mirror of
https://gitee.com/samwaf/SamWaf.git
synced 2026-10-29 17:23:13 +08:00
feat:增加搜索爬虫的检验
This commit is contained in:
samwaf
@@ -30,6 +30,7 @@ var (
|
||||
GWAF_RUNTIME_QPS uint64 = 0 //当前qps
|
||||
GWAF_RUNTIME_LOG_PROCESS uint64 = 0 //log 处理速度
|
||||
|
||||
GWAF_RUNTIME_DNS_SERVER string = "119.29.29.29" //反向查询DNS的IP
|
||||
/**
|
||||
遥测数据
|
||||
*/
|
||||
@@ -106,6 +107,9 @@ var (
|
||||
|
||||
//通讯加密
|
||||
GWAF_COMMUNICATION_KEY = []byte("7E@u*has$d*@s5YX") //通讯加密密钥
|
||||
|
||||
//资源下载
|
||||
GWAF_BOT_IP_URL_MAIN string = "https://raw.githubusercontent.com/samwafgo/SamWafBotIPDatabase/main/allowlist/index.json"
|
||||
)
|
||||
|
||||
func GetCurrentVersionInt() int {
|
||||
|
||||
+18
-16
@@ -15,22 +15,24 @@ type WebLog struct {
|
||||
CITY string `json:"city"`
|
||||
CREATE_TIME string `gorm:"index:idx_weblog_time" json:"create_time"`
|
||||
//CREATE_TIME string ` json:"create_time"`
|
||||
CONTENT_LENGTH int64 `json:"content_length"`
|
||||
COOKIES string `json:"cookies"`
|
||||
BODY string `json:"body"`
|
||||
REQ_UUID string `json:"req_uuid"`
|
||||
USER_CODE string `json:"user_code"`
|
||||
TenantId string `json:"tenant_id"` //租户ID（主要键）
|
||||
HOST_CODE string `json:"host_code"` //主机ID （主要键）
|
||||
Day int `json:"day"` //日 （主要键）
|
||||
ACTION string `json:"action"`
|
||||
RULE string `json:"rule"`
|
||||
STATUS string `json:"status"` //状态
|
||||
STATUS_CODE int `json:"status_code"` //状态编码
|
||||
RES_BODY string `json:"res_body"` //返回信息
|
||||
POST_FORM string `json:"post_form"` //提交的表单数据
|
||||
TASK_FLAG int `json:"task_flag" gorm:"default:-1"` //任务处理标记 -1 等待处理 ；1 可以进行处理 （定时任务处理），2 处理完毕
|
||||
UNIX_ADD_TIME int64 `json:"unix_add_time"` //添加日期unix
|
||||
CONTENT_LENGTH int64 `json:"content_length"`
|
||||
COOKIES string `json:"cookies"`
|
||||
BODY string `json:"body"`
|
||||
REQ_UUID string `json:"req_uuid"`
|
||||
USER_CODE string `json:"user_code"`
|
||||
TenantId string `json:"tenant_id"` //租户ID（主要键）
|
||||
HOST_CODE string `json:"host_code"` //主机ID （主要键）
|
||||
Day int `json:"day"` //日 （主要键）
|
||||
ACTION string `json:"action"`
|
||||
RULE string `json:"rule"`
|
||||
STATUS string `json:"status"` //状态
|
||||
STATUS_CODE int `json:"status_code"` //状态编码
|
||||
RES_BODY string `json:"res_body"` //返回信息
|
||||
POST_FORM string `json:"post_form"` //提交的表单数据
|
||||
TASK_FLAG int `json:"task_flag" gorm:"default:-1"` //任务处理标记 -1 等待处理 ；1 可以进行处理 （定时任务处理），2 处理完毕
|
||||
UNIX_ADD_TIME int64 `json:"unix_add_time"` //添加日期unix
|
||||
RISK_LEVEL int `json:"risk_level"` //危险等级 0:正常 1: 轻微 2: 有害 3: 严重 4: 特别严重
|
||||
GUEST_IDENTIFICATION string `json:"guest_identification"` //访客身份识别
|
||||
}
|
||||
type WAFLog struct {
|
||||
REQ_UUID string `json:"req_uuid"`
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
<t-button theme="default" shape="square" variant="text" @click="changeCollapsed">
|
||||
<view-list-icon class="collapsed-icon" />
|
||||
</t-button>
|
||||
<search :layout="layout" />
|
||||
<!--<search :layout="layout" />-->
|
||||
</div>
|
||||
</template>
|
||||
<menu-content v-show="layout !== 'side'" class="header-menu" :navData="menu" />
|
||||
|
||||
@@ -37,6 +37,7 @@ func (receiver *WafHostService) AddApi(wafHostAddReq request.WafHostAddReq) (str
|
||||
Certfile: wafHostAddReq.Certfile,
|
||||
Keyfile: wafHostAddReq.Keyfile,
|
||||
REMARKS: wafHostAddReq.REMARKS,
|
||||
GLOBAL_HOST: 0,
|
||||
}
|
||||
global.GWAF_LOCAL_DB.Create(wafHost)
|
||||
return wafHost.Code, nil
|
||||
@@ -69,10 +70,10 @@ func (receiver *WafHostService) ModifyApi(wafHostEditReq request.WafHostEditReq)
|
||||
"Remote_ip": wafHostEditReq.Remote_ip,
|
||||
"Remote_port": wafHostEditReq.Remote_port,
|
||||
"REMARKS": wafHostEditReq.REMARKS,
|
||||
|
||||
"Certfile": wafHostEditReq.Certfile,
|
||||
"Keyfile": wafHostEditReq.Keyfile,
|
||||
"UPDATE_TIME": customtype.JsonTime(time.Now()),
|
||||
"GLOBAL_HOST": 0,
|
||||
"Certfile": wafHostEditReq.Certfile,
|
||||
"Keyfile": wafHostEditReq.Keyfile,
|
||||
"UPDATE_TIME": customtype.JsonTime(time.Now()),
|
||||
}
|
||||
err := global.GWAF_LOCAL_DB.Debug().Model(model.Hosts{}).Where("CODE=?", wafHostEditReq.CODE).Updates(hostMap).Error
|
||||
|
||||
|
||||
@@ -151,3 +151,27 @@ func PortCheck(port int) bool {
|
||||
defer conn.Close()
|
||||
return false // Port is not available
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
通过ip段（CIDR）来查询是否在这个段内
|
||||
*/
|
||||
func CheckIPInRanges(ip string, ipRanges []string) bool {
|
||||
parsedIP := net.ParseIP(ip)
|
||||
if parsedIP == nil {
|
||||
return false // 如果IP地址解析失败，则返回false
|
||||
}
|
||||
|
||||
for _, ipRange := range ipRanges {
|
||||
_, ipNet, err := net.ParseCIDR(ipRange)
|
||||
if err != nil {
|
||||
return false // 如果CIDR格式解析失败，则返回false
|
||||
}
|
||||
|
||||
if ipNet.Contains(parsedIP) {
|
||||
return true // 如果IP地址在指定的CIDR范围内，则返回true
|
||||
}
|
||||
}
|
||||
|
||||
return false // 如果IP地址不在任何一个CIDR范围内，则返回false
|
||||
}
|
||||
|
||||
@@ -0,0 +1,221 @@
|
||||
package wafbot
|
||||
|
||||
import (
|
||||
"SamWaf/utils"
|
||||
"strings"
|
||||
)
|
||||
|
||||
/*
|
||||
*
|
||||
判断是否正确的搜索引擎 返回值： 是否是爬虫，是否是正常爬虫， 爬虫名称
|
||||
*/
|
||||
func DetermineNormalSearch(userAgent, ip string) (bool, bool, string) {
|
||||
if strings.Contains(userAgent, "Baiduspider") {
|
||||
return baiduSpider(ip)
|
||||
} else if strings.Contains(userAgent, "google") {
|
||||
return googleSpider(ip)
|
||||
} else if strings.Contains(userAgent, "bingbot") || strings.Contains(userAgent, "msn.com") {
|
||||
return bingSpider(ip)
|
||||
} else if strings.Contains(userAgent, "sogou") {
|
||||
return sogouSpider(ip)
|
||||
} else if strings.Contains(userAgent, "360Spider") {
|
||||
return spider360(ip)
|
||||
} else if strings.Contains(userAgent, "YisouSpider") {
|
||||
return yisouSpider(ip)
|
||||
} else if strings.Contains(userAgent, "Bytespider") {
|
||||
return byteSpider(ip)
|
