nginx 1.9.0 core dump

[pbesedm]

I compiled nginx-1.9.0 with ModSecurity-2.9.0, and nginx running as a proxy.

The nginx.conf is:

...
server {
resolver x.x.x.x;
resolver_timeout 5s;

listen       8088;
#server_name  localhost;

#charset koi8-r;

#access_log  logs/host.access.log  main;

location / {
    ModSecurityEnabled on;
    ModSecurityConfig modsecurity.conf;

    proxy_pass $scheme://$host$request_uri;
    proxy_set_header Host $http_host;

     proxy_buffers 256 4k;
     proxy_max_temp_file_size 0;

     proxy_connect_timeout 30;

     proxy_cache_valid 200 302 10m;
     proxy_cache_valid 301 1h;
     proxy_cache_valid any 1m;
}

Set SecRuleEngine On and did not Include any conf in modsecurity.conf.
So, When i visited site, nginx generate lots of errors in error.log, like:

2015/05/08 16:48:02 [alert] 2375#0: worker process 6401 exited on signal 11 (core dumped)
2015/05/08 16:48:03 [alert] 2375#0: worker process 6403 exited on signal 11 (core dumped)
2015/05/08 16:48:04 [alert] 2375#0: worker process 6405 exited on signal 11 (core dumped)

This is the bt information:
(gdb) bt
#0 ngx_http_upstream_copy_allow_ranges (r=0x8ff0d0, h=0x7fffdcda0af0, offset=) at src/http/ngx_http_upstream.c:4779
#1 0x000000000046ead6 in ngx_http_modsecurity_save_headers_out_visitor (data=0x8ff0d0, key=, value=) at ../modsecurity-2.9.0/nginx/modsecurity/ngx_http_modsecurity.c:765
#2 0x00007fb648ead1ad in apr_table_vdo () from /lib64/libapr-1.so.0
#3 0x00007fb648ead26f in apr_table_do () from /lib64/libapr-1.so.0
#4 0x00000000004703a4 in ngx_http_modsecurity_save_headers_out (r=0x8ff0d0) at ../modsecurity-2.9.0/nginx/modsecurity/ngx_http_modsecurity.c:707
#5 ngx_http_modsecurity_body_filter (r=, in=) at ../modsecurity-2.9.0/nginx/modsecurity/ngx_http_modsecurity.c:1190
#6 0x000000000040c549 in ngx_output_chain (ctx=ctx@entry=0x97dca0, in=in@entry=0x7fffdcda0e80) at src/core/ngx_output_chain.c:74
#7 0x000000000043738e in ngx_http_copy_filter (r=0x8ff0d0, in=0x7fffdcda0e80) at src/http/ngx_http_copy_filter_module.c:152
#8 0x0000000000449008 in ngx_http_range_body_filter (r=0x8ff0d0, in=) at src/http/modules/ngx_http_range_filter_module.c:605
#9 0x000000000042de5d in ngx_http_output_filter (r=r@entry=0x8ff0d0, in=in@entry=0x7fffdcda0e80) at src/http/ngx_http_core_module.c:1991
#10 0x000000000043116a in ngx_http_send_special (r=r@entry=0x8ff0d0, flags=flags@entry=1) at src/http/ngx_http_request.c:3341
#11 0x0000000000440cc5 in ngx_http_upstream_finalize_request (r=r@entry=0x8ff0d0, u=u@entry=0x905c60, rc=rc@entry=0) at src/http/ngx_http_upstream.c:4070
#12 0x0000000000441992 in ngx_http_upstream_process_request (r=r@entry=0x8ff0d0, u=u@entry=0x905c60) at src/http/ngx_http_upstream.c:3663
#13 0x0000000000441b5d in ngx_http_upstream_process_upstream (r=0x8ff0d0, u=0x905c60) at src/http/ngx_http_upstream.c:3596
#14 0x0000000000440d51 in ngx_http_upstream_handler (ev=) at src/http/ngx_http_upstream.c:1088
#15 0x00000000004263c5 in ngx_epoll_process_events (cycle=, timer=, flags=) at src/event/modules/ngx_epoll_module.c:822
#16 0x000000000041ed74 in ngx_process_events_and_timers (cycle=cycle@entry=0x8fb0c0) at src/event/ngx_event.c:249
#17 0x00000000004249d8 in ngx_worker_process_cycle (cycle=0x8fb0c0, data=) at src/os/unix/ngx_process_cycle.c:767
#18 0x0000000000423206 in ngx_spawn_process (cycle=cycle@entry=0x8fb0c0, proc=0x424907 <ngx_worker_process_cycle>, data=0x0, name=0x4b62d4 "worker process", respawn=respawn@entry=0)

at src/os/unix/ngx_process.c:198

#19 0x0000000000425350 in ngx_reap_children (cycle=0x8fb0c0) at src/os/unix/ngx_process_cycle.c:620
#20 ngx_master_process_cycle (cycle=cycle@entry=0x8fb0c0) at src/os/unix/ngx_process_cycle.c:173
#21 0x0000000000408b7d in main (argc=, argv=) at src/core/nginx.c:394

What else information should i provide?

[rbryancook]

I have also run into this, with nginx 1.8.0/modsecurity 2.9.0. The backtrace is almost identical. The nginx.conf is:
...
server {
listen 8080;
server_name 172.16.5.203;

    #charset koi8-r;

    #access_log  logs/host.access.log  main;

    location / {
        ModSecurityEnabled on;
        ModSecurityConfig modsecurity.conf;
        proxy_pass http://172.16.5.203;
    }
}

...

[zimmerle]

Hi @rbryancook and @pbesedm, please use our nginx_refactoring branch available at:

https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring

[rbryancook]

I downloaded and built (for NetBSD 6.0.4) the version from https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring, and built nginx 1.9.0 and it looks like the same problem. The backtrace is:

Program terminated with signal 11, Segmentation fault.
#0 0x0000000000440164 in ngx_http_upstream_copy_allow_ranges (
r=0x7f7ff4990050, h=0x7f7fffffd420, offset=)
at src/http/ngx_http_upstream.c:4779
4779 src/http/ngx_http_upstream.c: No such file or directory.
in src/http/ngx_http_upstream.c
(gdb) bt
#0 0x0000000000440164 in ngx_http_upstream_copy_allow_ranges (
r=0x7f7ff4990050, h=0x7f7fffffd420, offset=)
at src/http/ngx_http_upstream.c:4779
#1 0x000000000046e3f1 in ngx_http_modsecurity_save_headers_out_visitor (
data=0x7f7ff4990050, key=, value=)
at ../ModSecurity-master/nginx/modsecurity/ngx_http_modsecurity.c:765
#2 0x00007f7ff701458b in apr_table_vdo (
comp=0x46e339 <ngx_http_modsecurity_save_headers_out_visitor>,
rec=0x7f7ff4990050, t=0x7f7ff49929b8, vp=0x7f7fffffd4f0)
at tables/apr_tables.c:990
#3 0x00007f7ff7014785 in apr_table_do (comp=,
rec=, t=) at tables/apr_tables.c:925
#4 0x000000000046fa88 in ngx_http_modsecurity_save_headers_out (
r=0x7f7ff4990050)
at ../ModSecurity-master/nginx/modsecurity/ngx_http_modsecurity.c:707
#5 ngx_http_modsecurity_body_filter (r=0x7f7ff4990050, in=)
at ../ModSecurity-master/nginx/modsecurity/ngx_http_modsecurity.c:1190
#6 0x000000000040ce58 in ngx_output_chain (ctx=0x7f7ff49c2170,
in=0x7f7fffffd7d0) at src/core/ngx_output_chain.c:74
#7 0x00000000004376ed in ngx_http_copy_filter (r=0x7f7ff4990050,
in=0x7f7fffffd7d0) at src/http/ngx_http_copy_filter_module.c:152
#8 0x0000000000448429 in ngx_http_range_body_filter (r=0x7f7ff4990050,
in=) at src/http/modules/ngx_http_range_filter_module.c:605
---Type to continue, or q to quit---
#9 0x000000000042e3b9 in ngx_http_output_filter (r=,
in=) at src/http/ngx_http_core_module.c:1991
#10 0x0000000000431534 in ngx_http_send_special (r=0x7f7ff4990050, flags=1)
at src/http/ngx_http_request.c:3341
#11 0x0000000000440cdc in ngx_http_upstream_finalize_request (
r=0x7f7ff4990050, u=0x7f7ff49911f8, rc=0)
at src/http/ngx_http_upstream.c:4070
#12 0x0000000000441587 in ngx_http_upstream_process_request (r=0x7f7ff4990050,
u=0x7f7ff49911f8) at src/http/ngx_http_upstream.c:3663
#13 0x0000000000441c63 in ngx_http_upstream_process_upstream (
r=0x7f7ff4990050, u=0x7f7ff49911f8) at src/http/ngx_http_upstream.c:3596
#14 0x00000000004416e2 in ngx_http_upstream_handler (ev=)
at src/http/ngx_http_upstream.c:1088
#15 0x0000000000426e03 in ngx_kqueue_process_events (cycle=0x7f7ff7b1e050,
timer=, flags=)
at src/event/modules/ngx_kqueue_module.c:669
#16 0x000000000041f9be in ngx_process_events_and_timers (cycle=0x7f7ff7b1e050)
at src/event/ngx_event.c:249
#17 0x000000000042547f in ngx_worker_process_cycle (cycle=0x7f7ff7b1e050,
data=) at src/os/unix/ngx_process_cycle.c:767
#18 0x0000000000424051 in ngx_spawn_process (cycle=0x7f7ff7b1e050,
proc=0x4253a4 <ngx_worker_process_cycle>, data=0x0,
name=0x4b380f "worker process", respawn=0) at src/os/unix/ngx_process.c:198
---Type to continue, or q to quit---
#19 0x0000000000425dc7 in ngx_reap_children (cycle=0x7f7ff7b1e050)
at src/os/unix/ngx_process_cycle.c:620
#20 ngx_master_process_cycle (cycle=0x7f7ff7b1e050)
at src/os/unix/ngx_process_cycle.c:173
#21 0x0000000000409c25 in main (argc=, argv=)
at src/core/nginx.c:394

And my nginx.conf is:
server {
listen 8080;
server_name 172.16.5.203;

    #charset koi8-r;

    #access_log  logs/host.access.log  main;

    location / {
       ModSecurityEnabled on;
       ModSecurityConfig modsecurity.conf;
       proxy_pass $scheme://$host;
       proxy_set_header Host $http_host;
       proxy_buffers 256 4k;
       proxy_max_temp_file_size 0;
       proxy_connect_timeout 30;
       proxy_cache_valid 200 302 10m;
       proxy_cache_valid 301 1h;
       proxy_cache_valid any 1m;
    }
}   

If there is any other information that would be useful, please let me know.

[tuhoanganh]

@zimmerle
It works for me, Thanks
i'm using nginx 1.13 + nginx_refactoring