关于强制性验证优化

plugins/op_waf/waf/config.json

@@ -1 +1,66 @@
-{"reqfile_path": "{$WAF_PATH}/html", "retry": {"retry_time": 180, "is_open_global": 0, "retry": 6, "retry_cycle": 60}, "log": true, "scan": {"status": 444, "ps": "过滤常见扫描测试工具的渗透测试", "open": true, "reqfile": ""}, "cc": {"status": 444, "ps": "过虑CC攻击", "limit": 120, "endtime": 300, "open": true,"cycle": 60}, "safe_verify":{"status": 200,"ps": "强制安全校验", "reqfile": "safe_js.html","open": false,"cpu":50,"auto":true,"time":86400 },"get": {"status": 200, "ps": "过滤uri、uri参数中常见sql注入、xss等攻击", "open": true, "reqfile": "get.html"}, "log_save": 30, "user-agent": {"status": 200, "ps": "通常用于过滤浏览器、蜘蛛及一些自动扫描器", "open": true, "reqfile": "user_agent.html"}, "other": {"status": 200, "ps": "其它非通用过滤", "reqfile": "other.html"}, "cookie": {"status": 200, "ps": "过滤利用Cookie发起的渗透攻击", "open": true, "reqfile": "cookie.html"}, "logs_path": "/www/wwwlogs/waf", "post": {"status": 200, "ps": "过滤POST参数中常见sql注入、xss等攻击", "open": true, "reqfile": "post.html"}, "open": true}
+{
+    "reqfile_path": "{$WAF_PATH}/html",
+    "retry": {
+        "retry_time": 180,
+        "is_open_global": 0,
+        "retry": 6,
+        "retry_cycle": 60
+    },
+    "log": true,
+    "scan": {
+        "status": 444,
+        "ps": "过滤常见扫描测试工具的渗透测试",
+        "open": true,
+        "reqfile": ""
+    },
+    "cc": {
+        "status": 444,
+        "ps": "过虑CC攻击",
+        "limit": 120,
+        "endtime": 300,
+        "open": true,
+        "cycle": 60
+    },
+    "safe_verify": {
+        "status": 200,
+        "ps": "强制安全校验",
+        "reqfile": "safe_js.html",
+        "open": false,
+        "mode":"url",
+        "cpu": 50,
+        "auto": true,
+        "time": 86400
+    },
+    "get": {
+        "status": 200,
+        "ps": "过滤uri、uri参数中常见sql注入、xss等攻击",
+        "open": true,
+        "reqfile": "get.html"
+    },
+    "log_save": 30,
+    "user-agent": {
+        "status": 200,
+        "ps": "通常用于过滤浏览器、蜘蛛及一些自动扫描器",
+        "open": true,
+        "reqfile": "user_agent.html"
+    },
+    "other": {
+        "status": 200,
+        "ps": "其它非通用过滤",
+        "reqfile": "other.html"
+    },
+    "cookie": {
+        "status": 200,
+        "ps": "过滤利用Cookie发起的渗透攻击",
+        "open": true,
+        "reqfile": "cookie.html"
+    },
+    "logs_path": "/www/wwwlogs/waf",
+    "post": {
+        "status": 200,
+        "ps": "过滤POST参数中常见sql注入、xss等攻击",
+        "open": true,
+        "reqfile": "post.html"
+    },
+    "open": true
+}

plugins/op_waf/waf/html/safe_js.html

@@ -27,6 +27,15 @@
 
 <script type="text/javascript">
 
+function getQueryString(name) {
+    let reg = new RegExp("(^|&)" + name + "=([^&]*)(&|$)", "i");
+    let r = window.location.search.substr(1).match(reg);
+    if (r != null) {
+        return decodeURIComponent(r[2]);
+    };
+    return null;
+ }
+
 function ajax(type,bool){
 	var xhr = {};
 	if(typeof(type)=='undefined'){
@@ -135,7 +144,14 @@ var ok = setInterval(function(){
 			if (data['status'] == 0 && data['msg'] == 'ok'){
 				document.getElementById('status').innerHTML = 'ok';
 				setTimeout(function(){
-					location.reload();
+					var f = getQueryString('f');
+					// console.log(f,typeof(f));
+					if (f && f!=''){
+						location.href = f;
+					} else {
+						location.reload();
+					}
+					
 				},500);
 			} else{
 				document.getElementById('change').innerHTML = '?';

plugins/op_waf/waf/lua/init.lua

@@ -358,8 +358,31 @@ local function waf_cc_increase()
         ngx.exit(200)
     end    
 
-    local cc_html = ngx.re.gsub(cc_safe_js_html, "{uri}", make_uri_str)
-    C:return_html(200, cc_html)
+    if not config['safe_verify']['mode'] then return false end
+
+    if config['safe_verify']['mode'] == 'url' then
+        local page = '/safe_verify_'..cache_token
+        local request_uri = params['uri']
+        local to_url = page..'?f='..request_uri
+
+        local cache_url_key = cache_token..':url'
+        local cache_url_val = ngx.shared.waf_limit:get(cache_url_key)
+
+        if page == request_uri then
+            local cc_html = ngx.re.gsub(cc_safe_js_html, "{uri}", make_uri_str)
+            return C:return_html(200, cc_html)
+        end
+
+        if not cache_url_val then
+            ngx.shared.waf_limit:set(cache_url_key, request_uri,30)
+            return ngx.redirect(to_url)
+        end
+    end
+
+    if config['safe_verify']['mode'] == 'local' then
+        local cc_html = ngx.re.gsub(cc_safe_js_html, "{uri}", make_uri_str)
+        C:return_html(200, cc_html)
+    end
 end
 
 

plugins/op_waf/waf/lua/init_worker.lua

@@ -26,7 +26,7 @@ local function waf_timer_stats_total_log(premature)
     WAF_C:timer_stats_total()
 end
 
-local waf_clean_expire_data = function(premature)
+local function waf_clean_expire_data(premature)
     WAF_C:clean_log()
 end
 

plugins/op_waf/waf/lua/waf_common.lua

@@ -122,7 +122,7 @@ end
 
 function _M.initDB(self)
     local path = log_dir .. "/waf.db"
-    db, err = sqlite3.open(path)
+    local db, err = sqlite3.open(path)
 
     if err then
         self:D("initDB err:"..tostring(err))
@@ -371,7 +371,7 @@ function _M.return_html(self, status, html)
 end
 
 function _M.read_file_body(self, filename)
-    fp = io.open(filename, 'r')
+    local fp = io.open(filename, 'r')
     if fp == nil then
         return nil
     end