rpm/apache2-mod_security2
SHA256
1
0
Fork 0
forked from pool/apache2-mod_security2
Code Pull Requests Activity
ca6551fe3a
apache2-mod_security2/apache2-mod_security2.spec

119 lines
4.4 KiB
RPMSpec
Raw Normal View History

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
#
Accepting request 131757 from Apache:Modules license update: Apache-2.0 and GPL-2.0 Many of the files in the rules/ subdirectory are GPL-2.0 licensed (forwarded request 131755 from babelworx) OBS-URL: https://build.opensuse.org/request/show/131757 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=12
2012-08-27 15:45:37 +02:00
# spec file for package apache2-mod_security2
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
#
Accepting request 1098838 from home:dirkmueller:Factory - update to 2.9.7: * Fix: FILES_TMP_CONTENT may sometimes lack complete content * Support configurable limit on number of arguments processed * Silence compiler warning about discarded const * Support for JIT option for PCRE2 * Use uid for user if apr_uid_name_get() fails * Fix: handle error with SecConnReadStateLimit configuration * Only check for pcre2 install if required * Adjustment of previous fix for log messages * Mark apache error log messages as from mod_security2 * Use pkg-config to find libxml2 first * Support for PCRE2 in mlogc * Support for PCRE2 * Adjust parser activation rules in modsecurity.conf- recommended * Multipart parsing fixes and new MULTIPART_PART_HEADERS collection * Limit rsub null termination to where necessary * IIS: Update dependencies for next planned release * XML parser cleanup: NULL duplicate pointer * Properly cleanup XML parser contexts upon completion * Fix memory leak in streams * Fix: negative usec on log line when data type long is 32b * mlogc log-line parsing fails due to enhanced timestamp * Allow no-key, single-value JSON body * Set SecStatusEngine Off in modsecurity.conf-recommended * Fix memory leak that occurs on JSON parsing error * Multipart names/filenames may include single quote if double- quote enclosed * Add SecRequestBodyJsonDepthLimit to modsecurity.conf- OBS-URL: https://build.opensuse.org/request/show/1098838 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=87
2023-07-17 10:33:54 +02:00
# Copyright (c) 2023 SUSE LLC
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
- removing %apache_test_* macros, do not test module just by loading the module OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=81
2020-02-13 08:56:49 +01:00
# Please submit bugfixes or comments via https://bugs.opensuse.org/
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
#
Accepting request 259451 from home:pgajdos:apache2 - call spec-cleaner - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/259451 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=57
2014-11-11 13:00:42 +01:00
%define modname mod_security2
%define tarballname modsecurity-%{version}
%define usrsharedir %{_datadir}/%{name}
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
Name: apache2-mod_security2
Accepting request 1098838 from home:dirkmueller:Factory - update to 2.9.7: * Fix: FILES_TMP_CONTENT may sometimes lack complete content * Support configurable limit on number of arguments processed * Silence compiler warning about discarded const * Support for JIT option for PCRE2 * Use uid for user if apr_uid_name_get() fails * Fix: handle error with SecConnReadStateLimit configuration * Only check for pcre2 install if required * Adjustment of previous fix for log messages * Mark apache error log messages as from mod_security2 * Use pkg-config to find libxml2 first * Support for PCRE2 in mlogc * Support for PCRE2 * Adjust parser activation rules in modsecurity.conf- recommended * Multipart parsing fixes and new MULTIPART_PART_HEADERS collection * Limit rsub null termination to where necessary * IIS: Update dependencies for next planned release * XML parser cleanup: NULL duplicate pointer * Properly cleanup XML parser contexts upon completion * Fix memory leak in streams * Fix: negative usec on log line when data type long is 32b * mlogc log-line parsing fails due to enhanced timestamp * Allow no-key, single-value JSON body * Set SecStatusEngine Off in modsecurity.conf-recommended * Fix memory leak that occurs on JSON parsing error * Multipart names/filenames may include single quote if double- quote enclosed * Add SecRequestBodyJsonDepthLimit to modsecurity.conf- OBS-URL: https://build.opensuse.org/request/show/1098838 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=87
2023-07-17 10:33:54 +02:00
Version: 2.9.7
Accepting request 259451 from home:pgajdos:apache2 - call spec-cleaner - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/259451 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=57
2014-11-11 13:00:42 +01:00
Release: 0
