github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-12-31 13:49:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

envoy functionality...

Browse Source
This commit is contained in:
wiaamm
2025-11-30 14:17:02 +02:00
parent 802ee62e3c
commit 2759091364
1 changed files with 101 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

109
attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua
View File

@@ -43,6 +43,13 @@ function NanoHandler.access(conf)
return return
end end
-- Skip TLS/SSL handshake and certificate phase requests (no HTTP data yet)
local request_uri = ngx.var.request_uri
if not request_uri or request_uri == "" then
kong.log.debug("Skipping WAF inspection - TLS handshake or no URI")
return
end
local headers = kong.request.get_headers() local headers = kong.request.get_headers()
local session_id = nano.generate_session_id() local session_id = nano.generate_session_id()
kong.service.request.set_header("x-session-id", tostring(session_id)) kong.service.request.set_header("x-session-id", tostring(session_id))
@@ -79,6 +86,11 @@ function NanoHandler.access(conf)
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.cleanup_all() nano.cleanup_all()
return result return result
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) after request headers: ", verdict, " - session will be finalized in log phase")
kong.ctx.plugin.inspection_complete = true
return
end end
if contains_body == 1 then if contains_body == 1 then
@@ -91,6 +103,11 @@ function NanoHandler.access(conf)
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.cleanup_all() nano.cleanup_all()
return result return result
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) after request body: ", verdict, " - session will be finalized in log phase")
kong.ctx.plugin.inspection_complete = true
-- Continue to response phase
end end
else else
kong.log.debug("Request body not in memory, attempting to read from buffer/file") kong.log.debug("Request body not in memory, attempting to read from buffer/file")
@@ -103,6 +120,11 @@ function NanoHandler.access(conf)
nano.fini_session(session_data) nano.fini_session(session_data)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
return nano.handle_custom_response(session_data, response) return nano.handle_custom_response(session_data, response)
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) after request body from var: ", verdict, " - session will be finalized in log phase")
kong.ctx.plugin.inspection_complete = true
-- Continue to response phase
end end
else else
local body_file = ngx.var.request_body_file local body_file = ngx.var.request_body_file
@@ -122,6 +144,11 @@ function NanoHandler.access(conf)
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.cleanup_all() nano.cleanup_all()
return result return result
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) after request body from file: ", verdict, " - session will be finalized in log phase")
kong.ctx.plugin.inspection_complete = true
-- Continue to response phase
end end
else else
kong.log.debug("Empty body file") kong.log.debug("Empty body file")
@@ -150,6 +177,11 @@ function NanoHandler.access(conf)
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.cleanup_all() nano.cleanup_all()
return result return result
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) at request END: ", verdict, " - session will be finalized in log phase")
kong.ctx.plugin.inspection_complete = true
-- Continue to response phase
end end
else else
verdict, response = nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_REQUEST_END) verdict, response = nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_REQUEST_END)
@@ -159,6 +191,11 @@ function NanoHandler.access(conf)
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.cleanup_all() nano.cleanup_all()
return result return result
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) at request END (no body): ", verdict, " - session will be finalized in log phase")
kong.ctx.plugin.inspection_complete = true
-- Continue to response phase
end end
end end
@@ -172,6 +209,12 @@ function NanoHandler.header_filter(conf)
return return
end end
-- Skip if inspection already completed
if ctx.inspection_complete then
kong.log.debug("Inspection already completed, skipping header_filter")
return
end
local session_id = ctx.session_id local session_id = ctx.session_id
local session_data = ctx.session_data local session_data = ctx.session_data
@@ -186,13 +229,24 @@ function NanoHandler.header_filter(conf)
local content_length = tonumber(headers["content-length"]) or 0 local content_length = tonumber(headers["content-length"]) or 0
local verdict, response = nano.send_response_headers(session_id, session_data, header_data, status_code, content_length) local verdict, response = nano.send_response_headers(session_id, session_data, header_data, status_code, content_length)
kong.log.warn("Response headers verdict: ", verdict, " (INSPECT=", nano.AttachmentVerdict.INSPECT, ", ACCEPT=", nano.AttachmentVerdict.ACCEPT, ", DROP=", nano.AttachmentVerdict.DROP, ")")
-- Check verdict following Envoy pattern: if verdict != INSPECT, finalize
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
nano.fini_session(session_data) nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
return nano.handle_custom_response(session_data, response) return nano.handle_custom_response(session_data, response)
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other verdict - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) in header_filter: ", verdict, " - session will be finalized in log phase")
ctx.inspection_complete = true
return
end end
-- Only reach here if verdict == INSPECT - need to inspect body
kong.log.debug("Got INSPECT verdict - continuing to body_filter")
ctx.expect_body = not (status_code == 204 or status_code == 304 or (100 <= status_code and status_code < 200) or content_length == 0) ctx.expect_body = not (status_code == 204 or status_code == 304 or (100 <= status_code and status_code < 200) or content_length == 0)
end end
@@ -203,6 +257,12 @@ function NanoHandler.body_filter(conf)
return return
end end
-- Skip if inspection already completed
if ctx.inspection_complete then
kong.log.debug("Inspection already completed, skipping body_filter")
return
end
local session_id = ctx.session_id local session_id = ctx.session_id
local session_data = ctx.session_data local session_data = ctx.session_data
@@ -219,7 +279,6 @@ function NanoHandler.body_filter(conf)
ctx.body_buffer_chunk = 0 ctx.body_buffer_chunk = 0
ctx.body_filter_start_time = ngx.now() * 1000 ctx.body_filter_start_time = ngx.now() * 1000
end end
-- Check timeout (2.5 minutes) -- Check timeout (2.5 minutes)
local current_time = ngx.now() * 1000 local current_time = ngx.now() * 1000
if current_time - ctx.body_filter_start_time > 150000 then if current_time - ctx.body_filter_start_time > 150000 then
@@ -234,7 +293,7 @@ function NanoHandler.body_filter(conf)
if chunk and #chunk > 0 then if chunk and #chunk > 0 then
ctx.body_seen = true ctx.body_seen = true
-- Wrap in pcall for fail-open behavior -- Send response body chunk
local ok, result = pcall(function() local ok, result = pcall(function()
return {nano.send_body(session_id, session_data, chunk, nano.HttpChunkType.HTTP_RESPONSE_BODY)} return {nano.send_body(session_id, session_data, chunk, nano.HttpChunkType.HTTP_RESPONSE_BODY)}
end) end)
@@ -244,6 +303,8 @@ function NanoHandler.body_filter(conf)
local response = result[2] local response = result[2]
local modifications = result[3] local modifications = result[3]
kong.log.debug("Response body chunk verdict: ", verdict, " (chunk #", ctx.body_buffer_chunk, ")")
if modifications then if modifications then
chunk = nano.handle_body_modifications(chunk, modifications, ctx.body_buffer_chunk) chunk = nano.handle_body_modifications(chunk, modifications, ctx.body_buffer_chunk)
ngx.arg[1] = chunk ngx.arg[1] = chunk
@@ -251,6 +312,7 @@ function NanoHandler.body_filter(conf)
ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1 ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1
-- Following Envoy pattern: check if verdict != INSPECT
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data) nano.fini_session(session_data)
local custom_result = nano.handle_custom_response(session_data, response) local custom_result = nano.handle_custom_response(session_data, response)
@@ -258,18 +320,23 @@ function NanoHandler.body_filter(conf)
ctx.session_id = nil ctx.session_id = nil
ctx.session_data = nil ctx.session_data = nil
return custom_result return custom_result
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - stop inspection but keep session alive until log phase
kong.log.debug("Got final verdict (not INSPECT) during body chunk: ", verdict, " - session will be finalized in log phase")
ctx.inspection_complete = true
return
end end
-- Continue if verdict == INSPECT
else else
-- Nano failed - finalize session and pass through
kong.log.warn("nano.send_body failed, failing open: ", tostring(result)) kong.log.warn("nano.send_body failed, failing open: ", tostring(result))
nano.fini_session(session_data) -- Continue processing, fail open
nano.cleanup_all()
ctx.session_id = nil
ctx.session_data = nil
end end
end end
-- Handle EOF - this is where we signal end of transaction and get final verdict
if eof or (ctx.expect_body == false and not ctx.body_seen) then if eof or (ctx.expect_body == false and not ctx.body_seen) then
kong.log.debug("Reached EOF, sending RESPONSE_END signal")
local ok, result = pcall(function() local ok, result = pcall(function()
return {nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_RESPONSE_END)} return {nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_RESPONSE_END)}
end) end)
@@ -278,6 +345,9 @@ function NanoHandler.body_filter(conf)
local verdict = result[1] local verdict = result[1]
local response = result[2] local response = result[2]
kong.log.debug("Response END verdict: ", verdict)
-- Following Envoy pattern: check verdict after RESPONSE_END
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data) nano.fini_session(session_data)
local custom_result = nano.handle_custom_response(session_data, response) local custom_result = nano.handle_custom_response(session_data, response)
@@ -285,10 +355,33 @@ function NanoHandler.body_filter(conf)
ctx.session_id = nil ctx.session_id = nil
ctx.session_data = nil ctx.session_data = nil
return custom_result return custom_result
elseif verdict ~= nano.AttachmentVerdict.INSPECT then
-- ACCEPT or other - mark inspection complete, finalize in log phase
kong.log.debug("Got final verdict at EOF: ", verdict, " - session will be finalized in log phase")
ctx.inspection_complete = true
return
end end
-- If still INSPECT (shouldn't happen at EOF, but handle gracefully)
kong.log.warn("Got INSPECT verdict at EOF - this is unexpected, finalizing anyway")
else
kong.log.warn("nano.end_inspection failed, failing open: ", tostring(result))
end end
nano.fini_session(session_data) -- Mark inspection complete, actual cleanup in log phase
ctx.inspection_complete = true
end
end
-- log phase - equivalent to Envoy's OnDestroy
-- This is called when the last response byte has been sent to the client
function NanoHandler.log(conf)
kong.log.err("4-44444444444444444444-------------------------------------------------------------------------------------------------------------------------------------------------")
local ctx = kong.ctx.plugin
-- Clean up session data if it exists
if ctx.session_data then
kong.log.debug("log phase: cleaning up session")
nano.fini_session(ctx.session_data)
nano.cleanup_all() nano.cleanup_all()
ctx.session_id = nil ctx.session_id = nil
ctx.session_data = nil ctx.session_data = nil