kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/security/ap-modsecurity2/Makefile

59 lines
1.7 KiB
Makefile
Raw Normal View History

Recursive bump for pcre-8.30* (shlib major change)
2012-03-03 01:11:51 +01:00
# $NetBSD: Makefile,v 1.20 2012/03/03 00:13:51 wiz Exp $
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
DISTNAME= modsecurity-apache_2.5.13
Update to 2.1.0 Fix a typo in options.mk 23 Feb 2006 - 2.1.0 ------------------- * Removed the "Connection reset by peer" message, which has nothing to do with us. Actually the message was downgraded from ERROR to NOTICE so it will still appear in the debug log. * Removed the (harmless) message mentioning LAST_UPDATE_TIME missing. * It was not possible to remove a rule placed in phase 4 using SecRuleRemoveById or SecRuleRemoveByMsg. Fixed. * Fixed a problem with incorrectly setting requestBodyProcessor using the ctl action. * Bundled Core Rules 2.1-1.3.2b4. * Updates to the reference manual. * Reversed the return values of @validateDTD and @validateSchema, to make them consistent with other operators. * Added a few helpful debug messages in the XML validation area. * Updates to the reference manual. * Fixed the validateByteRange operator. * Default value for the status action is now 403 (as it was supposed to be but it was effectively 500). * Rule exceptions (removing using an ID range or an regular expression) is now applied to the current context too. (Previously it only worked on rules that are inherited from the parent context.) * Fix of a bug with expired variables. * Fixed regular expression variable selectors for many collections. * Performance improvements - up to two times for real-life work loads! * Memory consumption improvements (not measured but significant). * The allow action did not work in phases 3 and 4. Fixed. * Unlocked collections GLOBAL and RESOURCE. * Added support for variable expansion in the msg action. * New feature: It is now possible to make relative changes to the audit log parts with the ctl action. For example: "ctl:auditLogParts=+E". * New feature: "tag" action. To be used for event categorisation. * XML parser was not reporting errors that occured at the end of XML payload. * Files were not extracted from request if SecUploadKeepFiles was Off. Fixed. * Regular expressions that are too long are truncated to 256 characters before used in error messages. (In order to keep the error messages in the log at a reasonable size.) * Fixed the sha1 transformation function. * Fixed the skip action. * Fixed REQUEST_PROTOCOL, REMOTE_USER, and AUTH_TYPE. * SecRuleEngine did not work in child configuration contexts (e.g. <Location>). * Fixed base64Decode and base64Encode. 15 Nov 2006 - 2.0.4 ------------------- * Fixed the "deprecatevar" action. * Decreasing variable values did not work. * Made "nolog" do what it is supposed to do - cause a rule match to not be logged. Also "nolog" now implies "noauditlog" but it's possible to follow "nolog" with "auditlog" and have the match not logged to the error log but logged to the auditlog. (Not something that strikes me as useful but it's possible.) * Relative paths given to SecDataDir will now be treated as relative * Decreasing variable values did not work. * Made "nolog" do what it is supposed to do - cause a rule match to not be logged. Also "nolog" now implies "noauditlog" but it's possible to follow "nolog" with "auditlog" and have the match not logged to the error log but logged to the auditlog. (Not something that strikes me as useful but it's possible.) * Relative paths given to SecDataDir will now be treated as relative to the Apache server root. * Added checks to make sure only correct actions are specified in SecDefaultAction (some actions are required, some don't make any sense) and in rules that are not chain starters (same). This should make the unhelpful "Internal Error: Failed to add rule to the ruleset" message go away. * Fixed the problem when "SecRuleInheritance Off" is used in a context with no rules defined. * Fixed a problem of lost input (request body) data on some redirections, for example when mod_rewrite is used.
2007-03-18 11:35:13 +01:00
PKGNAME= ${APACHE_PKG_PREFIX}-${DISTNAME:S/apache_//}
Recursive bump for pcre-8.30* (shlib major change)
2012-03-03 01:11:51 +01:00
PKGREVISION= 2
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
CATEGORIES= www security
MASTER_SITES= http://www.modsecurity.org/download/
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
LICENSE= gnu-gpl-v2
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
Give up MAINTAINER
2009-07-17 20:00:13 +02:00
MAINTAINER= pkgsrc-users@NetBSD.org
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
HOMEPAGE= http://www.modsecurity.org/
COMMENT= Intrusion detection and prevention engine for web applications
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
PKG_DESTDIR_SUPPORT= user-destdir
APACHE_MODULE= yes
Wants APU, so no apache2
2011-11-25 23:18:11 +01:00
PKG_APACHE_ACCEPTED= apache22
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
USE_APR= yes
USE_LANGUAGES= c++ c
Also supports apache 2.2.x PKGREVISION++
2008-10-25 17:59:27 +02:00
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
.include "../../mk/apache.mk"
.include "options.mk"
Update from 2.1.4->2.5.7 Use ./configure as one is now supplied libmxl2 is no longer optional but curl is Rename doc/eg dirs from ap-security to ap-modsecurity * Allow for disabling request body limit checks in phase:1 * Now log XML parsing/validation warnings and errors to be in the debug log at levels 3 and 4, respectivly. * Transformation caching has been deprecated, and is now off by default. We now advise against using transformation caching in production. * Improve request body processing error messages. Any many more . . . see CHANGES for all the details
2008-10-12 14:50:17 +02:00
GNU_CONFIGURE= YES
USE_TOOLS+= pax
Needs libtool.
2009-01-29 17:54:17 +01:00
USE_LIBTOOL= yes
Update from 2.1.4->2.5.7 Use ./configure as one is now supplied libmxl2 is no longer optional but curl is Rename doc/eg dirs from ap-security to ap-modsecurity * Allow for disabling request body limit checks in phase:1 * Now log XML parsing/validation warnings and errors to be in the debug log at levels 3 and 4, respectivly. * Transformation caching has been deprecated, and is now off by default. We now advise against using transformation caching in production. * Improve request body processing error messages. Any many more . . . see CHANGES for all the details
2008-10-12 14:50:17 +02:00
WRKSRC= ${WRKDIR}/${DISTNAME}/apache2
* additional missing clean up after removal of libxml option. * pass to configure more preferred variables.
2011-03-19 14:31:52 +01:00
CONFIGURE_ARGS+= --with-apxs=${APXS}
CONFIGURE_ARGS+= --with-pcre=${BUILDLINK_PREFIX.pcre}
CONFIGURE_ARGS+= --with-libxml=${BUILDLINK_PREFIX.libxml2}
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
CONFIGURE_ARGS+= --with-lua=${BUILDLINK_PREFIX.lua}
CONFIGURE_ARGS+= --with-apr=${BUILDLINK_PREFIX.apr}
CONFIGURE_ARGS+= --with-apu=${BUILDLINK_PREFIX.apr-util}
INSTALLATION_DIRS+= lib/httpd
INSTALL_ENV+= APACHEPREFIX=${BUILDLINK_PREFIX.apache}
INSTALL_ENV+= DESTDIR=${DESTDIR}
Second round of explicit pax dependencies. As reminded by tnn@, many packages used to use ${PAX}. Use the common way of directly calling pax, it is created as tool after all.
2008-05-26 04:13:14 +02:00
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
EGDIR= share/examples/ap-modsecurity
DOCDIR= share/doc/ap-modsecurity
INSTALLATION_DIRS+= ${EGDIR} ${DOCDIR}
Update to 2.5.9 * Fixed PDF XSS issue where a non-GET request for a PDF file would crash the Apache httpd process. Discovered by Steve Grubb at Red Hat. * Removed an invalid "Internal error: Issuing "%s" for unspecified error." message that was logged when denying with nolog/noauditlog set and causing the request to be audited. * Fixed parsing multipart content with a missing part header name which would crash Apache. Discovered by "Internet Security Auditors" (isecauditors.com). * Added ability to specify the config script directly using --with-apr and --with-apu. * Updated copyright year to 2009. * Added macro expansion for append/prepend action. * Fixed race condition in concurrent updates of persistent counters. Updates are now atomic. * Cleaned up build, adding an option for verbose configure output and making the mlogc build more portable.
