Skip to content

Latest commit

 

History

History
318 lines (156 loc) · 9.88 KB

CHANGES.md

File metadata and controls

318 lines (156 loc) · 9.88 KB
Raw

Change Log

[Unreleased]

Added

Removed

Changed

Fixed

[5.3.1] - 2021-05-26 GMT+0800

Fixed

  • Sometimes the module does not compile even if the dependencies are installed correctly.

[5.3.0] - 2021-05-16 GMT+0800

Added

  • New directive: waf_under_attack, which can be used when the site is under attack.

  • New directive: waf_http_status, which sets the HTTP status code returned when a request is blocked.

  • New built-in variable: $waf_blocking_log, not an empty string when the request is intercepted for its value.

Changed

  • Update default rules.

Fixed

  • CC protection sometimes not work.

  • Cookie inspection sometimes not work.

[5.1.2] - 2021-04-30 GMT+0800

Added

  • Support for detecting SQL injection (powered by libinjection). This feature can be enabled by enabling the mode LIB-INJECTION, see the documentation for details.

[5.1.1] - 2021-04-23 GMT+0800

Fixed

  • URL and Referer whitelist are not working.

[5.1.0] - 2021-04-20 GMT+0800

Added

  • New built-in variable waf_log, which is not an empty string when this module has performed a inspection, but an empty string otherwise, mainly used in the directive access_log.

  • New built-in variable waf_spend, which records the time (in milliseconds) taken by this module to perform the inspection.

[5.0.0] - 2021-04-07 GMT+0800

WARNING

This version contains breaking changes.

Added

  • A new mode CACHE has been added, enabling this mode will cache the results of each inspection to improve performance.

  • New configuration waf_cache has been added to set parameters related to cache.

  • Added directive waf_cc_deny to set CC protection related parameters.

  • New directive waf_priority has been added to set the priority of all checks except for POST checks.

  • The Retry-Afte response header is appended when the CC protection returns a 503 status code.

Removed

  • The directive waf_cc_deny_limit is deprecated and replaced with the new directive waf_cc_deny.

Changed

  • Swaps the default priority of CC protection and IP whitelist inspection.

Fixed

  • Fixed a segmentation fault when the number of worker processes is greater than one.

  • Fixed a bug where CC protection statistics were sometimes inaccurate.

[4.0.0] - 2021-03-22 GMT+0800

WARNING

This version contains breaking changes.

Added

  • Added some parameters to waf_mode and waf_cc_deny_limit (368db2b).

Removed

  • Abort directive: waf_mult_mount. The function of this directive has been merged into the directive waf_mode.

Changed

  • Adds some parameters to the directive waf_mode.

Fixed

  • Fixed an error in the name of the built-in variable waf_rule_details, which was set to waf_rule_deatails in a previous version of the code.

  • No more superfluous inspections.

  • Completely resolve compatibility issues with the ngx_http_rewrite_module.

[3.1.6] - 2021-03-07

Fixed

  • Correcting the order in which rules take effect (51c7824).

[3.1.5] - 2021-03-03

Fixed

  • Fixed a bug in the config script that caused dependencies to not be checked correctly (075a27e).

[3.1.4] - 2021-03-02

Changed

  • Use safer string handling functions to avoid buffer overflows when conditions allow (177ae68).

[3.1.3] - 2021-02-23

Fixed

  • Order of effectiveness of correction rules (857ec84).

[3.1.2] - 2021-01-18

Fixed

  • Fixed a bug that caused module initialization to fail when the rule file was not writable (20acd27).

[3.1.1] - 2021-01-18

Fixed

  • Compatible with lower versions of gcc (becbbe0).

[3.1.0] - 2021-01-17

Note

  • v3.0.3 was skipped because a backward compatibility feature was added during the v3.0.3 test.

Added

  • Add debug log for easy troubleshooting (bac1d02).

Fixed

  • Fixed a segmentation fault (57d7719)。

  • More accurate visit frequency statistics (53d3b14).

[3.0.2] - 2021-01-10

Note

  • Because of hotfixes performed on v3.0.1, all beta versions of v3.0.2 are voided, please do not use these beta versions.

Fixed

  • Fixed a build error on Alpine Linux (e989aa3).

[3.0.1] - 2020-12-28

Fixed

  • Fixed a segmentation fault when inspecting cookies (8dc2b56).

[3.0.0] - 2020-12-25

Added

  • Anti Challenge Collapsar now supports IPV6 (00fbc1c).

  • IP black and white lists support IPV6, and can recognize IPV6 strings such as fe80::/10 (8519b26).

Changed

  • Delete some meaningless logs (bd279e7).

  • Friendly error alerts (d1185b2 & f2b617d). Warnings or error reporting when IP addresses in the rule file are invalid or IP address blocks overlap (does not detect all overlaps).

  • Faster IP matching (2b9e774).

Fixed

  • Fixed a bug that caused the cookie inspection not work (87beed1).

  • Modify the config file to ensure that the latest module code is compiled when executing make or make modules (25f97f5). Before the fix, if only the files under inc/ changed, the latest code would not be compiled because the files under inc/ were not checked for changes.

  • Fixed a bug with incorrect IPV4 segment identification (73a22eb). This bug could cause the subnet mask not to be generated correctly when a rule like 192.168.0.0/10, i.e. the suffix is not a multiple of 8, appears in the rule.

[2.1.1] - 2020-12.10

Added

Changed

Fixed

  • Fixed a module startup failure error. The error message for this error is nginx: [alert] could not open error log file: open() "ngx_waf: /logs/error.log" failed (2: No such file or directory) (0dfc46f).

[2.1.0] - 2020-12-09

Added

Changed

Fixed

[2.0.2] - 2020-12-07

Added

Changed

Fixed

  • Fix for Anti Challenge Collapsar failing when waf_mult_mount is disabled (048fe5c).

  • Fixed compile error caused by incorrect #include (3fa298c).

[2.0.1] - 2020-12-03

Added

Changed

  • Instead of downloading the uthash dependency manually, you can install the system library with yum install uthash-devel or apt-get install uthash-dev (7cfc94b).

Fixed

  • Fixed a bug that failed to compile under CentOS/RHEL 6 or 7 that was caused by not properly preventing macro redefinitions (28e1c8a & 566ae4a).

[2.0.0] - 2020-09-29

Added

  • We can compile the module with --add-dynamic-module. Thanks for dvershinin's work(ADD-SP#4)。

Changed

  • Remove a default User-Agent rule that is (?i)(? :Sogou web spider), as it will block non-malicious web spider(827d4e5).

  • Merge directives (ba92cfd). These directives will be merged: waf_check_ipv4, waf_check_url, waf_check_args, waf_check_ua, waf_check_referer, waf_check_cookie, waf_check_post, waf_check_cookie, waf_cc_deny. The merged new directive is waf_mode, see README.

Fixed

  • The blank lines in the rules can now be read correctly (955cf2d).