modsecurity nginx coredump #839
Comments
|
I am having similar core dumps -- |
|
@gyoza, @shel3over thanks for the report. is it something that is new to ModSecurity v2.9.0 or something that you was having on 2.8.0 as well ? |
|
I am certain 2.8.0 had issues as well. |
|
@gyoza did you tried the nginx_refactoring branch already? https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring |
|
Trying it. |
|
@gyoza code base is almost the same. I believe that it is ModSecurity v2.9.0-RC2 + a set of patches. This set of patches may help you with those problems that you are mentioned. I will update it to v2.9.0 + patches as soon as possible. |
|
Still getting dumps :( |
|
Keep in mind I also tried 1.7.10 with the refactor and had same filter module crash. |
|
@zimmerle i tried different nginx versions and even nginx_refactoring and also modsec 2.8 and 2.9 was an ubuntu 14.04 no idea if this related to some lib version used on ubuntu |
|
I am using amazon linux FYI. Also, unrelated, @shel3over we both have cats. awesome. |
|
@gyoza for a quick test, can you disable the SecRequestBodyAccess? https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#SecRequestBodyAccess |
|
taken out you get this core dump. I think I am noticing a trend also, If i try to hit a non-existant php script with arguments it seems to cause this to happen more often. for instance /blog/index.php?hello-world - just jam on refresh and the segfault will happen. |
|
Any updates? |
|
I have the same problem. when I request to http://example.com/index.php then it OK. But when I request to http://example.com/ or http://example.com/logo.jpg then it throws a exception "worker process exited on signal 11 (core dumped)". |
|
I checked it is OK for nginx 1.4.6 + modsecurity_refactoring. But i don't known the later version which is Ok. I waste about one week for this bug. I think @zimmerle should early update the patches for modsecurity :) |
|
Hi @taibd, thank you for your input. if you go over the opened bugs will you see that nginx_refactoring is not solving all the problems and it may add some new bugs. That is the main reason why this branch was not merged into the mainline yet. nginx_refactoring is being constantly updated with the mainline code. |
|
I had crashes using 1.4.7+latest refactor cloned today. Looks like maybe whatever changed from 1.4.6 to 1.4.7 is causing the problem ? |
|
Setting |
Helped to me, too. Nginx 1.8.0 |
|
proxy_force_ranges on; worked for me as well. Nginx 1.9.3 and modsec 2.9.0 |
|
Thanks for the workaraund. |
|
@ryanrbftp Thanks for your workaraund, which saves me a lot of time! |
|
Thanks! proxy_force_ranges worked! nginx 1.9.4, modsecurity 2.9.0 |
|
No longer a concern in libModSecurity. Marking it as won't fix for 2.x. Further information about libModSecurity available here: |
|
I still have this problem with the latest version of mod security and nginx 1.12. Tried everything but didn't found a fix. Any other suggestions? As I see nginx refectory branch is very old and now it's not the solution. |
|
Hi @intelbg, please move forward to the ModSecurity-nginx connector - www.github.com/SpiderLabs/ModSecurity-nginx |
|
I have the installed the libmodsecurity, but nginx-connector seems to not find it. Can you please tell me why as I post to you the steps I follow: 315 git clone https://github.com/SpiderLabs/ModSecurity
327 CFLAGS+=-I/usr/include/httpd ./configure --prefix=/usr/local/nginx/ --error-log-path=/var/log/nginx/error.log --with-http_ssl_module --with-openssl=/root/openssl-1.0.2g/ --with-http_v2_module --add-module=/usr/local/compile/headers-more-nginx-module-0.29rc1 --add-module=/usr/local/src/ngx_pagespeed-release-1.11.33.1-beta --with-cc=/opt/rh/devtoolset-2/root/usr/bin/gcc --add-module=/usr/local/src/nginx-1.12-new/testcookie-nginx-module-master/ --with-http_geoip_module --add-module=/usr/local/src/nginx-1.12-new/nginx-module-vts-master/ --add-module=/usr/local/src/ModSecurity-nginx/ --add-module=/usr/local/src/ngx_devel_kit-0.2.19/ Here is what I have in /usr/local/modsecurity: ls /usr/local/modsecurity/lib/ ls /usr/local/modsecurity/bin Have I missed something? |
|
@intelbg You should have something like below on your /usr/local/modsecurity/lib/ directory: libmodsecurity.a If these files are not present, there's something wrong with your libModSecurity compilation / installation. Or, they might being placed on a different directory. When compiling Nginx, make sure you point the configure options to where your nginx-connector is correctly located like: ./configure --add-module=/opt/ModSecurity-nginx Alternatively, you can also try compiling Nginx with a dynamic libModSecurity module like: ./configure --add-dynamic-module=/opt/ModSecurity-nginx --with-compat And then explicitly enable it on nginx.conf: load_module modules/ngx_http_modsecurity_module.so EDIT: The compilation recipes here should help: https://github.com/SpiderLabs/ModSecurity/wiki/Compilation-recipes |
|
@victorhora thank you about your reply. The steps you provided are exactly the steps I follow, but the question is why these libmodsecurity files are not present as there are not compilation errors. Here is the config.log from libmodsecurity compilation: |
The text was updated successfully, but these errors were encountered: