1Panel/plugins/openresty/waf/waf.lua

local geoip = require "geoip"
local lib = require "lib"
local fileUtils = require "file"
local config = require "config"
local cc = require "cc"
local utils = require "utils"
local cjson = require "cjson"

local ipairs = ipairs
local sub_str = string.sub
local find_str = string.find
local split_str = utils.split
local encode = cjson.encode
local read_file2table = fileUtils.read_file2table
local tonumber = tonumber
local date = os.date
local format_str = string.format

local function get_website_key()
    local s_name = ngx.var.server_name
    local website_key = ngx.shared.waf:get(s_name)
    if website_key then
        return website_key
    end
    local websites = read_file2table(config.config_dir .. '/websites.json')
    if not websites then
        return s_name
    end
    for _, v in ipairs(websites)
    do
        for _, domain in ipairs(v['domains'])
        do
            if s_name == domain then
                ngx.shared.waf:set(s_name, v['key'], 3600)
                return v['key']
            end
        end
    end
    if s_name == '_' then
        s_name = "UNKNOWN"
    end
    return s_name
end

local function init()
    local ip = utils.get_real_ip()
    ngx.ctx.ip = ip
    local ua = utils.get_header("user-agent")
    if not ua then
        ua = ""
    end
    ngx.ctx.ua = ua
    geoip.init()

    ngx.ctx.geoip = geoip.lookup(ip)

    local msg = "访问 IP  " .. ip
    if ngx.ctx.geoip.country then
        msg = msg .. " 国家 " .. cjson.encode(ngx.ctx.geoip.country)
    end
    if ngx.ctx.geoip.province then
        msg = msg .. " 省份 " .. cjson.encode(ngx.ctx.geoip.province)
    end
    ngx.log(ngx.ERR, msg)

    ngx.ctx.website_key = get_website_key()
    ngx.ctx.method = ngx.req.get_method()
    ngx.ctx.content_type = utils.get_header("content-type")
    if ngx.ctx.content_type then
        ngx.ctx.content_length = tonumber(utils.get_header("content-length"))
    end
    ngx.ctx.today = date("%Y-%m-%d")
end

local function return_js(js_type)
    ngx.header.content_type = "text/html;charset=utf8"
    ngx.header.Cache_Control = "no-cache"
    local host = ngx.var.scheme .. "://" .. ngx.var.host
    local set_access_url = host .. "/set_access_token"
    local secret = config.get_secret()
    local key = ngx.md5(ngx.ctx.ip .. ngx.var.server_name .. ngx.ctx.website_key
            .. ngx.ctx.ua .. ngx.ctx.today .. secret)
    local value = ngx.md5(ngx.time() .. ngx.ctx.ip)
    local js = config.get_html_res(js_type)
    ngx.say(format_str(js, set_access_url, key, value))
    ngx.status = 200
    ngx.exit(200)
end

local function return_json(data)
    ngx.header.content_type = "application/json;"
    ngx.header.Cache_Control = "no-cache"
    ngx.status = 200
    ngx.say(data)
    ngx.exit(200)
end

local function waf_api()
    local uri = ngx.var.uri
    local prefix = sub_str(uri, 1, 15)
    if find_str(prefix, "/set_access_token") then
        local kvs = split_str(uri, "-")
        if kvs[2] and kvs[3] then
            cc.set_access_token(kvs[2], kvs[3])
        else
            ngx.exit(444)
        end
    end
    if uri == "/slide_check_" .. ngx.md5(ngx.ctx.ip) .. ".js" then
        return_js("slide_js")
    end

    if uri == "/5s_check_" .. ngx.md5(ngx.ctx.ip) .. ".js" then
        return_js("five_second_js")
    end

    if ngx.var.remote_addr ~= '127.0.0.1' then
        return false
    end
    if uri == '/reload_waf_config' then
        config.load_config_file()
        ngx.exit(200)
    end
    if uri == '/get_black_ip' then
        --TODO 从 redis 获取黑名单
        local data = ngx.shared.waf_black_ip:get_keys(0)
        return_json(encode(data))
    end
end

if config.is_waf_on() then
    init()
    waf_api()

    if lib.is_white_ip() then
        return true
    end
    lib.default_ip_black()
    lib.black_ip()

    if lib.is_white_ua() then
        return true
    end
    lib.default_ua_black()
    lib.black_ua()

    lib.cc_url()
    if lib.is_white_url() then
        return true
    end
    lib.black_url()

    lib.allow_location_check()
    lib.acl()
    lib.bot_check()
    lib.method_check()
    lib.cc()
    lib.args_check()
    lib.cookie_check()
    lib.post_check()
    lib.header_check()

end