Page not found :(
The page you are looking for doesn't exist or has been moved.
From fc091497009ae38565419f694f853b0eb1da2a0a Mon Sep 17 00:00:00 2001
From: fzipi The page you are looking for doesn't exist or has been moved. The page you are looking for doesn't exist or has been moved.Page not found :(
Page not found :(
Caddy
You can find me fzipi @ github!
You can find me fzipi @ github!
The Coraza contributors.
The Coraza contributors.
Hi, I'm Juan Pablo Tosso, OWASP #Coraza project co-leader - Research Engineer at @traceableai, Proud Father and Open-Source Developer.
Machine specs: Apple M1 Pro (10 cores, 16 GB RAM)
Values are requests analyzed per second. The higher the value, the better results.
Test | Coraza v2 | Coraza v3 | Modsecurity |
---|---|---|---|
Simple JSON Request | 639 | 903 | 1011 |
Giant JSON Request | 603 | 908 | 847 |
Multipart Request | 606 | 817 | 976 |
Giant Multipart Request | 573 | 781 | 958 |
Simple GET Request | 654 | 955 | 1135 |
Simple URLENCODED Request | 624 | 892 | 842 |
Giant URLENCODED Request | 632 | 871 | 840 |
Test Versions:
# compile modsecurity: https://github.com/SpiderLabs/ModSecurity/wiki/Compilation-recipes-for-v3.x
+Tests description #
- Tests are performed using OWASP Core Ruleset v4 and go benchmarks.
- The benchmark tool supports coraza v2, v3 and modsecurity.
- Modsecurity is executed using CGO.
- There are currently 4 test-cases and 7 variations:
- JSON request: 1kb and 100kb payload
- URLENCODED request: 1kb and 100kb payload
- Multipart file upload: 1kb and 100kb payload
- GET request: no body
Results #
Machine specs: Apple M1 Pro (10 cores, 16 GB RAM)
Values are requests analyzed per second. The higher the value, the better results.
Test Coraza v2 Coraza v3 Modsecurity Simple JSON Request 639 903 1011 Giant JSON Request 603 908 847 Multipart Request 606 817 976 Giant Multipart Request 573 781 958 Simple GET Request 654 955 1135 Simple URLENCODED Request 624 892 842 Giant URLENCODED Request 632 871 840
Test Versions:
- Coraza v3: v3.0.0-dev (no tag)
- Coraza v2: v2.0.1
- Modsecurity v3: v3.0.7
Run your own benchmarks #
Using golang #
# compile modsecurity: https://github.com/SpiderLabs/ModSecurity/wiki/Compilation-recipes-for-v3.x
git clone https://github.com/jptosso/coraza-benchmark
cd coraza-benchmark
go test -bench=. ./...
Using Docker #
docker run jptosso/coraza-benchmark:latest
BodyBuffer is used to effectively handle large bodies. Coraza has to buffer the body in order to make reliable blocking possible. Future versions might implement a more efficient solution.
BodyBuffer.Reader
is a io.Reader
that reads from either a memory buffer or a file. Using files is disabled for tinygo.
Important: Copying a Reader to BodyBuffer will most likely flush the original reader. In most cases you will have to keep two copies of the reader, one for coraza, and one for your application. You can simply replace your reader pointer with the BodyBuffer reader pointer.
Body processors are designed to handle requests and responses in the same context. Most processors can handle either a request or a response, but there are cases of body processors like JSON, that can handle request and response in different context. Request-Response correlation is the responsibility of the processor, and the current use-case is GraphQL.
Body Processor | Request | Response | Correlation | Tinygo support |
---|---|---|---|---|
URLEncoded | Yes | No | No | Yes |
XML (Partial Support) | Yes | Yes | No | No |
Multipart | Yes | No | No | Yes |
JSON | Yes | Yes | No | Yes |
GraphQL | TBD | TBD | Yes | TBD |
BodyBuffer is used to effectively handle large bodies. Coraza has to buffer the body in order to make reliable blocking possible. Future versions might implement a more efficient solution.
BodyBuffer.Reader
is a io.Reader
that reads from either a memory buffer or a file. Using files is disabled for tinygo.
Important: Copying a Reader to BodyBuffer will most likely flush the original reader. In most cases you will have to keep two copies of the reader, one for coraza, and one for your application. You can simply replace your reader pointer with the BodyBuffer reader pointer.
Body processors are designed to handle requests and responses in the same context. Most processors can handle either a request or a response, but there are cases of body processors like JSON, that can handle request and response in different context. Request-Response correlation is the responsibility of the processor, and the current use-case is GraphQL.
Body Processor | Request | Response | Correlation | Tinygo support |
---|---|---|---|---|
URLEncoded | Yes | No | No | Yes |
XML (Partial Support) | Yes | Yes | No | No |
Multipart | Yes | No | No | Yes |
JSON | Yes | Yes | No | Yes |
GraphQL | TBD | TBD | Yes | TBD |
Variables are compiled in runtime in order to support Regex(precompiled) and XML, the function tx.GetField(variable)
. Using RuleVariable.Exceptions and []exceptions might seem redundant but both are different, the list of exception is complemented from the rule. In case of Regex, GetField
will use RuleVariable.Regex
to match data instead of RuleVariable.Key
.
Note: Collections are not concurrent-safe, don’t share transactions between routines.
Phases are used by RuleGroup
to filter between execution phases on HTTP/1.1 and HTTP/1.0.
Phase 1: Request Headers
This phase process theorically consists in three phases:
tx.ProcessConnection()
): Request address and porttx.ProcessURI()
): Request URL, does not include GET argumentstx.ProcessRequestHeaders()
) Will evaluate phase 1Phase 2: Request Body
This phase only runs when RequestBodyAcces
is On
, otherwise we will skip to phase 3. This phase will do one of the following:
RequestBodyLimitAction
is set to Reject
URLENCODED
: set POST arguments and request_BodyMULTIPART
: Parse files and set FILES variablesJSON
: Not implemented yetForceRequestBodyVariable
is set to true, URLENCODED will be forcedSee Body Handling for more info.
Phase 3: Response Headers
Phase 4: Response Body
Phase 5: Logging
This is a special phase, it will always run but it must be handled by the client. For example, if there is any error reported by Coraza, the client must at least implement a defer tx.ProcessLogging()
. This phase will close handlers, save persistent collections and write audit loggers, in order to write the audit loggers the following conditions must be met:
auditlog
actionSecAuditLog
)AuditEngine
must be On
or RelevantOnly
AuditEngine
was set to RelevantOnly
the response status must match AuditLogRelevantStatus
BodyBuffer is a struct that will manage the request or response buffer and store the data to temprary files if required. BodyBuffer will apply a few rules to decide whether to buffer the data in memory or write a temporary file, it will also return a Reader
to the memory buffer or the temporary file created. Temporary files must be deleted by tx.ProccessLoging
.
Not working yet.
tx.ProcessRequest(req)
helper #Coraza WAF is just a library but we support many integrations to deploy a WAF as an application server, reverse proxy, container, and more.
Expect interesting features and improvements within our community-driven roadmap, for small developers and big companies.
Continuous development, high performance and great documentation are the recipe for a perfect enterprise open -source project.