Closed adamjacobmuller closed 7 years ago
victorhora
commented
7 years ago Hi @AdamJacobMuller,
Thanks for the bug report. Just compiling these versions with default modsecurity.conf and starting Nginx leads to this crash? Could you please described in more details the steps your performed that lead to the segfault?
Thanks.
adamjacobmuller
commented
7 years ago Hi @victorhora,
The segfault occurs during the request processing, in the logging phase. The request is still delivered to the client. At high request/segfault rates, this will, of course, cause lots of client requests to fail if they are served by a worker that is log/panicking for another request.
I'm attaching a copy of the mod_security ruleset in use, and I can provide an nginx.conf mockup that will demonstrate the issue as well if you need, but, basically we're proxying requests to a backend and the response bodies are coming from that backend. SSL and HTTP/2 are in-use but the issue is not isolated to them. rules.zip
Thank you, -Adam
wergoth
commented
7 years ago Hi @AdamJacobMuller, could you tell me about nginx configuration options you used before nginx build? Thanks.
adamjacobmuller
commented
7 years ago Hi @wergoth,
Do you mean nginx ./configure options or for ModSecurity itself, for the latter, its just basic ./configure && make && make install
For nginx things are a bit more complex, but, not too much:
configure arguments: --prefix=/usr --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error_log --pid-path=/run/nginx.pid --lock-path=/run/lock/nginx.lock --with-cc-opt=-I/usr/include --with-ld-opt=-L/usr/lib --with-ipv6 --with-pcre --without-mail_pop3_module --without-mail_smtp_module --without-mail_imap_module --without-http_limit_conn_module --without-http_memcached_module --with-http_geoip_module --with-http_stub_status_module --with-http_realip_module --with-http_ssl_module --with-http_auth_request_module --user=nobody --group=nobody --with-http_mp4_module --with-http_flv_module --add-module=../lua-nginx-module --add-module=../ngx_devel_kit --add-module=../brotli --with-threads --with-file-aio --with-http_v2_module --add-module=../mod_security
adamjacobmuller
commented
7 years ago @victorhora and @wergoth, if you're having issues reproducing the bug, I'm happy to give you access to a test system that I have setup to reproduce it.
The issue definitely happens much more with parallel requests. It's very difficult to reproduce with something like curl, but, trivial with a browser. Drop me an email so the credentials aren't in a public github issue, adam@belugacdn.com and I'll setup access for you.
wergoth
commented
7 years ago Hi @AdamJacobMuller, We reproduced this issue and got the next results. Possibly it would help: ##########################################################
########################################################## curl 'http://10.8.4.213:8081/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini'
expected: 404 Not Found got: nginx segfault
##########################################################
##########################################################
(gdb) c Continuing.
Program received signal SIGSEGV, Segmentation fault. igdb) 0x00007f2e60e67390 in __memcpy_ssse3 () from /lib64/libc.so.6
(gdb) where
from /lib64/libstdc++.so.6
ruleMessage=std::shared_ptr (count 2, weak 0) 0x3b57b20) at rule.cc:706ruleMessage=std::shared_ptr (count 2, weak 0) 0x3b57b20) at rule.cc:758at /root/ModSecurity-nginx/src/ngx_http_modsecurity_pre_access.c:199at src/event/modules/ngx_epoll_module.c:902name=0x4f161e "worker process", respawn=respawn@entry=0) at src/os/unix/ngx_process.c:198572 new std::string(*v->m_key),
(gdb) print *this $1 = {m_accuracy = 0, m_actionsConf = std::vector of length 0, capacity 0, m_actionsRuntimePos = std::vector of length 0, capacity 0, m_actionsRuntimePre = std::vector of length 0, capacity 0, m_chained = false, m_chainedRule = 0x0, m_fileName = "/usr/local/cwaf/rules/rule-33062-Apps_WPPlugin.conf", m_lineNumber = 190, m_logData = "", m_marker = "", m_maturity = 0, m_op = 0x3121740, m_phase = 3, m_rev = "", m_ruleId = 0, m_secMarker = false, m_variables = 0x3120f80, m_ver = "", m_unconditional = false, m_referenceCount = 1}
(gdb) l
567 }
568 continue;
569 }
570
571 std::unique_ptr
(gdb) print *v $2 = {m_key = 0x7ffce6153a70, m_value = 0x3c349d0, m_dynamic_value = false, m_dynamic_key = false, m_dynamic = true, m_orign = empty std::list}
(gdb) printf "<%-64s>\n", (char)(v->m_key)
<6aaa80360ef1cc3640113a2aa4514aad::SESSION:wp_add > ############################################################## ###### NOTE: here *v->m_key seems not to be \0 terminated #### ############################################################## (gdb) printf "<%-64s>\n", (char*)(*v->m_value) <1' > (gdb) up #4 0x00007f2e622d8f02 in modsecurity::Rule::evaluate (this=0x31217a0, trans=0x39b5dd0, ruleMessage=std::shared_ptr (count 2, weak 0) 0x3b57b20) at rule.cc:706 706 finalVars = getFinalVars(trans); (gdb) print *this $4 = {m_accuracy = 0, m_actionsConf = std::vector of length 0, capacity 0, m_actionsRuntimePos = std::vector of length 0, capacity 0, m_actionsRuntimePre = std::vector of length 0, capacity 0, m_chained = false, m_chainedRule = 0x0, m_fileName = "/usr/local/cwaf/rules/rule-33062-Apps_WPPlugin.conf", m_lineNumber = 190, m_logData = "", m_marker = "", m_maturity = 0, m_op = 0x3121740, m_phase = 3, m_rev = "", m_ruleId = 0, m_secMarker = false, m_variables = 0x3120f80, m_ver = "", m_unconditional = false, m_referenceCount = 1} (gdb) (gdb) print *(Variable*)this->m_variables $8 = {_vptr.Variable = 0x3120ff0, m_name = " \026\022\003\000\000\000\000 \000\000\000\000\000\000\000\061\000\000\000\000\000\000\000\060\377^b.\177\000\000\001\000\016a\001\000\000\000\330\017\022\003\000\000\000\000\370\343\021`.\177\000\000\001\000\000\000H\017\267C1\000\000\000\000\000\000\000\005\000\000\000\000\000\000\000\005", '\000'
zimmerle
commented
7 years ago Hi @AdamJacobMuller,
I believe that the problem you are facing is a consequence of the rules being wrongly loaded. Not a run time issue. I am investigating.
defanator
commented
7 years ago Observing the very similar issue on Debian 8 "jessie" - this is the only OS where I was able to get 100% reproducible way to trigger segfault.
OS details:
root@vagrant:/# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 8.7 (jessie)
Release: 8.7
Codename: jessie
root@vagrant:/# gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/4.9/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 4.9.2-10' --with-bugurl=file:///usr/share/doc/gcc-4.9/README.Bugs --enable-languages=c,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-4.9 --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --with-gxx-include-dir=/usr/include/c++/4.9 --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --enable-gnu-unique-object --disable-vtable-verify --enable-plugin --with-system-zlib --disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.5.0-gcj-4.9-amd64/jre --enable-java-home --with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-4.9-amd64 --with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-4.9-amd64 --with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-objc-gc --enable-multiarch --with-arch-32=i586 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 4.9.2 (Debian 4.9.2-10)
root@vagrant:/# dpkg-query -W libc6
libc6:amd64 2.19-18+deb8u10Minimal nginx configuration:
user nginx;
worker_processes 1;
worker_rlimit_core 500000000;
working_directory /tmp;
error_log /var/log/nginx/error.log debug;
pid /var/run/nginx.pid;
load_module modules/ngx_http_modsecurity_module.so;
events {
worker_connections 1024;
}
http {
access_log off;
server {
listen 80;
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
location / {
proxy_pass http://nginx.org;
}
}
}/etc/nginx/modsec/main.conf:
include /etc/nginx/modsec/modsecurity.conf
# OWASP CRS v3.0.0 rules
include /etc/nginx/modsec/owasp-crs/crs-setup.conf
include /etc/nginx/modsec/owasp-crs/rules/*.conf/etc/nginx/modsec/modsecurity.conf:
SecRuleEngine On
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "(?:text|application)/xml" \
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_HEADERS:Content-Type "application/json" \
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:400, \
msg:'Multipart request body failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000
SecRule TX:/^MSC_/ "!@streq 0" \
"id:'200005',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html text/xml
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
SecTmpDir /tmp/
SecDataDir /tmp/
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog /var/log/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecUnicodeMapFile unicode.mapping 20127
SecStatusEngine OnIn /etc/nginx/modsec/owasp-crs/ there's a list of OWASP CRS v3.0.0 rules without any modifications.
