github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-12-31 13:49:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

add collect(stop)

Browse Source
This commit is contained in:
wiaamm
2025-12-06 13:08:40 +02:00
parent de751af7ed
commit b187507406
2 changed files with 50 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua
View File

@@ -77,7 +77,12 @@ function NanoHandler.access(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in access/send_data - session_id: ", session_id) kong.log.err("DROP verdict in access/send_data - session_id: ", session_id)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
return nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all()
kong.ctx.plugin.session_data = nil
kong.ctx.plugin.session_id = nil
return result
end end
if contains_body == 1 then if contains_body == 1 then
@@ -87,7 +92,12 @@ function NanoHandler.access(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in access/send_body (raw) - session_id: ", session_id) kong.log.err("DROP verdict in access/send_body (raw) - session_id: ", session_id)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
return nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all()
kong.ctx.plugin.session_data = nil
kong.ctx.plugin.session_id = nil
return result
end end
-- Free body from memory after sending -- Free body from memory after sending
body = nil body = nil
@@ -102,7 +112,12 @@ function NanoHandler.access(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in access/send_body (var) - session_id: ", session_id) kong.log.err("DROP verdict in access/send_body (var) - session_id: ", session_id)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
return nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all()
kong.ctx.plugin.session_data = nil
kong.ctx.plugin.session_id = nil
return result
end end
-- Free body_data from memory -- Free body_data from memory
body_data = nil body_data = nil
@@ -122,7 +137,12 @@ function NanoHandler.access(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in access/send_body (file) - session_id: ", session_id) kong.log.err("DROP verdict in access/send_body (file) - session_id: ", session_id)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
return nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all()
kong.ctx.plugin.session_data = nil
kong.ctx.plugin.session_id = nil
return result
end end
-- Free entire_body from memory -- Free entire_body from memory
entire_body = nil entire_body = nil
@@ -156,7 +176,12 @@ function NanoHandler.access(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in access/end_inspection - session_id: ", session_id) kong.log.err("DROP verdict in access/end_inspection - session_id: ", session_id)
kong.ctx.plugin.blocked = true kong.ctx.plugin.blocked = true
return nano.handle_custom_response(session_data, response) local result = nano.handle_custom_response(session_data, response)
nano.fini_session(session_data)
nano.cleanup_all()
kong.ctx.plugin.session_data = nil
kong.ctx.plugin.session_id = nil
return result
end end
NanoHandler.processed_requests[session_id] = true NanoHandler.processed_requests[session_id] = true
@@ -166,16 +191,6 @@ function NanoHandler.header_filter(conf)
kong.log.debug("2-HEADER_FILTER PHASE START") kong.log.debug("2-HEADER_FILTER PHASE START")
local ctx = kong.ctx.plugin local ctx = kong.ctx.plugin
-- Cleanup blocked sessions
if ctx.blocked and ctx.session_data then
kong.log.err("Cleaning up blocked session in header_filter: ", ctx.session_id)
nano.fini_session(ctx.session_data)
nano.cleanup_all()
ctx.session_data = nil
ctx.session_id = nil
return
end
if ctx.blocked then if ctx.blocked then
return return
end end
@@ -206,7 +221,12 @@ function NanoHandler.header_filter(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in header_filter - session_id: ", ctx.session_id) kong.log.err("DROP verdict in header_filter - session_id: ", ctx.session_id)
ctx.blocked = true ctx.blocked = true
return nano.handle_custom_response(ctx.session_data, response) local result = nano.handle_custom_response(ctx.session_data, response)
nano.fini_session(ctx.session_data)
nano.cleanup_all()
ctx.session_data = nil
ctx.session_id = nil
return result
elseif verdict == nano.AttachmentVerdict.ACCEPT then elseif verdict == nano.AttachmentVerdict.ACCEPT then
kong.log.debug("ACCEPT verdict in header_filter - marking inspection complete") kong.log.debug("ACCEPT verdict in header_filter - marking inspection complete")
end end
@@ -222,15 +242,6 @@ function NanoHandler.body_filter(conf)
ctx.body_filter_start_time = ngx.now() * 1000 ctx.body_filter_start_time = ngx.now() * 1000
end end
-- Cleanup blocked sessions
if ctx.blocked and ctx.session_data then
kong.log.err("Cleaning up blocked session in body_filter: ", ctx.session_id)
nano.fini_session(ctx.session_data)
nano.cleanup_all()
ctx.session_data = nil
ctx.session_id = nil
end
-- Fast path: skip if already blocked -- Fast path: skip if already blocked
if ctx.blocked then if ctx.blocked then
ngx.arg[1] = nil -- Discard chunk if blocked ngx.arg[1] = nil -- Discard chunk if blocked
@@ -285,7 +296,12 @@ function NanoHandler.body_filter(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in body_filter/send_body - session_id: ", ctx.session_id) kong.log.err("DROP verdict in body_filter/send_body - session_id: ", ctx.session_id)
ctx.blocked = true ctx.blocked = true
return nano.handle_custom_response(ctx.session_data, response) local result = nano.handle_custom_response(ctx.session_data, response)
nano.fini_session(ctx.session_data)
nano.cleanup_all()
ctx.session_data = nil
ctx.session_id = nil
return result
elseif verdict == nano.AttachmentVerdict.ACCEPT then elseif verdict == nano.AttachmentVerdict.ACCEPT then
-- Final ACCEPT verdict received - mark complete but don't cleanup yet (wait for EOF) -- Final ACCEPT verdict received - mark complete but don't cleanup yet (wait for EOF)
kong.log.debug("ACCEPT verdict received - session finalized") kong.log.debug("ACCEPT verdict received - session finalized")
@@ -320,7 +336,12 @@ function NanoHandler.body_filter(conf)
if verdict == nano.AttachmentVerdict.DROP then if verdict == nano.AttachmentVerdict.DROP then
kong.log.err("DROP verdict in body_filter/end_inspection - session_id: ", ctx.session_id) kong.log.err("DROP verdict in body_filter/end_inspection - session_id: ", ctx.session_id)
ctx.blocked = true ctx.blocked = true
return nano.handle_custom_response(ctx.session_data, response) local result = nano.handle_custom_response(ctx.session_data, response)
nano.fini_session(ctx.session_data)
nano.cleanup_all()
ctx.session_data = nil
ctx.session_id = nil
return result
end end
else else
kong.log.err("nano.end_inspection failed: ", tostring(result), " - cleaning up session") kong.log.err("nano.end_inspection failed: ", tostring(result), " - cleaning up session")

2
attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua
View File

@@ -292,6 +292,8 @@ function nano.handle_start_transaction()
table.insert(nano.allocated_metadata, metadata) table.insert(nano.allocated_metadata, metadata)
collectgarbage("stop")
return metadata return metadata
end end