From e3b48f7ae4ccedbe0580a2d19fb22297a4f9f1c2 Mon Sep 17 00:00:00 2001 From: TonyChyi Date: Fri, 22 Jan 2016 12:41:21 +0800 Subject: [PATCH] modify --- README.md | 3 ++ config.lua | 63 ++++++++++------------ init.lua | 126 +++++++++++++++++++++++++++++++++----------- ngx.conf | 2 +- wafconf/args | 6 +++ wafconf/ccrate | 1 + wafconf/cookie | 6 +++ wafconf/ipblacklist | 0 wafconf/ipwhitelist | 1 + wafconf/post | 6 +++ wafconf/user-agent | 2 +- 11 files changed, 149 insertions(+), 67 deletions(-) create mode 100644 wafconf/ccrate create mode 100644 wafconf/ipblacklist create mode 100644 wafconf/ipwhitelist diff --git a/README.md b/README.md index 72b1ed3..b546a7d 100644 --- a/README.md +++ b/README.md @@ -111,6 +111,9 @@ nginx安装路径假设为:/usr/local/nginx/conf/ post是只在post请求过滤的规则 whitelist是白名单，里面的url匹配到不做过滤 user-agent是对user-agent的过滤规则 + ipwhitelist是IP白名单，一行一个IP + ipblacklist是IP黑名单，一行一个IP + ccrate是CC防护的动态规则，修改后生效 默认开启了get和post过滤，需要开启cookie过滤的，编辑waf.lua取消部分--注释即可 diff --git a/config.lua b/config.lua index 1345c69..34d510c 100644 --- a/config.lua +++ b/config.lua @@ -1,45 +1,40 @@ -RulePath = "/usr/local/nginx/conf/waf/wafconf/" +RulePath = "/app/openresty-xwjr/nginx/conf/waf/wafconf/" attacklog = "on" -logdir = "/usr/local/nginx/logs/hack/" +logdir = "/var/log/nginx/hack/" UrlDeny="on" Redirect="on" CookieMatch="on" postMatch="on" whiteModule="on" black_fileExt={"php","jsp"} -ipWhitelist={"127.0.0.1"} -ipBlocklist={"1.0.0.1"} +uriWhitelist={"assets", "ccc"} +path403 = "403" CCDeny="on" -CCrate="100/60" +CCrate="240/60" html=[[ - - -网站防火墙 - + + + + + +