tx.paranoia_level on v3/master ignored #1127
Comments
|
Thank you for reporting @theMiddleBlue. And sorry for the inconvenience. This sounds annoying indeed. Could you raise the ModSec DebugLogLevel and show us the detailed debug log for 920014, please? There we should see the actual paranoia level and the skipping to the end of the 920xxx rule file. Your alerts indicate this rule not working properly. |
|
Hi @dune73, Following a grep by 920014 and here with 5 lines before and after: |
|
A user on irc reported the same thing. He assumed it was this commit owasp-modsecurity/ModSecurity@202a15b |
|
I'm using this request for reproduce it: Audit Log: Debug Log: |
|
As this appears in part to be a libmodsec problem @zimmerle would you like me to xpost this? |
|
@csanders-git doing some tests, it seems that the latest working commit is owasp-modsecurity/ModSecurity@f928e44 |
|
Doing some tests, I've found the problem: v3/master ignore this variable when it's set using lowercase variable name... Working configuration: SecAction \
"id:900000,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:TX.PARANOIA_LEVEL=1"Wrong configuration: SecAction \
"id:900000,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:tx.paranoia_level=1"Maybe this problem could affects any other SecRule on the CRS that set a lowercase variable name. |
|
Hmmmm, that should not happen... From the ModSecurity handbook:
|
|
Just tested more: OK: SecAction \
"id:900000,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:TX.PARANOIA_LEVEL=1"KO: SecAction \
"id:900000,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:tx.paranoia_level=1"KO: SecAction \
"id:900000,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:TX.paranoia_level=1"KO: SecAction \
"id:900000,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:TX.parANoia_LEvel=1" |
|
So if I had to guess that cfg for variable needs to be case insensitive @zimmerle |
|
I think this bug has been introduced by owasp-modsecurity/ModSecurity@892beb5 Here, the lookup was changed from using std::multimap::equal_range with custom hash and equal functions (both case-insensitive) to std::string::compare, which is case-sensitive: - auto range = this->equal_range(var);
- for (auto it = range.first; it != range.second; ++it) {
- l->insert(l->begin(), new VariableValue(&m_name, &var, &it->second));
+ for (auto &a : *this) {
+ if (a.first.compare(0, var.size(), var) == 0) {
+ l->insert(l->begin(), new VariableValue(&m_name, &var, &a.second));
+ }As a side-note, this change also seems to have turned a hash lookup into a linear search, so it may well have performance impact. |
|
Thanks for the detailed reporting guys. This is being handled at owasp-modsecurity/ModSecurity#1808. PR #1810 is up for evaluation to fix this issue. My tests went well and the buildbots are going fine for now. Would appreciate if you folks could test and report as well. Thanks! |
|
As pointed out by @zimmerle at owasp-modsecurity/ModSecurity#1808 (comment), this has been fixed by commit owasp-modsecurity/ModSecurity@d810de9. Thanks for your contribution @michaelgranzow-avi :) I believe this one can be closed now. |
Hi,
I've an odd behavior with the last v3/master version (I've just pulled it). It seems that it ignores at all the
setvar:tx.paranoia_level=1and it matches many rules in PL2, 3 and 4.My configuration:
And on audit log I've many of these (with my previous version of v3/master it wasn't happen):
Any idea? how can I do for pull the previous version of v3/master?
Thanks!
The text was updated successfully, but these errors were encountered: