opensource/SamWaf
3
0
Fork 0
mirror of https://gitee.com/samwaf/SamWaf.git synced 2026-11-03 03:31:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

增加url白名单前缀匹配等比较模式

Browse Source
This commit is contained in:
samwaf
2023-02-06 14:35:46 +08:00
parent 6605fdbef1
commit 6df78776eb
7 changed files with 123 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
localwaf/src/pages/waf/urlwhite/index.vue
+43 -2
View File
@@ -45,7 +45,15 @@
:key="index">
{{ item.label }}
</t-option>
</t-select>
</t-select>
</t-form-item>
<t-form-item label="匹配方式" name="compare_type">
<t-select v-model="formData.compare_type" clearable :style="{ width: '480px' }">
<t-option v-for="(item, index) in compare_type_options" :value="item.value" :label="item.label"
:key="index">
{{ item.label }}
</t-option>
</t-select>
</t-form-item>
<t-form-item label="Url" name="url">
<t-input :style="{ width: '480px' }" v-model="formData.url" placeholder="请输入白名单Url"></t-input>
@@ -73,7 +81,15 @@
:key="index">
{{ item.label }}
</t-option>
</t-select>
</t-select>
</t-form-item>
<t-form-item label="匹配方式" name="compare_type">
<t-select v-model="formEditData.compare_type" clearable :style="{ width: '480px' }">
<t-option v-for="(item, index) in compare_type_options" :value="item.value" :label="item.label"
:key="index">
{{ item.label }}
</t-option>
</t-select>
</t-form-item>
<t-form-item label="Url" name="url">
<t-input :style="{ width: '480px' }" v-model="formEditData.url" placeholder="请输入白名单Url"></t-input>
@@ -121,6 +137,7 @@
host_code: '',
url: '',
remarks: '',
compare_type:"等于"
};
export default Vue.extend({
name: 'ListBase',
@@ -152,6 +169,23 @@
type: 'error'
}],
},
compare_type_options: [{
label: '等于',
value: '等于'
},
{
label: '前缀匹配',
value: '前缀匹配'
},
{
label: '后缀匹配',
value: '后缀匹配'
},
{
label: '包含匹配',
value: '包含匹配'
},
],
textareaValue: '',
prefix,
dataLoading: false,
@@ -172,6 +206,13 @@
ellipsis: true,
colKey: 'host_code',
fixed: 'left',
},{
title: '匹配方式',
align: 'left',
width: 250,
ellipsis: true,
colKey: 'compare_type',
fixed: 'left',
},
{
title: 'Url',
main.go
+35 -33
View File
@@ -103,40 +103,42 @@ func main() {
for {
select {
case msg := <-global.GWAF_CHAN_MSG:
switch msg.Type {
case enums.ChanTypeWhiteIP:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPWhiteLists = msg.Content.([]model.IPWhiteList)
zlog.Debug("远程配置", zap.Any("IPWhiteLists", msg.Content.([]model.IPWhiteList)))
break
case enums.ChanTypeWhiteURL:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlWhiteLists = msg.Content.([]model.URLWhiteList)
zlog.Debug("远程配置", zap.Any("UrlWhiteLists", msg.Content.([]model.URLWhiteList)))
break
case enums.ChanTypeBlockIP:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPBlockLists = msg.Content.([]model.IPBlockList)
zlog.Debug("远程配置", zap.Any("IPBlockLists", msg))
break
case enums.ChanTypeBlockURL:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlBlockLists = msg.Content.([]model.URLBlockList)
zlog.Debug("远程配置", zap.Any("UrlBlockLists", msg.Content.([]model.URLBlockList)))
break
case enums.ChanTypeLdp:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].LdpUrlLists = msg.Content.([]model.LDPUrl)
zlog.Debug("远程配置", zap.Any("LdpUrlLists", msg.Content.([]model.LDPUrl)))
break
case enums.ChanTypeRule:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].RuleData = msg.Content.([]model.Rules)
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].Rule.LoadRules(msg.Content.([]model.Rules))
