owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx

size of the LMDB database file does not change

Open
#323 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Perl
Stars
1.9k
Forks
312
PR merge metrics
No merged PRs in 30d

Description

Hello, I'm using ModSecurity-nginx with lmdb support and REQUEST-912-DOS-PROTECTION rule.
The size of the lmdb database (modsec-shared-collections file) is always 1MB and does not change.
To determine the actual size of the database, I used the commands described here:
https://wiki.samba.org/index.php/Using_the_lmdb_database_backend
image (13)

1MB size is not enough. Not all IP addresses are recorded in the database and "expire" does not work correctly.
This is what an entry with "expire" looks like:
key: 0x7f307db15d66 **ip_address**_85a8bfc5e4d8eebd5dee39313b7462b0aacedf6e::::dos_block, data: 0x7f307db15daa {"__expire_":1713440905,"__value_":"1"}
The "dos_block" flag has an expiration date - the time until which the IP address is blocked.

This is what a record that blocks an IP address forever (without expiration date) looks like:
key: 0x7f3444f23192 **ip_address**_4dc3eb4c759ce8aa387ad1a757061a314d369738::::dos_block, data: 0x7f3444f231d5 {"__value_":"1"}

Expire records stop being written to the lmdb database when there is a large number of IP addresses. I suspect that this is due to the lmdb database being full.
Is it possible to increase the size of the lmdb database?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No repository file or test is named. Start by reproducing the behavior with the LMDB inspection commands linked in the issue and the REQUEST-912-DOS-PROTECTION rule, then trace how the modsec-shared-collections database handles capacity and expiration. Done means explaining why expiring records stop being written and validating a supported way to increase capacity or correct the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx
Domain
backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.