The Wayback Machine - https://web.archive.org/web/20200616205334/https://github.com/SpiderLabs/ModSecurity/issues/2300
Skip to content

/ ModSecurity

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Modsecurity Audit Log Section A logging IP addresses in HEX #2300

Open
inaratech opened this issue Apr 27, 2020 · 7 comments
Open

Modsecurity Audit Log Section A logging IP addresses in HEX #2300

inaratech opened this issue Apr 27, 2020 · 7 comments
Assignees
@zimmerle
Labels
3.x

Comments

@inaratech
Copy link

@inaratech inaratech commented Apr 27, 2020 •
edited

Hi,
Our modsecurity Audit log is logging section A in HEX i.e) SRC IP and DST IP are all in HEX. Tried searching for references to get this fixed but could not find anything therefore asking here.
A similar configuration on different server logs IP addresses correctly.
sample row as as follows
---zbDIkyKt---A--
[19/Apr/2020:13:50:48 +0900] 1587713388 0x562458815bb0 54952 0x562470244600 443
@zimmerle
Copy link
Member

@zimmerle zimmerle commented Apr 28, 2020

Hi @inaratech,

What are the versions of your ModSecurity and Nginx connector?
@zimmerle zimmerle self-assigned this Apr 28, 2020
@zimmerle zimmerle added the 3.x label Apr 28, 2020
@inaratech
Copy link
Author

@inaratech inaratech commented Apr 28, 2020

nginx-1.17.9
Modsecurity_nginx connector v1.0.1 - 2019-Dec-16
Modsecurity v3.0.4 - 2020-Jan-13
@phil47
Copy link

@phil47 phil47 commented May 2, 2020

Hello all,

For information, I have the same problem on:
Ubuntu 18.04.4 LTS
nginx/1.17.10 from nginx repository
Modsecurity-nginx v1.0.1 - 2019-Dec-16
Modsecurity v3.0.4 - 2020-Jan-13

I tried to install Apache server with modsecurity on the same server and there is no problem to get the real IP address.
@zavazingo
Copy link

@zavazingo zavazingo commented May 4, 2020 •
edited

Yesterday i faced same problem. It wasn't hex ip. It was pointer address.
Here are the quick fix. At ModSecurity/src/transaction.cc change lines like below;

line 1525 - audit_log << " " << this->m_clientIpAddress->c_str();
line 1527 - audit_log << " " << m_serverIpAddress->c_str();

Regards.
@zimmerle
Copy link
Member

@zimmerle zimmerle commented May 4, 2020

The bug is confirmed. The fix is really about get the value out of this pointer. We are currently working in something else that will present the fix for that issue as a side effect. Therefore I am leave it as is for now. Couple of days the new code will on v3/master. Thanks for the report.
@armandelli
Copy link

@armandelli armandelli commented May 28, 2020

Hey fellows, has this bug been fixed officially?
Just had this issue and ended up here on this thread :)
Thanks much!
Andre.
@5472-1
Copy link

@5472-1 5472-1 commented Jun 16, 2020 •
edited

Hi. Same issue here.

Specs:

Ubuntu 20.04 LTS
Modsecurity v3.0.4 - 2020-Jan-13
Apache/2.4.41 (Ubuntu) 2020-04-13
ModSecurity-apache connector v0.0.9-beta1 - 2017-Dec-22

Tried Zavazingo's work around but got an error at compile time. Tried other things like reinterpret cast to change the string to a pointer but even after compiling doesn't seem to have effect.
Edit: Also destination port seems to always be 0.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.x
6 participants
@zimmerle @phil47 @zavazingo @armandelli @inaratech @5472-1
You can’t perform that action at this time.