github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-12-31 05:39:07 +03:00
Code Issues Packages Projects Releases Wiki Activity

try exit in header filter

Browse Source
This commit is contained in:
wiaamm
2025-12-14 15:37:42 +02:00
parent 0867c408be
commit 165a01a2ea
1 changed files with 51 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

143
attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua
View File

@@ -17,7 +17,6 @@ function NanoHandler.access(conf)
local headers = kong.request.get_headers() local headers = kong.request.get_headers()
local session_id = nano.generate_session_id() local session_id = nano.generate_session_id()
kong.service.request.set_header("x-session-id", tostring(session_id))
local session_data = nano.init_session(session_id) local session_data = nano.init_session(session_id)
if not session_data then if not session_data then
@@ -34,14 +33,14 @@ function NanoHandler.access(conf)
local meta_data = nano.handle_start_transaction() local meta_data = nano.handle_start_transaction()
if not meta_data then if not meta_data then
kong.log.err("Failed to handle start transaction - failing open") kong.log.debug("Failed to handle start transaction - failing mode")
ctx.cleanup_needed = true ctx.cleanup_needed = true
return return
end end
local req_headers = nano.handleHeaders(headers) local req_headers = nano.handleHeaders(headers)
if not req_headers then if not req_headers then
kong.log.err("Failed to handle request headers - failing open") kong.log.debug("Failed to handle request headers - failing mode")
ctx.cleanup_needed = true ctx.cleanup_needed = true
return return
end end
@@ -69,65 +68,53 @@ function NanoHandler.access(conf)
end end
return return
end end
else else
local body_data = ngx.var.request_body local body_file = ngx.var.request_body_file
if body_data and #body_data > 0 then if body_file then
kong.log.debug("Found request body in nginx var, size: ", #body_data) local file = io.open(body_file, "rb")
verdict, response = nano.send_body(session_id, session_data, body_data, nano.HttpChunkType.HTTP_REQUEST_BODY) if file then
if verdict ~= nano.AttachmentVerdict.INSPECT then local chunk_size = 8192
ctx.cleanup_needed = true local chunk_count = 0
if verdict == nano.AttachmentVerdict.DROP then local start_time = ngx.now()
return nano.handle_custom_response(session_data, response) local timeout_sec = nano.get_request_processing_timeout_sec()
end kong.log.debug("Request body reading timeout set to ", timeout_sec, " seconds")
return
end while true do
else ngx.update_time()
local body_file = ngx.var.request_body_file local current_time = ngx.now()
if body_file then local elapsed = current_time - start_time
local file = io.open(body_file, "rb")
if file then
local chunk_size = 8192
local chunk_count = 0
local start_time = ngx.now()
local timeout_sec = nano.get_request_processing_timeout_sec()
kong.log.debug("Request body reading timeout set to ", timeout_sec, " seconds")
while true do if elapsed > timeout_sec then
ngx.update_time() ctx.cleanup_needed = true
local current_time = ngx.now() kong.log.warn("Request body reading timeout after ", elapsed, " seconds")
local elapsed = current_time - start_time file:close()
return
if elapsed > timeout_sec then end
kong.log.warn("Request body reading timeout after ", elapsed, " seconds")
file:close() local chunk = file:read(chunk_size)
return if not chunk or #chunk == 0 then
end kong.log.debug("End of request body file reached")
break
local chunk = file:read(chunk_size) end
if not chunk or #chunk == 0 then
kong.log.debug("End of request body file reached") chunk_count = chunk_count + 1
break kong.log.debug("Sending request body chunk ", chunk_count, " of size ", #chunk, " bytes to C module")
end verdict, response = nano.send_body(session_id, session_data, chunk, nano.HttpChunkType.HTTP_REQUEST_BODY)
chunk_count = chunk_count + 1 if verdict ~= nano.AttachmentVerdict.INSPECT then
kong.log.debug("Sending request body chunk ", chunk_count, " of size ", #chunk, " bytes to C module") file:close()
verdict, response = nano.send_body(session_id, session_data, chunk, nano.HttpChunkType.HTTP_REQUEST_BODY) ctx.cleanup_needed = true
if verdict == nano.AttachmentVerdict.DROP then
if verdict ~= nano.AttachmentVerdict.INSPECT then return nano.handle_custom_response(session_data, response)
file:close() end
ctx.cleanup_needed = true return
if verdict == nano.AttachmentVerdict.DROP then
return nano.handle_custom_response(session_data, response)
end
return
end
end end
file:close()
kong.log.debug("Sent ", chunk_count, " chunks from request body file")
end end
else file:close()
kong.log.err("Request body expected but no body data or file available") kong.log.debug("Sent ", chunk_count, " chunks from request body file")
end end
else
kong.log.err("Request body expected but no body data or file available")
end end
end end
@@ -136,7 +123,7 @@ function NanoHandler.access(conf)
end) end)
if not ok then if not ok then
kong.log.err("Error ending request inspection: ", verdict, " - failing open") kong.log.debug("Error ending request inspection: ", verdict, " - failing open")
ctx.cleanup_needed = true ctx.cleanup_needed = true
return return
end end
@@ -153,6 +140,8 @@ end
function NanoHandler.header_filter(conf) function NanoHandler.header_filter(conf)
local ctx = kong.ctx.plugin local ctx = kong.ctx.plugin
kong.log.err("-------------------- header_filter -------------------")
kong.response.exit(403, "Blocked by Open AppSec WAF Kong Plugin", { ["Content-Type"] = "text/plain" })
if nano.is_session_finalized(ctx.session_data) then if nano.is_session_finalized(ctx.session_data) then
kong.log.debug("Session has already been inspected, no need for further inspection") kong.log.debug("Session has already been inspected, no need for further inspection")
return return
@@ -170,7 +159,7 @@ function NanoHandler.header_filter(conf)
local header_data = nano.handleHeaders(headers) local header_data = nano.handleHeaders(headers)
if not header_data then if not header_data then
kong.log.err("Failed to handle response headers - failing open") kong.log.debug("Failed to handle response headers - failing open")
ctx.cleanup_needed = true ctx.cleanup_needed = true
return return
end end
@@ -182,11 +171,9 @@ function NanoHandler.header_filter(conf)
if verdict ~= nano.AttachmentVerdict.INSPECT then if verdict ~= nano.AttachmentVerdict.INSPECT then
ctx.cleanup_needed = true ctx.cleanup_needed = true
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.debug("DROP verdict in header_filter - will replace response in body_filter") kong.log.warn("DROP verdict in header_filter - sending block response immediately")
ctx.blocked = true return nano.handle_custom_response(session_data, response)
ctx.block_response = response
else else
kong.log.debug("ACCEPT verdict in header_filter - clearing Content-Length for chunked encoding")
ngx.header["Content-Length"] = nil ngx.header["Content-Length"] = nil
end end
return return
@@ -206,34 +193,6 @@ function NanoHandler.body_filter(conf)
local session_id = ctx.session_id local session_id = ctx.session_id
local session_data = ctx.session_data local session_data = ctx.session_data
if ctx.blocked then
kong.log.debug("Sending custom block response in body_filter")
if ctx.block_response then
kong.log.debug("Block response data available, preparing custom response")
local code, body, headers = nano.get_custom_response_data(session_data, ctx.block_response)
ngx.status = code
for header_name, header_value in pairs(headers) do
ngx.header[header_name] = header_value
end
if body and #body > 0 then
ngx.header["Content-Length"] = #body
ngx.arg[1] = body
else
ngx.header["Content-Length"] = 0
ngx.arg[1] = ""
end
else
kong.log.err("Missing session_data or block_response, sending empty response")
ngx.status = 403
ngx.arg[1] = ""
end
ngx.arg[2] = true
ctx.cleanup_needed = true
return
end
if nano.is_session_finalized(session_data) then if nano.is_session_finalized(session_data) then
kong.log.debug("Session has already been inspected, no need for further inspection") kong.log.debug("Session has already been inspected, no need for further inspection")
return return