Accepting request 560465 from home:jengelh:branches:Apache:Modules * (TM) ought not to be used according to openSUSE's license guidelines (when I last looked at it) * simplify the find line OBS-URL: https://build.opensuse.org/request/show/560465 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=77
2018-01-04 13:36:56 +01:00
Summary: Web Application Firewall for apache httpd
Accepting request 259451 from home:pgajdos:apache2 - call spec-cleaner - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/259451 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=57
2014-11-11 13:00:42 +01:00
License: Apache-2.0
Accepting request 741022 from openSUSE:Factory revert OBS-URL: https://build.opensuse.org/request/show/741022 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=80
2019-10-18 11:16:43 +02:00
Group: Productivity/Networking/Web/Servers
Accepting request 907282 from home:dspinella:branches:Apache:Modules - Update to 2.9.4: * Add microsec timestamp resolution to the formatted log timestamp * Added missing Geo Countries * Store temporaries in the request pool for regexes compiled per-request. * Fix other usage of the global pool for request temporaries in re_operators.c * Adds a sanity check before use ctl:ruleRemoveTargetById and ctl:ruleRemoveTargetByMsg. * Fix the order of error_msg validation * When the input filter finishes, check whether we returned data * fix: care non-null terminated chunk data * Fix for apr_global_mutex_create() crashes with mod_security * Fix inet addr handling on 64 bit big endian systems - Run spec-cleaner - Remove if/else for older version of SUSE distribution OBS-URL: https://build.opensuse.org/request/show/907282 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=85
2021-07-20 11:36:03 +02:00
URL: https://www.modsecurity.org/
Accepting request 907288 from home:dspinella:branches:Apache:Modules OBS-URL: https://build.opensuse.org/request/show/907288 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=86
2021-07-20 11:51:27 +02:00
Source: https://github.com/SpiderLabs/ModSecurity/releases/download/v%{version}/modsecurity-%{version}.tar.gz
Accepting request 259451 from home:pgajdos:apache2 - call spec-cleaner - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/259451 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=57
2014-11-11 13:00:42 +01:00
Source1: https://github.com/SpiderLabs/owasp-modsecurity-crs/tarball/master//SpiderLabs-owasp-modsecurity-crs-2.2.9-5-gebe8790.tar.gz
Source2: mod_security2.conf
Source6: README-SUSE-mod_security2.txt
Source7: empty.conf
Patch0: apache2-mod_security2-no_rpath.diff
Accepting request 287448 from home:elvigia:branches:Apache:Modules - spec, build: Respect optflags - spec: buildrequire pkgconfig - modsecurity-fixes.patch: mod_security fails at: * building with optflags enabled due to undefined behaviour and implicit declarations. * It abuses it apr_allocator api, creating one allocator per request and then destroying it, flooding the system with mmap() , munmap requests, this is particularly nasty with threaded mpms. it should instead use the allocator from the request pool. OBS-URL: https://build.opensuse.org/request/show/287448 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=61
2015-03-01 12:04:28 +01:00
Patch1: modsecurity-fixes.patch
Accepting request 556963 from home:kstreitova:branches:Apache:Modules - update to 2.9.2 * release notes https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2 * refresh apache2-mod_security2-no_rpath.diff * remove apache2-mod_security2-lua-5.3.patch that was applied upstream - remove outdated html pages and diagram (they can be accessed online at https://github.com/SpiderLabs/ModSecurity/wiki) * Reference-Manual.html.bz2 * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2 * modsecurity_diagram_apache_request_cycle.jpg - don't pack the whole doc directory as it contains also Makefiles or doxygen configuration files - disable mlogc as we don't pack it and it also can't be built for curl <=7.34 - add basic and regression test suite (but disabled for now) * add apache2-mod_security2_tests_conf.patch for apache2 configuration file used for tests that was trying to load mpm_worker_module (it's static for our apache2 package) * add "BuildRequires: perl-libwww-perl" needed for the test suite OBS-URL: https://build.opensuse.org/request/show/556963 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=75
2017-12-18 10:36:29 +01:00
Patch2: apache2-mod_security2_tests_conf.patch
- version update to 2.9.3 * Enable optimization for large stream input by default on IIS [Issue #1299 - @victorhora, @zimmerle] * Allow 0 length JSON requests. [Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern] * Include unanmed JSON values in unnamed ARGS [Issue #1577, #1576 - @marcstern, @victorhora, @zimmerle] * Fix buffer size for utf8toUnicode transformation [Issue #1208 - @katef, @victorhora] * Fix sanitizing JSON request bodies in native audit log format [p0pr0ck5, @victorhora] * IIS: Update Wix installer to bundle a supported CRS version (3.0) [@victorhora, @zimmerle] * IIS: Update dependencies for Windows build [Issue #1848 - @victorhora, @hsluoyz] * IIS: Set SecStreamInBodyInspection by default on IIS builds (#1299) [Issue #1299 - @victorhora] * IIS: Update modsecurity.conf [Issue #788 - @victorhora, @brianclark] * Add sanity check for a couple malloc() and make code more resilient [Issue #979 - @dogbert2, @victorhora, @zimmerl] * Fix NetBSD build by renaming the hmac function to avoid conflicts [Issue #1241 - @victorhora, @joerg, @sevan] * IIS: Windows build, fix duplicate YAJL dir in script [Issue #1612 - @allanbomsft, @victorhora] * IIS: Remove body prebuffering due to no locking in modsecProcessRequest [Issue #1917 - @allanbomsft, @victorhora] * Fix mpm-itk / mod_ruid2 compatibility [Issue #712 - @ju5t , @derhansen, @meatlayer, @victorhora] * Code cosmetics: checks if actionset is not null before use it OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=83
2021-02-23 08:55:22 +01:00
# https://github.com/SpiderLabs/ModSecurity/issues/2514
Patch3: modsecurity-2.9.3-input_filtering_errors.patch
Accepting request 259451 from home:pgajdos:apache2 - call spec-cleaner - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/259451 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=57
2014-11-11 13:00:42 +01:00
BuildRequires: apache-rpm-macros
Accepting request 131757 from Apache:Modules license update: Apache-2.0 and GPL-2.0 Many of the files in the rules/ subdirectory are GPL-2.0 licensed (forwarded request 131755 from babelworx) OBS-URL: https://build.opensuse.org/request/show/131757 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=12
2012-08-27 15:45:37 +02:00
BuildRequires: apache2-devel
BuildRequires: apache2-prefork
- apache2-mod_security2-no_rpath.diff: avoid the usage of -rpath in autoconf m4 macros. Obsoletes patch modsecurity-apache_2.8.0-build_fix_pcre.diff - use automake for build, add autoconf and automake to BuildRequires:. This fix is combined with [bnc#876878]. - turn on --enable-htaccess-config - use %{?_smp_mflags} for build - OWASP rule set. [bnc#876878] new in 2.8.0 (more complete changelog to add to last changelog): * Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit) now support white and suspicious list * New variables: FULL_REQUEST and FULL_REQUEST_LENGTH * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=46
2014-06-16 17:37:59 +02:00
BuildRequires: autoconf
BuildRequires: automake
Accepting request 131757 from Apache:Modules license update: Apache-2.0 and GPL-2.0 Many of the files in the rules/ subdirectory are GPL-2.0 licensed (forwarded request 131755 from babelworx) OBS-URL: https://build.opensuse.org/request/show/131757 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=12
2012-08-27 15:45:37 +02:00
BuildRequires: c++_compiler
- apache2-mod_security2-no_rpath.diff: avoid the usage of -rpath in autoconf m4 macros. Obsoletes patch modsecurity-apache_2.8.0-build_fix_pcre.diff - use automake for build, add autoconf and automake to BuildRequires:. This fix is combined with [bnc#876878]. - turn on --enable-htaccess-config - use %{?_smp_mflags} for build - OWASP rule set. [bnc#876878] new in 2.8.0 (more complete changelog to add to last changelog): * Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit) now support white and suspicious list * New variables: FULL_REQUEST and FULL_REQUEST_LENGTH * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=46
2014-06-16 17:37:59 +02:00
BuildRequires: libcurl-devel
- BuildRequires: libtool missing - apache2-mod_security2-libtool-fix.diff: initialize libtool. OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=47
2014-06-16 19:03:44 +02:00
BuildRequires: libtool
Accepting request 131757 from Apache:Modules license update: Apache-2.0 and GPL-2.0 Many of the files in the rules/ subdirectory are GPL-2.0 licensed (forwarded request 131755 from babelworx) OBS-URL: https://build.opensuse.org/request/show/131757 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=12
2012-08-27 15:45:37 +02:00
BuildRequires: libxml2-devel
- version update to 2.9.3 * Enable optimization for large stream input by default on IIS [Issue #1299 - @victorhora, @zimmerle] * Allow 0 length JSON requests. [Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern] * Include unanmed JSON values in unnamed ARGS [Issue #1577, #1576 - @marcstern, @victorhora, @zimmerle] * Fix buffer size for utf8toUnicode transformation [Issue #1208 - @katef, @victorhora] * Fix sanitizing JSON request bodies in native audit log format [p0pr0ck5, @victorhora] * IIS: Update Wix installer to bundle a supported CRS version (3.0) [@victorhora, @zimmerle] * IIS: Update dependencies for Windows build [Issue #1848 - @victorhora, @hsluoyz] * IIS: Set SecStreamInBodyInspection by default on IIS builds (#1299) [Issue #1299 - @victorhora] * IIS: Update modsecurity.conf [Issue #788 - @victorhora, @brianclark] * Add sanity check for a couple malloc() and make code more resilient [Issue #979 - @dogbert2, @victorhora, @zimmerl] * Fix NetBSD build by renaming the hmac function to avoid conflicts [Issue #1241 - @victorhora, @joerg, @sevan] * IIS: Windows build, fix duplicate YAJL dir in script [Issue #1612 - @allanbomsft, @victorhora] * IIS: Remove body prebuffering due to no locking in modsecProcessRequest [Issue #1917 - @allanbomsft, @victorhora] * Fix mpm-itk / mod_ruid2 compatibility [Issue #712 - @ju5t , @derhansen, @meatlayer, @victorhora] * Code cosmetics: checks if actionset is not null before use it OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=83
2021-02-23 08:55:22 +01:00
BuildRequires: lua53-devel
Accepting request 131757 from Apache:Modules license update: Apache-2.0 and GPL-2.0 Many of the files in the rules/ subdirectory are GPL-2.0 licensed (forwarded request 131755 from babelworx) OBS-URL: https://build.opensuse.org/request/show/131757 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=12
2012-08-27 15:45:37 +02:00
BuildRequires: pcre-devel
Accepting request 556963 from home:kstreitova:branches:Apache:Modules - update to 2.9.2 * release notes https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2 * refresh apache2-mod_security2-no_rpath.diff * remove apache2-mod_security2-lua-5.3.patch that was applied upstream - remove outdated html pages and diagram (they can be accessed online at https://github.com/SpiderLabs/ModSecurity/wiki) * Reference-Manual.html.bz2 * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2 * modsecurity_diagram_apache_request_cycle.jpg - don't pack the whole doc directory as it contains also Makefiles or doxygen configuration files - disable mlogc as we don't pack it and it also can't be built for curl <=7.34 - add basic and regression test suite (but disabled for now) * add apache2-mod_security2_tests_conf.patch for apache2 configuration file used for tests that was trying to load mpm_worker_module (it's static for our apache2 package) * add "BuildRequires: perl-libwww-perl" needed for the test suite OBS-URL: https://build.opensuse.org/request/show/556963 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=75
2017-12-18 10:36:29 +01:00
BuildRequires: perl-libwww-perl
Accepting request 287448 from home:elvigia:branches:Apache:Modules - spec, build: Respect optflags - spec: buildrequire pkgconfig - modsecurity-fixes.patch: mod_security fails at: * building with optflags enabled due to undefined behaviour and implicit declarations. * It abuses it apr_allocator api, creating one allocator per request and then destroying it, flooding the system with mmap() , munmap requests, this is particularly nasty with threaded mpms. it should instead use the allocator from the request pool. OBS-URL: https://build.opensuse.org/request/show/287448 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=61
2015-03-01 12:04:28 +01:00
BuildRequires: pkgconfig
Accepting request 131757 from Apache:Modules license update: Apache-2.0 and GPL-2.0 Many of the files in the rules/ subdirectory are GPL-2.0 licensed (forwarded request 131755 from babelworx) OBS-URL: https://build.opensuse.org/request/show/131757 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=12
2012-08-27 15:45:37 +02:00
Requires: %{apache_mmn}
Accepting request 317137 from home:pgajdos:apache2 require %{apache_suse_maintenance_mmn} OBS-URL: https://build.opensuse.org/request/show/317137 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=65
2015-07-16 19:01:10 +02:00
Requires: %{apache_suse_maintenance_mmn}
Accepting request 131757 from Apache:Modules license update: Apache-2.0 and GPL-2.0 Many of the files in the rules/ subdirectory are GPL-2.0 licensed (forwarded request 131755 from babelworx) OBS-URL: https://build.opensuse.org/request/show/131757 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=12
2012-08-27 15:45:37 +02:00
Requires: apache2
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
%description
Accepting request 560465 from home:jengelh:branches:Apache:Modules * (TM) ought not to be used according to openSUSE's license guidelines (when I last looked at it) * simplify the find line OBS-URL: https://build.opensuse.org/request/show/560465 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=77
2018-01-04 13:36:56 +01:00
ModSecurity is an intrusion detection and prevention
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
engine for web applications (or a web application firewall). Operating
as an Apache Web server module or standalone, the purpose of
ModSecurity is to increase web application security, protecting web
applications from known and unknown attacks.
