coraza-proxy-wasm support #454
Comments
|
as this module fails with |
|
adding debug level for error log just in case: |
|
You can try the build using corazawaf/coraza-proxy-wasm#144 and maybe make it work the example. |
|
Hi, With the |
|
~Hey! It works by transforming proxy_define_metric into a NOP, but how can we send options to the WASM filter? ~ Found it https://github.com/Kong/ngx_wasm_module/blob/nightly/docs/DIRECTIVES.md#module Works with the following config: # nginx.conf
events {}
error_log /dev/stdout info;
# nginx master process gets a default 'main' VM
# a new top-level configuration block receives all configuration for this main VM
wasm {
# [name] [path.{wasm,wat}]
module coraza /nginx/coraza.wasm '';
# module my_module /path/to/module.wasm;
}
# each nginx worker process is able to instantiate wasm modules in its subsystems
http {
access_log /dev/stdout;
server {
listen 8080;
location / {
# execute a proxy-wasm filter when proxying
# [module]
proxy_wasm coraza '
{
"directives_map": {
"default": [
"SecDebugLogLevel 9",
"SecRuleEngine On",
"SecRule REQUEST_URI \\"@streq /admin\\" \\"id:101,phase:1,t:lowercase,deny\\""
]
},
"default_directives": "default"
}';
# execute more WebAssembly during the access phase
# [phase] [module] [function]
# wasm_call access my_module check_something;
return 200 'Goodbye World!';
}
}
# other directives
wasm_socket_connect_timeout 60s;
wasm_socket_send_timeout 60s;
wasm_socket_read_timeout 60s;
wasm_socket_buffer_size 8k;
wasm_socket_large_buffers 32 16k;
}But it fails with error 200 and empty response: Update 3: If I use proxy_pass instead of return, curl times out: |
|
Not something I can reproduce; it works fine for me locally. |
with Coraza proxy wasm? could you share your config? This is my dockerfile FROM ubuntu
WORKDIR /tmp
RUN apt update -y
RUN apt install -y git wget unzip
RUN mkdir /nginx
RUN wget https://github.com/Kong/ngx_wasm_module/releases/download/nightly/wasmx-nightly-20231204-wasmtime-aarch64-ubuntu22.04.tar.gz
RUN tar -xvf wasmx-nightly-20231204-wasmtime-aarch64-ubuntu22.04.tar.gz
RUN mv wasmx-nightly-20231204-wasmtime-aarch64-ubuntu22.04/nginx /usr/local/sbin/nginxI mounted the modified version of coraza-proxy-wasm where I modified the metrics.go file: func (m *wafMetrics) incrementCounter(fqn string) {
} |
|
It's probably an issue with your Docker setup imho. I used the exact same config you posted above with a local build of ngx_wasm_module main. I updated |
|
A few thoughts from me: It would be beneficial for the host to support indicating the implemented and supported ABI version (akin to capabilities). This information can be utilized by the guest to dynamically determine the type of host it is interacting with. An analogous example is JavaScript code determining whether it is running in a node.js or browser environment. Additionally, the absence of a metrics-related API may not be a critical issue for WAF module (though it could potentially affect reporting). However, having such an API is valuable for production. It's unlikely that someone would deploy production workloads without metrics. Ultimately, the decision of pros and cons lies with the guest developer. As for testing and integrations, it may be okay to go without metrics and enable determining corectness and performance of the module on the particular host. As an illustration, the RUST SDK includes this feature: Similarly, the CPP (envoy) host also provides this capability: CPP Host Link I know, that host type/kind if not part of ABI spec, just a thought. |
Agreed and that is what I was hinting at, but there is no such API in the Proxy-Wasm SDK at the moment as you know, so users have to rely on their knowledge of the underlying host, e.g. like corazawaf/coraza-proxy-wasm#144 does. We will of course add metrics support but we do not have a timeline for it at the moment. |
|
I'd be inclined to close this given the filter behaves exactly as expected under the current state of the module. Unless a valid objection I will close it soon. |
I was trying to see if https://github.com/corazawaf/coraza-proxy-wasm would work with this module.
a wasm module can be downloaded from: https://github.com/corazawaf/coraza-proxy-wasm/releases/download/0.4.0/coraza-proxy-wasm-0.4.0.zip
error.log file:
Creating this issue to track completeness and compatibility with a more complicated proxy-wasm filter such as
coraza-proxy-wasm.nginx config:
sending a request to nginx:
The text was updated successfully, but these errors were encountered: