Bug 1400625

Summary: mod_security collections lose increment counts
Product: Red Hat Enterprise Linux 7 Reporter: Robert Bost <rbost>
Component: mod_securityAssignee: Daniel Kopeček <dkopecek>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE - Apps <qe-baseos-apps>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.4Keywords: Triaged
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-10 13:27:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Robert Bost 2016-12-01 16:11:02 UTC 
Description of problem:

When receiving requests quickly or concurrently, mod_security is unable to keep accurate count.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

Here is configuration for reproducing:

    SecRuleEngine On
    SecRule REQUEST_COOKIES:SESSIONID !^$  phase:1,id:118,nolog,pass,setsid:%{REQUEST_COOKIES.SESSIONID}
    SecAction phase:1,id:119,nolog,pass,setvar:SESSION.my_counter=+1

And here is a test script:

for i in $(seq 1 1000); do 
  curl -b "SESSIONID=testing" localhost &> /dev/null &
done


Actual results: Major loss in counter increments. You can check using modsec-sdbm-util and looking at the my_counter variable in output.


Expected results: No loss in counter increments.


Additional info: A solution has been proprosed upstream (https://github.com/SpiderLabs/ModSecurity/pull/1224) and is planned to be included in JBCS distribution of mod_security (https://issues.jboss.org/browse/JBCS-231).
Comment 2 Daniel Kopeček 2017-03-10 13:27:23 UTC 

*** This bug has been marked as a duplicate of bug 1388656 ***