{"action":"created","issue":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/227","repository_url":"https://api.github.com/repos/nbs-system/naxsi","labels_url":"https://api.github.com/repos/nbs-system/naxsi/issues/227/labels{/name}","comments_url":"https://api.github.com/repos/nbs-system/naxsi/issues/227/comments","events_url":"https://api.github.com/repos/nbs-system/naxsi/issues/227/events","html_url":"https://github.com/nbs-system/naxsi/issues/227","id":109131413,"number":227,"title":"Nginx workers segfault with nginx 1.9.5, naxsi 0.54 if http2 is enabled","user":{"login":"selivan","id":1208989,"avatar_url":"https://avatars.githubusercontent.com/u/1208989?v=3","gravatar_id":"","url":"https://api.github.com/users/selivan","html_url":"https://github.com/selivan","followers_url":"https://api.github.com/users/selivan/followers","following_url":"https://api.github.com/users/selivan/following{/other_user}","gists_url":"https://api.github.com/users/selivan/gists{/gist_id}","starred_url":"https://api.github.com/users/selivan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/selivan/subscriptions","organizations_url":"https://api.github.com/users/selivan/orgs","repos_url":"https://api.github.com/users/selivan/repos","events_url":"https://api.github.com/users/selivan/events{/privacy}","received_events_url":"https://api.github.com/users/selivan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":26,"created_at":"2015-09-30T16:34:48Z","updated_at":"2016-04-29T20:53:05Z","closed_at":null,"body":"**UPD:** Problem occurs only if `http2` is enabled in `listen` directive.\r\n\r\nHere are core dump files, apport crash report and manulay built packages I used on Ubuntu 14.04: https://yadi.sk/d/6m32n8IFjRqrc\r\n\r\nnasxi 0.54\r\n\r\n```\r\nnginx -V\r\nnginx version: nginx/1.9.5\r\nbuilt with OpenSSL 1.0.1f 6 Jan 2014\r\nTLS SNI support enabled\r\nconfigure arguments: --add-module=/home/selivan/work/naxsi/nginx-1.9.5-custom/debian/modules/naxsi/naxsi_src/ --add-module=/home/selivan/work/naxsi/nginx-1.9.5-custom/debian/modules/nginx-upstream-fair/ --with-cc-opt='-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_addition_module --with-http_geoip_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module --with-http_xslt_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module --with-http_v2_module\r\n```\r\n\r\nOnly module I used except naxsi is nginx-upstream-fair.\r\n\r\nProblem appeared after couple of minutes of nginx working with production load, synthetic tests did not reproduce it. \r\n`nginx.conf`:\r\n```\r\nhttp {\r\n        # Naxsi\r\n        include /etc/nginx/naxsi_core.rules;\r\n...\r\nserver {\r\n        server_name *********;\r\n        include           /etc/nginx/naxsi.rules;\r\n        set $naxsi_extensive_log 1;\r\n        location /RequestDenied {\r\n            return 418;\r\n            access_log /var/log/nginx/denied.log;\r\n        }\r\n...\r\n```\r\n\r\n`naxsi_core.rules` taken unchanged from source.\r\n\r\n`naxsi.rules`:\r\n```\r\n#Enables learning mode\r\nLearningMode;\r\nSecRulesEnabled;\r\n#SecRulesDisabled;\r\nDeniedUrl \"/RequestDenied\";\r\n## check rules\r\nCheckRule \"$SQL >= 8\" BLOCK;\r\nCheckRule \"$RFI >= 8\" BLOCK;\r\nCheckRule \"$TRAVERSAL >= 4\" BLOCK;\r\nCheckRule \"$EVADE >= 4\" BLOCK;\r\nCheckRule \"$XSS >= 8\" BLOCK;\r\n```\r\n\r\nProblem also appeared with naxsi 0.54rc3, which I accidentally built first.\r\n"},"comment":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/comments/215878934","html_url":"https://github.com/nbs-system/naxsi/issues/227#issuecomment-215878934","issue_url":"https://api.github.com/repos/nbs-system/naxsi/issues/227","id":215878934,"user":{"login":"rfnx","id":7004526,"avatar_url":"https://avatars.githubusercontent.com/u/7004526?v=3","gravatar_id":"","url":"https://api.github.com/users/rfnx","html_url":"https://github.com/rfnx","followers_url":"https://api.github.com/users/rfnx/followers","following_url":"https://api.github.com/users/rfnx/following{/other_user}","gists_url":"https://api.github.com/users/rfnx/gists{/gist_id}","starred_url":"https://api.github.com/users/rfnx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfnx/subscriptions","organizations_url":"https://api.github.com/users/rfnx/orgs","repos_url":"https://api.github.com/users/rfnx/repos","events_url":"https://api.github.com/users/rfnx/events{/privacy}","received_events_url":"https://api.github.com/users/rfnx/received_events","type":"User","site_admin":false},"created_at":"2016-04-29T20:53:05Z","updated_at":"2016-04-29T20:53:05Z","body":"@buixor Hello, thanks again for your work. I tried again and I still have a crash with naxsi. This is very easy to reproduce : for me, it happens everytime I click the \"connection\" button on my wordpress site, to go to the admin connection page (default to /wp-admin).\r\n\r\nConfiguration :\r\n- nginx version : 1.10.0;\r\n- naxsi version : 0.55rc1;\r\n- http/2 enabled;\r\n- Linux kernel with grsecurity.\r\n\r\nMy system log after the crash : \r\n```\r\nkernel: grsec: From 127.0.0.6: Segmentation fault occurred at 0000000000ad37e4 in /usr/bin/nginx[nginx:11381] uid/euid:33/33 gid/egid:33/33, parent /usr/bin/nginx[nginx:11379] uid/euid:0/0 gid/egid:0/0\r\nkernel: grsec: From 127.0.0.6: bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds.  Please investigate the crash report for /usr/bin/nginx[nginx:11381] uid/euid:33/33 gid/egid:33/33, parent /usr/bin/nginx[nginx:11379] uid/euid:0/0 gid/egid:0/0\r\nsystemd-coredump[11419]: Process 11381 (nginx) of user 33 dumped core.\r\n\r\n                                                        Stack trace of thread 11381:\r\n                                                        #0  0x00000000004c5964 nx_find_wl_in_hash (nginx)\r\n                                                        #1  0x00000000004c5e85 ngx_http_dummy_is_rule_whitelisted_n (nginx)\r\n                                                        #2  0x00000000004c7599 ngx_http_apply_rulematch_v_n (nginx)\r\n                                                        #3  0x00000000004c7ee2 ngx_http_basestr_ruleset_n (nginx)\r\n                                                        #4  0x00000000004c82c5 ngx_http_dummy_headers_parse (nginx)\r\n                                                        #5  0x00000000004c9980 ngx_http_dummy_data_parse (nginx)\r\n                                                        #6  0x00000000004cbc9e n/a (nginx)\r\n                                                        #7  0x00000000004563fc ngx_http_core_rewrite_phase (nginx)\r\n                                                        #8  0x0000000000451895 ngx_http_core_run_phases (nginx)\r\n                                                        #9  0x000000000045c973 ngx_http_process_request (nginx)\r\n                                                        #10 0x00000000004890a6 n/a (nginx)\r\n                                                        #11 0x0000000000489d76 n/a (nginx)\r\n                                                        #12 0x0000000000489fbe n/a (nginx)\r\n                                                        #13 0x0000000000488855 n/a (nginx)\r\n                                                        #14 0x000000000043e750 ngx_event_process_posted (nginx)\r\n                                                        #15 0x0000000000444921 n/a (nginx)\r\n                                                        #16 0x0000000000443350 ngx_spawn_process (nginx)\r\n                                                        #17 0x0000000000444c84 n/a (nginx)\r\n                                                        #18 0x00000000004455a4 ngx_master_process_cycle (nginx)\r\n                                                        #19 0x0000000000421838 main (nginx)\r\n                                                        #20 0x0000031d74329710 __libc_start_main (libc.so.6)\r\n                                                        #21 0x0000000000421d09 _start (nginx)\r\n\r\n                                                        Stack trace of thread 11392:\r\n                                                        #0  0x0000031d761333e8 pthread_cond_timedwait@@GLIBC_2.3.2 (libpthread.so.0)\r\n                                                        #1  0x00000000006f3095 n/a (nginx)\r\n                                                        #2  0x00000000006efb3a n/a (nginx)\r\n                                                        #3  0x000000000050b86e n/a (nginx)\r\n                                                        #4  0x00000000006f4588 n/a (nginx)\r\n                                                        #5  0x0000031d7612d424 start_thread (libpthread.so.0)\r\n                                                        #6  0x0000031d743f0cbd __clone (libc.so.6)\r\n```"}}