diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 44ce7f5..3ce7fdb 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -4,6 +4,8 @@
+
+
@@ -27,9 +29,29 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
@@ -38,8 +60,8 @@
-
-
+
+
@@ -75,6 +97,8 @@
+
+
@@ -86,8 +110,8 @@
DEFINITION_ORDER
-
-
+
+
@@ -144,9 +168,248 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -158,7 +421,7 @@
-
+
@@ -168,20 +431,28 @@
+
+
-
-
+
+
+
+
@@ -232,16 +503,32 @@
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
+
+
diff --git a/config.lua b/config.lua
index 00aaebf..a3b4d48 100644
--- a/config.lua
+++ b/config.lua
@@ -18,9 +18,9 @@ _M.defaults = {
cc_deny_seconds = 600,
cc_deny_code = 404,
log_path = "/tmp/nginx_waf.log",
- ip_white_list = {},
- ip_black_list = {},
- ip_black_code = 403,
+ white_ip_list = {},
+ black_ip_list = {},
+ black_return_code = 403,
}
return _M
diff --git a/core.lua b/core.lua
index 68607a0..2a64bda 100644
--- a/core.lua
+++ b/core.lua
@@ -14,6 +14,7 @@ local get_headers = ngx.req.get_headers
local config = require "config"
local iputils = require "iputils"
local mt = {__index=_M }
+local limit = ngx.shared.limit
local function get_client_ip()
local ip = get_headers()["X-Real-IP"]
@@ -42,6 +43,7 @@ end
function _M.new(self, name)
local t = {}
+ name = name or ""
t["name"] = name
t["config"] = _M.table_copy(config.defaults)
return setmetatable(t, mt)
@@ -58,7 +60,6 @@ function _M.deny_cc(self)
local ip = get_client_ip()
local token = ip..":"..uri
- local limit = ngx.shared.limit
local req, _ = limit:get(token)
if req then
@@ -71,11 +72,9 @@ function _M.deny_cc(self)
end
elseif req == max_visit then
if self.config.active then
- self:log("[Deny_cc] Block " .. token)
ngx.exit(self.config.cc_deny_code)
- else
- self:log("[Deny_cc] FakeBlock " .. token)
end
+ self:log("[Deny_cc] Block "..token)
limit:incr(token, 1)
return true
else
@@ -87,27 +86,34 @@ function _M.deny_cc(self)
end
function _M.log(self, msg)
+ ngx.log(ngx.WARN, self.config.log_path)
if log_inited[self.config.log_path] == nil then
- log_inited[self.config.log_path] = io.open(self.config.log_path, 'ab')
+ log_inited[self.config.log_path] = io.open(self.config.log_path, 'a')
end
self.fd = log_inited[self.config.log_path]
- self.fd:write(msg .. '\n')
+ if self.config.active then
+ self.fd:write(ngx.localtime().." [ACTIVE] ".."["..self.name.."] "..msg..'\n')
+ else
+ self.fd:write(ngx.localtime().." [MONITOR] ".."["..self.name.."] "..msg..'\n')
+ end
self.fd:flush()
end
function _M.in_white_ip_list(self)
local ip = get_client_ip()
- local is_white_token = ip.."white"
- local is_white, _ = limit:get(is_white_token)
+ local white_ip_token = ip.."white"
+ local is_white, _ = limit:get(white_ip_token)
if is_white then
return true
end
+ local white_ip_list = self.config.white_ip_list
if next(white_ip_list) ~= nil then
- local white_ip_list = self.config.white_ip_list
- for _, wip in paris(white_ip_list) do
+ for _, wip in pairs(white_ip_list) do
if ip == wip or iputils.ip_in_cidrs(ip, wip) then
+ limit:set(white_ip_token, true, 3600)
+ self:log("[White_ip] In white list passed: "..ip)
return true
end
end
@@ -116,20 +122,26 @@ function _M.in_white_ip_list(self)
end
function _M.in_black_ip_list(self)
- local limit = ngx.shared.limit
local ip = get_client_ip()
- local is_block_token = ip.."block"
- local is_block, _ = limit:get(is_block_token)
+ local block_ip_token = ip.."block"
+ local is_block, _ = limit:get(block_ip_token)
+
if is_block then
- ngx.exit(self.config.ip_black_code)
+ if self.config.active then
+ ngx.exit(self.config.black_return_code)
+ end
return true
end
- if next(white_ip_list) ~= nil then
- local black_ip_list = self.config.white_ip_list
- for _, bip in paris(black_ip_list) do
+
+ local black_ip_list = self.config.black_ip_list
+ if next(black_ip_list) ~= nil then
+ for _, bip in pairs(black_ip_list) do
if ip == bip or iputils.ip_in_cidrs(ip, bip) then
- limit:set(is_block_token, true, 3600)
- ngx.exit(self.config.ip_black_code)
+ limit:set(block_ip_token, true, 3600)
+ self:log("[Black_ip] In black list denied: "..ip)
+ if self.config.active then
+ ngx.exit(self.config.black_return_code)
+ end
return true
end
end
@@ -139,7 +151,6 @@ function _M.in_black_ip_list(self)
end
function _M.run(self)
- ngx.log(ngx.WARN, 'Start running waf')
if self:in_black_ip_list() then
elseif self:in_white_ip_list() then
elseif self.config.cc_deny and self:deny_cc() then
diff --git a/test.lua b/test.lua
index 480f809..aa42dd3 100644
--- a/test.lua
+++ b/test.lua
@@ -9,7 +9,6 @@
local _M = {}
_M.version = '0.1.1'
-local util = require "resty.waf.util"
local mt = {__index=_M}
@@ -19,23 +18,20 @@ end
local config = {'hello', 'world' }
-local _a = {}
-
-function _M:new()
- return setmetatable({}, mt)
+function _M.new(self, name)
+ name = name or 0
+ return setmetatable({name=name}, mt)
end
-function _M:name()
- local name = {'guang', 'hong', 'wei' }
- name_new = util.table_copy(name)
- print(table.concat(name_new, ','))
+function _M.get_name(self)
+ print(self.name)
end
-function _M.get_version()
- local name = _M.name()
- print(name)
-end
+--function _M.get_version()
+-- local name = _M.name()
+-- print(name)
+--end
-return _a
+return _M
diff --git a/test2.lua b/test2.lua
index 5cdd09d..7514b3a 100644
--- a/test2.lua
+++ b/test2.lua
@@ -7,25 +7,24 @@
--
-local lua_waf = require "core"
-local iputils = require "iputils"
-
+--local lua_waf = require "core"
+local lua_waf = require "test"
local waf = lua_waf:new("test")
-local waf2 = lua_waf:new("jj")
-
-for k, v in pairs(waf["config"]) do
- print(k, v)
-end
-
-waf:set_option("active", true)
-
-for k, v in pairs(waf["config"]) do
- print(k, v)
-end
-print(waf.config.active)
+print(waf.name)
+--for k, v in pairs(waf["config"]) do
+-- print(k, v)
+--end
+--
+--waf:set_option("active", true)
+--
+--for k, v in pairs(waf["config"]) do
+-- pritt(k, v)
+--end
+--print(waf.config.active)
+--
-- waf:deny_cc()
-- waf2:deny_cc()
-waf:log("hello world")
-waf2:log("world")
-print(iputils.ip2bin("192.168.1.1"))
+--waf:log("hello world")
+--waf2:log("world")
+--waf:get_name()