From 27db6cb17090d2bbdc627fdbdf93254330ebf60e Mon Sep 17 00:00:00 2001
From: samwaf <samwafgo@gmail.com>
Date: Tue, 11 Jul 2023 11:01:38 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E5=88=A4=E6=96=AD=E9=9D=99?=
 =?UTF-8?q?=E6=80=81=E8=B5=84=E6=BA=90=E4=B8=8D=E8=AE=B0=E5=BD=95=EF=BC=9B?=
 =?UTF-8?q?TODO=20=E5=BE=85=E5=A2=9E=E5=8A=A0=E4=B8=80=E4=B8=AA=E9=80=BB?=
 =?UTF-8?q?=E8=BE=91=E5=88=A4=E6=96=ADurl=E5=92=8CIP=E7=9A=84=E6=83=85?=
 =?UTF-8?q?=E5=86=B5=E7=9A=84=EF=BC=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 wafenginecore/wafengine.go | 84 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 82 insertions(+), 2 deletions(-)

diff --git a/wafenginecore/wafengine.go b/wafenginecore/wafengine.go
index a6431f6..9ec2fee 100644
--- a/wafenginecore/wafengine.go
+++ b/wafenginecore/wafengine.go
@@ -232,8 +232,6 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			waf.HostTarget[host].RevProxy = proxy // 放入缓存
 			proxy.ServeHTTP(w, r)
 		}
-		weblogbean.ACTION = "放行"
-		global.GQEQUE_LOG_DB.PushBack(weblogbean)
 		return
 	} else {
 		w.Write([]byte("403: Host forbidden " + host))
@@ -312,6 +310,50 @@ func (waf *WafEngine) modifyResponse() func(*http.Response) error {
 	return func(resp *http.Response) error {
 		resp.Header.Set("WAF", "SamWAF")
 		resp.Header.Set("Server", "SamWAF")
+		r := resp.Request
+		//开始准备req数据
+		//获取请求报文的内容长度
+		contentLength := r.ContentLength
+
+		//server_online[8081].Svr.Close()
+		var bodyByte []byte
+
+		// 拷贝一份request的Body ,控制不记录大文件的情况 ，先写死的
+		if r.Body != nil && r.Body != http.NoBody && contentLength < (global.GCONFIG_RECORD_MAX_BODY_LENGTH) {
+			bodyByte, _ = io.ReadAll(r.Body)
+			// 把刚刚读出来的再写进去，不然后面解析表单数据就解析不到了
+			r.Body = io.NopCloser(bytes.NewBuffer(bodyByte))
+		}
+		cookies, _ := json.Marshal(r.Cookies())
+		header, _ := json.Marshal(r.Header)
+		// 取出客户IP
+		ipAndPort := strings.Split(r.RemoteAddr, ":")
+		region := utils.GetCountry(ipAndPort[0])
+		currentDay, _ := strconv.Atoi(time.Now().Format("20060102"))
+		weblogbean := innerbean.WebLog{
+			HOST:           r.Host,
+			URL:            r.RequestURI,
+			REFERER:        r.Referer(),
+			USER_AGENT:     r.UserAgent(),
+			METHOD:         r.Method,
+			HEADER:         string(header),
+			COUNTRY:        region[0],
+			PROVINCE:       region[2],
+			CITY:           region[3],
+			SRC_IP:         ipAndPort[0],
+			SRC_PORT:       ipAndPort[1],
+			CREATE_TIME:    time.Now().Format("2006-01-02 15:04:05"),
+			CONTENT_LENGTH: contentLength,
+			COOKIES:        string(cookies),
+			BODY:           string(bodyByte),
+			REQ_UUID:       uuid.NewV4().String(),
+			USER_CODE:      global.GWAF_USER_CODE,
+			HOST_CODE:      "",
+			TenantId:       global.GWAF_TENANT_ID,
+			RULE:           "",
+			ACTION:         "通过",
+			Day:            currentDay,
+		}
 
 		host := resp.Request.Host
 		if !strings.Contains(host, ":") {
@@ -356,6 +398,44 @@ func (waf *WafEngine) modifyResponse() func(*http.Response) error {
 			resp.ContentLength = int64(len(newPayload))
 			resp.Header.Set("Content-Length", strconv.FormatInt(int64(len(finalBytes)), 10))
 		}
+		//返回内容的类型
+		respContentType := resp.Header.Get("Content-Type")
+		contentType := ""
+		//JS情况
+		if respContentType == "application/javascript" {
+			contentType = "js"
+		}
+		//CSS情况
+		if respContentType == "text/css" {
+			contentType = "css"
+		}
+		//图片情况
+		if respContentType == "image/jpeg" || respContentType == "image/png" ||
+			respContentType == "image/gif" || respContentType == "image/x-icon" {
+			contentType = "img"
+		}
+		//记录静态日志
+		isStaticAssist := false
+		switch contentType {
+		case "js":
+			isStaticAssist = true
+			break
+		case "css":
+			isStaticAssist = true
+			break
+		case "img":
+			isStaticAssist = true
+			break
+		default:
+			weblogbean.ACTION = "放行"
+			global.GQEQUE_LOG_DB.PushBack(weblogbean)
+		}
+		//TODO 如果是指定URL 或者 IP 不记录日志
+		if !isStaticAssist && weblogbean.URL != "/index.php/lttshop/task_scheduling/orderSale" && weblogbean.URL != "/index.php/lttshop/task_scheduling/orderHotSale" {
+			weblogbean.ACTION = "放行"
+			global.GQEQUE_LOG_DB.PushBack(weblogbean)
+		}
+
 		return nil
 	}
 }