diff --git a/README.md b/README.md index 9504cfb..395df1a 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,34 @@ +水平太烂，只能在原基础上改改。 + +1.原cc功能有点弱，改进后可以提高对攻击和普通访问的限制 + +默认同ip触发规则攻击超过10次/5秒,限制该ip访问nginx服务器1800秒。 + +同1 ip访问同1地址30次/60秒，限制访问该地址30秒。 + +2.日志主要是用于syslog服务器能力。 + + 1.--保存日志到syslog,可以用nginx设置的日志服务器保存日志。 + + logtoserver = "on" + +2.--通过加载socket.lua同时使用其他日志服务器，默认关闭。（这个有点粗糙，有需要的自己改） + +loghack="off" + +3.修改whiteurl，可以针对域名设置白名单。 + +--whiteurl start + +site:^www.baidu.com/whiteurl/ + +--end + + +------------------分割线------------------------------------------------- + +---------------lovshell记录---------------------------------------------- + ##ngx_lua_waf ngx_lua_waf是我刚入职趣游时候开发的一个基于ngx_lua的web应用防火墙。 @@ -136,3 +167,51 @@ nginx安装路径假设为:/usr/local/nginx/conf/ 感谢ngx_lua模块的开发者[@agentzh](https://github.com/agentzh/),春哥是我所接触过开源精神最好的人 + + +syntax: captures, err = ngx.re.match(subject, regex, options?, ctx?, res_table?) +syntax: from, to, err = ngx.re.find(subject, regex, options?, ctx?, nth?) + +Specify options to control how the match operation will be performed. The following option characters are supported: + +a anchored mode (only match from the beginning) + +d enable the DFA mode (or the longest token match semantics). + this requires PCRE 6.0+ or else a Lua exception will be thrown. + first introduced in ngx_lua v0.3.1rc30. + +D enable duplicate named pattern support. This allows named + subpattern names to be repeated, returning the captures in + an array-like Lua table. for example, + local m = ngx.re.match("hello, world", + "(?\w+), (?\w+)", + "D") + -- m["named"] == {"hello", "world"} + this option was first introduced in the v0.7.14 release. + this option requires at least PCRE 8.12. + +i case insensitive mode (similar to Perl's /i modifier) + +j enable PCRE JIT compilation, this requires PCRE 8.21+ which + must be built with the --enable-jit option. for optimum performance, + this option should always be used together with the 'o' option. + first introduced in ngx_lua v0.3.1rc30. + +J enable the PCRE Javascript compatible mode. this option was + first introduced in the v0.7.14 release. this option requires + at least PCRE 8.12. + +m multi-line mode (similar to Perl's /m modifier) + +o compile-once mode (similar to Perl's /o modifier), + to enable the worker-process-level compiled-regex cache + +s single-line mode (similar to Perl's /s modifier) + +u UTF-8 mode. this requires PCRE to be built with + the --enable-utf8 option or else a Lua exception will be thrown. + +U similar to "u" but disables PCRE's UTF-8 validity check on + the subject string. first introduced in ngx_lua v0.8.1. + +x extended mode (similar to Perl's /x modifier) diff --git a/config.lua b/config.lua index 6e66ce6..9a9d29d 100644 --- a/config.lua +++ b/config.lua @@ -1,23 +1,35 @@ -RulePath = "/usr/local/nginx/conf/waf/wafconf/" +RulePath = "/etc/nginx/waf/wafconf/" attacklog = "on" -logdir = "/usr/local/nginx/logs/hack/" +--保存日志到文件 +logtofile = "off" +logdir = "/var/log/nginx/" +--保存日志到syslog,采用nginx设置 +logtoserver = "on" +--通过syslog日志方式提交hack_ip记录到日志服务器 +loghack="off" +------------ UrlDeny="on" Redirect="on" CookieMatch="on" postMatch="on" whiteModule="on" black_fileExt={"php","jsp"} -ipWhitelist={"127.0.0.1"} +ipWhitelist={"127.0.0.1","192.168.2.1"} ipBlocklist={"1.0.0.1"} -CCDeny="off" -CCrate="100/60" +--违规ip登记，是否限制访问。 +--hackrate超过10次/5秒,限制访问1800秒。 +hackipdeny="on" +hackrate="10/60/1800" +--cc攻击防范 +CCDeny="on" +CCrate="30/60/30" html=[[ 网站防火墙