Re: Trying out "early blocking"
Rakesh Bare <[email protected]> Tue, 27 May 2025 12:04:35 +0530
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <CAFAfJojbp8_iixfz_jWonvqLqCDxJiyJSxHwvDjDoTuRyfn0NQ@mail.gmail.com> |
--===============2145200522540300622== Content-Type: multipart/alternative; boundary="000000000000c55c750636184242" --000000000000c55c750636184242 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hey, i have apache server with modsecurity. I have one rule which drop requests and get 403 response based on ip address which mentioned in txt file. this rule is triggered first. somehow the ip addresses which mentioned in that txt file can access my website but getting 400 response code (first time it showing 403 response as my first rule triggered). i dont know why apache giving 400 response code.? it should always give 403 response. Please suggest. Thanks, Rakesh On Tue, 27 May 2025, 08:59 CM via mod-security-users, < [email protected]> wrote: > But the purpose of early blocking is to block requests that Apache would > have otherwise redirected, is it not? > > Your 200 OK implies that there's no redirection in place, so even though > your log claimed that early blocking happened (my logs claim that too), > it's insufficient to prove that the redirect-prevention functionality is > actually functioning. > > What I'm seeing is that even though the logs claim early blocking is > happening, Apache is still able to perform redirects as normal on those > requests. > > Refer to attached auditlog1.txt where a score-14 request is answered with > a 308 redirect to another site even though the log claims "Access denied > with code 403 (phase 1)" (you won't see all the rules it matched because= I > put noauditlog on some of the 3-point rules, in total it violated 3 3-poi= nt > rules (noauditlog'd) and 1 5-point rule, for a total score of 14) > > after doing some additional testing, this seems to be an incompatibility > between early blocking and Apache's "ErrorDocument 403" directive. If I > disable "ErrorDocument 403" then early blocking is actually able to preve= nt > redirects but I don't really want to do that. "ErrorDocument" when > pointing to an internal URL is supposed to do a transparent, internal > rewrite rather than a redirect, but it sometimes has weird esoteric > interactions and incompatibilities, and it appears incompatibility with > early blocking is one of them > > so my next thought was to try to do early blocking with something other > than a 403, using some code I don't have an ErrorDocument for, such as a = 429 > > So I go to RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf and try to modify > early blocking rule 949111 like this: > > SecRuleUpdateActionById 949111 "t:none,deny,status:429" > > but this breaks my entire server and causes **all** requests to be > rejected with a 429, even score-0 requests > > see attached auditlog2.txt where a perfect score-0 request is rejected > with a 429 > > Message: Access denied with code 429 (phase 1). [file > "/usr/local/coreruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [lin= e > "221"] [id "949111"] [msg "Inbound Anomaly Score Exceeded in phase 1 (Tot= al > Score: 0)"] [ver "OWASP_CRS/4.14.0"] [tag "anomaly-evaluation"] [tag > "OWASP_CRS"] > > So I'm at a loss about how to proceed from here, other than turning off > early blocking, and probably going back to an older CRS version, since my > only reason for testing out CRS4 was because I thought I would be able to > get early blocking to work. > > > > > > > > Sent with Proton Mail secure email. > > On Monday, May 12th, 2025 at 3:43 AM, Ervin Heged=C3=BCs <[email protected]= om> > wrote: > > > Hi CM, > > > > I was able to check that with the "regular" build options (that I > > mentioned previously - Debian and Ubuntu feliver their packages > > with those options. > > > > Also I checked crs-setup.conf and enabled early blocking > > mechanism: > > > > > https://github.com/coreruleset/coreruleset/blob/main/crs-setup.conf.examp= le#L413-L421 > > > > I set up my config to use CRS on PL4 (to be sure that engine runs > > as many rules as possible). > > > > Then I sent a minimal but invalid request with telnet command: > > > > telnet localhost 80 > > Trying ::1... > > Connected to localhost. > > Escape character is '^]'. > > GET / HTTP/1.1 > > Host: 127.0.0.1 > > > > HTTP/1.1 200 OK > > Date: Mon, 12 May 2025 08:32:07 GMT > > Server: Apache/2.4.63 (Debian) > > Content-Length: 0 > > > > Errors in this request: > > * `Host` is an IP address - rule 920350 > > * `User-Agent` header is missing - rule 920320 > > > > These two rules collect 5 points which is enough to trigger rule > > 949111, which is responsible to deny the request in phase:1 > > > > > https://github.com/coreruleset/coreruleset/blob/main/rules/REQUEST-949-BL= OCKING-EVALUATION.conf#L212-L222 > > > > Here is the log: > > > > ModSecurity: Warning. Operator EQ matched 1 at TX:early_blocking. [file > "/home/airween/src/coreruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf= "] > [line "221"] [id "949111"] [msg "Inbound Anomaly Score Exceeded in phase = 1 > (Total Score: 5)"] [ver "OWASP_CRS/4.15.0-dev"] > > > > (I get response 200 because the engine is in DetectionOnly mode, > > and this is why you see "ModSecurity: Warning", and not "Access > > Denied) > > > > I think early blocking works as we expected. > > > > > > Please check your config again - hope this summary helps you. > > > > > > Regards, > > > > > > a._______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ > --000000000000c55c750636184242 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><p dir=3D"ltr">Hey,</p><p>i have apache server with modsec= urity. I have one rule which drop requests and get 403 response based on ip= address which mentioned in txt file. this rule is triggered first. <br><br= ></p><p>somehow the ip addresses which mentioned in that txt file can acces= s my website but getting 400 response code (first time it showing 403 respo= nse as my first rule triggered). i dont know why apache giving 400 response= code.? it should always give 403 response. Please suggest.<br><br></p><p>T= hanks,</p><p>Rakesh</p><p dir=3D"ltr"><br></p></div> <br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue= , 27 May 2025, 08:59 CM via mod-security-users, <<a href=3D"mailto:mod-s= [email protected]" target=3D"_blank">mod-security-users@l= ists.sourceforge.net</a>> wrote:<br></div><blockquote class=3D"gmail_quo= te" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204= );padding-left:1ex">But the purpose of early blocking is to block requests = that Apache would have otherwise redirected, is it not?<br> <br> Your 200 OK implies that there's no redirection in place, so even thoug= h your log claimed that early blocking happened (my logs claim that too), i= t's insufficient to prove that the redirect-prevention functionality is= actually functioning.<br> <br> What I'm seeing is that even though the logs claim early blocking is ha= ppening, Apache is still able to perform redirects as normal on those reque= sts.<br> <br> Refer to attached auditlog1.txt where a score-14 request is answered with a= 308 redirect to another site even though the log claims "Access denie= d with code 403 (phase 1)"=C2=A0 (you won't see all the rules it m= atched because I put noauditlog on some of the 3-point rules, in total it v= iolated 3 3-point rules (noauditlog'd) and 1 5-point rule, for a total = score of 14)<br> <br> after doing some additional testing, this seems to be an incompatibility be= tween early blocking and Apache's "ErrorDocument 403" directi= ve.=C2=A0 If I disable "ErrorDocument 403" then early blocking is= actually able to prevent redirects but I don't really want to do that.= =C2=A0 "ErrorDocument" when pointing to an internal URL is suppos= ed to do a transparent, internal rewrite rather than a redirect, but it som= etimes has weird esoteric interactions and incompatibilities, and it appear= s incompatibility with early blocking is one of them<br> <br> so my next thought was to try to do early blocking with something other tha= n a 403, using some code I don't have an ErrorDocument for, such as a 4= 29<br> <br> So I go to RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf and try to modify ea= rly blocking rule 949111 like this:<br> <br> SecRuleUpdateActionById 949111 "t:none,deny,status:429"<br> <br> but this breaks my entire server and causes **all** requests