api.c

/*
* ModSecurity for Apache 2.x, http://www.modsecurity.org/
* Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License.  You may obtain a copy of the License at
*
*     http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*/

#include <limits.h>
#include <stdio.h>

#include "http_core.h"
#include "http_request.h"

#include "modsecurity.h"
#include "apache2.h"
#include "http_main.h"
#include "http_connection.h"

#include "apr_optional.h"
#include "mod_log_config.h"

#include "msc_logging.h"
#include "msc_util.h"

#include "ap_mpm.h"
#include "scoreboard.h"

#include "apr_version.h"

#include "apr_lib.h"
#include "ap_config.h"
#include "http_config.h"

#include "api.h"

#ifdef WIN32
#include "msc_status_engine.h"
#endif

extern void *modsecLogObj;
extern void (*modsecLogHook)(void *obj, int level, char *str);
extern int (*modsecDropAction)(request_rec *r);
apr_status_t (*modsecReadBody)(request_rec *r, char *buf, unsigned int length, unsigned int *readcnt, int *is_eos);
apr_status_t (*modsecReadResponse)(request_rec *r, char *buf, unsigned int length, unsigned int *readcnt, int *is_eos);
apr_status_t (*modsecWriteBody)(request_rec *r, char *buf, unsigned int length);
apr_status_t (*modsecWriteResponse)(request_rec *r, char *buf, unsigned int length);

extern const char *process_command_config(server_rec *s,
                                          void *mconfig,
                                          apr_pool_t *p,
                                          apr_pool_t *ptemp,
                                          const char *filename);

#define DECLARE_EXTERNAL_HOOK(ns,link,ret,name,args) \
extern ns##_HOOK_##name##_t *hookfn_##name;

#define DECLARE_HOOK(ret,name,args) \
    DECLARE_EXTERNAL_HOOK(ap,AP,ret,name,args)

DECLARE_HOOK(int,pre_config,(apr_pool_t *pconf,apr_pool_t *plog, apr_pool_t *ptemp))
DECLARE_HOOK(int,post_config,(apr_pool_t *pconf,apr_pool_t *plog, apr_pool_t *ptemp,server_rec *s))
DECLARE_HOOK(void,child_init,(apr_pool_t *pchild, server_rec *s))
DECLARE_HOOK(int,process_connection,(conn_rec *c))
DECLARE_HOOK(int,post_read_request,(request_rec *r))
DECLARE_HOOK(int,fixups,(request_rec *r))
DECLARE_HOOK(void, error_log, (const char *file, int line, int level,
                       apr_status_t status, const server_rec *s,
                       const request_rec *r, apr_pool_t *pool,
                       const char *errstr))
DECLARE_HOOK(int,log_transaction,(request_rec *r))
DECLARE_HOOK(void,insert_filter,(request_rec *r))
DECLARE_HOOK(void,insert_error_filter,(request_rec *r))

char *sa_name = "standalone";
const char *sa_name_argv[] = { "standalone", NULL };
server_rec *server;
apr_pool_t *pool = NULL;

apr_status_t ap_http_in_filter(ap_filter_t *f, apr_bucket_brigade *b,
                            ap_input_mode_t mode, apr_read_type_e block,
                            apr_off_t readbytes);
apr_status_t ap_http_out_filter(ap_filter_t *f, apr_bucket_brigade *b);

server_rec *modsecInit()    {
    apr_initialize();

    apr_pool_create(&pool, NULL);

    apr_hook_global_pool = pool;

    server = apr_palloc(pool, sizeof(server_rec));

    server->addrs = apr_palloc(pool, sizeof(server_addr_rec));
    server->addrs->host_addr = apr_palloc(pool, sizeof(apr_sockaddr_t));
    server->addrs->host_addr->addr_str_len = 16;
    server->addrs->host_addr->family = AF_INET;
    server->addrs->host_addr->hostname = sa_name;
#ifdef WIN32
    server->addrs->host_addr->ipaddr_len = sizeof(IN_ADDR);
#else
    server->addrs->host_addr->ipaddr_len = sizeof(struct in_addr);
#endif
    server->addrs->host_addr->ipaddr_ptr = &server->addrs->host_addr->sa.sin.sin_addr;
    server->addrs->host_addr->pool = pool;
    server->addrs->host_addr->port = 80;
#ifdef WIN32
    server->addrs->host_addr->sa.sin.sin_addr.S_un.S_addr = 0x0100007f;
#else
    server->addrs->host_addr->sa.sin.sin_addr.s_addr = 0x0100007f;
#endif
    server->addrs->host_addr->sa.sin.sin_family = AF_INET;
    server->addrs->host_addr->sa.sin.sin_port = 80;
    server->addrs->host_addr->salen = sizeof(server->addrs->host_addr->sa);
    server->addrs->host_addr->servname = sa_name;
    server->addrs->host_port = 80;
    server->error_fname = "error.log";
    server->error_log = NULL;
    server->limit_req_fields = 1024;
    server->limit_req_fieldsize = 1024;
    server->limit_req_line = 1024;
#if AP_SERVER_MAJORVERSION_NUMBER > 1 && AP_SERVER_MINORVERSION_NUMBER < 3
    server->loglevel = APLOG_DEBUG;
#endif
    server->lookup_defaults = NULL;
    server->module_config = NULL;
    server->names = NULL;
#ifdef WIN32
    server->path = "c:\\inetpub\\wwwroot";
#else
    server->path = "/var/www";
#endif
    server->pathlen = strlen(server->path);
    server->port = 80;
    server->process = apr_palloc(pool, sizeof(process_rec));
    server->process->argc = 1;
    server->process->argv = sa_name_argv;
    server->process->pconf = pool;
    server->process->pool = pool;
    server->process->short_name = sa_name;
    server->server_admin = sa_name;
    server->server_hostname = sa_name;
    server->server_scheme = "";
    server->timeout = 60 * 1000000;// 60 seconds
    server->wild_names = NULL;
    server->is_virtual = 0;

    ap_server_config_defines = apr_array_make(pool, 1, sizeof(char *));

    // here we should add scoreboard handling for multiple processes and threads
    //
    ap_scoreboard_image = (scoreboard *)apr_palloc(pool, sizeof(scoreboard));

    memset(ap_scoreboard_image, 0, sizeof(scoreboard));

    // ----------

    security2_module.module_index = 0;

    security2_module.register_hooks(pool);

    ap_register_input_filter("HTTP_IN", ap_http_in_filter, NULL, AP_FTYPE_RESOURCE);
    ap_register_output_filter("HTTP_OUT", ap_http_out_filter, NULL, AP_FTYPE_CONTENT_SET);

    return server;
}

apr_status_t ap_http_in_filter(ap_filter_t *f, apr_bucket_brigade *bb_out,
        ap_input_mode_t mode, apr_read_type_e block,
        apr_off_t readbytes)    {
    char *tmp = NULL;
    apr_bucket *e = NULL;
    unsigned int readcnt = 0;
    int is_eos = 0;
    apr_bucket_brigade *bb_in;
    apr_bucket *after;
    apr_status_t rv;

    bb_in = modsecGetBodyBrigade(f->r);

    /* use request brigade */
    if (bb_in != NULL) {
        if (!APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(bb_in))) {
            e = apr_bucket_eos_create(f->c->bucket_alloc);
            APR_BRIGADE_INSERT_TAIL(bb_in, e);
        }

        rv = apr_brigade_partition(bb_in, readbytes, &after);
        if (rv != APR_SUCCESS && rv != APR_INCOMPLETE) {
            return rv;
        }
        
        for (e = APR_BRIGADE_FIRST(bb_in); e != after; e = APR_BRIGADE_FIRST(bb_in)) {
            APR_BUCKET_REMOVE(e);
            APR_BRIGADE_INSERT_TAIL(bb_out, e);
        }

        return APR_SUCCESS;
    }

    /* call the callback */
    if(modsecReadBody != NULL) {

        tmp = (char *)apr_palloc(f->r->pool, readbytes);
        modsecReadBody(f->r, tmp, readbytes, &readcnt, &is_eos);

        e = apr_bucket_pool_create(tmp, readcnt, f->r->pool, f->c->bucket_alloc);
        APR_BRIGADE_INSERT_TAIL(bb_out, e);

        if(is_eos)  {
            e = apr_bucket_eos_create(f->c->bucket_alloc);
            APR_BRIGADE_INSERT_TAIL(bb_out, e);
        }
        return APR_SUCCESS;
    }