%prep
Accepting request 259451 from home:pgajdos:apache2 - call spec-cleaner - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/259451 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=57
2014-11-11 13:00:42 +01:00
%setup -q -n %{tarballname}
%setup -q -D -T -a 1 -n %{tarballname}
Accepting request 206042 from home:draht:branches:Apache:Modules - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual OBS-URL: https://build.opensuse.org/request/show/206042 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=42
2013-11-07 00:16:14 +01:00
mv -v SpiderLabs* rules
- apache2-mod_security2-no_rpath.diff: avoid the usage of -rpath in autoconf m4 macros. Obsoletes patch modsecurity-apache_2.8.0-build_fix_pcre.diff - use automake for build, add autoconf and automake to BuildRequires:. This fix is combined with [bnc#876878]. - turn on --enable-htaccess-config - use %{?_smp_mflags} for build - OWASP rule set. [bnc#876878] new in 2.8.0 (more complete changelog to add to last changelog): * Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit) now support white and suspicious list * New variables: FULL_REQUEST and FULL_REQUEST_LENGTH * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=46
2014-06-16 17:37:59 +02:00
%patch0
Accepting request 287448 from home:elvigia:branches:Apache:Modules - spec, build: Respect optflags - spec: buildrequire pkgconfig - modsecurity-fixes.patch: mod_security fails at: * building with optflags enabled due to undefined behaviour and implicit declarations. * It abuses it apr_allocator api, creating one allocator per request and then destroying it, flooding the system with mmap() , munmap requests, this is particularly nasty with threaded mpms. it should instead use the allocator from the request pool. OBS-URL: https://build.opensuse.org/request/show/287448 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=61
2015-03-01 12:04:28 +01:00
%patch1 -p1
Accepting request 319200 from home:pgajdos:apache2 - fix build for lua 5.3 OBS-URL: https://build.opensuse.org/request/show/319200 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=67
2015-07-29 09:02:10 +02:00
%patch2 -p1
- version update to 2.9.3 * Enable optimization for large stream input by default on IIS [Issue #1299 - @victorhora, @zimmerle] * Allow 0 length JSON requests. [Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern] * Include unanmed JSON values in unnamed ARGS [Issue #1577, #1576 - @marcstern, @victorhora, @zimmerle] * Fix buffer size for utf8toUnicode transformation [Issue #1208 - @katef, @victorhora] * Fix sanitizing JSON request bodies in native audit log format [p0pr0ck5, @victorhora] * IIS: Update Wix installer to bundle a supported CRS version (3.0) [@victorhora, @zimmerle] * IIS: Update dependencies for Windows build [Issue #1848 - @victorhora, @hsluoyz] * IIS: Set SecStreamInBodyInspection by default on IIS builds (#1299) [Issue #1299 - @victorhora] * IIS: Update modsecurity.conf [Issue #788 - @victorhora, @brianclark] * Add sanity check for a couple malloc() and make code more resilient [Issue #979 - @dogbert2, @victorhora, @zimmerl] * Fix NetBSD build by renaming the hmac function to avoid conflicts [Issue #1241 - @victorhora, @joerg, @sevan] * IIS: Windows build, fix duplicate YAJL dir in script [Issue #1612 - @allanbomsft, @victorhora] * IIS: Remove body prebuffering due to no locking in modsecProcessRequest [Issue #1917 - @allanbomsft, @victorhora] * Fix mpm-itk / mod_ruid2 compatibility [Issue #712 - @ju5t , @derhansen, @meatlayer, @victorhora] * Code cosmetics: checks if actionset is not null before use it OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=83
2021-02-23 08:55:22 +01:00
%patch3 -p1
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
%build
- apache2-mod_security2-no_rpath.diff: avoid the usage of -rpath in autoconf m4 macros. Obsoletes patch modsecurity-apache_2.8.0-build_fix_pcre.diff - use automake for build, add autoconf and automake to BuildRequires:. This fix is combined with [bnc#876878]. - turn on --enable-htaccess-config - use %{?_smp_mflags} for build - OWASP rule set. [bnc#876878] new in 2.8.0 (more complete changelog to add to last changelog): * Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit) now support white and suspicious list * New variables: FULL_REQUEST and FULL_REQUEST_LENGTH * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=46