2009-03-14 14:45:38 +01:00
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
CONF_FILES= ${PREFIX}/${EGDIR}/modsecurity.conf-minimal \
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
${PKG_SYSCONFDIR}/httpd/modsecurity.conf
Add in a BUILDLINK depends on apache>=2.0.59nb2 as that contains the libtool fix this package needs to build. Riding on the initial import - no PKGREVISION bump
2006-11-05 19:05:33 +01:00
BUILDLINK_API_DEPENDS.apache+= apache>=2.0.59nb2
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
post-install:
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
${INSTALL_DATA} ${WRKDIR}/${DISTNAME}/modsecurity.conf-minimal \
${DESTDIR}${PREFIX}/${EGDIR}
Update from 2.1.4->2.5.7 Use ./configure as one is now supplied libmxl2 is no longer optional but curl is Rename doc/eg dirs from ap-security to ap-modsecurity * Allow for disabling request body limit checks in phase:1 * Now log XML parsing/validation warnings and errors to be in the debug log at levels 3 and 4, respectivly. * Transformation caching has been deprecated, and is now off by default. We now advise against using transformation caching in production. * Improve request body processing error messages. Any many more . . . see CHANGES for all the details
2008-10-12 14:50:17 +02:00
cd ${WRKDIR}/${DISTNAME}/doc && \
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
pax -rw . ${DESTDIR}${PREFIX}/${DOCDIR}
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
Update from 2.1.4->2.5.7 Use ./configure as one is now supplied libmxl2 is no longer optional but curl is Rename doc/eg dirs from ap-security to ap-modsecurity * Allow for disabling request body limit checks in phase:1 * Now log XML parsing/validation warnings and errors to be in the debug log at levels 3 and 4, respectivly. * Transformation caching has been deprecated, and is now off by default. We now advise against using transformation caching in production. * Improve request body processing error messages. Any many more . . . see CHANGES for all the details
2008-10-12 14:50:17 +02:00
.include "../../textproc/libxml2/buildlink3.mk"
Add a PCRE bl3 depends to fix builds (found by DragonFly bulk builds) PKGREVISION++
2007-12-27 17:39:07 +01:00
.include "../../devel/pcre/buildlink3.mk"
Update ap-modsecurity2 to 2.5.13, partly from Matthew Sporleder in PR 44745, rest by me. pkgsrc changes: - fix up deps - fix Apache module handling - DESTDIR support XXX: The DESTDIR support has to bypass apxs because as far as I can tell XXX: apxs -i doesn't know how to handle DESTDIRs. Various Apache modules XXX: do this in various different ways. Someone(TM) should teach apxs -i XXX: about DESTDIRs and fix up all the abuse. The infrastructure for XXX: Apache modules could use some rototilling as well. 29 Nov 2010 - 2.5.13 -------------------- * Cleaned up some mlogc code and debugging output. * Remove the ability to use a relative path to a piped audit logger (i.e. mlogc) as Apache does not support it in their piped loggers and it was breaking Windows and probably other platforms that use spaces in filesystem paths. Discovered by Tom Donovan. * Fix memory leak freeing regex. Discovered by Tom Donovan. * Fix some portability issues on Windows. * Fixed Geo lookup concurrent connections bug * Fixed Skip/SkipAfter chain bug * Added new setvar Lua API to be used into Lua scripts * Added PCRE messages indicates each rule that exceed match limits * Added new Base64 transformation function called base64DecodeEx, which can decode base64 data skipping special characters. * Add SecReadStateLimit to limit the number of concurrent threads in BUSY connections per ip address * Fixed redirect action was not expanding macros in chained rules 04 Feb 2010 - 2.5.12 -------------------- * Fixed SecUploadFileMode to set the correct mode. * Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions. * Added additional file info definitions introduced in APR 0.9.5 so that build will work with older APRs (IBM HTTP Server v6). * Added SecUploadFileLimit to limit the number of uploaded file parts that will be processed in a multipart POST. The default is 100. * Fixed path normalization to better handle backreferences that extend above root directories. Reported by Sogeti/ESEC R&D. * Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines. * Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D. * Fixed failure to match internally set TX variables with regex (TX:/.../) syntax. * Fixed failure to log full internal TX variable names and populate MATCHED_VAR* vars. * Enabled PCRE "studying" by default. This is now a configure-time option. * Added PCRE match limits (SecPcreMatchLimit/SecPcreMatchLimitRecursion) to aide in REDoS type attacks. A rule that goes over the limits will set TX:MSC_PCRE_LIMITS_EXCEEDED. It is intended that the next major release of ModSecurity (2.6.x) will move these flags to a dedicated collection. * Reduced default PCRE match limits reducing impact of REDoS on poorly written regex rules. Reported by Sogeti/ESEC R&D. * Fixed memory leak in v1 cookie parser. Reported by Sogeti/ESEC R&D. * Now support macro expansion in numeric operators (@eq, @ge, @lt, etc.) * Update copyright to 2010. * Reserved 700,000-799,999 IDs for Ivan Ristic. * Fixed SecAction not working when CONNECT request method is used (MODSEC-110). [Ivan Ristic] * Do not escape quotes in macro resolution and only escape NUL in setenv values. 04 Nov 2009 - 2.5.11 -------------------- * Added a new multipart flag, MULTIPART_INVALID_QUOTING, which will be set true if any invalid quoting is found during multipart parsing. * Fixed parsing quoted strings in multipart Content-Disposition headers. Discovered by Stefan Esser. * Cleanup persistence database locking code. * Added warning during configure if libcurl is found linked against gnutls for SSL. The openssl lib is recommended as gnutls has proven to cause issues with mutexes and may crash. * Cleanup some mlogc (over)logging. * Do not log output filter errors in the error log. * Moved output filter to run before other stock filters (mod_deflate, mod_cache, mod_expires, mod_filter) to avoid analyzing modified data in the response. Patch originally submitted by Ivan Ristic. 18 Sep 2009 - 2.5.10 -------------------- * Cleanup mlogc so that it builds on Windows. * Added more detailed messages to replace "Unknown error" in filters. * Added SecAuditLogDirMode and SecAuditLogFileMode to allow fine tuning auditlog permissions (especially with mpm-itk). * Cleanup SecUploadFileMode implementation. * Cleanup build scripts. * Fixed crash on configuration if SecMarker is used before any rules. * Fixed SecRuleUpdateActionById so that it will work on chain starters. * Cleanup build system for mlogc. * Allow mlogc to periodically flush memory pools. * Using nolog,auditlog will now log the "Message:" line to the auditlog, but nothing to the error log. Prior versions dropped the "Message:" line from both logs. To do this now, just use "nolog" or "nolog,noauditlog". * Forced mlogc to use SSLv3 to avoid some potential auto negotiation issues with some libcurl versions. * Fixed mlogc issue seen on big endian machines where content type could be listed as zero. * Removed extra newline from audit log message line when logging XML errors. This was causing problems parsing audit logs. * Fixed @pm/@pmFromFile case insensitivity. * Truncate long parameters in log message for "Match of ... against ... required" messages. * Correctly resolve chained rule actions in logs. * Cleanup some code for portability. * AIX does not support hidden visibility with xlc compiler. * Allow specifying EXTRA_CFLAGS during configure to override gcc specific values for non-gcc compilers. * Populate GEO:COUNTRY_NAME and GEO:COUNTRY_CONTINENT as documented. * Handle a newer geo database more gracefully, avoiding a potential crash for new countries that ModSecurity is not yet aware. * Allow checking &GEO "@eq 0" for a failed @geoLookup. * Fixed mlogc global mutex locking issue and added more debugging output. * Cleaned up build dependencies and configure options.
2011-03-19 22:18:06 +01:00
.include "../../lang/lua/buildlink3.mk"
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks. This is the 2.x branch of modsecurity and only supports Apache 2.x
2006-11-05 15:33:37 +01:00
.include "../../mk/bsd.pkg.mk"
Reference in a new issue Copy permalink