Error occurred when policy contains call to regex.split method

[cch0]

Description

• Not entirely sure the issue came from this repo or wasmtime-java.
• When regex.split method is added to the policy, I am seeing exception when evaluating the policy in Java.
• There is no issue evaluating the policy using OPA Playground. See https://play.openpolicyagent.org/p/HIaYuRdazp
• Policy is compiled to the bundle file using the following command

  opa build -t wasm -o out/bundle.tar.gz  config/play.rego -e play

• The exception can be seen when executing the bundle file illustrated in the following Unit test.

  @Test
  public void test() {
  try {
    Bundle bundle = BundleUtil.extractBundle("./sample-policy/bundle2/bundle.tar.gz");
  
    try (
        OPAModule om = new OPAModule(bundle);
    ) {
      String input = "{}";
      String output = om.evaluate(input, "play");
  
      assertEquals("[{\"result\":true}]", output);
    }
  
  } catch(Exception e) {
    e.printStackTrace();
    fail();
  }
  }

• Exception

  io.github.kawamuray.wasmtime.WasmtimeException: error while executing at wasm backtrace:
  0: 0x1439b - <unknown>!g0.data.play.hello
  1:  0x885 - <unknown>!eval
  2:  0x808 - <unknown>!opa_eval
  at io.github.kawamuray.wasmtime.Func.nativeCall(Native Method)
  at io.github.kawamuray.wasmtime.Func.call(Func.java:46)
  at io.github.kawamuray.wasmtime.Func.call(Func.java:57)
  at io.github.kawamuray.wasmtime.WasmFunctions.lambda$func$39(WasmFunctions.java:409)
  at io.github.sangkeon.opa.wasm.OPAExports.opaEval(OPAExports.java:332)
  at io.github.sangkeon.opa.wasm.OPAModule.evaluateFastPath(OPAModule.java:222)
  at io.github.sangkeon.opa.wasm.OPAModule.evaluate(OPAModule.java:179)
  at io.github.sangkeon.opa.wasm.OPAModule.evaluate(OPAModule.java:169)
  at PlayTest.test(PlayTest.java:19)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
  at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.base/java.lang.reflect.Method.invoke(Method.java:568)
  at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
  at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
  at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
  at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
  at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
  at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
  at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
  at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
  at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63)
  at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
  at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
  at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
  at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
  at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
  at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
  at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
  at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
  at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
  at com.intellij.rt.junit.IdeaTestRunner$Repeater$1.execute(IdeaTestRunner.java:38)
  at com.intellij.rt.execution.junit.TestsRepeater.repeat(TestsRepeater.java:11)
  at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:35)
  at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:235)
  at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:54)

Rego Policy

package play

import future.keywords.if

default hello := false

hello := true if {
    regex.split("[|]", "a|b")
}

Versions

• java-opa-wasm: v0.2.3
• wasmtime-java: 0.14.0
• MacOS 11.7.8 Intel

[sangkeon]

It's because regex.split builtin function is not supported.

I tested the rego code on npm-opa-wasm, it worked because npm-opa-wasm supported the builtin function. I tested the rego code on python-opa-wasm, I got following error.

Traceback (most recent call last): File "/home/sangkenlee/pipregextest/test.py", line 4, in policy = OPAPolicy('./policy.wasm') File "/home/sangkenlee/.local/lib/python3.10/site-packages/opa_wasm/opa_wasm.py", line 53, in init self.builtins_by_id = self._create_builtins_map(builtins if builtins else {}) File "/home/sangkenlee/.local/lib/python3.10/site-packages/opa_wasm/opa_wasm.py", line 159, in _create_builtins_map raise LookupError(f"A required builtin '{function_name}' function was not provided.") LookupError: A required builtin 'regex.split' function was not provided.

May be the error occured in the java-opa-wam for the same reason.

I'll add checking for not supported builtin functions like the implementation of the python-opa-wasm in the next release. I'll check implementing regex.split in the opa-java-wasm is possible when I have a time. Or ask the OPA team, they can include regex.split implementation in WASM on the policy.wasm in the future version of the OPA

Thanks.

[cch0]

Thank you for the explanation.

• Were you saying that the support for regex.split could be added to wasmtime-java library ?
• How would us implement regex.splt in this java-opa-wasm project without the change in wasmtime-java ?
• Trying to think how I can help to "unblock" myself.

Thanks again.

[sangkeon]

regex.split could be added to the java-opa-wasm. Changing wasmtime-java is not required.

It could be added to OPAModule.initImports().

In the npm-opa-wasm, implementation of regex.split is very straight foward.(https://github.com/open-policy-agent/npm-opa-wasm/blob/main/src/builtins/regex.js)

But implenting the code in the Java working exactly same may be not easy work.