This commit is contained in:
midoks
parent
26a33573fd
commit
7eeec1625b
|
|
@ -4,13 +4,15 @@ local setmetatable = setmetatable
|
|||
local _M = { _VERSION = '0.01' }
|
||||
local mt = { __index = _M }
|
||||
local json = require "cjson"
|
||||
local ngx_match = ngx.re.find
|
||||
|
||||
|
||||
function _M.new(cpath, rpath)
|
||||
function _M.new(cpath, rpath, logdir)
|
||||
-- ngx.log(ngx.ERR,"read:"..cpath..",rpath:"..rpath)
|
||||
local self = {
|
||||
cpath = cpath,
|
||||
rpath = rpath,
|
||||
logdir = logdir,
|
||||
config = '',
|
||||
site_config = ''
|
||||
}
|
||||
|
|
@ -55,6 +57,26 @@ function _M.read_file_body(self, filename)
|
|||
return fbody
|
||||
end
|
||||
|
||||
|
||||
|
||||
function _M.write_file(self, filename, body)
|
||||
fp = io.open(filename,'w')
|
||||
if fp == nil then
|
||||
return nil
|
||||
end
|
||||
fp:write(body)
|
||||
fp:flush()
|
||||
fp:close()
|
||||
return true
|
||||
end
|
||||
|
||||
|
||||
function _M.write_to_file(logstr)
|
||||
local filename = self.logdir .. '/' .. server_name .. '_' .. ngx.today() .. '.log'
|
||||
self:write_file(filename, logstr)
|
||||
return true
|
||||
end
|
||||
|
||||
function _M.continue_key(self,key)
|
||||
key = tostring(key)
|
||||
if string.len(key) > 64 then return false end;
|
||||
|
|
@ -122,6 +144,33 @@ function _M.read_file_table( self, name )
|
|||
end
|
||||
|
||||
|
||||
function _M.inc_log(self, name, rule)
|
||||
local total_path = cpath .. 'total.json'
|
||||
local tbody = ngx.shared.limit:get(total_path)
|
||||
if not tbody then
|
||||
tbody = self:read_file_body(total_path)
|
||||
if not tbody then return false end
|
||||
end
|
||||
local total = json.decode(tbody)
|
||||
if not total['sites'] then total['sites'] = {} end
|
||||
if not total['sites'][server_name] then total['sites'][server_name] = {} end
|
||||
if not total['sites'][server_name][name] then total['sites'][server_name][name] = 0 end
|
||||
if not total['rules'] then total['rules'] = {} end
|
||||
if not total['rules'][name] then total['rules'][name] = 0 end
|
||||
if not total['total'] then total['total'] = 0 end
|
||||
total['total'] = total['total'] + 1
|
||||
total['sites'][server_name][name] = total['sites'][server_name][name] + 1
|
||||
total['rules'][name] = total['rules'][name] + 1
|
||||
local total_log = json.encode(total)
|
||||
if not total_log then return false end
|
||||
ngx.shared.limit:set(total_path,total_log)
|
||||
if not ngx.shared.limit:get('b_btwaf_timeout') then
|
||||
self:write_file(total_path,total_log)
|
||||
ngx.shared.limit:set('b_btwaf_timeout',1,5)
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
---------------------------------------------------
|
||||
|
||||
function _M.get_server_name(self)
|
||||
|
|
@ -145,6 +194,103 @@ function _M.get_server_name(self)
|
|||
end
|
||||
|
||||
|
||||
-- function _M.get_sn(self)
|
||||
-- retun string.gsub(self:get_server_name(),'_','.')
|
||||
-- end
|
||||
|
||||
|
||||
function _M.is_ngx_match(self, rules, sbody, rule_name)
|
||||
ngx.say()
|
||||
if rules == nil or sbody == nil then return false end
|
||||
if type(sbody) == "string" then
|
||||
sbody = {sbody}
|
||||
end
|
||||
|
||||
if type(rules) == "string" then
|
||||
rules = {rules}
|
||||
end
|
||||
|
||||
for k,body in pairs(sbody)
|
||||
do
|
||||
if self:continue_key(k) then
|
||||
for i,rule in ipairs(rules)
|
||||
do
|
||||
ngx.say("i:"..i..",rule:"..rule)
|
||||
if self.site_config[server_name] and rule_name then
|
||||
local n = i - 1
|
||||
for _,j in ipairs(self.site_config[server_name]['disable_rule'][rule_name])
|
||||
do
|
||||
if n == j then
|
||||
rule = ""
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if body and rule ~="" then
|
||||
if type(body) == "string" then
|
||||
if ngx_match(ngx.unescape_uri(body),rule,"isjo") then
|
||||
error_rule = rule .. ' >> ' .. k .. ':' .. body
|
||||
return true
|
||||
end
|
||||
end
|
||||
if type(k) == "string" then
|
||||
if ngx_match(ngx.unescape_uri(k),rule,"isjo") then
|
||||
error_rule = rule .. ' >> ' .. k
|
||||
return true
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
|
||||
function _M.write_log(self, name, rule)
|
||||
ngx.say('name:'..name)
|
||||
local ip = C:get_client_ip()
|
||||
|
||||
|
||||
|
||||
local count,_ = ngx.shared.drop_ip:get(ip)
|
||||
if count then
|
||||
ngx.shared.drop_ip:incr(ip,1)
|
||||
else
|
||||
ngx.shared.drop_ip:set(ip,1,retry_cycle)
|
||||
end
|
||||
if self.config['log'] ~= true or self:is_site_config('log') ~= true then return false end
|
||||
local method = ngx.req.get_method()
|
||||
if error_rule then
|
||||
rule = error_rule
|
||||
error_rule = nil
|
||||
end
|
||||
|
||||
|
||||
local logtmp = {ngx.localtime(), ip, method,request_uri, ngx.var.http_user_agent, name, rule}
|
||||
ngx.say('logtmp:'..logtmp)
|
||||
local logstr = json.encode(logtmp) .. "\n"
|
||||
local count,_ = ngx.shared.drop_ip:get(ip)
|
||||
if count > retry and name ~= 'cc' then
|
||||
local safe_count,_ = ngx.shared.drop_sum:get(ip)
|
||||
if not safe_count then
|
||||
ngx.shared.drop_sum:set(ip,1,86400)
|
||||
safe_count = 1
|
||||
else
|
||||
ngx.shared.drop_sum:incr(ip,1)
|
||||
end
|
||||
local lock_time = retry_time * safe_count
|
||||
if lock_time > 86400 then lock_time = 86400 end
|
||||
logtmp = {ngx.localtime(),ip,method,request_uri,ngx.var.http_user_agent,name,retry_cycle .. '秒以内累计超过'..retry..'次以上非法请求,封锁'.. lock_time ..'秒'}
|
||||
logstr = logstr .. json.encode(logtmp) .. "\n"
|
||||
ngx.shared.drop_ip:set(ip,retry+1,lock_time)
|
||||
self:write_drop_ip('inc',lock_time)
|
||||
end
|
||||
self:write_to_file(logstr)
|
||||
self:inc_log(name,rule)
|
||||
end
|
||||
|
||||
|
||||
function _M.get_client_ip(self)
|
||||
local client_ip = "unknown"
|
||||
if self.site_config[server_name] then
|
||||
|
|
@ -169,6 +315,19 @@ function _M.get_client_ip(self)
|
|||
return client_ip
|
||||
end
|
||||
|
||||
|
||||
function _M.is_site_config(self,cname)
|
||||
if self.site_config[server_name] ~= nil then
|
||||
if cname == 'cc' then
|
||||
return self.site_config[server_name][cname]['open']
|
||||
else
|
||||
return self.site_config[server_name][cname]
|
||||
end
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
|
||||
function _M.t(self)
|
||||
ngx.say(',,,')
|
||||
end
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ local json = require "cjson"
|
|||
local ngx_match = ngx.re.find
|
||||
|
||||
local _C = require "common"
|
||||
local C = _C.new(cpath, rpath)
|
||||
local C = _C.new(cpath, rpath, logdir)
|
||||
|
||||
|
||||
function write_drop_ip(is_drop,drop_time)
|
||||
|
|
@ -22,7 +22,7 @@ function write_drop_ip(is_drop,drop_time)
|
|||
end
|
||||
|
||||
|
||||
ngx.header.content_type = "text/plain"
|
||||
|
||||
|
||||
local config = C:read_file_body_decode(cpath .. 'config.json')
|
||||
local site_config = C:read_file_body_decode(cpath .. 'site.json')
|
||||
|
|
@ -30,10 +30,6 @@ local site_config = C:read_file_body_decode(cpath .. 'site.json')
|
|||
C.setConfData(config, site_config)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
local args_rules = C:read_file_table('args')
|
||||
|
||||
local retry = config['retry']
|
||||
|
|
@ -44,161 +40,12 @@ local server_name = string.gsub(C:get_server_name(),'_','.')
|
|||
|
||||
|
||||
|
||||
|
||||
function is_ngx_match(rules,sbody,rule_name)
|
||||
|
||||
ngx.say(rules)
|
||||
if rules == nil or sbody == nil then return false end
|
||||
if type(sbody) == "string" then
|
||||
sbody = {sbody}
|
||||
end
|
||||
|
||||
if type(rules) == "string" then
|
||||
rules = {rules}
|
||||
end
|
||||
|
||||
for k,body in pairs(sbody)
|
||||
do
|
||||
ngx.say('k:'..k..',body:'..body..tostring(continue_key(k)))
|
||||
if continue_key(k) then
|
||||
ngx.say('ddddd-----dddd')
|
||||
for i,rule in ipairs(rules)
|
||||
do
|
||||
ngx.say('i:'..i..',body:'..rule)
|
||||
if site_config[server_name] and rule_name then
|
||||
local n = i - 1
|
||||
for _,j in ipairs(site_config[server_name]['disable_rule'][rule_name])
|
||||
do
|
||||
if n == j then
|
||||
rule = ""
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if body and rule ~="" then
|
||||
if type(body) == "string" then
|
||||
if ngx_match(ngx.unescape_uri(body),rule,"isjo") then
|
||||
error_rule = rule .. ' >> ' .. k .. ':' .. body
|
||||
return true
|
||||
end
|
||||
end
|
||||
if type(k) == "string" then
|
||||
if ngx_match(ngx.unescape_uri(k),rule,"isjo") then
|
||||
error_rule = rule .. ' >> ' .. k
|
||||
return true
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
function is_site_config(cname)
|
||||
if site_config[server_name] ~= nil then
|
||||
if cname == 'cc' then
|
||||
return site_config[server_name][cname]['open']
|
||||
else
|
||||
return site_config[server_name][cname]
|
||||
end
|
||||
end
|
||||
return true
|
||||
end
|
||||
|
||||
function write_file(filename,body)
|
||||
fp = io.open(filename,'w')
|
||||
if fp == nil then
|
||||
return nil
|
||||
end
|
||||
fp:write(body)
|
||||
fp:flush()
|
||||
fp:close()
|
||||
return true
|
||||
end
|
||||
|
||||
function write_log(name,rule)
|
||||
local count,_ = ngx.shared.drop_ip:get(ip)
|
||||
if count then
|
||||
ngx.shared.drop_ip:incr(ip,1)
|
||||
else
|
||||
ngx.shared.drop_ip:set(ip,1,retry_cycle)
|
||||
end
|
||||
if config['log'] ~= true or is_site_config('log') ~= true then return false end
|
||||
local method = ngx.req.get_method()
|
||||
if error_rule then
|
||||
rule = error_rule
|
||||
error_rule = nil
|
||||
end
|
||||
|
||||
local logtmp = {ngx.localtime(),ip,method,request_uri,ngx.var.http_user_agent,name,rule}
|
||||
local logstr = json.encode(logtmp) .. "\n"
|
||||
local count,_ = ngx.shared.drop_ip:get(ip)
|
||||
if count > retry and name ~= 'cc' then
|
||||
local safe_count,_ = ngx.shared.drop_sum:get(ip)
|
||||
if not safe_count then
|
||||
ngx.shared.drop_sum:set(ip,1,86400)
|
||||
safe_count = 1
|
||||
else
|
||||
ngx.shared.drop_sum:incr(ip,1)
|
||||
end
|
||||
local lock_time = retry_time * safe_count
|
||||
if lock_time > 86400 then lock_time = 86400 end
|
||||
logtmp = {ngx.localtime(),ip,method,request_uri,ngx.var.http_user_agent,name,retry_cycle .. '秒以内累计超过'..retry..'次以上非法请求,封锁'.. lock_time ..'秒'}
|
||||
logstr = logstr .. json.encode(logtmp) .. "\n"
|
||||
ngx.shared.drop_ip:set(ip,retry+1,lock_time)
|
||||
write_drop_ip('inc',lock_time)
|
||||
end
|
||||
write_to_file(logstr)
|
||||
inc_log(name,rule)
|
||||
end
|
||||
|
||||
function inc_log(name,rule)
|
||||
local total_path = cpath .. 'total.json'
|
||||
local tbody = ngx.shared.limit:get(total_path)
|
||||
if not tbody then
|
||||
tbody = C:read_file_body(total_path)
|
||||
if not tbody then return false end
|
||||
end
|
||||
local total = json.decode(tbody)
|
||||
if not total['sites'] then total['sites'] = {} end
|
||||
if not total['sites'][server_name] then total['sites'][server_name] = {} end
|
||||
if not total['sites'][server_name][name] then total['sites'][server_name][name] = 0 end
|
||||
if not total['rules'] then total['rules'] = {} end
|
||||
if not total['rules'][name] then total['rules'][name] = 0 end
|
||||
if not total['total'] then total['total'] = 0 end
|
||||
total['total'] = total['total'] + 1
|
||||
total['sites'][server_name][name] = total['sites'][server_name][name] + 1
|
||||
total['rules'][name] = total['rules'][name] + 1
|
||||
local total_log = json.encode(total)
|
||||
if not total_log then return false end
|
||||
ngx.shared.limit:set(total_path,total_log)
|
||||
if not ngx.shared.limit:get('b_btwaf_timeout') then
|
||||
write_file(total_path,total_log)
|
||||
ngx.shared.limit:set('b_btwaf_timeout',1,5)
|
||||
end
|
||||
end
|
||||
|
||||
function write_to_file(logstr)
|
||||
local filename = logdir .. '/' .. server_name .. '_' .. ngx.today() .. '.log'
|
||||
local fp = io.open(filename,'ab')
|
||||
if fp == nil then return false end
|
||||
fp:write(logstr)
|
||||
fp:flush()
|
||||
fp:close()
|
||||
return true
|
||||
end
|
||||
|
||||
function args()
|
||||
function waf_args()
|
||||
uri_request_args = ngx.req.get_uri_args()
|
||||
ngx.say('123123123----111')
|
||||
if not config['get']['open'] or not is_site_config('get') then return false end
|
||||
ngx.say('123123123----22'..json.encode(uri_request_args))
|
||||
|
||||
if is_ngx_match(args_rules,uri_request_args,'args') then
|
||||
ngx.say('123123123----4')
|
||||
ngx.say(get_html)
|
||||
write_log('args','regular')
|
||||
if not config['get']['open'] or not C:is_site_config('get') then return false end
|
||||
if C:is_ngx_match(args_rules,uri_request_args,'args') then
|
||||
ngx.say('okkkkkooo')
|
||||
C:write_log(ip,'args','regular')
|
||||
C:return_html(config['get']['status'],get_html)
|
||||
return true
|
||||
end
|
||||
|
|
@ -206,12 +53,8 @@ function args()
|
|||
end
|
||||
|
||||
function waf()
|
||||
|
||||
-- server_name = string.gsub(get_server_name(),'_','.')
|
||||
ngx.header.content_type = "text/plain"
|
||||
C:t()
|
||||
-- ngx.say(read_file('args'));
|
||||
-- args()
|
||||
waf_args()
|
||||
C:return_html(200, '11')
|
||||
-- return_message(200, config)
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue