unable to import github.com/corazawaf/coraza/v3

zetaab commented 1 year ago

The following program `sample.go` triggers an unexpected result

package main

// yaegi:tags purego
import (
        "fmt"

        "github.com/corazawaf/coraza/v3"
)

func main() {
        waf, err := coraza.NewWAF(coraza.NewWAFConfig().
                WithDirectives(`SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"`))
        // Now we parse our rules
        if err != nil {
                fmt.Println(err)
        }
        fmt.Printf("%+v\n", waf)
}

Expected result

% go run main.go
{waf:0x14000174000}

Got

% yaegi ./main.go
run: ./main.go:7:2: import "github.com/corazawaf/coraza/v3" error: /path/to/go/src/project/name/vendor/github.com/corazawaf/coraza/v3/config.go:11:2: import "github.com/corazawaf/coraza/v3/internal/corazawaf" error: /path/to/go/src/project/name/vendor/github.com/corazawaf/coraza/v3/internal/corazawaf/rule.go:13:2: import "unsafe" error: unable to find source related to: "unsafe"

Yaegi Version

0.15.1

Additional Notes

with unsafe being blocked by default in traefik. We cannot develop coraza waf plugin which will be the next generation for modsecurity.

litao09h commented 11 months ago

Encountering similar problems， It seems like there are many problems, not very mature。

alarbada commented 8 months ago

Such a shame, I also got a similar error.

blacky-i commented 3 months ago

Hello everyone! I tried to set up coraza in traefik. Here are my thougths, maybe somebody could find them useful.

I wanted to use coraza WAF and started looking in available solutions. Here what I have tried.

coraza-http-wasm-traefik

Beta stage option. It is embedded in traefik as middleware and works during processing, but there is a memory leak. A small investigation showed (by commenting on pieces of code and searching for leaks) that the garbage collector is not working well. And it is archived with the following message:

nottinygc was an interesting experiment to bring OK performance to Wasm binaries compiled with Go. But there are fundamental issues with using GC languages in a sandboxed environment like Wasm - this still applies even after the Wasm GC proposal, and is even worse before it. The wasilibs recommendation is to use a non-GC language such as C++, Rust, or similar, when compiling to Wasm and to not use Go.

I realized that I should leave it as it is. Rewriting coraza into another language to transfer to wasm seems a big task.

coraza-yaegi

Traefik has a second option for the plugin - using its own interpreter Yaegi.

Not working out of the box Issue 1 due to unsafe keyword. I tried to build a patched traefik with the addition of i.Use(unsafe.Symbols) into the project. But then the issues of the interpreter went further.

The first mistake was:

import \"github.com/corazawaf/coraza/v3/internal/memoize\" error: plugins-local/src/github.com/blackyi/coraza/vendor/github.com/corazawaf/coraza/v3/internal/memoize/nosync.go:10:12: not enough arguments in call to makeDoer

Memoization is good, of course, but optional. It could be dealt with later, but now I was trying to figure out how much work I needed to do. Commented it out. Next, the following error popped up - The use of goto statements does not work:

import \"github.com/tidwall/gjson\" error: plugins-local/src/github.com/blackyi/coraza/vendor/github.com/tidwall/gjson/gjson.go:1857:3: undefined: loop"

github.com/corazawaf/coraza/v3/internal/bodyprocessors/json.go:11:2: import \"github.com/tidwall/gjson\" error: plugins-local/src/github.com/blackyi/coraza/vendor/github.com/tidwall/gjson/gjson.go:2415:3: undefined: key"

it showed me that the interpreter has problems with code in the project dependencies. I also commented to understand the depth of the rabbit hole. And on the next mistake, I gave up. I realized that there was too much work to do.

error: plugins-local/src/github.com/blackyi/coraza/vendor/golang.org/x/net/html/parse.go:688:46: cannot use type func(*html.parser) bool as type func(*unsafe2.dummy) bool

I decided that this information might be useful. But for now, the most working option is to use coraza-spoa. Or, by the same analogy, write a plugin for traefik, redirect processing to another service.

traefik / yaegi