feat: full coraza-nginx rework — config inheritance, dlopen wrapper, bug fixes by ppomes · Pull Request #5 · corazawaf/coraza-nginx

ppomes · 2026-02-20T23:01:18Z

Summary

This supersedes PR #3 (Felipe's initial "make it compile" work) and adds:

Config inheritance: locations without their own rules now inherit from the parent config
Delayed header forwarding: response headers held back until body inspection completes, so the module can return proper 403 pages instead of aborting mid-stream
Go runtime deadlock fix (dlopen wrapper): libcoraza is a Go shared library — when nginx forks workers, Go's runtime threads are lost and workers deadlock. Fix: load libcoraza.so via dlopen() in each worker after fork so Go's runtime starts fresh. Rules are collected as strings during config parsing, then replayed in each worker. The wrapper is transparent, no changes in request-processing files. This is a fundamental issue that will affect any forking server using libcoraza (apache too).
Bug fixes: memory leaks in intervention processing, double-free on cleanup, transaction ID in logs
Tests: 13 test files updated for compatibility

Dependencies

@fzipi

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

…ouble-free Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Fix review comments: return types, null checks, and double-free vulnerability

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

feat: coraza-nginx with working tests

- Add log action to phase:1 rules so audit log H section is populated - Fix regex to match Coraza format "Access denied" instead of ModSecurity format - Remove TODO wrappers from now-passing tests (rules merge, auditLogParts, custom error page) - Mark response body test as intermittent

Delay forwarding response headers to the client until the body filter has finished Coraza phase 4 processing. This allows phase 4 rules to return proper error pages instead of failing silently after headers were already sent. Also handle file-backed response buffers that arrive before the copy filter converts them to memory.

fix: delay response headers until phase 4 body inspection completes

Copilot

Pull request overview

This PR reworks the coraza-nginx module to support config inheritance and safer phase-4 (response body) enforcement, while also addressing Go shared-library post-fork deadlocks by loading libcoraza.so via dlopen() in each worker.

Changes:

Collect rules during config parsing and replay/build WAF instances per worker in init_process (dlopen wrapper + deferred rule storage).
Delay forwarding response headers until body inspection completes to allow clean denials/custom error pages.
Update tests and build artifacts (Docker/config) to match the new behavior and rule semantics.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
t/coraza.t	Updates phase behavior/expectations (phase-4 now returns real status codes).
t/coraza-transaction-id.t	Adjusts transaction-id tests and removes auditlog portion.
t/coraza-scoring.t	Aligns scoring rules with phase-2 semantics and explicit actions.
t/coraza-response-body.t	Enables mime-type handling and makes response-body rule run in phase 4.
t/coraza-request-body.t	Adds request body processor ctl + updates limits/status expectations.
t/coraza-request-body-h2.t	Mirrors request-body changes for HTTP/2 tests (413 on reject).
t/coraza-proxy.t	Updates proxy tests for changed redirect/block behavior in phase 4.
t/coraza-proxy-h2.t	Mirrors proxy test updates for HTTP/2.
t/coraza-h2.t	Updates HTTP/2 base rules to explicit pass/deny/log semantics.
t/coraza-config.t	Adjusts config tests for explicit `pass` actions.
t/coraza-config-merge.t	Updates merge/inheritance test with requestBodyProcessor ctl.
t/coraza-config-debuglog.t	Updates debuglog assertions to new log formatting.
t/coraza-config-custom-error-page.t	Aligns audit/error-page assertions with updated logging behavior.
t/coraza-config-auditlog.t	Updates auditlog parts expectations and rule actions.
src/ngx_http_coraza_utils.c	Fixes ngx_str → C string conversion API to correctly return allocated output.
src/ngx_http_coraza_rewrite.c	Updates call sites for new `ngx_str_to_char(..., char **, ...)` signature.
src/ngx_http_coraza_pre_access.c	Adds early intervention checks and tracks `intervention_triggered`.
src/ngx_http_coraza_module.c	Implements deferred rule storage, per-worker WAF build, and intervention cleanup/log changes.
src/ngx_http_coraza_header_filter.c	Delays response header forwarding until body filter completes inspection.
src/ngx_http_coraza_dl.c	Adds dlopen/dlsym wrapper layer for libcoraza symbols (worker-safe Go runtime init).
src/ngx_http_coraza_common.h	Adds deferred rule types, ctx buffering fields, and dlopen API declarations.
src/ngx_http_coraza_body_filter.c	Adds file-buffer reading, buffers output until phase-4 completes, and forwards headers after inspection.
config	Switches link flags to `-ldl` and includes the new dlopen wrapper source.
_codeql_detected_source_root	Adds CodeQL source-root marker.
Dockerfile	Updates libcoraza build/install steps and tweaks nginx-tests invocation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/ngx_http_coraza_module.c

src/ngx_http_coraza_body_filter.c

src/ngx_http_coraza_module.c

src/ngx_http_coraza_dl.c

Dockerfile

fzipi · 2026-02-21T12:08:48Z

@ppomes Can you address Copilot's comments?

- Return NULL instead of NGX_CONF_ERROR in create_*_conf callbacks - Add NULL check for ngx_array_push_n in merge_conf - Loop on ngx_read_file to handle short reads

ppomes · 2026-02-21T23:05:49Z

@ppomes Can you address Copilot's comments?

Done!

fzipi

Try this. We can add a pipeline for windows builds afterwards.

src/dynlib.h

src/ngx_http_coraza_dl.c

ppomes · 2026-02-27T12:25:59Z

Hi @fzipi ,

This PR is now using uptream libcozara.

Pierre

fzipi · 2026-02-27T12:37:40Z

Ah, the branch renaming. Maybe you want to add the release instead? Probably as an environment variable so it's easy to update...

ppomes · 2026-02-27T12:49:40Z

Ah, the branch renaming. Maybe you want to add the release instead? Probably as an environment variable so it's easy to update...

Done!

ppomes · 2026-02-27T13:32:26Z

CI is now ok @fzipi

ppomes · 2026-02-27T14:51:57Z

CI is now ok @fzipi

Not yet... 👎

…rning

…used-function to CI

fzipi

I think this is good enough, and we can iterate over it if needed after merge.

Congrats on your hard work @ppomes ❤️ !

fzipi and others added 24 commits January 8, 2026 16:29

chore: update libcoraza api

6e0af0a

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

Initial plan

9458cd2

Fix review comments: return types, debug messages, null checks, and d…

917b0cd

…ouble-free Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Improve typedef comment for coraza_waf_config_t

7455be0

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Improve comment about config ownership model

04c389b

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Final update: all review comments addressed

b82f036

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Merge pull request corazawaf#4 from corazawaf/copilot/sub-pr-3

e855f86

Fix review comments: return types, null checks, and double-free vulnerability

fix: tests

4fd9b30

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

fix: ngx_str_to_char pass pointer by reference

093eec4

fix: Dockerfile prove runs only coraza tests

2f53dc4

fix: Dockerfile test runner

b77a9da

fix: intervention memory leaks

8ae8f72

feat: transaction ID tracking and access denied logging

fcc5551

fix: set intervention_triggered flag consistently

e38a4a7

fix: check body limit intervention before processing rules

95479e4

fix: config inheritance for locations without rules

0c4806c

fix: adapt tests for Coraza compatibility

d24a47c

test: mark unsupported libcoraza features as TODO

83384d8

fix: use ppomes/libcoraza fork with working rules_merge

86063cc

Merge pull request #1 from ppomes/chore/update-latest-libcoraza

774b496

feat: coraza-nginx with working tests

Merge pull request #2 from ppomes/chore/update-latest-libcoraza

6f60f15

fix: delay response headers until phase 4 body inspection completes

fix: dlopen libcoraza after fork to avoid Go runtime deadlock

e3cd8c6

jptosso requested a review from Copilot February 21, 2026 00:52

Copilot AI reviewed Feb 21, 2026

View reviewed changes

fix: address review feedback

eec1d9c

- Return NULL instead of NGX_CONF_ERROR in create_*_conf callbacks - Add NULL check for ngx_array_push_n in merge_conf - Loop on ngx_read_file to handle short reads

ppomes force-pushed the chore/update-latest-libcoraza branch from 698d494 to eec1d9c Compare February 25, 2026 23:17

Add cross-platform dynlib abstraction for dlopen/LoadLibrary

6079ccf

fzipi reviewed Feb 26, 2026

View reviewed changes

src/dynlib.h Outdated Show resolved Hide resolved

src/dynlib.h Show resolved Hide resolved

src/dynlib.h Show resolved Hide resolved

src/ngx_http_coraza_dl.c Outdated Show resolved Hide resolved

src/ngx_http_coraza_dl.c Outdated Show resolved Hide resolved

ppomes added 2 commits February 26, 2026 13:09

Apply review feedback: CORAZA_DYNLIB_BASENAME, Win64 guard

425a3fd

Use official upstream libcoraza

ad91bdb

Pin libcoraza to release v1.0.0

08711d1

fzipi mentioned this pull request Feb 27, 2026

chore: update libcoraza api #3

Closed

ppomes added 2 commits February 27, 2026 08:13

Fix CI: use libcoraza release tag instead of branch

65945f3

Fix CI: only run coraza tests, not all nginx tests

da3d368

ppomes added 3 commits February 27, 2026 10:01

Fix CI: remove unnecessary dynamic modules and deps

3bec425

Fix CI: ldconfig after libcoraza install, suppress unused-function wa…

89f9c94

…rning

Fix double-free in exit_process WAF cleanup, add ldconfig and -Wno-un…

2b09f72

…used-function to CI

fzipi approved these changes Feb 28, 2026

View reviewed changes

fzipi merged commit c0f3b6c into corazawaf:main Feb 28, 2026
1 check passed

fzipi mentioned this pull request Feb 28, 2026

Update README #11

Closed

Copilot AI mentioned this pull request Feb 28, 2026

docs: update README for config merging, platform support, and dlopen loading #12

Merged

Conversation

ppomes commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dependencies

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fzipi commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ppomes commented Feb 21, 2026

Uh oh!

fzipi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ppomes commented Feb 27, 2026

Uh oh!

fzipi commented Feb 27, 2026

Uh oh!

ppomes commented Feb 27, 2026

Uh oh!

ppomes commented Feb 27, 2026

Uh oh!

ppomes commented Feb 27, 2026

Uh oh!

fzipi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ppomes commented Feb 20, 2026 •

edited

Loading

fzipi commented Feb 21, 2026 •

edited

Loading