Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 189995 - www-apache/mod_security-2.1.1-r1 - "Phase REQUEST_BODY subrequest already intercepted with code 403." due to request_interception.patch
Summary: www-apache/mod_security-2.1.1-r1 - "Phase REQUEST_BODY subrequest already int...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Server (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Luca Longinotti (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on: 180150
Blocks:
  Show dependency tree
 
Reported: 2007-08-24 04:38 UTC by Vladimir
Modified: 2007-09-08 08:12 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Vladimir 2007-08-24 04:38:59 UTC 
Simple minimal ruleset for whitelisting my trus IP doesn't work and make "403 Access denied" error.

SecDefaultAction phase:2,log,deny,status:403
SecRule REMOTE_ADDR "^x\.x\.x\.x$" allow

Reproducible: Always
Comment 1 Vladimir 2007-08-24 04:40:03 UTC 
modsec_debug.log:
[/][4] Initialising transaction (txid D7gJt1nQIQgAADOFBYgAAAAA).
[/][4] Transaction context created (dcfg 80f9980).
[/][4] Starting phase REQUEST_HEADERS.
[/][4] Second phase starting (dcfg 80f9980).
[/][4] Input filter: This request does not have a body.
[/][4] Time #1: 378
[/][4] Starting phase REQUEST_BODY.
[/][4] Recipe: Invoking rule 812b8e8.
[/][4] Executing operator rx with param "^x\\.x\\.x\\.x$" against REMOTE_ADDR.
[/][4] Operator completed in 42 usec.
[/][4] Rule returned 1.
[/][1] Access allowed (phase 2). Pattern match "^x\\.x\\.x\\.x$" at REMOTE_ADDR.
[/][4] Time #2: 14281
[/index.php][4] Phase REQUEST_BODY subrequest already intercepted with code 403.

As I see in sources, this bug was introduced by mod_security-2.1.1-request_interception.patch, that was to have been provide support to mod_limitipconn
Comment 2 Benedikt Böhm (RETIRED) gentoo-dev 2007-09-08 08:12:03 UTC 
mod_security-2.1.2 in cvs, should be fixed