858 lines
27 KiB
C
858 lines
27 KiB
C
/*
|
|
* mod_reqin_log.c - Apache HTTPD module for logging HTTP requests as JSON to Unix socket
|
|
*
|
|
* Copyright (c) 2026. All rights reserved.
|
|
*/
|
|
|
|
#include "httpd.h"
|
|
#include "http_config.h"
|
|
#include "http_core.h"
|
|
#include "http_log.h"
|
|
#include "http_protocol.h"
|
|
#include "http_request.h"
|
|
#include "mod_reqin_log.h"
|
|
#include "apr_strings.h"
|
|
#include "apr_time.h"
|
|
#include "apr_lib.h"
|
|
#include "ap_config.h"
|
|
|
|
#include <sys/socket.h>
|
|
#include <sys/un.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <time.h>
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <limits.h>
|
|
|
|
/* Maximum Unix socket path length (sun_path is typically 108 bytes) */
|
|
#define MAX_SOCKET_PATH_LEN (sizeof(((struct sockaddr_un *)0)->sun_path) - 1)
|
|
|
|
/* Maximum JSON log line size (64KB) - prevents memory exhaustion DoS */
|
|
#define MAX_JSON_SIZE (64 * 1024)
|
|
|
|
/* Default sensitive headers blacklist - prevents accidental logging of credentials */
|
|
static const char *const DEFAULT_SENSITIVE_HEADERS[] = {
|
|
"Authorization",
|
|
"Cookie",
|
|
"Set-Cookie",
|
|
"X-Api-Key",
|
|
"X-Auth-Token",
|
|
"Proxy-Authorization",
|
|
"WWW-Authenticate",
|
|
NULL
|
|
};
|
|
|
|
/* Dynamic string buffer */
|
|
typedef struct {
|
|
char *data;
|
|
apr_size_t len;
|
|
apr_size_t capacity;
|
|
apr_pool_t *pool;
|
|
} dynbuf_t;
|
|
|
|
/* Per-child process state - stored in server config
|
|
* Includes mutex for thread safety in worker/event MPMs */
|
|
typedef struct {
|
|
int socket_fd;
|
|
apr_thread_mutex_t *fd_mutex; /* Protects socket_fd from concurrent access */
|
|
apr_time_t last_connect_attempt;
|
|
apr_time_t last_error_report;
|
|
int connect_failed;
|
|
} reqin_log_child_state_t;
|
|
|
|
/* Module server configuration structure */
|
|
typedef struct {
|
|
reqin_log_config_t *config;
|
|
reqin_log_child_state_t child_state;
|
|
} reqin_log_server_conf_t;
|
|
|
|
/* Forward declarations for helper functions */
|
|
static void dynbuf_append(dynbuf_t *db, const char *str, apr_size_t len);
|
|
static void append_json_string(dynbuf_t *db, const char *str);
|
|
static void format_iso8601(dynbuf_t *db, apr_time_t t);
|
|
static int parse_int_strict(const char *arg, int *out);
|
|
|
|
/* Forward declarations for server config */
|
|
static void *reqin_log_create_server_conf(apr_pool_t *pool, server_rec *s);
|
|
|
|
/* Forward declarations for commands */
|
|
static const char *cmd_set_enabled(cmd_parms *cmd, void *dummy, int flag);
|
|
static const char *cmd_set_socket(cmd_parms *cmd, void *dummy, const char *arg);
|
|
static const char *cmd_set_headers(cmd_parms *cmd, void *dummy, const char *arg);
|
|
static const char *cmd_set_max_headers(cmd_parms *cmd, void *dummy, const char *arg);
|
|
static const char *cmd_set_max_header_value_len(cmd_parms *cmd, void *dummy, const char *arg);
|
|
static const char *cmd_set_reconnect_interval(cmd_parms *cmd, void *dummy, const char *arg);
|
|
static const char *cmd_set_error_report_interval(cmd_parms *cmd, void *dummy, const char *arg);
|
|
|
|
/* Forward declarations for hooks */
|
|
static int reqin_log_post_read_request(request_rec *r);
|
|
static void reqin_log_child_init(apr_pool_t *p, server_rec *s);
|
|
static int reqin_log_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s);
