comotion / VSF

Varnish Security Firewall
Other
213 stars 67 forks source link

Panic using VSF with Varnish plus 4.1 #41

Closed Jefl closed 8 years ago

Jefl commented 8 years ago

Hi there ! Would you please look at the trace included. I would love to continue using VSF with varnish plus unfortunately varnish plus is going crazy with vsf module.

Last panic at: Mon, 11 Apr 2016 14:42:31 GMT
"Assert error in child_sigsegv_handler(), mgt/mgt_child.c line 282:
Condition(Segmentation fault by instruction at 0x18) not true.
thread = (cache-worker)
version = varnish-plus-4.1.2r1 revision 4d86388
ident = Linux,2.6.32-573.12.1.el6.x86_64,x86_64,-junix,-smse,-smalloc,-hcritbit,epoll
Backtrace:
0x439a53: pan_ic+0x163
0x459afa: varnishd() [0x459afa]
0x3ff5a0f790: libpthread.so.0() [0x3ff5a0f790]
0x431704: http_findhdr+0x14
0x431872: http_GetHdr+0x62
0x7f9d75174b4d: libvmod_vsf.so(vmod_body+0x8d) [0x7f9d75174b4d]
0x7f9d787d2d90: vgc.so(VGC_function_vcl_recv+0x1e0) [0x7f9d787d2d90]
0x446524: vcl_call_method+0x1e4
0x4468ea: VCL_recv_method+0x5a
0x43e2ca: CNT_Request+0x79a
req = 0x7f9ffe9a1020 {
vxid = 32770, step = R_STP_RECV,
req_body = R_BODY_NONE,
restarts = 0, esi_level = 0,
sp = 0x7f9ffd822220 {
fd = 23, vxid = 32769,
client = 10.102.4.5 25687,
step = S_STP_H1PROC,
},
worker = 0x7f9ffddd9b40 {
stack = {0x7f9ffddda000 -> 0x7f9ffddce000},
ws = 0x7f9ffddd9d38 {
id = \"wrk\",
{s,f,r,e} = {0x7f9ffddd92c0,0x7f9ffddd92c0,(nil),+2040},
},
VCL::method = inside RECV,
VCL::return = abandon,
VCL::methods = {RECV},
},
ws = 0x7f9ffe9a1210 {
id = \"req\",
{s,f,r,e} = {0x7f9ffe9a3010,+304,(nil),+57320},
},
http_conn = 0x7f9ffe9a1128 {
pfd = 0x7f9ffd822230(23),
doclose = NULL,
ws = 0x7f9ffe9a1210,
{rxbuf_b, rxbuf_e} = {0x7f9ffe9a3010, 0x7f9ffe9a3050},
{pipeline_b, pipeline_e} = {(nil), (nil)},
content_length = -1,
body_status = none,
first_byte_timeout = 0.000000,
between_bytes_timeout = 0.000000,
},
http[req] = 0x7f9ffe9a12a8 {
ws[req] = 0x7f9ffe9a1210,
hdrs {
\"HEAD\",
\"/is-alive\",
\"HTTP/1.1\",
\"User-agent: LB-Check\",
\"Host: haproxy\",
\"X-Forwarded-For: XX.XX.XX.XX\",
\"X-VSF-Actual-IP: XX.XX.XX.XX\",
\"X-VSF-ClientIP: XX.XX.XX.XX\",
\"X-VSF-Method: HEAD\",
\"X-VSF-Proto: HTTP/1.1\",
\"X-VSF-UA: LB-Check\",
\"X-VSF-URL: /is-alive\",
},
},
vcl = {
temp = warm
srcname = {
\"/etc/varnish/default.vcl\",
\"Builtin\",
\"/etc/varnish/security/vsf.vcl\",
\"/etc/varnish/security/build/variables.vcl\",
\"/etc/varnish/security/local.vcl\",
\"/etc/varnish/security/config.vcl\",
\"/etc/varnish/security/rules/protocol.vcl\",
\"/etc/varnish/security/rules/paths.vcl\",
\"/etc/varnish/security/rules/generic.vcl\",
\"/etc/varnish/security/rules/sql.vcl\",
\"/etc/varnish/security/rules/sql.encoded.vcl\",
\"/etc/varnish/security/rules/xss.vcl\",
\"/etc/varnish/security/rules/xss.encoded.vcl\",
\"/etc/varnish/security/rules/demo.vcl\",
\"/etc/varnish/security/rules/php.vcl\",
\"/etc/varnish/security/rules/cmd.vcl\",
\"/etc/varnish/security/rules/restricted-file-extensions.vcl\",
\"/etc/varnish/security/rules/content-encoding.vcl\",
\"/etc/varnish/security/rules/content-type.vcl\",
\"/etc/varnish/security/rules/localfiles.vcl\",
\"/etc/varnish/security/build/variables.vcl\",
\"/etc/varnish/security/handlers.vcl\",
\"/etc/varnish/rsr.vcl\",
\"/etc/varnish/tsr.vcl\",
\"/etc/varnish/marts.vcl\",
\"/etc/varnish/vcs_deliver.vcl\",
\"/etc/varnish/error_page.vcl\",
\"/etc/varnish/403_page.vcl\",
},
},
flags = {
},
},

Many thanks in advance for your support !

Jef

fgsch commented 8 years ago

Thanks for the report. I will take a look.

Could you share your vcl_recv{}?

fgsch commented 8 years ago

Also can you let us know which libvmod-vsf revision you are compiling/running?

Jefl commented 8 years ago

libvmod-vsf was compiled from the current master branch. The vcl_recv is pretty sensitive, shall I send it to you to a private email ?

fgsch commented 8 years ago

Sure, that's fine. If you are restarting at some point I will need the full VCL though.

fgsch commented 8 years ago

@Jefl how often does this happen? Can you reproduce it?

I haven't been able to find anything so far but I'm still investigating.

fgsch commented 8 years ago

Also, can you send me all the VCLs please?

fgsch commented 8 years ago

I'm tracking this privately. I will update it in due time.

fgsch commented 8 years ago

This was due to mixing varnish-libs packages for different versions.

Compiling it against the right packages fixed the issue.