Repository navigation
Conversation
Port of owasp-modsecurity#3660 to the 2.x tree code in apache2/msc_tree.c, which is the same implementation: - CPTAddElement only handled the "same key" case when the netmask was an exact duplicate; a different netmask on an existing key (10.0.0.0/16 followed by 10.0.0.0/8) was silently dropped. - InsertNetmask and the duplicate branch allocated a fresh, empty netmasks array instead of growing it, losing the earlier netmasks on the node. - CPTFindElementIPNetblock never reset the byte index between the netmasks of a node, so only the most specific one was applied. Netmask insertion is now one helper that copies the existing entries into a larger pool allocation and keeps them sorted; the same key branch appends the new netmask to the existing prefix; the lookup masks the address again for every netmask. Fixes owasp-modsecurity#3588 Related to owasp-modsecurity#2192, owasp-modsecurity#2893 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0181jBv5JdNQviwDzfnkf1Gy
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This branch has not been deployed
1 participant
What
Port of #3660 (3.x) to the 2.x radix tree in
apache2/msc_tree.c, which is the same implementation:CPTAddElementonly handled the "same key" case when the netmask was an exact duplicate. A different netmask on an existing key (10.0.0.0/16followed by10.0.0.0/8, or172.16.0.0followed by172.16.0.0/12) was ignored, so the wider prefix never matched.InsertNetmaskand the duplicate branch allocated a fresh, emptynetmasksarray from the pool each time, losing the earlier entries on the node. Insertion is now one helper (CPTAddNetmask) that copies the existing entries into a larger pool allocation and keeps them sorted from most to least specific.CPTFindElementIPNetblocknever reset the byte index between the netmasks of a node, so only the most specific one was applied to the address. The index is now reset per netmask.Why
Reported in #3588 for both branches, and consistent with the "stops matching past a certain number of entries" reports in #2192 and #2893.
Tests
New
tests/regression/misc/60-ipmatch-overlap.t(auto-discovered), 8 cases using@ipMatchonARGS:ip: narrow-then-wide and wide-then-narrow on the same key, host-then-network, duplicates, IPv6 narrow-then-wide, and negative cases for both families.Verified in a Debian bookworm container (apache2 2.4): on untouched
v2/mastercases 1, 4 and 7 fail (200 instead of 403); on this branch all 8 pass.References
Fixes #3588 (2.x)
Related to #2192, #2893, #3660
🤖 Generated with Claude Code