You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Jon Belanger <jo...@fidelissecurity.com> on 2012/11/08 23:23:47 UTC
[users@httpd] Using mod_ext_filter mode=input
I'm trying to intercept file upload requests using the mod_ext_filter module in input mode.
I've tried a few test commands to write the STDIN to a file, for example:
/usr/bin/tee /tmp/ext_filter_debug
And also tried a test script that does basically the same thing:
#!/bin/sh
cat - > /tmp/ext_filter_debug
If I send a large file I can see the request append /tmp/ext_filter_debug file, but as soon as the request completes, the file goes down to 0 bytes in both instances. I don't understand how this is even possible given that the module should have no idea what file I'm writing to.
Interestingly if I try this:
#!/bin/sh
cat - > /tmp/ext_filter_debug
cat /tmp/ext_filter_debug
The /tmp/ext_filter_debug file hangs out a while longer, duration depending on size, but then eventually goes to zero.
Eventually, I want to parse the request and encrypt the uploading file using openssl smime, but I don't understand how to work with the incoming request. The only error I see logged is:
(9) Bad file descriptor: apr_file_close(child input)
To /var/log/apach2/error.log. I tried LogLevel=debug and DebugLevel=9. LogStderr helps to see if I have a problem in the cmd script itself, but otherwise isn't much help.
Can any provide any examples for this use case?
Thank you,
Jon Belanger
Re: [users@httpd] Using mod_ext_filter mode=input
Posted by Jon Belanger <jo...@fidelissecurity.com>.
Hi Jeff,
Thanks for the response. I went ahead and compiled Apache 2.4 latest and that did clear the logged error. I'm still having trouble with the 0 file size, but I'm doing a sleep and a cp to a unique file in the cmd script to make the content persist in the FS. It does look like you're correct that another request is coming in, but it must be something internal. I'll continue to hack at it.
Best Regards,
Jon
From: Jeff Trawick <tr...@gmail.com>>
Reply-To: "users@httpd.apache.org<ma...@httpd.apache.org>" <us...@httpd.apache.org>>
Date: Monday, November 12, 2012 1:19 PM
To: "users@httpd.apache.org<ma...@httpd.apache.org>" <us...@httpd.apache.org>>
Subject: Re: [users@httpd] Using mod_ext_filter mode=input
On Mon, Nov 12, 2012 at 9:06 AM, Jon Belanger <jo...@fidelissecurity.com>> wrote:
Does anyone still maintain this? Any ideas?
Hi Jon,
The issue of the unexpected error (and message) matches this recent fix to trunk and 2.4.x:
http://svn.apache.org/viewvc?view=revision&revision=1364606
The patch looks quite simple to try with 2.2.x. Can you how much that helps? (I don't know what else would happen besides the message.)
With the patch in place, I successfully ran the first example you gave, like so:
extfilterdefine tee \
cmd="/usr/bin/tee /tmp/ext_filter_debug" \
mode=input
setinputfilter tee
Is it possible that your testing showed the file going to zero because of some other request hitting the server (with no body)?
Thank you,
Jon
From: Jon Belanger <jo...@fidelissecurity.com>>
Reply-To: "users@httpd.apache.org<ma...@httpd.apache.org>" <us...@httpd.apache.org>>
Date: Thursday, November 8, 2012 5:23 PM
To: "users@httpd.apache.org<ma...@httpd.apache.org>" <us...@httpd.apache.org>>
Subject: [users@httpd] Using mod_ext_filter mode=input
I'm trying to intercept file upload requests using the mod_ext_filter module in input mode.
I've tried a few test commands to write the STDIN to a file, for example:
/usr/bin/tee /tmp/ext_filter_debug
And also tried a test script that does basically the same thing:
#!/bin/sh
cat - > /tmp/ext_filter_debug
If I send a large file I can see the request append /tmp/ext_filter_debug file, but as soon as the request completes, the file goes down to 0 bytes in both instances. I don't understand how this is even possible given that the module should have no idea what file I'm writing to.
Interestingly if I try this:
#!/bin/sh
cat - > /tmp/ext_filter_debug
cat /tmp/ext_filter_debug
The /tmp/ext_filter_debug file hangs out a while longer, duration depending on size, but then eventually goes to zero.
Eventually, I want to parse the request and encrypt the uploading file using openssl smime, but I don't understand how to work with the incoming request. The only error I see logged is:
(9) Bad file descriptor: apr_file_close(child input)
To /var/log/apach2/error.log. I tried LogLevel=debug and DebugLevel=9. LogStderr helps to see if I have a problem in the cmd script itself, but otherwise isn't much help.
Can any provide any examples for this use case?
