Skip to content

iis: fail closed (HTTP 500) on ModSecurity config load failure #3617

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
A13501350 wants to merge 1 commit into
base: v2/master
Choose a base branch
from
+35 −8
Open

iis: fail closed (HTTP 500) on ModSecurity config load failure #3617

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions iis/moduleconfig.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

extern PVOID g_pModuleContext;

class MODSECURITY_STORED_CONTEXT : public IHttpStoredContext

Check warning on line 25 in iis/moduleconfig.h

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Don't mix public and private data members. 


See more on https://sonarcloud.io/project/issues?id=owasp-modsecurity_ModSecurity&issues=AaAqa6j6vKLTf8kMfjxs&open=AaAqa6j6vKLTf8kMfjxs&pullRequest=3617
{
public:
MODSECURITY_STORED_CONTEXT();
Expand Down Expand Up @@ -69,6 +69,9 @@

void* m_Config;

time_t configFailTime = 0;
bool configLoadingFailed = false;

private:
HRESULT
GetBooleanPropertyValue(
Expand Down
40 changes: 32 additions & 8 deletions iis/mymodule.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@
#undef inline
#define inline inline

#include <time.h>

#include "winsock2.h"

// IIS7 Server API header file
Expand Down Expand Up @@ -715,7 +717,7 @@
}

REQUEST_NOTIFICATION_STATUS
CMyHttpModule::OnBeginRequest(

Check failure on line 720 in iis/mymodule.cpp

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Refactor this function to reduce its Cognitive Complexity from 44 to the 25 allowed. 


See more on https://sonarcloud.io/project/issues?id=owasp-modsecurity_ModSecurity&issues=AaAqa6hPvKLTf8kMfjxq&open=AaAqa6hPvKLTf8kMfjxq&pullRequest=3617
IN IHttpContext * pHttpContext,
IN IHttpEventProvider * pProvider
)
Expand All @@ -726,6 +728,7 @@

UNREFERENCED_PARAMETER ( pProvider );

time_t curr_time = time(NULL);

Check failure on line 731 in iis/mymodule.cpp

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use the "nullptr" literal. 


See more on https://sonarcloud.io/project/issues?id=owasp-modsecurity_ModSecurity&issues=AaAqa6hPvKLTf8kMfjxr&open=AaAqa6hPvKLTf8kMfjxr&pullRequest=3617
EnterCriticalSection(&m_csLock);

if ( pHttpContext == NULL )
Expand All @@ -746,9 +749,9 @@

if ( FAILED( hr ) )
{
//hr = E_UNEXPECTED;
hr = S_OK;
goto Finished;
pHttpContext->GetResponse()->SetStatus(500, "WAF internal error. Unable to get config.");
pHttpContext->SetRequestHandled();
return RQ_NOTIFICATION_FINISH_REQUEST;
}

// If module is disabled, dont go any further
Expand All @@ -758,6 +761,26 @@
goto Finished;
}

auto reportConfigurationError = [pConfig, pHttpContext, this] {
pConfig->configLoadingFailed = true;
pHttpContext->GetResponse()->SetStatus(500, "WAF internal error. Invalid configuration.");
pHttpContext->SetRequestHandled();
LeaveCriticalSection(&m_csLock);
return RQ_NOTIFICATION_FINISH_REQUEST;
};

// If we previously failed to load the config, try again if 10sec passed
if (pConfig->configLoadingFailed)
{
if (difftime(curr_time, pConfig->configFailTime) < 10) {
return reportConfigurationError();
}
else {
WriteEventViewerLog("Recycling w3wp worker due to config load fail", EVENTLOG_ERROR_TYPE);
g_pHttpServer->RecycleProcess(L"ModSecurity config load failed");
}
}

if(pConfig->m_Config == NULL)
{
char *path;
Expand All @@ -767,8 +790,8 @@

if ( FAILED( hr ) )
{
hr = E_UNEXPECTED;
goto Finished;
pConfig->configFailTime = curr_time;
return reportConfigurationError();
}

pConfig->m_Config = modsecGetDefaultConfig();
Expand All @@ -782,8 +805,8 @@
if ( FAILED( hr ) )
{
delete path;
hr = E_UNEXPECTED;
goto Finished;
pConfig->configFailTime = curr_time;
return reportConfigurationError();
}

if(path[0] != 0)
Expand All @@ -793,9 +816,10 @@
if(err != NULL)
{
WriteEventViewerLog(err, EVENTLOG_ERROR_TYPE);
pConfig->configFailTime = curr_time;
delete apppath;
delete path;
goto Finished;
return reportConfigurationError();
}

modsecReportRemoteLoadedRules();
Expand Down
Loading