github
/
ngx_lua_waf_oneinstack
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update init.lua 

1.更新优化
2.文件流跳过过滤
3.上传大型文件过滤对CPU性能要求高
pull/11/head
174001602 2020-11-29 10:46:25 +08:00 committed by GitHub
parent 3ce453ab98
commit e763bf048c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 61 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
init.lua
View File

@ -200,11 +200,11 @@ end
-- deny post -- deny post
function post_attack_check() function post_attack_check()
if config_post_check == "on" and ngx.var.request_method == "POST" then if config_post_check == "on" and ngx.var.request_method == "POST" then
ngx.req.read_body()
local POST_RULES = get_rule("post") local POST_RULES = get_rule("post")
local receive_headers = ngx.req.get_headers() local receive_headers = ngx.req.get_headers()
for _,rule in pairs(POST_RULES) do
ngx.req.read_body()
if string.sub(receive_headers["content-type"],1,20) == "multipart/form-data;" then if string.sub(receive_headers["content-type"],1,20) == "multipart/form-data;" then
info_type = "Deny_MULTIPART_POST"
local body_data = ngx.req.get_body_data() local body_data = ngx.req.get_body_data()
content_type = receive_headers["content-type"] content_type = receive_headers["content-type"]
if not body_data then if not body_data then
@ -222,10 +222,7 @@ function post_attack_check()
boundary = string.sub(content_type, bj+1) boundary = string.sub(content_type, bj+1)
if body_data ~= "" and boundary ~= "" then if body_data ~= "" and boundary ~= "" then
boundary = '--'..boundary boundary = '--'..boundary
body_data = string.gsub(body_data, "\r", "") REQ_POST = {}
body_data = string.gsub(body_data, "\n", "")
body_data = string.gsub(body_data, "\t", "")
local table_body_data = {}
local i = 0 local i = 0
local b = string.len(boundary) local b = string.len(boundary)
while true do while true do
@ -233,22 +230,13 @@ function post_attack_check()
i,j = string.find(body_data, boundary, i + b + 1) i,j = string.find(body_data, boundary, i + b + 1)
if i == nil then break end if i == nil then break end
body = string.sub(body_data, x, i-1) body = string.sub(body_data, x, i-1)
table.insert(table_body_data, body) Content_Disposition = body:match('Content%-Disposition:.-\r\n')
end file_type = body:match("Content%-Type:.-\r\n")
for key, val in pairs(table_body_data) do if file_type ~= nil and Content_Disposition ~= nil then
if type(val) == "table" then table.insert(REQ_POST, file_type)
POST_DATA = string.lower(table.concat(val, " ")) table.insert(REQ_POST, Content_Disposition)
elseif type(val) == "boolean" then
POST_DATA = nil
else else
POST_DATA = string.lower(val) table.insert(REQ_POST, body)
end
if POST_DATA and rule ~="" and rulematch(unescape(POST_DATA),string.lower(rule),"jo") then
log_record("Deny__MULTIPART_POST",ngx.var.request_uri,"-",rule)
if config_waf_enable == "on" then
waf_output()
return true
end
end end
end end
else else
@ -259,7 +247,8 @@ function post_attack_check()
end end
end end
else else
local REQ_POST, err = ngx.req.get_post_args() info_type = "Deny_POST"
REQ_POST, err = ngx.req.get_post_args()
if err == "truncated" then if err == "truncated" then
log_record("DENY_POST_MANY",ngx.var.request_uri,"-",rule) log_record("DENY_POST_MANY",ngx.var.request_uri,"-",rule)
if config_waf_enable == "on" then if config_waf_enable == "on" then
@ -267,6 +256,8 @@ function post_attack_check()
return true return true
end end
end end
end
for _,rule in pairs(POST_RULES) do
for key, val in pairs(REQ_POST) do for key, val in pairs(REQ_POST) do
if type(val) == "table" then if type(val) == "table" then
POST_DATA = string.lower(table.concat(val, " ")) POST_DATA = string.lower(table.concat(val, " "))
@ -276,7 +267,7 @@ function post_attack_check()
POST_DATA = string.lower(val) POST_DATA = string.lower(val)
end end
if POST_DATA and rule ~="" and rulematch(unescape(POST_DATA),string.lower(rule),"jo") then if POST_DATA and rule ~="" and rulematch(unescape(POST_DATA),string.lower(rule),"jo") then
log_record("Deny_POST",ngx.var.request_uri,"-",rule) log_record(info_type,ngx.var.request_uri,"-",rule)
if config_waf_enable == "on" then if config_waf_enable == "on" then
waf_output() waf_output()
return true return true
@ -284,7 +275,6 @@ function post_attack_check()
end end
end end
end end
end
return true return true
end end
return false return false