Request:
root@vagrant:/# curl -vi -H 'User-Agent: Mozilla/5.00 (Nikto/2.1.6)' http://localhost/modsec-full/
* Hostname was NOT found in DNS cache
* Trying ::1...
* connect to ::1 port 80 failed: Connection refused
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 80 (#0)
> GET /modsec-full/ HTTP/1.1
> Host: localhost
> Accept: */*
> User-Agent: Mozilla/5.00 (Nikto/2.1.6)
>
* Empty reply from server
* Connection #0 to host localhost left intact
curl: (52) Empty reply from serverBacktrace:
(gdb) bt full
#0 0x00007f07d482226b in std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(std::string const&) ()
from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
No symbol table info available.
#1 0x00007f07d57a2954 in modsecurity::Rule::getFinalVars (this=this@entry=0x7f07d982d1d0, trans=trans@entry=0x7f07d97d77a0) at rule.cc:622
key = 0x7ffdde1e7e60
var = std::unique_ptr<modsecurity::collection::Variable> containing 0x7ffdde1e8070
v = <optimized out>
__for_range = std::vector of length 1, capacity 15 = {0x7f07dab7fed0}
variable = <optimized out>
e = std::vector of length 1, capacity 15 = {0x7f07dab7fed0}
ignoreVariable = false
i = 0
exclusions_update_by_tag_remove = empty std::list
exclusions_update_by_id_remove = empty std::list
variables = std::vector of length 1, capacity 1 = {0x7f07d982c9b0}
exclusions = empty std::list
finalVars = std::vector of length 0, capacity 0
#2 0x00007f07d57a44b4 in modsecurity::Rule::evaluate (this=this@entry=0x7f07d982d1d0, trans=trans@entry=0x7f07d97d77a0,
ruleMessage=std::shared_ptr (count 1, weak 0) 0x7f07dab7f7e0) at rule.cc:774
variables = <optimized out>
recursiveGlobalRet = <optimized out>
containsDisruptive = false
eparam = "\"1\""
globalRet = false
finalVars = std::vector of length 0, capacity 0
#3 0x00007f07d5794e07 in modsecurity::Rules::evaluate (this=0x7f07d97fe6a0, phase=phase@entry=3, transaction=transaction@entry=0x7f07d97d77a0) at rules.cc:219
rule = 0x7f07d982d1d0
i = 295
rules = std::vector of length -17458961258336, capacity -17458961258336 = {0x7f07d980a950, 0x7f07d980ad40, 0x7f07d980b4e0, 0x7f07d980bb70, 0x7f07d987dbb0,
0x7f07d986d660, 0x7f07d986dc40, 0x7f07d986e2d0, 0x7f07d986e800, 0x7f07d986ef00, 0x7f07d986f720, 0x7f07d986fce0, 0x7f07d9870110, 0x7f07d987df50, 0x7f07d987e390,
0x7f07d987e890, 0x7f07d987ee20, 0x7f07d987f460, 0x7f07d987f960, 0x7f07d98800c0, 0x7f07d9887780, 0x7f07d9887df0, 0x7f07d9888630, 0x7f07d9888be0, 0x7f07d9889110,
0x7f07d98896f0, 0x7f07d9889d90, 0x7f07d988a280, 0x7f07d988a850, 0x7f07d988ac90, 0x7f07d98699e0, 0x7f07d9869f00, 0x7f07d986a390, 0x7f07d986b350, 0x7f07d986b7f0,
0x7f07d986c8d0, 0x7f07d988d370, 0x7f07d988d800, 0x7f07d988e350, 0x7f07d988f190, 0x7f07d9890040, 0x7f07d9890ef0, 0x7f07d9892430, 0x7f07d98927a0, 0x7f07d9893690,
0x7f07d9894950, 0x7f07d9895e20, 0x7f07d9898330, 0x7f07d9899cb0, 0x7f07d989a810, 0x7f07d989c260, 0x7f07d989c610, 0x7f07d989e010, 0x7f07d989e350, 0x7f07d989eb00,
0x7f07d98674c0, 0x7f07d9868290, 0x7f07d9860d80, 0x7f07d98621f0, 0x7f07d98627c0, 0x7f07d9863c80, 0x7f07d989f040, 0x7f07d98a0510, 0x7f07d98a1ad0, 0x7f07d98a3090,
0x7f07d98a4680, 0x7f07d98a49c0, 0x7f07d98a50f0, 0x7f07d98a5f90, 0x7f07d98a6a90, 0x7f07d98a75d0, 0x7f07d98a7a70, 0x7f07d985cf50, 0x7f07d985e400, 0x7f07d985ecf0,
0x7f07d985f810, 0x7f07d9860380, 0x7f07d98a7e70, 0x7f07d985a870, 0x7f07d98ab4e0, 0x7f07d98ad150, 0x7f07d98adca0, 0x7f07d98ae260, 0x7f07d98aeb70, 0x7f07d98549f0,
0x7f07d9856440, 0x7f07d991c4a0, 0x7f07d9926660, 0x7f07d9926fe0, 0x7f07d9938050, 0x7f07d994f4f0, 0x7f07d994fe70, 0x7f07d9966b70, 0x7f07d9966fe0, 0x7f07d9850b90,
0x7f07d98520b0, 0x7f07d9853310, 0x7f07d9967410, 0x7f07d9968530, 0x7f07d996e4f0, 0x7f07d996fab0, 0x7f07d99710e0, 0x7f07d9972980, 0x7f07d9973470, 0x7f07d99748c0,
0x7f07d9975ec0, 0x7f07d99777c0, 0x7f07d9978950, 0x7f07d9979b50, 0x7f07d997ac40, 0x7f07d997aec0, 0x7f07d997bee0, 0x7f07d997faf0, 0x7f07d9981720, 0x7f07d9982160,
0x7f07d9983d50, 0x7f07d9984800, 0x7f07d9985b70, 0x7f07d9986ed0, 0x7f07d9988260, 0x7f07d9989570, 0x7f07d998abf0, 0x7f07d998c430, 0x7f07d998e3a0, 0x7f07d998f590,
0x7f07d9990fc0, 0x7f07d9992090, 0x7f07d9993250, 0x7f07d99946e0, 0x7f07d999a3e0, 0x7f07d999b370, 0x7f07d999e000, 0x7f07d999f260, 0x7f07d999fa80, 0x7f07d99a0f10,
0x7f07d99a1780, 0x7f07d99a2780, 0x7f07d99a4210, 0x7f07d99a55d0, 0x7f07d99a6c60, 0x7f07d99a6f60, 0x7f07d984ca60, 0x7f07d984e220, 0x7f07d984f890, 0x7f07d99a8020,
0x7f07d99a96c0, 0x7f07d99aab00, 0x7f07d99abec0, 0x7f07d99ad4c0, 0x7f07d99adc60, 0x7f07d99af410, 0x7f07d99afbf0, 0x7f07d99b0870, 0x7f07d99b18e0, 0x7f07d99b2a60,
0x7f07d99b2ea0, 0x7f07d9848b90, 0x7f07d984a740, 0x7f07d984c180, 0x7f07d99b8b70, 0x7f07d9bec540, 0x7f07d9bece90, 0x7f07d9c00450, 0x7f07d9c00fe0, 0x7f07d9c01400,
0x7f07d9844b60, 0x7f07d9846150, 0x7f07d9847660, 0x7f07d9c01e50, 0x7f07d9c027f0, 0x7f07d9c03990, 0x7f07d9c04a60, 0x7f07d9c055f0, 0x7f07d9c05a10, 0x7f07d9840af0,
0x7f07d9c0a010, 0x7f07d9c11900, 0x7f07d9c1a3a0, 0x7f07d9c23160, 0x7f07d9c24dd0, 0x7f07d9c89fd0, 0x7f07d9c8ba80, 0x7f07d9c94210, 0x7f07d9c95bf0, 0x7f07d9ca3510,
0x7f07d9ca4c90, 0x7f07d9ca5580, 0x7f07d9ca60c0, 0x7f07d9ca6c50, 0x7f07d9ca71f0, 0x7f07d983ca40, 0x7f07d983f3c0, 0x7f07d9ca7d10, 0x7f07d9ca9090, 0x7f07d9d30b60,
0x7f07d9d3b620, 0x7f07d9d3ce60, 0x7f07d9d4ee30, 0x7f07d9d50620, 0x7f07d9d51e50...}
#4 0x00007f07d5781eca in modsecurity::Transaction::processRequestBody (this=<optimized out>) at transaction.cc:811
a = std::unique_ptr<std::basic_string<char, std::char_traits<char>, std::allocator<char> >> containing 0x0
fullRequest = "Host: localhost\nAccept: */*\nUser-Agent: Mozilla/5.00 (Nikto/2.1.6)\n\n\n"
l = std::vector of length 3, capacity 4 = {0x7f07da910140, 0x7f07d9803760, 0x7f07d9803a20}
#5 0x00007f07d5aa0ba0 in ngx_http_modsecurity_pre_access_handler (r=0x7f07dab80040) at ../ModSecurity-nginx/src/ngx_http_modsecurity_pre_access.c:199
already_inspected = 0
chain = 0x0
ctx = 0x7f07d9791c58
cf = 0x7f07dab80040
old_pool = 0x0
#6 0x00007f07d7c470cf in ngx_http_core_generic_phase (r=0x7f07d9790f20, ph=0x7f07dab317f0) at src/http/ngx_http_core_module.c:873
rc = <optimized out>
