mirrors/buildroot
0
0
Fork 0
mirror of https://git.busybox.net/buildroot.git synced 2024-11-30 17:03:31 +08:00
Code Issues Packages Projects Releases Wiki Activity
e87365ffb4
buildroot/package/modsecurity2/modsecurity2.mk

29 lines
972 B
Makefile
Raw Normal View History

package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 21:25:31 +08:00
################################################################################
#
# modsecurity2
#
################################################################################
package/modsecurity2: security bump to version 2.9.7 - Fix CVE-2023-24021: Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer overflows on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection. - host-pkgconf is mandatory and used to find libxml2 since https://github.com/SpiderLabs/ModSecurity/commit/baa38ddbaf55a87afecad7a1e1760c69a2689787 - pcre2 is supported since: https://github.com/SpiderLabs/ModSecurity/commit/8fc0b519b7a6c023259753a21f33bf3649a25b14 https://github.com/SpiderLabs/ModSecurity/blob/v2.9.7/CHANGES Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-02-05 22:00:02 +08:00
MODSECURITY2_VERSION = 2.9.7
package/modsecurity2: security bump to version 2.9.5 - Fix CVE-2021-42717: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4. - Use official tarball and so drop autoreconf Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-12-18 05:21:45 +08:00
MODSECURITY2_SOURCE = modsecurity-$(MODSECURITY2_VERSION).tar.gz
MODSECURITY2_SITE = https://github.com/SpiderLabs/ModSecurity/releases/download/v$(MODSECURITY2_VERSION)
package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 21:25:31 +08:00
MODSECURITY2_LICENSE = Apache-2.0
MODSECURITY2_LICENSE_FILES = LICENSE
package/modsecurity2: add CPE variables cpe:2.3:a:trustwave:modsecurity is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atrustwave%3Amodsecurity Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-12-18 05:20:15 +08:00
MODSECURITY2_CPE_ID_VENDOR = trustwave
MODSECURITY2_CPE_ID_PRODUCT = modsecurity
package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 21:25:31 +08:00
MODSECURITY2_INSTALL_STAGING = YES
package/modsecurity2: security bump to version 2.9.7 - Fix CVE-2023-24021: Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer overflows on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection. - host-pkgconf is mandatory and used to find libxml2 since https://github.com/SpiderLabs/ModSecurity/commit/baa38ddbaf55a87afecad7a1e1760c69a2689787 - pcre2 is supported since: https://github.com/SpiderLabs/ModSecurity/commit/8fc0b519b7a6c023259753a21f33bf3649a25b14 https://github.com/SpiderLabs/ModSecurity/blob/v2.9.7/CHANGES Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-02-05 22:00:02 +08:00
MODSECURITY2_DEPENDENCIES = host-pkgconf apache libxml2 pcre2
package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 21:25:31 +08:00
MODSECURITY2_CONF_OPTS = \
package/modsecurity2: security bump to version 2.9.7 - Fix CVE-2023-24021: Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer overflows on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection. - host-pkgconf is mandatory and used to find libxml2 since https://github.com/SpiderLabs/ModSecurity/commit/baa38ddbaf55a87afecad7a1e1760c69a2689787 - pcre2 is supported since: https://github.com/SpiderLabs/ModSecurity/commit/8fc0b519b7a6c023259753a21f33bf3649a25b14 https://github.com/SpiderLabs/ModSecurity/blob/v2.9.7/CHANGES Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-02-05 22:00:02 +08:00
--with-pcre2=$(STAGING_DIR)/usr/bin/pcre2-config \
package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 21:25:31 +08:00
--with-apr=$(STAGING_DIR)/usr/bin/apr-1-config \
--with-apu=$(STAGING_DIR)/usr/bin/apu-1-config \
--with-apxs=$(STAGING_DIR)/usr/bin/apxs \
--without-curl \
--without-lua \
package/modsecurity2: disable pcre Disable pcre to avoid the following build failure if pcre-config is found on host raised since bump to version 2.9.7 in commit 42e34cf10f9eb037aa8c48a4fb9e8f521901b983: /home/thomas/autobuild/instance-0/output-1/per-package/modsecurity2/host/bin/../lib/gcc/mips64el-buildroot-linux-gnu/11.3.0/../../../../mips64el-buildroot-linux-gnu/bin/ld: cannot find -lpcre: No such file or directory Fixes: - http://autobuild.buildroot.org/results/f4864f8cc1d07e357f6e5f8302c19ae94e9cf3af Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-02-20 00:56:38 +08:00
--without-pcre \
package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 21:25:31 +08:00
--without-yajl \
--without-ssdeep
$(eval $(autotools-package))
Reference in New Issue Copy Permalink