NGINX Dynamic Module support #5
Conversation
Lets you compile the module with Dynamic Module in NGINX 1.9.11 onwards. Simply compile with --add-dynamic-module instead of --add-module and use the load_module directive in the NGINX configuration file to use. See: * https://www.nginx.com/resources/wiki/extending/ * https://www.nginx.com/blog/dynamic-modules-nginx-1-9-11/
|
Hi @LinuxJedi, Thank you for the patch! that is really cool feature. I would like to share some concerns about having the ModSecurity library in a location that is not standard. In the second step of the compilation, while compiling the ngx_http_modsecurity.org as a shared object, we have the following: as expected in this scenario, the generated object is not linked with the ModSecurity library (neither to other dependencies): Dynamic loading this object in nginx, naturally leads to missing symbols during the run time. As demonstrated below: We can have a workable version, by extending the linker options to the modsecurity object generation, as following: This lead us to a fully constructed ELF with all the symbols resolved: I am doing something wrong? or we may want to extend the linker options to the shared objects as well? In case you want to see the full compilation log (along with the configuration options), it is available here: https://gist.github.com/zimmerle/5cab0a1bb2c51eb31810 Thanks again for the patch! |
|
hmm... good point. Let me look over it again and see if I can improve that situation. |
Now the module will link to libmodsecurity when compiled as a dynamic module rather than the NGINX binary. Tested with NGINX 1.9.11 in dyanmic and static mode.
|
ok, please try this version of the patch. Hopefully you can see what I'm doing here but please let me know if you need me to explain any of it. |
|
Hi @LinuxJedi, Working like a charm! thanks again for patch. Merged on |
|
Has anyone confirmed this working? I'm getting the following after compiling with nginx-1.10.3 |
|
Hi @GenericUK, Yep. It should be working fine. Are you compiling your nginx server and the module on the very same machine? |
|
@zimmerle Thanks Yes! But I have Nginx installed from my distro repository (Raspbian/Debian stretch) and then I downloaded the same version direct from Nginx for the build. I guess the flags used in ./configure might be different between the two. I don't know how/or if I can update the ./configure to match nginx -V |
|
Here's my config using my installed Nginx options from nginx -V (excluding modules). It checks fine and make completes. Still the same not binary compatible message. pi@raspberrypi:/opt/nginx-1.10.3 $ sudo NO_WARNING_CHECKS=yes ./configure --add-dynamic-module=/opt/ModSecurity-nginx --with-openssl=/usr/bin/openssl --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-mf9ymV/nginx-1.10.3=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi
Configuration summary
nginx path prefix: "/usr/share/nginx" |
Lets you compile the module with Dynamic Module in NGINX 1.9.11 onwards.
Simply compile with --add-dynamic-module instead of --add-module and use
the load_module directive in the NGINX configuration file to use.
See: