/* 
 * $Id: mod_blowchunks.c,v 1.3 2002/06/22 05:27:33 cbailiff Exp $
 *
 * Reject chunked requests before vulnerable chunking routines can read them.
 * (apache module version)
 *
 * Cris Bailiff, c.bailiff+blowchunks@devsecure.com - http://www.awayweb.com
 * http://www.devsecure.com/pub/src/mod_blowchunks.c
 *
 * Copyright 2002 Cris Bailiff.  All rights reserved.
 *
 * Permission is granted to anyone to use this software for any purpose on
 * any computer system, and to alter it and redistribute it, subject
 * to the following restrictions:
 *
 * 1. The author is not responsible for the consequences of use of this
 *  software, no matter how awful, even if they arise from flaws in it.
 *
 * 2. The origin of this software must not be misrepresented, either by
 *  explicit claim or by omission. 
 *
 * 3. Altered versions must be plainly marked as such, and must not be
 *  misrepresented as being the original software. 
 *
 * 4. This notice may not be removed or altered.
 *
 * To compile & install in your apache (using apxs):
 *
 *     # /usr/sbin/apxs -i -a -c mod_blowchunks.c
 *
 * and restart. Read the apxs(8) man page for more info on compiling apache
 * modules.
 */

#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_main.h"
#include "http_protocol.h"

module MODULE_VAR_EXPORT blowchunks_module;

static int blowchunks_check_one_header(void *data, const char *key, const char *val)
{
    if (ap_find_last_token(NULL, val, "chunked")) {
	*((int *)data)=TRUE; 
	return FALSE;
    }
    return TRUE;
}

static int blowchunks_post_read_request(request_rec *r)
{
    int found=FALSE;
    ap_table_do(blowchunks_check_one_header,&found,r->headers_in,
	    "Transfer-Encoding",NULL);
    if (found==TRUE) {
        ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r,
	    "Transfer-Encoding: chunked - denied and logged");
	return HTTP_BAD_REQUEST;
    }
    return DECLINED;
}

module MODULE_VAR_EXPORT blowchunks_module =
{
    STANDARD_MODULE_STUFF,
    NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
    NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
#if MODULE_MAGIC_NUMBER >= 19970902
    blowchunks_post_read_request
#else
#error Your apache is too old to have the post_read_request module hook
#endif
};