diff --git a/config.lua b/config.lua index 6e66ce6..2f7144b 100644 --- a/config.lua +++ b/config.lua @@ -5,6 +5,7 @@ UrlDeny="on" Redirect="on" CookieMatch="on" postMatch="on" +WhiteServerName="on" whiteModule="on" black_fileExt={"php","jsp"} ipWhitelist={"127.0.0.1"} diff --git a/init.lua b/init.lua index eb44bf0..6807e27 100644 --- a/init.lua +++ b/init.lua @@ -10,10 +10,13 @@ UrlDeny = optionIsOn(UrlDeny) PostCheck = optionIsOn(postMatch) CookieCheck = optionIsOn(cookieMatch) WhiteCheck = optionIsOn(whiteModule) +WhiteServerName = optionIsOn(WhiteServerName) PathInfoFix = optionIsOn(PathInfoFix) attacklog = optionIsOn(attacklog) CCDeny = optionIsOn(CCDeny) Redirect=optionIsOn(Redirect) + + function getClientIp() IP = ngx.req.get_headers()["X-Real-IP"] if IP == nil then @@ -64,9 +67,14 @@ urlrules=read_rule('url') argsrules=read_rule('args') uarules=read_rule('user-agent') wturlrules=read_rule('whiteurl') +white_servername_list = read_rule('white_servername') postrules=read_rule('post') ckrules=read_rule('cookie') +function debug(info) + write("/var/log/nginx/waf/debug.log", info) +end + function say_html() if Redirect then @@ -89,6 +97,30 @@ function whiteurl() end return false end + + + +function white_servername() + debug("white servername") + if 1==1 then + host = ngx.req.get_headers()["Host"] + if host == nil then + debug("nil host") + return false; + end + debug(host) + if white_servername_list ~= nil then + for _, rule in pairs(white_servername_list) do + if ngxmatch(host, rule, "isjo") then + return true + end + end + end + return false + end +end + + function fileExtCheck(ext) local items = Set(black_fileExt) ext=string.lower(ext) diff --git a/waf.lua b/waf.lua index a6e5fdc..bd22f19 100644 --- a/waf.lua +++ b/waf.lua @@ -8,6 +8,7 @@ elseif ngx.var.http_Acunetix_Aspect then elseif ngx.var.http_X_Scan_Memo then ngx.exit(444) elseif whiteurl() then +elseif white_servername() then elseif ua() then elseif url() then elseif args() then diff --git a/wafconf/url b/wafconf/url index 31130d3..a48a430 100644 --- a/wafconf/url +++ b/wafconf/url @@ -1,4 +1,4 @@ -\.(svn|htaccess|bash_history) +\.(svn|git|htaccess|bash_history) \.(bak|inc|old|mdb|sql|backup|java|class)$ (vhost|bbs|host|wwwroot|www|site|root|hytop|flashfxp).*\.rar (phpmyadmin|jmx-console|jmxinvokerservlet)