github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-12-31 05:39:07 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix oom

Browse Source
This commit is contained in:
wiaamm
2025-12-02 09:36:21 +02:00
parent 0328ddb046
commit 845138d493
1 changed files with 59 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

88
attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua
View File

@@ -76,10 +76,12 @@ function NanoHandler.access(conf)
local verdict, response = nano.send_data(session_id, session_data, meta_data, req_headers, contains_body, nano.HttpChunkType.HTTP_REQUEST_FILTER) local verdict, response = nano.send_data(session_id, session_data, meta_data, req_headers, contains_body, nano.HttpChunkType.HTTP_REQUEST_FILTER)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return result return result
end end
@@ -88,10 +90,12 @@ function NanoHandler.access(conf)
if body and #body > 0 then if body and #body > 0 then
verdict, response = nano.send_body(session_id, session_data, body, nano.HttpChunkType.HTTP_REQUEST_BODY) verdict, response = nano.send_body(session_id, session_data, body, nano.HttpChunkType.HTTP_REQUEST_BODY)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return result return result
end end
else else
@@ -102,9 +106,13 @@ function NanoHandler.access(conf)
kong.log.err("Found request body in nginx var, size: ", #body_data) kong.log.err("Found request body in nginx var, size: ", #body_data)
verdict, response = nano.send_body(session_id, session_data, body_data, nano.HttpChunkType.HTTP_REQUEST_BODY) verdict, response = nano.send_body(session_id, session_data, body_data, nano.HttpChunkType.HTTP_REQUEST_BODY)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
return nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return result
end end
else else
local body_file = ngx.var.request_body_file local body_file = ngx.var.request_body_file
@@ -119,10 +127,12 @@ function NanoHandler.access(conf)
kong.log.err("Sending entire body of size ", #entire_body, " bytes to C module") kong.log.err("Sending entire body of size ", #entire_body, " bytes to C module")
verdict, response = nano.send_body(session_id, session_data, entire_body, nano.HttpChunkType.HTTP_REQUEST_BODY) verdict, response = nano.send_body(session_id, session_data, entire_body, nano.HttpChunkType.HTTP_REQUEST_BODY)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return result return result
else else
kong.log.err("Empty body file") kong.log.err("Empty body file")
@@ -142,14 +152,18 @@ function NanoHandler.access(conf)
kong.log.err("Error ending request inspection: ", verdict, " - failing open") kong.log.err("Error ending request inspection: ", verdict, " - failing open")
nano.fini_session(session_data) nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return return
end end
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return result return result
end end
end end
@@ -162,14 +176,18 @@ function NanoHandler.access(conf)
kong.log.err("Error ending request inspection (no body): ", verdict, " - failing open") kong.log.err("Error ending request inspection (no body): ", verdict, " - failing open")
nano.fini_session(session_data) nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return return
end end
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
local result = nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
kong.ctx.plugin.session_id = nil
kong.ctx.plugin.session_data = nil
return result return result
end end
end end
@@ -208,6 +226,10 @@ function NanoHandler.header_filter(conf)
if not ok then if not ok then
kong.log.err("2-ERROR in send_response_headers: ", tostring(verdict), " - failing open, skipping response inspection") kong.log.err("2-ERROR in send_response_headers: ", tostring(verdict), " - failing open, skipping response inspection")
ctx.inspection_complete = true ctx.inspection_complete = true
nano.fini_session(session_data)
nano.cleanup_all()
ctx.session_id = nil
ctx.session_data = nil
return return
end end
@@ -215,8 +237,13 @@ function NanoHandler.header_filter(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
ctx.inspection_complete = true
local custom_result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
return nano.handle_custom_response(session_data, response) ctx.session_id = nil
ctx.session_data = nil
return custom_result
end end
kong.log.err("2-Response headers verdict: ", verdict, " - continuing to body_filter (will inspect body chunks)") kong.log.err("2-Response headers verdict: ", verdict, " - continuing to body_filter (will inspect body chunks)")
@@ -256,14 +283,14 @@ function NanoHandler.body_filter(conf)
local elapsed = current_time - ctx.body_filter_start_time local elapsed = current_time - ctx.body_filter_start_time
if elapsed > 150000 then if elapsed > 150000 then
kong.log.err("Body filter timeout exceeded (", elapsed, "ms) - finalizing session") kong.log.err("Body filter timeout exceeded (", elapsed, "ms) - finalizing session")
nano.fini_session(session_data)
nano.cleanup_all()
ctx.session_id = nil
ctx.session_data = nil
kong.log.err("------------------------------------------------------------------------") kong.log.err("------------------------------------------------------------------------")
kong.log.err("SETTING inspection_complete=true in body_filter (TIMEOUT)") kong.log.err("SETTING inspection_complete=true in body_filter (TIMEOUT)")
kong.log.err("------------------------------------------------------------------------") kong.log.err("------------------------------------------------------------------------")
ctx.inspection_complete = true ctx.inspection_complete = true
nano.fini_session(session_data)
nano.cleanup_all()
ctx.session_id = nil
ctx.session_data = nil
goto skip_inspection goto skip_inspection
end end
@@ -291,10 +318,11 @@ function NanoHandler.body_filter(conf)
ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1 ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data)
local custom_result = nano.handle_custom_response(session_data, response)
nano.cleanup_all()
ctx.plugin.blocked = true ctx.plugin.blocked = true
ctx.inspection_complete = true
local custom_result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all()
ctx.session_id = nil ctx.session_id = nil
ctx.session_data = nil ctx.session_data = nil
return custom_result return custom_result
@@ -322,29 +350,31 @@ function NanoHandler.body_filter(conf)
kong.log.err("3-Response END verdict: " .. tostring(verdict)) kong.log.err("3-Response END verdict: " .. tostring(verdict))
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
nano.fini_session(session_data) ctx.plugin.blocked = true
ctx.inspection_complete = true
local custom_result = nano.handle_custom_response(session_data, response) local custom_result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all() nano.cleanup_all()
ctx.session_id = nil ctx.session_id = nil
ctx.session_data = nil ctx.session_data = nil
ctx.plugin.blocked = true
ctx.inspection_complete = true
return custom_result return custom_result
else
-- Normal case: ACCEPT or INSPECT verdict
kong.log.err("------------------------------------------------------------------------")
kong.log.err("SETTING inspection_complete=true in body_filter (EOF processing complete)")
kong.log.err("------------------------------------------------------------------------")
ctx.inspection_complete = true
kong.log.err("EOF reached - finalizing session in body_filter")
nano.fini_session(session_data)
nano.cleanup_all()
ctx.session_id = nil
ctx.session_data = nil
end end
else else
kong.log.err("nano.end_inspection failed, failing open: ", tostring(result)) kong.log.err("nano.end_inspection failed, failing open: ", tostring(result))
ctx.inspection_complete = true
end end
kong.log.err("------------------------------------------------------------------------")
kong.log.err("SETTING inspection_complete=true in body_filter (EOF processing complete)")
kong.log.err("------------------------------------------------------------------------")
ctx.inspection_complete = true
kong.log.err("EOF reached - finalizing session in body_filter")
nano.fini_session(session_data)
nano.cleanup_all()
ctx.session_id = nil
ctx.session_data = nil
end end
::skip_inspection:: ::skip_inspection::