Add support for lua 5.4; remove curl deprecation

[3eka]

Describe the bug

I have custom (latest) installations of lua library and curl utility installed under /pz/SFW directory...

• Lua 5.4.6
• cURL 8.3.0

GCC 12 is used on OpenIndiana (Solaris fork) Illumos based OS

Logs and dumps
Lua 5.4 is not supported:

:; make
...
libtool: compile:  /usr/gcc/12/bin/gcc -DHAVE_CONFIG_H -I. -DSOLARIS2=11 -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -I/usr/include/libxml2 -I/pz/SFW/apr/include -I/pz/SFW/apr/include -I/pz/SFW/include -I/usr/apache2/2.4/include -I/pz/SFW/include -DWITH_CURL_SSLVERSION_TLSv1_2 -DWITH_CURL -I/usr/include/libxml2 -DWITH_LUA -DWITH_PCRE_STUDY -DMODSEC_PCRE_MATCH_LIMIT=1500 -DMODSEC_PCRE_MATCH_LIMIT_RECURSION=1500 -DREQUEST_EARLY -DCACHE_LUA -DPERFORMANCE_MEASUREMENT -DMSC_LARGE_STREAM_INPUT -DWITH_REMOTE_RULES -I/pz/SFW/include -DWITH_PCRE2 -I/pz/SFW/include -DWITH_YAJL -I/usr/include/yajl -lstdc++ -m64 -march=native -std=c89 -std=c99 -D_POSIX_PTHREAD_SEMANTICS -D_XOPEN_SOURCE=600 -D_FILE_OFFSET_BITS=64 -D__EXTENSIONS__ -I/pz/SFW/include -I/pz/SFW/include/openssl -I/pz/SFW/apr/include -I/pz/SFW/include/nghttp3 -I/usr/include -I/usr/gnu/include -I/usr/include/readline -I/usr/include/ncurses -I/usr/include/idn2 -I/pz/SFW/apr/include -I/pz/SFW/include -MT mod_security2_la-msc_lua.lo -MD -MP -MF .deps/mod_security2_la-msc_lua
.Tpo -c msc_lua.c  -fPIC -DPIC -o .libs/mod_security2_la-msc_lua.o                                                                                                                                            
msc_lua.c: In function 'lua_execute':                                                                                                                                                                         
msc_lua.c:465:2: error: #error We are only tested under Lua 5.0, 5.1, 5.2, or 5.3.                                                                                                                            
  465 | #error We are only tested under Lua 5.0, 5.1, 5.2, or 5.3.                   

If I remove custom lua 5.4 and leave system provied packages:

:; pkg list 'runtime/lua*'
NAME (PUBLISHER)                                  VERSION                    IFO
runtime/lua                                       5.2.4-2020.0.1.3           i--
runtime/lua-53                                    5.3.6-2020.0.1.1           i--

then custom cURL installation triggers deprecation warning:

/usr/gcc/12/bin/gcc -DHAVE_CONFIG_H -I. -I../apache2  -DSOLARIS2=11 -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -I../apache2  -I/pz/SFW/apr/include -I/pz/SFW/include -DWITH_CURL_SSLVERSION_TLSv1_2 -DWITH_CURL -
I/pz/SFW/include -DWITH_PCRE2 -I/pz/SFW/include -lstdc++ -m64 -march=native -std=c89 -std=c99 -D_POSIX_PTHREAD_SEMANTICS -D_XOPEN_SOURCE=600 -D_FILE_OFFSET_BITS=64 -D__EXTENSIONS__ -I/pz/SFW/include -I/pz/S
FW/include/openssl -I/pz/SFW/apr/include -I/pz/SFW/include/nghttp3 -I/usr/include -I/usr/gnu/include -I/usr/include/readline -I/usr/include/ncurses -I/usr/include/idn2  -I/pz/SFW/apr/include -I/pz/SFW/inclu
de -MT mlogc-mlogc.o -MD -MP -MF .deps/mlogc-mlogc.Tpo -c -o mlogc-mlogc.o `test -f 'mlogc.c' || echo './'`mlogc.c                                                                                            
mlogc.c: In function 'thread_worker':                                                                                                                                                                         
mlogc.c:1746:29: warning: 'CURLINFO_SIZE_UPLOAD' is deprecated: since 7.55.0. Use CURLINFO_SIZE_UPLOAD_T [-Wdeprecated-declarations]                                                                          
 1746 |                             curl_easy_getinfo(curl, CURLINFO_SIZE_UPLOAD,                                                                                                                             
      |                             ^~~~~~~~~~~~~~~~~                                                                                                                                                         
In file included from mlogc.c:37:                                                                                                                                                                             
/pz/SFW/include/curl/curl.h:2863:3: note: declared here                                                                                                                                                       
 2863 |   CURLINFO_SIZE_UPLOAD CURL_DEPRECATED(7.55.0, "Use CURLINFO_SIZE_UPLOAD_T")                                                                                                                          
      |   ^~~~~~~~~~~~~~~~~~~~                                                                             

To Reproduce

Install Lua 5.4.6 library and cURL 8.3.0 utility and try to compile mod_security 2 against (PCRE2 custom installation is OK, but just because that was not changed recently)

Expected behavior

Clean builds of mod_security, version 2 with Lua 5.4.6 library and cURL 8.3.0 utility custom installation

Server (please complete the following information):
N/A

Rule Set (please complete the following information):
N/A
Additional context

Best regards

[martinhsv]

Thanks for raising those @3eka .

(Note that those are both relevant only to the v2.9.x codeline; ModSecurity v3 already allows lua 5.4).

[3eka]

I am stuck with v2, because using Apache web server, and https://github.com/SpiderLabs/ModSecurity-apache#note--this-project-is-not-production-ready

Regards.

[martinhsv]

Of course. The observation was only intended as clarification for users of ModSecurity v3 with nginx, that the issue described here is not relevant to them.

[martinhsv]

I am going to proceed to close this since the higher priority of the two separate items has been fixed. Feel free to open a fresh issue for the lower-priority mlogc portion, if you wish.