Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

增加对.git目录访问的拦截 #46

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

增加对.git目录访问的拦截 #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8c0326e
增加对.git目录访问的拦截
virusdefender May 3, 2015
6203189
Update init.lua
virusdefender May 7, 2015
4d79bb7
Update waf.lua
virusdefender May 7, 2015
b89d6ea
Update config.lua
virusdefender May 7, 2015
b32ae8f
Update init.lua
virusdefender May 7, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions config.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ UrlDeny="on"
Redirect="on"
CookieMatch="on"
postMatch="on"
WhiteServerName="on"
whiteModule="on"
black_fileExt={"php","jsp"}
ipWhitelist={"127.0.0.1"}
Expand Down
32 changes: 32 additions & 0 deletions init.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,13 @@ UrlDeny = optionIsOn(UrlDeny)
PostCheck = optionIsOn(postMatch)
CookieCheck = optionIsOn(cookieMatch)
WhiteCheck = optionIsOn(whiteModule)
WhiteServerName = optionIsOn(WhiteServerName)
PathInfoFix = optionIsOn(PathInfoFix)
attacklog = optionIsOn(attacklog)
CCDeny = optionIsOn(CCDeny)
Redirect=optionIsOn(Redirect)


function getClientIp()
IP = ngx.req.get_headers()["X-Real-IP"]
if IP == nil then
Expand Down Expand Up @@ -64,9 +67,14 @@ urlrules=read_rule('url')
argsrules=read_rule('args')
uarules=read_rule('user-agent')
wturlrules=read_rule('whiteurl')
white_servername_list = read_rule('white_servername')
postrules=read_rule('post')
ckrules=read_rule('cookie')

function debug(info)
write("/var/log/nginx/waf/debug.log", info)
end


function say_html()
if Redirect then
Expand All @@ -89,6 +97,30 @@ function whiteurl()
end
return false
end



function white_servername()
debug("white servername")
if 1==1 then
host = ngx.req.get_headers()["Host"]
if host == nil then
debug("nil host")
return false;
end
debug(host)
if white_servername_list ~= nil then
for _, rule in pairs(white_servername_list) do
if ngxmatch(host, rule, "isjo") then
return true
end
end
end
return false
end
end


function fileExtCheck(ext)
local items = Set(black_fileExt)
ext=string.lower(ext)
Expand Down
1 change: 1 addition & 0 deletions waf.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ elseif ngx.var.http_Acunetix_Aspect then
elseif ngx.var.http_X_Scan_Memo then
ngx.exit(444)
elseif whiteurl() then
elseif white_servername() then
elseif ua() then
elseif url() then
elseif args() then
Expand Down
2 changes: 1 addition & 1 deletion wafconf/url
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
\.(svn|htaccess|bash_history)
\.(svn|git|htaccess|bash_history)
\.(bak|inc|old|mdb|sql|backup|java|class)$
(vhost|bbs|host|wwwroot|www|site|root|hytop|flashfxp).*\.rar
(phpmyadmin|jmx-console|jmxinvokerservlet)
Expand Down