diff -Naurp modsecurity-apache_2.6.1/apache2/msc_multipart.c modsecurity-apache_2.6.1.oden/apache2/msc_multipart.c --- modsecurity-apache_2.6.1/apache2/msc_multipart.c 2012-12-23 17:51:00.000000000 +0000 +++ modsecurity-apache_2.6.1.oden/apache2/msc_multipart.c 2012-12-23 17:51:16.000000000 +0000 @@ -653,6 +653,7 @@ static int multipart_process_boundary(mo } } else { + msr->mpd->flag_invalid_part = 1; msr_log(msr, 3, "Multipart: Skipping invalid part %pp (part name missing): " "(offset %u, length %u)", msr->mpd->mpp, msr->mpd->mpp->offset, msr->mpd->mpp->length); @@ -961,6 +962,11 @@ int multipart_complete(modsec_rec *msr, msr_log(msr, 4, "Multipart: Warning: invalid quoting used."); } + if (msr->mpd->flag_invalid_part) { + msr_log(msr, 4, "Multipart: Warning: invalid part parsing."); + } + + if (msr->mpd->flag_invalid_header_folding) { msr_log(msr, 4, "Multipart: Warning: invalid header folding used."); } diff -Naurp modsecurity-apache_2.6.1/apache2/msc_multipart.h modsecurity-apache_2.6.1.oden/apache2/msc_multipart.h --- modsecurity-apache_2.6.1/apache2/msc_multipart.h 2011-07-18 17:35:27.000000000 +0000 +++ modsecurity-apache_2.6.1.oden/apache2/msc_multipart.h 2012-12-23 17:51:16.000000000 +0000 @@ -117,6 +117,7 @@ struct multipart_data { int flag_boundary_whitespace; int flag_missing_semicolon; int flag_invalid_quoting; + int flag_invalid_part; int flag_invalid_header_folding; int flag_file_limit_exceeded; }; diff -Naurp modsecurity-apache_2.6.1/apache2/re_variables.c modsecurity-apache_2.6.1.oden/apache2/re_variables.c --- modsecurity-apache_2.6.1/apache2/re_variables.c 2011-07-18 17:35:27.000000000 +0000 +++ modsecurity-apache_2.6.1.oden/apache2/re_variables.c 2012-12-23 17:51:16.000000000 +0000 @@ -1377,6 +1377,18 @@ static int var_multipart_missing_semicol } } +/* MULTIPART_INVALID_PART */ + +static int var_multipart_invalid_part_generate(modsec_rec *msr, msre_var *var, msre_rule *rule, + apr_table_t *vartab, apr_pool_t *mptmp) +{ + if ((msr->mpd != NULL)&&(msr->mpd->flag_invalid_part != 0)) { + return var_simple_generate(var, vartab, mptmp, "1"); + } else { + return var_simple_generate(var, vartab, mptmp, "0"); + } +} + /* MULTIPART_INVALID_QUOTING */ static int var_multipart_invalid_quoting_generate(modsec_rec *msr, msre_var *var, msre_rule *rule, @@ -1429,6 +1441,7 @@ static int var_multipart_strict_error_ge ||(msr->mpd->flag_lf_line != 0) ||(msr->mpd->flag_missing_semicolon != 0) ||(msr->mpd->flag_invalid_quoting != 0) + ||(msr->mpd->flag_invalid_part != 0) ||(msr->mpd->flag_invalid_header_folding != 0) ||(msr->mpd->flag_file_limit_exceeded != 0) ) { @@ -2835,6 +2848,17 @@ void msre_engine_register_default_variab VAR_DONT_CACHE, /* flag */ PHASE_REQUEST_BODY ); + + /* MULTIPART_INVALID_PART */ + msre_engine_variable_register(engine, + "MULTIPART_INVALID_PART", + VAR_SIMPLE, + 0, 0, + NULL, + var_multipart_invalid_part_generate, + VAR_DONT_CACHE, /* flag */ + PHASE_REQUEST_BODY + ); /* MULTIPART_INVALID_QUOTING */ msre_engine_variable_register(engine,