|
|
static void reqin_log_register_hooks(apr_pool_t *p);
|
|
|
|
/* Command table */
|
|
static const command_rec reqin_log_cmds[] = {
|
|
AP_INIT_FLAG("JsonSockLogEnabled", cmd_set_enabled, NULL, RSRC_CONF,
|
|
"Enable or disable mod_reqin_log (On|Off)"),
|
|
AP_INIT_TAKE1("JsonSockLogSocket", cmd_set_socket, NULL, RSRC_CONF,
|
|
"Unix domain socket path for JSON logging"),
|
|
AP_INIT_ITERATE("JsonSockLogHeaders", cmd_set_headers, NULL, RSRC_CONF,
|
|
"List of HTTP header names to log"),
|
|
AP_INIT_TAKE1("JsonSockLogMaxHeaders", cmd_set_max_headers, NULL, RSRC_CONF,
|
|
"Maximum number of headers to log (default: 10)"),
|
|
AP_INIT_TAKE1("JsonSockLogMaxHeaderValueLen", cmd_set_max_header_value_len, NULL, RSRC_CONF,
|
|
"Maximum length of header value to log (default: 256)"),
|
|
AP_INIT_TAKE1("JsonSockLogReconnectInterval", cmd_set_reconnect_interval, NULL, RSRC_CONF,
|
|
"Reconnect interval in seconds (default: 10)"),
|
|
AP_INIT_TAKE1("JsonSockLogErrorReportInterval", cmd_set_error_report_interval, NULL, RSRC_CONF,
|
|
"Error report interval in seconds (default: 10)"),
|
|
{ NULL }
|
|
};
|
|
|
|
/* Module definition */
|
|
module AP_MODULE_DECLARE_DATA reqin_log_module = {
|
|
STANDARD20_MODULE_STUFF,
|
|
NULL, /* per-directory config creator */
|
|
NULL, /* dir config merger */
|
|
reqin_log_create_server_conf, /* server config creator */
|
|
NULL, /* server config merger */
|
|
reqin_log_cmds, /* command table */
|
|
reqin_log_register_hooks /* register hooks */
|
|
};
|
|
|
|
/* Get module configuration */
|
|
static reqin_log_server_conf_t *get_server_conf(server_rec *s)
|
|
{
|
|
return (reqin_log_server_conf_t *)ap_get_module_config(s->module_config, &reqin_log_module);
|
|
}
|
|
|
|
/* Create server configuration */
|
|
static void *reqin_log_create_server_conf(apr_pool_t *pool, server_rec *s)
|
|
{
|
|
(void)s;
|
|
reqin_log_server_conf_t *srv_conf = apr_pcalloc(pool, sizeof(reqin_log_server_conf_t));
|
|
|
|
srv_conf->config = apr_pcalloc(pool, sizeof(reqin_log_config_t));
|
|
srv_conf->config->headers = apr_array_make(pool, 5, sizeof(const char *));
|
|
srv_conf->config->max_headers = DEFAULT_MAX_HEADERS;
|
|
srv_conf->config->max_header_value_len = DEFAULT_MAX_HEADER_VALUE_LEN;
|
|
srv_conf->config->reconnect_interval = DEFAULT_RECONNECT_INTERVAL;
|
|
srv_conf->config->error_report_interval = DEFAULT_ERROR_REPORT_INTERVAL;
|
|
|
|
srv_conf->child_state.socket_fd = -1;
|
|
srv_conf->child_state.fd_mutex = NULL;
|
|
srv_conf->child_state.last_connect_attempt = 0;
|
|
srv_conf->child_state.last_error_report = 0;
|
|
srv_conf->child_state.connect_failed = 0;
|
|
|
|
return srv_conf;
|
|
}
|
|
|
|
/* ============== Dynamic Buffer Functions ============== */
|
|
|
|
static void dynbuf_init(dynbuf_t *db, apr_pool_t *pool, apr_size_t initial_capacity)
|
|
{
|
|
db->pool = pool;
|
|
db->capacity = initial_capacity;
|
|
db->len = 0;
|
|
db->data = apr_palloc(pool, initial_capacity);
|
|
db->data[0] = '\0';
|
|
}
|
|
|
|
static void dynbuf_append(dynbuf_t *db, const char *str, apr_size_t len)
|
|
{
|
|
if (str == NULL) return;
|
|
|
|
if (len == (apr_size_t)-1) {
|
|
len = strlen(str);
|
|
}
|
|
|
|
if (db->len + len >= db->capacity) {
|
|
apr_size_t new_capacity = (db->len + len + 1) * 2;
|
|
char *new_data = apr_palloc(db->pool, new_capacity);
