APACHE_MODULE(log_config, logging configuration, , , yes)
+APACHE_MODULE(log_forensic, forensic logging)
+
+if test "x$enable_log_forensic" != "xno"; then
+ # mod_log_forensic needs test_char.h
+ APR_ADDTO(INCLUDES, [-I\$(top_builddir)/server])
+fi
+
APACHE_MODULE(logio, input and output logging, , , no)
APACHE_MODPATH_FINISH
apr_file_t *fd;
} fcfg;
-static apr_uint32_t next_id;
-
static void *make_forensic_log_scfg(apr_pool_t *p, server_rec *s)
{
fcfg *cfg = apr_pcalloc(p, sizeof *cfg);
if (!(id = apr_table_get(r->subprocess_env, "UNIQUE_ID"))) {
/* we make the assumption that we can't go through all the PIDs in
under 1 second */
- id = apr_psprintf(r->pool, "%x:%lx:%x", getpid(), time(NULL),
- apr_atomic_inc32(&next_id));
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
+ "mod_log_forensic: mod_unique_id must also be active");
+ return DECLINED;
}
ap_set_module_config(r->request_config, &log_forensic_module, (char *)id);
#define T_OS_ESCAPE_PATH (0x04)
#define T_HTTP_TOKEN_STOP (0x08)
#define T_ESCAPE_LOGITEM (0x10)
+#define T_ESCAPE_FORENSIC (0x20)
int main(int argc, char *argv[])
{
"#define T_OS_ESCAPE_PATH (%u)\n"
"#define T_HTTP_TOKEN_STOP (%u)\n"
"#define T_ESCAPE_LOGITEM (%u)\n"
+ "#define T_ESCAPE_FORENSIC (%u)\n"
"\n"
"static const unsigned char test_char_table[256] = {\n"
" 0,",
T_ESCAPE_PATH_SEGMENT,
T_OS_ESCAPE_PATH,
T_HTTP_TOKEN_STOP,
- T_ESCAPE_LOGITEM);
+ T_ESCAPE_LOGITEM,
+ T_ESCAPE_FORENSIC);
/* we explicitly dealt with NUL above
* in case some strchr() do bogosity with it */
flags |= T_ESCAPE_LOGITEM;
}
+ /* For forensic logging, escape all control characters, top bit set,
+ * :, | (used as delimiters) and % (used for escaping).
+ */
+ if (!apr_isprint(c) || c == ':' || c == '|' || c == '%'
+ || apr_iscntrl(c) || !c) {
+ flags |= T_ESCAPE_FORENSIC;
+ }
+
printf("%u%c", flags, (c < 255) ? ',' : ' ');
}