Varnish WAF 1.3.0 Release

About the release

Varnish WAF 1.3.0 is a feature release focused on observability. It adds two new VCL methods — .detection_mode() and .log_matches() — that make it easier to stage and tune a rule set before switching it to blocking.

Please see the changelog for the complete list of changes.

Notable changes

Query the current detection mode

.detection_mode() returns the engine’s effective state for the transaction — "On", "DetectionOnly" or "Off" — accounting for any mid-transaction ctl:ruleEngine change. It returns "Off" when there is no transaction, so it is safe to call unconditionally.

Log non-disruptive rule matches

.log_matches() writes matching-but-non-disruptive rules to the VSL under the WAF tag with a MATCH: prefix. This surfaces detections while running in DetectionOnly, and the CRS anomaly-scoring rules while running in On. It is opt-in per request; the bundled waf.vcl wires it to the waf-log-matches header.

References

• Changelog with the complete list of changes.
• Varnish WAF Documentation
• Varnish WAF Installation