1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
|
Installation
============
Snuffleupagus is tested against `various PHP 7+ versions <https://travis-ci.org/jvoisin/snuffleupagus/>`_.
Manual installation
-------------------
Depending on the system, we might already offer binary packages.
You can check our :doc:`download`. In that case you only need to activate
the extension inside your ``php.ini`` and to configure it.
Requirements
^^^^^^^^^^^^
The only dependency (at least on Debian) to compile Snuffleupagus is
`php7.0-dev <https://packages.debian.org/search?keywords=php7.0-dev>`_ or onwards.
Quickstart
^^^^^^^^^^
::
git clone https://github.com/jvoisin/snuffleupagus
cd snuffleupagus/src
phpize
./configure --enable-snuffleupagus
make
make install
This should install the ``snuffleupagus.so`` file in your extension directory.
The final step is adding an extension loading directive, and to specify the
location of the :doc:`configuration file <config>`, either in a
``conf.d/20-snuffleupagus.ini`` file, or directly in you ``php.ini`` if you
prefer:
::
extension=snuffleupagus.so
# This is only an example,
# you can place your rules wherever you want.
sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules
Be careful, on some distribution, there are separate configurations for
cli/fpm/cgi/… be sure to edit the right one.
If you're using `Gentoo <https://gentoo.org>`__, you might encounter the
following error:
::
$ make
$ /bin/sh /root/snuffleupagus-0.5.0/src/libtool --mode=compile cc -I. -I/root/snuffleupagus-0.5.0/src -DPHP_ATOM_INC -I/root/snuffleupagus-0.5.0/src/include -I/root/snuffleupagus-0.5.0/src/main -I/root/snuffleupagus-0.5.0/src -I/usr/lib64/php7.3/include/php -I/usr/lib64/php7.3/include/php/main -I/usr/lib64/php7.3/include/php/TSRM -I/usr/lib64/php7.3/include/php/Zend -I/usr/lib64/php7.3/include/php/ext -I/usr/lib64/php7.3/include/php/ext/date/lib -DHAVE_CONFIG_H -g -O2 -Wall -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-security -D_FORTIFY_SOURCE=2 -fstack-protector -c /root/snuffleupagus-0.5.0/src/snuffleupagus.c -o snuffleupagus.lo
libtool: Version mismatch error. This is libtool 2.4.6, but the
libtool: definition of this LT_INIT comes from an older release.
libtool: You should recreate aclocal.m4 with macros from libtool 2.4.6
libtool: and run autoconf again.
make: *** [Makefile:193: snuffleupagus.lo] Error 63
$
This is a `documented php bug <https://bugs.php.net/bug.php?id=58979>`__,
solvable via:
::
rm -f aclocal.m4
phpize
aclocal && libtoolize --force && autoreconf
./configure --enable-snuffleupagus
make
Heroku installation
-------------------
Heroku's official `buildpack <https://github.com/heroku/heroku-buildpack-php/>`_
uses ``Composer`` to install all dependencies required by your PHP application.
Careful with the `default set of rules
<https://github.com/jvoisin/snuffleupagus/blob/master/config/default.rules>`__,
since it might block the composer deployment, leading to the following errors:
::
heroku[web.1]: Starting process with command `vendor/bin/heroku-php-apache2 -F fpm_custom.conf public/`
heroku[web.1]: Stopping all processes with SIGTERM
app[web.1]: Stopping httpd...
app[web.1]: SIGTERM received, attempting graceful shutdown...
app[web.1]: Stopping php-fpm...
app[web.1]: Shutdown complete.
heroku[web.1]: Process exited with status 143
app[web.1]: [heroku-exec] Starting
app[web.1]: Unable to determine Composer vendor-dir setting; is 'composer' executable on path or 'composer.phar' in current working directory?
heroku[web.1]: Process exited with status 1
heroku[web.1]: State changed from starting to crashed
Requirements
^^^^^^^^^^^^
To install snuffleupagus on heroku, simply follow the `documentation <https://devcenter.heroku.com/articles/php-support#custom-compile-step>`_,
and edit the ``composer.json`` file, as well as the ``Procfile`` to load the additional PHP-FPM configuration.
composer.json
"""""""""""""
::
{
"require": {
"php": "~7.4.6"
},
"config": {
"platform": {
"php": "7.4.6"
}
},
"scripts": {
"compile": [
"git clone https://github.com/jvoisin/snuffleupagus /tmp/snuffleupagus",
"cd /tmp/snuffleupagus/src && phpize && ./configure --enable-snuffleupagus && make && make install",
"echo 'extension=snuffleupagus.so\nsp.allow_broken_configuration=on\nsp.configuration_file=/dev/null' > /app/.heroku/php/etc/php/conf.d/999-ext-snuffleupagus.ini"
]
}
}
This configuration will compile Snuffleupagus to shared library, install it to the proper
location and specify an empty configuration in ``sp.configuration_file`` to ensure
that the ``composer`` deployment phase won't get killed by some rules.
PHP-FPM
"""""""
::
; ext-snuffleupagus
php_admin_flag[sp.allow_broken_configuration] = off
php_admin_value[sp.configuration_file] = /app/default.rules
The final step is to point ``sp.configuration_file`` to a rule set by setting
the preference in an additional `PHP-FPM
configuration <https://devcenter.heroku.com/articles/custom-php-settings#php-fpm-configuration-include>`_.
You should now be running Snuffleupagus in PHP on heroku:
::
app[web.1]: [05-Jul-2020 07:45:22 UTC] PHP Fatal error: [snuffleupagus][0.0.0.0][disabled_function] Aborted execution on call of the function 'exec', because its argument '$command' content (id;whoami) matched a rule in /app/public/test2.php on line 1
app[web.1]: 10.9.226.141 - - [05/Jul/2020:07:45:22 +0000] "GET /test2.php?cmd=id;whoami HTTP/1.1" 500 - "-" "curl/7.68.0
heroku[router]: at=info method=GET path="/test2.php?cmd=id;whoami" host=heroku-x-snuffleupagus.herokuapp.com request_id=012345678-9012-3456-7890-123456789012 fwd="1.2.3.4" dyno=web.1 connect=0ms service=7ms status=500 bytes=169 protocol=http
Upgrading
---------
Upgrading Snuffleupagus is as simple as recompiling it (or using a binary), replacing the file and restarting your webserver.
|
