ngx_waf

# Change Log (6.0.x)

The format is based on Keep a Changelog (opens new window), and this project adheres to Semantic Versioning (opens new window).

What is a breaking change?

  • The original configuration file may not work, for example, if a directive item is removed or renamed.
  • It may be necessary to update the build environment, such as installing new dependencies.

# [6.0.3] - 2021-08-02 UTC+0800

# Fixed

  • A segmentation fault may be raised when releasing resources from the virtual machine.

# [6.0.2] - 2021-08-01 UTC+0800

# Fixed

  • The whitelist of URL and Referer in the upper-level configuration cannot be inherited properly.

# [6.0.1] - 2021-07-30 UTC+0800

# Deprecated

  • Deprecates the parameters interval and percent of the directive waf_cache, but does not remove them, only that they no longer have any effect. These two parameters will be removed in the future.

# Changed

  • Improved performance of CC protection.

# Fixed

# [6.0.0] - 2021-07-21 UTC+0800

# NOTE

  • This release contains some breaking changes.

  • Advanced rules have a high performance cost because the principle is to compile the rules into a series of instructions that are then executed by the VM.

# Upgrade from 5.x.x to 6.x.x

  1. Create a new empty file named advanced in the rules directory.

  2. If the directive waf_priority is used, you can delete it or modify it according to the directive in the documentation.

# Pre-built modules

We now provide pre-compiled modules that can be used as long as the following requirements are met.

  1. The version of nginx must be the latest stable or mainline version.
  2. The C standard library implementation must be the GNU implementation or the MUSL implementation.

The download script will automatically check if the second condition is met.

You can execute assets/download.sh to download the corresponding version of the module and save it to the current directory. Here is the use case.

# nginx-stable ngx_waf-stable
sh assets/download stable stable

# nginx-mainline ngx_waf-stable
sh assets/download mainline stable

# nginx-stable ngx_waf-beta
sh assets/download stable beta

# nginx-mainline ngx_waf-beta
sh assets/download mainline beta

Each update takes about an hour and a half to compile the module, so it is recommended that you download the updated module more than two hours after the update, otherwise you may download the old module.

# Added

  • Advanced rules are supported, see the documentation for details.

# Removed

  • Remove mode COMPAT, no longer fully compatible with ngx_http_rewrite_module.

# Changed

  • Updated the directive waf_priority, see the documentation for details.

  • You can now use all the directives of this module in blocks http, server and location