mirror of
https://github.com/openappsec/attachment.git
synced 2025-08-14 05:45:57 +03:00
send the all the body
This commit is contained in:
parent
466abd73bc
commit
a253345eb3
@ -40,10 +40,6 @@ function NanoHandler.access(conf)
|
|||||||
local has_content_length = tonumber(ngx.var.http_content_length) and tonumber(ngx.var.http_content_length) > 0
|
local has_content_length = tonumber(ngx.var.http_content_length) and tonumber(ngx.var.http_content_length) > 0
|
||||||
local contains_body = has_content_length and 1 or 0
|
local contains_body = has_content_length and 1 or 0
|
||||||
|
|
||||||
if has_content_length then
|
|
||||||
kong.log.debug("Request has content-length: ", ngx.var.http_content_length)
|
|
||||||
end
|
|
||||||
|
|
||||||
local verdict, response = nano.send_data(session_id, session_data, meta_data, req_headers, contains_body, nano.HttpChunkType.HTTP_REQUEST_FILTER)
|
local verdict, response = nano.send_data(session_id, session_data, meta_data, req_headers, contains_body, nano.HttpChunkType.HTTP_REQUEST_FILTER)
|
||||||
if verdict == nano.AttachmentVerdict.DROP then
|
if verdict == nano.AttachmentVerdict.DROP then
|
||||||
nano.fini_session(session_data)
|
nano.fini_session(session_data)
|
||||||
@ -85,33 +81,23 @@ function NanoHandler.access(conf)
|
|||||||
kong.log.debug("Reading request body from file: ", body_file)
|
kong.log.debug("Reading request body from file: ", body_file)
|
||||||
local file = io.open(body_file, "rb")
|
local file = io.open(body_file, "rb")
|
||||||
if file then
|
if file then
|
||||||
local chunk_size = 8192 -- 8KB chunks
|
-- Read entire body at once
|
||||||
local chunks_processed = 0
|
local entire_body = file:read("*all")
|
||||||
local total_bytes = 0
|
file:close()
|
||||||
|
|
||||||
while true do
|
if entire_body and #entire_body > 0 then
|
||||||
local chunk = file:read(chunk_size)
|
kong.log.debug("Sending entire body of size ", #entire_body, " bytes to C module")
|
||||||
if not chunk then break end
|
verdict, response = nano.send_body(session_id, session_data, entire_body, nano.HttpChunkType.HTTP_REQUEST_BODY)
|
||||||
|
|
||||||
chunks_processed = chunks_processed + 1
|
|
||||||
total_bytes = total_bytes + #chunk
|
|
||||||
kong.log.debug("Processing body chunk ", chunks_processed, " of size ", #chunk)
|
|
||||||
|
|
||||||
verdict, response = nano.send_body(session_id, session_data, chunk, nano.HttpChunkType.HTTP_REQUEST_BODY)
|
|
||||||
if verdict == nano.AttachmentVerdict.DROP then
|
if verdict == nano.AttachmentVerdict.DROP then
|
||||||
file:close()
|
|
||||||
nano.fini_session(session_data)
|
nano.fini_session(session_data)
|
||||||
kong.ctx.plugin.blocked = true
|
kong.ctx.plugin.blocked = true
|
||||||
local result = nano.handle_custom_response(session_data, response)
|
local result = nano.handle_custom_response(session_data, response)
|
||||||
nano.cleanup_all()
|
nano.cleanup_all()
|
||||||
return result
|
return result
|
||||||
end
|
end
|
||||||
|
else
|
||||||
|
kong.log.debug("Empty body file")
|
||||||
end
|
end
|
||||||
|
|
||||||
file:close()
|
|
||||||
kong.log.debug("Processed ", chunks_processed, " chunks, total bytes: ", total_bytes)
|
|
||||||
else
|
|
||||||
kong.log.err("Failed to open request body file: ", body_file)
|
|
||||||
end
|
end
|
||||||
else
|
else
|
||||||
kong.log.warn("Request body expected but no body data or file available")
|
kong.log.warn("Request body expected but no body data or file available")
|
||||||
|
@ -399,12 +399,11 @@ static int lua_send_body(lua_State *L) {
|
|||||||
|
|
||||||
AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse));
|
AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse));
|
||||||
*res_ptr = SendDataNanoAttachment(attachment, &attachment_data);
|
*res_ptr = SendDataNanoAttachment(attachment, &attachment_data);
|
||||||
|
|
||||||
// Push verdict
|
// Push verdict
|
||||||
lua_pushinteger(L, res_ptr->verdict);
|
lua_pushinteger(L, res_ptr->verdict);
|
||||||
lua_pushlightuserdata(L, res_ptr);
|
lua_pushlightuserdata(L, res_ptr);
|
||||||
|
|
||||||
// Push modifications if they exist
|
|
||||||
if (res_ptr->modifications) {
|
if (res_ptr->modifications) {
|
||||||
lua_pushlightuserdata(L, res_ptr->modifications);
|
lua_pushlightuserdata(L, res_ptr->modifications);
|
||||||
} else {
|
} else {
|
||||||
@ -414,27 +413,22 @@ static int lua_send_body(lua_State *L) {
|
|||||||
return 3;
|
return 3;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Calculate number of chunks (8KB each, like Envoy)
|
|
||||||
const size_t CHUNK_SIZE = 8 * 1024;
|
const size_t CHUNK_SIZE = 8 * 1024;
|
||||||
size_t num_chunks = ((body_len - 1) / CHUNK_SIZE) + 1;
|
size_t num_chunks = ((body_len - 1) / CHUNK_SIZE) + 1;
|
||||||
|
|
||||||
// Limit number of chunks like Envoy
|
|
||||||
if (num_chunks > 10000) {
|
if (num_chunks > 10000) {
|
||||||
num_chunks = 10000;
|
num_chunks = 10000;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Create HttpBody structure
|
|
||||||
HttpBody http_chunks;
|
HttpBody http_chunks;
|
||||||
http_chunks.bodies_count = num_chunks;
|
http_chunks.bodies_count = num_chunks;
|
||||||
|
|
||||||
// Allocate memory for chunks array
|
|
||||||
http_chunks.data = (nano_str_t*)malloc(num_chunks * sizeof(nano_str_t));
|
http_chunks.data = (nano_str_t*)malloc(num_chunks * sizeof(nano_str_t));
|
||||||
if (!http_chunks.data) {
|
if (!http_chunks.data) {
|
||||||
lua_pushstring(L, "Error: Failed to allocate memory for chunks");
|
lua_pushstring(L, "Error: Failed to allocate memory for chunks");
|
||||||
return lua_error(L);
|
return lua_error(L);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Prepare chunks using pointer arithmetic like Envoy
|
|
||||||
for (size_t i = 0; i < num_chunks; i++) {
|
for (size_t i = 0; i < num_chunks; i++) {
|
||||||
nano_str_t* chunk_ptr = (nano_str_t*)((char*)http_chunks.data + (i * sizeof(nano_str_t)));
|
nano_str_t* chunk_ptr = (nano_str_t*)((char*)http_chunks.data + (i * sizeof(nano_str_t)));
|
||||||
size_t chunk_start = i * CHUNK_SIZE;
|
size_t chunk_start = i * CHUNK_SIZE;
|
||||||
@ -444,25 +438,20 @@ static int lua_send_body(lua_State *L) {
|
|||||||
chunk_ptr->len = chunk_len;
|
chunk_ptr->len = chunk_len;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Prepare attachment data
|
|
||||||
AttachmentData attachment_data;
|
AttachmentData attachment_data;
|
||||||
attachment_data.session_id = session_id;
|
attachment_data.session_id = session_id;
|
||||||
attachment_data.session_data = session_data;
|
attachment_data.session_data = session_data;
|
||||||
attachment_data.chunk_type = chunk_type;
|
attachment_data.chunk_type = chunk_type;
|
||||||
attachment_data.data = &http_chunks;
|
attachment_data.data = &http_chunks;
|
||||||
|
|
||||||
// Send all chunks at once
|
|
||||||
AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse));
|
AttachmentVerdictResponse* res_ptr = malloc(sizeof(AttachmentVerdictResponse));
|
||||||
*res_ptr = SendDataNanoAttachment(attachment, &attachment_data);
|
*res_ptr = SendDataNanoAttachment(attachment, &attachment_data);
|
||||||
|
|
||||||
// Free allocated memory
|
|
||||||
free(http_chunks.data);
|
free(http_chunks.data);
|
||||||
|
|
||||||
// Push verdict
|
|
||||||
lua_pushinteger(L, res_ptr->verdict);
|
lua_pushinteger(L, res_ptr->verdict);
|
||||||
lua_pushlightuserdata(L, res_ptr);
|
lua_pushlightuserdata(L, res_ptr);
|
||||||
|
|
||||||
// Push modifications if they exist
|
|
||||||
if (res_ptr->modifications) {
|
if (res_ptr->modifications) {
|
||||||
lua_pushlightuserdata(L, res_ptr->modifications);
|
lua_pushlightuserdata(L, res_ptr->modifications);
|
||||||
} else {
|
} else {
|
||||||
|
@ -86,7 +86,7 @@ end
|
|||||||
function nano.handle_custom_response(session_data, response)
|
function nano.handle_custom_response(session_data, response)
|
||||||
local worker_id = ngx.worker.id()
|
local worker_id = ngx.worker.id()
|
||||||
local attachment = nano.attachments[worker_id]
|
local attachment = nano.attachments[worker_id]
|
||||||
|
|
||||||
if not attachment then
|
if not attachment then
|
||||||
kong.log.warn("Cannot handle custom response: Attachment not available for worker ", worker_id, " - failing open")
|
kong.log.warn("Cannot handle custom response: Attachment not available for worker ", worker_id, " - failing open")
|
||||||
return kong.response.exit(200, "Request allowed due to attachment unavailability")
|
return kong.response.exit(200, "Request allowed due to attachment unavailability")
|
||||||
|
Loading…
x
Reference in New Issue
Block a user