search

owasp-modsecurity / ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
https://www.modsecurity.org
Apache License 2.0
8.23k stars 1.61k forks source link

configure with --with-lua= / parameter seems to be not used #2773

Open amsnek opened 2 years ago

amsnek commented 2 years ago

Describe the bug When compiling with a provided, local compiled LUA (5.4.4), the --with-lua=/data/lua-5.4.4 seems to be ignored and results in "not found" -> it does not seem to look at the path provided

Logs and dumps ... configure: LUA library found at: /usr/lib64//liblua-5.3.so LOOKING AT PATH: /opt/local configure: LUA library found at: /usr/lib64//liblua-5.3.so LOOKING AT PATH: /usr/lib/lua5.3/liblua configure: LUA library found at: /usr/lib64//liblua-5.3.so *** LOOKING AT PATH: /usr/lib/lua5.2/liblua configure: LUA library found at: /usr/lib64//liblua-5.3.so configure: LUA library was not found ... -> no --with-lua=/data/lua-5.4.4 PATH inspected/used

To Reproduce Steps to reproduce the behavior: configure --with-lua=/some/path

Expected behavior *** LOOKING AT PATH: /some/path finding LUA there

A clear and concise description of what you expected to happen. Expecting to find and use locally self-compiled LUA (5.4.4)

Server (please complete the following information): ModSecurity v3.0.7 RHEL8

Initially i thought that the issue is that Lua doesnt build shared libs (.so) -> but even when building with shared libs (using patch from https://www.linuxfromscratch.org/patches/blfs/svn/lua-5.4.4-shared_library-1.patch) -> the behaviour does not change.

amsnek commented 2 years ago

the same issue for SSDEEP as possible workaround, one can modify the configure script and replace the POSSIBLE_PATH with the location of the lib LUA_POSSIBLE_PATHS="/path/custom/location/lib" SSDEEP_POSSIBLE_PATHS="/path/custom/location/lib"

and use --with-lua=yes and --with-ssdeep=yes

but using --with-lua=/path/to/lib or --with-ssdeep=/path/to/lib -> will result in not found

martinhsv commented 1 year ago

Yes, I see. Unlike some of the other configuration items, the m4 file for lua is not doing anything with values other than yes or no.

Although path support would reasonably be expected given the help message ( https://github.com/SpiderLabs/ModSecurity/blob/cb4d7ae371c0f6436639cf5c4c1a3c7c481202d8/build/lua.m4#L25C10-L25C10 )