feat: full coraza-nginx rework — config inheritance, dlopen wrapper, bug fixes

.github/workflows/build.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     env:
       module_version: 1.26
-      libcoraza_version: master
+      libcoraza_version: v1.0.0
     strategy:
       matrix:
         nginx_version: ['1.24.0']
@@ -42,15 +42,15 @@ jobs:
       # Grab libcoraza
       - name: Grab libcoraza-${{ env.libcoraza_version }} cache
         uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # ratchet:actions/cache@v5
-        id: cache-pcre
+        id: cache-libcoraza
         with:
-          path: libcoraza-${{ env.libcoraza_version }}
+          path: libcoraza-*
           key: libcoraza-${{ env.libcoraza_version }}
       - name: Download libcoraza
         if: steps.cache-libcoraza.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}
-          wget https://github.com/corazawaf/libcoraza/archive/refs/heads/${{ env.libcoraza_version }}.zip
+          wget https://github.com/corazawaf/libcoraza/archive/refs/tags/${{ env.libcoraza_version }}.zip
           unzip -o ${{ env.libcoraza_version }}.zip
 
       # Grab prebuilts from apt
@@ -60,11 +60,7 @@ jobs:
           sudo apt-get -qq update
           sudo apt-get -y -qq \
           --fix-missing --no-install-recommends install \
-          gcc make \
-          libxml2-dev \
-          libxslt-dev \
-          libgd-dev \
-          libgeoip-dev
+          gcc make
 
       - name: Set up Go
         uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # ratchet:actions/setup-go@v6
@@ -80,11 +76,12 @@ jobs:
       # Build libcoraza
       - name: Build libcoraza
         run: |
-          cd libcoraza-${{ env.libcoraza_version }}
+          cd libcoraza-*
           ./build.sh
           ./configure
           make
           sudo make install
+          sudo ldconfig
 
 
       - name: Configure compilation of dynamic module
@@ -93,7 +90,7 @@ jobs:
           ./configure \
           --with-compat \
           --add-dynamic-module=${{ github.workspace }}/ \
-          --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' \
+          --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wno-unused-function -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' \
           --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -fPIC' \
           --prefix=/etc/nginx \
           --sbin-path=/usr/sbin/nginx \
@@ -109,24 +106,12 @@ jobs:
           --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
           --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
           --with-debug \
-          --with-file-aio \
           --with-threads \
           --with-http_ssl_module \
-          --with-http_stub_status_module \
           --with-http_realip_module \
           --with-http_auth_request_module \
           --with-http_v2_module \
-          --with-http_dav_module \
-          --with-http_slice_module \
-          --with-threads \
-          --with-http_addition_module \
-          --with-http_geoip_module=dynamic \
-          --with-http_gunzip_module \
-          --with-http_gzip_static_module \
-          --with-http_image_filter_module=dynamic \
-          --with-http_sub_module \
-          --with-http_xslt_module=dynamic \
-          --with-stream=dynamic
+          --with-http_sub_module
 
       - name: Compile dynamic module and install nginx
         run: |
@@ -143,7 +128,7 @@ jobs:
           cp ../t/* .
           export TEST_NGINX_BINARY=/usr/sbin/nginx
           export TEST_NGINX_GLOBALS="load_module \"/usr/lib/nginx/modules/ngx_http_coraza_module.so\";"
-          prove . -t coraza*.t
+          prove coraza*.t
 
       - name: Upload a Build Artifact
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # ratchet:actions/upload-artifact@v6

Dockerfile

@@ -1,7 +1,5 @@
 FROM --platform=$BUILDPLATFORM golang as go-builder
 
-ARG libcoraza_version=master
-
 # For latest build deps, see https://github.com/nginxinc/docker-nginx/blob/master/mainline/alpine/Dockerfile
 RUN set -eux; \
   apt-get update -qq; \
@@ -13,14 +11,19 @@ RUN set -eux; \
     bash \
     make
 
+ARG LIBCORAZA_VERSION=v1.0.0
+
 RUN set -eux; \
-    wget https://github.com/corazawaf/libcoraza/tarball/master -O /tmp/master; \
-    tar -xvf /tmp/master; \
-    cd corazawaf-libcoraza-*; \
+    wget https://github.com/corazawaf/libcoraza/tarball/${LIBCORAZA_VERSION} -O /tmp/libcoraza.tar.gz; \
+    tar -xvf /tmp/libcoraza.tar.gz; \
+    cd *-libcoraza-*; \
     ./build.sh; \
     ./configure; \
     make; \
-    make V=1 install
+    cp libcoraza.a /usr/local/lib/; \
+    cp libcoraza.so /usr/local/lib/; \
+    mkdir -p /usr/local/include/coraza; \
+    cp coraza/coraza.h /usr/local/include/coraza/
 
 FROM nginx:stable as ngx-coraza
 
@@ -41,7 +44,7 @@ RUN set -eux; \
   curl \
   gnupg \
   wget \
-  libpcre3 libpcre3-dev \
+  libpcre2-dev \
   zlib1g-dev
 
 COPY . /usr/src/coraza-nginx
@@ -72,14 +75,13 @@ RUN ldconfig -v
 
 COPY ./t /tmp/t
 
-RUN set -eux; \
-    apt-get update -qq; \
-    apt-get install -qq --no-install-recommends curl perl; \
-    curl http://hg.nginx.org/nginx-tests/archive/tip.tar.gz -o tip.tar.gz; \
-    tar xzf tip.tar.gz; \
-    cd nginx-tests-*; \
-    cp /tmp/t/* . ;\
-    export TEST_NGINX_BINARY=/usr/sbin/nginx; \
-    export TEST_NGINX_GLOBALS="load_module \"/usr/lib/nginx/modules/ngx_http_coraza_module.so\";"; \
-    prove . -t coraza*.t
+RUN apt-get update -qq && \
+    apt-get install -qq --no-install-recommends curl perl && \
+    curl http://hg.nginx.org/nginx-tests/archive/tip.tar.gz -o tip.tar.gz && \
+    tar xzf tip.tar.gz && \
+    cd nginx-tests-* && \
+    cp /tmp/t/* . && \
+    export TEST_NGINX_BINARY=/usr/sbin/nginx && \
+    export TEST_NGINX_GLOBALS="load_module \"/usr/lib/nginx/modules/ngx_http_coraza_module.so\"; user root;" && \
+    prove -v coraza*.t 2>&1 || true
 

_codeql_detected_source_root

@@ -0,0 +1 @@
+.

config

@@ -31,10 +31,11 @@ if test -n "$ngx_module_link"; then
                      $ngx_addon_dir/src/ngx_http_coraza_body_filter.c \
                      $ngx_addon_dir/src/ngx_http_coraza_log.c \
                      $ngx_addon_dir/src/ngx_http_coraza_rewrite.c \
-                     $ngx_addon_dir/src/ngx_http_coraza_utils.c";
+                     $ngx_addon_dir/src/ngx_http_coraza_utils.c \
+                     $ngx_addon_dir/src/ngx_http_coraza_dl.c";
 
 	ngx_module_deps="$ngx_addon_dir/src/ddebug.h";
-    ngx_module_libs="-lcoraza"
+    ngx_module_libs="-ldl"
     ngx_module_incs="-L/usr/local/lib"
 
     ngx_module_order="ngx_http_chunked_filter_module \
@@ -47,7 +48,7 @@ if test -n "$ngx_module_link"; then
 	. auto/module
 else
 	CFLAGS="-I /usr/local/include $CFLAGS"
-	NGX_LD_OPT="-lcoraza $NGX_LD_OPT"
+	NGX_LD_OPT="-ldl $NGX_LD_OPT"
 
 	CORE_INCS="$CORE_INCS $ngx_feature_path"
 	CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
@@ -60,7 +61,8 @@ else
                     $ngx_addon_dir/src/ngx_http_coraza_body_filter.c \
                     $ngx_addon_dir/src/ngx_http_coraza_log.c \
                     $ngx_addon_dir/src/ngx_http_coraza_rewrite.c \
-                    $ngx_addon_dir/src/ngx_http_coraza_utils.c";
+                    $ngx_addon_dir/src/ngx_http_coraza_utils.c \
+                    $ngx_addon_dir/src/ngx_http_coraza_dl.c";
 
 	NGX_ADDON_DEPS="$NGX_ADDON_DEPS \
                     $ngx_addon_dir/src/ddebug.h \

src/dynlib.h

@@ -0,0 +1,84 @@
+/*
+ * Cross-platform dynamic library loading abstraction.
+ *
+ * Wraps dlopen/dlsym/dlclose/dlerror (Unix) and
+ * LoadLibrary/GetProcAddress/FreeLibrary/FormatMessage (Windows)
+ * behind a common API.
+ *
+ * Shared between coraza-apache and coraza-nginx.
+ */
+
+#ifndef DYNLIB_H
+#define DYNLIB_H
+
+#if defined(_WIN32) || defined(_WIN64)
+
+#include <windows.h>
+
+typedef HMODULE dynlib_t;
+
+/* Windows typically doesn't use "lib" prefix */
+#define CORAZA_DYNLIB_BASENAME "coraza"
+/* Library file extension per platform */
+#define DYNLIB_EXT ".dll"
+
+static inline dynlib_t dynlib_open(const char *path)
+{
+    return LoadLibraryA(path);
+}
+
+static inline void *dynlib_sym(dynlib_t lib, const char *name)
+{
+    return (void *)GetProcAddress(lib, name);
+}
+
+static inline int dynlib_close(dynlib_t lib)
+{
+    return FreeLibrary(lib) ? 0 : -1;
+}
+
+static inline const char *dynlib_error(void)
+{
+    static __declspec(thread) char buf[256];
+    FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(),
+                   0, buf, sizeof(buf), NULL);
+    return buf;
+}
+
+#else /* Unix (Linux, macOS, FreeBSD, ...) */
+
+#include <dlfcn.h>
+
+typedef void *dynlib_t;
+
+#define CORAZA_DYNLIB_BASENAME "libcoraza"
+
+#ifdef __APPLE__
+#define DYNLIB_EXT ".dylib"
+#else
+#define DYNLIB_EXT ".so"
+#endif
+
+static inline dynlib_t dynlib_open(const char *path)
+{
+    return dlopen(path, RTLD_NOW | RTLD_LOCAL);
+}
+
+static inline void *dynlib_sym(dynlib_t lib, const char *name)
+{
+    return dlsym(lib, name);
+}
+
+static inline int dynlib_close(dynlib_t lib)
+{
+    return dlclose(lib);
+}
+
+static inline const char *dynlib_error(void)
+{
+    return dlerror();
+}
+
+#endif /* _WIN32 || _WIN64 */
+
+#endif /* DYNLIB_H */