Cannot load module on Debian Buster

HanXHX commented 4 years ago

Hi,

I tried to install Naxsi on Debian Buster but I can't load the module.

2020/09/08 13:19:17 [emerg] 9896#9896: module "/opt/nginx/modules/ngx_http_naxsi_module.so" is not binary compatible in /etc/nginx/modules-enabled/51-mod-http-naxsi.conf:1

Nginx is installed from Debian repository nginx-full package.

I tried many configurations:

Compile Naxsi 0.56 with GCC 7
Compile Naxsi master branch with GCC8
With or without --with-compat arg (./configure)

Base script:

#!/bin/bash

NGINX_VERSION=$(nginx -V 2>&1 | awk -F '/' '/^nginx version/ { print $NF }')
NAXSI_VERSION=0.56

echo "Nginx version: ${NGINX_VERSION}"

nginx -V 2>&1 | grep -q naxsi

if [[ $? -eq 0 ]];
then
    echo "Nginx install done"
    exit 0
fi

cd /tmp
rm -rf nginx-* naxsi_*

wget https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -O nginx-$NGINX_VERSION.tar.gz
wget https://github.com/nbs-system/naxsi/archive/$NAXSI_VERSION.tar.gz -O naxsi_$NAXSI_VERSION.tar.gz

tar xf nginx-$NGINX_VERSION.tar.gz
tar xf naxsi_$NAXSI_VERSION.tar.gz

cd nginx-$NGINX_VERSION
./configure --add-dynamic-module=../naxsi-$NAXSI_VERSION/naxsi_src/
make CC=gcc-7 modules

mv -f /tmp/nginx-$NGINX_VERSION/objs/ngx_http_naxsi_module.so /root/ngx_http_naxsi_module.so

echo "Naxsi location: /root/ngx_http_naxsi_module.so"

root@buster:~{0}# ./install_naxsi.sh
Nginx version: 1.14.2
--2020-09-08 13:25:33--  https://nginx.org/download/nginx-1.14.2.tar.gz
Resolving nginx.org (nginx.org)... 3.125.197.172, 52.58.199.22, 2a05:d014:edb:5704::6, ...
Connecting to nginx.org (nginx.org)|3.125.197.172|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1015384 (992K) [application/octet-stream]
Saving to: ‘nginx-1.14.2.tar.gz’

nginx-1.14.2.tar.gz                             100%[=====================================================================================================>] 991.59K  1.29MB/s    in 0.8s    

2020-09-08 13:25:34 (1.29 MB/s) - ‘nginx-1.14.2.tar.gz’ saved [1015384/1015384]

--2020-09-08 13:25:34--  https://github.com/nbs-system/naxsi/archive/0.56.tar.gz
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/nbs-system/naxsi/tar.gz/0.56 [following]
--2020-09-08 13:25:34--  https://codeload.github.com/nbs-system/naxsi/tar.gz/0.56
Resolving codeload.github.com (codeload.github.com)... 140.82.121.10
Connecting to codeload.github.com (codeload.github.com)|140.82.121.10|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 192120 (188K) [application/x-gzip]
Saving to: ‘naxsi_0.56.tar.gz’

naxsi_0.56.tar.gz                               100%[=====================================================================================================>] 187.62K   722KB/s    in 0.3s    

2020-09-08 13:25:35 (722 KB/s) - ‘naxsi_0.56.tar.gz’ saved [192120/192120]

checking for OS
 + Linux 4.19.0-9-amd64 x86_64
checking for C compiler ... found
 + using GNU C compiler
 + gcc version: 8.3.0 (Debian 8.3.0-6) 
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for EPOLLEXCLUSIVE ... found
checking for O_PATH ... found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for prctl(PR_SET_KEEPCAPS) ... found
checking for capabilities ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for nobody group ... not found
checking for nogroup group ... found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for sched_setaffinity() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for SO_BINDANY ... not found
checking for IP_TRANSPARENT ... found
checking for IP_BINDANY ... not found
checking for IP_BIND_ADDRESS_NO_PORT ... found
checking for IP_RECVDSTADDR ... not found
checking for IP_SENDSRCADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for eventfd() ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for AF_INET6 ... found
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for clock_gettime(CLOCK_MONOTONIC) ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for sysconf(_SC_LEVEL1_DCACHE_LINESIZE) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
configuring additional dynamic modules
adding module in ../naxsi-0.56/naxsi_src/
 + ngx_http_naxsi_module was configured
checking for PCRE library ... found
checking for PCRE JIT support ... found
checking for zlib library ... found
creating objs/Makefile

Configuration summary
  + using system PCRE library
  + OpenSSL library is not used
  + using system zlib library

  nginx path prefix: "/usr/local/nginx"
  nginx binary file: "/usr/local/nginx/sbin/nginx"
  nginx modules path: "/usr/local/nginx/modules"
  nginx configuration prefix: "/usr/local/nginx/conf"
  nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
  nginx pid file: "/usr/local/nginx/logs/nginx.pid"
  nginx error log file: "/usr/local/nginx/logs/error.log"
  nginx http access log file: "/usr/local/nginx/logs/access.log"
  nginx http client request body temporary files: "client_body_temp"
  nginx http proxy temporary files: "proxy_temp"
  nginx http fastcgi temporary files: "fastcgi_temp"
  nginx http uwsgi temporary files: "uwsgi_temp"
  nginx http scgi temporary files: "scgi_temp"

make -f objs/Makefile modules
make[1]: Entering directory '/tmp/nginx-1.14.2'
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_runtime.o \
    ../naxsi-0.56/naxsi_src//naxsi_runtime.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_config.o \
    ../naxsi-0.56/naxsi_src//naxsi_config.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_utils.o \
    ../naxsi-0.56/naxsi_src//naxsi_utils.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_skeleton.o \
    ../naxsi-0.56/naxsi_src//naxsi_skeleton.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_json.o \
    ../naxsi-0.56/naxsi_src//naxsi_json.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_raw.o \
    ../naxsi-0.56/naxsi_src//naxsi_raw.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/libinjection/libinjection_sqli.o \
    ../naxsi-0.56/naxsi_src//ext/libinjection/libinjection_sqli.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/libinjection/libinjection_xss.o \
    ../naxsi-0.56/naxsi_src//ext/libinjection/libinjection_xss.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/libinjection/libinjection_html5.o \
    ../naxsi-0.56/naxsi_src//ext/libinjection/libinjection_html5.c
gcc-7 -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/ngx_http_naxsi_module_modules.o \
    objs/ngx_http_naxsi_module_modules.c
gcc-7 -o objs/ngx_http_naxsi_module.so \
objs/addon/naxsi_src/naxsi_runtime.o \
objs/addon/naxsi_src/naxsi_config.o \
objs/addon/naxsi_src/naxsi_utils.o \
objs/addon/naxsi_src/naxsi_skeleton.o \
objs/addon/naxsi_src/naxsi_json.o \
objs/addon/naxsi_src/naxsi_raw.o \
objs/addon/libinjection/libinjection_sqli.o \
objs/addon/libinjection/libinjection_xss.o \
objs/addon/libinjection/libinjection_html5.o \
objs/ngx_http_naxsi_module_modules.o \
-shared
make[1]: Leaving directory '/tmp/nginx-1.14.2'
Naxsi location: /root/ngx_http_naxsi_module.so

Is it a Naxsi bug or something missing in doc?

Best,

EM

wargio commented 4 years ago

please use master and use the latest version of gcc that you have on debian.

HanXHX commented 4 years ago

Hi @wargio,

I said i tried to compile/install with gcc8 + naxsi master branch on my first message.

Please see the updated script with this params:

root@buster:~# cat install_naxsi.sh 
#!/bin/bash

NGINX_VERSION=$(nginx -V 2>&1 | awk -F '/' '/^nginx version/ { print $NF }')
NAXSI_VERSION=master

echo "Nginx version: ${NGINX_VERSION}"

nginx -V 2>&1 | grep -q naxsi

if [[ $? -eq 0 ]];
then
    echo "Nginx install done"
    exit 0
fi

cd /tmp
rm -rf nginx-* naxsi_*

wget https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -O nginx-$NGINX_VERSION.tar.gz
wget https://github.com/nbs-system/naxsi/archive/$NAXSI_VERSION.tar.gz -O naxsi_$NAXSI_VERSION.tar.gz

tar xf nginx-$NGINX_VERSION.tar.gz
tar xf naxsi_$NAXSI_VERSION.tar.gz

cd nginx-$NGINX_VERSION
./configure --add-dynamic-module=../naxsi-$NAXSI_VERSION/naxsi_src/
make modules

mv -f /tmp/nginx-$NGINX_VERSION/objs/ngx_http_naxsi_module.so /root/ngx_http_naxsi_module.so

echo "Naxsi location: /root/ngx_http_naxsi_module.so"

root@buster:~# gcc --version
gcc (Debian 8.3.0-6) 8.3.0
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

root@buster:~# ./install_naxsi.sh 
Nginx version: 1.14.2
--2020-09-09 08:36:26--  https://nginx.org/download/nginx-1.14.2.tar.gz
Resolving nginx.org (nginx.org)... 52.58.199.22, 3.125.197.172, 2a05:d014:edb:5704::6, ...
Connecting to nginx.org (nginx.org)|52.58.199.22|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1015384 (992K) [application/octet-stream]
Saving to: ‘nginx-1.14.2.tar.gz’

nginx-1.14.2.tar.gz                             100%[=====================================================================================================>] 991.59K  2.15MB/s    in 0.5s    

2020-09-09 08:36:27 (2.15 MB/s) - ‘nginx-1.14.2.tar.gz’ saved [1015384/1015384]

--2020-09-09 08:36:27--  https://github.com/nbs-system/naxsi/archive/master.tar.gz
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/nbs-system/naxsi/tar.gz/master [following]
--2020-09-09 08:36:27--  https://codeload.github.com/nbs-system/naxsi/tar.gz/master
Resolving codeload.github.com (codeload.github.com)... 140.82.121.9
Connecting to codeload.github.com (codeload.github.com)|140.82.121.9|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/x-gzip]
Saving to: ‘naxsi_master.tar.gz’

naxsi_master.tar.gz                                 [  <=>                                                                                                 ] 191.74K   932KB/s    in 0.2s    

2020-09-09 08:36:27 (932 KB/s) - ‘naxsi_master.tar.gz’ saved [196345]

checking for OS
 + Linux 4.19.0-9-amd64 x86_64
checking for C compiler ... found
 + using GNU C compiler
 + gcc version: 8.3.0 (Debian 8.3.0-6) 
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for EPOLLEXCLUSIVE ... found
checking for O_PATH ... found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for prctl(PR_SET_KEEPCAPS) ... found
checking for capabilities ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for nobody group ... not found
checking for nogroup group ... found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for sched_setaffinity() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for SO_BINDANY ... not found
checking for IP_TRANSPARENT ... found
checking for IP_BINDANY ... not found
checking for IP_BIND_ADDRESS_NO_PORT ... found
checking for IP_RECVDSTADDR ... not found
checking for IP_SENDSRCADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for eventfd() ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for AF_INET6 ... found
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for clock_gettime(CLOCK_MONOTONIC) ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for sysconf(_SC_LEVEL1_DCACHE_LINESIZE) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
configuring additional dynamic modules
adding module in ../naxsi-master/naxsi_src/
 + ngx_http_naxsi_module was configured
checking for PCRE library ... found
checking for PCRE JIT support ... found
checking for zlib library ... found
creating objs/Makefile

Configuration summary
  + using system PCRE library
  + OpenSSL library is not used
  + using system zlib library

  nginx path prefix: "/usr/local/nginx"
  nginx binary file: "/usr/local/nginx/sbin/nginx"
  nginx modules path: "/usr/local/nginx/modules"
  nginx configuration prefix: "/usr/local/nginx/conf"
  nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
  nginx pid file: "/usr/local/nginx/logs/nginx.pid"
  nginx error log file: "/usr/local/nginx/logs/error.log"
  nginx http access log file: "/usr/local/nginx/logs/access.log"
  nginx http client request body temporary files: "client_body_temp"
  nginx http proxy temporary files: "proxy_temp"
  nginx http fastcgi temporary files: "fastcgi_temp"
  nginx http uwsgi temporary files: "uwsgi_temp"
  nginx http scgi temporary files: "scgi_temp"

make -f objs/Makefile modules
make[1]: Entering directory '/tmp/nginx-1.14.2'
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_runtime.o \
    ../naxsi-master/naxsi_src//naxsi_runtime.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_config.o \
    ../naxsi-master/naxsi_src//naxsi_config.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_utils.o \
    ../naxsi-master/naxsi_src//naxsi_utils.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_skeleton.o \
    ../naxsi-master/naxsi_src//naxsi_skeleton.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_json.o \
    ../naxsi-master/naxsi_src//naxsi_json.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/naxsi_src/naxsi_raw.o \
    ../naxsi-master/naxsi_src//naxsi_raw.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/libinjection/libinjection_sqli.o \
    ../naxsi-master/naxsi_src//ext/libinjection/libinjection_sqli.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/libinjection/libinjection_xss.o \
    ../naxsi-master/naxsi_src//ext/libinjection/libinjection_xss.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/addon/libinjection/libinjection_html5.o \
    ../naxsi-master/naxsi_src//ext/libinjection/libinjection_html5.c
cc -c -fPIC -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs -I src/http -I src/http/modules \
    -o objs/ngx_http_naxsi_module_modules.o \
    objs/ngx_http_naxsi_module_modules.c
cc -o objs/ngx_http_naxsi_module.so \
objs/addon/naxsi_src/naxsi_runtime.o \
objs/addon/naxsi_src/naxsi_config.o \
objs/addon/naxsi_src/naxsi_utils.o \
objs/addon/naxsi_src/naxsi_skeleton.o \
objs/addon/naxsi_src/naxsi_json.o \
objs/addon/naxsi_src/naxsi_raw.o \
objs/addon/libinjection/libinjection_sqli.o \
objs/addon/libinjection/libinjection_xss.o \
objs/addon/libinjection/libinjection_html5.o \
objs/ngx_http_naxsi_module_modules.o \
-shared
make[1]: Leaving directory '/tmp/nginx-1.14.2'
Naxsi location: /root/ngx_http_naxsi_module.so

root@buster:~# cp /root/ngx_http_naxsi_module.so /opt/nginx/modules/ngx_http_naxsi_module.so

root@buster:~# systemctl restart nginx
Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xe" for details.

root@buster:~# tail /var/log/nginx/error.log 
2020/09/09 08:35:13 [emerg] 10659#10659: module "/opt/nginx/modules/ngx_http_naxsi_module.so" is not binary compatible in /etc/nginx/modules-enabled/51-mod-http-naxsi.conf:1
2020/09/09 08:36:42 [emerg] 13091#13091: module "/opt/nginx/modules/ngx_http_naxsi_module.so" is not binary compatible in /etc/nginx/modules-enabled/51-mod-http-naxsi.conf:1

Best,

EM

marcinguy commented 4 years ago

@HanXHX you need to compile NAXSI module with the same flags as your NGINX

Run

$nginx -V

to list compile flags on your installed package and pass the same flags to ./configure of NAXSI.

i.e

./configure <FLAGS FROM NGINX> --add-dynamic-module=../naxsi-$NAXSI_VERSION/naxsi_src/

Then hopefully it should work.

wargio commented 4 years ago

can you try these debs? https://github.com/nbs-system/naxsi/releases/tag/1.1 [edit] i've tested the debs. they do work with the nginx debian package

wargio commented 4 years ago

ok, seems that on debian the version actually differs from the nginx source. you need to use apt-get source nginx to fetch the source code and actually successfully build it.

HanXHX commented 4 years ago

Hi @marcinguy @wargio

The deb package for buster works well :sunglasses:

I tried with a simple config: start OK, i have the expected results.

However i suggest an update on package dependencies for Debian.

Naxsi package depends "nginx" package. However Debian provides many nginx packages: nginx-light, nginx-extras...

When i install nginx-full + naxsi install crashes. I suggest to change the dependency from nginx to nginx-common.

Debian uses this dependency for extra modules like libnginx-mod-http-echo.

root@buster:~# dpkg -i debian-buster-libnginx-mod-http-naxsi_1.1_amd64.deb 
Selecting previously unselected package libnginx-mod-http-naxsi.
(Reading database ... 34025 files and directories currently installed.)
Preparing to unpack debian-buster-libnginx-mod-http-naxsi_1.1_amd64.deb ...
Unpacking libnginx-mod-http-naxsi (1.1) ...
dpkg: dependency problems prevent configuration of libnginx-mod-http-naxsi:
 libnginx-mod-http-naxsi depends on nginx (>= 1.14.2); however:
  Package nginx is not installed.
  Version of nginx on system, provided by nginx-full:amd64, is <none>.

dpkg: error processing package libnginx-mod-http-naxsi (--install):
 dependency problems - leaving unconfigured

Best,

EM

wargio commented 4 years ago

Cool. thanks. i'll do it immediately.

wargio commented 4 years ago

@HanXHX i've updated the debs.

HanXHX commented 4 years ago

@wargio awesome :1st_place_medal:

It works fine. I will check with an extended config tomorrow.

Thanks for your work! :clap:

wargio commented 4 years ago

I'm closing this and mark it as fixed.

wargio commented 4 years ago

ps: wiki updated for debian/ubuntu

nbs-system / naxsi

Cannot load module on Debian Buster #512