github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-11-15 17:02:15 +03:00
Code Issues Packages Projects Releases Wiki Activity

fixing multi headers valus issue in kong

Browse Source
This commit is contained in:
wiaamm
2025-10-15 13:21:01 +03:00
parent 30b19505ce
commit 64a881fda1
3 changed files with 46 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua
View File

@@ -7,9 +7,8 @@ NanoHandler.PRIORITY = 3000
NanoHandler.VERSION = "1.0.0" NanoHandler.VERSION = "1.0.0"
NanoHandler.sessions = {} NanoHandler.sessions = {}
NanoHandler.processed_requests = {} -- Track processed requests NanoHandler.processed_requests = {}
-- **Handles worker initialization**
function NanoHandler.init_worker() function NanoHandler.init_worker()
nano.init_attachment() nano.init_attachment()
end end
@@ -35,7 +34,11 @@ function NanoHandler.access(conf)
kong.ctx.plugin.session_id = session_id kong.ctx.plugin.session_id = session_id
local meta_data = nano.handle_start_transaction() local meta_data = nano.handle_start_transaction()
if not meta_data then
kong.log.err("Failed to handle start transaction - failing open") kong.log.err("Failed to handle start transaction - failing open")
return
end
local req_headers = nano.handleHeaders(headers) local req_headers = nano.handleHeaders(headers)
local has_content_length = tonumber(ngx.var.http_content_length) and tonumber(ngx.var.http_content_length) > 0 local has_content_length = tonumber(ngx.var.http_content_length) and tonumber(ngx.var.http_content_length) > 0
@@ -62,10 +65,8 @@ function NanoHandler.access(conf)
return result return result
end end
else else
-- Body might be buffered to file, try to read it using nginx variables
kong.log.debug("Request body not in memory, attempting to read from buffer/file") kong.log.debug("Request body not in memory, attempting to read from buffer/file")
-- Try to read the request body using nginx.var
local body_data = ngx.var.request_body local body_data = ngx.var.request_body
if body_data and #body_data > 0 then if body_data and #body_data > 0 then
kong.log.debug("Found request body in nginx var, size: ", #body_data) kong.log.debug("Found request body in nginx var, size: ", #body_data)
@@ -76,13 +77,11 @@ function NanoHandler.access(conf)
return nano.handle_custom_response(session_data, response) return nano.handle_custom_response(session_data, response)
end end
else else
-- Try to read from the temporary file if available
local body_file = ngx.var.request_body_file local body_file = ngx.var.request_body_file
if body_file then if body_file then
kong.log.debug("Reading request body from file: ", body_file) kong.log.debug("Reading request body from file: ", body_file)
local file = io.open(body_file, "rb") local file = io.open(body_file, "rb")
if file then if file then
-- Read entire body at once
local entire_body = file:read("*all") local entire_body = file:read("*all")
file:close() file:close()

69
attachments/kong/plugins/open-appsec-waf-kong-plugin/lua_attachment_wrapper.c
View File

@@ -8,7 +8,6 @@
#define MAX_HEADERS 10000 #define MAX_HEADERS 10000
// Initialize NanoAttachment for worker
static int lua_init_nano_attachment(lua_State *L) { static int lua_init_nano_attachment(lua_State *L) {
int worker_id = luaL_checkinteger(L, 1); int worker_id = luaL_checkinteger(L, 1);
int num_workers = luaL_checkinteger(L, 2); int num_workers = luaL_checkinteger(L, 2);
@@ -70,13 +69,20 @@ static int lua_get_block_page(lua_State *L) {
} }
int offset = 0; int offset = 0;
memcpy(result + offset, page.title_prefix.data, page.title_prefix.len); offset += page.title_prefix.len; memcpy(result + offset, page.title_prefix.data, page.title_prefix.len);
memcpy(result + offset, page.title.data, page.title.len); offset += page.title.len; offset += page.title_prefix.len;
memcpy(result + offset, page.body_prefix.data, page.body_prefix.len); offset += page.body_prefix.len; memcpy(result + offset, page.title.data, page.title.len);
memcpy(result + offset, page.body.data, page.body.len); offset += page.body.len; offset += page.title.len;
memcpy(result + offset, page.uuid_prefix.data, page.uuid_prefix.len); offset += page.uuid_prefix.len; memcpy(result + offset, page.body_prefix.data, page.body_prefix.len);
memcpy(result + offset, page.uuid.data, page.uuid.len); offset += page.uuid.len; offset += page.body_prefix.len;
memcpy(result + offset, page.uuid_suffix.data, page.uuid_suffix.len); offset += page.uuid_suffix.len; memcpy(result + offset, page.body.data, page.body.len);
offset += page.body.len;
memcpy(result + offset, page.uuid_prefix.data, page.uuid_prefix.len);
offset += page.uuid_prefix.len;
memcpy(result + offset, page.uuid.data, page.uuid.len);
offset += page.uuid.len;
memcpy(result + offset, page.uuid_suffix.data, page.uuid_suffix.len);
offset += page.uuid_suffix.len;
result[size] = '\0'; result[size] = '\0';
lua_pushlstring(L, result, size); lua_pushlstring(L, result, size);
@@ -98,7 +104,6 @@ static int lua_get_redirect_page(lua_State *L) {
return 1; return 1;
} }
// Free HttpMetaData memory
static int lua_free_http_metadata(lua_State *L) { static int lua_free_http_metadata(lua_State *L) {
HttpMetaData *metadata = (HttpMetaData *)lua_touserdata(L, 1); HttpMetaData *metadata = (HttpMetaData *)lua_touserdata(L, 1);
if (!metadata) return 0; if (!metadata) return 0;
@@ -117,7 +122,6 @@ static int lua_free_http_metadata(lua_State *L) {
} }
// Allocate memory for nano_str_t (long-lived, must be freed later)
static int lua_createNanoStrAlloc(lua_State *L) { static int lua_createNanoStrAlloc(lua_State *L) {
const char* str = luaL_checkstring(L, 1); const char* str = luaL_checkstring(L, 1);
if (!str) { if (!str) {
@@ -131,11 +135,11 @@ static int lua_createNanoStrAlloc(lua_State *L) {
lua_pushnil(L); lua_pushnil(L);
lua_pushstring(L, "Failed to allocate memory for string"); lua_pushstring(L, "Failed to allocate memory for string");
return 2; return 2;
} }
nano_str_t* nanoStr = (nano_str_t*)malloc(sizeof(nano_str_t)); nano_str_t* nanoStr = (nano_str_t*)malloc(sizeof(nano_str_t));
if (!nanoStr) { if (!nanoStr) {
free(c_str); // Clean up already allocated string free(c_str);
lua_pushnil(L); lua_pushnil(L);
lua_pushstring(L, "Failed to allocate memory for nano_str_t"); lua_pushstring(L, "Failed to allocate memory for nano_str_t");
return 2; return 2;
@@ -148,7 +152,6 @@ static int lua_createNanoStrAlloc(lua_State *L) {
return 1; return 1;
} }
// Free nano_str_t (Memory cleanup)
static int lua_freeNanoStr(lua_State *L) { static int lua_freeNanoStr(lua_State *L) {
nano_str_t* nanoStr = (nano_str_t*)lua_touserdata(L, 1); nano_str_t* nanoStr = (nano_str_t*)lua_touserdata(L, 1);
if (nanoStr) { if (nanoStr) {
@@ -158,8 +161,6 @@ static int lua_freeNanoStr(lua_State *L) {
return 0; return 0;
} }
// Allocate memory for HttpHeaders
// Allocate memory for HttpHeaders
static int lua_allocHttpHeaders(lua_State *L) { static int lua_allocHttpHeaders(lua_State *L) {
size_t max_headers = 10000; size_t max_headers = 10000;
@@ -180,7 +181,6 @@ static int lua_allocHttpHeaders(lua_State *L) {
return 1; return 1;
} }
// Free HttpHeaders memory
static int lua_freeHttpHeaders(lua_State *L) { static int lua_freeHttpHeaders(lua_State *L) {
HttpHeaders* headers = (HttpHeaders*)lua_touserdata(L, 1); HttpHeaders* headers = (HttpHeaders*)lua_touserdata(L, 1);
if (headers) { if (headers) {
@@ -190,7 +190,6 @@ static int lua_freeHttpHeaders(lua_State *L) {
return 0; return 0;
} }
// Set the headers_count in HttpHeaders
static int lua_setHeaderCount(lua_State *L) { static int lua_setHeaderCount(lua_State *L) {
HttpHeaders* headers = (HttpHeaders*)lua_touserdata(L, 1); HttpHeaders* headers = (HttpHeaders*)lua_touserdata(L, 1);
int count = luaL_checkinteger(L, 2); int count = luaL_checkinteger(L, 2);
@@ -203,7 +202,6 @@ static int lua_setHeaderCount(lua_State *L) {
return 0; return 0;
} }
// Helper function to convert Lua string to nano_str_t
static void lua_fill_nano_str(lua_State *L, int index, nano_str_t *nano_str) { static void lua_fill_nano_str(lua_State *L, int index, nano_str_t *nano_str) {
size_t len; size_t len;
const char *str = luaL_checklstring(L, index, &len); const char *str = luaL_checklstring(L, index, &len);
@@ -214,20 +212,18 @@ static void lua_fill_nano_str(lua_State *L, int index, nano_str_t *nano_str) {
return; return;
} }
// Allocate memory + 1 for null termination
nano_str->data = (char *)malloc(len + 1); nano_str->data = (char *)malloc(len + 1);
if (!nano_str->data) { // Check if allocation failed if (!nano_str->data) {
nano_str->len = 0; nano_str->len = 0;
return; return;
} }
memcpy(nano_str->data, str, len); // Copy exact `len` bytes memcpy(nano_str->data, str, len);
nano_str->data[len] = '\0'; // Manually null-terminate nano_str->data[len] = '\0';
nano_str->len = len; nano_str->len = len;
} }
// Set a header element in HttpHeaderData
static int lua_setHeaderElement(lua_State *L) { static int lua_setHeaderElement(lua_State *L) {
HttpHeaders *headers = (HttpHeaders *)lua_touserdata(L, 1); HttpHeaders *headers = (HttpHeaders *)lua_touserdata(L, 1);
int index = luaL_checkinteger(L, 2); int index = luaL_checkinteger(L, 2);
@@ -237,7 +233,6 @@ static int lua_setHeaderElement(lua_State *L) {
return 1; return 1;
} }
// Safely allocate and set header key/value
lua_fill_nano_str(L, 3, &headers->data[index].key); lua_fill_nano_str(L, 3, &headers->data[index].key);
lua_fill_nano_str(L, 4, &headers->data[index].value); lua_fill_nano_str(L, 4, &headers->data[index].value);
@@ -245,7 +240,6 @@ static int lua_setHeaderElement(lua_State *L) {
return 1; return 1;
} }
// Initialize session
static int lua_init_session(lua_State *L) { static int lua_init_session(lua_State *L) {
NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1); NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1);
SessionID session_id = luaL_checkinteger(L, 2); SessionID session_id = luaL_checkinteger(L, 2);
@@ -267,7 +261,6 @@ static int lua_init_session(lua_State *L) {
return 1; return 1;
} }
// Finalize session
static int lua_fini_session(lua_State *L) { static int lua_fini_session(lua_State *L) {
NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1); NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1);
HttpSessionData* session_data = lua_touserdata(L, 2); HttpSessionData* session_data = lua_touserdata(L, 2);
@@ -283,7 +276,6 @@ static int lua_fini_session(lua_State *L) {
return 1; return 1;
} }
// Check if session is finalized
static int lua_is_session_finalized(lua_State *L) { static int lua_is_session_finalized(lua_State *L) {
NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1); NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1);
HttpSessionData* session_data = (HttpSessionData*) lua_touserdata(L, 2); HttpSessionData* session_data = (HttpSessionData*) lua_touserdata(L, 2);
@@ -298,7 +290,6 @@ static int lua_is_session_finalized(lua_State *L) {
return 1; return 1;
} }
// Function to extract request metadata and create HttpMetaData struct
static int lua_create_http_metadata(lua_State *L) { static int lua_create_http_metadata(lua_State *L) {
HttpMetaData *metadata = (HttpMetaData *)malloc(sizeof(HttpMetaData)); HttpMetaData *metadata = (HttpMetaData *)malloc(sizeof(HttpMetaData));
if (!metadata) { if (!metadata) {
@@ -316,41 +307,33 @@ static int lua_create_http_metadata(lua_State *L) {
lua_fill_nano_str(L, 9, &metadata->parsed_host); lua_fill_nano_str(L, 9, &metadata->parsed_host);
lua_fill_nano_str(L, 10, &metadata->parsed_uri); lua_fill_nano_str(L, 10, &metadata->parsed_uri);
// Store pointer in Lua
lua_pushlightuserdata(L, metadata); lua_pushlightuserdata(L, metadata);
return 1; // Return userdata return 1;
} }
// Send data to NanoAttachment
static int lua_send_data(lua_State *L) { static int lua_send_data(lua_State *L) {
// Retrieve function arguments from Lua
NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1); NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1);
SessionID session_id = luaL_checkinteger(L, 2); SessionID session_id = luaL_checkinteger(L, 2);
HttpSessionData *session_data = (HttpSessionData*) lua_touserdata(L, 3); HttpSessionData *session_data = (HttpSessionData*) lua_touserdata(L, 3);
HttpChunkType chunk_type = luaL_checkinteger(L, 4); HttpChunkType chunk_type = luaL_checkinteger(L, 4);
HttpMetaData* meta_data = (HttpMetaData*) lua_touserdata(L, 5); HttpMetaData* meta_data = (HttpMetaData*) lua_touserdata(L, 5);
HttpHeaders* req_headers = (HttpHeaders*) lua_touserdata(L, 6); HttpHeaders* req_headers = (HttpHeaders*) lua_touserdata(L, 6);
int contains_body = luaL_checkinteger(L, 7); // Convert Lua boolean to C int int contains_body = luaL_checkinteger(L, 7);
//int contains_body = 0;
// Validate inputs
if (!attachment || !session_data || !meta_data || !req_headers) { if (!attachment || !session_data || !meta_data || !req_headers) {
lua_pushstring(L, "Error: received NULL data in lua_send_data"); lua_pushstring(L, "Error: received NULL data in lua_send_data");
return lua_error(L); return lua_error(L);
} }
// Allocate memory for HttpRequestFilterData
HttpRequestFilterData *filter_data = (HttpRequestFilterData *)malloc(sizeof(HttpRequestFilterData)); HttpRequestFilterData *filter_data = (HttpRequestFilterData *)malloc(sizeof(HttpRequestFilterData));
if (!filter_data) { if (!filter_data) {
return luaL_error(L, "Memory allocation failed for HttpRequestFilterData"); return luaL_error(L, "Memory allocation failed for HttpRequestFilterData");
} }
// Populate HttpRequestFilterData struct
filter_data->meta_data = meta_data; filter_data->meta_data = meta_data;
filter_data->req_headers = req_headers; filter_data->req_headers = req_headers;
filter_data->contains_body = contains_body; filter_data->contains_body = contains_body;
// Create attachment data
AttachmentData attachment_data; AttachmentData attachment_data;
attachment_data.session_id = session_id; attachment_data.session_id = session_id;
attachment_data.session_data = session_data; attachment_data.session_data = session_data;
@@ -360,7 +343,6 @@ static int lua_send_data(lua_State *L) {
AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse)); AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse));
*res_ptr = SendDataNanoAttachment(attachment, &attachment_data); *res_ptr = SendDataNanoAttachment(attachment, &attachment_data);
// Free allocated memory
free(filter_data); free(filter_data);
lua_pushinteger(L, res_ptr->verdict); lua_pushinteger(L, res_ptr->verdict);
@@ -381,7 +363,6 @@ static int lua_send_body(lua_State *L) {
return lua_error(L); return lua_error(L);
} }
// For small bodies, send as a single chunk
if (body_len <= 8 * 1024) { if (body_len <= 8 * 1024) {
HttpBody http_chunks; HttpBody http_chunks;
http_chunks.bodies_count = 1; http_chunks.bodies_count = 1;
@@ -400,7 +381,6 @@ static int lua_send_body(lua_State *L) {
AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse)); AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse));
*res_ptr = SendDataNanoAttachment(attachment, &attachment_data); *res_ptr = SendDataNanoAttachment(attachment, &attachment_data);
// Push verdict
lua_pushinteger(L, res_ptr->verdict); lua_pushinteger(L, res_ptr->verdict);
lua_pushlightuserdata(L, res_ptr); lua_pushlightuserdata(L, res_ptr);
@@ -478,7 +458,6 @@ static int lua_end_inspection(lua_State *L) {
attachment_data.chunk_type = chunk_type; attachment_data.chunk_type = chunk_type;
attachment_data.data = NULL; attachment_data.data = NULL;
// Send NULL to indicate end of data
AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse)); AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse));
*res_ptr = SendDataNanoAttachment(attachment, &attachment_data); *res_ptr = SendDataNanoAttachment(attachment, &attachment_data);
@@ -488,7 +467,6 @@ static int lua_end_inspection(lua_State *L) {
return 2; return 2;
} }
// Send response headers to NanoAttachment
static int lua_send_response_headers(lua_State *L) { static int lua_send_response_headers(lua_State *L) {
NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1); NanoAttachment* attachment = (NanoAttachment*) lua_touserdata(L, 1);
SessionID session_id = luaL_checkinteger(L, 2); SessionID session_id = luaL_checkinteger(L, 2);
@@ -502,7 +480,6 @@ static int lua_send_response_headers(lua_State *L) {
return lua_error(L); return lua_error(L);
} }
// Create ResHttpHeaders structure exactly as in filter.go
ResHttpHeaders res_headers; ResHttpHeaders res_headers;
res_headers.headers = headers; res_headers.headers = headers;
res_headers.response_code = status_code; res_headers.response_code = status_code;
