RESPONSE_BODY variable is unfilled

[p0pr0ck5]

It seems that ngx_http_modsecurity_body_filter.c makes some assumptions about the ngx_chain_t struct passed to ngx_http_modsecurity_body_filter. Examine the following:

Given the following nginx 1.8.1 build:

poprocks@soter:~/code/C/ModSecurity-nginx/src$ /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.8.1
built by gcc 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04) 
configure arguments: --with-debug --add-module=/home/poprocks/code/C/ModSecurity-nginx

And given the following inline modsecurity config: https://gist.github.com/p0pr0ck5/3864f5f18ae5ba5cb7aa

Given this diff for debug purposes - https://gist.github.com/p0pr0ck5/a24b2f8f8cd00997df41 -

Given a request to localhost/index.html (which will read the file from disk) we will find ourselves stepping through to here:

ngx_http_modsecurity_body_filter (r=0xfefee0, in=0x7ffff21ab810)
    at /home/poprocks/code/C/ModSecurity-nginx/src/ngx_http_modsecurity_body_filter.c:53
53      if (ctx == NULL) {
(gdb) 
59          dd("checking chain %p", chain);
(gdb) 
61          if (chain->buf->last_buf)
(gdb) 
63              buffer_fully_loadead = 1;
(gdb) 
57      for (; chain != NULL; chain = chain->next)
(gdb) 
67      if (buffer_fully_loadead == 1)
(gdb) 
73              dd("checking chain %p", chain);
(gdb) 
75              u_char *data = chain->buf->start;
(gdb) 
77              dd("data length is %ld", chain->buf->end - data);

We will see the following in the error log:

modsec *** ngx_http_modsecurity_body_filter: body filter, recovering ctx: 0xff0e50 at /home/poprocks/code/C/ModSecurity-nginx/src/ngx_http_modsecurity_body_filter.c line 51.
modsec *** ngx_http_modsecurity_body_filter: checking chain 0x7ffff21ab810 at /home/poprocks/code/C/ModSecurity-nginx/src/ngx_http_modsecurity_body_filter.c line 59.
modsec *** ngx_http_modsecurity_body_filter: checking chain 0x7ffff21ab810 at /home/poprocks/code/C/ModSecurity-nginx/src/ngx_http_modsecurity_body_filter.c line 73.

Examining the chain:

(gdb) print *(ngx_chain_t *) 0x7ffff21ab810
$1 = {buf = 0x1064250, next = 0x0}

Okay, we have a single buffer. The buffers contents:

(gdb) print *(ngx_buf_t *) 0x1064250
$2 = {pos = 0x0, last = 0x0, file_pos = 0, file_last = 612, start = 0x0, end = 0x0, tag = 0x0, file = 0x10642a0, shadow = 0x0, 
  temporary = 0, memory = 0, mmap = 0, recycled = 0, in_file = 1, flush = 0, sync = 0, last_buf = 1, last_in_chain = 1, 
  last_shadow = 0, temp_file = 0, num = 0}

So there is no buffer to pass to msc_append_response_body since the contents come from disk.

[zimmerle]

Hi @p0pr0ck5,

Thanks for the bug report :) it seems that the missing piece was:

r->filter_need_in_memory = 1;

See the commit: 221a134