zlog.Debug("远程配置", zap.Any("Rule", msg.Content.([]model.Rules)))
break
case enums.ChanTypeAnticc:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].PluginIpRateLimiter = plugin.NewIPRateLimiter(rate.Limit(msg.Content.(model.AntiCC).Rate), msg.Content.(model.AntiCC).Limit)
zlog.Debug("远程配置", zap.Any("Anticc", msg.Content.(model.AntiCC)))
break
if wafEngine.HostCode[msg.HostCode] != "" && wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]] != nil {
switch msg.Type {
case enums.ChanTypeWhiteIP:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPWhiteLists = msg.Content.([]model.IPWhiteList)
zlog.Debug("远程配置", zap.Any("IPWhiteLists", msg.Content.([]model.IPWhiteList)))
break
case enums.ChanTypeWhiteURL:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlWhiteLists = msg.Content.([]model.URLWhiteList)
zlog.Debug("远程配置", zap.Any("UrlWhiteLists", msg.Content.([]model.URLWhiteList)))
break
case enums.ChanTypeBlockIP:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPBlockLists = msg.Content.([]model.IPBlockList)
zlog.Debug("远程配置", zap.Any("IPBlockLists", msg))
break
case enums.ChanTypeBlockURL:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlBlockLists = msg.Content.([]model.URLBlockList)
zlog.Debug("远程配置", zap.Any("UrlBlockLists", msg.Content.([]model.URLBlockList)))
break
case enums.ChanTypeLdp:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].LdpUrlLists = msg.Content.([]model.LDPUrl)
zlog.Debug("远程配置", zap.Any("LdpUrlLists", msg.Content.([]model.LDPUrl)))
break
case enums.ChanTypeRule:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].RuleData = msg.Content.([]model.Rules)
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].Rule.LoadRules(msg.Content.([]model.Rules))
zlog.Debug("远程配置", zap.Any("Rule", msg.Content.([]model.Rules)))
break
case enums.ChanTypeAnticc:
wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].PluginIpRateLimiter = plugin.NewIPRateLimiter(rate.Limit(msg.Content.(model.AntiCC).Rate), msg.Content.(model.AntiCC).Limit)
zlog.Debug("远程配置", zap.Any("Anticc", msg.Content.(model.AntiCC)))
break
case enums.ChanTypeHost: //此处待定
break
} //end switch
case enums.ChanTypeHost: //此处待定
break
} //end switch
}
case engineStatus := <-global.GWAF_CHAN_ENGINE:
if engineStatus == 1 {
zlog.Info("准备关闭WAF引擎")
model/request/waf_white_url_add_req.go
+4 -3
View File
@@ -1,7 +1,8 @@
package request
type WafWhiteUrlAddReq struct {
HostCode string `json:"host_code"` //网站唯一码（主要键）
Url string `json:"url"` //白名单url
Remarks string `json:"remarks"` //备注
HostCode string `json:"host_code"` //网站唯一码（主要键）
CompareType string `json:"compare_type" form:"compare_type"` //对比方式
Url string `json:"url"` //白名单url
Remarks string `json:"remarks"` //备注
}
model/request/waf_white_url_edit_req.go
+5 -4
View File
@@ -1,8 +1,9 @@
package request
type WafWhiteUrlEditReq struct {
Id string `json:"id"` //白名单url唯一键
HostCode string `json:"host_code"` //网站唯一码（主要键）
Url string `json:"url"` //白名单url
Remarks string `json:"remarks"` //备注
Id string `json:"id"` //白名单url唯一键
HostCode string `json:"host_code"` //网站唯一码（主要键）
CompareType string `json:"compare_type" form:"compare_type"` //对比方式
Url string `json:"url"` //白名单url
Remarks string `json:"remarks"` //备注
}
model/whitelist.go
+1
View File
@@ -18,6 +18,7 @@ type URLWhiteList struct {
UserCode string `json:"user_code"` //用户码（主要键）
TenantId string `json:"tenant_id"` //租户ID（主要键）
