Re: FW: modsecurity pause action seems to be causing request to be dropped

Hey Paul,

Sorry, I do not have time to look into this. But I do agree is an action that
has an unexpected behaviour. I remember this clearly from when I wrote the
book and played around with it.

I do not think a lot of people are using it. Probably for this reason.

Best,

Christian

On Fri, Feb 07, 2020 at 05:23:21PM +0000, Paul Beckett wrote:
> Alexandre Schaff very kindly replied to me directly, and set me on the right path. Things are now sort of working, but I believe the behaviour of pause is not as I'd expect.
> 
> My SecDefaultAction is pass.
> The ModSecurity Handbook v2, described the pause action as "Pause for a period of time, then execute allow". For this reason I removed the "pass" as it seemed to be being ignored.
> Although it sounds like the behaviour of pause in relation to other actions was modified back in 2013 : https://github.com/SpiderLabs/ModSecurity/issues/445 . I'd hope that this had been updated into ubuntu's libapache2-mod-security2 package.
> 
> However I think the behaviour I am seeing doesn't seem to match either the pre-2013 case, or the expected behaviour suggested by that post:
> 
>   *   pause = pause then drop
>   *   pass,pause = pause then allow
> 
> Processing of additional rules does not take place:
> 
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2004,phase:2,log,msg:'***POST PAGE***',noauditlog,pass,pause:500,chain"
> SecRule REQUEST_METHOD "@rx ^POST$"
> # Add delay to rendering login page
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,log,msg:'***GET PAGE***',noauditlog,pass,pause:200"
> 
> ie. if it matched on rule ID:2004 then rule ID:2003 doesn't get processed.
> 
> Thanks,
> Paul
> 
> ________________________________
> From: SCHAFF Alexandre
> Sent: 07 February 2020 09:37
> To: Paul Beckett <[email protected]>
> Subject: Re: modsecurity pause action seems to be causing request to be dropped
> 
> Bonjour,
> 
> Issue in src code when action in SecRule 'pause' interacts with SecDefaultAction sets a disruptive action. Interaction happens when there is no disruptive action in the SecRule.
> 
> Try
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,pass,nolog,noauditlog,pause:371"
> 
> Alexandre.
> 
> 
> ________________________________
> From: Paul Beckett <[email protected]>
> Sent: Friday, February 7, 2020 8:32 AM
> To: [email protected] <[email protected]>
> Subject: [mod-security-users] modsecurity pause action seems to be causing request to be dropped
> 
> Yesterday this seemed to be working for me, but today this rule is seems to be causing the request to be dropped
> 
> Rule:
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,nolog,noauditlog,pause:371"
> 
> If I comment it out page returns, uncommented curl comes straight back with:
> * Empty reply from server
> * Connection #0 to host modsectest.local left intact
> curl: (52) Empty reply from server
> 
> This is being tested against a simple newly built test environment:
> Ubuntu 18.04.3 LTS
> Apache2 and mod-sec installed from repository
> Loading CRS3
> 
> If anyone can see an obvious explanation for this, I'd be very grateful.
> Thanks,
> Paul
> 


> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/



_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/