[]()
Welcome to OWASP Coraza Web Application Firewall, OWASP Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset.
## Prerequisites
* Linux distribution (Debian and Centos are recommended, Windows is not supported yet)
* Golang [compiler]( “compiler” ) v1.16+
## Migrate from v1
* Rollback SecAuditLog to the legacy syntax (serial/concurrent)
* Attach an error log handler using `waf.SetErrorLogCb(cb)` (optional)
* the function Transaction.Clean() must be used to clear transaction data, files and take them back to the sync pool.
* If you are using @rx with libpcre (CRS) install the plugin [github.com/jptosso/coraza-pcre]( “github.com/jptosso/coraza-pcre” )
* If you are using low level APIs check the complete changelog as most of them were removed.
## Running the tests
Run the go tests:
go test ./…
go test -race ./…
Using pre-commit
pip install pre-commit
pre-commit run –all-files
You can also install the pre-commit git hook by running
pre-commit install
## Coraza v2 differences with v1
* Full internal API refactor, public API has not changed
* Full audit engine refactor with plugins support
* New enhanced plugins interface for transformations, actions, body processors, and operators
* We are fully compliant with Seclang from modsecurity v2
* Many features removed and transformed into plugins: XML (Mostly), GeoIP and PCRE regex
* Better debug logging
* New error logging (like modsecurity)
* Better performance
## Your first Coraza WAF project
package main
import(
“fmt”
“github.com/corazawaf/coraza/v2”
“github.com/corazawaf/coraza/v2/seclang”
)
func main() {
// First we initialize our waf and our seclang parser
waf := coraza.NewWaf()
parser, _ := seclang.NewParser(waf)
// Now we parse our rules
if err := parser.FromString(`SecRule REMOTE_ADDR “@rx .*” “id:1,phase:1,deny,status:403″`); err != nil {
fmt.Println(err)
}
// Then we create a transaction and assign some variables
tx := waf.NewTransaction()
defer func(){
tx.ProcessLogging()
tx.Clean()
}()
tx.ProcessConnection(“127.0.0.1”, 8080, “127.0.0.1”, 12345)
// Finally we process the request headers phase, which may return an interruption
if it := tx.ProcessRequestHeaders(); it != nil {
fmt.Printf(“Transaction was interrupted with status %dn”, it.Status)
}
}
## Why Coraza WAF?
### Philosophy
* **Simplicity:** Anyone should be able to understand and modify Coraza WAF’s source code
* **Extensibility:** It should be easy to extend Coraza WAF with new functionalities
* **Innovation:** Coraza WAF isn’t just a [ModSecurity]( “ModSecurity” ) port. It must include awesome new functions (in the meantime, it’s just a port
?
)
* **Community:** Coraza WAF is a community project, and all ideas will be considered
### Roadmap
* New rule language
* GraphQL body processor
* C exports
* WASM scripts support
## Coraza WAF implementations
* [Caddy Plugin (Reverse Proxy and Web Server)]( “Caddy Plugin (Reverse Proxy and Web Server)” ) (Stable)
* [Traefik Plugin (Reverse Proxy and Web Server)]( “Traefik Plugin (Reverse Proxy and Web Server)” ) (preview)
* [Gin ]( “Gin” )[Middleware]( “Middleware” ) (Web Framework) (Preview)
* [Buffalo Plugin (Web Framework)]( “Buffalo Plugin (Web Framework)” ) (soon)
* [Coraza Server (HAPROXY, REST and GRPC)]( “Coraza Server (HAPROXY, REST and GRPC)” ) (experimental)
* [Apache httpd]( “Apache httpd” ) (experimental)
* [Nginx]( “Nginx” ) (soon)
* [Coraza C Exports]( “Coraza C Exports” ) (experimental)
## Some useful tools
* [Go FTW]( “Go FTW” ): rule testing engine
* [Coraza Playground]( “Coraza Playground” ): rule testing sandbox with web interface
* [OWASP Core Ruleset]( “OWASP Core Ruleset” ): Awesome rule set, compatible with Coraza
## Troubleshooting
**Dependency issues**:
go get: github.com/jptosso/coraza-waf/[email protected]: parsing go.mod:
module declares its path as: github.com/corazawaf/coraza/v2
but was required as: github.com/jptosso/coraza-waf/v2
Coraza was migrated from github.com/jptosso/coraza-waf to github.com/corazawaf/coraza. Most dependencies has already been updated to use the new repo, but you must make sure they all use v2.0.0-rc.3+. You may use the following command to fix the error:
go get -u github.com/corazawaf/coraza/[email protected]
## How to contribute
Contributions are welcome. There are many TODOs, functionalities, fixes, bug reports, and any help you can provide. Just send your PR.
cd /path/to/coraza
egrep -Rin “TODO|FIXME” -R –exclude-dir=vendor *
## Special thanks
* Modsecurity team for creating ModSecurity
* OWASP Coreruleset team for the CRS and their help
### Companies using Coraza
* [Babiel]( “Babiel” ) (supporter)
### Author on Twitter
* [@jptosso]( “@jptosso” )
## Donations
For donations, see [Donations site]( “Donations site” )
**[Download Coraza]( “Download Coraza” )**Read More