Блог

Пытаюсь добавить Modsecurity v3.0.4 в Nginx v1.19.9, но сталкиваюсь с некоторыми ошибками, которые я не понимаю. Есть МНОГО ошибок, подобных тем, которые я вставил ниже, но не включил их все. Мое намерение состоит в том, чтобы создать статический двоичный файл Nginx и не использовать модуль динамической безопасности. Спасибо за любую помощь.

Докерфайл

 FROM alpine:latest as build

#Define build argument for version
ARG NGNX_VERSION=1.19.8
ARG PCRE_VERSION=8.44
ARG OSSL_VERSION=1.1.1k
ARG ZLIB_VERSION=1.2.11
ARG GEO_DB_RELEASE=2021-04
ARG MODSEC_BRANCH=v3.0.4
ARG OWASP_BRANCH=v3.3/master

# Set working directory
WORKDIR /tmp

RUN echo "Installing Dependencies" amp;amp; 
    apk add --no-cache --virtual general-dependencies  
    autoconf 
    automake 
    byacc 
    build-base                                                          
    gnupg                                                               
    perl                                                                
    linux-headers                                                       
    pcre-dev                                                            
    wget                                                                
    geoip-dev 
    curl-dev 
    flex 
    g   
    gcc 
    geoip-dev 
    git 
    libc-dev 
    libmaxminddb-dev 
    libstdc   
    libtool 
    libxml2-dev 
    linux-headers 
    lmdb-dev 
    make 
    openssl-dev 
    pcre-dev 
    yajl-dev 
    zlib-dev

# Clone and compile modsecurity. Binary will be located in /usr/local/modsecurity
RUN echo "Installing ModSec Library" amp;amp; 
    git clone -b ${MODSEC_BRANCH} --depth 1 https://github.com/SpiderLabs/ModSecurity amp;amp; 
    git -C /tmp/ModSecurity submodule update --init --recursive amp;amp; 
    (cd "/tmp/ModSecurity" amp;amp; 
        ./build.sh amp;amp; 
        ./configure --with-lmdb  amp;amp; 
        make -j 10 amp;amp; 
        make install 
    )

# Retrieve required packages
RUN echo 'Cloning Modsec Nginx Connector, GeoIP, ModSec OWASP Rules, and download/extract nginx and GeoIP databases' amp;amp; 
    git clone -b master --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git amp;amp; 
    git clone -b ${OWASP_BRANCH} --depth 1 https://github.com/coreruleset/coreruleset.git /usr/local/owasp-modsecurity-crs amp;amp; 
    wget -q https://www.openssl.org/source/openssl-$OSSL_VERSION.tar.gz     amp;amp; 
    tar -xzf openssl-$OSSL_VERSION.tar.gz                                   amp;amp; 
    wget -q https://ftp.pcre.org/pub/pcre/pcre-$PCRE_VERSION.tar.bz2        amp;amp; 
    tar -xjf pcre-$PCRE_VERSION.tar.bz2                                     amp;amp; 
    wget -q http://zlib.net/zlib-$ZLIB_VERSION.tar.gz                       amp;amp; 
    tar -xzf zlib-$ZLIB_VERSION.tar.gz                                      amp;amp; 
    wget -q http://nginx.org/download/nginx-$NGNX_VERSION.tar.gz            amp;amp; 
    tar -xzf nginx-$NGNX_VERSION.tar.gz


# Install Nginx with PCRE, OpenSSL, Geomod, Zlib
RUN set -x                                                                  amp;amp; 
    cd /tmp/nginx-$NGNX_VERSION                                             amp;amp; 
    ./configure                                                             
    --with-compat                               
        --with-ld-opt="-static"                                             
        --with-pcre=/tmp/pcre-${PCRE_VERSION}                               
        --with-zlib=/tmp/zlib-${ZLIB_VERSION}                               
        --with-openssl=/tmp/openssl-${OSSL_VERSION}                         
        --with-http_realip_module                                           
        --with-http_v2_module                                               
    --add-module=/tmp/ModSecurity-nginx                 
        --with-http_ssl_module                                              amp;amp; 
    make -j 10                                                              amp;amp; 
    make install                                                            amp;amp; 
    strip /usr/local/nginx/sbin/nginx                                       amp;amp; 
    apk del general-dependencies

# Symlink access and error logs to /dev/stdout and /dev/stderr, in
# order to make use of Docker's logging mechanism
RUN ln -sf /dev/stdout /usr/local/nginx/logs/access.log                     amp;amp; 
    ln -sf /dev/stderr /usr/local/nginx/logs/error.log

RUN addgroup -S nginx amp;amp; adduser -S -G nginx nginx
 

Сбои происходят во время раздела создания Nginx. Есть много подобных им.

 /usr/include/c  /10.2.1/bits/basic_string.tcc:225: undefined reference to `std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_copy_chars(char*, char const*, char const*)'
/usr/lib/gcc/x86_64-alpine-linux-musl/10.2.1/../../../../x86_64-alpine-linux-musl/bin/ld: /usr/include/c  /10.2.1/bits/basic_string.tcc:219: undefined reference to `std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_create(unsigned longamp;, unsigned long)'
/usr/lib/gcc/x86_64-alpine-linux-musl/10.2.1/../../../../x86_64-alpine-linux-musl/bin/ld: /usr/include/c  /10.2.1/bits/basic_string.tcc:212: undefined reference to `std::__throw_logic_error(char const*)'
/usr/lib/gcc/x86_64-alpine-linux-musl/10.2.1/../../../../x86_64-alpine-linux-musl/bin/ld: /usr/local/modsecurity/lib/libmodsecurity.a(lt5-libmodsecurity_la-rule.o): in function `_GLOBAL__sub_I_rule.cc':
/usr/include/c  /10.2.1/iostream:74: undefined reference to `std::ios_base::Init::Init()'
/usr/lib/gcc/x86_64-alpine-linux-musl/10.2.1/../../../../x86_64-alpine-linux-musl/bin/ld: /usr/local/modsecurity/lib/libmodsecurity.a(lt5-libmodsecurity_la-rule.o): in function `__static_initialization_and_destruction_0':
/usr/include/c  /10.2.1/iostream:74: undefined reference to `std::ios_base::Init::~Init()'
/usr/lib/gcc/x86_64-alpine-linux-musl/10.2.1/../../../../x86_64-alpine-linux-musl/bin/ld: /usr/local/modsecurity/lib/libmodsecurity.a(lt5-libmodsecurity_la-rule.o): in function `__static_initialization_and_destruction_0':
/tmp/ModSecurity/src/variables/rule.cc:23: undefined reference to `std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()'
collect2: error: ld returned 1 exit status
make[1]: *** [objs/Makefile:267: objs/nginx] Error 1
 

Проект набора основных правил OWASP ModSecurity здесь.

Я никогда не пытался выполнить статическую компиляцию, но я предлагаю вам задать вопрос в списке рассылки modsecurity или в списке рассылки конкретного разработчика modsecurity.

https://sourceforge.net/p/mod-security/mailman/