||||
}
|
||||
return false, false, "未知"
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
百度的蜘蛛
|
||||
*/
|
||||
func baiduSpider(ip string) (bool, bool, string) {
|
||||
//先查询本地库
|
||||
//然后远端查询
|
||||
lookup, err := ReverseDNSLookup(ip)
|
||||
if err == nil {
|
||||
if len(lookup) > 0 {
|
||||
if strings.HasSuffix(lookup[0], ".baidu.com.") || strings.HasSuffix(lookup[0], ".baidu.jp.") {
|
||||
return true, true, "百度爬虫"
|
||||
} else {
|
||||
return true, false, "可能不是百度爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "可能不是百度爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "伪装百度爬虫"
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
谷歌的蜘蛛
|
||||
*/
|
||||
func googleSpider(ip string) (bool, bool, string) {
|
||||
//先查询本地库
|
||||
//然后远端查询
|
||||
lookup, err := ReverseDNSLookup(ip)
|
||||
if err == nil {
|
||||
if len(lookup) > 0 {
|
||||
if strings.HasSuffix(lookup[0], ".googlebot.com.") {
|
||||
return true, true, "Google爬虫"
|
||||
} else if strings.HasSuffix(lookup[0], ".google.com.") {
|
||||
return true, true, "Google爬虫(特殊)"
|
||||
} else if strings.HasSuffix(lookup[0], ".googleusercontent.com.") {
|
||||
return true, true, "Google爬虫(用户触发)"
|
||||
} else {
|
||||
return true, false, "可能不是Google爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "可能不是Google爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "伪装Google爬虫"
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
bing的蜘蛛
|
||||
*/
|
||||
func bingSpider(ip string) (bool, bool, string) {
|
||||
//先查询本地库
|
||||
//然后远端查询
|
||||
lookup, err := ReverseDNSLookup(ip)
|
||||
if err == nil {
|
||||
if len(lookup) > 0 {
|
||||
if strings.HasSuffix(lookup[0], ".msn.com.") {
|
||||
return true, true, "Bing爬虫"
|
||||
} else {
|
||||
return true, false, "可能不是Bing爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "可能不是Bing爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "伪装Bing爬虫"
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
sogou蜘蛛
|
||||
*/
|
||||
func sogouSpider(ip string) (bool, bool, string) {
|
||||
//先查询本地库
|
||||
//然后远端查询
|
||||
lookup, err := ReverseDNSLookup(ip)
|
||||
if err == nil {
|
||||
if len(lookup) > 0 {
|
||||
if strings.HasSuffix(lookup[0], ".sogou.com.") {
|
||||
return true, true, "搜狗爬虫"
|
||||
} else {
|
||||
return true, false, "可能不是搜狗爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "可能不是搜狗爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "伪装搜狗爬虫"
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
360 搜索引擎
|
||||
*/
|
||||
func spider360(ip string) (bool, bool, string) {
|
||||
// 将要检查的 IP 地址段转换成数组
|
||||
ipRanges := []string{
|
||||
"180.153.232.",
|
||||
"180.153.234.",
|
||||
"180.153.236.",
|
||||
"180.163.220.",
|
||||
"42.236.101.",
|
||||
"42.236.102.",
|
||||
"42.236.103.",
|
||||
"42.236.10.",
|
||||
"42.236.12.",
|
||||
"42.236.13.",
|
||||
"42.236.14.",
|
||||
"42.236.15.",
|
||||
"42.236.16.",
|
||||
"42.236.17.",
|
||||
"42.236.46.",
|
||||
"42.236.48.",
|
||||
"42.236.49.",
|
||||
"42.236.50.",
|
||||
"42.236.51.",
|
||||
"42.236.52.",
|
||||
"42.236.53.",
|
||||
"42.236.54.",
|
||||
"42.236.55.",
|
||||
"42.236.99.",
|
||||
}
|
||||
// 判断指定 IP 是否在数组中的 IP 地址段范围内
|
||||
isInRange := false
|
||||
for _, ipRange := range ipRanges {
|
||||
if strings.HasPrefix(ip, ipRange) {
|
||||
isInRange = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if isInRange {
|
||||
return true, true, "360爬虫"
|
||||
} else {
|
||||
return true, false, "伪装360爬虫"
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
UC 搜索
|
||||
*/
|
||||
func yisouSpider(ip string) (bool, bool, string) {
|
||||
//先查询本地库
|
||||
//然后远端查询
|
||||
lookup, err := ReverseDNSLookup(ip)
|
||||
if err == nil {
|
||||
if len(lookup) > 0 {
|
||||
if strings.HasSuffix(lookup[0], ".sm.cn.") {
|
||||
return true, true, "神马搜索爬虫"
|
||||
} else {
|
||||
return true, false, "可能不是神马搜索爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "可能不是神马搜索爬虫"
|
||||
}
|
||||
} else {
|
||||
return true, false, "伪装神马搜索爬虫"
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
字节跳动的爬虫
|
||||
*/
|
||||
func byteSpider(ip string) (bool, bool, string) {
|
||||
ipRanges := []string{
|
||||
"110.249.201.0/24",
|
||||
"110.249.202.0/24",
|
||||
"111.225.148.0/24",
|
||||
"111.225.149.0/24",
|
||||
"220.243.135.0/24",
|
||||
"220.243.136.0/24",
|
||||
"220.243.188.0/24",
|
||||
"220.243.189.0/24",
|
||||
"60.8.123.0/24",
|
||||
"60.8.151.0/24",
|
||||
}
|
||||
|
||||
isInRanges := utils.CheckIPInRanges(ip, ipRanges)
|
||||
if isInRanges {
|
||||
return true, true, "字节跳动爬虫"
|
||||
} else {
|
||||
return true, false, "伪装字节跳动爬虫"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
package wafbot
|
||||
|
||||
import (
|
||||
"SamWaf/global"
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"time"
|
||||
)
|
||||
|
||||
func ReverseDNSLookup(ipAddress string) ([]string, error) {
|
||||
startTime := time.Now()
|
||||
|
||||
ctx := context.Background()
|
||||
d := net.Dialer{Resolver: &net.Resolver{
|
||||
PreferGo: true,
|
||||
Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
|
||||
return net.Dial("udp", global.GWAF_RUNTIME_DNS_SERVER+":53")
|
||||
},
|
||||
}}
|
||||
ctxWithTimeout, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
|
||||
defer cancel()
|
||||
names, err := d.Resolver.LookupAddr(ctxWithTimeout, ipAddress)
|
||||
|
||||
elapsed := time.Since(startTime)
|
||||
|
||||
fmt.Println(elapsed)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("逆向 DNS 查询失败: %s", err)
|
||||
}
|
||||
|
||||
if len(names) == 0 {
|
||||
return nil, fmt.Errorf("未找到与该 IP 地址关联的域名")
|
||||
}
|
||||
|
||||
return names, nil
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
package wafbot
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestReverseDNSLookup(t *testing.T) {
|
||||
lookup, err := ReverseDNSLookup("114.119.151.1")
|
||||
if err == nil {
|
||||
for _, s := range lookup {
