v3/master Lua unknown error #1809
Assignees
Labels
Comments
|
@theMiddleBlue, what version of Nginx and modsecurity are you running? Can you show
|
|
./configure nginx -V Core dump: |
|
I suspect this is a conflict with OpenResty's integration of LuaJIT, but I'm not certain. It might be worth trying to build libmodsecurity with OpenResty's LuaJIT (yes, there's a bit of chicken-and-egg if you're using the standard OpenResty build lifecycle). |
|
Actually, it's probably best not to try to make this work at all, given that Lua 5.1 (and thus LuaJIT) are unsupported by libmodsecurity . Whatever logic you need in Lua, probably best just to stick to OpenResty directly. Or better yet, use a WAF written specifically for OpenResty ;) |
|
I can't remember if I've tested this before, but recent versions of LuaJIT seems compatible with Lua 5.2 according to luajit.org. You might want to try with DLUAJIT_ENABLE_LUA52COMPAT. |
|
@victorhora 5.2 compatibility is already enabled by default with all modern OpenResty releases. |
|
thanks @p0pr0ck5 and @victorhora my purpose was to generate logs in the "modsecurity auditlog format" (json) for some Lua scripts that I use with the nginx_lua_module in openresty. Maybe I need to create the same modsec auditlog JSON using nginx_lua_module :/ |
|
I might have misunderstood you (or the issue) @p0pr0ck5, but I thought that you meant that libModSecurity is not supporting LuaJIT? I'm not affirming that it does or does not support, I was mentioning that by glancing at the current docs of LuaJIT I believe that it might work out of the box. It would be neat if you could share your thoughts here as I didn't had the chance of testing it yet. Thanks :) |
|
I will do some testing @victorhora, but the build chain at this point offers no way for libmodsecurity to look for a custom path for Lua headers/objects, nor does it appear to support LuaJIT. So anyone wanting to leverage LuaJIT is out of luck at this point without hacking the configure script. |
|
Some brief updates: I was able to reproduce the segault reported by @theMiddleBlue this morning with the following Nginx config snippet: And pretty easy to see why: Meanwhile the same config with vanilla Nginx 1.15.0 works just fine, with the expected error msg: Next step was to modify the autogenerated Modsecurity configure script to look for the OpenResty-included LuaJIT and attempt to build with this: But the configuration fails: Modifying the configure script to ignore 501 as an unusable version results in the following configure output: And compilation fails as follows: I will dig into the Lua engine a bit and see what I can find. |
|
Okay, a bit more hacking and I've got this working as PoC. First, I edited the autogenerated configure script to replace the This diff is absolutely not correct and needs a lot of work (particularly the And according to the debug logs we do indeed see transformations applying successfully and the Lua script executing, using the injected Oh, and to be sure, we are indeed using the appropriate Lua lib: Hopefully this is of some use folks. |
|
Lua 5.1 is now supported. Thanks @p0pr0ck5 :) I've just pushed PR #1854 to also support luaJIT which should hopefully solve this issue once and for all. My tests went fine on a couple of distros, but it would be good if you folks could check on other distros to make sure we are covering the major ones. |
|
LuaJIT should be supported as of 857bf9d |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi,
I've a problem using
exec:or defining aSecRuleScriptwith a test Lua script. Following my configurations and test:Rule:
My test Lua script:
In both cases I got an empty response and an unknown error makes nginx workers to crash:
modsecurity debug log:
nginx error.log
I've try to run my script and it works:
Any idea? Am I doing something wrong?
thanks.
The text was updated successfully, but these errors were encountered: