diff --git a/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua b/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua index 6ad3106..b408cef 100755 --- a/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua +++ b/attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua @@ -80,14 +80,13 @@ function NanoHandler.access(conf) kong.log.err("DROP verdict in access/send_data - session_id: ", session_id) kong.ctx.plugin.blocked = true kong.ctx.plugin.inspection_complete = true - local result = nano.handle_custom_response(session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(session_data) kong.ctx.plugin.session_id = nil kong.ctx.plugin.session_data = nil - return result + return end if contains_body == 1 then @@ -98,14 +97,13 @@ function NanoHandler.access(conf) kong.log.err("DROP verdict in access/send_body (raw) - session_id: ", session_id) kong.ctx.plugin.blocked = true kong.ctx.plugin.inspection_complete = true - local result = nano.handle_custom_response(session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(session_data) kong.ctx.plugin.session_id = nil kong.ctx.plugin.session_data = nil - return result + return end -- Free body from memory after sending body = nil @@ -121,14 +119,13 @@ function NanoHandler.access(conf) kong.log.err("DROP verdict in access/send_body (var) - session_id: ", session_id) kong.ctx.plugin.blocked = true kong.ctx.plugin.inspection_complete = true - local result = nano.handle_custom_response(session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(session_data) kong.ctx.plugin.session_id = nil kong.ctx.plugin.session_data = nil - return result + return end -- Free body_data from memory body_data = nil @@ -149,14 +146,13 @@ function NanoHandler.access(conf) kong.log.err("DROP verdict in access/send_body (file) - session_id: ", session_id) kong.ctx.plugin.blocked = true kong.ctx.plugin.inspection_complete = true - local result = nano.handle_custom_response(session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(session_data) kong.ctx.plugin.session_id = nil kong.ctx.plugin.session_data = nil - return result + return end -- Free entire_body from memory entire_body = nil @@ -192,14 +188,13 @@ function NanoHandler.access(conf) kong.log.err("DROP verdict in access/end_inspection - session_id: ", session_id) kong.ctx.plugin.blocked = true kong.ctx.plugin.inspection_complete = true - local result = nano.handle_custom_response(session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(session_data) kong.ctx.plugin.session_id = nil kong.ctx.plugin.session_data = nil - return result + return end end @@ -239,14 +234,13 @@ function NanoHandler.header_filter(conf) kong.log.err("DROP verdict in header_filter - session_id: ", ctx.session_id) ctx.blocked = true ctx.inspection_complete = true - local result = nano.handle_custom_response(ctx.session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(ctx.session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(ctx.session_data) ctx.session_id = nil ctx.session_data = nil - return result + return elseif verdict == nano.AttachmentVerdict.ACCEPT then kong.log.debug("ACCEPT verdict in header_filter - marking inspection complete") ctx.inspection_complete = true @@ -319,14 +313,13 @@ function NanoHandler.body_filter(conf) kong.log.err("DROP verdict in body_filter/send_body - session_id: ", ctx.session_id) ctx.blocked = true ctx.inspection_complete = true - local result = nano.handle_custom_response(ctx.session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(ctx.session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(ctx.session_data) ctx.session_id = nil ctx.session_data = nil - return result + return elseif verdict == nano.AttachmentVerdict.ACCEPT then -- Final ACCEPT verdict received - mark complete but don't cleanup yet (wait for EOF) kong.log.debug("ACCEPT verdict received - session finalized") @@ -364,14 +357,13 @@ function NanoHandler.body_filter(conf) kong.log.err("DROP verdict in body_filter/end_inspection - session_id: ", ctx.session_id) ctx.blocked = true ctx.inspection_complete = true - local result = nano.handle_custom_response(ctx.session_data, response) - kong.log.err("Block page result: ", result) + nano.handle_custom_response(ctx.session_data, response) -- Free response AFTER using it nano.free_response_immediate(response) nano.fini_session(ctx.session_data) ctx.session_id = nil ctx.session_data = nil - return result + return end else kong.log.err("nano.end_inspection failed: ", tostring(result), " - cleaning up session") diff --git a/attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua b/attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua index 8216297..ea320f2 100755 --- a/attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua +++ b/attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua @@ -90,7 +90,8 @@ function nano.handle_custom_response(session_data, response) if not attachment then kong.log.warn("Cannot handle custom response: Attachment not available for worker ", worker_id, " - failing open") - return kong.response.exit(200, "Request allowed due to attachment unavailability") + kong.response.exit(200, "Request allowed due to attachment unavailability") + return end local response_type = nano_attachment.get_web_response_type(attachment, session_data, response) @@ -103,19 +104,22 @@ function nano.handle_custom_response(session_data, response) code = 403 end kong.log.err("Response code only: ", code) - return kong.response.exit(code, "") + kong.response.exit(code, "") + return end if response_type == nano.WebResponseType.REDIRECT_WEB_RESPONSE then local location = nano_attachment.get_redirect_page(attachment, session_data, response) kong.log.err("Redirect response to: ", location) - return kong.response.exit(307, "", { ["Location"] = location }) + kong.response.exit(307, "", { ["Location"] = location }) + return end local block_page = nano_attachment.get_block_page(attachment, session_data, response) if not block_page then kong.log.err("Failed to retrieve custom block page for session ", session_data) - return kong.response.exit(500, { message = "Internal Server Error" }) + kong.response.exit(500, { message = "Internal Server Error" }) + return end local code = nano_attachment.get_response_code(response) if not code or code < 100 or code > 599 then @@ -123,8 +127,7 @@ function nano.handle_custom_response(session_data, response) code = 403 end kong.log.err("Block page response with code: ", code, ", page length: ", #block_page) - return kong.response.exit(code, block_page, { ["Content-Type"] = "text/html" }) - + kong.response.exit(code, block_page, { ["Content-Type"] = "text/html" }) end