search

corazawaf / coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
https://www.coraza.io
Apache License 2.0
2.26k stars 224 forks source link

High Memory Usage since at least v3.2.1 #1159

Closed fionera closed 1 month ago

fionera commented 1 month ago

Description

Somewhere since version v3.0.1, a bug was introduced increasing memory usage a lot.

Steps to reproduce

Run a couple thousand requests again a coraza instance. I can provide pprofs which show this behaviour

Expected result

What should happen? Static or at least not that high of an increase of memory

Actual result

Lots of memory.

fionera commented 1 month ago

Ok this is a side effect of coraza allocating the response body on every request. Maybe this should be replaced with a buffer pool

jptosso commented 1 month ago

Hey! So there is no issue?

fionera commented 1 month ago

I really don't know. I have to investigate more because I get different results via go Benchmarks and running the process with pprof export built in

jcchavezs commented 1 month ago

Maybe this should be replaced with a buffer pool

We use a pool of transactions and each of them has a buffer for request/response body.

fionera commented 1 month ago

Yeah so was my idea. There is a static maximum size anyway, so there is nothing against it. I do the same inside my haproxy package.

fionera commented 1 month ago

I would think that replacing TransactionVariables.responseBody with static capacity byte slice that gets reused between transactions would help a lot