2014-06-16 17:37:59 +02:00
aclocal
automake
Accepting request 556963 from home:kstreitova:branches:Apache:Modules - update to 2.9.2 * release notes https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2 * refresh apache2-mod_security2-no_rpath.diff * remove apache2-mod_security2-lua-5.3.patch that was applied upstream - remove outdated html pages and diagram (they can be accessed online at https://github.com/SpiderLabs/ModSecurity/wiki) * Reference-Manual.html.bz2 * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2 * modsecurity_diagram_apache_request_cycle.jpg - don't pack the whole doc directory as it contains also Makefiles or doxygen configuration files - disable mlogc as we don't pack it and it also can't be built for curl <=7.34 - add basic and regression test suite (but disabled for now) * add apache2-mod_security2_tests_conf.patch for apache2 configuration file used for tests that was trying to load mpm_worker_module (it's static for our apache2 package) * add "BuildRequires: perl-libwww-perl" needed for the test suite OBS-URL: https://build.opensuse.org/request/show/556963 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=75
2017-12-18 10:36:29 +01:00
%configure --with-apxs=%{apache_apxs} --enable-request-early --enable-htaccess-config --disable-mlogc
- apache2-mod_security2-no_rpath.diff: avoid the usage of -rpath in autoconf m4 macros. Obsoletes patch modsecurity-apache_2.8.0-build_fix_pcre.diff - use automake for build, add autoconf and automake to BuildRequires:. This fix is combined with [bnc#876878]. - turn on --enable-htaccess-config - use %{?_smp_mflags} for build - OWASP rule set. [bnc#876878] new in 2.8.0 (more complete changelog to add to last changelog): * Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit) now support white and suspicious list * New variables: FULL_REQUEST and FULL_REQUEST_LENGTH * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=46
2014-06-16 17:37:59 +02:00
CFLAGS="%{optflags}" make %{?_smp_mflags}
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
%install
Accepting request 259451 from home:pgajdos:apache2 - call spec-cleaner - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/259451 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=57
2014-11-11 13:00:42 +01:00
pushd apache2
Accepting request 206042 from home:draht:branches:Apache:Modules - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual OBS-URL: https://build.opensuse.org/request/show/206042 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=42
2013-11-07 00:16:14 +01:00
install -d -m 0755 %{buildroot}%{apache_libexecdir}
- apache2-mod_security2-no_rpath.diff: avoid the usage of -rpath in autoconf m4 macros. Obsoletes patch modsecurity-apache_2.8.0-build_fix_pcre.diff - use automake for build, add autoconf and automake to BuildRequires:. This fix is combined with [bnc#876878]. - turn on --enable-htaccess-config - use %{?_smp_mflags} for build - OWASP rule set. [bnc#876878] new in 2.8.0 (more complete changelog to add to last changelog): * Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit) now support white and suspicious list * New variables: FULL_REQUEST and FULL_REQUEST_LENGTH * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=46
2014-06-16 17:37:59 +02:00
install .libs/mod_security2.so %{buildroot}%{apache_libexecdir}/%{modname}.so
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
popd
Accepting request 206042 from home:draht:branches:Apache:Modules - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual OBS-URL: https://build.opensuse.org/request/show/206042 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=42
2013-11-07 00:16:14 +01:00
install -D -m 0644 %{SOURCE2} %{buildroot}%{apache_sysconfdir}/conf.d/%{modname}.conf
install -d -m 0755 %{buildroot}%{apache_sysconfdir}/mod_security2.d
install -D -m 0644 %{SOURCE6} %{buildroot}%{apache_sysconfdir}/mod_security2.d
OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=52
2014-08-27 18:32:34 +02:00
install -D -m 0644 %{SOURCE7} %{buildroot}%{apache_sysconfdir}/mod_security2.d
Accepting request 206042 from home:draht:branches:Apache:Modules - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual OBS-URL: https://build.opensuse.org/request/show/206042 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=42