HostCode string `json:"host_code"` //网站唯一码（主要键）
CompareType string `json:"compare_type"` //判断类型，包含、开始、结束、完全匹配
Url string `json:"url"` //请求地址
Remarks string `json:"remarks"` //备注
CreateTime time.Time `json:"create_time"` //创建时间
service/waf_service/waf_white_url.go
+2
View File
@@ -19,6 +19,7 @@ func (receiver *WafWhiteUrlService) AddApi(req request.WafWhiteUrlAddReq) error
TenantId: global.GWAF_TENANT_ID,
Id: uuid.NewV4().String(),
HostCode: req.HostCode,
CompareType: req.CompareType,
Url: req.Url,
Remarks: req.Remarks,
CreateTime: time.Now(),
@@ -41,6 +42,7 @@ func (receiver *WafWhiteUrlService) ModifyApi(req request.WafWhiteUrlEditReq) er
}
ipWhiteMap := map[string]interface{}{
"Host_Code": req.HostCode,
"Compare_Type": req.CompareType,
"Url": req.Url,
"Remarks": req.Remarks,
"last_update_time": time.Now(),
wafenginecore/wafengine.go
+33 -32
View File
@@ -114,37 +114,6 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
if waf.HostTarget[host].Host.GUARD_STATUS == 1 {
var jumpGuardFlag = false
var sqlFlag = false
//检测sql注入
sqliResult, _ := libinjection.IsSQLi(weblogbean.URL)
if sqliResult {
sqlFlag = true
}
sqliResult, _ = libinjection.IsSQLi(weblogbean.BODY)
if sqliResult {
sqlFlag = true
}
if sqlFlag == true {
EchoErrorInfo(w, r, weblogbean, "SQL注入", "请正确访问")
return
}
//检测xss注入
var xssFlag = false
sqlixssResult := libinjection.IsXSS(weblogbean.URL)
if sqlixssResult == true {
xssFlag = true
}
sqlixssResult = libinjection.IsXSS(weblogbean.BODY)
if sqlixssResult == true {
xssFlag = true
}
if xssFlag == true {
EchoErrorInfo(w, r, weblogbean, "XSS跨站注入", "请正确访问")
return
}
//检测xss
//ip白名单策略（待优化性能）
if waf.HostTarget[host].IPWhiteLists != nil {
for i := 0; i < len(waf.HostTarget[host].IPWhiteLists); i++ {
@@ -157,7 +126,10 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
//url白名单策略（待优化性能）
if waf.HostTarget[host].UrlWhiteLists != nil {
for i := 0; i < len(waf.HostTarget[host].UrlWhiteLists); i++ {
if waf.HostTarget[host].UrlWhiteLists[i].Url == weblogbean.URL {
if (waf.HostTarget[host].UrlWhiteLists[i].CompareType == "等于" && waf.HostTarget[host].UrlWhiteLists[i].Url == weblogbean.URL) ||
(waf.HostTarget[host].UrlWhiteLists[i].CompareType == "前缀匹配" && strings.HasPrefix(weblogbean.URL, waf.HostTarget[host].UrlWhiteLists[i].Url)) ||
(waf.HostTarget[host].UrlWhiteLists[i].CompareType == "后缀匹配" && strings.HasSuffix(weblogbean.URL, waf.HostTarget[host].UrlWhiteLists[i].Url)) ||
(waf.HostTarget[host].UrlWhiteLists[i].CompareType == "包含匹配" && strings.Contains(weblogbean.URL, waf.HostTarget[host].UrlWhiteLists[i].Url)) {
jumpGuardFlag = true
break
}
@@ -183,6 +155,35 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
if jumpGuardFlag == false {
var sqlFlag = false
//检测sql注入
sqliResult, _ := libinjection.IsSQLi(weblogbean.URL)
if sqliResult {
sqlFlag = true
}
sqliResult, _ = libinjection.IsSQLi(weblogbean.BODY)
if sqliResult {
sqlFlag = true
}
if sqlFlag == true {
EchoErrorInfo(w, r, weblogbean, "SQL注入", "请正确访问")
return
}
//检测xss注入
var xssFlag = false
sqlixssResult := libinjection.IsXSS(weblogbean.URL)
if sqlixssResult == true {
xssFlag = true
}
sqlixssResult = libinjection.IsXSS(weblogbean.BODY)
if sqlixssResult == true {
xssFlag = true
}
if xssFlag == true {
EchoErrorInfo(w, r, weblogbean, "XSS跨站注入", "请正确访问")
return
}
//检测xss
//cc 防护
if waf.HostTarget[host].PluginIpRateLimiter != nil {
limiter := waf.HostTarget[host].PluginIpRateLimiter.GetLimiter(weblogbean.SRC_IP)