Rename get to urlpath

init.lua

@@ -1,6 +1,6 @@
 --配置部分
 logpath='/data/logs/hack/'
-rulepath='/usr/local/nginx/conf/wafconf/'
+rulepath='/usr/local/openresty/nginx/conf/ngx_lua_waf/wafconf/'
 syslogserver='127.0.0.1'
 filext=''
 --如果需要开启syslog传输，请取消掉log函数部分的注释
@@ -21,10 +21,10 @@ local O_APPEND = 0x0400;
 local S_IRUSR = 0x0100;
 local S_IWUSR = 0x0080;
 function write(logfile,msg)
-            local logger_fd = C.open(logfile, bor(O_RDWR, O_CREAT, O_APPEND), bor(S_IRUSR,S_IWUSR));
+    local logger_fd = C.open(logfile, bor(O_RDWR, O_CREAT, O_APPEND), bor(S_IRUSR,S_IWUSR));
-            local c = msg;
+    local c = msg;
-            C.write(logger_fd, c, #c);
+    C.write(logger_fd, c, #c);
-            C.close(logger_fd)
+    C.close(logger_fd)
 end
 function syslog(msg)
     ngx.header.content_type = "text/html"
@@ -59,56 +59,97 @@ function syslog(msg)
     debug = 7
 
 
-local sock = ngx.socket.udp()
+    local sock = ngx.socket.udp()
-local ok, err = sock:setpeername(syslogserver, 514)
+    local ok, err = sock:setpeername(syslogserver, 514)
---上面的ip和端口就是syslog server的ip和端口地址，可自行修改
+    --上面的ip和端口就是syslog server的ip和端口地址，可自行修改
-if not ok then
+    if not ok then
-    ngx.say("failed to connect to syslog server: ", err)
+        ngx.say("failed to connect to syslog server: ", err)
-    return
+        return
-end
-level=info
-facility=daemon
-sign=level+facility*8
-ok, err = sock:send('<'..sign..'>'..msg)
-sock:close()
-end
-function log(method,url,data)
-    if data then
-      if ngx.var.http_user_agent  then
-  --		syslog(ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \""..data.."\" \""..ngx.status.."\" \""..ngx.var.http_user_agent.."\"\n")
-			write(logpath..'/'..ngx.var.server_name.."_sec.log",ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \""..data.."\" \""..ngx.status.."\" \""..ngx.var.http_user_agent.."\"\n")
-      else
-	--		syslog(ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \""..data.."\" \"-\"\n")
-			write(logpath..'/'..ngx.var.server_name.."_sec.log",ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \""..data.."\" \"-\"\n")
-      end
-    else
-        if ngx.var.http_user_agent  then
-          --  syslog(ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \"-\" \""..ngx.var.http_user_agent.."\"\n")
-            write(logpath..'/'..ngx.var.server_name.."_sec.log",ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \"-\" \""..ngx.var.http_user_agent.."\"\n")
-        else
-	--		syslog(ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \"-\" \"".."-\"\n")
-			write(logpath..'/'..ngx.var.server_name.."_sec.log",ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \"-\" \"".."-\"\n")
-        end
     end
+    level=info
+    facility=daemon
+    sign=level+facility*8
+    ok, err = sock:send('<'..sign..'>'..msg)
+    sock:close()
 end
---------------------------------------响应函数--------------------------------------------------------------------------------
+function log()
-function check()
+    if ngx.var.http_user_agent  then
-    ngx.header.content_type = "text/html"
+        --  syslog(ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \"-\" \""..ngx.var.http_user_agent.."\"\n")
-    ngx.print("just a joke hehe~ !!")
+        write(logpath..'/'..ngx.var.server_name.."_sec.log",ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..ngx.req.get_method().." "..ngx.var.request_uri.."\" \"-\" \""..ngx.var.http_user_agent.."\"\n")
-    ngx.exit(200)
+    else
+        --		syslog(ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..method.." "..url.."\" \"-\" \"".."-\"\n")
+        write(logpath..'/'..ngx.var.server_name.."_sec.log",ngx.var.remote_addr.." ".." ["..ngx.localtime().."] \""..ngx.req.get_method().." "..ngx.var.request_uri.."\" \"-\" \"".."-\"\n")
+    end
 end
 ------------------------------------规则读取函数-------------------------------------------------------------------
-function read_rule(var)
+function getrule(method,dict)    
-    file = io.open(rulepath..'/'..var,"r")
+    local waf = dict;
+    file = io.open(rulepath..'/'..method,"r")
     t = {}
     for line in file:lines() do
-        table.insert(t,line)
+        waf.set(waf,line,true)
     end
     file:close()
-    return(table.concat(t,"|"))
 end
-regex=read_rule('global')
+local update = ngx.shared.update;
-get=read_rule('get')
+local updated_at = update:get("updated_at");
-post=read_rule('post')
+if updated_at == nil or updated_at < ( ngx.now() - 10 ) then
-agent=read_rule('user-agent')
+    getrule('urlpath',ngx.shared.urlpath)
-whitelist=read_rule('whitelist')
+    getrule('post',ngx.shared.post)
+    getrule('user-agent',ngx.shared.ua)
+    getrule('args',ngx.shared.args)
+
+else
+    update:set("updated_at", ngx.now());
+end
+function say_html(ruleid)
+    ngx.header.content_type = "text/html"
+    ngx.say('Please go away~~~')
+    log()
+    ngx.exit(200)
+end
+function args()
+    for k,v in pairs(ngx.shared.args:get_keys()) do
+        local args = ngx.req.get_uri_args()
+        for key, val in pairs(args) do
+            if ngx.re.match(val,v,"isjo") then
+                say_html(k)
+                log('GET')
+                return true
+            end
+        end
+    end
+    return false
+end
+
+function url()
+    for k,v in pairs(ngx.shared.urlpath:get_keys()) do
+        if ngx.re.match(ngx.var.request_uri,v,"isjo") then
+            say_html(k)
+            log('GET')
+            return true
+        end
+    end
+    return false
+end
+
+function ua()
+    for k,v in pairs(ngx.shared.ua:get_keys()) do
+        if ngx.re.match(ngx.var.http_user_agent,v,"isjo") then
+            say_html(k)
+            log('User-agent')
+        end
+    end
+    return false
+end
+
+function body()
+    for k,v in pairs(ngx.shared.post:get_keys()) do
+        if ngx.req.get_body_data() and ngx.re.match(ngx.req.get_body_data(),v,"isjo") then
+            say_html(k)
+            log('POST')
+            return true
+        end
+    end
+    return false
+end

waf.lua

@@ -1,33 +1,21 @@
 ngx.req.read_body()
-if  ngx.re.match(ngx.var.request_uri,whitelist,"isjo") then
+if ngx.req.get_headers()['Acunetix-Aspect']  then
-    return
+    ngx.exit(400)
-else
+elseif ngx.req.get_headers()['X-Scan-Memo'] then
-    if ngx.re.match(ngx.unescape_uri(ngx.var.request_uri),regex.."|"..get,"isjo") then
+    ngx.exit(400)
-        log('GET',ngx.unescape_uri(ngx.var.request_uri))
-        check()
---    elseif ngx.re.match(string.gsub(ngx.var.request_uri,"\\%",""),regex.."|"..get,"isjo") then
---        log('GET',ngx.var.request_uri)
---        check()
-    elseif  ngx.re.match(ngx.var.request_uri,[[%00|%0b|%0d|%c0%ae|%0a]],"isjo") then
-        check()
-    elseif ngx.var.http_user_agent and ngx.re.match(ngx.var.http_user_agent,regex.."|"..agent,"isjo")  then
-        log('USER-AGENT',ngx.unescape_uri(ngx.var.request_uri))
-        check()
-    elseif ngx.req.get_body_data() and  ngx.re.match(ngx.req.get_body_data(),[[Content-Disposition: form-data;(.*)filename=]],"isjo") ==nil and ngx.re.match(ngx.unescape_uri(ngx.req.get_body_data()),regex.."|"..post,"isjo") then
-        log('POST',ngx.unescape_uri(ngx.var.request_uri),ngx.unescape_uri(ngx.req.get_body_data()))
-            check()
-    elseif string.len(filext) >0 then
-        if ngx.req.get_body_data() and ngx.re.match(ngx.req.get_body_data(),"Content-Disposition: form-data;(.*)filename=\"(.*)."..filext.."\"","isjo") then
-            check()
-        end
---    elseif ngx.req.get_headers()["Cookie"] and ngx.re.match(ngx.unescape_uri(ngx.req.get_headers()["Cookie"]),regex,"isjo")then
---        log('COOKIE',ngx.unescape_uri(ngx.var.request_uri),ngx.unescape_uri(ngx.req.get_headers()["Cookie"]))
---        check()
-    elseif ngx.req.get_headers()['Acunetix-Aspect']  then
-        ngx.exit(400)
-    elseif ngx.req.get_headers()['X-Scan-Memo'] then
-        ngx.exit(400)
-    else
-        return
-    end
 end
+if ua() then
+elseif url() then
+elseif args() then
+elseif ngx.req.get_body_data() and  ngx.re.match(ngx.req.get_body_data(),[[Content-Disposition: form-data;(.*)filename=]],"isjo") ==nil  then
+    ngx.req.read_body()
+    body()
+    ngx.req.discard_body()
+elseif string.len(filext) >0 then
+    if ngx.req.get_body_data() and ngx.re.match(ngx.req.get_body_data(),"Content-Disposition: form-data;(.*)filename=\"(.*)."..filext.."\"","isjo") then
+    ngx.exit('Not Allow Uploaded!!')
+    end
+else
+    return
+end
+ log('User-agent')