From 3e396f9e601c7fbcfda148304e63561011430ab7 Mon Sep 17 00:00:00 2001 From: midoks Date: Wed, 24 Apr 2019 00:15:01 +0800 Subject: [PATCH] waf --- data/defaultSite.pl | 2 +- plugins/op_firewall/conf/luawaf.conf | 4 + plugins/op_firewall/index.py | 125 ++++++++------------------- plugins/op_firewall/waf/config.lua | 4 +- plugins/openresty/index.py | 6 +- 5 files changed, 48 insertions(+), 93 deletions(-) create mode 100755 plugins/op_firewall/conf/luawaf.conf diff --git a/data/defaultSite.pl b/data/defaultSite.pl index 26ba64bc4..bec7f1669 100644 --- a/data/defaultSite.pl +++ b/data/defaultSite.pl @@ -1 +1 @@ -t2.cachecha.com \ No newline at end of file +t.vvv \ No newline at end of file diff --git a/plugins/op_firewall/conf/luawaf.conf b/plugins/op_firewall/conf/luawaf.conf new file mode 100755 index 000000000..10f93c2cd --- /dev/null +++ b/plugins/op_firewall/conf/luawaf.conf @@ -0,0 +1,4 @@ +lua_shared_dict limit 10m; +lua_package_path "{$WAF_PATH}/?.lua"; +init_by_lua_file {$WAF_PATH}/init.lua; +access_by_lua_file {$WAF_PATH}/waf.lua; diff --git a/plugins/op_firewall/index.py b/plugins/op_firewall/index.py index 8090701d6..519290fc4 100755 --- a/plugins/op_firewall/index.py +++ b/plugins/op_firewall/index.py @@ -68,6 +68,15 @@ def status(): return 'start' +def contentReplace(content): + service_path = public.getServerDir() + waf_path = public.getServerDir() + "/openresty/nginx/conf/waf" + content = content.replace('{$ROOT_PATH}', public.getRootDir()) + content = content.replace('{$SERVER_PATH}', service_path) + content = content.replace('{$WAF_PATH}', waf_path) + return content + + def initDreplace(): path = public.getServerDir() + "/openresty/nginx/conf" if not os.path.exists(path + '/waf'): @@ -75,98 +84,50 @@ def initDreplace(): cmd = 'cp -rf ' + sdir + ' ' + path public.execShell(cmd) + config = public.getServerDir() + "/openresty/nginx/conf/waf/config.lua" + content = public.readFile(config) + content = contentReplace(content) + public.writeFile(config, content) + + waf_conf = public.getServerDir() + "/openresty/nginx/conf/luawaf.conf" + waf_tpl = getPluginDir() + "/conf/luawaf.conf" + content = public.readFile(waf_tpl) + content = contentReplace(content) + public.writeFile(waf_conf, content) + def start(): initDreplace() - # data = public.execShell(file + ' start') - # if data[1] == '': - # return 'ok' - # return data[1] + + path = getConf() + conf = public.readFile(path) + conf = conf.replace('#include luawaf.conf;', "include luawaf.conf;") + + public.writeFile(path, conf) + public.restartWeb() return 'ok' def stop(): - file = initDreplace() - data = public.execShell(file + ' stop') - clearTemp() - if data[1] == '': - return 'ok' - return data[1] + initDreplace() + + path = getConf() + conf = public.readFile(path) + conf = conf.replace('include luawaf.conf;', "#include luawaf.conf;") + + public.writeFile(path, conf) + public.restartWeb() + return 'ok' def restart(): - file = initDreplace() - data = public.execShell(file + ' restart') - if data[1] == '': - return 'ok' - return data[1] + return 'ok' def reload(): - file = initDreplace() - data = public.execShell(file + ' reload') - if data[1] == '': - return 'ok' - return data[1] - - -def initdStatus(): - if not app_debug: - if public.isAppleSystem(): - return "Apple Computer does not support" - initd_bin = getInitDFile() - if os.path.exists(initd_bin): - return 'ok' - return 'fail' - - -def initdInstall(): - import shutil - if not app_debug: - if public.isAppleSystem(): - return "Apple Computer does not support" - - source_bin = initDreplace() - initd_bin = getInitDFile() - shutil.copyfile(source_bin, initd_bin) - public.execShell('chmod +x ' + initd_bin) - public.execShell('chkconfig --add ' + getPluginName()) return 'ok' -def initdUinstall(): - if not app_debug: - if public.isAppleSystem(): - return "Apple Computer does not support" - - public.execShell('chkconfig --del ' + getPluginName()) - initd_bin = getInitDFile() - os.remove(initd_bin) - return 'ok' - - -def runInfo(): - # 取Openresty负载状态 - try: - result = public.httpGet('http://127.0.0.1/nginx_status') - tmp = result.split() - data = {} - data['active'] = tmp[2] - data['accepts'] = tmp[9] - data['handled'] = tmp[7] - data['requests'] = tmp[8] - data['Reading'] = tmp[11] - data['Writing'] = tmp[13] - data['Waiting'] = tmp[15] - return public.getJson(data) - except Exception as e: - return 'oprenresty not started' - - -def errorLogPath(): - return getServerDir() + '/nginx/logs/error.log' - - if __name__ == "__main__": func = sys.argv[1] if func == 'status': @@ -179,19 +140,7 @@ if __name__ == "__main__": print restart() elif func == 'reload': print reload() - elif func == 'initd_status': - print initdStatus() - elif func == 'initd_install': - print initdInstall() - elif func == 'initd_uninstall': - print initdUinstall() elif func == 'conf': print getConf() - elif func == 'get_os': - print getOs() - elif func == 'run_info': - print runInfo() - elif func == 'error_log': - print errorLogPath() else: print 'error' diff --git a/plugins/op_firewall/waf/config.lua b/plugins/op_firewall/waf/config.lua index 561c7aa2e..56fa0a64b 100644 --- a/plugins/op_firewall/waf/config.lua +++ b/plugins/op_firewall/waf/config.lua @@ -1,6 +1,6 @@ -RulePath = "/www/server/panel/vhost/wafconf/" +RulePath = "{$WAF_PATH}/wafconf" attacklog = "on" -logdir = "/www/wwwlogs/waf/" +logdir = "{$ROOT_PATH}/wwwlogs/waf/" UrlDeny="on" Redirect="on" CookieMatch="off" diff --git a/plugins/openresty/index.py b/plugins/openresty/index.py index 6513725de..bcf99a0fe 100755 --- a/plugins/openresty/index.py +++ b/plugins/openresty/index.py @@ -131,7 +131,9 @@ def confReplace(): content = content.replace('{$OS_USER}', user) content = content.replace('{$OS_USER_GROUP}', user_group) - public.writeFile(getServerDir() + '/nginx/conf/nginx.conf', content) + nconf = getServerDir() + '/nginx/conf/nginx.conf' + if not os.path.exists(nconf): + public.writeFile(getServerDir() + '/nginx/conf/nginx.conf', content) # give nginx root permission ng_exe_bin = getServerDir() + "/nginx/sbin/nginx" @@ -240,7 +242,7 @@ def initdUinstall(): if not app_debug: if public.isAppleSystem(): return "Apple Computer does not support" - + public.execShell('chkconfig --del ' + getPluginName()) initd_bin = getInitDFile() os.remove(initd_bin)