802ce75a80
Unify packaging: use Docker + fpm for DEB and RPM builds
...
- Add Dockerfile.package with multi-stage build (builder, package-builder, output)
- Update Makefile to add package, package-deb, package-rpm, and test-package targets
- Replace debhelper and rpmbuild with fpm for consistent packaging
- Both DEB and RPM packages now built from single Dockerfile
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com >
2026-02-27 15:31:55 +01:00
b5d093f8cb
Docs: update security documentation and hardening notes
...
architecture.yml:
- Update header_handling: document built-in sensitive headers blacklist
- Expand security section with hardening measures
- Add socket permissions, path recommendations, environment variable
README.md:
- Add new 'Built-in Sensitive Headers Blacklist' section
- Document all blocked headers (Authorization, Cookie, X-Api-Key, etc.)
- Update socket security: permissions 0o660, /var/run path, group membership
- Add hardening features: path validation, JSON size limit, NULL checks, mutex
- Fix JSON example (remove extra closing brace)
- Update socket consumer example with secure permissions (0o660)
- Add MOD_REQIN_LOG_SOCKET environment variable to example
- Update Fields table: header_<Name> flat structure description
- Add note about automatic sensitive header exclusion
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com >
2026-02-26 23:41:51 +01:00
e44059865b
Security: fix critical vulnerabilities and harden module
...
Security fixes:
#1 Buffer overflow: Validate socket path length against sun_path limit
- Add MAX_SOCKET_PATH_LEN constant
- Reject paths >= 108 bytes before snprintf
#2,#3 NULL pointer dereference: Add NULL checks
- r->connection->local_ip: use conditional append
- r->protocol: fallback to "UNKNOWN" if NULL
#4 Sensitive headers blacklist: Prevent credential leakage
- Add DEFAULT_SENSITIVE_HEADERS[] blacklist
- Block: Authorization, Cookie, Set-Cookie, X-Api-Key, etc.
- Log skipped headers at DEBUG level only
#5 Memory exhaustion DoS: Add MAX_JSON_SIZE limit (64KB)
- Check buffer size before adding headers
- Truncate header list if limit reached
#6 Socket permissions: Change 0o666 → 0o660
- Owner and group only (not world-writable)
- Apache user must be in socket's group
#7 Race condition: Add mutex for FD access in worker/event MPMs
- apr_thread_mutex_t protects socket_fd
- FD_MUTEX_LOCK/UNLOCK macros
- Created in reqin_log_create_server_conf()
#8 Timestamp overflow: Document 2262 limitation
- Add comment explaining apr_time_t limits
- Safe until ~2262 (uint64 nanoseconds)
#9 Error logging verbosity: Reduce information disclosure
- APLOG_ERR: Generic messages only
- APLOG_DEBUG: Detailed error information
#10 Socket path security: Move from /tmp to /var/run
- Update socket_consumer.py, test scripts
- Use environment variable MOD_REQIN_LOG_SOCKET
- More secure default location
Files modified:
- src/mod_reqin_log.c: All security fixes
- scripts/socket_consumer.py: Permissions, path
- scripts/run_integration_tests.sh: Path security
- scripts/test_unix_socket.sh: Path security
- tests/integration/test_integration.py: Path security
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com >
2026-02-26 23:37:30 +01:00
070c2a7bd2
Refactor: thread-safe per-process state and add tests
...
Major changes:
- Move child state from global variable to server config (reqin_log_server_conf_t)
- Add reqin_log_create_server_conf() for proper per-server initialization
- Fix thread safety for worker/event MPMs
- Add cmocka unit tests (test_module_real.c)
- Add Python integration tests (test_integration.py)
- Update CI workflow and Dockerfiles for test execution
- Fix: Remove child_exit hook (not in architecture.yml)
Tests:
- Unit tests: JSON escaping, ISO8601 formatting, header truncation
- Integration tests: basic_logging, header_limits, socket_unavailable, socket_loss
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com >
2026-02-26 23:28:45 +01:00
7cfd14fb65
Fix: add missing child_exit hook per architecture.yml
...
- Add reqin_log_child_exit() to close Unix socket on child exit
- Register hook with ap_hook_child_exit()
- Ensures clean socket cleanup as specified in architecture.yml
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com >
2026-02-26 14:04:47 +01:00
66549acf5c
Initial commit: mod_reqin_log Apache module
...
Features:
- JSON logging of HTTP requests to Unix domain socket
- Configurable HTTP headers logging (flat JSON structure)
- Header value truncation and count limits
- Automatic reconnect on socket disconnection
- Error reporting with throttling
Configuration directives:
- JsonSockLogEnabled: Enable/disable logging
- JsonSockLogSocket: Unix socket path
- JsonSockLogHeaders: List of headers to log
- JsonSockLogMaxHeaders: Maximum headers to log
- JsonSockLogMaxHeaderValueLen: Max header value length
- JsonSockLogReconnectInterval: Reconnect delay
- JsonSockLogErrorReportInterval: Error log throttle
Includes:
- Module source code (src/)
- Unit and integration tests (tests/, scripts/)
- Documentation (README.md, architecture.yml)
- Build configuration (CMakeLists.txt, Makefile)
- Packaging (deb/rpm)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com >
2026-02-26 13:55:07 +01:00
