github
/
ngx_lua_waf_oneinstack
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update init.lua 

1.更新优化
2.文件流跳过过滤
3.上传大型文件过滤对CPU性能要求高
pull/11/head
174001602 2020-11-29 10:46:25 +08:00 committed by GitHub
parent 3ce453ab98
commit e763bf048c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 61 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

132
init.lua
View File

@ -200,89 +200,79 @@ end
-- deny post -- deny post
function post_attack_check() function post_attack_check()
if config_post_check == "on" and ngx.var.request_method == "POST" then if config_post_check == "on" and ngx.var.request_method == "POST" then
ngx.req.read_body()
local POST_RULES = get_rule("post") local POST_RULES = get_rule("post")
local receive_headers = ngx.req.get_headers() local receive_headers = ngx.req.get_headers()
for _,rule in pairs(POST_RULES) do if string.sub(receive_headers["content-type"],1,20) == "multipart/form-data;" then
ngx.req.read_body() info_type = "Deny_MULTIPART_POST"
if string.sub(receive_headers["content-type"],1,20) == "multipart/form-data;" then local body_data = ngx.req.get_body_data()
local body_data = ngx.req.get_body_data() content_type = receive_headers["content-type"]
content_type = receive_headers["content-type"] if not body_data then
if not body_data then local body_data_file = ngx.req.get_body_file()
local body_data_file = ngx.req.get_body_file() if body_data_file then
if body_data_file then local fh, err = io.open(body_data_file,"r")
local fh, err = io.open(body_data_file,"r") if fh then
if fh then fh:seek("set")
fh:seek("set") body_data = fh:read("*a")
body_data = fh:read("*a") fh:close()
fh:close()
end
end end
end end
bi, bj = string.find(content_type, 'boundary=') end
boundary = string.sub(content_type, bj+1) bi, bj = string.find(content_type, 'boundary=')
if body_data ~= "" and boundary ~= "" then boundary = string.sub(content_type, bj+1)
boundary = '--'..boundary if body_data ~= "" and boundary ~= "" then
body_data = string.gsub(body_data, "\r", "") boundary = '--'..boundary
body_data = string.gsub(body_data, "\n", "") REQ_POST = {}
body_data = string.gsub(body_data, "\t", "") local i = 0
local table_body_data = {} local b = string.len(boundary)
local i = 0 while true do
local b = string.len(boundary) x = i + b + 1;
while true do i,j = string.find(body_data, boundary, i + b + 1)
x = i + b + 1; if i == nil then break end
i,j = string.find(body_data, boundary, i + b + 1) body = string.sub(body_data, x, i-1)
if i == nil then break end Content_Disposition = body:match('Content%-Disposition:.-\r\n')
body = string.sub(body_data, x, i-1) file_type = body:match("Content%-Type:.-\r\n")
table.insert(table_body_data, body) if file_type ~= nil and Content_Disposition ~= nil then
end table.insert(REQ_POST, file_type)
for key, val in pairs(table_body_data) do table.insert(REQ_POST, Content_Disposition)
if type(val) == "table" then else
POST_DATA = string.lower(table.concat(val, " ")) table.insert(REQ_POST, body)
elseif type(val) == "boolean" then
POST_DATA = nil
else
POST_DATA = string.lower(val)
end
if POST_DATA and rule ~="" and rulematch(unescape(POST_DATA),string.lower(rule),"jo") then
log_record("Deny__MULTIPART_POST",ngx.var.request_uri,"-",rule)
if config_waf_enable == "on" then
waf_output()
return true
end
end
end
else
log_record("Deny__MULTIPART_POST",ngx.var.request_uri,"Empty",rule)
if config_waf_enable == "on" then
waf_output()
return true
end end
end end
else else
local REQ_POST, err = ngx.req.get_post_args() log_record("Deny__MULTIPART_POST",ngx.var.request_uri,"Empty",rule)
if err == "truncated" then if config_waf_enable == "on" then
log_record("DENY_POST_MANY",ngx.var.request_uri,"-",rule) waf_output()
return true
end
end
else
info_type = "Deny_POST"
REQ_POST, err = ngx.req.get_post_args()
if err == "truncated" then
log_record("DENY_POST_MANY",ngx.var.request_uri,"-",rule)
if config_waf_enable == "on" then
waf_output()
return true
end
end
end
for _,rule in pairs(POST_RULES) do
for key, val in pairs(REQ_POST) do
if type(val) == "table" then
POST_DATA = string.lower(table.concat(val, " "))
elseif type(val) == "boolean" then
POST_DATA = nil
else
POST_DATA = string.lower(val)
end
if POST_DATA and rule ~="" and rulematch(unescape(POST_DATA),string.lower(rule),"jo") then
log_record(info_type,ngx.var.request_uri,"-",rule)
if config_waf_enable == "on" then if config_waf_enable == "on" then
waf_output() waf_output()
return true return true
end end
end end
for key, val in pairs(REQ_POST) do
if type(val) == "table" then
POST_DATA = string.lower(table.concat(val, " "))
elseif type(val) == "boolean" then
POST_DATA = nil
else
POST_DATA = string.lower(val)
end
if POST_DATA and rule ~="" and rulematch(unescape(POST_DATA),string.lower(rule),"jo") then
log_record("Deny_POST",ngx.var.request_uri,"-",rule)
if config_waf_enable == "on" then
waf_output()
return true
end
end
end
end end
end end
return true return true