2013-11-07 00:16:14 +01:00
cp -a %{SOURCE6} doc
install -d -m 0755 %{buildroot}/%{usrsharedir}
install -d -m 0755 %{buildroot}/%{usrsharedir}/tools
rm -f rules/.gitignore rules/LICENSE
cp -a rules/util/README %{buildroot}/%{usrsharedir}/tools/README-rules-updater.txt
cp -a tools/rules-updater.pl tools/rules-updater-example.conf %{buildroot}/%{usrsharedir}/tools
Accepting request 560465 from home:jengelh:branches:Apache:Modules * (TM) ought not to be used according to openSUSE's license guidelines (when I last looked at it) * simplify the find line OBS-URL: https://build.opensuse.org/request/show/560465 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=77
2018-01-04 13:36:56 +01:00
find rules -type f -exec chmod 644 {} +
Accepting request 206042 from home:draht:branches:Apache:Modules - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual OBS-URL: https://build.opensuse.org/request/show/206042 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=42
2013-11-07 00:16:14 +01:00
cp -a rules %{buildroot}/%{usrsharedir}
rm -rf %{buildroot}/%{usrsharedir}/rules/util
rm -rf %{buildroot}/%{usrsharedir}/rules/lua
rm -f %{buildroot}/%{usrsharedir}/rules/READM*
rm -f %{buildroot}/%{usrsharedir}/rules/INSTALL %{buildroot}/%{usrsharedir}/rules/CHANGELOG
Accepting request 556963 from home:kstreitova:branches:Apache:Modules - update to 2.9.2 * release notes https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2 * refresh apache2-mod_security2-no_rpath.diff * remove apache2-mod_security2-lua-5.3.patch that was applied upstream - remove outdated html pages and diagram (they can be accessed online at https://github.com/SpiderLabs/ModSecurity/wiki) * Reference-Manual.html.bz2 * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2 * modsecurity_diagram_apache_request_cycle.jpg - don't pack the whole doc directory as it contains also Makefiles or doxygen configuration files - disable mlogc as we don't pack it and it also can't be built for curl <=7.34 - add basic and regression test suite (but disabled for now) * add apache2-mod_security2_tests_conf.patch for apache2 configuration file used for tests that was trying to load mpm_worker_module (it's static for our apache2 package) * add "BuildRequires: perl-libwww-perl" needed for the test suite OBS-URL: https://build.opensuse.org/request/show/556963 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=75
2017-12-18 10:36:29 +01:00
# Temporarily disable test suite as there are some failures that need to be solved
Accepting request 1098838 from home:dirkmueller:Factory - update to 2.9.7: * Fix: FILES_TMP_CONTENT may sometimes lack complete content * Support configurable limit on number of arguments processed * Silence compiler warning about discarded const * Support for JIT option for PCRE2 * Use uid for user if apr_uid_name_get() fails * Fix: handle error with SecConnReadStateLimit configuration * Only check for pcre2 install if required * Adjustment of previous fix for log messages * Mark apache error log messages as from mod_security2 * Use pkg-config to find libxml2 first * Support for PCRE2 in mlogc * Support for PCRE2 * Adjust parser activation rules in modsecurity.conf- recommended * Multipart parsing fixes and new MULTIPART_PART_HEADERS collection * Limit rsub null termination to where necessary * IIS: Update dependencies for next planned release * XML parser cleanup: NULL duplicate pointer * Properly cleanup XML parser contexts upon completion * Fix memory leak in streams * Fix: negative usec on log line when data type long is 32b * mlogc log-line parsing fails due to enhanced timestamp * Allow no-key, single-value JSON body * Set SecStatusEngine Off in modsecurity.conf-recommended * Fix memory leak that occurs on JSON parsing error * Multipart names/filenames may include single quote if double- quote enclosed * Add SecRequestBodyJsonDepthLimit to modsecurity.conf- OBS-URL: https://build.opensuse.org/request/show/1098838 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=87
2023-07-17 10:33:54 +02:00
%check
make test
