;;; Copyright © 2025 Wojtek Kosior <koszko@koszko.org>
;;; Licensed under the Creative Commons Zero v1.0.

(define-module (gnu packages modsecurity)
  #:use-module ((gnu packages apr) #:select (apr apr-util))
  #:use-module ((gnu packages autotools) #:select (autoconf automake libtool))
  #:use-module ((gnu packages bison) #:select (bison))
  #:use-module ((gnu packages curl) #:select (curl))
  #:use-module ((gnu packages databases) #:select (lmdb))
  #:use-module ((gnu packages datastructures) #:select (ssdeep))
  #:use-module ((gnu packages documentation) #:select (doxygen))
  #:use-module ((gnu packages flex) #:select (flex))
  #:use-module ((gnu packages geo) #:select (libmaxminddb))
  #:use-module ((gnu packages lua) #:select (lua))
  #:use-module ((gnu packages pcre) #:select (pcre pcre2))
  #:use-module ((gnu packages perl) #:select (perl))
  #:use-module ((gnu packages pkg-config) #:select (pkg-config))
  #:use-module ((gnu packages xml) #:select (libxml2))
  #:use-module ((gnu packages valgrind) #:select (valgrind))
  #:use-module ((gnu packages web) #:select (httpd yajl))
  #:use-module ((guix build-system gnu) #:select (gnu-build-system))
  #:use-module ((guix gexp) #:select (gexp file-append))
  #:use-module ((guix git-download) #:select
                (git-fetch git-file-name git-reference))
  #:use-module ((guix licenses) #:select (asl2.0 bsd-3))
  #:use-module ((guix packages) #:select
                (base32 delete modify-inputs origin package package-arguments
                 package-inputs replace))
  #:use-module ((guix utils) #:select (substitute-keyword-arguments)))



(define-public libmodsecurity
  (package
   (name "libmodsecurity")
   (version "3.0.13")
   (source (origin
            (method git-fetch)
            (uri (git-reference
                  (url "https://github.com/owasp-modsecurity/ModSecurity")
                  (commit (format #f "v~a" version))
                  (recursive? #t)))
            (file-name (git-file-name name version))
            (sha256 (base32
                     "0khzm7wfd34w3zdhinq8z46c21pwcczb5jvg2j0b0d1v9nvzaggv"))))
   (build-system gnu-build-system)
   (arguments (list
               #:configure-flags
               #~(cons* "--with-pcre2"
                        (map (lambda (name)
                               (format #f "--with-~a=~a" name
                                       (assoc-ref %build-inputs name)))
                             '("curl" "lmdb" "ssdeep")))
               #:phases
               #~(modify-phases %standard-phases
                   (add-after 'patch-source-shebangs 'patch-prog-paths-in-tests
                     (lambda _
                       (let* ((PATH (string-split (getenv "PATH") #\:))
                              (/bin/echo (search-path PATH "echo"))
                              (/bin/ech (string-drop-right /bin/echo 1))
                              (regression "test/test-cases/regression"))
                         (for-each
                          (lambda (test)
                            (substitute*
                                (format #f "test/test-cases/regression/~a.json"
                                        test)
                              (("/bin/ech") /bin/ech)))
                          '("action-exec" "operator-inpectFile")))))
                   (add-before 'configure 'fix-ssdeep-searching
                     (lambda _
                       (substitute* "build/ssdeep.m4"
                         (("\\[Path to ssdeep prefix\\]\\)\\]" matched)
                          (string-append
                           matched
                           ",[SSDEEP_POSSIBLE_PATHS=\"${with_ssdeep}\";"
                           " with_ssdeep=yes]"))))))))
   (inputs (list curl libmaxminddb libxml2 lmdb lua pcre2 ssdeep yajl))
   (native-inputs (list autoconf
                        automake
                        bison
                        doxygen
                        libtool
                        flex
                        perl
                        pkg-config
                        valgrind))
   (synopsis "Free software web application firewall (WAF) library")
   (description "Libmodsecurity is one component of the ModSecurity v3 project.
The library codebase serves as an interface to ModSecurity Connectors taking in
web traffic and applying traditional ModSecurity processing.")
   (home-page "https://modsecurity.org/")
   (license (list asl2.0 ;; libmodsecurity, Mbed TLS
                  bsd-3)))) ;; libinjection

(define httpd-modsecurity-with-older-pcre
  (package
   (name "httpd-modsecurity")
   (version "2.9.8")
   (source (origin
            (method git-fetch)
            (uri (git-reference
                  (url "https://github.com/owasp-modsecurity/ModSecurity")
                  (commit (format #f "v~a" version))))
            (file-name (git-file-name name version))
            (sha256 (base32
                     "04mjmc0kp3k56lvi4s8vmksiqsamspsj5cqbk14bkr36xrw5g7kw"))))
   (build-system gnu-build-system)
   (arguments (list
               #:configure-flags
               #~(let ((inputs `(("apu" . ,(assoc-ref %build-inputs "apr-util"))
                                 ("apxs" . ,(assoc-ref %build-inputs "httpd"))
                                 . ,%build-inputs)))
                   (map (lambda (name)
                          (format #f "--with-~a=~a"
                                  name (assoc-ref inputs name)))
                        '("apr" "apu" "apxs" "curl" "pcre" "ssdeep")))
               #:phases
               #~(modify-phases %standard-phases
                   (add-after 'unpack 'supply-id_log-for-test-linking
                     (lambda _
                       (let ((port (open-file "tests/msc_test.c" "a")))
                         ;; True `id_log' is in `apache2/apache2_config.c' which
                         ;; isn't and cannot (easily) be linked with the test.
                         (format port "const char* id_log(msre_rule* _) ~
                                       {return \"DUMMY\";}")
                         (close port))))
                   (add-after 'unpack 'fix-module-installation-prefix
                     (lambda _
                       (substitute* "apache2/Makefile.am"
                         (("(\\$.DESTDIR.)(\\$.APXS_MODULES.)" _ dst apxs_mods)
                          (format #f "~a$(prefix)~a" dst apxs_mods)))))
                   (add-after 'install-license-files 'install-NOTICE-file
                     (lambda* (#:key outputs #:allow-other-keys)
                       (let* ((out (assoc-ref outputs "out"))
                              (package (strip-store-file-name out)))
                         (install-file "NOTICE" (format #f "~a/share/doc/~a"
                                                        out package))))))))
   (inputs (list apr
                 apr-util
                 curl
                 httpd
                 libxml2
                 lua
                 (list pcre "bin")
                 ssdeep
                 yajl))
   (native-inputs (list autoconf automake httpd libtool perl pkg-config))
   (synopsis "Free software web application firewall (WAF) module")
   (description "ModSecurity enables web application defenders to gain
visibility into HTTP(S) and provides a power rules language and API to implement
advanced protections.")
   (home-page "https://modsecurity.org/")
   (license (list asl2.0))))

(define-public httpd-modsecurity
  (let ((base httpd-modsecurity-with-older-pcre))
    (package
      (inherit base)
      (arguments (substitute-keyword-arguments (package-arguments base)
                   ;; Sadly, tests don't seem to work with PRCE2.
                   ((#:tests? _ #f) #f)
                   ((#:configure-flags flags)
                    #~(cons (format #f "--with-pcre2=~a"
                                    (assoc-ref %build-inputs "pcre2"))
                            #$flags))))
      (inputs (modify-inputs (package-inputs base)
                (delete "pcre")
                (append pcre2))))))