owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx

Module logs version of libmodsecurity headers it was built against, not dynamically linked version

Open
#383 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Perl
Stars
1.9k
Forks
312
PR merge metrics
No merged PRs in 30d

Description

This is cosmetic, but since it had me scratching my head for a while I figured it's helpful to log as a bug.

In ngx_http_modsecurity_module.c:ngx_http_modsecurity_init_main_conf() the module emits an error log entry noting the number of rules loaded and the version of libmodsecurity3. The version number comes from constants which are derived from the header file modsecurity/modsecurity.h. https://github.com/owasp-modsecurity/ModSecurity-nginx/blob/9eb44fd9ab0988756e1ab8ce5aa5548ddbe57846/src/ngx_http_modsecurity_module.c#L691

These symbols are resolved at compile time from the header file, but the module itself is dynamically linked and so this may not reflect the version of the library in use by the module.

Practically, fixing this would require a new API in libmodsecurity to request the library version and calling that from the connector. This would not be a backward-compatible change and may not make sense outside of a significant update.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at src/ngx_http_modsecurity_module.c in ngx_http_modsecurity_init_main_conf() and inspect the version constants from modsecurity/modsecurity.h. Compare those compile-time values with what the dynamically linked library can expose, while reviewing the stated backward-compatibility constraint. Done means determining whether a runtime-version API and connector change can be scoped across the relevant projects.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, nginx
Domain
backend, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.