Re: [Mod-security-developers] ModSecurity version 2.9.0-RC1 released

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi Rainer,

Thanks for your feedback.

Curl is no longer mandatory on our master tree.

We have created `#ifdefs' with three different definitions:

- WITH_CURL: Enables the download of remote resources (including
  remote rules).
- WITH_REMOTE_RULES: Enables the SecRemoteRules directive, notice
  that it depends on WITH_CURL.
- WITH_CRYPTO: Support for encryption on SecRemoteRules directive
  (Needs apr/apu compiled with crypto support).

All those variables should be automatically set by autotools, making
our build to work even without Curl. Of course, if you don't have
Curl(-dev) during the build time, the "remote resources" will not be
available.

Br.,
Felipe "Zimmerle" Costa
Security Researcher, SpiderLabs

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com <http://www.trustwave.com/>

On 11/18/14 7:00 PM, "Rainer Jung" <rai...@ki...> wrote:

>Addition: you should also move the line
>
>#ifdef WITH_REMOTE_RULES_SUPPORT
>
>in msc_remote_rules.c higher up in the file. Currently it would still
>include (and need) all header files and only then the if block would
>disable all code. But the curl.h might not be there, so include and
>compilation fails. Moving of the if line directly after
>
>#include "msc_remote_rules.h"
>
>fixes this.
>
>Then there are two more curl dependencies:
>
>- in apache2/re_operators.c in function msre_op_pmFromFile_param_init if
>the file name for pmFromFile is an https URL
>
>- in apache2/msc_util.c in function ip_tree_from_uri if the file name
>for ipmatchFromFile is an https URL
>
>IMHO both features should be disabled (replaced by an error message
>during runtime) if curl is not found.
>
>Thanks and regards,
>
>Rainer
>
>Am 18.11.2014 um 22:29 schrieb Rainer Jung:
>> Thanks for producing the RC and sharing.
>>
>> Building it without curl support we get the expected
>>
>> NOTE: curl library is only required for building mlogc
>>
>> output from the configure script, but then the build fails because of
>> the new remote rules support. File msc_remote_rules.h unconditionally
>> needs curl/curl.h.
>>
>> I'd say curl is a bit huge and the remote rule support not in the main
>> stream use, so having the curl dependency only as an option currently
>> would be good.
>>
>> To not introduce a new mandatory dependency, you should define
>> WITH_REMOTE_RULES_SUPPORT only if curl was found by configure.
>>
>> Regards,
>>
>> Rainer
>>
>> Am 18.11.2014 um 14:34 schrieb Felipe Costa:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Hi,
>>>
>>> I am proud to announce our first release candidate for version 2.9.0.
>>> The 2.9.0-RC1 contains fixes and new features.
>>>
>>> The documentation is available in our wikipage:
>>>
>>>http://scanmail.trustwave.com/?c=4062&d=s8Hr1APWoFLpzfgNjgdh9FNfwJOpYf55
>>>vD_zHetZzA&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2
>>>fwiki%2fReference-Manual
>>>
>>> The source and binaries (and the respective hashes) are available at:
>>>
>>>http://scanmail.trustwave.com/?c=4062&d=s8Hr1APWoFLpzfgNjgdh9FNfwJOpYf55
>>>vDb2G-8MkA&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2
>>>freleases%2ftag%2fv2%2e9%2e0-rc1
>>>
>>> SHA256(modsecurity-2.9.0-RC1.tar.gz)=
>>> 1a061e09bc7e3218a80bc2004b7e87c8f3a382323b09633e060c16bea5e23098
>>> SHA256(ModSecurityIIS_2.9.0-RC1-32b.msi)=
>>> 68cd286612ca7026442ec3c409f33a2eaca428d9bb7a297d23a19043f5c31360
>>> SHA256(ModSecurityIIS_2.9.0-RC1-64b.msi)=
>>> 948ffeda98684c569c22da95d600aca7998f20a85c9345a56086e1a85c1d8ab7
>>>
>>> We would like to thank you all that helped out making this release:
>>> comments,
>>> bug reports, and pull requests.
>>>
>>> The most important changes are listed bellow:
>>>
>>> New features
>>> ============
>>>
>>> * `pmFromFile' and `ipMatchFromFile' operators are now accepting HTTPS
>>> served
>>>     files as parameter.
>>> * `SecRemoteRules' directive - allows you to specify a HTTPS served
>>> file that
>>>    may contain rules in the SecRule format to be loaded into your
>>> ModSecurity
>>>    instance.
>>> * `SecRemoteRulesFailAction' directive - allows you to control
>>> whenever the
>>>    user wants to Abort or just Warn when there is a problem while
>>> downloading
>>>    rules specified with the directive: `SecRemoteRules'.
>>> * `fuzzyHash' operator - allows to match contents using fuzzy hashes.
>>> * `FILES_TMP_CONTENT' collection - make available the content of
>>>uploaded
>>>    files.