#7 0x00007f07d7c4292d in ngx_http_core_run_phases (r=r@entry=0x7f07d9790f20) at src/http/ngx_http_core_module.c:851
rc = <optimized out>
ph = 0x7f07dab31760
cmcf = <optimized out>
#8 0x00007f07d7c42a22 in ngx_http_handler (r=r@entry=0x7f07d9790f20) at src/http/ngx_http_core_module.c:834
cmcf = <optimized out>
#9 0x00007f07d7c4d60e in ngx_http_process_request (r=0x7f07d9790f20) at src/http/ngx_http_request.c:1948
c = 0x7f07cfaf52e0
#10 0x00007f07d7c4deb0 in ngx_http_process_request_line (rev=0x7f07cf4f4130) at src/http/ngx_http_request.c:1048
n = <optimized out>
rc = <optimized out>
rv = <optimized out>
host = {len = 1,
data = 0x7f07d7c4e008 <ngx_http_wait_request_handler+264> "H\205\300H\211\003\017\204\020\377\377\377H\215\005E\373\377\377H\211\357H\211E\020H\203\304\030[]A\\A]\351/\373\377\377\017\037\200"}
c = 0x7f07cfaf52e0
r = 0x7f07d9790f20
#11 0x00007f07d7c36424 in ngx_epoll_process_events (cycle=<optimized out>, timer=<optimized out>, flags=<optimized out>) at src/event/modules/ngx_epoll_module.c:902
events = 1
revents = 1
instance = <optimized out>
i = 0
level = <optimized out>
err = <optimized out>
rev = <optimized out>
wev = <optimized out>
queue = <optimized out>
c = 0x7f07cfaf52e0
#12 0x00007f07d7c2d1ea in ngx_process_events_and_timers (cycle=cycle@entry=0x7f07d9778ec0) at src/event/ngx_event.c:242
flags = <optimized out>
timer = <optimized out>
delta = 1503598642301
#13 0x00007f07d7c342b1 in ngx_worker_process_cycle (cycle=cycle@entry=0x7f07d9778ec0, data=data@entry=0x0) at src/os/unix/ngx_process_cycle.c:749
worker = 0
#14 0x00007f07d7c32be3 in ngx_spawn_process (cycle=0x7f07d9778ec0, proc=0x7f07d7c34230 <ngx_worker_process_cycle>, data=0x0, name=0x7f07d7ccaa97 "worker process", respawn=1)
at src/os/unix/ngx_process.c:198
on = 1
pid = 0
s = 1
#15 0x00007f07d7c355ea in ngx_reap_children (cycle=<optimized out>) at src/os/unix/ngx_process_cycle.c:621
i = 1
n = 2
ch = {command = 2, pid = 14165, slot = 1, fd = -1}
ccf = 0x7f07dab80040
#16 ngx_master_process_cycle (cycle=0x7f07d9778ec0) at src/os/unix/ngx_process_cycle.c:174
title = 0x7f07d7f2b990 <ngx_last_process> "\002"
size = 140728330001264
n = 140728330001264
set = {__val = {0 <repeats 16 times>}}
itv = {it_interval = {tv_sec = 0, tv_usec = 0}, it_value = {tv_sec = 0, tv_usec = 0}}
#17 0x00007f07d7c0d30b in main (argc=<optimized out>, argv=<optimized out>) at src/core/nginx.c:381
b = <optimized out>
log = 0x7f07d7f18300 <ngx_log>
i = <optimized out>
cycle = 0x7f07d9774eb0
init_cycle = {conf_ctx = 0x0, pool = 0x7f07d9774970, log = 0x7f07d7f18300 <ngx_log>, new_log = {log_level = 0, file = 0x0, connection = 0, disk_full_time = 0,
handler = 0x0, data = 0x0, writer = 0x0, wdata = 0x0, action = 0x0, next = 0x0}, log_use_stderr = 0, files = 0x0, free_connections = 0x0, free_connection_n = 0,
modules = 0x0, modules_n = 0, modules_used = 0, reusable_connections_queue = {prev = 0x0, next = 0x0}, reusable_connections_n = 0, listening = {elts = 0x0,
nelts = 0, size = 0, nalloc = 0, pool = 0x0}, paths = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, config_dump = {elts = 0x0, nelts = 0, size = 0,
nalloc = 0, pool = 0x0}, config_dump_rbtree = {root = 0x0, sentinel = 0x0, insert = 0x0}, config_dump_sentinel = {key = 0, left = 0x0, right = 0x0, parent = 0x0,
color = 0 '\000', data = 0 '\000'}, open_files = {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0}, shared_memory = {
last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0}, connection_n = 0, files_n = 0, connections = 0x0, read_events = 0x0,
write_events = 0x0, old_cycle = 0x0, conf_file = {len = 21, data = 0x7ffdde1eaf8b "ss"}, conf_param = {len = 0, data = 0x0}, conf_prefix = {len = 11,
data = 0x7ffdde1eaf8b "ss"}, prefix = {len = 11, data = 0x7f07d7cc6860 "/etc/nginx/"}, lock_file = {len = 0, data = 0x0}, hostname = {len = 0, data = 0x0}}
cd = <optimized out>
ccf = 0x7f07d9776c78
(gdb) A Vagrant-based environment is available here for quick reproducing this segfault: https://github.com/defanator/modsecurity-performance
Steps to reproduce:
# git clone https://github.com/defanator/modsecurity-performance.git
# cd modsecurity-performance
# vagrant up debian
# vagrant ssh debian
vagrant@vagrant:~$ curl -vi -H 'User-Agent: Mozilla/5.00 (Nikto/2.1.6)' http://localhost/modsec-full/Tested on the following Vagrant box:
debian/jessie64 (libvirt, 8.7.0)Just finished testing on another box, debian/jessie64 (virtualbox, 8.9.0), the same results. OS details:
vagrant@vagrant:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 8.9 (jessie)
Release: 8.9
Codename: jessie
vagrant@vagrant:~$ gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/4.9/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 4.9.2-10' --with-bugurl=file:///usr/share/doc/gcc-4.9/README.Bugs --enable-languages=c,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-4.9 --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --with-gxx-include-dir=/usr/include/c++/4.9 --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --enable-gnu-unique-object --disable-vtable-verify --enable-plugin --with-system-zlib --disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.5.0-gcj-4.9-amd64/jre --enable-java-home --with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-4.9-amd64 --with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-4.9-amd64 --with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-objc-gc --enable-multiarch --with-arch-32=i586 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 4.9.2 (Debian 4.9.2-10)
vagrant@vagrant:~$ dpkg-query -W libc6
libc6:amd64 2.19-18+deb8u10Should be ok at: cc1d220b408fe73a4e1950b71848772d505d6ce0
zimmerle
commented
7 years ago Fix confirmed. Thanks ;)
Hello,
We are running ModSecurity@1edd3570e11e9bb2b6d86b249232b24917a4b0ac and ModSecurity-nginx@abbf2c47f6f3205484a1a9db618e067dce213b89 with nginx 1.13.1 and seeing the following segfault:
This looks like an issue/bug in ModSecurity directly (and not the nginx connector) so filing the bug here, let me know if that's incorrect.