github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-12-31 13:49:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

ready for review

Browse Source
This commit is contained in:
wiaamm
2025-12-14 10:05:09 +02:00
parent aed6c78f9b
commit 425a63177e
2 changed files with 16 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua
View File

@@ -28,7 +28,7 @@ function NanoHandler.access(conf)
ctx.session_data = session_data
ctx.session_id = session_id
if nano.is_session_finalized(session_id) then
kong.log.info("Session has already been inspected, no need for further inspection")
kong.log.debug("Session has already been inspected, no need for further inspection")
return
end
@@ -90,7 +90,7 @@ function NanoHandler.access(conf)
local chunk_count = 0
local start_time = ngx.now()
local timeout_sec = nano.get_request_processing_timeout_sec()
kong.log.err("Request body reading timeout set to ", timeout_sec, " seconds")
kong.log.debug("Request body reading timeout set to ", timeout_sec, " seconds")
while true do
ngx.update_time()
@@ -105,7 +105,7 @@ function NanoHandler.access(conf)
local chunk = file:read(chunk_size)
if not chunk or #chunk == 0 then
kong.log.err("End of request body file reached")
kong.log.debug("End of request body file reached")
break
end
@@ -135,8 +135,8 @@ function NanoHandler.access(conf)
return nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_REQUEST_END)
end)
kong.log.err("Error ending request inspection: ", verdict, " - failing open")
if not ok then
kong.log.err("Error ending request inspection: ", verdict, " - failing open")
ctx.cleanup_needed = true
return
end
@@ -154,15 +154,14 @@ end
function NanoHandler.header_filter(conf)
local ctx = kong.ctx.plugin
if nano.is_session_finalized(ctx.session_data) then
kong.log.err("Session has already been inspected, no need for further inspection")
kong.log.debug("Session has already been inspected, no need for further inspection")
return
end
if ctx.cleanup_needed then
kong.log.err("cleanup in header_filter, passing through")
kong.log.debug("cleanup in header_filter, passing through")
return
end
kong.log.err("header_filter phase started")
local session_id = ctx.session_id
local session_data = ctx.session_data
@@ -183,21 +182,17 @@ function NanoHandler.header_filter(conf)
if verdict ~= nano.AttachmentVerdict.INSPECT then
ctx.cleanup_needed = true
if verdict == nano.AttachmentVerdict.DROP then
kong.log.warn("DROP verdict in header_filter - will replace response in body_filter")
kong.log.debug("DROP verdict in header_filter - will replace response in body_filter")
ctx.blocked = true
ctx.block_response = response
end
return
end
-- Clear Content-Length since we're buffering the response
kong.log.err("Clearing Content-Length header to enable response body buffering, current value: ", tostring(content_length))
ctx.expect_body = not (status_code == 204 or status_code == 304 or (100 <= status_code and status_code < 200) or content_length == 0)
end
function NanoHandler.body_filter(conf)
kong.log.err("Entering body_filter phase")
local ctx = kong.ctx.plugin
local chunk = ngx.arg[1]
local eof = ngx.arg[2]
@@ -207,11 +202,10 @@ function NanoHandler.body_filter(conf)
local session_data = ctx.session_data
if ctx.blocked then
kong.log.err("Sending custom block response in body_filter")
kong.log.debug("Sending custom block response in body_filter")
if ctx.block_response then
kong.log.err("Block response data available, preparing custom response")
kong.log.debug("Block response data available, preparing custom response")
local code, body, headers = nano.get_custom_response_data(session_data, ctx.block_response)
kong.log.info("Replacing response with custom response, code: ", code)
ngx.status = code
for header_name, header_value in pairs(headers) do
@@ -236,38 +230,35 @@ function NanoHandler.body_filter(conf)
end
if nano.is_session_finalized(session_data) then
kong.log.err("Session has already been inspected, no need for further inspection")
kong.log.debug("Session has already been inspected, no need for further inspection")
return
end
if ctx.cleanup_needed then
kong.log.err("cleanup chunk without inspection, passing through")
kong.log.debug("cleanup chunk without inspection, passing through")
return
end
if not ctx.body_filter_start_time then
ctx.body_filter_start_time = ngx.now()
ctx.body_filter_timeout_sec = nano.get_response_processing_timeout_sec()
kong.log.err("vody_filter timeout set to ", ctx.body_filter_timeout_sec, " seconds")
kong.log.debug("body_filter timeout set to ", ctx.body_filter_timeout_sec, " seconds")
end
local elapsed_time = ngx.now() - ctx.body_filter_start_time
if elapsed_time > ctx.body_filter_timeout_sec then
kong.log.warn("Body filter timeout after ", elapsed_time, " seconds - failing open")
ctx.cleanup_needed = true
-- Send buffered chunks before timeout
if ctx.response_buffer and #ctx.response_buffer > 0 then
ngx.arg[1] = table.concat(ctx.response_buffer)
end
return
end
-- Initialize response buffer
if not ctx.response_buffer then
ctx.response_buffer = {}
end
if chunk and #chunk > 0 then
kong.log.err("Processing response body chunk of size ", #chunk, " bytes")
ctx.body_buffer_chunk = ctx.body_buffer_chunk or 0
ctx.body_seen = true
@@ -277,17 +268,14 @@ function NanoHandler.body_filter(conf)
if modifications then
chunk = nano.handle_body_modifications(chunk, modifications, ctx.body_buffer_chunk)
-- Update buffered chunk with modifications
ctx.response_buffer[#ctx.response_buffer] = chunk
end
ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1
if verdict ~= nano.AttachmentVerdict.INSPECT then
kong.log.err("Final verdict for response body chunk: ", verdict)
ctx.cleanup_needed = true
if verdict == nano.AttachmentVerdict.DROP then
kong.log.warn("DROP verdict in body_filter - replacing with custom response")
local code, body, headers = nano.get_custom_response_data(session_data, response)
ngx.status = code
for header_name, header_value in pairs(headers) do
@@ -303,25 +291,18 @@ function NanoHandler.body_filter(conf)
ngx.arg[2] = true
return
else
kong.log.err("ACCEPT verdict in body_filter - flushing buffer and switching to pass-through chucnk :" , ctx.body_buffer_chunk)
local buffered_data = table.concat(ctx.response_buffer)
kong.log.err("Flushing ", #ctx.response_buffer, " buffered chunks (", #buffered_data, " bytes) before switching to pass-through")
ngx.arg[1] = buffered_data
ctx.response_buffer = nil
return
end
end
kong.log.err("Response body chunk of size ", #chunk, " bytes inspected and passed")
-- Don't send chunk yet - hold it in buffer
ngx.arg[1] = ""
return
end
if eof then
kong.log.err("End of response body reached in body_filter, eof=true")
if ctx.body_seen or ctx.expect_body == false then
kong.log.err("Calling end_inspection for response")
local verdict, response = nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_RESPONSE_END)
if verdict ~= nano.AttachmentVerdict.INSPECT then
kong.log.debug("Final verdict after end_inspection: ", verdict)
@@ -342,23 +323,16 @@ function NanoHandler.body_filter(conf)
end
ngx.arg[2] = true
return
else
-- ACCEPT verdict at EOF
kong.log.err("ACCEPT verdict at EOF - will flush buffered response")
end
end
end
-- Send buffered response (for INSPECT or ACCEPT verdicts)
kong.log.err("Response fully inspected and passed - flushing buffered chunks , total buffered chunks: ", #ctx.response_buffer)
if ctx.response_buffer and #ctx.response_buffer > 0 then
local buffered_data = table.concat(ctx.response_buffer)
kong.log.err("Flushing ", #ctx.response_buffer, " buffered chunks, total size: ", #buffered_data, " bytes")
-- Set Content-Length for the buffered data
ngx.header["Content-Length"] = #buffered_data
ngx.arg[1] = buffered_data
else
kong.log.err("No buffered chunks to flush")
kong.log.debug("No buffered chunks to flush (empty response)")
ngx.header["Content-Length"] = 0
end
ngx.arg[2] = true

10
attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua
View File

@@ -111,7 +111,7 @@ function nano.get_custom_response_data(session_data, response)
local block_page = nano_attachment.get_block_page(attachment, session_data, response)
if not block_page then
kong.log.err("Failed to retrieve custom block page for session ", session_data)
kong.log.debug("Failed to retrieve custom block page for session ", session_data)
return 403, "", {}
end
local code = nano_attachment.get_response_code(response)
@@ -193,7 +193,6 @@ function nano.init_attachment()
if attachment then
break
end
kong.log.err("Worker ", worker_id, " failed to initialize attachment (attempt ", attempt, "/", retries, "): ", err)
end
@@ -235,7 +234,7 @@ function nano.is_session_finalized(session_data)
local attachment = nano.attachments[worker_id]
if not attachment or not session_data then
kong.log.err("Cannot check session finalization: Invalid attachment or session_data")
kong.log.debug("Cannot check session finalization: Invalid attachment or session_data")
return true
end
@@ -264,7 +263,6 @@ function nano.handle_start_transaction()
table.insert(nano.allocated_metadata, metadata)
collectgarbage("stop")
kong.log.err("Generated start transaction metadata: ", metadata)
return metadata
end
@@ -302,8 +300,6 @@ function nano.handleHeaders(headers)
end
nano_attachment.setHeaderCount(header_data, index)
kong.log.err("Processed headers into header_data : ", header_data)
return header_data
end
@@ -476,7 +472,7 @@ function nano.end_inspection(session_id, session_data, chunk_type)
end
if not session_data then
kong.log.err("Cannot end inspection: Invalid session_data for session ", session_id)
kong.log.debug("Cannot end inspection: Invalid session_data for session ", session_id)
return nano.AttachmentVerdict.INSPECT, nil
end