summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--src/sp_execute.c2
-rw-r--r--src/sp_unserialize.c2
-rw-r--r--src/sp_upload_validation.c2
-rw-r--r--src/sp_utils.c12
-rw-r--r--src/sp_utils.h2
-rw-r--r--src/tests/config/config_disabled_functions_require.ini3
-rw-r--r--src/tests/deny_writable_execution_simulation.phpt4
-rw-r--r--src/tests/disabled_functions.phpt2
-rw-r--r--src/tests/disabled_functions_param.phpt4
-rw-r--r--src/tests/disabled_functions_param_alias.phpt2
-rw-r--r--src/tests/disabled_functions_require_simulation.phpt26
-rw-r--r--src/tests/disabled_functions_ret_simulation.phpt4
-rw-r--r--src/tests/disabled_functions_upper.phpt2
-rw-r--r--src/tests/unserialize_sim.phpt2
14 files changed, 48 insertions, 21 deletions
diff --git a/src/sp_execute.c b/src/sp_execute.c
index 014a049..419e56d 100644
--- a/src/sp_execute.c
+++ b/src/sp_execute.c
@@ -13,7 +13,7 @@ static int (*orig_zend_stream_open)(const char *filename,
13ZEND_COLD static inline void terminate_if_writable(const char *filename) { 13ZEND_COLD static inline void terminate_if_writable(const char *filename) {
14 if (0 == access(filename, W_OK)) { 14 if (0 == access(filename, W_OK)) {
15 if (true == SNUFFLEUPAGUS_G(config).config_readonly_exec->simulation) { 15 if (true == SNUFFLEUPAGUS_G(config).config_readonly_exec->simulation) {
16 sp_log_msg("readonly_exec", SP_LOG_NOTICE, 16 sp_log_msg("readonly_exec", SP_LOG_SIMULATION,
17 "Attempted execution of a writable file (%s).", filename); 17 "Attempted execution of a writable file (%s).", filename);
18 } else { 18 } else {
19 sp_log_msg("readonly_exec", SP_LOG_DROP, 19 sp_log_msg("readonly_exec", SP_LOG_DROP,
diff --git a/src/sp_unserialize.c b/src/sp_unserialize.c
index c8503de..b3dfad7 100644
--- a/src/sp_unserialize.c
+++ b/src/sp_unserialize.c
@@ -88,7 +88,7 @@ PHP_FUNCTION(sp_unserialize) {
88 } 88 }
89 } else { 89 } else {
90 if ( true == SNUFFLEUPAGUS_G(config).config_unserialize->simulation) { 90 if ( true == SNUFFLEUPAGUS_G(config).config_unserialize->simulation) {
91 sp_log_msg("unserialize", SP_LOG_NOTICE, "Invalid HMAC for %s", serialized_str); 91 sp_log_msg("unserialize", SP_LOG_SIMULATION, "Invalid HMAC for %s", serialized_str);
92 if ((orig_handler = zend_hash_str_find_ptr(SNUFFLEUPAGUS_G(sp_internal_functions_hook), 92 if ((orig_handler = zend_hash_str_find_ptr(SNUFFLEUPAGUS_G(sp_internal_functions_hook),
93 "unserialize", 11))) { 93 "unserialize", 11))) {
94 orig_handler(INTERNAL_FUNCTION_PARAM_PASSTHRU); 94 orig_handler(INTERNAL_FUNCTION_PARAM_PASSTHRU);
diff --git a/src/sp_upload_validation.c b/src/sp_upload_validation.c
index 6655e11..3f0d788 100644
--- a/src/sp_upload_validation.c
+++ b/src/sp_upload_validation.c
@@ -79,7 +79,7 @@ int sp_rfc1867_callback(unsigned int event, void *event_data, void **extra) {
79 if (WEXITSTATUS(waitstatus) != 0) { // Nope 79 if (WEXITSTATUS(waitstatus) != 0) { // Nope
80 char *uri = sp_getenv("REQUEST_URI"); 80 char *uri = sp_getenv("REQUEST_URI");
81 int sim = SNUFFLEUPAGUS_G(config).config_upload_validation->simulation; 81 int sim = SNUFFLEUPAGUS_G(config).config_upload_validation->simulation;
82 sp_log_msg("upload_valiation", sim?SP_LOG_NOTICE:SP_LOG_DROP, 82 sp_log_msg("upload_valiation", sim?SP_LOG_SIMULATION:SP_LOG_DROP,
83 "The upload of %s on %s was rejected.", filename, uri?uri:"?"); 83 "The upload of %s on %s was rejected.", filename, uri?uri:"?");
84 if (!SNUFFLEUPAGUS_G(config).config_upload_validation->simulation) { 84 if (!SNUFFLEUPAGUS_G(config).config_upload_validation->simulation) {
85 zend_bailout(); 85 zend_bailout();
diff --git a/src/sp_utils.c b/src/sp_utils.c
index f696a55..0ddc024 100644
--- a/src/sp_utils.c
+++ b/src/sp_utils.c
@@ -231,14 +231,14 @@ void sp_log_disable(const char* restrict path, const char* restrict arg_name,
231 const int sim = config_node->simulation; 231 const int sim = config_node->simulation;
232 if (arg_name) { 232 if (arg_name) {
233 if (alias) { 233 if (alias) {
234 sp_log_msg("disabled_function", sim?SP_LOG_NOTICE:SP_LOG_DROP, 234 sp_log_msg("disabled_function", sim?SP_LOG_SIMULATION:SP_LOG_DROP,
235 "The call to the function '%s' in %s:%d has been disabled, " 235 "The call to the function '%s' in %s:%d has been disabled, "
236 "because its argument '%s' content (%s) matched the rule '%s'.", 236 "because its argument '%s' content (%s) matched the rule '%s'.",
237 path, zend_get_executed_filename(TSRMLS_C), 237 path, zend_get_executed_filename(TSRMLS_C),
238 zend_get_executed_lineno(TSRMLS_C), arg_name, arg_value?arg_value:"?", 238 zend_get_executed_lineno(TSRMLS_C), arg_name, arg_value?arg_value:"?",
239 alias); 239 alias);
240 } else { 240 } else {
241 sp_log_msg("disabled_function", sim?SP_LOG_NOTICE:SP_LOG_DROP, 241 sp_log_msg("disabled_function", sim?SP_LOG_SIMULATION:SP_LOG_DROP,
242 "The call to the function '%s' in %s:%d has been disabled, " 242 "The call to the function '%s' in %s:%d has been disabled, "
243 "because its argument '%s' content (%s) matched a rule.", 243 "because its argument '%s' content (%s) matched a rule.",
244 path, zend_get_executed_filename(TSRMLS_C), 244 path, zend_get_executed_filename(TSRMLS_C),
@@ -247,13 +247,13 @@ void sp_log_disable(const char* restrict path, const char* restrict arg_name,
247 } 247 }
248 } else { 248 } else {
249 if (alias) { 249 if (alias) {
250 sp_log_msg("disabled_function", sim?SP_LOG_NOTICE:SP_LOG_DROP, 250 sp_log_msg("disabled_function", sim?SP_LOG_SIMULATION:SP_LOG_DROP,
251 "The call to the function '%s' in %s:%d has been disabled, " 251 "The call to the function '%s' in %s:%d has been disabled, "
252 "because of the the rule '%s'.",path, 252 "because of the the rule '%s'.",path,
253 zend_get_executed_filename(TSRMLS_C), 253 zend_get_executed_filename(TSRMLS_C),
254 zend_get_executed_lineno(TSRMLS_C), alias); 254 zend_get_executed_lineno(TSRMLS_C), alias);
255 } else { 255 } else {
256 sp_log_msg("disabled_function", sim?SP_LOG_NOTICE:SP_LOG_DROP, 256 sp_log_msg("disabled_function", sim?SP_LOG_SIMULATION:SP_LOG_DROP,
257 "The call to the function '%s' in %s:%d has been disabled.", 257 "The call to the function '%s' in %s:%d has been disabled.",
258 path, zend_get_executed_filename(TSRMLS_C), 258 path, zend_get_executed_filename(TSRMLS_C),
259 zend_get_executed_lineno(TSRMLS_C)); 259 zend_get_executed_lineno(TSRMLS_C));
@@ -271,13 +271,13 @@ void sp_log_disable_ret(const char* restrict path,
271 const char* alias = config_node->alias; 271 const char* alias = config_node->alias;
272 const int sim = config_node->simulation; 272 const int sim = config_node->simulation;
273 if (alias) { 273 if (alias) {
274 sp_log_msg("disabled_function", sim?SP_LOG_NOTICE:SP_LOG_DROP, 274 sp_log_msg("disabled_function", sim?SP_LOG_SIMULATION:SP_LOG_DROP,
275 "The execution has been aborted in %s:%d, " 275 "The execution has been aborted in %s:%d, "
276 "because the function '%s' returned '%s', which matched the rule '%s'.", 276 "because the function '%s' returned '%s', which matched the rule '%s'.",
277 zend_get_executed_filename(TSRMLS_C), 277 zend_get_executed_filename(TSRMLS_C),
278 zend_get_executed_lineno(TSRMLS_C), path, ret_value?ret_value:"?", alias); 278 zend_get_executed_lineno(TSRMLS_C), path, ret_value?ret_value:"?", alias);
279 } else { 279 } else {
280 sp_log_msg("disabled_function", sim?SP_LOG_NOTICE:SP_LOG_DROP, 280 sp_log_msg("disabled_function", sim?SP_LOG_SIMULATION:SP_LOG_DROP,
281 "The execution has been aborted in %s:%d, " 281 "The execution has been aborted in %s:%d, "
282 "because the return value (%s) of the function '%s' matched a rule.", 282 "because the return value (%s) of the function '%s' matched a rule.",
283 zend_get_executed_filename(TSRMLS_C), 283 zend_get_executed_filename(TSRMLS_C),
diff --git a/src/sp_utils.h b/src/sp_utils.h
index 3b14205..61a4c53 100644
--- a/src/sp_utils.h
+++ b/src/sp_utils.h
@@ -35,7 +35,7 @@
35#define HOOK_FUNCTION_BY_REGEXP(regexp, hook_table, new_function, execution) \ 35#define HOOK_FUNCTION_BY_REGEXP(regexp, hook_table, new_function, execution) \
36 hook_regexp(regexp, SNUFFLEUPAGUS_G(hook_table), new_function, execution) 36 hook_regexp(regexp, SNUFFLEUPAGUS_G(hook_table), new_function, execution)
37 37
38#define SP_LOG_NOTICE "notice" 38#define SP_LOG_SIMULATION "simulation"
39#define SP_LOG_DROP "drop" 39#define SP_LOG_DROP "drop"
40#define SP_LOG_DEBUG "debug" 40#define SP_LOG_DEBUG "debug"
41#define SP_LOG_ERROR "error" 41#define SP_LOG_ERROR "error"
diff --git a/src/tests/config/config_disabled_functions_require.ini b/src/tests/config/config_disabled_functions_require.ini
index 474fada..c23824d 100644
--- a/src/tests/config/config_disabled_functions_require.ini
+++ b/src/tests/config/config_disabled_functions_require.ini
@@ -1 +1,2 @@
1sp.disable_functions.function("require").param("").value_r("meh$").drop(); 1sp.disable_functions.function("require").param("").value_r("sim$").drop().simulation();
2sp.disable_functions.function("require").param("").value_r("meh$").drop(); \ No newline at end of file
diff --git a/src/tests/deny_writable_execution_simulation.phpt b/src/tests/deny_writable_execution_simulation.phpt
index 3278be8..549fb81 100644
--- a/src/tests/deny_writable_execution_simulation.phpt
+++ b/src/tests/deny_writable_execution_simulation.phpt
@@ -32,7 +32,7 @@ include "$dir/writable_file.txt";
32include "$dir/non_writable_file.txt"; 32include "$dir/non_writable_file.txt";
33?> 33?>
34--EXPECTF-- 34--EXPECTF--
35[snuffleupagus][0.0.0.0][readonly_exec][notice] Attempted execution of a writable file (%a/writable_file.txt). 35[snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution of a writable file (%a/writable_file.txt).
36Code execution within a writable file. 36Code execution within a writable file.
37Code execution within a non-writable file. 37Code execution within a non-writable file.
38--CLEAN-- 38--CLEAN--
@@ -42,4 +42,4 @@ chmod("$dir/non_writable_file.txt", 0777);
42chmod("$dir/writable_file.txt", 0777); 42chmod("$dir/writable_file.txt", 0777);
43unlink("$dir/non_writable_file.txt"); 43unlink("$dir/non_writable_file.txt");
44unlink("$dir/writable_file.txt"); 44unlink("$dir/writable_file.txt");
45?> \ No newline at end of file 45?>
diff --git a/src/tests/disabled_functions.phpt b/src/tests/disabled_functions.phpt
index 37da911..1c66ede 100644
--- a/src/tests/disabled_functions.phpt
+++ b/src/tests/disabled_functions.phpt
@@ -14,7 +14,7 @@ echo strpos("pouet", "o");
14?> 14?>
15--EXPECTF-- 15--EXPECTF--
16[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions.php:%d has been disabled. 16[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions.php:%d has been disabled.
