Saturday, May 09, 2026 AM03:21:24 HKT

2026-05-09 03:21:32 +08:00
commit 41f17b127c
884 changed files with 263824 additions and 0 deletions
@@ -0,0 +1,87 @@
+name: "CI Unit Tests & Efficacy"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - 'naxsi_src/**'
+      - 'unit-tests/**'
+      - 'distros/**'
+
+# Automatically cancel any previous workflow on new push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  build-sys:
+    strategy:
+      fail-fast: false
+      matrix:
+        container:
+          - fedora:37
+          - fedora:38
+          - fedora:39
+    name: libinjection-system ${{ matrix.container }}
+    runs-on: ubuntu-latest
+    container: ${{ matrix.container }}
+    steps:
+      - name: Checkout repository without submodule
+        uses: actions/checkout@v4
+      - name: Install system libinjection
+        run: |
+          sudo dnf -y install libinjection \
+                              libinjection-devel \
+                              pcre2-devel pcre2 \
+                              zlib-devel zlib \
+                              make automake gcc \
+                              wget openssl
+      - name: Build
+        run: /bin/bash .scripts/ci-build.sh "1.25.1"
+
+
+  build-test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        nginx:
+          - 1.27.0
+          - 1.26.1
+          - 1.25.1
+          - 1.24.0
+          - 1.23.4
+          - 1.22.0
+          - 1.21.5
+          - 1.20.2
+          - 1.18.0
+          - 1.16.1
+          - 1.14.2
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          persist-credentials: false
+      - name: Build
+        run: /bin/bash .scripts/ci-build.sh "${{ matrix.nginx }}"
+      - name: Unit Tests
+        run: /bin/bash .scripts/ci-test.sh
+
+  build-efficacy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          persist-credentials: false
+      - name: Build
+        run: /bin/bash .scripts/ci-build.sh "1.25.1"
+      - name: Run WAF efficacy tests (core only)
+        run: /bin/bash .scripts/ci-wafefficacy.sh core
+      - name: Run WAF efficacy tests (complete)
+        run: /bin/bash .scripts/ci-wafefficacy.sh complete
@@ -0,0 +1,69 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches:
+      - main
+    paths:
+      - 'naxsi_src/**'
+  schedule:
+    - cron: '42 17 * * 2'
+
+# Automatically cancel any previous workflow on new push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        persist-credentials: false
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: 'cpp'
+        
+    - name: Autobuild
+      run: .scripts/ci-build.sh "1.23.0"
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        output: "reports"
+        upload: false
+
+    - name: Move file to merged.sarif (CodeQL)
+      run: mv reports/*.sarif merged.sarif
+
+    - name: Exclude NGINX source
+      run: |
+        jq 'del(.runs[].results[].locations[] | select(.physicalLocation.artifactLocation.uri | contains("nginx-source/")))' merged.sarif > tmp0.sarif
+        jq 'del(.runs[].results[] | select(.locations | length == 0))' tmp0.sarif > filtered.sarif
+
+    - name: Treat warnings as errors
+      run: |
+        jq '.runs[].tool.driver.rules[] |= . + {"defaultConfiguration": {"level": "error"}}' filtered.sarif > final.sarif
+
+    - name: Upload SARIF file
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: final.sarif
@@ -0,0 +1,282 @@
+name: "CI for distros"
+
+on:
+  push:
+    branches:
+      - main
+      - "dist-*"
+    tags:
+      - v*
+  pull_request:
+    branches:
+      - "dist-*"
+    paths:
+      - 'naxsi_src/**'
+      - 'unit-tests/**'
+      - 'distros/**'
+
+# Automatically cancel any previous workflow on new push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  tarball:
+    runs-on: ubuntu-latest
+    name: "Release Tarball"
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        persist-credentials: false
+    - name: Prepare Release
+      shell: bash
+      run: |
+        if [[ "${{ startsWith(github.event.ref, 'refs/tags')}}" = "true" ]]
+        then
+          RELEASE_ID="${{ github.event.ref }}"
+        else
+          RELEASE_ID="git-`date "+%Y-%m-%d"`-`git rev-parse --short HEAD`"
+        fi
+        RELEASE_ID=${RELEASE_ID##refs/tags/}
+        echo RELEASE_NAME="naxsi-${RELEASE_ID}-src-with-deps-tgz" >> $GITHUB_ENV
+        export TARNAME="naxsi-${RELEASE_ID}-src-with-deps.tar.gz"
+        touch "$TARNAME"
+        rm -rf .git
+        tar --exclude="$TARNAME" -czvf "$TARNAME" .
+    - name: Upload tarball
+      uses: actions/upload-artifact@v3
+      with:
+        name: ${{ env.RELEASE_NAME }}
+        path: ./*.tar.gz
+
+  zip:
+    runs-on: ubuntu-latest
+    name: "Release Zip"
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        persist-credentials: false
+    - name: Prepare Release
+      shell: bash
+      run: |
+        if [[ "${{ startsWith(github.event.ref, 'refs/tags')}}" = "true" ]]
+        then
+          RELEASE_ID="${{ github.event.ref }}"
+        else
+          RELEASE_ID="git-`date "+%Y-%m-%d"`-`git rev-parse --short HEAD`"
+        fi
+        RELEASE_ID=${RELEASE_ID##refs/tags/}
+        echo RELEASE_NAME="naxsi-${RELEASE_ID}-src-with-deps-zip" >> $GITHUB_ENV
+        rm -rf .git
+    - name: Upload zip
+      uses: actions/upload-artifact@v3
+      with:
+        name: ${{ env.RELEASE_NAME }}
+        path: ./*
+
+  packages:
+    runs-on: ubuntu-latest
+    name: ${{ matrix.name }}
+    container: ${{ matrix.container }}
+    strategy:
+      fail-fast: false
+      matrix:
+        name:
+          [
+            "arch-linux",
+            "debian-buster",
+            "debian-bullseye",
+            "debian-bookworm",
+            "ubuntu-focal",
+            "ubuntu-jammy",
+            "alpine-3.17.4",
+            "alpine-3.18.2",
+          ]
+        include:
+          - name: arch-linux
+            container: archlinux:latest
+            package: arch
+          - name: debian-buster
+            container: debian:buster
+            package: deb
+            pcredep: libpcre3-dev
+            nginxdep: nginx-common
+          - name: debian-bullseye
+            container: debian:bullseye
+            package: deb
+            pcredep: libpcre3-dev
+            nginxdep: nginx-common
+          - name: debian-bookworm
+            container: debian:bookworm-slim
+            package: deb
+            pcredep: libpcre2-dev
+            nginxdep: nginx
+          - name: ubuntu-focal
+            container: ubuntu:focal
+            package: deb
+            pcredep: libpcre3-dev
+            nginxdep: nginx-common
+          - name: ubuntu-jammy
+            container: ubuntu:jammy
+            package: deb
+            pcredep: libpcre3-dev
+            nginxdep: nginx-common
+          - name: alpine-3.17.4
+            container: alpine:3.17.4
+            package: apk
+          - name: alpine-3.18.2
+            container: alpine:3.18.2
+            package: apk
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # APK package
+    - name: Install required dependencies
+      if: matrix.package == 'apk'
+      run: apk add alpine-sdk doas
+    - name: Checkout needed repos
+      if: matrix.package == 'apk'
+      run: |
+        rm -rf naxsi_src/libinjection
+        git clone https://github.com/libinjection/libinjection.git naxsi_src/libinjection
+        git -C naxsi_src/libinjection checkout b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9
+        chmod 777 .
+    - name: ${{ matrix.name }} package
+      if: matrix.package == 'apk'
+      run:  sh ./distros/alpine/build-ci.sh
+    - name: Test apk package
+      if: matrix.package == 'apk'
+      run: |
+        apk add --no-cache nginx
+        apk add --allow-untrusted build/*.apk
+    - name: Upload apk package
+      if: matrix.package == 'apk'
+      uses: actions/upload-artifact@v3
+      with:
+        name: ${{ matrix.name }}
+        path: build/*.apk
+
+    # DEB package
+    - name: Update OS & Install deps
+      if: matrix.package == 'deb'
+      run: |
+        if [ -f "/etc/apt/sources.list" ]; then
+          cat /etc/apt/sources.list > /tmp/sources.list.orig
+          cat /tmp/sources.list.orig | grep -v "#" | sed 's/^deb /deb-src /g' >> /etc/apt/sources.list
+        fi
+        apt-get -qqy update
+        DEBIAN_FRONTEND=noninteractive apt-get -qqy --no-install-recommends install \
+            build-essential \
+            ca-certificates \
+            dpkg-dev \
+            gzip \
+            git \
+            libgd-dev \
+            libgeoip-dev \
+            ${{ matrix.pcredep }} \
+            libperl-dev \
+            libssl-dev \
+            libxslt1-dev \
+            nginx \
+            tar \
+            wget \
+            zlib1g-dev
+        if [ -f "/etc/apt/sources.list.d/debian.sources" ]; then
+          # bookworm only.