# make test-regression
Accepting request 556963 from home:kstreitova:branches:Apache:Modules - update to 2.9.2 * release notes https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2 * refresh apache2-mod_security2-no_rpath.diff * remove apache2-mod_security2-lua-5.3.patch that was applied upstream - remove outdated html pages and diagram (they can be accessed online at https://github.com/SpiderLabs/ModSecurity/wiki) * Reference-Manual.html.bz2 * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2 * modsecurity_diagram_apache_request_cycle.jpg - don't pack the whole doc directory as it contains also Makefiles or doxygen configuration files - disable mlogc as we don't pack it and it also can't be built for curl <=7.34 - add basic and regression test suite (but disabled for now) * add apache2-mod_security2_tests_conf.patch for apache2 configuration file used for tests that was trying to load mpm_worker_module (it's static for our apache2 package) * add "BuildRequires: perl-libwww-perl" needed for the test suite OBS-URL: https://build.opensuse.org/request/show/556963 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=75
2017-12-18 10:36:29 +01:00
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
%files
%{apache_libexecdir}/%{modname}.so
%config(noreplace) %{apache_sysconfdir}/conf.d/%{modname}.conf
Accepting request 206042 from home:draht:branches:Apache:Modules - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual OBS-URL: https://build.opensuse.org/request/show/206042 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=42
2013-11-07 00:16:14 +01:00
%dir %{apache_sysconfdir}/mod_security2.d
%{apache_sysconfdir}/mod_security2.d/README-SUSE-mod_security2.txt
OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=51
2014-08-27 17:32:56 +02:00
%{apache_sysconfdir}/mod_security2.d/empty.conf
Accepting request 206042 from home:draht:branches:Apache:Modules - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual OBS-URL: https://build.opensuse.org/request/show/206042 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=42
2013-11-07 00:16:14 +01:00
%{usrsharedir}
Accepting request 907282 from home:dspinella:branches:Apache:Modules - Update to 2.9.4: * Add microsec timestamp resolution to the formatted log timestamp * Added missing Geo Countries * Store temporaries in the request pool for regexes compiled per-request. * Fix other usage of the global pool for request temporaries in re_operators.c * Adds a sanity check before use ctl:ruleRemoveTargetById and ctl:ruleRemoveTargetByMsg. * Fix the order of error_msg validation * When the input filter finishes, check whether we returned data * fix: care non-null terminated chunk data * Fix for apr_global_mutex_create() crashes with mod_security * Fix inet addr handling on 64 bit big endian systems - Run spec-cleaner - Remove if/else for older version of SUSE distribution OBS-URL: https://build.opensuse.org/request/show/907282 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=85
2021-07-20 11:36:03 +02:00
%license LICENSE
%doc README.md CHANGES NOTICE authors.txt
Accepting request 556963 from home:kstreitova:branches:Apache:Modules - update to 2.9.2 * release notes https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2 * refresh apache2-mod_security2-no_rpath.diff * remove apache2-mod_security2-lua-5.3.patch that was applied upstream - remove outdated html pages and diagram (they can be accessed online at https://github.com/SpiderLabs/ModSecurity/wiki) * Reference-Manual.html.bz2 * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2 * modsecurity_diagram_apache_request_cycle.jpg - don't pack the whole doc directory as it contains also Makefiles or doxygen configuration files - disable mlogc as we don't pack it and it also can't be built for curl <=7.34 - add basic and regression test suite (but disabled for now) * add apache2-mod_security2_tests_conf.patch for apache2 configuration file used for tests that was trying to load mpm_worker_module (it's static for our apache2 package) * add "BuildRequires: perl-libwww-perl" needed for the test suite OBS-URL: https://build.opensuse.org/request/show/556963 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_security2?expand=0&rev=75
2017-12-18 10:36:29 +01:00
%doc doc/README.txt
%doc doc/README-SUSE-mod_security2.txt
%doc rules/util/regression-tests
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=1
2008-09-24 15:02:28 +02:00
%changelog
Copy Permalink