to be rejected= with a 429, even score-0 requests<br> <br> see attached auditlog2.txt where a perfect score-0 request is rejected with= a 429<br> <br> Message: Access denied with code 429 (phase 1). [file "/usr/local/core= ruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "221&q= uot;] [id "949111"] [msg "Inbound Anomaly Score Exceeded in = phase 1 (Total Score: 0)"] [ver "OWASP_CRS/4.14.0"] [tag &qu= ot;anomaly-evaluation"] [tag "OWASP_CRS"]<br> <br> So I'm at a loss about how to proceed from here, other than turning off= early blocking, and probably going back to an older CRS version, since my = only reason for testing out CRS4 was because I thought I would be able to g= et early blocking to work.<br> <br> <br> <br> <br> <br> <br> <br> Sent with Proton Mail secure email.<br> <br> On Monday, May 12th, 2025 at 3:43 AM, Ervin Heged=C3=BCs <<a href=3D"mai= lto:[email protected]" rel=3D"noreferrer" target=3D"_blank">[email protected]= om</a>> wrote:<br> <br> > Hi CM,<br> > <br> > I was able to check that with the "regular" build options (t= hat I<br> > mentioned previously - Debian and Ubuntu feliver their packages<br> > with those options.<br> > <br> > Also I checked crs-setup.conf and enabled early blocking<br> > mechanism:<br> > <br> > <a href=3D"https://github.com/coreruleset/coreruleset/blob/main/crs-se= tup.conf.example#L413-L421" rel=3D"noreferrer noreferrer" target=3D"_blank"= >https://github.com/coreruleset/coreruleset/blob/main/crs-setup.conf.exampl= e#L413-L421</a><br> > <br> > I set up my config to use CRS on PL4 (to be sure that engine runs<br> > as many rules as possible).<br> > <br> > Then I sent a minimal but invalid request with telnet command:<br> > <br> > telnet localhost 80<br> > Trying ::1...<br> > Connected to localhost.<br> > Escape character is '^]'.<br> > GET / HTTP/1.1<br> > Host: 127.0.0.1<br> > <br> > HTTP/1.1 200 OK<br> > Date: Mon, 12 May 2025 08:32:07 GMT<br> > Server: Apache/2.4.63 (Debian)<br> > Content-Length: 0<br> > <br> > Errors in this request:<br> > * `Host` is an IP address - rule 920350<br> > * `User-Agent` header is missing - rule 920320<br> > <br> > These two rules collect 5 points which is enough to trigger rule<br> > 949111, which is responsible to deny the request in phase:1<br> > <br> > <a href=3D"https://github.com/coreruleset/coreruleset/blob/main/rules/= REQUEST-949-BLOCKING-EVALUATION.conf#L212-L222" rel=3D"noreferrer noreferre= r" target=3D"_blank">https://github.com/coreruleset/coreruleset/blob/main/r= ules/REQUEST-949-BLOCKING-EVALUATION.conf#L212-L222</a><br> > <br> > Here is the log:<br> > <br> > ModSecurity: Warning. Operator EQ matched 1 at TX:early_blocking. [fil= e "/home/airween/src/coreruleset/rules/REQUEST-949-BLOCKING-EVALUATION= .conf"] [line "221"] [id "949111"] [msg "Inbo= und Anomaly Score Exceeded in phase 1 (Total Score: 5)"] [ver "OW= ASP_CRS/4.15.0-dev"]<br> > <br> > (I get response 200 because the engine is in DetectionOnly mode,<br> > and this is why you see "ModSecurity: Warning", and not &quo= t;Access<br> > Denied)<br> > <br> > I think early blocking works as we expected.<br> > <br> > <br> > Please check your config again - hope this summary helps you.<br> > <br> > <br> > Regards,<br> > <br> > <br> > a._______________________________________________<br> mod-security-users mailing list<br> <a href=3D"mailto:[email protected]" rel=3D"noreferr= er" target=3D"_blank">[email protected]</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"= rel=3D"noreferrer noreferrer" target=3D"_blank">https://lists.sourceforge.= net/lists/listinfo/mod-security-users</a><br> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:<b= r> <a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no= referrer noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/= commercial/rules/</a><br> <a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"= noreferrer noreferrer" target=3D"_blank">http://www.modsecurity.org/project= s/commercial/support/</a><br> </blockquote></div> --000000000000c55c750636184242-- --===============2145200522540300622== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2145200522540300622== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/ --===============2145200522540300622==--