owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx
size of the LMDB database file does not change
Nobody has claimed this yet.
- Dominant language
- Perl
- Stars
- 1.9k
- Forks
- 312
- PR merge metrics
- No merged PRs in 30d
Description
Hello, I'm using ModSecurity-nginx with lmdb support and REQUEST-912-DOS-PROTECTION rule.
The size of the lmdb database (modsec-shared-collections file) is always 1MB and does not change.
To determine the actual size of the database, I used the commands described here:
https://wiki.samba.org/index.php/Using_the_lmdb_database_backend
1MB size is not enough. Not all IP addresses are recorded in the database and "expire" does not work correctly.
This is what an entry with "expire" looks like:
key: 0x7f307db15d66 **ip_address**_85a8bfc5e4d8eebd5dee39313b7462b0aacedf6e::::dos_block, data: 0x7f307db15daa {"__expire_":1713440905,"__value_":"1"}
The "dos_block" flag has an expiration date - the time until which the IP address is blocked.
This is what a record that blocks an IP address forever (without expiration date) looks like:
key: 0x7f3444f23192 **ip_address**_4dc3eb4c759ce8aa387ad1a757061a314d369738::::dos_block, data: 0x7f3444f231d5 {"__value_":"1"}
Expire records stop being written to the lmdb database when there is a large number of IP addresses. I suspect that this is due to the lmdb database being full.
Is it possible to increase the size of the lmdb database?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file or test is named. Start by reproducing the behavior with the LMDB inspection commands linked in the issue and the REQUEST-912-DOS-PROTECTION rule, then trace how the modsec-shared-collections database handles capacity and expiration. Done means explaining why expiring records stop being written and validating a supported way to increase capacity or correct the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100