@@ -521,18 +498,15 @@ static int lua_send_response_headers(lua_State *L) {
return 2; return 2;
} }
// Free verdict response memory
static int lua_free_verdict_response(lua_State *L) { static int lua_free_verdict_response(lua_State *L) {
AttachmentVerdictResponse *response = (AttachmentVerdictResponse *)lua_touserdata(L, 1); AttachmentVerdictResponse *response = (AttachmentVerdictResponse *)lua_touserdata(L, 1);
if (!response) return 0; if (!response) return 0;
// Free the AttachmentVerdictResponse structure
free(response); free(response);
return 0; return 0;
} }
// Register functions in Lua
static const struct luaL_Reg nano_attachment_lib[] = { static const struct luaL_Reg nano_attachment_lib[] = {
{"init_nano_attachment", lua_init_nano_attachment}, {"init_nano_attachment", lua_init_nano_attachment},
{"get_web_response_type", lua_get_web_response_type}, {"get_web_response_type", lua_get_web_response_type},
@@ -558,7 +532,6 @@ static const struct luaL_Reg nano_attachment_lib[] = {
{NULL, NULL} {NULL, NULL}
}; };
// Load library
int luaopen_lua_attachment_wrapper(lua_State *L) { int luaopen_lua_attachment_wrapper(lua_State *L) {
luaL_newlib(L, nano_attachment_lib); luaL_newlib(L, nano_attachment_lib);
return 1; return 1;

72
attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua
View File

@@ -4,16 +4,16 @@ local kong = kong
local nano = {} local nano = {}
nano.session_counter = 0 nano.session_counter = 0
nano.attachments = {} -- Store attachments per worker nano.attachments = {}
nano.num_workers = ngx.worker.count() or 1 -- Detect number of workers nano.num_workers = ngx.worker.count() or 1
nano.allocated_strings = {} nano.allocated_strings = {}
nano.allocate_headers = {} nano.allocate_headers = {}
nano.allocated_metadata = {} -- Track metadata allocations nano.allocated_metadata = {}
nano.allocated_responses = {} -- Track response allocations nano.allocated_responses = {}
nano.AttachmentVerdict = { nano.AttachmentVerdict = {
INSPECT = 0, INSPECT = 0,
ACCEPT = 1, ACCEPT = 1,
DROP = 2, -- Matches `ATTACHMENT_VERDICT_DROP` DROP = 2,
INJECT = 3 INJECT = 3
} }
nano.HttpChunkType = { nano.HttpChunkType = {
@@ -63,8 +63,8 @@ typedef struct __attribute__((__packed__)) HttpInjectData {
} HttpInjectData; } HttpInjectData;
typedef struct NanoHttpModificationList { typedef struct NanoHttpModificationList {
struct NanoHttpModificationList *next; ///< Next node. struct NanoHttpModificationList *next;
HttpInjectData modification; ///< Modification data. HttpInjectData modification;
char *modification_buffer; char *modification_buffer;
} NanoHttpModificationList; } NanoHttpModificationList;
]] ]]
@@ -79,7 +79,6 @@ local NanoHttpModificationListPtr = ffi.typeof("NanoHttpModificationList*")
function nano.generate_session_id() function nano.generate_session_id()
nano.session_counter = nano.session_counter + 1 nano.session_counter = nano.session_counter + 1
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
-- Compose session_id as "<worker_id><counter>", e.g. "20001"
return tonumber(string.format("%d%05d", worker_id, nano.session_counter)) return tonumber(string.format("%d%05d", worker_id, nano.session_counter))
end end
@@ -96,7 +95,6 @@ function nano.handle_custom_response(session_data, response)
if response_type == nano.WebResponseType.RESPONSE_CODE_ONLY then if response_type == nano.WebResponseType.RESPONSE_CODE_ONLY then
local code = nano_attachment.get_response_code(response) local code = nano_attachment.get_response_code(response)
-- Validate HTTP status code
if not code or code < 100 or code > 599 then if not code or code < 100 or code > 599 then
kong.log.warn("Invalid response code received: ", code, " - using 403 instead") kong.log.warn("Invalid response code received: ", code, " - using 403 instead")
code = 403 code = 403
@@ -115,8 +113,7 @@ function nano.handle_custom_response(session_data, response)
kong.log.err("Failed to retrieve custom block page for session ", session_data) kong.log.err("Failed to retrieve custom block page for session ", session_data)
return kong.response.exit(500, { message = "Internal Server Error" }) return kong.response.exit(500, { message = "Internal Server Error" })
end end
local code = nano_attachment.get_response_code(response) -- Get the intended status code local code = nano_attachment.get_response_code(response)
-- Validate HTTP status code
if not code or code < 100 or code > 599 then if not code or code < 100 or code > 599 then
kong.log.warn("Invalid response code received: ", code, " - using 403 instead") kong.log.warn("Invalid response code received: ", code, " - using 403 instead")
code = 403 code = 403
@@ -128,40 +125,36 @@ end
-- Allocates memory (must be freed later)
function nano.create_nano_str_alloc(str) function nano.create_nano_str_alloc(str)
if not str then return nil end if not str then return nil end
local nano_str = nano_attachment.createNanoStrAlloc(str) local nano_str = nano_attachment.createNanoStrAlloc(str)
table.insert(nano.allocated_strings, nano_str) -- Track allocation table.insert(nano.allocated_strings, nano_str)
return nano_str return nano_str
end end
-- Free nano_str_t to prevent memory leaks
function nano.free_nano_str(nano_str) function nano.free_nano_str(nano_str)
if nano_str then if nano_str then
nano_attachment.freeNanoStr(nano_str) nano_attachment.freeNanoStr(nano_str)
end end
end end
-- Free all allocated nano_str_t to prevent memory leaks
function nano.free_all_nano_str() function nano.free_all_nano_str()
for _, nano_str in ipairs(nano.allocated_strings) do for _, nano_str in ipairs(nano.allocated_strings) do
nano_attachment.freeNanoStr(nano_str) -- Free memory in C nano_attachment.freeNanoStr(nano_str)
end end
nano.allocated_strings = {} -- Reset the list nano.allocated_strings = {}
end end
function nano.free_http_headers(header_data) function nano.free_http_headers(header_data)
for _, nano_header in ipairs(nano.allocate_headers) do for _, nano_header in ipairs(nano.allocate_headers) do
nano_attachment.freeHttpHeaders(nano_header) -- Free memory in C nano_attachment.freeHttpHeaders(nano_header)
end end
nano.allocate_headers = {} -- Reset the list nano.allocate_headers = {}
end end
-- Free all allocated metadata
function nano.free_all_metadata() function nano.free_all_metadata()
for _, metadata in ipairs(nano.allocated_metadata) do for _, metadata in ipairs(nano.allocated_metadata) do
nano_attachment.free_http_metadata(metadata) nano_attachment.free_http_metadata(metadata)
@@ -169,7 +162,6 @@ function nano.free_all_metadata()
nano.allocated_metadata = {} nano.allocated_metadata = {}
end end
-- Free all allocated responses
function nano.free_all_responses() function nano.free_all_responses()
for _, response in ipairs(nano.allocated_responses) do for _, response in ipairs(nano.allocated_responses) do
nano_attachment.free_verdict_response(response) nano_attachment.free_verdict_response(response)
@@ -177,7 +169,6 @@ function nano.free_all_responses()
nano.allocated_responses = {} nano.allocated_responses = {}
end end
-- Free all allocations (call this on cleanup)
function nano.cleanup_all() function nano.cleanup_all()
nano.free_all_nano_str() nano.free_all_nano_str()
nano.free_all_metadata() nano.free_all_metadata()
@@ -185,7 +176,6 @@ function nano.cleanup_all()
nano.free_http_headers() nano.free_http_headers()
end end
-- Initialize worker attachment
function nano.init_attachment() function nano.init_attachment()
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
local attachment, err local attachment, err
@@ -194,6 +184,7 @@ function nano.init_attachment()
for attempt = 1, retries do for attempt = 1, retries do
attachment, err = nano_attachment.init_nano_attachment(worker_id, nano.num_workers) attachment, err = nano_attachment.init_nano_attachment(worker_id, nano.num_workers)
if attachment then if attachment then
kong.log.info("Worker ", worker_id, " successfully initialized attachment on attempt ", attempt)
break break
end end
@@ -205,10 +196,10 @@ function nano.init_attachment()
else else
nano.attachments[worker_id] = attachment nano.attachments[worker_id] = attachment
kong.log.info("Worker ", worker_id, " successfully initialized nano_attachment.") kong.log.info("Worker ", worker_id, " successfully initialized nano_attachment.")
return true
end end
end end
-- Initialize a session for a given request
function nano.init_session(session_id) function nano.init_session(session_id)
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
local attachment = nano.attachments[worker_id] local attachment = nano.attachments[worker_id]
@@ -233,7 +224,6 @@ function nano.init_session(session_id)
return session_data return session_data
end end
-- Check if session is finalized
function nano.is_session_finalized(session_data) function nano.is_session_finalized(session_data)
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
local attachment = nano.attachments[worker_id] local attachment = nano.attachments[worker_id]
@@ -246,7 +236,6 @@ function nano.is_session_finalized(session_data)
return nano_attachment.is_session_finalized(attachment, session_data) return nano_attachment.is_session_finalized(attachment, session_data)
end end
-- Extract metadata for request
function nano.handle_start_transaction() function nano.handle_start_transaction()
local stream_info = kong.request local stream_info = kong.request
@@ -274,20 +263,15 @@ function nano.handle_start_transaction()
return metadata return metadata
end end
-- Handle request headers and convert them to nano_str_t
function nano.handleHeaders(headers) function nano.handleHeaders(headers)
local envoy_headers_prefix = "x-envoy"
-- Allocate memory for headers in C
local header_data = nano_attachment.allocHttpHeaders() local header_data = nano_attachment.allocHttpHeaders()
table.insert(nano.allocate_headers, header_data) -- Track allocation table.insert(nano.allocate_headers, header_data)
local index = 0 local index = 0
for key, value in pairs(headers) do for key, value in pairs(headers) do
if index > 10000 then break end if index > 10000 then break end
-- Filter out unwanted headers if key == "x-request-id" or
if key:find("^" .. envoy_headers_prefix) or key == "x-request-id" or
key == ":method" or key == ":path" or key == ":scheme" or key == ":method" or key == ":path" or key == ":scheme" or
key == "x-forwarded-proto" then key == "x-forwarded-proto" then
goto continue goto continue
@@ -303,13 +287,11 @@ function nano.handleHeaders(headers)
::continue:: ::continue::
end end
-- Store the count
nano_attachment.setHeaderCount(header_data, index) nano_attachment.setHeaderCount(header_data, index)
return header_data return header_data
end end
-- Send data to NanoAttachment
function nano.send_data(session_id, session_data, meta_data, header_data, contains_body, chunk_type) function nano.send_data(session_id, session_data, meta_data, header_data, contains_body, chunk_type)
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
local attachment = nano.attachments[worker_id] local attachment = nano.attachments[worker_id]
@@ -319,12 +301,11 @@ function nano.send_data(session_id, session_data, meta_data, header_data, contai
return nano.AttachmentVerdict.INSPECT return nano.AttachmentVerdict.INSPECT
end end
contains_body = tonumber(contains_body) or 0 -- Ensure it's a number contains_body = tonumber(contains_body) or 0
contains_body = (contains_body > 0) and 1 or 0 -- Force strict 0 or 1 contains_body = (contains_body > 0) and 1 or 0
local verdict, response = nano_attachment.send_data(attachment, session_id, session_data, chunk_type, meta_data, header_data, contains_body) local verdict, response = nano_attachment.send_data(attachment, session_id, session_data, chunk_type, meta_data, header_data, contains_body)
-- Track response for cleanup
if response then if response then
table.insert(nano.allocated_responses, response) table.insert(nano.allocated_responses, response)
end end
@@ -341,10 +322,8 @@ function nano.send_body(session_id, session_data, body_chunk, chunk_type)
return nano.AttachmentVerdict.INSPECT return nano.AttachmentVerdict.INSPECT
end end
-- Send the body chunk directly as a string
local verdict, response, modifications = nano_attachment.send_body(attachment, session_id, session_data, body_chunk, chunk_type) local verdict, response, modifications = nano_attachment.send_body(attachment, session_id, session_data, body_chunk, chunk_type)
-- Track response for cleanup
if response then if response then
table.insert(nano.allocated_responses, response) table.insert(nano.allocated_responses, response)
end end
@@ -352,7 +331,6 @@ function nano.send_body(session_id, session_data, body_chunk, chunk_type)
return verdict, response, modifications return verdict, response, modifications
end end
-- Function to inject content into a string at a specific position
function nano.inject_at_position(buffer, injection, pos) function nano.inject_at_position(buffer, injection, pos)
if pos < 0 or pos > #buffer then if pos < 0 or pos > #buffer then