|
|
memcpy(new_data, db->data, db->len);
|
|
db->data = new_data;
|
|
db->capacity = new_capacity;
|
|
}
|
|
|
|
memcpy(db->data + db->len, str, len);
|
|
db->len += len;
|
|
db->data[db->len] = '\0';
|
|
}
|
|
|
|
static void dynbuf_append_char(dynbuf_t *db, char c)
|
|
{
|
|
if (db->len + 1 >= db->capacity) {
|
|
apr_size_t new_capacity = db->capacity * 2;
|
|
char *new_data = apr_palloc(db->pool, new_capacity);
|
|
memcpy(new_data, db->data, db->len);
|
|
db->data = new_data;
|
|
db->capacity = new_capacity;
|
|
}
|
|
db->data[db->len++] = c;
|
|
db->data[db->len] = '\0';
|
|
}
|
|
|
|
/* ============== JSON Helper Functions ============== */
|
|
|
|
static void append_json_string(dynbuf_t *db, const char *str)
|
|
{
|
|
if (str == NULL) {
|
|
return;
|
|
}
|
|
|
|
for (const char *p = str; *p; p++) {
|
|
char c = *p;
|
|
switch (c) {
|
|
case '"': dynbuf_append(db, "\\\"", 2); break;
|
|
case '\\': dynbuf_append(db, "\\\\", 2); break;
|
|
case '\b': dynbuf_append(db, "\\b", 2); break;
|
|
case '\f': dynbuf_append(db, "\\f", 2); break;
|
|
case '\n': dynbuf_append(db, "\\n", 2); break;
|
|
case '\r': dynbuf_append(db, "\\r", 2); break;
|
|
case '\t': dynbuf_append(db, "\\t", 2); break;
|
|
default:
|
|
if ((unsigned char)c < 0x20) {
|
|
char unicode[8];
|
|
snprintf(unicode, sizeof(unicode), "\\u%04x", (unsigned char)c);
|
|
dynbuf_append(db, unicode, -1);
|
|
} else {
|
|
dynbuf_append_char(db, c);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
static void format_iso8601(dynbuf_t *db, apr_time_t t)
|
|
{
|
|
apr_time_exp_t tm;
|
|
apr_time_exp_gmt(&tm, t);
|
|
|
|
char time_str[32];
|
|
snprintf(time_str, sizeof(time_str), "%04d-%02d-%02dT%02d:%02d:%02dZ",
|
|
tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
|
|
tm.tm_hour, tm.tm_min, tm.tm_sec);
|
|
dynbuf_append(db, time_str, -1);
|
|
}
|
|
|
|
static int parse_int_strict(const char *arg, int *out)
|
|
{
|
|
char *end = NULL;
|
|
long v;
|
|
if (arg == NULL || *arg == '\0' || out == NULL) return -1;
|
|
errno = 0;
|
|
v = strtol(arg, &end, 10);
|
|
if (errno != 0 || end == arg || *end != '\0' || v < INT_MIN || v > INT_MAX) return -1;
|
|
*out = (int)v;
|
|
return 0;
|
|
}
|
|
|
|
/* ============== Configuration Command Handlers ============== */
|
|
|
|
static const char *cmd_set_enabled(cmd_parms *cmd, void *dummy, int flag)
|
|
{
|
|
(void)dummy;
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cmd->server);
|
|
if (srv_conf == NULL) {
|
|
return "Internal error: server configuration not available";
|
|
}
|
|
srv_conf->config->enabled = flag ? 1 : 0;
|
|
return NULL;
|
|
}
|
|
|
|
static const char *cmd_set_socket(cmd_parms *cmd, void *dummy, const char *arg)
|
|
{
|
|
(void)dummy;
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cmd->server);
|
|
if (srv_conf == NULL) {
|
|
return "Internal error: server configuration not available";
|
|
}
|
|
if (arg == NULL || *arg == '\0') {
|
|
return "JsonSockLogSocket must be a non-empty Unix socket path";
|
|
}
|
|
if (strlen(arg) >= MAX_SOCKET_PATH_LEN) {
|
|
return "JsonSockLogSocket path is too long for Unix domain socket";
|
|
}
|
|
srv_conf->config->socket_path = apr_pstrdup(cmd->pool, arg);
|
|
return NULL;
|
|
}
|
|
|
|
static const char *cmd_set_headers(cmd_parms *cmd, void *dummy, const char *arg)
|
|
{
|
|
(void)dummy;
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cmd->server);
|
|
if (srv_conf == NULL) {
|
|
return "Internal error: server configuration not available";
|
|
}
|
|
*(const char **)apr_array_push(srv_conf->config->headers) = apr_pstrdup(cmd->pool, arg);
|
|
return NULL;
|
|
}
|
|
|
|
static const char *cmd_set_max_headers(cmd_parms *cmd, void *dummy, const char *arg)
|
|
{
|
|
int val;
|
|
(void)dummy;
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cmd->server);
|
|
if (srv_conf == NULL) {
|
|
return "Internal error: server configuration not available";
|
|
}
|
|
if (parse_int_strict(arg, &val) != 0) {
|
|
return "JsonSockLogMaxHeaders must be a valid integer";
|
|
}
|
|
if (val < 0) {
|
|
return "JsonSockLogMaxHeaders must be >= 0";
|
|
}
|
|
srv_conf->config->max_headers = val;
|
|
return NULL;
|
|
}
|
|
|
|
static const char *cmd_set_max_header_value_len(cmd_parms *cmd, void *dummy, const char *arg)
|
|
{
|
|
int val;
|
|
(void)dummy;
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cmd->server);
|
|
if (srv_conf == NULL) {
|
|
return "Internal error: server configuration not available";
|
|
}
|
|
if (parse_int_strict(arg, &val) != 0) {
|
|
return "JsonSockLogMaxHeaderValueLen must be a valid integer";
|
|
}
|
|
if (val < 1) {
|
|
return "JsonSockLogMaxHeaderValueLen must be >= 1";
|
|
}
|
|
srv_conf->config->max_header_value_len = val;
|
|
return NULL;
|
|
}
|
|
|
|
static const char *cmd_set_reconnect_interval(cmd_parms *cmd, void *dummy, const char *arg)
|
|
{
|
|
int val;
|
|
(void)dummy;
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cmd->server);
|
|
if (srv_conf == NULL) {
|
|
return "Internal error: server configuration not available";
|
|
}
|
|
if (parse_int_strict(arg, &val) != 0) {
|
|
return "JsonSockLogReconnectInterval must be a valid integer";
|
|
}
|
|
if (val < 0) {
|
|
return "JsonSockLogReconnectInterval must be >= 0";
|
|
}
|
|
srv_conf->config->reconnect_interval = val;
|
|
return NULL;
|
|
}
|
|
|
|
static const char *cmd_set_error_report_interval(cmd_parms *cmd, void *dummy, const char *arg)
|
|
{
|
|
int val;
|
|
(void)dummy;
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cmd->server);
|
|
if (srv_conf == NULL) {
|
|
return "Internal error: server configuration not available";
|
|
}
|
|
if (parse_int_strict(arg, &val) != 0) {
|
|
return "JsonSockLogErrorReportInterval must be a valid integer";
|
|
}
|
|
if (val < 0) {
|
|
return "JsonSockLogErrorReportInterval must be >= 0";
|
|
}
|
|
srv_conf->config->error_report_interval = val;
|
|
return NULL;
|
|
}
|
|
|
|
/* ============== Socket Functions ============== */
|
|
|
|
/**
|
|
* Check if a header name is in the sensitive headers blacklist.
|
|
* Returns 1 if header should be excluded, 0 otherwise.
|
|
*/
|
|
static int is_sensitive_header(const char *name)
|
|
{
|
|
if (name == NULL) {
|
|
return 0;
|
|
}
|
|
|
|
for (int i = 0; DEFAULT_SENSITIVE_HEADERS[i] != NULL; i++) {
|
|
if (strcasecmp(name, DEFAULT_SENSITIVE_HEADERS[i]) == 0) {
|
|
return 1;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/* Mutex helper macros for thread-safe socket FD access */
|
|
#define FD_MUTEX_LOCK(state) do { \
|
|
if ((state)->fd_mutex) { \
|
|
apr_thread_mutex_lock((state)->fd_mutex); \
|
|
} \
|
|
} while(0)
|
|
|
|
#define FD_MUTEX_UNLOCK(state) do { \
|
|
if ((state)->fd_mutex) { \
|
|
