owasp-modsecurity / owasp-modsecurity/ModSecurity

2.x standalone fails to link since ap_map_http_request_error() is not exported as APR function

Open
#3,451 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

To integrate the ModSecurity 2.x with HAProxy, I compiled the standalone/ .
It compiles successfully, but when linked with SPOA published at
https://github.com/haproxy/spoa-modsecurity/
link phase fails with:

LANG=C make MODSEC_INC=/usr/local/src/modsecurity/ModSecurity/INSTALL/include MODSEC_LIB=/usr/local/src/modsecurity/ModSecurity/INSTALL/lib APACHE2_INC=/usr/include/httpd APR_INC=/usr/include/apr-1 | tee log.build
cc  -o modsecurity spoa.o modsec_wrapper.o /usr/local/src/modsecurity/ModSecurity/INSTALL/lib/standalone.a -lpthread  -levent -levent_pthreads -lcurl -lapr-1 -laprutil-1 -lxml2 -lpcre -lpcre2-8 -lyajl
/usr/local/src/modsecurity/ModSecurity/INSTALL/lib/standalone.a(standalone_la-apache2_io.o): In function `read_request_body':
/usr/local/src/modsecurity/ModSecurity/standalone/../apache2/apache2_io.c:237: undefined reference to 
`ap_map_http_request_error'
collect2: error: ld returned 1 exit status
make: *** [Makefile:43: modsecurity] Error 1

The function ap_map_http_request_error() is internal to httpd and not published to APR libraries.

The patch below fixes this, but I feel somewhat uncomfortable.

diff --git a/apache2/apache2_io.c b/apache2/apache2_io.c
index 8deeb01c..383439a3 100644
--- a/apache2/apache2_io.c
+++ b/apache2/apache2_io.c
@@ -175,6 +175,42 @@ apr_status_t input_filter(ap_filter_t *f, apr_bucket_brigade *bb_out,
     return APR_SUCCESS;
 }

+/* Ack. ap_map_http_request_error() is not an apr function, so it is
+ * not public in a library. Include it here.
+ */
+/*
+ * Map specific APR codes returned by the filter stack to HTTP error
+ * codes, or the default status code provided. Use it as follows:
+ *
+ * return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+ *
+ * If the filter has already handled the error, AP_FILTER_ERROR will
+ * be returned, which is cleanly passed through.
+ *
+ * These mappings imply that the filter stack is reading from the
+ * downstream client, the proxy will map these codes differently.
+ */
+AP_DECLARE(int) ap_map_http_request_error(apr_status_t rv, int status)
+{
+    switch (rv) {
+    case AP_FILTER_ERROR:
+        return AP_FILTER_ERROR;
+
+    case APR_ENOSPC:
+        return HTTP_REQUEST_ENTITY_TOO_LARGE;
+
+    case APR_ENOTIMPL:
+        return HTTP_NOT_IMPLEMENTED;
+
+    case APR_TIMEUP:
+    case APR_ETIMEDOUT:
+        return HTTP_REQUEST_TIME_OUT;
+
+    default:
+        return status;
+    }
+}
+
 /**
  * Reads request body from a client.
  */

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in apache2/apache2_io.c, especially read_request_body and the standalone build command shown in the report. Check how ap_map_http_request_error is provided for standalone builds and verify the result by linking the standalone library with the SPOA ModSecurity integration; done means the link completes without the undefined reference.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.