Thank you,
Jon Belanger
--
Born in Roswell... married an alien...
http://emptyhammock.com/
Re: [users@httpd] Using mod_ext_filter mode=input
Posted by Jeff Trawick <tr...@gmail.com>.
On Mon, Nov 12, 2012 at 9:06 AM, Jon Belanger <
jon.belanger@fidelissecurity.com> wrote:
> Does anyone still maintain this? Any ideas?
>
Hi Jon,
The issue of the unexpected error (and message) matches this recent fix to
trunk and 2.4.x:
http://svn.apache.org/viewvc?view=revision&revision=1364606
The patch looks quite simple to try with 2.2.x. Can you how much that
helps? (I don't know what else would happen besides the message.)
With the patch in place, I successfully ran the first example you gave,
like so:
extfilterdefine tee \
cmd="/usr/bin/tee /tmp/ext_filter_debug" \
mode=input
setinputfilter tee
Is it possible that your testing showed the file going to zero because of
some other request hitting the server (with no body)?
> Thank you,
> Jon
>
> From: Jon Belanger <jo...@fidelissecurity.com>
> Reply-To: "users@httpd.apache.org" <us...@httpd.apache.org>
> Date: Thursday, November 8, 2012 5:23 PM
> To: "users@httpd.apache.org" <us...@httpd.apache.org>
> Subject: [users@httpd] Using mod_ext_filter mode=input
>
> I'm trying to intercept file upload requests using the mod_ext_filter
> module in input mode.
>
> I've tried a few test commands to write the STDIN to a file, for example:
>
> /usr/bin/tee /tmp/ext_filter_debug
>
> And also tried a test script that does basically the same thing:
>
> #!/bin/sh
> cat - > /tmp/ext_filter_debug
>
> If I send a large file I can see the request append /tmp/ext_filter_debug
> file, but as soon as the request completes, the file goes down to 0 bytes
> in both instances. I don't understand how this is even possible given that
> the module should have no idea what file I'm writing to.
>
> Interestingly if I try this:
>
> #!/bin/sh
> cat - > /tmp/ext_filter_debug
> cat /tmp/ext_filter_debug
>
> The /tmp/ext_filter_debug file hangs out a while longer, duration
> depending on size, but then eventually goes to zero.
>
> Eventually, I want to parse the request and encrypt the uploading file
> using openssl smime, but I don't understand how to work with the incoming
> request. The only error I see logged is:
>
> *(9) Bad* file *descriptor*: apr_file_close(*child* input)
>
> To /var/log/apach2/error.log. I tried LogLevel=debug and DebugLevel=9.
> LogStderr helps to see if I have a problem in the cmd script itself, but
> otherwise isn't much help.
>
> Can any provide any examples for this use case?
>
> Thank you,
> Jon Belanger
>
--
Born in Roswell... married an alien...
http://emptyhammock.com/
Re: [users@httpd] Using mod_ext_filter mode=input
Posted by Jon Belanger <jo...@fidelissecurity.com>.
Does anyone still maintain this? Any ideas?
Thank you,
Jon
From: Jon Belanger <jo...@fidelissecurity.com>>
Reply-To: "users@httpd.apache.org<ma...@httpd.apache.org>" <us...@httpd.apache.org>>
Date: Thursday, November 8, 2012 5:23 PM
To: "users@httpd.apache.org<ma...@httpd.apache.org>" <us...@httpd.apache.org>>
Subject: [users@httpd] Using mod_ext_filter mode=input
I'm trying to intercept file upload requests using the mod_ext_filter module in input mode.
I've tried a few test commands to write the STDIN to a file, for example:
/usr/bin/tee /tmp/ext_filter_debug
And also tried a test script that does basically the same thing:
#!/bin/sh
cat - > /tmp/ext_filter_debug
If I send a large file I can see the request append /tmp/ext_filter_debug file, but as soon as the request completes, the file goes down to 0 bytes in both instances. I don't understand how this is even possible given that the module should have no idea what file I'm writing to.
Interestingly if I try this:
#!/bin/sh
cat - > /tmp/ext_filter_debug
cat /tmp/ext_filter_debug
The /tmp/ext_filter_debug file hangs out a while longer, duration depending on size, but then eventually goes to zero.
Eventually, I want to parse the request and encrypt the uploading file using openssl smime, but I don't understand how to work with the incoming request. The only error I see logged is:
(9) Bad file descriptor: apr_file_close(child input)
To /var/log/apach2/error.log. I tried LogLevel=debug and DebugLevel=9. LogStderr helps to see if I have a problem in the cmd script itself, but otherwise isn't much help.
Can any provide any examples for this use case?
Thank you,
Jon Belanger