17[snuffleupagus][0.0.0.0][disabled_function][notice] The call to the function 'printf' in %a/tests/disabled_functions.php:%d has been disabled. 17[snuffleupagus][0.0.0.0][disabled_function][simulation] The call to the function 'printf' in %a/tests/disabled_functions.php:%d has been disabled.
18printf in simulation mode 18printf in simulation mode
19print in disabled mode 19print in disabled mode
20[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'var_dump' in %a/tests/disabled_functions.php:%d has been disabled. 20[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'var_dump' in %a/tests/disabled_functions.php:%d has been disabled.
diff --git a/src/tests/disabled_functions_param.phpt b/src/tests/disabled_functions_param.phpt
index 2309217..61521cd 100644
--- a/src/tests/disabled_functions_param.phpt
+++ b/src/tests/disabled_functions_param.phpt
@@ -20,5 +20,5 @@ win
20int(15) 20int(15)
21[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'shell_exec' in %a/disabled_functions_param.php:5 has been disabled, because its argument 'cmd' content (id) matched the rule '3'. 21[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'shell_exec' in %a/disabled_functions_param.php:5 has been disabled, because its argument 'cmd' content (id) matched the rule '3'.
2242 2242
23[snuffleupagus][0.0.0.0][disabled_function][notice] The call to the function 'strcmp' in %a/tests/disabled_functions_param.php:7 has been disabled, because its argument 'str1' content (bla) matched the rule '5'. 23[snuffleupagus][0.0.0.0][disabled_function][simulation] The call to the function 'strcmp' in %a/tests/disabled_functions_param.php:7 has been disabled, because its argument 'str1' content (bla) matched the rule '5'.
24[snuffleupagus][0.0.0.0][disabled_function][notice] The call to the function 'strncmp' in %a/tests/disabled_functions_param.php:8 has been disabled, because its argument 'str1' content (bla) matched a rule. 24[snuffleupagus][0.0.0.0][disabled_function][simulation] The call to the function 'strncmp' in %a/tests/disabled_functions_param.php:8 has been disabled, because its argument 'str1' content (bla) matched a rule.
diff --git a/src/tests/disabled_functions_param_alias.phpt b/src/tests/disabled_functions_param_alias.phpt
index fe3d1c1..b549d70 100644
--- a/src/tests/disabled_functions_param_alias.phpt
+++ b/src/tests/disabled_functions_param_alias.phpt
@@ -11,4 +11,4 @@ shell_exec("id");
11?> 11?>
12--EXPECTF-- 12--EXPECTF--
13[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions_param_alias.php:2 has been disabled, because of the the rule '1'. 13[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions_param_alias.php:2 has been disabled, because of the the rule '1'.
14[snuffleupagus][0.0.0.0][disabled_function][notice] The call to the function 'shell_exec' in %a/tests/disabled_functions_param_alias.php:3 has been disabled, because of the the rule '2'. 14[snuffleupagus][0.0.0.0][disabled_function][simulation] The call to the function 'shell_exec' in %a/tests/disabled_functions_param_alias.php:3 has been disabled, because of the the rule '2'.
diff --git a/src/tests/disabled_functions_require_simulation.phpt b/src/tests/disabled_functions_require_simulation.phpt
new file mode 100644
index 0000000..2744c37
--- /dev/null
+++ b/src/tests/disabled_functions_require_simulation.phpt
@@ -0,0 +1,26 @@
1--TEST--
2Disable functions - Require (simulation)
3--SKIPIF--
4<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
5--INI--
6sp.configuration_file={PWD}/config/config_disabled_functions_require.ini
7--FILE--
8<?php
9$dir = __DIR__;
10file_put_contents($dir . '/test.bla', "BLA\n");
11file_put_contents($dir . '/test.sim', "MEH\n");
12require $dir . '/test.bla';
13require $dir . '/test.sim';
14echo "1337\n";
15?>
16--EXPECTF--
17BLA
18[snuffleupagus][0.0.0.0][disabled_function][simulation] The call to the function 'include' in %a/disabled_functions_require_simulation.php:%d has been disabled, because its argument 'inclusion path' content (%a/test.sim) matched a rule.
