coraza-rs

Rust bindings and Envoy dynamic module for coraza.

Crates

• coraza-sys: Raw bindings to coraza using the official libcoraza library (included as a git submodule) generated with bindgen
• coraza-rs: An idiomatic, safe API built on top of coraza-sys
• coraza-dynamic-module: A dynamic module loadable by Envoy

Building

1. Install dependencies (Rust, Golang, and autotools). See the Dockerfile for details.
2. Clone the repository with submodules (required for the official libcoraza dependency):

   git clone --recursive <repository-url>

   If you've already cloned the repository, initialize and update submodules:

   git submodule update --init --recursive

3. Build the release version:

   cargo build --release

   The dynamic module will be created in the Cargo build cache.

Examples

See the examples directory for a minimal working example with test script.

Testing

End-to-End Tests

1. Build the Docker image:

   docker build -t envoy-with-coraza-module:latest .

2. Run the end-to-end tests:

   cd e2e && go test ./...

FTW Tests

FTW (Framework for Testing WAFs) tests validate WAF rule behavior using the OWASP CRS regression test suite.

1. Build the Docker image:

   docker build -t envoy-with-coraza-module:latest .

2. Run FTW tests:

   cd ftw
   docker compose build --pull
   docker compose run --rm ftw

The CRS rules are embedded in Coraza via rootfs, so no manual rule setup is required.