ngx_lua写的应用防火墙
根据一个网友的代码改写的一个应用防火墙
--[[
* waf for goodID
* @author yufei
* @time 2016-06-08
* 在nginx.conf的HTTP中加入
* lua_shared_dict limit 50m;
* lua_shared_dict iplimit 20m;
* lua_shared_dict blockiplimit 5m;
--]]
-------------------------------------------------------------
SecRuleEngine="on" --开启引擎
attacklog = "on" --开启日志
CCDeny="on" --cc攻击开关
CCrate="100/10" --基于接口的计数 次/秒
comCCrate="500/10" --基于域名的计数 次/秒
ipCCrate="800/10" --基于ip的计数 次/秒
logpath = "/data/logs/waflog/" --日志文件路径
-------------------------------------------------
ccdenyrules={"ccdeny1","ccdeny","","","","logon"}
function gethost()
host = ngx.var.host
if host == nil or type(host) ~= "string" then
math.randomseed(os.time())
host = "nohost"..math.random()
end
return host
end
function fail(service)
local host="182.111.111.44"
local phone="177000088888"
local DATE=os.date("%x.%X", os.time())
local service=service
local command=[==[curl -s -v -k -X POST "http://u.s.goodid.com/smg" -d "tpid=11&ip=]==]..host.."&s="..service.."&time="..DATE.."&phone="..phone.."&check=0"
io.popen(command)
end
function denycc(clientdata)
lua_use_default_type = "text/html"
if CCDeny=="on" then
local uri=clientdata[2]
local host = gethost()
CCcount=tonumber(string.match(CCrate,'(.*)/'))
CCseconds=tonumber(string.match(CCrate,'/(.*)'))
ipCCcount=tonumber(string.match(ipCCrate,'(.*)/'))
ipCCseconds=tonumber(string.match(ipCCrate,'/(.*)'))
comCCcount=tonumber(string.match(comCCrate,'(.*)/'))
comCCseconds=tonumber(string.match(comCCrate,'/(.*)'))
local useragent = clientdata[4]
local uid = string.match(useragent,"/.*/(%d+)$")
if tonumber(uid) ~= nil and tonumber(uid) > 0 then
token = clientdata[1]..host..uri.."_"..uid
clientcom = clientdata[1]..host
clientip = clientdata[1]
else
token = clientdata[1]..host..uri
clientcom = clientdata[1]..host
clientip = clientdata[1]
end
local limit = ngx.shared.limit
local iplimit = ngx.shared.iplimit
local blockiplimit = ngx.shared.blockiplimit
local blocklimit = ngx.shared.blocklimit
local comlimit = ngx.shared.comlimit
local blockcomlimit = ngx.shared.blockcomlimit
local req,_=limit:get(token)
local blockreq,_=blocklimit:get(token)
local ipreq,_=iplimit:get(clientip)
local blockipreq,_=blockiplimit:get(clientip)
local comreq,_=comlimit:get(clientcom)
local blockcomreq,_=blockcomlimit:get(clientcom)
local cishu = tostring(req)..tostring(blockreq)..tostring(comreq)..tostring(blockcomreq)..tostring(ipreq)..tostring(blockipreq)
if blockipreq or ipreq then
if blockcomreq or comreq then
if blockreq or req then
if blockipreq or ipreq >= ipCCcount then
rulestype = "ip"
log(ccdenyrules,clientdata,token,cishu,rulestype)
blockiplimit:set(clientip,1,30)
ngx.exit(403)
return true
else
iplimit:incr(clientip,1)
if blockcomreq or comreq >= comCCcount then
rulestype = "com"
log(ccdenyrules,clientdata,token,cishu,rulestype)
blockcomlimit:set(clientcom,1,30)
ngx.exit(403)
return true
else
comlimit:incr(clientcom,1)
if blockreq or req >= CCcount then
rulestype = "uid"
log(ccdenyrules,clientdata,token,cishu,rulestype)
blocklimit:set(token,1,30)
ngx.exit(403)
return true
else
limit:incr(token,1)
end
end
end
else
limit:set(token,1,CCseconds)
end
else
comlimit:set(clientcom,1,comCCseconds)
end
else
iplimit:set(clientip,1,ipCCseconds)
end
end
return false
end
function getheaders()
local header=""
local headerstring = ngx.req.get_headers() or {}
for key, val in pairs(headerstring) do
if type(val) == "table" then
header=header..key..table.concat(val, "")
elseif type(val) == "boolean" then
header=header..key
else
header=header..key..val
end
end
header=tostring(header)
return header
end
function getargs()
local args=""
local argsstring = ngx.req.get_uri_args() or {}
for key,val in pairs(argsstring) do
if type(val) == "table" then
args=args..key..table.concat(val, "")
elseif type(val) == "boolean" then
args=args..key
else
args=args..key..val
end
end
args=tostring(args)
return args
end
function postargs()
ngx.req.read_body()
local post=""
local args, err = ngx.req.get_post_args() or {}
for key, val in pairs(args) do
if type(val) == "table" then
post=post..key..table.concat(val, "")
elseif type(val) == "boolean" then
post=post..key
else
post=post..key..val
end
end
post=tostring(post)
return post
end
function yesorno(data)
if data~=nil then
return data
else
return "unknow"
end
end
function write(logfile,msg)
local fd = io.open(logfile,"ab")
if fd == nil then return end
fd:write(msg)
fd:flush()
fd:close()
end
function log(rules,clientdata,token,cishu,rulestype)
if attacklog then
if rules[6]=="logon" then
local servername=ngx.var.server_name
local nowtime=ngx.var.time_local or "-"
local request=ngx.var.request or "_"
local nowstatus=ngx.var.status or "_"
local bodybyte=ngx.var.body_bytes_sent or "_"
local xforward=ngx.var.http_x_forwarded_for or "_"
line = clientdata[1].."["..nowtime.."]".." \""..request.."\" "..nowstatus.." "..bodybyte.." \""..clientdata[3].."\" \""..clientdata[4].."\" \""..xforward.."\" \""..rulestype.."\" "..token.." " ..cishu.. "\n"
local filename = logpath..'/'..servername.."_"..ngx.today().."_sec.log"
write(filename,line)
end
end
end
function main()
if SecRuleEngine=="on" then
local ip=yesorno(ngx.var.remote_addr)
local uri=yesorno(ngx.var.uri)
local referer=yesorno(ngx.var.http_referer)
local useragent=yesorno(ngx.var.http_user_agent)
local cookie=yesorno(ngx.var.http_cookie)
local method=yesorno(ngx.req.get_method())
local args=""
local post=""
local header=yesorno(getheaders())
--[[
if method=="GET" then
args=yesorno(ngx.unescape_uri(getargs()))
elseif method=="POST" then
post=yesorno(ngx.unescape_uri(postargs()))
else
ngx.exit(403)
end
--]]
clientdata={ip,uri,referer,useragent,cookie,args,post,method,header}
if ip ~= "127.0.0.1" then
if denycc(clientdata) then
else
return
end
end
else
return
end
end
main()