19MEH
201337
21--CLEAN--
22<?php
23$dir = __DIR__;
24unlink($dir . '/test.bla');
25unlink($dir . '/test.sim');
26?>
diff --git a/src/tests/disabled_functions_ret_simulation.phpt b/src/tests/disabled_functions_ret_simulation.phpt
index 58af3a9..1965030 100644
--- a/src/tests/disabled_functions_ret_simulation.phpt
+++ b/src/tests/disabled_functions_ret_simulation.phpt
@@ -11,8 +11,8 @@ echo stripos("pouet", "p") . "\n";
11strcmp("p", "p") . "\n"; 11strcmp("p", "p") . "\n";
12?> 12?>
13--EXPECTF-- 13--EXPECTF--
14[snuffleupagus][0.0.0.0][disabled_function][notice] The execution has been aborted in %a/disabled_functions_ret_simulation.php:2, because the return value (0) of the function 'strpos' matched a rule. 14[snuffleupagus][0.0.0.0][disabled_function][simulation] The execution has been aborted in %a/disabled_functions_ret_simulation.php:2, because the return value (0) of the function 'strpos' matched a rule.
150 150
16[snuffleupagus][0.0.0.0][disabled_function][notice] The execution has been aborted in %a/disabled_functions_ret_simulation.php:3, because the function 'stripos' returned '0', which matched the rule '1'. 16[snuffleupagus][0.0.0.0][disabled_function][simulation] The execution has been aborted in %a/disabled_functions_ret_simulation.php:3, because the function 'stripos' returned '0', which matched the rule '1'.
170 170
18[snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in %a/disabled_functions_ret_simulation.php:4, because the return value (0) of the function 'strcmp' matched a rule. 18[snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in %a/disabled_functions_ret_simulation.php:4, because the return value (0) of the function 'strcmp' matched a rule.
diff --git a/src/tests/disabled_functions_upper.phpt b/src/tests/disabled_functions_upper.phpt
index 4a7ed94..08c26c0 100644
--- a/src/tests/disabled_functions_upper.phpt
+++ b/src/tests/disabled_functions_upper.phpt
@@ -14,7 +14,7 @@ echo sTRPOs("pouet", "o");
14?> 14?>
15--EXPECTF-- 15--EXPECTF--
16[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions_upper.php:%d has been disabled. 16[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'system' in %a/tests/disabled_functions_upper.php:%d has been disabled.
17[snuffleupagus][0.0.0.0][disabled_function][notice] The call to the function 'printf' in %a/tests/disabled_functions_upper.php:%d has been disabled. 17[snuffleupagus][0.0.0.0][disabled_function][simulation] The call to the function 'printf' in %a/tests/disabled_functions_upper.php:%d has been disabled.
18printf in simulation mode 18printf in simulation mode
19print in disabled mode 19print in disabled mode
20[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'var_dump' in %a/tests/disabled_functions_upper.php:%d has been disabled. 20[snuffleupagus][0.0.0.0][disabled_function][drop] The call to the function 'var_dump' in %a/tests/disabled_functions_upper.php:%d has been disabled.
diff --git a/src/tests/unserialize_sim.phpt b/src/tests/unserialize_sim.phpt
index 8ebf64d..0d8280c 100644
--- a/src/tests/unserialize_sim.phpt
+++ b/src/tests/unserialize_sim.phpt
@@ -13,5 +13,5 @@ var_dump(unserialize('s:1:"a";alyualskdufyhalkdjsfhalkjdhflaksjdfhlkasdhflkahdaw
13?> 13?>
14--EXPECT-- 14--EXPECT--
15s:1:"a";650609b417904d0d9bbf1fc44a975d13ecdf6b02b715c1a06271fb3b673f25b1string(1) "a" 15s:1:"a";650609b417904d0d9bbf1fc44a975d13ecdf6b02b715c1a06271fb3b673f25b1string(1) "a"
16[snuffleupagus][0.0.0.0][unserialize][notice] Invalid HMAC for s:1:"a";alyualskdufyhalkdjsfh 16[snuffleupagus][0.0.0.0][unserialize][simulation] Invalid HMAC for s:1:"a";alyualskdufyhalkdjsfh
17string(1) "a" 17string(1) "a"