|
[-]
[+]
|
Changed |
mod_security-ix.changes
|
|
|
|
[-]
[+]
|
Changed |
mod_security-ix.spec
^
|
|
|
|
[-]
[+]
|
Deleted |
CVE-2013-2765.patch
^
|
| @@ -1,10 +0,0 @@
---- modsecurity-apache_2.6.8/apache2/msc_reqbody.c.orig 2013-06-29 18:56:31.446864803 +0200
-+++ modsecurity-apache_2.6.8/apache2/msc_reqbody.c 2013-06-29 18:56:45.354863561 +0200
-@@ -170,6 +170,7 @@
-
- /* Would storing this chunk mean going over the limit? */
- if ((msr->msc_reqbody_spilltodisk)
-+ && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON)
- && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit))
- {
- msc_data_chunk **chunks;
|
|
[-]
[+]
|
Deleted |
mlogc-disable-force-sslv3.patch
^
|
| @@ -1,11 +0,0 @@
---- mlogc/mlogc.c.orig 2012-03-05 17:20:00.254555490 +0100
-+++ mlogc/mlogc.c 2012-03-05 17:20:10.430753985 +0100
-@@ -1214,7 +1214,7 @@
- curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);
- curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0);
- /* SSLv3 works better overall as some servers have issues with TLS */
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv3);
-+ /* curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv3); */
- curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15);
- curl_easy_setopt(curl, CURLOPT_NOSIGNAL, TRUE);
- curl_easy_setopt(curl, CURLOPT_HEADER, TRUE);
|
|
[-]
[+]
|
Deleted |
modsecurity-2.9.1_curl-lower_7.34.patch
^
|
| @@ -1,60 +0,0 @@
---- mlogc/mlogc.c.orig 2016-06-02 09:15:03.283648355 +0200
-+++ mlogc/mlogc.c 2016-06-02 10:59:44.378377602 +0200
-@@ -1270,33 +1270,36 @@
- }
-
-
-- /* Seems like CURL_SSLVERSION_TLSv1_2 is not supported on libcurl
-- * < v7.34.0
-- *
-- * version_num is a 24 bit number created like this:
-- * <8 bits major number> | <8 bits minor number> | <8 bits patch number>.
-- */
-- switch (tlsprotocol) {
-- case 0:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0);
-- break;
-- case 1:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);
-- break;
-- case 2:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-- break;
-- default:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-- break;
-- }
- cmaj = curlversion->version_num >> 16;
- cmin = (curlversion->version_num & 0x00ff00) >> 8;
- cpat = (curlversion->version_num & 0x0000ff);
- /* If cURL version < v7.34.0, use TLS v1.x */
- if (cmaj <= 7 && cmin < 34) {
- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
-- }
-+#ifdef CURL_SSLVERSION_TLSv1_0
-+ } else {
-+ /* Seems like CURL_SSLVERSION_TLSv1_2 is not supported on libcurl
-+ * < v7.34.0
-+ *
-+ * version_num is a 24 bit number created like this:
-+ * <8 bits major number> | <8 bits minor number> | <8 bits patch number>.
-+ */
-+ switch (tlsprotocol) {
-+ case 0:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0);
-+ break;
-+ case 1:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);
-+ break;
-+ case 2:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-+ break;
-+ default:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-+ break;
-+ }
-+#endif
-+ }
-
- curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15);
- curl_easy_setopt(curl, CURLOPT_NOSIGNAL, TRUE);
|
|
[-]
[+]
|
Added |
mod_security-ix.spec2513
^
|
| @@ -0,0 +1,110 @@
+Summary: Security module for the Apache HTTP Server
+Name: mod_security
+Version: 2.6.1
+Release: 23
+License: GPLv2
+URL: http://www.modsecurity.org/
+Group: System Environment/Daemons
+Source: http://www.modsecurity.org/download/modsecurity-apache_%{version}.tar.bz2
+Source1: 00_mod_security.conf
+Source2: modsecurity_crs_10_config-default.conf
+Source3: zzz_asl_custom_exclude.conf
+Source4: zzz_asl_custom_local_exclude.conf
+Patch1: waf-label.patch
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+Requires: httpd httpd-mmn = %([ -a %{_includedir}/httpd/.mmn ] && cat %{_includedir}/httpd/.mmn || echo missing)
+BuildRequires: httpd-devel libxml2-devel pcre-devel libtool pkgconfig curl-devel
+BuildRequires: curl
+BuildRequires: lua-devel
+
+Requires: libxml2 pcre lua
+Provides: ix-mod_security = %{version}
+
+%description
+ModSecurity is an open source intrusion detection and prevention engine
+for web applications. It operates embedded into the web server, acting
+as a powerful umbrella - shielding web applications from attacks.