apr_thread_mutex_unlock((state)->fd_mutex); \
|
|
} \
|
|
} while(0)
|
|
|
|
static int try_connect(reqin_log_config_t *cfg, reqin_log_child_state_t *state, server_rec *s)
|
|
{
|
|
apr_time_t now;
|
|
apr_time_t reconnect_interval;
|
|
apr_time_t error_interval;
|
|
int err = 0;
|
|
int should_report = 0;
|
|
int fd;
|
|
int flags;
|
|
struct sockaddr_un addr;
|
|
int rc;
|
|
|
|
if (cfg == NULL || state == NULL || s == NULL || cfg->socket_path == NULL || cfg->socket_path[0] == '\0') {
|
|
return -1;
|
|
}
|
|
|
|
if (strlen(cfg->socket_path) >= MAX_SOCKET_PATH_LEN) {
|
|
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
|
|
MOD_REQIN_LOG_NAME ": Unix socket path too long, cannot connect");
|
|
return -1;
|
|
}
|
|
|
|
now = apr_time_now();
|
|
reconnect_interval = apr_time_from_sec(cfg->reconnect_interval);
|
|
error_interval = apr_time_from_sec(cfg->error_report_interval);
|
|
|
|
FD_MUTEX_LOCK(state);
|
|
|
|
if (state->connect_failed &&
|
|
(now - state->last_connect_attempt) < reconnect_interval) {
|
|
FD_MUTEX_UNLOCK(state);
|
|
return -1;
|
|
}
|
|
|
|
state->last_connect_attempt = now;
|
|
|
|
if (state->socket_fd < 0) {
|
|
state->socket_fd = socket(AF_UNIX, SOCK_STREAM, 0);
|
|
if (state->socket_fd < 0) {
|
|
err = errno;
|
|
state->connect_failed = 1;
|
|
if ((now - state->last_error_report) >= error_interval) {
|
|
state->last_error_report = now;
|
|
should_report = 1;
|
|
}
|
|
FD_MUTEX_UNLOCK(state);
|
|
|
|
if (should_report) {
|
|
ap_log_error(APLOG_MARK, APLOG_ERR, err, s,
|
|
MOD_REQIN_LOG_NAME ": Unix socket connect failed: cannot create socket");
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
flags = fcntl(state->socket_fd, F_GETFL, 0);
|
|
if (flags < 0) {
|
|
flags = 0;
|
|
}
|
|
fcntl(state->socket_fd, F_SETFL, flags | O_NONBLOCK);
|
|
}
|
|
|
|
fd = state->socket_fd;
|
|
memset(&addr, 0, sizeof(addr));
|
|
addr.sun_family = AF_UNIX;
|
|
snprintf(addr.sun_path, sizeof(addr.sun_path), "%s", cfg->socket_path);
|
|
|
|
rc = connect(fd, (struct sockaddr *)&addr, sizeof(addr));
|
|
if (rc < 0) {
|
|
err = errno;
|
|
if (err == EINPROGRESS || err == EAGAIN || err == EWOULDBLOCK || err == EALREADY || err == EISCONN) {
|
|
state->connect_failed = 0;
|
|
FD_MUTEX_UNLOCK(state);
|
|
return 0;
|
|
}
|
|
|
|
close(fd);
|
|
state->socket_fd = -1;
|
|
state->connect_failed = 1;
|
|
if ((now - state->last_error_report) >= error_interval) {
|
|
state->last_error_report = now;
|
|
should_report = 1;
|
|
}
|
|
FD_MUTEX_UNLOCK(state);
|
|
|
|
if (should_report) {
|
|
ap_log_error(APLOG_MARK, APLOG_ERR, err, s,
|
|
MOD_REQIN_LOG_NAME ": Unix socket connect failed: %s", cfg->socket_path);
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
state->connect_failed = 0;
|
|
FD_MUTEX_UNLOCK(state);
|
|
return 0;
|
|
}
|
|
|
|
static int ensure_connected(reqin_log_config_t *cfg, reqin_log_child_state_t *state, server_rec *s)
|
|
{
|
|
int connected;
|
|
|
|
FD_MUTEX_LOCK(state);
|
|
connected = (state->socket_fd >= 0 && !state->connect_failed);
|
|
FD_MUTEX_UNLOCK(state);
|
|
|
|
if (connected) {
|
|
return 0;
|
|
}
|
|
|
|
return try_connect(cfg, state, s);
|
|
}
|
|
|
|
static int write_to_socket(const char *data, apr_size_t len, server_rec *s,
|
|
reqin_log_config_t *cfg, reqin_log_child_state_t *state)
|
|
{
|
|
int fd;
|
|
apr_size_t total_written = 0;
|
|
