test: add valgrind memcheck/helgrind soak of the running module

.dockerignore

@@ -0,0 +1,5 @@
+.git
+.github
+.claude
+win32
+*.md

.github/workflows/soak.yml

@@ -0,0 +1,73 @@
+name: Valgrind soak
+
+# Manual/scheduled only, not on every PR: a memcheck/helgrind soak runs
+# 10-50x slower than native. See tools/soak.sh.
+on:
+  workflow_dispatch:
+    inputs:
+      duration:
+        description: Seconds per soak run
+        default: "120"
+      concurrency:
+        description: Concurrent traffic workers
+        default: "8"
+  schedule:
+    - cron: "0 3 * * 1" # weekly, Monday 03:00 UTC
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  memcheck:
+    name: memcheck soak
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Build base image
+        run: docker build -t modsec-nginx-test .
+
+      - name: Build soak image
+        run: docker build -f Dockerfile.fuzz -t modsec-nginx-soak .
+
+      - name: Run memcheck soak
+        env:
+          DURATION: ${{ inputs.duration || '120' }}
+          CONCURRENCY: ${{ inputs.concurrency || '8' }}
+        run: |
+          docker run --rm --cap-add=SYS_PTRACE \
+            -e USE_VALGRIND=1 \
+            modsec-nginx-soak /usr/local/nginx/sbin/nginx \
+            "$DURATION" "$CONCURRENCY"
+
+  helgrind:
+    name: helgrind soak
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Build base image
+        run: docker build -t modsec-nginx-test .
+
+      - name: Build soak image
+        run: docker build -f Dockerfile.fuzz -t modsec-nginx-soak .
+
+      - name: Run helgrind soak
+        env:
+          DURATION: ${{ inputs.duration || '120' }}
+          CONCURRENCY: ${{ inputs.concurrency || '8' }}
+        run: |
+          docker run --rm --cap-add=SYS_PTRACE \
+            -e USE_HELGRIND=1 \
+            modsec-nginx-soak /usr/local/nginx/sbin/nginx \
+            "$DURATION" "$CONCURRENCY"

Dockerfile

@@ -0,0 +1,72 @@
+# Build image for the ModSecurity-nginx connector: libmodsecurity3, nginx,
+# and this connector, statically linked (matching the .github/workflows/
+# test_new.yml CI build). Used as the base for Dockerfile.fuzz's
+# valgrind/helgrind soak; not intended as a production nginx image.
+FROM debian:bookworm-slim AS builder
+
+ARG NGINX_VERSION=1.29.1
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        git \
+        wget \
+        automake \
+        autoconf \
+        libtool \
+        pkg-config \
+        pcre2-utils \
+        libpcre2-dev \
+        libyajl-dev \
+        libxml2-dev \
+        libmaxminddb-dev \
+        libcurl4-openssl-dev \
+        zlib1g-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+# Stage 1: libmodsecurity v3, matching test_new.yml's build.
+WORKDIR /build
+RUN git clone --depth 1 --branch v3/master --recurse-submodules \
+        https://github.com/owasp-modsecurity/ModSecurity.git libmodsecurity
+WORKDIR /build/libmodsecurity
+RUN ./build.sh && \
+    ./configure --without-lmdb --prefix=/usr && \
+    make -j"$(nproc)" && \
+    make install
+
+# Stage 2: nginx, statically linked against this connector.
+WORKDIR /build
+RUN wget -q -O nginx.tar.gz "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" && \
+    tar -xzf nginx.tar.gz
+COPY . /build/ModSecurity-nginx
+WORKDIR /build/nginx-${NGINX_VERSION}
+RUN ./configure \
+        --with-ld-opt="-Wl,-rpath,/usr/lib" \
+        --with-http_v2_module \
+        --with-http_auth_request_module \
+        --add-module=../ModSecurity-nginx && \
+    make -j"$(nproc)" && \
+    make install
+
+# Runtime image: nginx binary + libmodsecurity's runtime deps only.
+FROM debian:bookworm-slim
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libpcre2-8-0 \
+        libyajl2 \
+        libxml2 \
+        libmaxminddb0 \
+        libcurl4 \
+        libstdc++6 \
+        zlib1g && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/local/nginx /usr/local/nginx
+COPY --from=builder /usr/lib/libmodsecurity* /usr/lib/
+RUN ldconfig
+
+EXPOSE 80
+ENTRYPOINT ["/usr/local/nginx/sbin/nginx"]
+CMD ["-g", "daemon off;"]

Dockerfile.fuzz

@@ -0,0 +1,29 @@
+# Valgrind memcheck/helgrind soak image for the ModSecurity-nginx connector.
+#
+# Kept separate from the main Dockerfile so the production-shaped build image
+# stays untouched; this just layers valgrind + curl + tools/soak.sh on top.
+#
+# Build (base image first, then this one):
+#   docker build -t modsec-nginx-test .
+#   docker build -f Dockerfile.fuzz -t modsec-nginx-soak .
+#
+# Run:
+#   docker run --rm --cap-add=SYS_PTRACE modsec-nginx-soak /usr/local/nginx/sbin/nginx 60 4
+#   docker run --rm -e USE_VALGRIND=1 --cap-add=SYS_PTRACE modsec-nginx-soak \
+#       /usr/local/nginx/sbin/nginx 120 8
+#   docker run --rm -e USE_HELGRIND=1 --cap-add=SYS_PTRACE modsec-nginx-soak \
+#       /usr/local/nginx/sbin/nginx 120 8
+#
+# See tools/soak.sh for what the soak actually does.
+
+ARG BASE_IMAGE=modsec-nginx-test
+FROM ${BASE_IMAGE}
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends valgrind curl && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY tools/soak.sh tools/valgrind.suppress /opt/soak/
+
+ENTRYPOINT ["/opt/soak/soak.sh"]
+CMD ["/usr/local/nginx/sbin/nginx"]