fix: record real response status in IIS audit log F part - #2
Closed
A13501350 wants to merge 2 commits into
Closed
Conversation
The IIS connector never copied the HTTP response status into the request_rec, so r->status stayed 0 and the audit log rendered the F part as a bogus 'HTTP/1.1 500 Internal Server Error' (ap_get_status_line(0)) for every transaction. Set r->status and r->status_line from the raw HTTP_RESPONSE in OnSendResponse so the logging hook and relevant-status checks use the real response code.
The IIS connector never copies the response status into the request_rec; r->status is only set in OnSendResponse. A request superseded by an internal redirect (e.g. the IIS default document rewrite of "/" to "/iisstart.htm") never reaches OnSendResponse, so its r->status stays 0 and the audit log F part would record a bogus HTTP/1.1 500 Internal Server Error (ap_get_status_line(0)). Skip audit logging for such transactions unless they were actually intercepted. A blocked request always reaches OnSendResponse with r->status set (403), so it is unaffected.
Owner
Author
|
Closing: this PR was opened against the fork by mistake; the change targets upstream owasp-modsecurity/ModSecurity. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the audit log F-part status for the IIS connector.
Problem
The IIS connector never copies the HTTP response status into the
Apache
request_recused by the core engine.r->statusstays 0, soevery audit log entry records
500 Internal Server Error(
ap_get_status_line(0)) in the F part, even for perfectly normal200 responses.
Changes
iis/mymodule.cpp (
OnSendResponse): copy the real HTTP responsestatus and reason phrase from the IIS
HTTP_RESPONSEintor->statusand
r->status_linebefore the audit log runs.apache2/mod_security2.c (
hook_log_transaction, guarded by#if defined(VERSION_IIS)): a transaction superseded by an IISinternal redirect (e.g.
/→/iisstart.htm) never reachesOnSendResponse, so itsr->statusstays 0. Skip audit logging forsuch transactions unless the request was actually intercepted, instead
of recording a bogus 500.
The IIS connector change is in the C++ module (IIS-specific). The
mod_security2.c change is guarded so it only affects IIS builds; Apache
behavior is unchanged.
Verification
IIS test pipeline runs the CRS regression smoke suite (913/920/930/941);
audit log shows real 200 status F-parts and zero bogus 500s.