apr_time_t error_interval = apr_time_from_sec(cfg->error_report_interval);
|
|
|
|
FD_MUTEX_LOCK(state);
|
|
|
|
fd = state->socket_fd;
|
|
if (fd < 0) {
|
|
FD_MUTEX_UNLOCK(state);
|
|
return -1;
|
|
}
|
|
|
|
while (total_written < len) {
|
|
ssize_t n = write(fd, data + total_written, len - total_written);
|
|
if (n < 0) {
|
|
int err = errno;
|
|
apr_time_t now = apr_time_now();
|
|
int should_report = 0;
|
|
int conn_lost = (err == EPIPE || err == ECONNRESET || err == ENOTCONN);
|
|
|
|
if (conn_lost) {
|
|
close(fd);
|
|
state->socket_fd = -1;
|
|
state->connect_failed = 1;
|
|
}
|
|
|
|
if (err != EAGAIN && err != EWOULDBLOCK &&
|
|
(now - state->last_error_report) >= error_interval) {
|
|
state->last_error_report = now;
|
|
should_report = 1;
|
|
}
|
|
|
|
FD_MUTEX_UNLOCK(state);
|
|
|
|
if (should_report) {
|
|
if (conn_lost) {
|
|
ap_log_error(APLOG_MARK, APLOG_ERR, err, s,
|
|
MOD_REQIN_LOG_NAME ": Unix socket write failed: connection lost");
|
|
} else {
|
|
ap_log_error(APLOG_MARK, APLOG_ERR, err, s,
|
|
MOD_REQIN_LOG_NAME ": Unix socket write failed");
|
|
}
|
|
}
|
|
|
|
return -1;
|
|
}
|
|
|
|
total_written += (apr_size_t)n;
|
|
}
|
|
|
|
FD_MUTEX_UNLOCK(state);
|
|
return 0;
|
|
}
|
|
|
|
/* ============== Request Logging Functions ============== */
|
|
|
|
static const char *get_header(request_rec *r, const char *name)
|
|
{
|
|
const apr_table_t *headers = r->headers_in;
|
|
apr_array_header_t *arr = apr_table_elts(headers);
|
|
apr_table_entry_t *elts = (apr_table_entry_t *)arr->elts;
|
|
int nelts = arr->nelts;
|
|
|
|
for (int i = 0; i < nelts; i++) {
|
|
if (elts[i].key != NULL && strcasecmp(elts[i].key, name) == 0) {
|
|
return elts[i].val;
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
static void log_request(request_rec *r, reqin_log_config_t *cfg, reqin_log_child_state_t *state)
|
|
{
|
|
apr_pool_t *pool;
|
|
server_rec *s;
|
|
dynbuf_t buf;
|
|
char port_buf[16];
|
|
const char *src_ip;
|
|
const char *dst_ip;
|
|
const char *method;
|
|
const char *path;
|
|
const char *host;
|
|
const char *http_version;
|
|
|
|
if (!r || !r->server || !r->pool || !r->connection) {
|
|
return;
|
|
}
|
|
|
|
pool = r->pool;
|
|
s = r->server;
|
|
|
|
if (ensure_connected(cfg, state, s) < 0) {
|
|
return;
|
|
}
|
|
|
|
src_ip = r->useragent_ip ? r->useragent_ip :
|
|
(r->connection->client_ip ? r->connection->client_ip : "");
|
|
dst_ip = r->connection->local_ip ? r->connection->local_ip : "";
|
|
method = r->method ? r->method : "UNKNOWN";
|
|
path = r->parsed_uri.path ? r->parsed_uri.path : "/";
|
|
host = apr_table_get(r->headers_in, "Host");
|
|
if (host == NULL) {
|
|
host = "";
|
|
}
|
|
http_version = r->protocol ? r->protocol : "UNKNOWN";
|
|
|
|
dynbuf_init(&buf, pool, 4096);
|
|
|
|
dynbuf_append(&buf, "{", 1);
|
|
|
|
/* time */
|
|
dynbuf_append(&buf, "\"time\":\"", 8);
|
|
format_iso8601(&buf, r->request_time);
|
|
dynbuf_append(&buf, "\",", 2);
|
|
|
|
/* timestamp (nanoseconds since epoch) */
|
|
{
|
|
apr_time_t now = apr_time_now();
|
|
apr_uint64_t ns = (apr_uint64_t)now * 1000;
|
|
char ts_buf[32];
|
|
snprintf(ts_buf, sizeof(ts_buf), "%" APR_UINT64_T_FMT, ns);
|
|
dynbuf_append(&buf, "\"timestamp\":", 12);
|
|
dynbuf_append(&buf, ts_buf, -1);
|
|
dynbuf_append(&buf, ",", 1);
|
|
}
|
|
|
|
/* src_ip */
|
|
dynbuf_append(&buf, "\"src_ip\":\"", 10);
|
|
append_json_string(&buf, src_ip);
