Skip to content

Commit b0243f3

Browse files
wtzhang23wtzhang23
committed
include default core rule set into default root fs
Signed-off-by: William Zhang <wtzhang23@gmail.com>
1 parent 7d19b8d commit b0243f3

7 files changed

Lines changed: 107 additions & 4 deletions

File tree

‎Makefile.am‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ endif
1313

1414
all: coraza/coraza.h libcoraza.a libcoraza.$(SHARED_EXT)
1515

16-
coraza/coraza.h: libcoraza/coraza.go libcoraza/log.go
16+
coraza/coraza.h: libcoraza/coraza.go libcoraza/log.go libcoraza/fs.go
1717
@mkdir -p coraza
1818
go tool cgo -exportheader $@ $^
1919

20-
libcoraza.a: libcoraza/coraza.go libcoraza/log.go
20+
libcoraza.a: libcoraza/coraza.go libcoraza/log.go libcoraza/fs.go
2121
go build -buildmode=c-archive -o $@ $^
2222

23-
libcoraza.$(SHARED_EXT): libcoraza/coraza.go libcoraza/log.go
23+
libcoraza.$(SHARED_EXT): libcoraza/coraza.go libcoraza/log.go libcoraza/fs.go
2424
go build -buildmode=c-shared -o $@ $^
2525

2626
install-data-local: all check

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ module github.com/corazawaf/libcoraza
33
go 1.24.0
44

55
require (
6+
github.com/corazawaf/coraza-coreruleset/v4 v4.21.0
67
github.com/corazawaf/coraza/v3 v3.3.3
78
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93
89
golang.org/x/sync v0.19.0

‎go.sum‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc h1:OlJhrgI3I+FLUCTI3JJW8MoqyM78WbqJjecqMnqG+wc=
22
github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc/go.mod h1:7rsocqNDkTCira5T0M7buoKR2ehh7YZiPkzxRuAgvVU=
3+
github.com/corazawaf/coraza-coreruleset/v4 v4.21.0 h1:Su2rMyY+fN0Y5V6RmJPbnjAnXgxhwNoxKCxQTqmfrS4=
4+
github.com/corazawaf/coraza-coreruleset/v4 v4.21.0/go.mod h1:tRjsdtj39+at47dLCpE8ChoDa2FK2IAwTWIpDT8Z62g=
35
github.com/corazawaf/coraza/v3 v3.3.3 h1:kqjStHAgWqwP5dh7n0vhTOF0a3t+VikNS/EaMiG0Fhk=
46
github.com/corazawaf/coraza/v3 v3.3.3/go.mod h1:xSaXWOhFMSbrV8qOOfBKAyw3aOqfwaSaOy5BgSF8XlA=
57
github.com/corazawaf/libinjection-go v0.2.2 h1:Chzodvb6+NXh6wew5/yhD0Ggioif9ACrQGR4qjTCs1g=
68
github.com/corazawaf/libinjection-go v0.2.2/go.mod h1:OP4TM7xdJ2skyXqNX1AN1wN5nNZEmJNuWbNPOItn7aw=
9+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
10+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
711
github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
812
github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
913
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
@@ -16,6 +20,10 @@ github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
1620
github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
1721
github.com/petar-dambovaliev/aho-corasick v0.0.0-20240411101913-e07a1f0e8eb4 h1:1Kw2vDBXmjop+LclnzCb/fFy+sgb3gYARwfmoUcQe6o=
1822
github.com/petar-dambovaliev/aho-corasick v0.0.0-20240411101913-e07a1f0e8eb4/go.mod h1:EHPiTAKtiFmrMldLUNswFwfZ2eJIYBHktdaUTZxYWRw=
23+
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
24+
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
25+
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
26+
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
1927
github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
2028
github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
2129
github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
@@ -39,5 +47,7 @@ golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
3947
golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
4048
google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
4149
google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
50+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
51+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
4252
rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
4353
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=

‎libcoraza/coraza.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ type WafConfigHandle struct {
7777
//export coraza_new_waf_config
7878
func coraza_new_waf_config() C.coraza_waf_config_t {
7979
return C.coraza_waf_config_t(cgo.NewHandle(&WafConfigHandle{
80-
config: coraza.NewWAFConfig(),
80+
config: coraza.NewWAFConfig().WithRootFS(rootFS),
8181
}))
8282
}
8383

‎libcoraza/coraza_test.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,57 @@ func TestWafIsConsistent(t *testing.T) {
3333
}
3434

3535
func TestAddRulesToWaf(t *testing.T) {
36+
tests := []struct {
37+
name string
38+
rules string
39+
canCreateWaf bool
40+
}{
41+
{
42+
name: "rule",
43+
rules: `SecRule REMOTE_ADDR "127.0.0.1" "id:1,phase:1,deny,log,msg:'test 123',status:403"`,
44+
canCreateWaf: true,
45+
},
46+
{
47+
name: "include local file",
48+
rules: `Include testdata/test.conf`,
49+
canCreateWaf: true,
50+
},
51+
{
52+
name: "include coreruleset file",
53+
rules: `Include @owasp_crs/*.conf`,
54+
canCreateWaf: true,
55+
},
56+
{
57+
name: "include invalid rule",
58+
rules: `foobar123`,
59+
canCreateWaf: false,
60+
},
61+
{
62+
name: "include non-existent file",
63+
rules: `Include testdata/nonexistent.conf`,
64+
canCreateWaf: false,
65+
},
66+
}
67+
for _, test := range tests {
68+
t.Run(test.name, func(t *testing.T) {
69+
config := coraza_new_waf_config()
70+
rv := coraza_rules_add(config, stringToC(test.rules))
71+
if rv != 0 {
72+
t.Fatalf("Rules addition failed: %d", rv)
73+
}
74+
75+
er := stringToC("")
76+
waf := coraza_new_waf(config, &er)
77+
if test.canCreateWaf && (waf == 0 || stringFromC(er) != "") {
78+
t.Fatalf("Waf creation failed: %d", waf)
79+
} else if !test.canCreateWaf && (waf != 0 || stringFromC(er) == "") {
80+
t.Fatalf("Waf creation should have failed: %d", waf)
81+
}
82+
if stringFromC(er) != "" {
83+
t.Logf("Waf creation error: %s", stringFromC(er))
84+
}
85+
})
86+
}
3687
}
3788

3889
func TestCoraza_add_get_args(t *testing.T) {

‎libcoraza/fs.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package main
2+
3+
import "C"
4+
5+
import (
6+
"io/fs"
7+
"os"
8+
9+
coreruleset "github.com/corazawaf/coraza-coreruleset/v4"
10+
)
11+
12+
// combinedFS is a filesystem that routes paths first by checking the local filesystem
13+
// and then the coreruleset rootfs.
14+
type combinedFS struct {
15+
corerulesetFS fs.FS // coreruleset rootfs
16+
}
17+
18+
func (c *combinedFS) Open(name string) (fs.File, error) {
19+
// First try the local filesystem using os.Open directly
20+
file, localFileErr := os.Open(name)
21+
if localFileErr == nil {
22+
return file, nil
23+
}
24+
25+
// Then try the coreruleset rootfs
26+
corerulesetFile, corerulesetErr := c.corerulesetFS.Open(name)
27+
if corerulesetErr == nil {
28+
return corerulesetFile, nil
29+
}
30+
31+
return nil, localFileErr // return the local file error since the coreruleset fs is the last resort
32+
}
33+
34+
var rootFS fs.FS
35+
36+
func init() {
37+
rootFS = &combinedFS{
38+
corerulesetFS: coreruleset.FS,
39+
}
40+
}

‎libcoraza/testdata/test.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
SecRule REMOTE_ADDR "127.0.0.1" "id:1,phase:1,deny,log,msg:'test 123',status:403"

0 commit comments

Comments
 (0)