>>> * InsecureNoCheckCert - option to validate or not a chain of SSL
>>> certificates
>>>    on mlogc connections.
>>>
>>>
>>> Bug fixes
>>> =========
>>>
>>> * ModSecurityIIS: ModSecurity event ID was changed from 0 to 0x1.
>>>    [Issue #676 - Kris Kater and ModSecurity team]
>>> * Fixed signature on "status call": ModSecurity is now using the
>>>original
>>>    server signature.
>>>    [Issues #702 - Linas and ModSecurity team]
>>> * YAJL version is printed while ModSecurity initialization.
>>>    [Issue #703 - Steffen (Apache Lounge) and Mauro Faccenda]
>>> * Fixed subnet representation using slash notation on the @ipMatch
>>> operator.
>>>    [Issue #706 - Walter Hop and ModSecurity team]
>>> * Limited the length of a status call.
>>>    [Issue #714 - 'cpanelkurt' and ModSecurity team]
>>> * Added the missing -P option to nginx regression tests.
>>>    [Issue #720 - Paul Yang]
>>> * Fixed automake scripts to do not use features which will be
>>> deprecated in the
>>>    upcoming releases of automake.
>>>    [Issue #760 - ModSecurity team]
>>> * apr-utils's LDFALGS is now considered while building ModSecurity.
>>>    [Issue #782 - Daniel J. Luke]
>>> * IIS installer is not considering IIS 6 as compatible anymore.
>>>    [Issue #790 - ModSecurity team]
>>> * Fixed yajl build script: now looking for the correct header file.
>>>    [Issue #804 - 'rpfilomeno' and ModSecurity team]
>>> * mlgoc is now forced to use TLS 1.x.
>>>    [Issue #806 - Josh Amishav-Zlatin and ModSecurity team]
>>>
>>>
>>> Br.,
>>> Felipe "Zimmerle" Costa
>>> Security Researcher, SpiderLabs
>>>
>>> Trustwave | SMART SECURITY ON DEMAND
>>> www.trustwave.com <http://www.trustwave.com/>
>>>
>>> -----BEGIN PGP SIGNATURE-----
>>> Version: GnuPG v1
>>> Comment: GPGTools -
>>>http://scanmail.trustwave.com/?c=4062&d=s8Hr1APWoFLpzfgNjgdh9FNfwJOpYf55
>>>vDb2R7gImQ&s=5&u=https%3a%2f%2fgpgtools%2eorg
>>>
>>> iEYEARECAAYFAlRrRO0ACgkQ5t+wjOixEneDsQCfdQO7tsVdlBJB4bKQkRFzvpP+
>>> m8EAn2ToUijuHIKpOm9yWdcwsuZ5yBW+
>>> =80Ng
>>> -----END PGP SIGNATURE-----
>>>
>>> ________________________________
>>>
>>> This transmission may contain information that is privileged,
>>> confidential, and/or exempt from disclosure under applicable law. If
>>> you are not the intended recipient, you are hereby notified that any
>>> disclosure, copying, distribution, or use of the information contained
>>> herein (including any reliance thereon) is strictly prohibited. If you
>>> received this transmission in error, please immediately contact the
>>> sender and destroy the material in its entirety, whether in electronic
>>> or hard copy format.
>>>
>>>
>>>------------------------------------------------------------------------
>>>------
>>>
>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>> from Actuate! Instantly Supercharge Your Business Reports and
>>>Dashboards
>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>more
>>> Get technology previously reserved for billion-dollar corporations,
>>>FREE
>>>
>>>http://scanmail.trustwave.com/?c=4062&d=s8Hr1APWoFLpzfgNjgdh9FNfwJOpYf55
>>>vDSlR7kAyA&s=5&u=http%3a%2f%2fpubads%2eg%2edoubleclick%2enet%2fgampad%2f
>>>clk%3fid%3d157005751%26iu%3d%2f4140%2fostg%2eclktrk
>>>
>>> _______________________________________________
>>> mod-security-developers mailing list
>>> mod...@li...
>>>
>>>http://scanmail.trustwave.com/?c=4062&d=s8Hr1APWoFLpzfgNjgdh9FNfwJOpYf55
>>>vDahR74PzA&s=5&u=https%3a%2f%2flists%2esourceforge%2enet%2flists%2flisti
>>>nfo%2fmod-security-developers
>>> ModSecurity Services from Trustwave's SpiderLabs:
>>> https://www.trustwave.com/spiderLabs.php
>
>--------------------------------------------------------------------------
>----
>Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>with Interactivity, Sharing, Native Excel Exports, App Integration & more
>Get technology previously reserved for billion-dollar corporations, FREE
>http://scanmail.trustwave.com/?c=4062&d=s8Hr1APWoFLpzfgNjgdh9FNfwJOpYf55vD
>SlR7kAyA&s=5&u=http%3a%2f%2fpubads%2eg%2edoubleclick%2enet%2fgampad%2fclk%
>3fid%3d157005751%26iu%3d%2f4140%2fostg%2eclktrk
>_______________________________________________
>mod-security-developers mailing list
>mod...@li...
>http://scanmail.trustwave.com/?c=4062&d=s8Hr1APWoFLpzfgNjgdh9FNfwJOpYf55vD
>ahR74PzA&s=5&u=https%3a%2f%2flists%2esourceforge%2enet%2flists%2flistinfo%
>2fmod-security-developers
>ModSecurity Services from Trustwave's SpiderLabs:
>https://www.trustwave.com/spiderLabs.php

________________________________

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.