Enhance wasm plugins

[juliens]

What does this PR do?

This PR enhance the wasm plugins mechanism by adding:

• The ability to use http-wasm builds with go thanks to wasm-goexport ( GOOS=wasip1 GOARCH=wasm ).
  • To allow this we had to use a fork of the http-wasm-host part.
• The ability to use wazergo for the wasip1 implementation and the WasmEdge socket extension (only if sockets were detected to avoid breaking changes). WARNING this doesn't work on Windows.
• The ability to configure mounts (shared directory) and envs (shared environment variables) for wasm plugin.
  • for now, virtual shared directory is not possible when using Wazergo, only exact match mount ( /etc:/etcworks but not /tmp/etc:/etc)

Motivation

As describe in #10801 , it allows more powerful wasm plugin.

More

You can find an plugin example here: https://github.com/traefik/plugindemowasm-http-call

- [ ] Added/updated tests
- [ ] Added/updated documentation

Additional Notes

Co-authored-by: Michael <michael.matur@gmail.com>

[rtribotte]

LGTM

[mmatur]

LGTM

[jcchavezs]

I wonder if we should specify the syntax for this as IMHO it is very counter intuitive.

[jcchavezs]

shall we include more realistic values for this?

[tiangao88]

Hello all,

It seems that the problem persists in 3.1

Extracted from my docker compose

networks:
coolify:
external: true
services:
traefik:
container_name: coolify-proxy
image: 'traefik:v3.1'
restart: unless-stopped
extra_hosts:
- 'host.docker.internal:host-gateway'
networks:
- coolify
ports:
- '80:80'
- '443:443'
- '443:443/udp'
- '8080:8080'
volumes:
- '/var/run/docker.sock:/var/run/docker.sock:ro'
- '/data/coolify/proxy:/traefik'
- '/data/coolify/proxy/owasp_crs:/data/coolify/proxy/owasp_crs'

And here is my dynamic configuration

http:
middlewares:
my-coraza-waf:
plugin:
coraza-waf:
directives:
- 'SecRuleEngine On'
- 'SecDebugLogLevel 2'
- 'SecRule REQUEST_URI "@Streq /blocked" "id:101,phase:1,log,deny,status:403"'
- 'SecRule REQUEST_HEADERS:User-Agent "@contains BadBot" "id:103,phase:1,log,deny,status:403"'
- 'Include /data/coolify/proxy/owasp_crs/crs-setup.conf'

The include fails

2024-11-12T18:15:26Z DBG github.com/traefik/traefik/v3/pkg/logs/wasm.go:31 > Initializing WAF with CRS embedded and directives:
SecRuleEngine On
SecDebugLogLevel 2
SecRule REQUEST_URI "@Streq /blocked" "id:101,phase:1,log,deny,status:403"
SecRule REQUEST_HEADERS:User-Agent "@contains BadBot" "id:103,phase:1,log,deny,status:403"
Include /data/coolify/proxy/owasp_crs/crs-setup.conf entryPointName=https middlewareName=my-coraza-waf@file middlewareType=wasm routerName=https-0-ssw0w844cw8cgo4gs4c8ko0k-litellm@docker
2024-11-12T18:15:26Z ERR github.com/traefik/traefik/v3/pkg/logs/wasm.go:31 > Failed to initialize WAF: invalid WAF config from string: failed to readfile: open /data/coolify/proxy/owasp_crs/crs-setup.conf: file does not exist entryPointName=https middlewareName=my-coraza-waf@file middlewareType=wasm routerName=https-0-ssw0w844cw8cgo4gs4c8ko0k-litellm@docker
2024-11-12T18:15:26Z ERR github.com/traefik/traefik/v3/pkg/server/router/router.go:136 > error="building Wasm middleware: creating middleware: wasm: error instantiating guest: module closed with exit_code(1)" entryPointName=https routerName=https-0-ssw0w844cw8cgo4gs4c8ko0k-litellm@docker

Thanks for you help!

[rtribotte]

Hello @tiangao88,

Thanks for reporting this!

Could you please open a dedicated issue?

[jcchavezs]

Related jcchavezs/coraza-http-wasm#17