+          echo "deb https://ftp.debian.org/debian/ bookworm contrib main non-free non-free-firmware" >> /etc/apt/sources.list.d/nginx.list
+          echo "deb-src https://ftp.debian.org/debian/ bookworm contrib main non-free non-free-firmware" >> /etc/apt/sources.list.d/nginx.list
+          apt-get -qqy update
+          DEBIAN_FRONTEND=noninteractive apt-get -qqy --no-install-recommends install \
+            libperl-dev
+        fi
+    - name: Checkout needed repos
+      if: matrix.package == 'deb'
+      run: |
+        rm -rf naxsi_src/libinjection
+        git clone https://github.com/libinjection/libinjection.git naxsi_src/libinjection
+        git -C naxsi_src/libinjection checkout b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9
+        git clone --depth=1 https://github.com/wargio/deb-creator.git
+        chmod 777 .
+        apt-get source nginx
+    - name: ${{ matrix.name }} package
+      if: matrix.package == 'deb'
+      run: |
+        mkdir -p deb_pkg/
+        DEB_PKG=$(realpath deb_pkg)
+        NGINX_PACKAGE="${{ matrix.nginxdep }}"
+        NAXSI_VERSION=$(grep "NAXSI_VERSION" naxsi_src/naxsi_const.h | cut -d ' ' -f3 | sed 's/"//g')
+        LIBPCRE_PACKAGE="${{ matrix.pcredep }}"
+        LIBPCRE_VERSION=$(dpkg -s ${{ matrix.pcredep }} | grep '^Version:' | cut -d ' ' -f2 | cut -d '-' -f1)
+        NGINX_VERSION=$(dpkg -s nginx | grep '^Version:' | cut -d ' ' -f2 | cut -d '-' -f1)
+        NGINX_BUILD_OPTS=$(nginx -V 2>&1 | grep "configure arguments:" | cut -d ":" -f2- | sed -e "s#/build/nginx-[A-Za-z0-9]*/#./#g" | sed 's/--add-dynamic-module=[A-Za-z0-9\/\._-]*//g')
+        echo "NGINX_VERSION:    $NGINX_VERSION"
+        echo "NGINX_BUILD_OPTS: $NGINX_BUILD_OPTS"
+        # build module
+        cd nginx-$NGINX_VERSION
+        CMDLINE=$(echo ./configure $NGINX_BUILD_OPTS --add-dynamic-module=../naxsi_src/)
+        eval $CMDLINE
+        make modules
+        cd ..
+        # install files
+        mkdir -p "$DEB_PKG/data/usr/lib/nginx/modules/"
+        mkdir -p "$DEB_PKG/data/usr/share/nginx/modules-available/"
+        mkdir -p "$DEB_PKG/data/usr/share/naxsi/whitelists"
+        mkdir -p "$DEB_PKG/data/usr/share/naxsi/blocking"
+        install -Dm755 distros/deb/postinstall.script "$DEB_PKG/postinstall.script"
+        install -Dm755 distros/deb/postremove.script "$DEB_PKG/postremove.script"
+        install -Dm755 distros/deb/preremove.script "$DEB_PKG/preremove.script"
+        install -Dm644 distros/deb/control.install "$DEB_PKG/control.install"
+        install -Dm755 "nginx-$NGINX_VERSION/objs/ngx_http_naxsi_module.so" "$DEB_PKG/data/usr/lib/nginx/modules/ngx_http_naxsi_module.so"
+        install -Dm644 distros/deb/mod-http-naxsi.conf "$DEB_PKG/data/usr/share/nginx/modules-available/mod-http-naxsi.conf"
+        install -Dm644 distros/nginx/naxsi_block_mode.conf "$DEB_PKG/data/usr/share/naxsi/naxsi_block_mode.conf"
+        install -Dm644 distros/nginx/naxsi_denied_url.conf "$DEB_PKG/data/usr/share/naxsi/naxsi_denied_url.conf"
+        install -Dm644 distros/nginx/naxsi_learning_mode.conf "$DEB_PKG/data/usr/share/naxsi/naxsi_learning_mode.conf"
+        install -Dm644 naxsi_rules/naxsi_core.rules "$DEB_PKG/data/usr/share/naxsi/naxsi_core.rules"
+        install -Dm644 naxsi_rules/whitelists/*.rules "$DEB_PKG/data/usr/share/naxsi/whitelists"
+        install -Dm644 naxsi_rules/blocking/*.rules "$DEB_PKG/data/usr/share/naxsi/blocking"
+        # add deb details.
+        sed -i "s/@NGINX_PACKAGE@/$NGINX_PACKAGE/" "$DEB_PKG/control.install"
+        sed -i "s/@NGINX_VERSION@/$NGINX_VERSION/" "$DEB_PKG/control.install"
+        sed -i "s/@LIBPCRE_PACKAGE@/$LIBPCRE_PACKAGE/" "$DEB_PKG/control.install"
+        sed -i "s/@LIBPCRE_VERSION@/$LIBPCRE_VERSION/" "$DEB_PKG/control.install"
+        sed -i "s/@NAXSI_VERSION@/$NAXSI_VERSION/" "$DEB_PKG/control.install"
+        # build deb file
+        ./deb-creator/deb-creator "$DEB_PKG"
+    - name: Test deb package
+      if: matrix.package == 'deb'
+      run: dpkg -i deb_pkg/*.deb
+    - name: Upload deb package
+      if: matrix.package == 'deb'
+      uses: actions/upload-artifact@v3
+      with:
+        name: ${{ matrix.name }}
+        path: deb_pkg/*.deb
+
+    # Arch Linux package
+    - name: ${{ matrix.name }} package
+      if: matrix.package == 'arch'
+      run: |
+        pacman -Syy --needed --noconfirm sudo base-devel git perl-rename
+        chmod 777 distros/arch
+        useradd build-user -m
+        passwd -d build-user
+        printf 'build-user ALL=(ALL) ALL\n' | tee -a /etc/sudoers
+        cd distros/arch
+        sudo -u build-user makepkg -s --noconfirm
+        # Fix package name due github name restrictions
+        perl-rename -v 's/:/-/g' *.pkg.tar.zst
+    - name: Test arch package
+      if: matrix.package == 'arch'
+      run: pacman -U --noconfirm distros/arch/*.pkg.tar.zst
+    - name: Upload arch package
+      if: matrix.package == 'arch'
+      uses: actions/upload-artifact@v3
+      with:
+        name: ${{ matrix.name }}
+        path: distros/arch/*.pkg.tar.zst
@@ -0,0 +1,69 @@
+name: "Linters"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+# Automatically cancel any previous workflow on new push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  no-debug:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Check debug logs are disabled
+      run: /bin/bash .scripts/ci-debug-check.sh
+
+  distro-ci-check:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        persist-credentials: false
+    - name: Check if the distro info are updated
+      run: /bin/bash .scripts/ci-distro-check.sh
+
+  licenses:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Reuse Compliance Check
+      uses: fsfe/reuse-action@v5
+      with:
+        args: --suppress-deprecation lint
+
+
+  formatting:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Install wget, software-properties-common, lsb-release (dependencies of LLVM install script)
+      run: sudo apt --assume-yes install wget software-properties-common lsb-release
+    - name: Install automatic LLVM 16
+      run: wget https://apt.llvm.org/llvm.sh -O /tmp/llvm-install.sh; chmod +x /tmp/llvm-install.sh; sudo /tmp/llvm-install.sh 16
+    - name: Install clang-format-16
+      run: sudo apt --assume-yes install clang-format-16
+    - name: Format check
+      run: find naxsi_src/ -type f -name "*.c" -o -name "*.h" | grep -v "libinjection" | xargs -I % clang-format --verbose --Werror --dry-run %
+
+  rules:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Install python3
+      run: sudo apt --assume-yes install python3
+    - name: Format check rules
+      run: |
+        bash .scripts/ci-rules-linter.sh naxsi_rules/blocking
+        bash .scripts/ci-rules-linter.sh naxsi_rules/whitelists
@@ -0,0 +1,41 @@
+name: "Windows CI Unit Tests"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - 'naxsi_src/**'
+      - 'unit-tests/**'
+      - 'distros/**'
+
+# Automatically cancel any previous workflow on new push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  build-test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest]
+        nginx:
+          - 1.24.0
+          - 1.23.2
+          - 1.22.1
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: cmd
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+        persist-credentials: false
+    - name: Windows build
+      run: .scripts\ci-windows-build.bat ${{ matrix.nginx }}
+    - name: Unit Tests
+      run: .scripts\ci-windows-test.bat