ModSecurity2 v2.9.11 not working on RHEL 7 due to undefined symbol: pcre2_set_depth_limit

[friesoft]

Describe the bug

ModSecurity 2.9.11 in combination with Apache httpd 2.4.64 doesn't start on RHEL 7 due to an undefined symbol "pcre2_set_depth_limit" of pcre2

RHEL 7 has the following rpm:
pcre2-10.23-2.el7.x86_64

But the missing symbol is nowhere to be found:

$ grep 'pcre2_set_depth_limit' /lib64/libpcre2-8.so.0.5.0
$ echo $?
1

Logs and dumps
Cannot load modules/mod_security2.so into server: /opt/apache/modules/mod_security2.so: undefined symbol: pcre2_set_depth_limit

To Reproduce

Compile modsecurity against RHEL 7 pcre2 and try to start apache httpd (also self compiled)

Expected behavior

Apache httpd shouldn't fail to start due to undefined symbols

Server (please complete the following information):

• ModSecurity version (and connector): ModSecurity 2.9.11
• WebServer: Apache httpd 2.4.64
• OS (and distro): RHEL 7

[airween]

Hi @friesoft,

Thanks for reporting it - I'm sorry you're experiencing this issue.

Unfortunately this PCRE2 version is a bit old. Here is what I found:

• pcre2_set_depth_limit() was introduced in commit 88db1be, on 2017 Mar 12
• probably the next release was 10.30 on 2022 Jan 25 - which is very weird... (may be the developers created releases on GH later?)
• 10.23 definitely does not contain this function

If your OS does not provide this function, the only one thing what you can do is use --with-pcre flag - see the blog post about this change.

[friesoft]

Thanks for answering so quickly :)
Yeah RHEL 7 is pretty rusty already, was just wondering it broke in a bugfix release from 2.9.7 to 2.9.11.

We've resorted to compiling latest pcre2 as well, now it's working fine.

[airween]

Thanks for your patience.

Just one question: do you think it would make sense to add a compile condition for older systems to use PCRE2?

Switching to PCRE2 was necessary, because most system has started to remove the old PCRE engine (eg. in Debian 13 there won't be part of system). But we kept the door open to use the old engine too. So, the question is do we need to add a version check and use functions conditionally?

[friesoft]

compile condition for older systems to use PCRE2?
do you mean pcre here?

I guess it would have been sufficient for us if it was clear from the changelog or if the configure script checked which version of pcre is needed at the minimum. Currently the build using pcre2 works on rhel 7 but startup of httpd fails which could have been caught by a configure time error if version was checked properly

[airween]

compile condition for older systems to use PCRE2?
do you mean pcre here?

no, I meant PCRE2. You reported an issue about a PCRE2 function, which does not exist in your PCRE2 library because it's too old.

I guess it would have been sufficient for us if it was clear from the changelog or if the configure script checked which version of pcre is needed at the minimum.

You're definitely right. I (and I assume the previous developers) wasn't clear with the fact that PCRE2 has been developing continuously, and earlier releases didn't have all functions that the newer ones have.

Currently the build using pcre2 works on rhel 7 but startup of httpd fails which could have been caught by a configure time error if version was checked properly

Yes, it seems we have to add some extra checks to autoconf scripts.

Thanks!