    /* cannot read request body */
    e = apr_bucket_eos_create(f->c->bucket_alloc);
    APR_BRIGADE_INSERT_TAIL(bb_out, e);

    return APR_SUCCESS;
}

apr_status_t ap_http_out_filter(ap_filter_t *f, apr_bucket_brigade *b)  {
    apr_bucket_brigade *bb_out = (apr_bucket_brigade *)f->ctx;

    APR_BRIGADE_CONCAT(bb_out, b);
    return APR_SUCCESS;
}

void modsecTerminate()  {
    apr_pool_destroy(pool);
    pool = NULL;
    apr_terminate();
}

void modsecStartConfig()    {
    apr_pool_t *ptemp = NULL;

    apr_pool_create(&ptemp, pool);

    hookfn_pre_config(pool, pool, ptemp);

    apr_pool_destroy(ptemp);
}

directory_config *modsecGetDefaultConfig()  {
    return (directory_config *)security2_module.create_dir_config(pool, NULL);
}

const char *modsecProcessConfig(directory_config *config, const char *file, const char *dir)  {
    apr_pool_t *ptemp = NULL;
    const char *err;
	apr_status_t status;
	const char *rootpath, *incpath;

	if(dir == NULL || strlen(dir) == 0)
#ifdef	WIN32
		dir = "\\";
#else
		dir = "/";
#endif

	incpath = file;

	/* locate the start of the directories proper */
	status = apr_filepath_root(&rootpath, &incpath, APR_FILEPATH_TRUENAME | APR_FILEPATH_NATIVE, config->mp);

	/* we allow APR_SUCCESS and APR_EINCOMPLETE */
	if (APR_ERELATIVE == status) {
		int li = strlen(dir) - 1;

		if(dir[li] != '/' && dir[li] != '\\')
#ifdef	WIN32
			file = apr_pstrcat(config->mp, dir, "\\", file, NULL);
#else
			file = apr_pstrcat(config->mp, dir, "/", file, NULL);
#endif
		else
			file = apr_pstrcat(config->mp, dir, file, NULL);
	}
	else if (APR_EBADPATH == status) {
		return apr_pstrcat(config->mp, "Config file has a bad path, ", file, NULL);
	}

	apr_pool_create(&ptemp, config->mp);

    err = process_command_config(server, config, config->mp, ptemp, file);

    apr_pool_destroy(ptemp);

    return err;
}

void modsecFinalizeConfig() {
    apr_pool_t *ptemp = NULL;

    apr_pool_create(&ptemp, pool);

    hookfn_post_config(pool, pool, ptemp, server);
    hookfn_post_config(pool, pool, ptemp, server);

    apr_pool_destroy(ptemp);
}

void modsecInitProcess()    {
    hookfn_child_init(pool, server);
}

conn_rec *modsecNewConnection() {
    conn_rec *c;
    apr_pool_t *pc = NULL;

    apr_pool_create(&pc, pool);

    c = apr_pcalloc(pc, sizeof(conn_rec));

    c->base_server = server;
    c->id = 1;
    c->local_addr = server->addrs->host_addr;
    c->local_host = sa_name;
    c->local_ip = "127.0.0.1";
    c->pool = pc;
    c->remote_host = sa_name;
#if AP_SERVER_MAJORVERSION_NUMBER > 1 && AP_SERVER_MINORVERSION_NUMBER < 3
    c->remote_ip = "127.0.0.1";
    c->remote_addr = server->addrs->host_addr;
#else
    c->client_ip = "127.0.0.1";
    c->client_addr = server->addrs->host_addr;
#endif
    c->input_filters = NULL;
    c->output_filters = NULL;
    c->bucket_alloc = apr_bucket_alloc_create(pc);

    return c;
}

void modsecProcessConnection(conn_rec *c)   {
    hookfn_process_connection(c);
}

request_rec *modsecNewRequest(conn_rec *connection, directory_config *config)   {
    request_rec *r;
    apr_pool_t *pr = NULL;

    apr_pool_create(&pr, connection->pool);

    r = apr_pcalloc(pr, sizeof(request_rec));

    r->connection = connection;
    r->server = server;
    r->pool = pr;
    r->main = NULL;
    r->next = NULL;
    r->notes = apr_table_make(pr, 10);
    r->per_dir_config = apr_palloc(pr, sizeof(void *));
    ((void **)r->per_dir_config)[0] = config;
    r->prev = NULL;
    r->subprocess_env = apr_table_make(pr, 10);
    apr_table_setn(r->subprocess_env, "UNIQUE_ID", "unique_id");
    r->user = NULL;

    r->headers_in = apr_table_make(pr, 10);
    r->headers_out = apr_table_make(pr, 10);
    r->err_headers_out = apr_table_make(pr, 10);
    //apr_table_setn(r->headers_in, "Host", "www.google.com");
    //apr_table_setn(r->headers_in, "", "");

    r->the_request = "GET /../../index.html HTTP/1.1";
    r->method = "GET";
    r->method_number = M_GET;
    r->protocol = "HTTP/1.1";
    r->uri = "http://www.google.com/../../index.html";
    r->args = "";
    r->filename = "/../../index.html";
    r->handler = "IIS";

    r->parsed_uri.scheme = "http";
    r->parsed_uri.path = "/../../index.html";
    r->parsed_uri.hostname = "www.google.com";
    r->parsed_uri.is_initialized = 1;
    r->parsed_uri.port = 1234;
    r->parsed_uri.port_str = "1234";
    r->parsed_uri.query = "";
    r->parsed_uri.dns_looked_up = 0;
    r->parsed_uri.dns_resolved = 0;
    r->parsed_uri.password = NULL;
    r->parsed_uri.user = NULL;
    r->parsed_uri.fragment = "";

    r->input_filters = NULL;
    r->output_filters = NULL;

    return r;
}

static modsec_rec *retrieve_msr(request_rec *r) {
    modsec_rec *msr = NULL;
    request_rec *rx = NULL;

    /* Look in the current request first. */
    msr = (modsec_rec *)apr_table_get(r->notes, NOTE_MSR);
    if (msr != NULL) {
        msr->r = r;
        return msr;
    }

    /* If this is a subrequest then look in the main request. */
    if (r->main != NULL) {
        msr = (modsec_rec *)apr_table_get(r->main->notes, NOTE_MSR);
        if (msr != NULL) {
            msr->r = r;
            return msr;
        }
    }

    /* If the request was redirected then look in the previous requests. */
    rx = r->prev;
    while(rx != NULL) {
        msr = (modsec_rec *)apr_table_get(rx->notes, NOTE_MSR);
        if (msr != NULL) {
            msr->r = r;
            return msr;
        }
        rx = rx->prev;
    }

    return NULL;
}

int modsecProcessRequestHeaders(request_rec *r) {
    return hookfn_post_read_request(r);
}

int modsecProcessRequestBody(request_rec *r) {
    int status = DECLINED;
    modsec_rec *msr = NULL;

    ap_filter_t *f = ap_add_input_filter("HTTP_IN", NULL, r, r->connection);
    apr_bucket_brigade* bb_out;

    status = hookfn_fixups(r);

    ap_remove_input_filter(f);

	if (status != DECLINED) {
		return status;
	}

    hookfn_insert_filter(r);

    /* Find the transaction context first. */
    msr = retrieve_msr(r);

    if (msr == NULL)
        return status;

    bb_out = modsecGetBodyBrigade(r);
    if (bb_out) {
        (void) apr_brigade_cleanup(bb_out);
        status = ap_get_brigade(r->input_filters, bb_out, AP_MODE_READBYTES, APR_BLOCK_READ, -1);
        if (status == APR_SUCCESS) {
            return DECLINED;
        }
        return status;
    }

    if(msr->stream_input_data != NULL && modsecWriteBody != NULL)
    {
        // target is responsible for copying the data into correctly managed buffer
        //
        modsecWriteBody(r, msr->stream_input_data, msr->stream_input_length);

        free(msr->stream_input_data);