kong.log.err("Invalid injection position: ", pos, ", buffer length: ", #buffer) kong.log.err("Invalid injection position: ", pos, ", buffer length: ", #buffer)
@@ -361,12 +339,10 @@ function nano.inject_at_position(buffer, injection, pos)
return buffer:sub(1, pos) .. injection .. buffer:sub(pos + 1) return buffer:sub(1, pos) .. injection .. buffer:sub(pos + 1)
end end
-- Function to handle body modifications
function nano.handle_body_modifications(body, modifications, body_buffer_chunk) function nano.handle_body_modifications(body, modifications, body_buffer_chunk)
if modifications == nil then if modifications == nil then
return body return body
end end
-- cast the userdata to a pointer
local curr_modification = ffi.cast(NanoHttpModificationListPtr, modifications) local curr_modification = ffi.cast(NanoHttpModificationListPtr, modifications)
while curr_modification ~= nil do while curr_modification ~= nil do
@@ -385,13 +361,11 @@ function nano.handle_body_modifications(body, modifications, body_buffer_chunk)
return body return body
end end
-- Add a new function for handling response bodies
function nano.send_response_body(session_id, session_data, body_chunk) function nano.send_response_body(session_id, session_data, body_chunk)
local verdict, response, modifications = nano.send_body(session_id, session_data, body_chunk, nano.HttpChunkType.HTTP_RESPONSE_BODY) local verdict, response, modifications = nano.send_body(session_id, session_data, body_chunk, nano.HttpChunkType.HTTP_RESPONSE_BODY)
return verdict, response, modifications return verdict, response, modifications
end end
-- Finalize session cleanup
function nano.fini_session(session_data) function nano.fini_session(session_data)
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
local attachment = nano.attachments[worker_id] local attachment = nano.attachments[worker_id]
@@ -406,7 +380,6 @@ function nano.fini_session(session_data)
return true return true
end end
-- Send response headers for inspection
function nano.send_response_headers(session_id, session_data, headers, status_code, content_length) function nano.send_response_headers(session_id, session_data, headers, status_code, content_length)
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
local attachment = nano.attachments[worker_id] local attachment = nano.attachments[worker_id]
@@ -425,7 +398,6 @@ function nano.send_response_headers(session_id, session_data, headers, status_co
content_length content_length
) )
-- Track response for cleanup
if response then if response then
table.insert(nano.allocated_responses, response) table.insert(nano.allocated_responses, response)
end end
@@ -433,7 +405,6 @@ function nano.send_response_headers(session_id, session_data, headers, status_co
return verdict, response return verdict, response
end end
-- Function to handle header modifications
function nano.handle_header_modifications(headers, modifications) function nano.handle_header_modifications(headers, modifications)
if not modifications then if not modifications then
return headers return headers
@@ -469,7 +440,7 @@ function nano.handle_header_modifications(headers, modifications)
kong.log.debug("Injecting into header: ", header_name) kong.log.debug("Injecting into header: ", header_name)
modified_headers[header_name] = nano.inject_at_position(header_value, value, mod.injection_pos) modified_headers[header_name] = nano.inject_at_position(header_value, value, mod.injection_pos)
end end
elseif type == 2 then -- REPLACE elseif type == 2 then
kong.log.debug("Replacing header: ", key) kong.log.debug("Replacing header: ", key)
modified_headers[key] = value modified_headers[key] = value
end end
@@ -480,7 +451,6 @@ function nano.handle_header_modifications(headers, modifications)
return modified_headers return modified_headers
end end
-- End inspection for a session
function nano.end_inspection(session_id, session_data, chunk_type) function nano.end_inspection(session_id, session_data, chunk_type)
local worker_id = ngx.worker.id() local worker_id = ngx.worker.id()
local attachment = nano.attachments[worker_id] local attachment = nano.attachments[worker_id]
@@ -497,7 +467,6 @@ function nano.end_inspection(session_id, session_data, chunk_type)
local verdict, response = nano_attachment.end_inspection(attachment, session_id, session_data, chunk_type) local verdict, response = nano_attachment.end_inspection(attachment, session_id, session_data, chunk_type)
-- Track response for cleanup if allocated
if response then if response then
table.insert(nano.allocated_responses, response) table.insert(nano.allocated_responses, response)
end end
@@ -505,5 +474,4 @@ function nano.end_inspection(session_id, session_data, chunk_type)
return verdict, response return verdict, response
end end
-- Helper function to ensure attachment is available
return nano return nano