blob: 703ffedf91d8efce78d58c94f3646ef87261e519 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
# Copyright 1999-2009 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/www-apache/mod_security/mod_security-2.5.9-r1.ebuild,v 1.4 2009/11/19 16:38:56 maekke Exp $
inherit apache-module autotools
MY_P=${P/mod_security-/modsecurity-apache_}
MY_P=${MY_P/_rc/-rc}
DESCRIPTION="Web application firewall and Intrusion Detection System for Apache."
HOMEPAGE="http://www.modsecurity.org/"
SRC_URI="http://www.modsecurity.org/download/${MY_P}.tar.gz"
LICENSE="GPL-2"
SLOT="0"
KEYWORDS="amd64 ~mips ~ppc ~sparc x86"
IUSE="lua perl"
DEPEND="dev-libs/libxml2
perl? ( dev-perl/libwww-perl )
lua? ( >=dev-lang/lua-5.1 )"
RDEPEND="${DEPEND}"
S="${WORKDIR}/${MY_P}"
APACHE2_MOD_FILE="apache2/.libs/${PN}2.so"
APACHE2_MOD_CONF="2.1.2/99_mod_security"
APACHE2_MOD_DEFINE="SECURITY"
need_apache2
src_unpack() {
unpack ${A}
cd "${S}"/apache2
epatch "${FILESDIR}"/${P}-broken-autotools.patch
epatch "${FILESDIR}"/${P}-as-needed.patch
eautoreconf
}
src_compile() {
cd apache2
econf --with-apxs="${APXS}" \
--without-curl \
$(use_with lua) \
|| die "econf failed"
APXS_FLAGS=
for flag in ${CFLAGS}; do
APXS_FLAGS="${APXS_FLAGS} -Wc,${flag}"
done
# Yes we need to prefix it _twice_
for flag in ${LDFLAGS}; do
APXS_FLAGS="${APXS_FLAGS} -Wl,${flag}"
done
emake \
APXS_CFLAGS="${CFLAGS}" \
APXS_LDFLAGS="${LDFLAGS}" \
APXS_EXTRA_CFLAGS="${APXS_FLAGS}" \
|| die "emake failed"
}
src_test() {
cd apache2
make test || die
}
src_install() {
apache-module_src_install
# install rules updater only if perl is enabled (optionally)
if use perl; then
newsbin tools/rules-updater.pl modsec-rules-updater || die
fi
# install documentation
dodoc CHANGES || die
newdoc rules/CHANGELOG CHANGES.crs || die
newdoc rules/README README.crs || die
dohtml -r doc/* || die
# Prepare the core ruleset
cd "${S}"/rules/
sed -i -e 's:logs/:/var/log/apache2/:g' *.conf || die
insinto ${APACHE_MODULES_CONFDIR}/mod_security/
for i in *.conf; do
newins ${i} ${i/modsecurity_crs_/} || die
done
}
pkg_postinst() {
elog "Please note that the core rule set distributed with mod_security is quite"
elog "draconic. If you're using this on a blog, a forum or another user-submitted"
elog "web application where you might talk about standard Unix paths (such as /etc"
elog "or /bin), you might want to disable at least rules 950005 and 950907"
elog "(command injection) if you're sure it might not be a security risk."
elog " "
elog "To do that on the most limited case you might want to use something like"
elog "the following code (this comes from a Typo weblog instance):"
elog " "
elog " <Location /comments>"
elog " SecRuleRemoveById 950005 950907"
elog " </Location>"
elog " "
}
|
GitWeb