From fcf62802b9bc0a0c6aca7e5964c5598366cbe11e Mon Sep 17 00:00:00 2001 From: potatso Date: Wed, 12 Jul 2023 19:07:44 +0800 Subject: [PATCH] refactor: update code --- lib/resty/coraza.lua | 52 +++---- lib/resty/coraza/coraza.lua | 201 +++++++++++++------------ lib/resty/coraza/request.lua | 11 +- t/sanity.t | 284 +++++++++++++++++++++++++++++++++++ 4 files changed, 419 insertions(+), 129 deletions(-) create mode 100644 t/sanity.t diff --git a/lib/resty/coraza.lua b/lib/resty/coraza.lua index b7cca79..67f0d2e 100644 --- a/lib/resty/coraza.lua +++ b/lib/resty/coraza.lua @@ -4,9 +4,6 @@ local coraza = require "resty.coraza.coraza" local consts = require "resty.coraza.constants" local nlog = ngx.log -local ngx_var = ngx.var -local ngx_ctx = ngx.ctx -local ngx_req = ngx.req local fmt = string.format local debug_fmt = log.debug_fmt @@ -34,13 +31,13 @@ function _M.rules_add(waf, directives) end function _M.do_access_filter() - local transaction = ngx_ctx.transaction + local transaction = ngx.ctx.transaction - coraza.process_connection(transaction, ngx_var.remote_addr, ngx_var.remote_port, - ngx_var.server_addr, ngx_var.server_port) + coraza.process_connection(transaction, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) -- process uri - coraza.process_uri(transaction, ngx_var.request_uri, ngx_req.get_method(), ngx_var.server_protocol) + coraza.process_uri(transaction, ngx.var.request_uri, ngx.req.get_method(), ngx.var.server_protocol) -- process http get args.The coraza_process_uri function recommends using AddGetRequestArgument to add get args request.build_and_process_get_args(transaction) @@ -51,20 +48,20 @@ function _M.do_access_filter() -- process http req body if has request.build_and_process_body(transaction) - ngx_ctx.action, ngx_ctx.status_code = coraza.intervention(transaction) + ngx.ctx.action, ngx.ctx.status_code = coraza.intervention(transaction) end function _M.do_create_transaction(waf) -- each connection will be created a transaction - ngx_ctx.transaction = coraza.new_transaction(waf) + ngx.ctx.transaction = coraza.new_transaction(waf) end function _M.do_free_transaction() - local transaction = ngx_ctx.transaction + local transaction = ngx.ctx.transaction if transaction ~= nil then - nlog(debug_fmt("transaction %s is freed by coraza_free_transaction", ngx_ctx.request_id)) - ngx_ctx.transaction = nil + nlog(debug_fmt("transaction %s is freed by coraza_free_transaction", ngx.ctx.request_id)) + ngx.ctx.transaction = nil coraza.free_transaction(transaction) end end @@ -73,11 +70,11 @@ function _M.do_handle() -- transaction is interrupted by policy, be free firstly. -- If request has disrupted by coraza, the transaction is freed and set to nil. -- Response which was disrupted doesn't make sense. - if ngx_ctx.action ~= nil and ngx_ctx.transaction ~= nil then - nlog(warn_fmt([[Transaction %s request: "%s" is interrupted by policy. Action is %s]], ngx_ctx.request_id, ngx_var.request, ngx_ctx.action)) - if ngx_ctx.action == "drop" or ngx_ctx.action == "deny" then - ngx_ctx.is_disrupted = true - return ngx_ctx.status_code, fmt(consts.BLOCK_CONTENT_FORMAT, ngx_ctx.status_code) + if ngx.ctx.action ~= nil and ngx.ctx.transaction ~= nil then + nlog(warn_fmt([[Transaction %s request: "%s" is interrupted by policy. Action is %s]], ngx.ctx.request_id, ngx.var.request, ngx.ctx.action)) + if ngx.ctx.action == "drop" or ngx.ctx.action == "deny" then + ngx.ctx.is_disrupted = true + return ngx.ctx.status_code, fmt(consts.BLOCK_CONTENT_FORMAT, ngx.ctx.status_code) end end end @@ -86,14 +83,14 @@ function _M.do_interrupt() -- transaction is interrupted by policy, be free firstly. -- If request has disrupted by coraza, the transaction is freed and set to nil. -- Response which was disrupted doesn't make sense. - if ngx_ctx.is_disrupted == true and ngx.get_phase() == "header_filter" then + if ngx.ctx.is_disrupted == true and ngx.get_phase() == "header_filter" then nlog(debug_fmt("Transaction %s has been disrupted at request phrase. ignore", - ngx_ctx.request_id)) + ngx.ctx.request_id)) return end local status_code, block_msg = _M.do_handle() if status_code ~= nil then - ngx.status = ngx_ctx.status_code + ngx.status = ngx.ctx.status_code