+
+%prep
+%setup -n modsecurity-apache_%{version}
+%patch1 -p1
+
+%build
+CFLAGS="%{optflags}"
+export CFLAGS
+
+cd apache2
+%configure \
+ --disable-pcre-match-limit \
+ --disable-pcre-match-limit-recursion
+
+# Legacy from LoadFile
+#perl -pi.orig -e 's|LIBDIR|%{_libdir}|;' %{SOURCE1}
+
+make %{_smp_mflags}
+
+%install
+rm -rf %{buildroot}
+mkdir -p %{buildroot}/%{_sysconfdir}/httpd/modsecurity.d/
+mkdir -p %{buildroot}/%{_sysconfdir}/httpd/conf.d/
+mkdir -p %{buildroot}/var/asl/data/suspicious
+mkdir -p %{buildroot}/var/asl/data/msa
+mkdir -p %{buildroot}/var/asl/data/audit
+install -D -m755 apache2/.libs/mod_security2.so %{buildroot}/%{_libdir}/httpd/modules/mod_security2.so
+install -D -m644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/httpd/conf.d/00_mod_security.conf
+install -D -m644 %{SOURCE2} %{buildroot}/%{_sysconfdir}/httpd/modsecurity.d/modsecurity_crs_10_config.conf
+install -D -m644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/httpd/modsec/zzz_asl_custom_exclude.conf
+install -D -m644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/httpd/modsec/zzz_asl_custom_local_exclude.conf
+install -D -m755 rules/util/modsec-clamscan.pl %{buildroot}%{_bindir}/modsec-clamscan.pl
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr (-,root,root)
+%doc CHANGES LICENSE README.* modsecurity* doc
+%{_libdir}/httpd/modules/mod_security2.so
+%{_bindir}/modsec-clamscan.pl
+%config %{_sysconfdir}/httpd/conf.d/00_mod_security.conf
+%dir %{_sysconfdir}/httpd/modsecurity.d
+%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/modsecurity_crs_10_config.conf
+%config %{_sysconfdir}/httpd/modsec/zzz_asl_custom_exclude.conf
+%config(noreplace) %{_sysconfdir}/httpd/modsec/zzz_asl_custom_local_exclude.conf
+
+%defattr(-,apache,apache)
+%dir /var/asl
+%dir /var/asl/data
+%dir /var/asl/data/suspicious
+%dir /var/asl/data/msa
+%dir /var/asl/data/audit
+
+%changelog
+* Mon Jun 27 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-23
+- rename 999_asl_custom_exclude.conf to zzz_asl_custom_exclude.conf
+- rename 999_asl_custom_local_exclude.conf to zzz_asl_custom_local_exclude.conf
+
+
+* Mon Jun 06 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-21
+- added 999_asl_custom_local_exclude.conf with noreplace
+- set 999_asl_custom_exclude.conf to replace
+
+* Mon Jun 06 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-20
+- added rules to excludelist:
+ - 350147
+ - 350148
+ - 340162
+
+* Fri May 06 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-19
+- rename exclude config file from 00_asl_custom_exclude.conf to 999_asl_custom_exclude.conf
+
+* Thu May 05 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-18
+- disable clamav check rule 351000 by default
+
+* Tue May 03 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-17
+- add 00_asl_custom_exclude.conf and disable RBL rule 350000 by default
+
+* Fri Apr 01 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-16
+- update to release 2.5.13
+
+* Wed Nov 24 2010 Carsten Schoene <cs@linux-administrator.com> - 2.5.12-15
+- initial InterNetX GmbH specific mod_security build
|
|
[-]
[+]
|
Deleted |
modsec-clamscan.pl
^
|
| @@ -1,50 +0,0 @@
-#!/usr/bin/perl
-#
-# modsec-clamscan.pl
-# ModSecurity for Apache (http://www.modsecurity.org)
-# Copyright (c) 2002-2007 Breach Security, Inc. (http://www.breach.com)
-#
-# This script is an interface between mod_security and its
-# ability to intercept files being uploaded through the
-# web server, and ClamAV
-
-# by default use the command-line version of ClamAV,
-# which is slower but more likely to work out of the
-# box
-$CLAMSCAN = "/usr/bin/clamscan";
-
-# using ClamAV in daemon mode is faster since the
-# anti-virus engine is already running, but you also
-# need to configure file permissions to allow ClamAV,
-# usually running as a user other than the one Apache
-# is running as, to access the files
-# $CLAMSCAN = "/usr/bin/clamdscan";
-
-if (@ARGV != 1) {
- print "Usage: modsec-clamscan.pl <filename>\n";
- exit;
-}
-
-my ($FILE) = @ARGV;
-
-$cmd = "$CLAMSCAN --stdout --no-summary $FILE";
-$input = `$cmd`;
-$input =~ m/^(.+)/;
-$error_message = $1;
-
-$output = "0 Unable to parse clamscan output [$1]";
-
-if ($error_message =~ m/: Empty file\.?$/) {
- $output = "1 empty file";
-}
-elsif ($error_message =~ m/: (.+) ERROR$/) {
- $output = "0 clamscan: $1";
-}
-elsif ($error_message =~ m/: (.+) FOUND$/) {
- $output = "0 clamscan: $1";
-}
-elsif ($error_message =~ m/: OK$/) {
- $output = "1 clamscan: OK";
-}
-
-print "$output\n";
|
|
[-]
[+]
|
Deleted |
modsec-clean_var-asl-data-audit
^
|
| @@ -1,5 +0,0 @@
-#!/bin/bash
-nice -n 19 find /var/asl/data/audit -type d -mindepth 1 -cmin +30 -print0 | xargs -r -0 rm -rf
-mkdir -p /var/asl/data/audit
-chown -R %APAUSR%:%APAGRP% /var/asl/data/audit
-[ -x /usr/local/bin/modsec-permissions ] && /usr/local/bin/modsec-permissions || :
|
|
|
Deleted |
modsecurity-2.8.0.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.0.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.2.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.3.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.4.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.5.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.7.tar.bz2
^
|
|
|
Changed |
modsecurity-apache_2.5.13.tar.gz
^
|
|
|
Changed |
modsecurity-apache_2.6.1.tar.bz2
^
|
|
|
Deleted |
modsecurity-apache_2.7.5.tar.bz2
^
|
|
|
Deleted |
modsecurity-apache_2.7.7.tar.bz2
^
|
|
[-]
[+]
|
Changed |
zzz_asl_custom_exclude.conf
^
|
| @@ -4,21 +4,3 @@
SecRuleRemoveById 350147
SecRuleRemoveById 350148
SecRuleRemoveById 340162
-SecRuleRemoveById 391213
-SecRuleRemoveById 340152
-
-# experimental
-SecRuleRemoveById 340202
-SecRuleRemoveById 340201
-SecRuleRemoveById 340204
-SecRuleRemoveById 340205
-SecRuleRemoveById 340206
-SecRuleRemoveById 340207
-SecRuleRemoveById 340208
-SecRuleRemoveById 340209
-SecRuleRemoveById 345400
-SecRuleRemoveById 345401
-SecRuleRemoveById 345402
-SecRuleRemoveById 345403
-SecRuleRemoveById 345404
-
|