        msr->stream_input_data = NULL;
    }

    // leftover code possibly for future use
    //
    //if(r->input_filters != NULL && r->input_filters->frec->filter_init_func != NULL)
    //r->input_filters->frec->filter_init_func(r->input_filters);
    //if(r->input_filters != NULL && r->input_filters->frec->filter_func.in_func != NULL)
    //r->input_filters->frec->filter_func.in_func(r->input_filters, NULL, 0, 0, 0);

    return status;
}

void modsecSetConfigForIISRequestBody(request_rec *r)
{
    modsec_rec *msr = retrieve_msr(r);

    if(msr == NULL || msr->txcfg == NULL)
        return;

    if(msr->txcfg->reqbody_access)
        msr->txcfg->stream_inbody_inspection = 1;
}

int modsecContextState(request_rec *r)
{
    modsec_rec *msr = retrieve_msr(r);

    if(msr == NULL || msr->txcfg == NULL)
        return NOT_SET;

    return msr->txcfg->is_enabled;
}

int modsecIsRequestBodyAccessEnabled(request_rec *r)
{
    modsec_rec *msr = retrieve_msr(r);

    if(msr == NULL || msr->txcfg == NULL)
        return 0;

    return msr->txcfg->reqbody_access;
}

int modsecIsResponseBodyAccessEnabled(request_rec *r)
{
    modsec_rec *msr = retrieve_msr(r);

    if(msr == NULL || msr->txcfg == NULL)
        return 0;

    return msr->txcfg->resbody_access;
}

int modsecProcessResponse(request_rec *r)   {
    int status;
    modsec_rec *msr;
    apr_bucket *e;
    ap_filter_t *f;
    apr_bucket_brigade *bb_in, *bb_out, *bb;

    if(r->output_filters == NULL) {
        return DECLINED;
    }

    msr = (modsec_rec *)r->output_filters->ctx;
    if (msr == NULL) {
        ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO, 0, r->server,
                "ModSecurity: Internal Error: msr is null in output filter.");
        ap_remove_output_filter(r->output_filters);
        return APR_EGENERAL;
    }

    msr->r = r;

    /* create input response brigade */
    bb_in = apr_brigade_create(msr->mp, r->connection->bucket_alloc);

    if (bb_in == NULL) {
        msr_log(msr, 1, "Process response: Failed to create brigade.");
        return APR_EGENERAL;
    }

    /* get input response brigade */
    bb = modsecGetResponseBrigade(r);
    if (bb != NULL) {
        APR_BRIGADE_CONCAT(bb_in, bb);
        if (!APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(bb_in))) {
            e = apr_bucket_eos_create(bb_in->bucket_alloc);
            APR_BRIGADE_INSERT_TAIL(bb_in, e);
        }
    } else if (modsecReadResponse != NULL) {
        unsigned int readcnt = 0;
        int is_eos = 0;
        char buf[8192];
        while(!is_eos)  {
            modsecReadResponse(r, buf, 8192, &readcnt, &is_eos);

            if(readcnt > 0) {
                char *tmp = (char *)apr_palloc(r->pool, readcnt);
                memcpy(tmp, buf, readcnt);
                e = apr_bucket_pool_create(tmp, readcnt, r->pool, r->connection->bucket_alloc);
                APR_BRIGADE_INSERT_TAIL(bb_in, e);
            }
        }

        e = apr_bucket_eos_create(r->connection->bucket_alloc);
        APR_BRIGADE_INSERT_TAIL(bb_in, e);
    } else {
        /* cannot read response body process header only */

        e = apr_bucket_eos_create(r->connection->bucket_alloc);
        APR_BRIGADE_INSERT_TAIL(bb_in, e);
    }

    bb_out = bb ? bb : apr_brigade_create(msr->mp, r->connection->bucket_alloc);

    if (bb_out == NULL) {
        msr_log(msr, 1, "Process response: Failed to create brigade.");
        return APR_EGENERAL;
    }

    /* concat output bucket to bb_out */
    f = ap_add_output_filter("HTTP_OUT", bb_out, r, r->connection);
    status = ap_pass_brigade(r->output_filters, bb_in);
    ap_remove_output_filter(f);

    if (status == APR_EGENERAL) {
        /* retrive response status from bb_out */
        for(e = APR_BRIGADE_FIRST(bb_out);
                e != APR_BRIGADE_SENTINEL(bb_out);
                e = APR_BUCKET_NEXT(e)) {
            if (AP_BUCKET_IS_ERROR(e)) {
                return ((ap_bucket_error*) e->data)->status;
            }
        }
        return APR_EGENERAL;
    }

    if (status != DECLINED) {
        return status;
    }

    /* copy bb_out */
    // is there a way to tell whether the response body was modified or not?
    if (modsecWriteResponse != NULL
            && (msr->txcfg->content_injection_enabled || msr->content_prepend_len != 0 || msr->content_append_len != 0)
            && msr->txcfg->resbody_access)   {

        char *data = NULL;
        apr_size_t length;

        status = apr_brigade_pflatten(msr->of_brigade, &data, &length, msr->mp);

        if (status != APR_SUCCESS) {
            msr_log(msr, 1, "Output filter: Failed to flatten brigade (%d): %s", status,
                    get_apr_error(msr->mp, status));
            return APR_EGENERAL;
        }

        if ( modsecWriteResponse(msr->r, data, msr->stream_output_length) != APR_SUCCESS) {
            return APR_EGENERAL;
        }
    }
    
    return DECLINED;
}

int modsecFinishRequest(request_rec *r) {
    // run output filter
    //if(r->output_filters != NULL && r->output_filters->frec->filter_init_func != NULL)
    //r->output_filters->frec->filter_init_func(r->output_filters);

    hookfn_log_transaction(r);

    // make sure you cleanup before calling apr_terminate()
    // otherwise double-free might occur, because of the request body pool cleanup function
    //
    apr_pool_destroy(r->pool);

    return DECLINED;
}

// destroy only the connection pool
int modsecFinishConnection(conn_rec *c)
{
    apr_pool_destroy(c->pool);

    return 0;
}


void modsecSetLogHook(void *obj, void (*hook)(void *obj, int level, char *str)) {
    modsecLogObj = obj;
    modsecLogHook = hook;
}

void modsecSetReadBody(apr_status_t (*func)(request_rec *r, char *buf, unsigned int length, unsigned int *readcnt, int *is_eos))    {
    modsecReadBody = func;
}

void modsecSetReadResponse(apr_status_t (*func)(request_rec *r, char *buf, unsigned int length, unsigned int *readcnt, int *is_eos))    {
    modsecReadResponse = func;
}

void modsecSetWriteBody(apr_status_t (*func)(request_rec *r, char *buf, unsigned int length))   {
    modsecWriteBody = func;
}

void modsecSetWriteResponse(apr_status_t (*func)(request_rec *r, char *buf, unsigned int length))   {
    modsecWriteResponse = func;
}

void modsecSetDropAction(int (*func)(request_rec *r)) {
    modsecDropAction = func;
}

/*
 * Case SecServerSignature was used, this function returns the banner that
 * should be used, otherwise it returns NULL.
 */
const char *modsecIsServerSignatureAvailale(void) {
    return new_server_signature;
}

#ifdef VERSION_IIS
void modsecStatusEngineCall()
{
    if (status_engine_state != STATUS_ENGINE_DISABLED) {
        msc_status_engine_call();
    }
    else {
        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
            "Status engine is currently disabled, enable it by set " \
            "SecStatusEngine to On.\n");
    }
}

void modsecReportRemoteLoadedRules()
{
#ifdef WITH_REMOTE_RULES
    if (remote_rules_server != NULL)
    {
        if (remote_rules_server->amount_of_rules == 1)
        {
            ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
                "ModSecurity: Loaded %d rule from: '%s'.",
                remote_rules_server->amount_of_rules,
                remote_rules_server->uri);
        }
        else
        {
            ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
                "ModSecurity: Loaded %d rules from: '%s'.",
                remote_rules_server->amount_of_rules,
                remote_rules_server->uri);
        }
    }
#endif
    if (remote_rules_fail_message != NULL)
    {
        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, "ModSecurity: " \
            "Problems loading external resources: %s",
            remote_rules_fail_message);
    }

}
#endif