test: Add support for FTW-tests

.github/workflows/ftw.yaml

@@ -0,0 +1,36 @@
+---
+
+name: FTW Test
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        haproxy-version: [3.0, 2.8]  # 3.1
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Run regression tests (ftw)
+        run: go run mage.go ftw
+        env:
+          FTW_HAPROXY_VERSION: "${{ matrix.haproxy-version }}"
+
+      - uses: actions/upload-artifact@v4
+        if: success() || failure()
+        with:
+          name: ftw-haproxy-spoa-logs
+          path: |
+            build/ftw.log
+            build/ftw-spoa.log
+            build/ftw-haproxy.log

.github/workflows/test.yaml

@@ -24,4 +24,4 @@ jobs:
           haproxy -vv
 
       - name: Test
-        run: go run mage.go test
+        run: go run mage.go test

example/docker-compose.yaml

@@ -19,7 +19,7 @@ services:
   haproxy:
     restart: unless-stopped
     image: haproxy:2.9-alpine
-    ports: [ "8080:80", "8443:443", "8082:8082"]
+    ports: [ "8080:80", "8443:443", "8082:8082" ]
     depends_on:
       - httpbin
     links:

ftw/Dockerfile.coraza_spoa

@@ -0,0 +1,26 @@
+# Copyright 2023 The OWASP Coraza contributors
+# SPDX-License-Identifier: Apache-2.0
+
+FROM golang:1.22 AS build
+
+WORKDIR /go/src/app
+COPY . .
+
+RUN go mod download
+RUN go vet -v ./...
+
+RUN CGO_ENABLED=0 go build -o /go/bin/coraza-spoa
+
+FROM gcr.io/distroless/static-debian12
+
+LABEL org.opencontainers.image.authors="The OWASP Coraza contributors" \
+      org.opencontainers.image.description="OWASP Coraza WAF (Haproxy SPOA)" \
+      org.opencontainers.image.documentation="https://coraza.io/connectors/coraza-spoa/" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.source="https://github.com/corazawaf/coraza-spoa" \
+      org.opencontainers.image.title="coraza-spoa"
+
+COPY --from=build /go/bin/coraza-spoa /
+COPY ./ftw/coraza-spoa.yaml /config.yaml
+
+CMD ["/coraza-spoa", "--config", "/config.yaml"]

ftw/Dockerfile.ftw

@@ -0,0 +1,22 @@
+# Copyright 2025 The OWASP Coraza contributors
+# SPDX-License-Identifier: Apache-2.0
+
+FROM ghcr.io/coreruleset/go-ftw:1.1.2
+
+RUN apk update && apk add curl
+
+WORKDIR /workspace
+
+# TODOs:
+# - update when new CRS version is tagged: https://github.com/coreruleset/coreruleset/archive/refs/tags/v4.5.0.tar.gz
+# - keep it aligned with the github.com/corazawaf/coraza-coreruleset/v4 dependency version used
+ENV CRS_VERSION=4.5.0
+
+ADD https://github.com/coreruleset/coreruleset/archive/refs/tags/v${CRS_VERSION}.tar.gz /workspace/coreruleset/
+RUN cd coreruleset && tar -xf v${CRS_VERSION}.tar.gz --strip-components 1
+
+COPY ftw.yml /workspace/ftw.yml
+COPY tests.sh /workspace/tests.sh
+
+ENTRYPOINT ["sh"]
+CMD ["-c", "/workspace/tests.sh"]

ftw/coraza-spoa.yaml

@@ -0,0 +1,52 @@
+---
+
+bind: 0.0.0.0:9000
+log_level: info
+log_file: /build/ftw-spoa.log
+log_format: console
+
+applications:
+  - name: ftw
+    directives: |
+      Include @coraza.conf-recommended
+      # log details on failures
+      SecAuditLog /build/ftw-audit.log
+      SecAuditLogRelevantStatus "^(?:5)"
+
+      # FTW config
+      SecDefaultAction "phase:3,log,auditlog,pass"
+      SecDefaultAction "phase:4,log,auditlog,pass"
+      SecDefaultAction "phase:5,log,auditlog,pass"
+      SecDebugLogLevel 3
+
+      SecAction "id:900005,\
+          phase:1,\
+          nolog,\
+          pass,\
+          ctl:ruleEngine=DetectionOnly,\
+          ctl:ruleRemoveById=910000,\
+          setvar:tx.blocking_paranoia_level=4,\
+          setvar:tx.crs_validate_utf8_encoding=1,\
+          setvar:tx.arg_name_length=100,\
+          setvar:tx.arg_length=400,\
+          setvar:tx.total_arg_length=64000,\
+          setvar:tx.max_num_args=255,\
+          setvar:tx.max_file_size=64100,\
+          setvar:tx.combined_file_sizes=65535"
+
+      SecRule REQUEST_HEADERS:X-CRS-Test "@rx ^.*$" "id:999999,\
+          phase:1,\
+          pass,\
+          t:none,\
+          log,\
+          msg:'X-CRS-Test %{MATCHED_VAR}',\
+          ctl:ruleRemoveById=1-999999"
+
+      Include @crs-setup.conf.example
+      Include @owasp_crs/*.conf
+
+    response_check: true
+    transaction_ttl_ms: 60000
+    log_level: error  # Printing only logs at error level to reduce what ftw has to parse
+    log_file: /build/ftw.log
+    log_format: console

ftw/docker-compose.yml

@@ -0,0 +1,63 @@
+---
+
+services:
+  backend:
+    image: ghcr.io/coreruleset/albedo:0.0.16
+    command: ['--port', '8081']
+    ports:
+      - 8081:8081
+
+  # clean existing logs, enable haproxy to write logs, allow devs to manage logs without sudo
+  prepare-logs:
+    image: alpine:3.21
+    command:
+      - /bin/sh
+      - -c
+      - rm -f /build/ftw* && touch /build/ftw.log /build/ftw-haproxy.log /build/ftw-haproxy.log /build/ftw-audit.log && chmod 666 /build/ftw*
+    volumes:
+      - ../build:/build:rw
+
+  coraza-spoa:
+    depends_on:
+      - prepare-logs
+    build:
+      context: ..
+      dockerfile: ./ftw/Dockerfile.coraza_spoa
+      network: host
+    volumes:
+     - ../build:/build:rw
+    ports:
+      - 9000:9000
+
+  haproxy:
+    depends_on:
+      - prepare-logs
+      - backend
+    image: "haproxy:${FTW_HAPROXY_VERSION-3.0}-alpine"
+    links:
+      - coraza-spoa:coraza-spoa
+    volumes:
+      - type: bind
+        source: ./haproxy/
+        target: /usr/local/etc/haproxy
+      - ../build:/build:rw
+    command:
+      - /bin/sh
+      - -c
+      - haproxy -f /usr/local/etc/haproxy/haproxy.cfg > /build/ftw-haproxy.log
+    ports:
+      - 8080:8080
+
+  ftw:
+    depends_on:
+      - coraza-spoa
+      - haproxy
+    build:
+      context: .
+      dockerfile: Dockerfile.ftw
+      network: host
+    environment:
+      - FTW_CLOUDMODE
+      - FTW_INCLUDE
+    volumes:
+      - ../build:/build