klaubert / waf-fle

WAF-FLE, ModSecurity Console
http://waf-fle.org
GNU General Public License v2.0
139 stars 73 forks source link

waf-fle stopped working after patching #78

Open hans-mayer opened 1 year ago

hans-mayer commented 1 year ago

Dear All,

it seems waf-fle itself is dead. Independent of that I will post my issue. I am using waf-fle since about 5 years and I like it as it needs less resources.

The last entry in the MySQL DB was 2023-02-17 18:10 Just before I did patch the system ( Debian 11 bullseye ) These are the following apps which were patched just before on that day:

-rw-r--r-- 1 root root 81975 Feb 17 14:17 elasticsearch.list -rw-r--r-- 1 root root 527 Feb 17 14:17 gir1.2-webkit2-4.0:amd64.list -rw-r--r-- 1 root root 509 Feb 17 14:17 gir1.2-javascriptcoregtk-4.0:amd64.list -rw-r--r-- 1 root root 6186 Feb 17 14:17 libwebkit2gtk-4.0-37:amd64.list -rw-r--r-- 1 root root 405 Feb 17 14:17 libjavascriptcoregtk-4.0-18:amd64.list -rw-r--r-- 1 root root 3658657 Feb 17 14:17 kibana.list -rw-r--r-- 1 root root 142653 Feb 17 14:17 filebeat.list -rw-r--r-- 1 root root 100105 Feb 17 14:17 metricbeat.list -rw-r--r-- 1 root root 812 Feb 17 17:13 sox.md5sums -rw-r--r-- 1 root root 1705 Feb 17 17:13 libsox-fmt-base:amd64.md5sums -rw-r--r-- 1 root root 389 Feb 17 17:13 libsox-fmt-alsa:amd64.md5sums -rw-r--r-- 1 root root 67 Feb 17 17:13 libsox3:amd64.triggers -rw-r--r-- 1 root root 2842 Feb 17 17:13 libsox3:amd64.symbols -rw-r--r-- 1 root root 41 Feb 17 17:13 libsox3:amd64.shlibs -rw-r--r-- 1 root root 350 Feb 17 17:13 libsox3:amd64.md5sums

I tried to narrow down the issue. I see traffic between Apache and MySQL. There are several SQL statements visible with WireShark but in the events table there is no new entry.

With DEBUG I see in the Apache log

[Wed Feb 22 21:44:36.486946 2023] [php7:warn] [pid 44506] [client 192.168.241.9:35474] PHP Warning: count(): Parameter must be an array or an object that implements Countable in /usr/local/waf-fle_0.6.4/functions.php on line 2943 [Wed Feb 22 21:44:36.489336 2023] [php7:warn] [pid 44506] [client 192.168.241.9:35474] PHP Warning: count(): Parameter must be an array or an object that implements Countable in /usr/local/waf-fle_0.6.4/functions.php on line 708

But this seems not to reflect the real issue:

706     if ($DEBUG) {
707         global $debugInfo;
708         $debugCount = count($debugInfo[__FUNCTION__]);
709         $starttime = microtime(true);
710     }

Any help would be great.

Kind regards Hans