NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2ae78f1c79
kumquat-buildroot/package/modsecurity2/modsecurity2.mk

29 lines
974 B
Makefile
Raw Normal View History

package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 15:25:31 +02:00
################################################################################
#
# modsecurity2
#
################################################################################
package/modsecurity2: security bump to version 2.9.5 - Fix CVE-2021-42717: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4. - Use official tarball and so drop autoreconf Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-12-17 22:21:45 +01:00
MODSECURITY2_VERSION = 2.9.5
MODSECURITY2_SOURCE = modsecurity-$(MODSECURITY2_VERSION).tar.gz
MODSECURITY2_SITE = https://github.com/SpiderLabs/ModSecurity/releases/download/v$(MODSECURITY2_VERSION)
package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 15:25:31 +02:00
MODSECURITY2_LICENSE = Apache-2.0
MODSECURITY2_LICENSE_FILES = LICENSE
package/modsecurity2: add CPE variables cpe:2.3:a:trustwave:modsecurity is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atrustwave%3Amodsecurity Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-12-17 22:20:15 +01:00
MODSECURITY2_CPE_ID_VENDOR = trustwave
MODSECURITY2_CPE_ID_PRODUCT = modsecurity
package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-18 15:25:31 +02:00
MODSECURITY2_INSTALL_STAGING = YES
MODSECURITY2_DEPENDENCIES = apache libxml2 pcre
MODSECURITY2_CONF_OPTS = \
--with-pcre=$(STAGING_DIR)/usr/bin/pcre-config \
--with-libxml=$(STAGING_DIR)/usr \
--with-apr=$(STAGING_DIR)/usr/bin/apr-1-config \
--with-apu=$(STAGING_DIR)/usr/bin/apu-1-config \
--with-apxs=$(STAGING_DIR)/usr/bin/apxs \
--without-curl \
--without-lua \
--without-yajl \
--without-ssdeep
$(eval $(autotools-package))
Reference in New Issue Copy Permalink