diff --git a/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua b/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua index 99736dc..4fedac1 100755 --- a/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua +++ b/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua @@ -43,6 +43,13 @@ function NanoHandler.access(conf) return end + -- Skip TLS/SSL handshake and certificate phase requests (no HTTP data yet) + local request_uri = ngx.var.request_uri + if not request_uri or request_uri == "" then + kong.log.debug("Skipping WAF inspection - TLS handshake or no URI") + return + end + local headers = kong.request.get_headers() local session_id = nano.generate_session_id() kong.service.request.set_header("x-session-id", tostring(session_id)) @@ -79,6 +86,11 @@ function NanoHandler.access(conf) local result = nano.handle_custom_response(session_data, response) nano.cleanup_all() return result + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) after request headers: ", verdict, " - session will be finalized in log phase") + kong.ctx.plugin.inspection_complete = true + return end if contains_body == 1 then @@ -91,6 +103,11 @@ function NanoHandler.access(conf) local result = nano.handle_custom_response(session_data, response) nano.cleanup_all() return result + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) after request body: ", verdict, " - session will be finalized in log phase") + kong.ctx.plugin.inspection_complete = true + -- Continue to response phase end else kong.log.debug("Request body not in memory, attempting to read from buffer/file") @@ -103,6 +120,11 @@ function NanoHandler.access(conf) nano.fini_session(session_data) kong.ctx.plugin.blocked = true return nano.handle_custom_response(session_data, response) + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) after request body from var: ", verdict, " - session will be finalized in log phase") + kong.ctx.plugin.inspection_complete = true + -- Continue to response phase end else local body_file = ngx.var.request_body_file @@ -122,6 +144,11 @@ function NanoHandler.access(conf) local result = nano.handle_custom_response(session_data, response) nano.cleanup_all() return result + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) after request body from file: ", verdict, " - session will be finalized in log phase") + kong.ctx.plugin.inspection_complete = true + -- Continue to response phase end else kong.log.debug("Empty body file") @@ -150,6 +177,11 @@ function NanoHandler.access(conf) local result = nano.handle_custom_response(session_data, response) nano.cleanup_all() return result + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) at request END: ", verdict, " - session will be finalized in log phase") + kong.ctx.plugin.inspection_complete = true + -- Continue to response phase end else verdict, response = nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_REQUEST_END) @@ -159,6 +191,11 @@ function NanoHandler.access(conf) local result = nano.handle_custom_response(session_data, response) nano.cleanup_all() return result + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) at request END (no body): ", verdict, " - session will be finalized in log phase") + kong.ctx.plugin.inspection_complete = true + -- Continue to response phase end end @@ -172,6 +209,12 @@ function NanoHandler.header_filter(conf) return end + -- Skip if inspection already completed + if ctx.inspection_complete then + kong.log.debug("Inspection already completed, skipping header_filter") + return + end + local session_id = ctx.session_id local session_data = ctx.session_data @@ -186,13 +229,24 @@ function NanoHandler.header_filter(conf) local content_length = tonumber(headers["content-length"]) or 0 local verdict, response = nano.send_response_headers(session_id, session_data, header_data, status_code, content_length) + + kong.log.warn("Response headers verdict: ", verdict, " (INSPECT=", nano.AttachmentVerdict.INSPECT, ", ACCEPT=", nano.AttachmentVerdict.ACCEPT, ", DROP=", nano.AttachmentVerdict.DROP, ")") + + -- Check verdict following Envoy pattern: if verdict != INSPECT, finalize if verdict == nano.AttachmentVerdict.DROP then kong.ctx.plugin.blocked = true nano.fini_session(session_data) nano.cleanup_all() return nano.handle_custom_response(session_data, response) + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other verdict - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) in header_filter: ", verdict, " - session will be finalized in log phase") + ctx.inspection_complete = true + return end + -- Only reach here if verdict == INSPECT - need to inspect body + kong.log.debug("Got INSPECT verdict - continuing to body_filter") ctx.expect_body = not (status_code == 204 or status_code == 304 or (100 <= status_code and status_code < 200) or content_length == 0) end @@ -203,6 +257,12 @@ function NanoHandler.body_filter(conf) return end + -- Skip if inspection already completed + if ctx.inspection_complete then + kong.log.debug("Inspection already completed, skipping body_filter") + return + end + local session_id = ctx.session_id local session_data = ctx.session_data @@ -219,7 +279,6 @@ function NanoHandler.body_filter(conf) ctx.body_buffer_chunk = 0 ctx.body_filter_start_time = ngx.now() * 1000 end - -- Check timeout (2.5 minutes) local current_time = ngx.now() * 1000 if current_time - ctx.body_filter_start_time > 150000 then @@ -234,7 +293,7 @@ function NanoHandler.body_filter(conf) if chunk and #chunk > 0 then ctx.body_seen = true - -- Wrap in pcall for fail-open behavior + -- Send response body chunk local ok, result = pcall(function() return {nano.send_body(session_id, session_data, chunk, nano.HttpChunkType.HTTP_RESPONSE_BODY)} end) @@ -244,6 +303,8 @@ function NanoHandler.body_filter(conf) local response = result[2] local modifications = result[3] + kong.log.debug("Response body chunk verdict: ", verdict, " (chunk #", ctx.body_buffer_chunk, ")") + if modifications then chunk = nano.handle_body_modifications(chunk, modifications, ctx.body_buffer_chunk) ngx.arg[1] = chunk @@ -251,6 +312,7 @@ function NanoHandler.body_filter(conf) ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1 + -- Following Envoy pattern: check if verdict != INSPECT if verdict == nano.AttachmentVerdict.DROP then nano.fini_session(session_data) local custom_result = nano.handle_custom_response(session_data, response) @@ -258,18 +320,23 @@ function NanoHandler.body_filter(conf) ctx.session_id = nil ctx.session_data = nil return custom_result + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - stop inspection but keep session alive until log phase + kong.log.debug("Got final verdict (not INSPECT) during body chunk: ", verdict, " - session will be finalized in log phase") + ctx.inspection_complete = true + return end + -- Continue if verdict == INSPECT else - -- Nano failed - finalize session and pass through kong.log.warn("nano.send_body failed, failing open: ", tostring(result)) - nano.fini_session(session_data) - nano.cleanup_all() - ctx.session_id = nil - ctx.session_data = nil + -- Continue processing, fail open end end + -- Handle EOF - this is where we signal end of transaction and get final verdict if eof or (ctx.expect_body == false and not ctx.body_seen) then + kong.log.debug("Reached EOF, sending RESPONSE_END signal") + local ok, result = pcall(function() return {nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_RESPONSE_END)} end) @@ -278,6 +345,9 @@ function NanoHandler.body_filter(conf) local verdict = result[1] local response = result[2] + kong.log.debug("Response END verdict: ", verdict) + + -- Following Envoy pattern: check verdict after RESPONSE_END if verdict == nano.AttachmentVerdict.DROP then nano.fini_session(session_data) local custom_result = nano.handle_custom_response(session_data, response) @@ -285,10 +355,33 @@ function NanoHandler.body_filter(conf) ctx.session_id = nil ctx.session_data = nil return custom_result + elseif verdict ~= nano.AttachmentVerdict.INSPECT then + -- ACCEPT or other - mark inspection complete, finalize in log phase + kong.log.debug("Got final verdict at EOF: ", verdict, " - session will be finalized in log phase") + ctx.inspection_complete = true + return end + -- If still INSPECT (shouldn't happen at EOF, but handle gracefully) + kong.log.warn("Got INSPECT verdict at EOF - this is unexpected, finalizing anyway") + else + kong.log.warn("nano.end_inspection failed, failing open: ", tostring(result)) end - nano.fini_session(session_data) + -- Mark inspection complete, actual cleanup in log phase + ctx.inspection_complete = true + end +end + +-- log phase - equivalent to Envoy's OnDestroy +-- This is called when the last response byte has been sent to the client +function NanoHandler.log(conf) + kong.log.err("4-44444444444444444444-------------------------------------------------------------------------------------------------------------------------------------------------") + local ctx = kong.ctx.plugin + + -- Clean up session data if it exists + if ctx.session_data then + kong.log.debug("log phase: cleaning up session") + nano.fini_session(ctx.session_data) nano.cleanup_all() ctx.session_id = nil ctx.session_data = nil