|
|
dynbuf_append(&buf, "\",", 2);
|
|
|
|
/* src_port */
|
|
if (r->connection->client_addr != NULL) {
|
|
snprintf(port_buf, sizeof(port_buf), "%u", (unsigned int)r->connection->client_addr->port);
|
|
} else {
|
|
snprintf(port_buf, sizeof(port_buf), "0");
|
|
}
|
|
dynbuf_append(&buf, "\"src_port\":", 11);
|
|
dynbuf_append(&buf, port_buf, -1);
|
|
dynbuf_append(&buf, ",", 1);
|
|
|
|
/* dst_ip */
|
|
dynbuf_append(&buf, "\"dst_ip\":\"", 10);
|
|
append_json_string(&buf, dst_ip);
|
|
dynbuf_append(&buf, "\",", 2);
|
|
|
|
/* dst_port */
|
|
if (r->connection->local_addr != NULL) {
|
|
snprintf(port_buf, sizeof(port_buf), "%u", (unsigned int)r->connection->local_addr->port);
|
|
} else {
|
|
snprintf(port_buf, sizeof(port_buf), "0");
|
|
}
|
|
dynbuf_append(&buf, "\"dst_port\":", 11);
|
|
dynbuf_append(&buf, port_buf, -1);
|
|
dynbuf_append(&buf, ",", 1);
|
|
|
|
/* method */
|
|
dynbuf_append(&buf, "\"method\":\"", 10);
|
|
append_json_string(&buf, method);
|
|
dynbuf_append(&buf, "\",", 2);
|
|
|
|
/* path */
|
|
dynbuf_append(&buf, "\"path\":\"", 8);
|
|
append_json_string(&buf, path);
|
|
dynbuf_append(&buf, "\",", 2);
|
|
|
|
/* host */
|
|
dynbuf_append(&buf, "\"host\":\"", 8);
|
|
append_json_string(&buf, host);
|
|
dynbuf_append(&buf, "\",", 2);
|
|
|
|
/* http_version */
|
|
dynbuf_append(&buf, "\"http_version\":\"", 16);
|
|
append_json_string(&buf, http_version);
|
|
dynbuf_append(&buf, "\"", 1);
|
|
|
|
/* Check buffer size before adding headers to prevent memory exhaustion */
|
|
if (buf.len >= MAX_JSON_SIZE) {
|
|
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
|
|
MOD_REQIN_LOG_NAME ": JSON buffer size limit reached before headers");
|
|
return;
|
|
}
|
|
|
|
/* headers - flat structure at same level as other fields */
|
|
if (cfg->headers && cfg->headers->nelts > 0) {
|
|
int header_count = 0;
|
|
int max_to_log = cfg->max_headers;
|
|
const char **header_names = (const char **)cfg->headers->elts;
|
|
|
|
for (int i = 0; i < cfg->headers->nelts && header_count < max_to_log; i++) {
|
|
const char *header_name = header_names[i];
|
|
const char *header_value;
|
|
|
|
/* Skip sensitive headers to prevent credential leakage */
|
|
if (is_sensitive_header(header_name)) {
|
|
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
|
|
MOD_REQIN_LOG_NAME ": Skipping sensitive header: %s", header_name);
|
|
continue;
|
|
}
|
|
|
|
header_value = get_header(r, header_name);
|
|
|
|
if (header_value != NULL) {
|
|
apr_size_t header_contrib = 9 + strlen(header_name) + 3 + strlen(header_value) + 1;
|
|
apr_size_t val_len;
|
|
char *truncated;
|
|
|
|
if (buf.len + header_contrib >= MAX_JSON_SIZE) {
|
|
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
|
|
MOD_REQIN_LOG_NAME ": JSON size limit reached, truncating headers");
|
|
break;
|
|
}
|
|
|
|
dynbuf_append(&buf, ",\"header_", 9);
|
|
append_json_string(&buf, header_name);
|
|
dynbuf_append(&buf, "\":\"", 3);
|
|
|
|
val_len = strlen(header_value);
|
|
if ((int)val_len > cfg->max_header_value_len) {
|
|
val_len = (apr_size_t)cfg->max_header_value_len;
|
|
}
|
|
|
|
truncated = apr_pstrmemdup(pool, header_value, val_len);
|
|
append_json_string(&buf, truncated);
|
|
dynbuf_append(&buf, "\"", 1);
|
|
|
|
header_count++;
|
|
}
|
|
}
|
|
}
|
|
|
|
dynbuf_append(&buf, "}\n", 2);
|
|
|
|
