REMOTE_ADDR is incorrectly populated

[oniric85]

Hi, all
I was trying to determine what was not working with my GeoIP database that I've set up for ModSecurity under IIS. It seems to me that REMOTE_ADDR variable is filled with the ip address concatenated to the REMOTE_PORT like

127.0.0.1:54321

This is not correct as it then causes the Geo lookup to fail as per this log line:
GEO: Looking up "xxx.xxx.xxx.xxx:63565".
Geo lookup for "xxx.xxx.xxx.xxx:63565" failed: The requested name is valid, but no data of the requested type was found.

I think this is a big issue as it seems not to be local to the Geo IP section but a global problem.

[oniric85]

Some other information.
Using ModSecurity 2.8.0 with CRS 2.2.9

[oniric85]

This is probably related to this commit where client IP passing to IIS was added to ModSecurity:

https://github.com/SpiderLabs/ModSecurity/blob/8dc9ae9135f949355abf6bfabd423589daa542e3/iis/mymodule.cpp

Seems like GetIpAddr is using winsock function WSAAddressToString that also appends port information according to documentation and google searches so maybe this is the root cause of the problem.

[bedirhan]

Disclaimer: This is my first lua script and that language is not pretty.

Here's a overly simple lua script that you can use as a workaround

#!/opt/local/bin/lua
function main()

m.log(4, "Custom lua is running: " .. m.getvar("REMOTE_ADDR") );

local rawipaddress = m.getvar("REMOTE_ADDR", "none");

if(rawipaddress == nil) then
    m.log(4, "REMOTE_ADDR is nil");
    return nil
end

local ipaddress = "none";

for token in string.gmatch(rawipaddress, "[^:]+") do
    m.log(4, "IPAddress is " .. token);
    ipaddress = token
    break
end

if(ipaddress == nil) then
    m.log(4, "Parsed IP Address is nil, this is weird");
    return nil
end

m.setvar("TX.IPADRES", ipaddress);
m.log(4, "IP is in TX.IPADRES: " .. m.getvar("TX.IPADRES"));
return nil;
end

In order to use this as an example

SecRuleScript "set_ip.lua" "pass"
SecRule TX:IPADRES "@geoLookup" "chain,phase:1,t:none,block,log,msg:'Client IP not from US',id:1244"
SecRule GEO:COUNTRY_CODE "!@streq US"

[ojasp]

Just ran into the same issue, I have a custom rule that blocks IP addresses based on requested URIs & it only blocks IP/port combination(192.168.0.1:40987 etc) which defeats the purpose. The lua script above doesn't seem to set the "tx.ipadres" variable. Has this been fixed in the new version? Is there another workaround?

Thanks,
Ojas

[zimmerle]

Hi @ojasp this issue still open. There is no fix available yet. Most likely it will be fixed when the IIS add-on starts to use the libmodsecurity instead of the Standalone version.

[ojasp]

Thanks zimmerle! Do you suggest any workaround to extract IP address from remote_addr?

[ojasp]

I would like to post an update as I was able to get the above script to work after quite a lot of trial and error. When you call the lua script, please make sure to include phase & t:none. Here's my modified lua script:

#!/opt/local/bin/lua

function main()

local rawipaddress = m.getvar("REMOTE_ADDR", "none");

local ipaddress = "none";

for token in string.gmatch(rawipaddress, "[^:]+") do
    m.log(4, "IPAddress is " .. token);
    ipaddress = token
    break
end

m.setvar("TX.IPADRES", ipaddress);
m.log(4, "IP is in TX.IPADRES: " .. m.getvar("TX.IPADRES"));
return nil;
end

Here is how I call the lua script:

SecRuleScript "set_ip.lua" "phase:1,t:none,pass"
SecAction phase:1,nolog,pass,initcol:user=%{TX.IPADRES},id:100

[zimmerle]

@ojasp good solution!

[itrade-it]

@ojasp can you explain if there is new edition of your solution?

I put this in my modsecurity_crs_15_customrules.conf

SecRuleScript "set_ip.lua" "phase:1,t:none,pass"
SecAction phase:1,nolog,pass,initcol:user=%{TX.IPADRES},id:000009
SecRule TX:IPADRES "@geoLookup" "chain,phase:1,t:none,block,log,msg:'Client IP from top 12 High Risk Countries',id:000008"
SecRule GEO:COUNTRY_CODE "@pm UA ID YU LT EG RO BG TR RU PK MY IL"

Is this correct ?

[ojasp]

@itrade-it :
That looks about right, make sure that set_ip.lua script is in base_rules
directory. Unfortunately I wouldn't be able to help you much on this
because we gave up on modsecurity early this year as it was getting too
complicated & required more time to get things ironed out than we
originally anticipated. We figured that we could do similar stuff on IIS
with Request FIltering and it didn't require as much tinkering.

Are you are running .NET/MVC application with global.asax configured to
send unhandled errors? If so, even after mod-security blocks a request,
global.asax will still send you a notification. This is not the case with
Request Filtering (maybe because Request Filtering is baked into IIS).

Anyhow, I still have my lua script and custom rule files. Let me know if
you want me to share them with you.

On Tue, Apr 26, 2016 at 4:58 AM, itrade-it [email protected] wrote:

@ojasp https://github.com/ojasp can you explain if there is new edition
of your solution?

I put this in my modsecurity_crs_15_customrules.conf

SecRuleScript "set_ip.lua" "phase:1,t:none,pass"
SecAction phase:1,nolog,pass,initcol:user=%{TX.IPADRES},id:000009
SecRule TX:IPADRES "@geoLookup"
"chain,phase:1,t:none,block,log,msg:'Client IP from top 12 High Risk
Countries',id:000008"
SecRule GEO:COUNTRY_CODE "@pm https://github.com/pm UA ID YU LT EG RO
BG TR RU PK MY IL"

Is this correct ?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#734 (comment)

[itrade-it]

Thank you.
Can you explain how do similar staff with Request Filtering ?
( getting too complicated with MS ).

That looks about right, make sure that set_ip.lua script is in base_rules
directory. Unfortunately I wouldn't be able to help you much on this
because we gave up on modsecurity early this year as it was getting too
complicated & required more time to get things ironed out than we
originally anticipated. We figured that we could do similar stuff on IIS
with Request FIltering and it didn't require as much tinkering.

Are you are running .NET/MVC application with global.asax configured to
send unhandled errors? If so, even after mod-security blocks a request,
global.asax will still send you a notification. This is not the case with
Request Filtering (maybe because Request Filtering is baked into IIS).

Anyhow, I still have my lua script and custom rule files. Let me know if
you want me to share them with you.

On Tue, Apr 26, 2016 at 4:58 AM, itrade-it [email protected]
wrote:

@ojasp https://github.com/ojasp can you explain if there is new
edition
of your solution?

I put this in my modsecurity_crs_15_customrules.conf

SecRuleScript "set_ip.lua" "phase:1,t:none,pass"
SecAction phase:1,nolog,pass,initcol:user=%{TX.IPADRES},id:000009
SecRule TX:IPADRES "@geoLookup"
"chain,phase:1

[zimmerle]

Fixed by: #1220.