local ok, msg = pcall(ngx.say, block_msg) if ok == false then nlog(err_fmt(msg)) @@ -103,21 +100,21 @@ function _M.do_interrupt() end function _M.do_header_filter() - if ngx_ctx.is_disrupted == true then - -- If request was interrupted by coraza at access_by_lua phrase, the ngx_ctx.transaction will be set nil. + if ngx.ctx.is_disrupted == true then + -- If request was interrupted by coraza at access_by_lua phrase, the ngx.ctx.transaction will be set nil. -- We can bypass the check. nlog(debug_fmt("Transaction %s has been disrupted at request phrase. ignore", - ngx_ctx.request_id)) + ngx.ctx.request_id)) return end local h = ngx.resp.get_headers(0, true) for k, v in pairs(h) do - coraza.add_response_header(ngx_ctx.transaction, k, v) + coraza.add_response_header(ngx.ctx.transaction, k, v) end -- copy from https://github.com/SpiderLabs/ModSecurity-nginx/blob/d59e4ad121df702751940fd66bcc0b3ecb51a079/src/ngx_http_modsecurity_header_filter.c#L527 - coraza.process_response_headers(ngx_ctx.transaction, ngx.status, "HTTP 1.1") + coraza.process_response_headers(ngx.ctx.transaction, ngx.status, "HTTP 1.1") - ngx_ctx.action, ngx_ctx.status_code = coraza.intervention(ngx_ctx.transaction) + ngx.ctx.action, ngx.ctx.status_code = coraza.intervention(ngx.ctx.transaction) end function _M.do_body_filter() @@ -125,8 +122,7 @@ function _M.do_body_filter() end function _M.do_log() - coraza.process_logging(ngx_ctx.transaction) - + coraza.process_logging(ngx.ctx.transaction) end return _M diff --git a/lib/resty/coraza/coraza.lua b/lib/resty/coraza/coraza.lua index 23f269f..a79b68e 100644 --- a/lib/resty/coraza/coraza.lua +++ b/lib/resty/coraza/coraza.lua @@ -7,8 +7,6 @@ local ffi = require "ffi" local log = require "resty.coraza.log" local nlog = ngx.log -local ngx_var = ngx.var -local ngx_ctx = ngx.ctx local err_fmt = log.err_fmt local debug_fmt = log.debug_fmt @@ -143,78 +141,84 @@ function _M.new_transaction(waf) -- checking whether the transaction objects are correctly released or not. -- In end of process, or intervention. -- extern coraza_transaction_t coraza_new_transaction(coraza_waf_t waf, void* logCb); - local res = coraza.coraza_new_transaction(waf, nil) - ngx_ctx.request_id = ngx_var.request_id - nlog(debug_fmt("Success to creat new transaction id %s", ngx_ctx.request_id)) - return res + local ok, msg = pcall(coraza.coraza_new_transaction, waf, nil) + if ok then + ngx.ctx.request_id = ngx.var.request_id + nlog(debug_fmt("Success to creat new transaction id %s", + ngx.ctx.request_id)) + return msg + else + nlog(debug_fmt("Failed to creat new transaction id %s, msg: %s", + ngx.ctx.request_id, msg)) + end end function _M.process_connection(transaction, sourceAddress, clientPort, serverHost, serverPort) -- extern int coraza_process_connection(coraza_transaction_t t, char* sourceAddress, int clientPort, -- char* serverHost, int serverPort); - local res = coraza.coraza_process_connection(transaction, cast_to_c_char(sourceAddress), + local ok, msg = pcall(coraza.coraza_process_connection, transaction, cast_to_c_char(sourceAddress), tonumber(clientPort), cast_to_c_char(serverHost), tonumber(serverPort)) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_process_connection with " .. - "sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s", - ngx_ctx.request_id, sourceAddress, clientPort, serverHost, serverPort)) - else + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_process_connection with " .. - "sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s", - ngx_ctx.request_id, sourceAddress, clientPort, serverHost, serverPort)) + "sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s", + ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_process_connection with " .. + "sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s msg: %s", + ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort, msg)) end end function _M.process_uri(transaction, uri, method, proto) -- This function won't add GET arguments, they must be added with AddArgument -- extern int coraza_process_uri(coraza_transaction_t t, char* uri, char* method, char* proto); - local res = coraza.coraza_process_uri(transaction, cast_to_c_char(uri), + local ok, msg = pcall(coraza.coraza_process_uri, transaction, cast_to_c_char(uri), cast_to_c_char(method), cast_to_c_char(proto)) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_process_uri with %s %s %s", - ngx_ctx.request_id, ngx_ctx.request_id, method, uri, proto)) - else + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_process_uri with %s %s %s", - ngx_ctx.request_id, method, uri, proto)) + ngx.ctx.request_id, method, uri, proto)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_process_uri with %s %s %s. msg: %s", + ngx.ctx.request_id, ngx.ctx.request_id, method, uri, proto, msg)) end end function _M.add_request_header(transaction, header_name, header_value) -- extern int coraza_add_request_header(coraza_transaction_t t, char* name, int name_len, -- char* value, int value_len); - local res = coraza.coraza_add_request_header(transaction, cast_to_c_char(header_name), #header_name, - cast_to_c_char(header_value), #header_value) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_add_request_header with %s:%s", - ngx_ctx.request_id, header_name, header_value)) - else + local ok, msg = pcall(coraza.coraza_add_request_header, transaction, + cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_add_request_header with %s:%s", - ngx_ctx.request_id, header_name, header_value)) + ngx.ctx.request_id, header_name, header_value)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_add_request_header with %s:%s. msg: %s", + ngx.ctx.request_id, header_name, header_value, msg)) end end function _M.add_get_args(transaction, header_name, header_value) -- extern int coraza_add_get_args(coraza_transaction_t t, char* name, char* value); - local res = coraza.coraza_add_get_args(transaction, cast_to_c_char(header_name), - cast_to_c_char(header_value)) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_add_get_args with %s:%s", - ngx_ctx.request_id, header_name, header_value)) - else + local ok, msg = pcall(coraza.coraza_add_get_args, transaction, + cast_to_c_char(header_name), cast_to_c_char(header_value)) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_add_get_args with %s:%s", - ngx_ctx.request_id, header_name, header_value)) + ngx.ctx.request_id, header_name, header_value)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_add_get_args with %s:%s. msg: %s", + ngx.ctx.request_id, header_name, header_value, msg)) end end function _M.process_request_headers(transaction) -- extern int coraza_process_request_headers(coraza_transaction_t t); - local res = coraza.coraza_process_request_headers(transaction) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_headers", - ngx_ctx.request_id)) - else + local ok, msg = pcall(coraza.coraza_process_request_headers, transaction) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_headers", - ngx_ctx.request_id)) + ngx.ctx.request_id)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_headers. msg: %s", + ngx.ctx.request_id, msg)) end end @@ -230,10 +234,10 @@ function _M.intervention(transaction) status_code = 403 end nlog(debug_fmt("Transaction %s disrupted with status %s action %s", - ngx_ctx.request_id, status_code, action)) + ngx.ctx.request_id, status_code, action)) return action, status_code else - nlog(debug_fmt("Failed to disrupt transaction %s", ngx_ctx.request_id)) + nlog(debug_fmt("Failed to disrupt transaction %s, action is nil", ngx.ctx.request_id)) return nil, nil end @@ -241,107 +245,114 @@ end function _M.free_transaction(transaction) -- extern int coraza_free_transaction(coraza_transaction_t t); - local res = coraza.coraza_free_transaction(transaction) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_free_transaction", - ngx_ctx.request_id)) - else + local ok, msg = coraza.coraza_free_transaction(transaction) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_free_transaction", - ngx_ctx.request_id)) + ngx.ctx.request_id)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_free_transaction. msg: %s", + ngx.ctx.request_id, msg)) end end function _M.append_request_body(transaction, body) -- extern int coraza_append_request_body(coraza_transaction_t t, unsigned char* data, int length); - local res = coraza.coraza_append_request_body(transaction, cast_to_c_char(body), #body) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_append_request_body with %s", - ngx_ctx.request_id, body)) - else + local ok, msg = pcall(coraza.coraza_append_request_body, transaction, + cast_to_c_char(body), #body) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_append_request_body with %s", - ngx_ctx.request_id, body)) + ngx.ctx.request_id, body)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_append_request_body with %s. msg: %s", + ngx.ctx.request_id, body, msg)) end end function _M.request_body_from_file(transaction, file_path) -- extern int coraza_request_body_from_file(coraza_transaction_t t, char* file); -- return 0 if success, otherwish return 1 - local res = coraza.coraza_request_body_from_file(transaction, cast_to_c_char(file_path)) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_request_body_from_file with %s", - ngx_ctx.request_id, file_path)) - else + local ok, msg = pcall(coraza.coraza_request_body_from_file, + transaction, cast_to_c_char(file_path)) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_request_body_from_file with %s", - ngx_ctx.request_id, file_path)) + ngx.ctx.request_id, file_path)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_request_body_from_file with %s. msg: %s", + ngx.ctx.request_id, file_path, msg)) end end function _M.process_request_body(transaction) -- extern int coraza_process_request_body(coraza_transaction_t t); - local res = coraza.coraza_process_request_body(transaction) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_body", - ngx_ctx.request_id)) - else + local ok, msg = pcall(coraza.coraza_process_request_body, transaction) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_body", - ngx_ctx.request_id)) + ngx.ctx.request_id)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_body. msg: %s", + ngx.ctx.request_id, msg)) end end -- for processing response - function _M.process_response_headers(transaction, status_code, proto) -- extern int coraza_process_response_headers(coraza_transaction_t t, int status, char* proto); - local res = coraza.coraza_process_response_headers(transaction, tonumber(status_code), cast_to_c_char(proto)) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_headers with %s %s", - ngx_ctx.request_id, status_code, proto)) - else + local ok, msg = pcall(coraza.coraza_process_response_headers,transaction, + tonumber(status_code), cast_to_c_char(proto)) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_headers with %s %s", - ngx_ctx.request_id, status_code, proto)) + ngx.ctx.request_id, status_code, proto)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_headers with %s %s", + ngx.ctx.request_id, status_code, proto)) end end function _M.add_response_header(transaction, header_name, header_value) -- extern int coraza_add_response_header(coraza_transaction_t t, char* name, -- int name_len, char* value, int value_len); - local res = coraza.coraza_add_response_header(transaction, cast_to_c_char(header_name), #header_name, - cast_to_c_char(header_value), #header_value) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_add_response_header with %s:%s", - ngx_ctx.request_id, header_name, header_value)) - else + local ok, msg = pcall(coraza.coraza_add_response_header, transaction, cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_add_response_header with %s:%s", - ngx_ctx.request_id, header_name, header_value)) + ngx.ctx.request_id, header_name, header_value)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_add_response_header with %s:%s. msg: %s", + ngx.ctx.request_id, header_name, header_value, msg)) end end function _M.append_response_body(transaction, body) - local res = coraza.coraza_append_response_body(transaction, cast_to_c_char(body), #body) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_append_response_body with %s", - ngx_ctx.request_id, body)) - else + local ok, msg = pcall(coraza.coraza_append_response_body, transaction, + cast_to_c_char(body), #body) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_append_response_body with %s", - ngx_ctx.request_id, body)) + ngx.ctx.request_id, body)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_append_response_body with %s, msg: %s", + ngx.ctx.request_id, body, msg)) end end function _M.process_response_body(transaction) - local res = coraza.coraza_process_response_body(transaction) - if res == 1 then - nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_body", - ngx_ctx.request_id)) - else + local ok, msg = pcall(coraza.coraza_process_response_body,transaction) + if ok then nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_body", - ngx_ctx.request_id)) + ngx.ctx.request_id)) + else + nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_body. msg: %s", + ngx.ctx.request_id, msg)) end end function _M.process_logging(transaction) - coraza.coraza_process_logging(transaction) - nlog(debug_fmt("Transaction %s success to invoke coraza_process_logging", - ngx_ctx.request_id)) + local ok, msg = pcall(coraza.coraza_process_logging, transaction) + if ok then + nlog(debug_fmt("Transaction %s success to invoke coraza_process_logging", + ngx.ctx.request_id)) + else + nlog(debug_fmt("Transaction %s failed to invoke coraza_process_logging. msg: %s", + ngx.ctx.request_id, msg)) + end end return _M \ No newline at end of file diff --git a/lib/resty/coraza/request.lua b/lib/resty/coraza/request.lua index bb91075..929e06d 100644 --- a/lib/resty/coraza/request.lua +++ b/lib/resty/coraza/request.lua @@ -4,7 +4,6 @@ local fmt = string.format local ngx = ngx local nlog = ngx.log -local ngx_req = ngx.req local _M = { _VERSION = '1.0.0', @@ -12,9 +11,9 @@ local _M = { function _M.build_and_process_header(transaction) - local headers, err = ngx_req.get_headers(0, true) + local headers, err = ngx.req.get_headers(0, true) if err then - err = fmt("failed to call ngx_req.get_headers: %s", err) + err = fmt("failed to call ngx.req.get_headers: %s", err) nlog(ngx.ERR, err) end for k, v in pairs(headers) do @@ -24,10 +23,10 @@ function _M.build_and_process_header(transaction) end function _M.build_and_process_body(transaction) - local req_body = ngx_req.get_body_data() + local req_body = ngx.req.get_body_data() if req_body then -- TODO: fix code to process multipart/formdata - -- local path = ngx_req.get_body_file() + -- local path = ngx.req.get_body_file() -- coraza.request_body_from_file(path) local req_body_size = #req_body -- TODO req_body_size > req_body_size_opt @@ -38,7 +37,7 @@ end function _M.build_and_process_get_args(transaction) -- process http get args if has - local arg = ngx_req.get_uri_args() + local arg = ngx.req.get_uri_args() for k,v in pairs(arg) do coraza.add_get_args(transaction, k, v) end diff --git a/t/sanity.t b/t/sanity.t new file mode 100644 index 0000000..b31a0ec --- /dev/null +++ b/t/sanity.t @@ -0,0 +1,284 @@ +use Test::Nginx::Socket 'no_plan'; + +our $HttpConfig = <<'_EOC_'; + lua_package_path "lib/?.lua;/usr/local/share/lua/5.1/?.lua;;"; + lua_socket_log_errors off; + lua_need_request_body on; +_EOC_ + +our $LocationConfig = <<'_EOC_'; + location /t { + content_by_lua_block { + local coraza = require "resty.coraza" + local waf = coraza.create_waf() + if waf then + ngx.say("done") + end + + } + } +_EOC_ + +add_block_preprocessor(sub { + my ($block) = @_; + + if (!defined $block->request) { + $block->set_value("request", "GET /t"); + } +}); + +no_shuffle(); +no_long_string(); +no_root_location(); +run_tests(); + +__DATA__ + +=== TEST 1: sanity +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + if waf then + ngx.say("done") + end + } + } +--- error_code: 200 +--- response_body_like eval +"done" +--- error_log eval +["Success to creat new waf"] + +=== TEST 2: test to release waf pointer +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + coraza.free_waf(waf) + } + } +--- error_code: 200 +--- error_log eval +["Success to creat new waf", "Success to free new waf"] + +=== TEST 3: test rules_add_file +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local ok, msg = coraza.rules_add_file(waf, "non-exist") + ngx.say(msg) + } + } +--- error_code: 200 +--- response_body_like eval +"failed to readfile: open non-exist: no such file or directory" + +=== TEST 4: test rules_add with sec ssss +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local ok, msg = coraza.rules_add(waf, "sec ssss") + ngx.say(msg) + } + } +--- error_code: 200 +--- response_body_like eval +"unknown directive \"sec\"" + +=== TEST 5: test rules_add with SecRule REQUEST_HEADERS:User-Agent "Mozilla" "phase:1, id:3,drop,status:452,log,msg:'Blocked User-Agent'" +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local ok, msg = coraza.rules_add(waf, [[SecRule REQUEST_HEADERS:User-Agent "Mozilla" "phase:1, id:3,drop,status:452,log,msg:'Blocked User-Agent'"]]) + ngx.say(msg) + } + } +--- error_code: 200 +--- error_log eval +["Success to load rule with"] + +=== TEST 6: test new_transaction +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local ok, msg = coraza.new_transaction(waf) + } + } +--- error_code: 200 +--- error_log eval +["Success to creat new transaction id"] + +=== TEST 7: test new_transaction with nil waf pointer +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local ok, msg = coraza.new_transaction() + } + } +--- error_code: 200 +--- error_log eval +["Failed to creat new transaction id"] + +=== TEST 8: test process_connection +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(tran, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + } + } +--- error_code: 200 +--- error_log eval +["success to invoke coraza_process_connection with"] + +=== TEST 9: test process_connection with error +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(nil, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + } + } +--- error_code: 200 +--- error_log eval +["failed to invoke coraza_process_connection with"] + +=== TEST 10: test process_uri +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(tran, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + coraza.process_uri(tran, "GET", "/index.php?a=1", "http/1.1") + coraza.process_uri(tran, "aa", "/index.php?a=1", "http/1.1") + coraza.process_uri(nil, "aa", "/index.php?a=1", "http/1.1") + } + } +--- error_code: 200 +--- error_log eval +["success to invoke coraza_process_uri with", "failed to invoke coraza_process_uri with"] + +=== TEST 11: test add_request_header +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(tran, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + coraza.process_uri(tran, "GET", "/index.php?a=1", "http/1.1") + coraza.add_request_header(tran, "key", "value") + } + } +--- error_code: 200 +--- error_log eval +["success to invoke coraza_add_request_header with key:value"] + +=== TEST 12: test add_request_header with error +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(tran, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + coraza.process_uri(tran, "GET", "/index.php?a=1", "http/1.1") + coraza.add_request_header(nil, "key", "value") + } + } +--- error_code: 200 +--- error_log eval +["failed to invoke coraza_add_request_header with key:value"] + +=== TEST 12: test add_get_args +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(tran, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + coraza.process_uri(tran, "GET", "/index.php?a=1", "http/1.1") + coraza.add_request_header(tran, "key", "value") + coraza.add_get_args(tran, "key", "value") + } + } +--- error_code: 200 +--- error_log eval +["success to invoke coraza_add_get_args with key:value"] + +=== TEST 13: test add_get_args with error +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(tran, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + coraza.process_uri(tran, "GET", "/index.php?a=1", "http/1.1") + coraza.add_request_header(tran, "key", "value") + coraza.add_get_args(nil, "key", "value") + } + } +--- error_code: 200 +--- error_log eval +["failed to invoke coraza_add_get_args with key:value"] + +=== TEST 13: test process_request_headers +--- http_config eval: $::HttpConfig +--- config +location /t { + content_by_lua_block { + local coraza = require "resty.coraza.coraza" + local waf = coraza.new_waf() + local tran = coraza.new_transaction(waf) + coraza.process_connection(tran, ngx.var.remote_addr, ngx.var.remote_port, + ngx.var.server_addr, ngx.var.server_port) + coraza.process_uri(tran, "GET", "/index.php?a=1", "http/1.1") + coraza.add_request_header(tran, "key", "value") + coraza.process_request_headers(tran) + } + } +--- error_code: 200 +--- error_log eval +["success to invoke coraza_process_request_headers"]