if (buf.len > MAX_JSON_SIZE) {
|
|
apr_time_t now = apr_time_now();
|
|
apr_time_t error_interval = apr_time_from_sec(cfg->error_report_interval);
|
|
int should_report = 0;
|
|
|
|
FD_MUTEX_LOCK(state);
|
|
if ((now - state->last_error_report) >= error_interval) {
|
|
state->last_error_report = now;
|
|
should_report = 1;
|
|
}
|
|
FD_MUTEX_UNLOCK(state);
|
|
|
|
if (should_report) {
|
|
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
|
|
MOD_REQIN_LOG_NAME ": JSON log line exceeds maximum size, dropping");
|
|
}
|
|
return;
|
|
}
|
|
|
|
write_to_socket(buf.data, buf.len, s, cfg, state);
|
|
}
|
|
|
|
/* ============== Apache Hooks ============== */
|
|
|
|
static int reqin_log_post_read_request(request_rec *r)
|
|
{
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(r->server);
|
|
|
|
if (srv_conf == NULL || srv_conf->config == NULL ||
|
|
!srv_conf->config->enabled || srv_conf->config->socket_path == NULL) {
|
|
return DECLINED;
|
|
}
|
|
|
|
log_request(r, srv_conf->config, &srv_conf->child_state);
|
|
return DECLINED;
|
|
}
|
|
|
|
static void reqin_log_child_init(apr_pool_t *p, server_rec *s)
|
|
{
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(s);
|
|
|
|
if (srv_conf == NULL) {
|
|
return;
|
|
}
|
|
|
|
srv_conf->child_state.socket_fd = -1;
|
|
srv_conf->child_state.last_connect_attempt = 0;
|
|
srv_conf->child_state.last_error_report = 0;
|
|
srv_conf->child_state.connect_failed = 0;
|
|
|
|
srv_conf->child_state.fd_mutex = NULL;
|
|
if (apr_thread_mutex_create(&srv_conf->child_state.fd_mutex,
|
|
APR_THREAD_MUTEX_DEFAULT, p) != APR_SUCCESS) {
|
|
srv_conf->child_state.fd_mutex = NULL;
|
|
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
|
|
MOD_REQIN_LOG_NAME ": Failed to create mutex, continuing in degraded mode");
|
|
}
|
|
|
|
if (srv_conf->config == NULL || !srv_conf->config->enabled ||
|
|
srv_conf->config->socket_path == NULL) {
|
|
return;
|
|
}
|
|
|
|
try_connect(srv_conf->config, &srv_conf->child_state, s);
|
|
}
|
|
|
|
static int reqin_log_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
|
|
{
|
|
server_rec *cur;
|
|
|
|
(void)pconf;
|
|
(void)plog;
|
|
(void)ptemp;
|
|
|
|
for (cur = s; cur != NULL; cur = cur->next) {
|
|
reqin_log_server_conf_t *srv_conf = get_server_conf(cur);
|
|
reqin_log_config_t *cfg;
|
|
|
|
if (srv_conf == NULL || srv_conf->config == NULL) {
|
|
continue;
|
|
}
|
|
|
|
cfg = srv_conf->config;
|
|
if (!cfg->enabled) {
|
|
continue;
|
|
}
|
|
|
|
if (cfg->socket_path == NULL || cfg->socket_path[0] == '\0') {
|
|
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, cur,
|
|
MOD_REQIN_LOG_NAME ": JsonSockLogEnabled is On but JsonSockLogSocket is missing");
|
|
return HTTP_INTERNAL_SERVER_ERROR;
|
|
}
|
|
|
|
if (strlen(cfg->socket_path) >= MAX_SOCKET_PATH_LEN) {
|
|
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, cur,
|
|
MOD_REQIN_LOG_NAME ": JsonSockLogSocket path too long (max %d)", (int)MAX_SOCKET_PATH_LEN - 1);
|
|
return HTTP_INTERNAL_SERVER_ERROR;
|
|
}
|
|
}
|
|
|
|
return OK;
|
|
}
|
|
|
|
static void reqin_log_register_hooks(apr_pool_t *p)
|
|
{
|
|
(void)p;
|
|
ap_hook_post_config(reqin_log_post_config, NULL, NULL, APR_HOOK_MIDDLE);
|
|
ap_hook_post_read_request(reqin_log_post_read_request, NULL, NULL, APR_HOOK_MIDDLE);
|
|
ap_hook_child_init(reqin_log_child_init, NULL, NULL, APR_HOOK_MIDDLE);
|
|
}
|