Duplicate Log Message: "(Content-Length) is larger than the configured limit"

[davewichers]

This is a minor issue. I'm seeing this log message twice in my ModSecurity 'H' blocks. I believe the cause is in: apache2/mod_security2.c:

line 877 is: msr_log(msr, 1, "Request body (Content-Length) is larger than the "
and lines 993, 996, & 1000 are the same (but only one of those will execute).

Seems like maybe the log event at 877 can simply be deleted since it duplicates what happens later on. Not sure which code block is more important and which can be removed.

I'm using mod_security 2.9.2 and it would be nice if this was fixed in the 2.9.x branch since 3.0 won't be coming out as a production ready release for a while.

[victorhora]

Hi @davewichers

Well the thing is that the code snippet in line 877 executes in the Phase 1 (Request Headers) and the other code block happens in Phase 2 (Request Body) .

There might be genuine reasons where a user can have rules placed on different phases and hence get the check (and warning) that the request body is larger than the configured limit and decide what to with it (SecRequestBodyLimitAction).

I believe that a simple method for you to avoid seeing this message on your logs is by simply raising the default values of SecRequestBodyLimit and SecRequestBodyNoFilesLimit that comes with your modsecurity.conf-recommend file.

For a future release, we could think about coming up with a SecRequestBodyLimitAction with an additional parameter of "NoLog/Log" in case the user wants to turn off/on the logging when this is met. But this would have to go to v3 as new features are only going to v3.

[davewichers]

Why would a Request Headers check care about the length of the body? And won't the Request Body phase happen either way? So if you simply eliminate the logging that occurs in line 877, it will still happen later so will avoid the duplication without the user having to do anything specific to avoid it.

…

On Wed, Oct 3, 2018 at 7:04 PM Victor Hora ***@***.***> wrote: Hi @davewichers <https://github.com/davewichers> Well the thing is that the code snippet in line 877 executes in the Phase 1 (Request Headers) <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#Phase_Request_Headers> and the other code block happens in Phase 2 (Request Body) <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#Phase_Request_Body> . There might be genuine reasons where a user can have rules placed on different phases and hence get the check (and warning) that the request body is larger than the configured limit and decide what to with it ( SecRequestBodyLimitAction <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecRequestBodyLimitAction> ). I believe that a simple method for you to avoid seeing this message on your logs is by simply raising the default values of SecRequestBodyLimit <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecRequestBodyLimit> and SecRequestBodyNoFilesLimit <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecRequestBodyNoFilesLimit> that comes with your modsecurity.conf-recommend <https://github.com/SpiderLabs/ModSecurity/blob/v2/master/modsecurity.conf-recommended#L38> file. For a future release, we could think about coming up with a SecRequestBodyLimitAction <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#SecRequestBodyLimitAction> with an additional parameter of "NoLog/Log" in case the user wants to turn off/on the logging when this is met. But this would have to go to v3 as new features are only going to v3. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1908 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBd6TG01v37rmXSQ-kKHKr1DyMhMHks5uhUKBgaJpZM4Wwt0J> .

[zimmerle]

@davewichers are you running nginx or apache ?

[davewichers]

I'm running Apache on CentOS 6 with ModSec 2.9.1 & CentOS 7 w/ ModSec 2.9.2. I believe I'm only seeing this behavior on my CentOS 7 setup. I'd have to retest on CentOS 6 w/ 2.9.1 to verify if that's important.

…

On Thu, Oct 4, 2018 at 2:40 PM Felipe Zimmerle ***@***.***> wrote: @davewichers <https://github.com/davewichers> are you running nginx or apache ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1908 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBR_uNiJ7OLwj08KzhoGefzactj4Uks5uhlYWgaJpZM4Wwt0J> .

[victorhora]

Ok, so the message is not duplicated on the debug_log, but only on the audit_log!. Being so, there's a chance that this behaviour is related with #1468 (comment).

Due to the fact that the "Request body (Content-Length) is larger than the configured limit" message is also printed on Apache's error_log, it would explain why it is printed twice like so:

Message: Request body (Content-Length) is LARGER than the configured limit (131072).
Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client ::1] ModSecurity: Request body (Content-Length) is LARGER than the configured limit (131072). [hostname "localhost"] [uri "/"] [unique_id "W7YdiW9nHAu6Ud3rZhqNbwAAAAA"]