README.md

@@ -63,8 +63,8 @@ nginx安装路径假设为:/usr/local/nginx/conf/
         --是否拦截post攻击
         whiteModule = "on" 
         --是否开启URL白名单
-        black_fileExt={"php","jsp"}
+        fileExtension={"jpeg","gif","jpg","png","bmp","rar","zip","tar.gz"}
-        --填写不允许上传文件后缀类型
+        --填写可上传文件后缀类型
         ipWhitelist={"127.0.0.1"}
         --ip白名单，多个ip用逗号分隔
         ipBlocklist={"1.0.0.1"}
@@ -106,8 +106,8 @@ nginx安装路径假设为:/usr/local/nginx/conf/
 
 	过滤规则在wafconf下，可根据需求自行调整，每条规则需换行,或者用|分割
 	
-		args里面的规则get参数进行过滤的
+		global是全局过滤文件，里面的规则对post和get都过滤		
-		url是只在get请求url过滤的规则		
+		get是只在get请求过滤的规则		
 		post是只在post请求过滤的规则		
 		whitelist是白名单，里面的url匹配到不做过滤		
 		user-agent是对user-agent的过滤规则

config.lua

@@ -6,7 +6,7 @@ Redirect="on"
 CookieMatch="on"
 postMatch="on" 
 whiteModule="on" 
-black_fileExt={"php","jsp"}
+fileExtension={"jpeg","gif","jpg","png","bmp","rar","zip","tar.gz"}
 ipWhitelist={"127.0.0.1"}
 ipBlocklist={"1.0.0.1"}
 CCDeny="off"

init.lua

@@ -15,7 +15,10 @@ attacklog = optionIsOn(attacklog)
 CCDeny = optionIsOn(CCDeny)
 Redirect=optionIsOn(Redirect)
 function getClientIp()
-        IP  = ngx.var.remote_addr 
+        IP = ngx.req.get_headers()["X-Real-IP"]
+        if IP == nil then
+                IP  = ngx.var.remote_addr 
+        end
         if IP == nil then
                 IP  = "unknown"
         end
@@ -87,14 +90,12 @@ function whiteurl()
     return false
 end
 function fileExtCheck(ext)
-    local items = Set(black_fileExt)
+    local items = Set(fileExtension)
     ext=string.lower(ext)
     if ext then
-        for rule in pairs(items) do
+        if not items[ext] then
-            if ngx.re.match(ext,rule,"isjo") then
+			log('POST',ngx.var.request_uri,"-","file attack with ext "..ext)
-	        log('POST',ngx.var.request_uri,"-","file attack with ext "..ext)
             say_html()
-            end
         end
     end
     return false
@@ -109,14 +110,9 @@ function args()
         local args = ngx.req.get_uri_args()
         for key, val in pairs(args) do
             if type(val)=='table' then
-                 local t={}
+                if val ~= false then
-                 for k,v in pairs(val) do
+                    data=table.concat(val, " ")
-                    if v == true then
-                        v=""
-                    end
-                    table.insert(t,v)
                 end
-                data=table.concat(t, " ")
             else
                 data=val
             end

waf.lua

@@ -1,6 +1,5 @@
 local content_length=tonumber(ngx.req.get_headers()['content-length'])
 local method=ngx.req.get_method()
-local ngxmatch=ngx.re.match
 if whiteip() then
 elseif blockip() then
 elseif denycc() then
@@ -42,12 +41,12 @@ elseif PostCheck then
 	   	        return true
     	    	end
 		size = size + len(data)
-		local m = ngxmatch(data,[[Content-Disposition: form-data;(.+)filename="(.+)\\.(.*)"]],'ijo')
+		local m = ngx.re.match(data,'Content-Disposition: form-data;(.+)filename="(.+)\\.(.*)"','ijo')
         	if m then
             		fileExtCheck(m[3])
             		filetranslate = true
         	else
-            		if ngxmatch(data,"Content-Disposition:",'isjo') then
+            		if ngx.re.find(data,"Content-Disposition:",'isjo') then
                 		filetranslate = false
             		end
             		if filetranslate==false then
@@ -69,16 +68,13 @@ elseif PostCheck then
 				return
 			end
 			for key, val in pairs(args) do
-				if type(val) == "table" then
+				if type(val) == "table" or val == false then
-					if type(val[1]) == "boolean" then
-						return
-					end
 					data=table.concat(val, ", ")
 				else
 					data=val
 				end
 				if data and type(data) ~= "boolean" and body(data) then
-                			body(key)
+                  return true
 				end
 			end
 		end

wafconf/post

@@ -1,3 +1,4 @@
+\.\./
 select.+(from|limit)
 (?:(union(.*?)select))
 having|rongjitest