git.iko.soy/typeable/nixpkgs
on master help sign in
Merge pull request #149591 from Izorkin/update-modsecurity

update modsecurity packages

commit3ad52fcdd67c8a8479acf13038b16509274521df authorStig <stig@stig.io> dateMon 14 Feb 2022, 19:56 (5 years ago) parent4f3a4c48b37c4d
4 files changed+79−13
compare with master
unifiedsplit
pkgs/servers/http/nginx/modules.nix+2−2 pkgs/tools/security/libmodsecurity/default.nix+33−11 pkgs/tools/security/modsecurity-crs/default.nix+42 pkgs/top-level/all-packages.nix+2
pkgs/servers/http/nginx/modules.nix+2−2
@@ -252,8 +252,8 @@ in
252252 name = "modsecurity-nginx";
253253 owner = "SpiderLabs";
254254 repo = "ModSecurity-nginx";
255− rev = "v1.0.1";
256− sha256 = "0cbb3g3g4v6q5zc6an212ia5kjjad62bidnkm8b70i4qv1615pzf";
255+ rev = "v1.0.2";
256+ sha256 = "sha256-UXiitc3jZlgXlCsDPS+xEFLNRVgRbn8BCCXUEqAWlII=";
257257 };
258258 inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ];
259259 };
pkgs/tools/security/libmodsecurity/default.nix+33−11
@@ -1,34 +1,57 @@
1−{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config
2−, doxygen, perl, valgrind
3−, curl, geoip, libxml2, lmdb, lua, pcre, yajl }:
1+{ lib, stdenv, fetchFromGitHub
2+, autoreconfHook, bison, flex, pkg-config
3+, curl, geoip, libmaxminddb, libxml2, lmdb, lua, pcre
4+, ssdeep, valgrind, yajl
5+}:
46
57stdenv.mkDerivation rec {
68 pname = "libmodsecurity";
7− version = "3.0.4";
9+ version = "3.0.6";
810
911 src = fetchFromGitHub {
1012 owner = "SpiderLabs";
1113 repo = "ModSecurity";
12− fetchSubmodules = true;
1314 rev = "v${version}";
14− sha256 = "07vry10cdll94sp652hwapn0ppjv3mb7n2s781yhy7hssap6f2vp";
15+ sha256 = "sha256-V+NBT2YN8qO3Px8zEzSA2ZsjSf1pv8+VlLxYlrpqfGg=";
16+ fetchSubmodules = true;
1517 };
1618
17− nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
19+ nativeBuildInputs = [ autoreconfHook bison flex pkg-config ];
20+ buildInputs = [ curl geoip libmaxminddb libxml2 lmdb lua pcre ssdeep valgrind yajl ];
1821
19− buildInputs = [ perl valgrind curl geoip libxml2 lmdb lua pcre yajl ];
22+ outputs = [ "out" "dev" ];
2023
2124 configureFlags = [
22− "--enable-static"
25+ "--enable-parser-generation"
2326 "--with-curl=${curl.dev}"
2427 "--with-libxml=${libxml2.dev}"
28+ "--with-lmdb=${lmdb.out}"
29+ "--with-maxmind=${libmaxminddb}"
2530 "--with-pcre=${pcre.dev}"
26− "--with-yajl=${yajl}"
31+ "--with-ssdeep=${ssdeep}"
2732 ];
2833
34+ postPatch = ''
35+ substituteInPlace build/lmdb.m4 \
36+ --replace "\''${path}/include/lmdb.h" "${lmdb.dev}/include/lmdb.h" \
37+ --replace "lmdb_inc_path=\"\''${path}/include\"" "lmdb_inc_path=\"${lmdb.dev}/include\""
38+ substituteInPlace build/ssdeep.m4 \
39+ --replace "/usr/local/libfuzzy" "${ssdeep}/lib" \
40+ --replace "\''${path}/include/fuzzy.h" "${ssdeep}/include/fuzzy.h" \
41+ --replace "ssdeep_inc_path=\"\''${path}/include\"" "ssdeep_inc_path=\"${ssdeep}/include\""
42+ substituteInPlace modsecurity.conf-recommended \
43+ --replace "SecUnicodeMapFile unicode.mapping 20127" "SecUnicodeMapFile $out/share/modsecurity/unicode.mapping 20127"
44+ '';
45+
46+ postInstall = ''
47+ mkdir -p $out/share/modsecurity
48+ cp ${src}/{AUTHORS,CHANGES,LICENSE,README.md,modsecurity.conf-recommended,unicode.mapping} $out/share/modsecurity
49+ '';
50+
2951 enableParallelBuilding = true;
3052
3153 meta = with lib; {
54+ homepage = "https://github.com/SpiderLabs/ModSecurity";
3255 description = ''
3356 ModSecurity v3 library component.
3457 '';
@@ -40,7 +63,6 @@ stdenv.mkDerivation rec {
4063 the ModSecurity SecRules format and apply them to HTTP content provided
4164 by your application via Connectors.
4265 '';
43− homepage = "https://modsecurity.org/";
4466 license = licenses.asl20;
4567 platforms = platforms.all;
4668 maintainers = with maintainers; [ izorkin ];
pkgs/tools/security/modsecurity-crs/default.nixnew file+42
@@ -0,0 +1,42 @@
1+{ lib, stdenv, fetchFromGitHub }:
2+
3+stdenv.mkDerivation rec {
4+ version = "3.3.2";
5+ pname = "modsecurity-crs";
6+
7+ src = fetchFromGitHub {
8+ owner = "coreruleset";
9+ repo = "coreruleset";
10+ rev = "v${version}";
11+ sha256 = "sha256-m/iVLhk2y5BpYu8EwC2adrrDnbaVCQ0SE25ltvMokCw=";
12+ };
13+
14+ installPhase = ''
15+ install -D -m444 -t $out/rules ${src}/rules/*.conf
16+ install -D -m444 -t $out/rules ${src}/rules/*.data
17+ install -D -m444 -t $out/share/doc/modsecurity-crs ${src}/*.md
18+ install -D -m444 -t $out/share/doc/modsecurity-crs ${src}/{CHANGES,INSTALL,LICENSE}
19+ install -D -m444 -t $out/share/modsecurity-crs ${src}/rules/*.example
20+ install -D -m444 -t $out/share/modsecurity-crs ${src}/crs-setup.conf.example
21+ cat > $out/share/modsecurity-crs/modsecurity-crs.load.example <<EOF
22+ ##
23+ ## This is a sample file for loading OWASP CRS's rules.
24+ ##
25+ Include /etc/modsecurity/crs/crs-setup.conf
26+ IncludeOptional /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
27+ Include $out/rules/*.conf
28+ IncludeOptional /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
29+ EOF
30+ '';
31+
32+ meta = with lib; {
33+ homepage = "https://coreruleset.org";
34+ description = ''
35+ The OWASP ModSecurity Core Rule Set is a set of generic attack detection
36+ rules for use with ModSecurity or compatible web application firewalls.
37+ '';
38+ license = licenses.asl20;
39+ platforms = platforms.all;
40+ maintainers = with maintainers; [ izorkin ];
41+ };
42+}
pkgs/top-level/all-packages.nix+2
@@ -7883,6 +7883,8 @@ with pkgs;
78837883
78847884 modsecurity_standalone = callPackage ../tools/security/modsecurity { };
78857885
7886+ modsecurity-crs = callPackage ../tools/security/modsecurity-crs { };
7887+
78867888 molly-guard = callPackage ../os-specific/linux/molly-guard { };
78877889
78887890 molotov = callPackage ../applications/video/molotov {};