Description of problem:

When receiving requests quickly or concurrently, mod_security is unable to keep accurate count.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

Here is configuration for reproducing:

    SecRuleEngine On
    SecRule REQUEST_COOKIES:SESSIONID !^$  phase:1,id:118,nolog,pass,setsid:%{REQUEST_COOKIES.SESSIONID}
    SecAction phase:1,id:119,nolog,pass,setvar:SESSION.my_counter=+1

And here is a test script:

for i in $(seq 1 1000); do 
  curl -b "SESSIONID=testing" localhost &> /dev/null &
done


Actual results: Major loss in counter increments. You can check using modsec-sdbm-util and looking at the my_counter variable in output.


Expected results: No loss in counter increments.


Additional info: A solution has been proprosed upstream (https://github.com/SpiderLabs/ModSecurity/pull/1224) and is planned to be included in JBCS distribution of mod_security (https://issues.jboss.org/browse/JBCS-231).