1 /* Licensed to the Apache Software Foundation (ASF) under one or more
2 * contributor license agreements. See the NOTICE file distributed with
3 * this work for additional information regarding copyright ownership.
4 * The ASF licenses this file to You under the Apache License, Version 2.0
5 * (the "License"); you may not use this file except in compliance with
6 * the License. You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 /*
18 * See also support/check_forensic.
19 * Relate the forensic log to the transfer log by including
20 * %{forensic-id}n in the custom log format, for example:
21 * CustomLog logs/custom "%h %l %u %t \"%r\" %>s %b %{forensic-id}n"
22 *
23 * Credit is due to Tina Bird <tbird precision-guesswork.com>, whose
24 * idea this module was.
25 *
26 * Ben Laurie 29/12/2003
27 */
28
29 #include "httpd.h"
30 #include "http_config.h"
31 #include "http_log.h"
32 #include "apr_strings.h"
33 #include "apr_atomic.h"
34 #include "http_protocol.h"
35 #include "test_char.h"
36 #if APR_HAVE_UNISTD_H
37 #include <unistd.h>
38 #endif
39
40 module AP_MODULE_DECLARE_DATA log_forensic_module;
41
42 typedef struct fcfg {
43 const char *logname;
44 apr_file_t *fd;
45 } fcfg;
46
47 static apr_uint32_t next_id;
48
make_forensic_log_scfg(apr_pool_t * p,server_rec * s)49 static void *make_forensic_log_scfg(apr_pool_t *p, server_rec *s)
50 {
51 fcfg *cfg = apr_pcalloc(p, sizeof *cfg);
52
53 cfg->logname = NULL;
54 cfg->fd = NULL;
55
56 return cfg;
57 }
58
merge_forensic_log_scfg(apr_pool_t * p,void * parent,void * new)59 static void *merge_forensic_log_scfg(apr_pool_t *p, void *parent, void *new)
60 {
61 fcfg *cfg = apr_pcalloc(p, sizeof *cfg);
62 fcfg *pc = parent;
63 fcfg *nc = new;
64
65 cfg->logname = apr_pstrdup(p, nc->logname ? nc->logname : pc->logname);
66 cfg->fd = NULL;
67
68 return cfg;
69 }
70
open_log(server_rec * s,apr_pool_t * p)71 static int open_log(server_rec *s, apr_pool_t *p)
72 {
73 fcfg *cfg = ap_get_module_config(s->module_config, &log_forensic_module);
74
75 if (!cfg->logname || cfg->fd)
76 return 1;
77
78 if (*cfg->logname == '|') {
79 piped_log *pl;
80 const char *pname = ap_server_root_relative(p, cfg->logname + 1);
81
82 pl = ap_open_piped_log(p, pname);
83 if (pl == NULL) {
84 ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00650)
85 "couldn't spawn forensic log pipe %s", cfg->logname);
86 return 0;
87 }
88 cfg->fd = ap_piped_log_write_fd(pl);
89 }
90 else {
91 const char *fname = ap_server_root_relative(p, cfg->logname);
92 apr_status_t rv;
93
94 if ((rv = apr_file_open(&cfg->fd, fname,
95 APR_WRITE | APR_APPEND | APR_CREATE,
96 APR_OS_DEFAULT, p)) != APR_SUCCESS) {
97 ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, APLOGNO(00651)
98 "could not open forensic log file %s.", fname);
99 return 0;
100 }
101 }
102
103 return 1;
104 }
105
log_init(apr_pool_t * pc,apr_pool_t * p,apr_pool_t * pt,server_rec * s)106 static int log_init(apr_pool_t *pc, apr_pool_t *p, apr_pool_t *pt,
107 server_rec *s)
108 {
109 for ( ; s ; s = s->next) {
110 if (!open_log(s, p)) {
111 return HTTP_INTERNAL_SERVER_ERROR;
112 }
113 }
114
115 return OK;
116 }
117
118
119 /* e is the first _invalid_ location in q
120 N.B. returns the terminating NUL.
121 */
log_escape(char * q,const char * e,const char * p)122 static char *log_escape(char *q, const char *e, const char *p)
123 {
124 for ( ; *p ; ++p) {
125 ap_assert(q < e);
126 if (test_char_table[*(unsigned char *)p]&T_ESCAPE_FORENSIC) {
127 ap_assert(q+2 < e);
128 *q++ = '%';
129 ap_bin2hex(p, 1, q);
130 q += 2;
131 }
132 else
133 *q++ = *p;
134 }
135 ap_assert(q < e);
136 *q = '\0';
137
138 return q;
139 }
140
141 typedef struct hlog {
142 char *log;
143 char *pos;
144 char *end;
145 apr_pool_t *p;
146 apr_size_t count;
147 } hlog;
148
count_string(const char * p)149 static int count_string(const char *p)
150 {
151 int n;
152
153 for (n = 0 ; *p ; ++p, ++n)
154 if (test_char_table[*(unsigned char *)p]&T_ESCAPE_FORENSIC)
155 n += 2;
156 return n;
157 }
158
count_headers(void * h_,const char * key,const char * value)159 static int count_headers(void *h_, const char *key, const char *value)
160 {
161 hlog *h = h_;
162
163 h->count += count_string(key)+count_string(value)+2;
164
165 return 1;
166 }
167
log_headers(void * h_,const char * key,const char * value)168 static int log_headers(void *h_, const char *key, const char *value)
169 {
170 hlog *h = h_;
171
172 /* note that we don't have to check h->pos here, coz its been done
173 for us by log_escape */
174 *h->pos++ = '|';
175 h->pos = log_escape(h->pos, h->end, key);
176 *h->pos++ = ':';
177 h->pos = log_escape(h->pos, h->end, value);
178
179 return 1;
180 }
181
log_before(request_rec * r)182 static int log_before(request_rec *r)
183 {
184 fcfg *cfg = ap_get_module_config(r->server->module_config,
185 &log_forensic_module);
186 const char *id;
187 hlog h;
188 apr_size_t n;
189 apr_status_t rv;
190
191 if (!cfg->fd || r->prev) {
192 return DECLINED;
193 }
194
195 if (!(id = apr_table_get(r->subprocess_env, "UNIQUE_ID"))) {
196 /* we make the assumption that we can't go through all the PIDs in
197 under 1 second */
198 id = apr_psprintf(r->pool, "%" APR_PID_T_FMT ":%lx:%x", getpid(),
199 time(NULL), apr_atomic_inc32(&next_id));
200 }
201 ap_set_module_config(r->request_config, &log_forensic_module, (char *)id);
202
203 h.p = r->pool;
204 h.count = 0;
205
206 apr_table_do(count_headers, &h, r->headers_in, NULL);
207
208 h.count += 1+strlen(id)+1+count_string(r->the_request)+1+1;
209 h.log = apr_palloc(r->pool, h.count);
210 h.pos = h.log;
211 h.end = h.log+h.count;
212
213 *h.pos++ = '+';
214 strcpy(h.pos, id);
215 h.pos += strlen(h.pos);
216 *h.pos++ = '|';
217 h.pos = log_escape(h.pos, h.end, r->the_request);
218
219 apr_table_do(log_headers, &h, r->headers_in, NULL);
220
221 ap_assert(h.pos < h.end);
222 *h.pos++ = '\n';
223
224 n = h.count-1;
225 rv = apr_file_write(cfg->fd, h.log, &n);
226 ap_assert(rv == APR_SUCCESS && n == h.count-1);
227
228 apr_table_setn(r->notes, "forensic-id", id);
229
230 return OK;
231 }
232
log_after(request_rec * r)233 static int log_after(request_rec *r)
234 {
235 fcfg *cfg = ap_get_module_config(r->server->module_config,
236 &log_forensic_module);
237 const char *id = ap_get_module_config(r->request_config,
238 &log_forensic_module);
239 char *s;
240 apr_size_t l, n;
241 apr_status_t rv;
242
243 if (!cfg->fd || id == NULL) {
244 return DECLINED;
245 }
246
247 s = apr_pstrcat(r->pool, "-", id, "\n", NULL);
248 l = n = strlen(s);
249 rv = apr_file_write(cfg->fd, s, &n);
250 ap_assert(rv == APR_SUCCESS && n == l);
251
252 return OK;
253 }
254
set_forensic_log(cmd_parms * cmd,void * dummy,const char * fn)255 static const char *set_forensic_log(cmd_parms *cmd, void *dummy, const char *fn)
256 {
257 fcfg *cfg = ap_get_module_config(cmd->server->module_config,
258 &log_forensic_module);
259
260 cfg->logname = fn;
261 return NULL;
262 }
263
264 static const command_rec forensic_log_cmds[] =
265 {
266 AP_INIT_TAKE1("ForensicLog", set_forensic_log, NULL, RSRC_CONF,
267 "the filename of the forensic log"),
268 { NULL }
269 };
270
register_hooks(apr_pool_t * p)271 static void register_hooks(apr_pool_t *p)
272 {
273 static const char * const pre[] = { "mod_unique_id.c", NULL };
274
275 ap_hook_open_logs(log_init,NULL,NULL,APR_HOOK_MIDDLE);
276 ap_hook_post_read_request(log_before,pre,NULL,APR_HOOK_REALLY_FIRST);
277 ap_hook_log_transaction(log_after,NULL,NULL,APR_HOOK_REALLY_LAST);
278 }
279
280 AP_DECLARE_MODULE(log_forensic) =
281 {
282 STANDARD20_MODULE_STUFF,
283 NULL, /* create per-dir config */
284 NULL, /* merge per-dir config */
285 make_forensic_log_scfg, /* server config */
286 merge_forensic_log_scfg, /* merge server config */
287 forensic_log_cmds, /* command apr_table_t */
288 register_hooks /* register hooks */
289 };
290