Pages

[Gregg]

Without much fanfare mod_security2 version 2.9.1 is now available for Apache 2.4.x VC11 & VC14. The only big difference with this version and 2.8.0 is the introduction of SecRemoteRules. SecRemoteRules allows you to get rules from a file stored on a remote server via https connection. The connection is handled by the Curl library.

This version includes:

Curl 7.47.1 (dll)
LibXML2 2.9.3 (dll)
Lua 5.1.5 (compiled in)
PCRE 8.38 (dll)
Yajl 2.1.0 (dll)

VC14 modules cab be downloaded Here
VC11 modules cab be downloaded Here


VC9 users:

I will most likely not be creating a 2.9.1 for 2.2.x or 2.4.x on VC9. Why you may ask? Curl which is used to contact remote servers for rules uses SChannel, not OpenSSL to make the secure https connection. This was done to bypass the OpenSSL matching nightmare and also SChannel uses the Windows Certificate Store which is much better than Curls built in one when using OpenSSL.

The down side to this is that SChannel is only built into Windows Vista/Server 2008 and later. Since our VC9 builds are targeted for Windows XP SP2 and Windows Server 2003, I can't see putting out something that simply cannot work on XP/2003. At some point when a release comes out with major bug fixes I will build a newer version for VC9 without Remote Rules.