diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 7cb639e..44ce7f5 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -25,21 +25,21 @@
-
+
-
-
+
+
-
+
-
-
+
+
@@ -48,8 +48,8 @@
-
-
+
+
@@ -74,8 +74,8 @@
@@ -222,26 +222,26 @@
-
-
-
-
-
-
-
-
-
-
+
+
-
-
+
+
+
+
+
+
+
+
+
+
diff --git a/config.lua b/config.lua
index 11327da..00aaebf 100644
--- a/config.lua
+++ b/config.lua
@@ -18,9 +18,9 @@ _M.defaults = {
cc_deny_seconds = 600,
cc_deny_code = 404,
log_path = "/tmp/nginx_waf.log",
- ip_check= true,
- ip_white_list = nil,
- ip_black_list = nil,
+ ip_white_list = {},
+ ip_black_list = {},
+ ip_black_code = 403,
}
return _M
diff --git a/core.lua b/core.lua
index 60006ae..68607a0 100644
--- a/core.lua
+++ b/core.lua
@@ -12,6 +12,7 @@ log_inited = {}
local get_headers = ngx.req.get_headers
local config = require "config"
+local iputils = require "iputils"
local mt = {__index=_M }
local function get_client_ip()
@@ -94,9 +95,54 @@ function _M.log(self, msg)
self.fd:flush()
end
+function _M.in_white_ip_list(self)
+ local ip = get_client_ip()
+ local is_white_token = ip.."white"
+ local is_white, _ = limit:get(is_white_token)
+
+ if is_white then
+ return true
+ end
+
+ if next(white_ip_list) ~= nil then
+ local white_ip_list = self.config.white_ip_list
+ for _, wip in paris(white_ip_list) do
+ if ip == wip or iputils.ip_in_cidrs(ip, wip) then
+ return true
+ end
+ end
+ end
+ return false
+end
+
+function _M.in_black_ip_list(self)
+ local limit = ngx.shared.limit
+ local ip = get_client_ip()
+ local is_block_token = ip.."block"
+ local is_block, _ = limit:get(is_block_token)
+ if is_block then
+ ngx.exit(self.config.ip_black_code)
+ return true
+ end
+ if next(white_ip_list) ~= nil then
+ local black_ip_list = self.config.white_ip_list
+ for _, bip in paris(black_ip_list) do
+ if ip == bip or iputils.ip_in_cidrs(ip, bip) then
+ limit:set(is_block_token, true, 3600)
+ ngx.exit(self.config.ip_black_code)
+ return true
+ end
+ end
+ end
+ return false
+
+end
+
function _M.run(self)
ngx.log(ngx.WARN, 'Start running waf')
- if self.config.cc_deny and self:deny_cc() then
+ if self:in_black_ip_list() then
+ elseif self:in_white_ip_list() then
+ elseif self.config.cc_deny and self:deny_cc() then
end
end