diff --git a/localwaf/src/pages/waf/urlwhite/index.vue b/localwaf/src/pages/waf/urlwhite/index.vue
index 4873d68..4ad7ac6 100644
--- a/localwaf/src/pages/waf/urlwhite/index.vue
+++ b/localwaf/src/pages/waf/urlwhite/index.vue
@@ -45,7 +45,15 @@
:key="index">
{{ item.label }}
-
+
+
+
+
+
+ {{ item.label }}
+
+
@@ -73,7 +81,15 @@
:key="index">
{{ item.label }}
-
+
+
+
+
+
+ {{ item.label }}
+
+
@@ -121,6 +137,7 @@
host_code: '',
url: '',
remarks: '',
+ compare_type:"等于"
};
export default Vue.extend({
name: 'ListBase',
@@ -152,6 +169,23 @@
type: 'error'
}],
},
+ compare_type_options: [{
+ label: '等于',
+ value: '等于'
+ },
+ {
+ label: '前缀匹配',
+ value: '前缀匹配'
+ },
+ {
+ label: '后缀匹配',
+ value: '后缀匹配'
+ },
+ {
+ label: '包含匹配',
+ value: '包含匹配'
+ },
+ ],
textareaValue: '',
prefix,
dataLoading: false,
@@ -172,6 +206,13 @@
ellipsis: true,
colKey: 'host_code',
fixed: 'left',
+ },{
+ title: '匹配方式',
+ align: 'left',
+ width: 250,
+ ellipsis: true,
+ colKey: 'compare_type',
+ fixed: 'left',
},
{
title: 'Url',
diff --git a/main.go b/main.go
index 9c3b9ce..b743a7b 100644
--- a/main.go
+++ b/main.go
@@ -103,40 +103,42 @@ func main() {
for {
select {
case msg := <-global.GWAF_CHAN_MSG:
- switch msg.Type {
- case enums.ChanTypeWhiteIP:
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPWhiteLists = msg.Content.([]model.IPWhiteList)
- zlog.Debug("远程配置", zap.Any("IPWhiteLists", msg.Content.([]model.IPWhiteList)))
- break
- case enums.ChanTypeWhiteURL:
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlWhiteLists = msg.Content.([]model.URLWhiteList)
- zlog.Debug("远程配置", zap.Any("UrlWhiteLists", msg.Content.([]model.URLWhiteList)))
- break
- case enums.ChanTypeBlockIP:
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPBlockLists = msg.Content.([]model.IPBlockList)
- zlog.Debug("远程配置", zap.Any("IPBlockLists", msg))
- break
- case enums.ChanTypeBlockURL:
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlBlockLists = msg.Content.([]model.URLBlockList)
- zlog.Debug("远程配置", zap.Any("UrlBlockLists", msg.Content.([]model.URLBlockList)))
- break
- case enums.ChanTypeLdp:
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].LdpUrlLists = msg.Content.([]model.LDPUrl)
- zlog.Debug("远程配置", zap.Any("LdpUrlLists", msg.Content.([]model.LDPUrl)))
- break
- case enums.ChanTypeRule:
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].RuleData = msg.Content.([]model.Rules)
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].Rule.LoadRules(msg.Content.([]model.Rules))
- zlog.Debug("远程配置", zap.Any("Rule", msg.Content.([]model.Rules)))
- break
- case enums.ChanTypeAnticc:
- wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].PluginIpRateLimiter = plugin.NewIPRateLimiter(rate.Limit(msg.Content.(model.AntiCC).Rate), msg.Content.(model.AntiCC).Limit)
- zlog.Debug("远程配置", zap.Any("Anticc", msg.Content.(model.AntiCC)))
- break
+ if wafEngine.HostCode[msg.HostCode] != "" && wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]] != nil {
+ switch msg.Type {
+ case enums.ChanTypeWhiteIP:
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPWhiteLists = msg.Content.([]model.IPWhiteList)
+ zlog.Debug("远程配置", zap.Any("IPWhiteLists", msg.Content.([]model.IPWhiteList)))
+ break
+ case enums.ChanTypeWhiteURL:
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlWhiteLists = msg.Content.([]model.URLWhiteList)
+ zlog.Debug("远程配置", zap.Any("UrlWhiteLists", msg.Content.([]model.URLWhiteList)))
+ break
+ case enums.ChanTypeBlockIP:
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].IPBlockLists = msg.Content.([]model.IPBlockList)
+ zlog.Debug("远程配置", zap.Any("IPBlockLists", msg))
+ break
+ case enums.ChanTypeBlockURL:
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].UrlBlockLists = msg.Content.([]model.URLBlockList)
+ zlog.Debug("远程配置", zap.Any("UrlBlockLists", msg.Content.([]model.URLBlockList)))
+ break
+ case enums.ChanTypeLdp:
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].LdpUrlLists = msg.Content.([]model.LDPUrl)
+ zlog.Debug("远程配置", zap.Any("LdpUrlLists", msg.Content.([]model.LDPUrl)))
+ break
+ case enums.ChanTypeRule:
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].RuleData = msg.Content.([]model.Rules)
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].Rule.LoadRules(msg.Content.([]model.Rules))
+ zlog.Debug("远程配置", zap.Any("Rule", msg.Content.([]model.Rules)))
+ break
+ case enums.ChanTypeAnticc:
+ wafEngine.HostTarget[wafEngine.HostCode[msg.HostCode]].PluginIpRateLimiter = plugin.NewIPRateLimiter(rate.Limit(msg.Content.(model.AntiCC).Rate), msg.Content.(model.AntiCC).Limit)
+ zlog.Debug("远程配置", zap.Any("Anticc", msg.Content.(model.AntiCC)))
+ break
- case enums.ChanTypeHost: //此处待定
- break
- } //end switch
+ case enums.ChanTypeHost: //此处待定
+ break
+ } //end switch
+ }
case engineStatus := <-global.GWAF_CHAN_ENGINE:
if engineStatus == 1 {
zlog.Info("准备关闭WAF引擎")
diff --git a/model/request/waf_white_url_add_req.go b/model/request/waf_white_url_add_req.go
index 5d557dd..9e304e6 100644
--- a/model/request/waf_white_url_add_req.go
+++ b/model/request/waf_white_url_add_req.go
@@ -1,7 +1,8 @@
package request
type WafWhiteUrlAddReq struct {
- HostCode string `json:"host_code"` //网站唯一码（主要键）
- Url string `json:"url"` //白名单url
- Remarks string `json:"remarks"` //备注
+ HostCode string `json:"host_code"` //网站唯一码（主要键）
+ CompareType string `json:"compare_type" form:"compare_type"` //对比方式
+ Url string `json:"url"` //白名单url
+ Remarks string `json:"remarks"` //备注
}
diff --git a/model/request/waf_white_url_edit_req.go b/model/request/waf_white_url_edit_req.go
index 04bc04b..ce13642 100644
--- a/model/request/waf_white_url_edit_req.go
+++ b/model/request/waf_white_url_edit_req.go
@@ -1,8 +1,9 @@
package request
type WafWhiteUrlEditReq struct {
- Id string `json:"id"` //白名单url唯一键
- HostCode string `json:"host_code"` //网站唯一码（主要键）
- Url string `json:"url"` //白名单url
- Remarks string `json:"remarks"` //备注
+ Id string `json:"id"` //白名单url唯一键
+ HostCode string `json:"host_code"` //网站唯一码（主要键）
+ CompareType string `json:"compare_type" form:"compare_type"` //对比方式
+ Url string `json:"url"` //白名单url
+ Remarks string `json:"remarks"` //备注
}
diff --git a/model/whitelist.go b/model/whitelist.go
index b9ab6d2..876d6de 100644
--- a/model/whitelist.go
+++ b/model/whitelist.go
@@ -18,6 +18,7 @@ type URLWhiteList struct {
UserCode string `json:"user_code"` //用户码（主要键）
TenantId string `json:"tenant_id"` //租户ID（主要键）
HostCode string `json:"host_code"` //网站唯一码（主要键）
+ CompareType string `json:"compare_type"` //判断类型，包含、开始、结束、完全匹配
Url string `json:"url"` //请求地址
Remarks string `json:"remarks"` //备注
CreateTime time.Time `json:"create_time"` //创建时间
diff --git a/service/waf_service/waf_white_url.go b/service/waf_service/waf_white_url.go
index 5d23423..2f8f1db 100644
--- a/service/waf_service/waf_white_url.go
+++ b/service/waf_service/waf_white_url.go
@@ -19,6 +19,7 @@ func (receiver *WafWhiteUrlService) AddApi(req request.WafWhiteUrlAddReq) error
TenantId: global.GWAF_TENANT_ID,
Id: uuid.NewV4().String(),
HostCode: req.HostCode,
+ CompareType: req.CompareType,
Url: req.Url,
Remarks: req.Remarks,
CreateTime: time.Now(),
@@ -41,6 +42,7 @@ func (receiver *WafWhiteUrlService) ModifyApi(req request.WafWhiteUrlEditReq) er
}
ipWhiteMap := map[string]interface{}{
"Host_Code": req.HostCode,
+ "Compare_Type": req.CompareType,
"Url": req.Url,
"Remarks": req.Remarks,
"last_update_time": time.Now(),
diff --git a/wafenginecore/wafengine.go b/wafenginecore/wafengine.go
index c891ca6..8e2819d 100644
--- a/wafenginecore/wafengine.go
+++ b/wafenginecore/wafengine.go
@@ -114,37 +114,6 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
if waf.HostTarget[host].Host.GUARD_STATUS == 1 {
var jumpGuardFlag = false
-
- var sqlFlag = false
- //检测sql注入
- sqliResult, _ := libinjection.IsSQLi(weblogbean.URL)
- if sqliResult {
- sqlFlag = true
- }
- sqliResult, _ = libinjection.IsSQLi(weblogbean.BODY)
- if sqliResult {
- sqlFlag = true
- }
- if sqlFlag == true {
- EchoErrorInfo(w, r, weblogbean, "SQL注入", "请正确访问")
- return
- }
- //检测xss注入
- var xssFlag = false
- sqlixssResult := libinjection.IsXSS(weblogbean.URL)
- if sqlixssResult == true {
- xssFlag = true
- }
- sqlixssResult = libinjection.IsXSS(weblogbean.BODY)
- if sqlixssResult == true {
- xssFlag = true
- }
- if xssFlag == true {
- EchoErrorInfo(w, r, weblogbean, "XSS跨站注入", "请正确访问")
- return
- }
- //检测xss
-
//ip白名单策略（待优化性能）
if waf.HostTarget[host].IPWhiteLists != nil {
for i := 0; i < len(waf.HostTarget[host].IPWhiteLists); i++ {
@@ -157,7 +126,10 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
//url白名单策略（待优化性能）
if waf.HostTarget[host].UrlWhiteLists != nil {
for i := 0; i < len(waf.HostTarget[host].UrlWhiteLists); i++ {
- if waf.HostTarget[host].UrlWhiteLists[i].Url == weblogbean.URL {
+ if (waf.HostTarget[host].UrlWhiteLists[i].CompareType == "等于" && waf.HostTarget[host].UrlWhiteLists[i].Url == weblogbean.URL) ||
+ (waf.HostTarget[host].UrlWhiteLists[i].CompareType == "前缀匹配" && strings.HasPrefix(weblogbean.URL, waf.HostTarget[host].UrlWhiteLists[i].Url)) ||
+ (waf.HostTarget[host].UrlWhiteLists[i].CompareType == "后缀匹配" && strings.HasSuffix(weblogbean.URL, waf.HostTarget[host].UrlWhiteLists[i].Url)) ||
+ (waf.HostTarget[host].UrlWhiteLists[i].CompareType == "包含匹配" && strings.Contains(weblogbean.URL, waf.HostTarget[host].UrlWhiteLists[i].Url)) {
jumpGuardFlag = true
break
}
@@ -183,6 +155,35 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
if jumpGuardFlag == false {
+ var sqlFlag = false
+ //检测sql注入
+ sqliResult, _ := libinjection.IsSQLi(weblogbean.URL)
+ if sqliResult {
+ sqlFlag = true
+ }
+ sqliResult, _ = libinjection.IsSQLi(weblogbean.BODY)
+ if sqliResult {
+ sqlFlag = true
+ }
+ if sqlFlag == true {
+ EchoErrorInfo(w, r, weblogbean, "SQL注入", "请正确访问")
+ return
+ }
+ //检测xss注入
+ var xssFlag = false
+ sqlixssResult := libinjection.IsXSS(weblogbean.URL)
+ if sqlixssResult == true {
+ xssFlag = true
+ }
+ sqlixssResult = libinjection.IsXSS(weblogbean.BODY)
+ if sqlixssResult == true {
+ xssFlag = true
+ }
+ if xssFlag == true {
+ EchoErrorInfo(w, r, weblogbean, "XSS跨站注入", "请正确访问")
+ return
+ }
+ //检测xss
//cc 防护
if waf.HostTarget[host].PluginIpRateLimiter != nil {
limiter := waf.HostTarget[host].PluginIpRateLimiter.GetLimiter(weblogbean.SRC_IP)