tx.param returns wrong value #9

Activity

1. Cpt-Graby commented on Nov 2, 2023

   

   Cpt-Graby

   on Nov 2, 2023

   Last edited by Cpt-Graby

   More actions

   Hi there,

   I personally started working with modsecurity (V2.9.7) and haproxy a week ago, so there may be some errors in my reasoning.

   I had the same problem as you with another custom rule. Modsec was logging it as a deny, but the flag in my haproxy stayed at '-101' as if nothing was wrong...
   By looking into the origin of the problem, I've been able to trace it back to a logic error.
   It occurs in the modsec_wrapper.c code around line 600

   	/* Process request headers analysis. */
   	status = modsecProcessRequestHeaders(req);
   	if (status != DECLINED && status != DONE)
   		return_code = status;
   
   	/* Process request body analysis. */
   	status = modsecProcessRequestBody(req);
   	if (status != DECLINED && status != DONE)
   		return_code = status;
   
   	/* End processing. */
   
   	fail = 0;
   	if (return_code == -1)
   		return_code = 0;
   

   The phase 1 keyword means it handle in the modsecProcessRequestHeaders(req) function but the spoa agent processes (and resets) the status variable with the line status=modsecProcessRequestBody(req) function.
   So i guess that's why haproxy reseve a "everthing is fine" info.

   So the solution that i thought of were:

   • Put an if statement between the two functions.
   • Change my rule to phase 2, instead of phase 1.

   In my case, i choose the second option because i didn't know the design logic in the first place.
2. buzz-tee commented on Mar 21, 2025

   

   buzz-tee

   on Mar 21, 2025

   More actions

   Same here. Note that value -101 corresponds to AP_NOBODY_READ which seems to be a variant of status code DECLINED (thus ModSecurity might in fact rather convert it to DECLINED).

   Maybe it would be an option to include AP_NOBODY_READ in the conditions for both phases:

   --- modsecurity-spoa.orig/modsec_wrapper.c  2025-03-21 10:37:56.195279627 +0100
   +++ modsecurity-spoa.mod/modsec_wrapper.c   2025-03-21 10:38:21.067901236 +0100
   @@ -602,12 +602,12 @@
    
    	/* Process request headers analysis. */
    	status = modsecProcessRequestHeaders(req);
   -	if (status != DECLINED && status != DONE)
   +	if (status != DECLINED && status != AP_NOBODY_READ && status != DONE)
    		return_code = status;
    
    	/* Process request body analysis. */
    	status = modsecProcessRequestBody(req);
   -	if (status != DECLINED && status != DONE)
   +	if (status != DECLINED && status != AP_NOBODY_READ && status != DONE)
    		return_code = status;
    
    	/* End processing. */

   For sure somebody with deeper understanding of the implications this patch brings should have a look first.