ModSecurity segfault #1496
Comments
|
Hi @adamjacobmuller, Thanks for the bug report. Just compiling these versions with default modsecurity.conf and starting Nginx leads to this crash? Could you please described in more details the steps your performed that lead to the segfault? Thanks. |
|
Hi @victorhora, The segfault occurs during the request processing, in the logging phase. The request is still delivered to the client. At high request/segfault rates, this will, of course, cause lots of client requests to fail if they are served by a worker that is log/panicking for another request. I'm attaching a copy of the mod_security ruleset in use, and I can provide an nginx.conf mockup that will demonstrate the issue as well if you need, but, basically we're proxying requests to a backend and the response bodies are coming from that backend. SSL and HTTP/2 are in-use but the issue is not isolated to them. Thank you, |
|
Hi @adamjacobmuller, |
|
Hi @wergoth, Do you mean nginx ./configure options or for ModSecurity itself, for the latter, its just basic ./configure && make && make install For nginx things are a bit more complex, but, not too much:
|
|
@victorhora and @wergoth, if you're having issues reproducing the bug, I'm happy to give you access to a test system that I have setup to reproduce it. The issue definitely happens much more with parallel requests. It's very difficult to reproduce with something like |
|
Hi @adamjacobmuller, REQUEST########################################################## expected: 404 Not Found ########################################################## DEBUGGER OUTPUT########################################################## (gdb) c Program received signal SIGSEGV, Segmentation fault. (gdb) where #3 0x00007f2e622d7a76 in modsecurity::Rule::getFinalVars (this=0x31217a0, trans=0x39b5dd0) at rule.cc:572 (gdb) print *this (gdb) l (gdb) print *v (gdb) printf "<%-64s>\n", (char*)(*v->m_key) NOTE: here *v->m_key seems not to be \0 terminated############################################################## (gdb) up (gdb) print *this (gdb) print (Variable)this->m_variables (gdb) print *this->m_op (gdb) print trans (gdb) q ############################################# PLATFORM AND CONFIGURATION############################################# ModSecurity - v3.0.0+e14dc60 for Linux Mandatory dependencies
Optional dependencies
Other Options
gcc -v uname -a nginx version: nginx/1.13.1 |
|
Hi @adamjacobmuller, I believe that the problem you are facing is a consequence of the rules being wrongly loaded. Not a run time issue. I am investigating. |
|
Observing the very similar issue on Debian 8 "jessie" - this is the only OS where I was able to get 100% reproducible way to trigger segfault. OS details: Minimal nginx configuration: /etc/nginx/modsec/main.conf: /etc/nginx/modsec/modsecurity.conf: In /etc/nginx/modsec/owasp-crs/ there's a list of OWASP CRS v3.0.0 rules without any modifications. Request: Backtrace: A Vagrant-based environment is available here for quick reproducing this segfault: https://github.com/defanator/modsecurity-performance Steps to reproduce: Tested on the following Vagrant box: |
|
Just finished testing on another box, |
|
Should be ok at: cc1d220b408fe73a4e1950b71848772d505d6ce0 |
|
Fix confirmed. Thanks ;) |
Hello,
We are running ModSecurity@1edd3570e11e9bb2b6d86b249232b24917a4b0ac and ModSecurity-nginx@abbf2c47f6f3205484a1a9db618e067dce213b89 with nginx 1.13.1 and seeing the following segfault:
This looks like an issue/bug in ModSecurity directly (and not the nginx connector) so filing the bug here, let me know if that's incorrect.
The text was updated successfully, but these errors were encountered: