diff mbox series

[1/1] package/modsecurity2: new package

Message ID 20211018132532.814742-1-herve.codina@bootlin.com
State Accepted
Headers show
Series [1/1] package/modsecurity2: new package | expand

Commit Message

Herve Codina Oct. 18, 2021, 1:25 p.m. UTC 
The modsecurity2 package provides an Apache module implementing
a web application firewall (WAF) module.

Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com>
and Nicolas Carrier <nicolas.carrier@orolia.com>

modsecurity2 will be superseeded sooner or later by modsecurity v3
ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity
is already supported in Buildroot with its Nginx connector.
According to the Apache connector web page and the discussion [3],
the Apache connector is not ready for production use.

  [1] https://github.com/SpiderLabs/ModSecurity
  [2] https://github.com/SpiderLabs/ModSecurity-apache
  [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80

The best we can do now is to still use modsecurity2 (v2.9.x) for
Apache:
  https://github.com/SpiderLabs/ModSecurity/tree/v2/master

Signed-off-by: Herve Codina <herve.codina@bootlin.com>
---
A previous version was submitted but never merged:
  https://lore.kernel.org/buildroot/20191121172845.25958-1-tom.marcuzzi@orolia.com/
The patch was marked "superseeded" probably wrongly with the
introduction of modsecurity v3 (libmodsecurity and its Nginx
connector)

 DEVELOPERS                             |  2 ++
 package/Config.in                      |  5 +++++
 package/modsecurity2/Config.in         | 12 ++++++++++++
 package/modsecurity2/modsecurity2.hash |  3 +++
 package/modsecurity2/modsecurity2.mk   | 21 +++++++++++++++++++++
 5 files changed, 43 insertions(+)
 create mode 100644 package/modsecurity2/Config.in
 create mode 100644 package/modsecurity2/modsecurity2.hash
 create mode 100644 package/modsecurity2/modsecurity2.mk

Comments

Thomas Petazzoni Dec. 17, 2021, 8:47 p.m. UTC | #1 
Hello,

On Mon, 18 Oct 2021 15:25:31 +0200
Herve Codina <herve.codina@bootlin.com> wrote:

> The modsecurity2 package provides an Apache module implementing
> a web application firewall (WAF) module.
> 
> Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com>
> and Nicolas Carrier <nicolas.carrier@orolia.com>
> 
> modsecurity2 will be superseeded sooner or later by modsecurity v3
> ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity
> is already supported in Buildroot with its Nginx connector.
> According to the Apache connector web page and the discussion [3],
> the Apache connector is not ready for production use.
> 
>   [1] https://github.com/SpiderLabs/ModSecurity
>   [2] https://github.com/SpiderLabs/ModSecurity-apache
>   [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80
> 
> The best we can do now is to still use modsecurity2 (v2.9.x) for
> Apache:
>   https://github.com/SpiderLabs/ModSecurity/tree/v2/master
> 
> Signed-off-by: Herve Codina <herve.codina@bootlin.com>

Thanks, I've applied after:

 * Adding a bunch of additional --without-<something> to disable
   optional dependencies that are not handled

 * Adding a dependency on pcre, which even if it is already guaranteed
   to be there from Apache, is used directly by modsecurity2, so it
   makes sense to express this dependency.

Thanks!

Thomas
diff mbox series

Patch

diff --git a/DEVELOPERS b/DEVELOPERS
index 19f6d95270..9a41236705 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -1150,6 +1150,7 @@  F:	package/dtbocfg/
 F:	package/libdbi/
 F:	package/libdbi-drivers/
 F:	package/lua-augeas/
+F:	package/modsecurity2/
 F:	support/testing/tests/package/test_dtbocfg.py
 F:	support/testing/tests/package/test_lua_augeas.py
 
@@ -1991,6 +1992,7 @@  F:	package/bmap-tools/
 F:	package/libdbi/
 F:	package/libdbi-drivers/
 F:	package/lua-augeas/
+F:	package/modsecurity2/
 F:	package/php-xdebug/
 F:	package/python-augeas/
 F:	package/python-flask-expects-json/
diff --git a/package/Config.in b/package/Config.in
index 48f365d773..230a976b6b 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2097,6 +2097,11 @@  menu "Networking applications"
 	source "package/aircrack-ng/Config.in"
 	source "package/aoetools/Config.in"
 	source "package/apache/Config.in"
+if BR2_PACKAGE_APACHE
+menu "External Apache modules"
+	source "package/modsecurity2/Config.in"
+endmenu
+endif
 	source "package/argus/Config.in"
 	source "package/arp-scan/Config.in"
 	source "package/arptables/Config.in"
diff --git a/package/modsecurity2/Config.in b/package/modsecurity2/Config.in
new file mode 100644
index 0000000000..703cb682b3
--- /dev/null
+++ b/package/modsecurity2/Config.in
@@ -0,0 +1,12 @@ 
+config BR2_PACKAGE_MODSECURITY2
+	bool "modsecurity2"
+	depends on BR2_PACKAGE_APACHE
+	select BR2_PACKAGE_LIBXML2
+	help
+	  ModSecurity is an open source, cross-platform web application
+	  firewall (WAF) module. Known as the "Swiss Army Knife" of
+	  WAFs, it enables web application defenders to gain visibility
+	  into HTTP(S) traffic and provides a power rules language and
+	  API to implement advanced protections.
+
+	  https://github.com/SpiderLabs/ModSecurity
diff --git a/package/modsecurity2/modsecurity2.hash b/package/modsecurity2/modsecurity2.hash
new file mode 100644
index 0000000000..1501b5642e
--- /dev/null
+++ b/package/modsecurity2/modsecurity2.hash
@@ -0,0 +1,3 @@ 
+# Locally computed
+sha256  686695c650449a338757711254ea78c67dedb1d258e03e5c8686f869388fff8c  modsecurity2-2.9.4.tar.gz
+sha256  2c564f5a67e49e74c80e5a7dcacd1904e7408f1fd6a95218b38c04f012d94cb9  LICENSE
diff --git a/package/modsecurity2/modsecurity2.mk b/package/modsecurity2/modsecurity2.mk
new file mode 100644
index 0000000000..b9a5a93057
--- /dev/null
+++ b/package/modsecurity2/modsecurity2.mk
@@ -0,0 +1,21 @@ 
+################################################################################
+#
+# modsecurity2
+#
+################################################################################
+
+MODSECURITY2_VERSION = 2.9.4
+MODSECURITY2_SITE = $(call github,SpiderLabs,ModSecurity,v$(MODSECURITY2_VERSION))
+MODSECURITY2_LICENSE = Apache-2.0
+MODSECURITY2_LICENSE_FILES = LICENSE
+MODSECURITY2_INSTALL_STAGING = YES
+MODSECURITY2_DEPENDENCIES = apache libxml2
+MODSECURITY2_AUTORECONF = YES
+
+MODSECURITY2_CONF_OPTS += --with-pcre=$(STAGING_DIR)/usr/bin/pcre-config \
+	--with-libxml=$(STAGING_DIR)/usr \
+	--with-apr=$(STAGING_DIR)/usr/bin/apr-1-config \
+	--with-apu=$(STAGING_DIR)/usr/bin/apu-1-config \
+	--with-apxs=$(STAGING_DIR)/usr/bin/apxs
+
+$(eval $(autotools-package))