|
||||
fmt.Println(s)
|
||||
}
|
||||
}
|
||||
}
|
||||
+54
-29
@@ -11,6 +11,7 @@ import (
|
||||
"SamWaf/plugin"
|
||||
"SamWaf/utils"
|
||||
"SamWaf/utils/zlog"
|
||||
"SamWaf/wafbot"
|
||||
"SamWaf/wafproxy"
|
||||
"bufio"
|
||||
"bytes"
|
||||
@@ -117,31 +118,33 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
datetimeNow := time.Now()
|
||||
weblogbean := innerbean.WebLog{
|
||||
HOST: host,
|
||||
URL: enEscapeUrl,
|
||||
REFERER: r.Referer(),
|
||||
USER_AGENT: r.UserAgent(),
|
||||
METHOD: r.Method,
|
||||
HEADER: string(header),
|
||||
COUNTRY: region[0],
|
||||
PROVINCE: region[2],
|
||||
CITY: region[3],
|
||||
SRC_IP: ipAndPort[0],
|
||||
SRC_PORT: ipAndPort[1],
|
||||
CREATE_TIME: datetimeNow.Format("2006-01-02 15:04:05"),
|
||||
UNIX_ADD_TIME: datetimeNow.UnixNano() / 1e6,
|
||||
CONTENT_LENGTH: contentLength,
|
||||
COOKIES: string(cookies),
|
||||
BODY: string(bodyByte),
|
||||
REQ_UUID: uuid.NewV4().String(),
|
||||
USER_CODE: global.GWAF_USER_CODE,
|
||||
HOST_CODE: waf.HostTarget[host].Host.Code,
|
||||
TenantId: global.GWAF_TENANT_ID,
|
||||
RULE: "",
|
||||
ACTION: "通过",
|
||||
Day: currentDay,
|
||||
POST_FORM: r.PostForm.Encode(),
|
||||
TASK_FLAG: -1,
|
||||
HOST: host,
|
||||
URL: enEscapeUrl,
|
||||
REFERER: r.Referer(),
|
||||
USER_AGENT: r.UserAgent(),
|
||||
METHOD: r.Method,
|
||||
HEADER: string(header),
|
||||
COUNTRY: region[0],
|
||||
PROVINCE: region[2],
|
||||
CITY: region[3],
|
||||
SRC_IP: ipAndPort[0],
|
||||
SRC_PORT: ipAndPort[1],
|
||||
CREATE_TIME: datetimeNow.Format("2006-01-02 15:04:05"),
|
||||
UNIX_ADD_TIME: datetimeNow.UnixNano() / 1e6,
|
||||
CONTENT_LENGTH: contentLength,
|
||||
COOKIES: string(cookies),
|
||||
BODY: string(bodyByte),
|
||||
REQ_UUID: uuid.NewV4().String(),
|
||||
USER_CODE: global.GWAF_USER_CODE,
|
||||
HOST_CODE: waf.HostTarget[host].Host.Code,
|
||||
TenantId: global.GWAF_TENANT_ID,
|
||||
RULE: "",
|
||||
ACTION: "通过",
|
||||
Day: currentDay,
|
||||
POST_FORM: r.PostForm.Encode(),
|
||||
TASK_FLAG: -1,
|
||||
RISK_LEVEL: 0, //危险等级
|
||||
GUEST_IDENTIFICATION: "正常访客", //访客身份识别
|
||||
}
|
||||
|
||||
formValues := url.Values{}
|
||||
@@ -205,6 +208,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
if waf.HostTarget[host].IPBlockLists != nil {
|
||||
for i := 0; i < len(waf.HostTarget[host].IPBlockLists); i++ {
|
||||
if waf.HostTarget[host].IPBlockLists[i].Ip == weblogbean.SRC_IP {
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "IP黑名单", "您的访问被阻止了IP限制")
|
||||
return
|
||||
}
|
||||
@@ -214,6 +218,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
if waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].Host.GUARD_STATUS == 1 && waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].IPBlockLists != nil {
|
||||
for i := 0; i < len(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].IPBlockLists); i++ {
|
||||
if waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].IPBlockLists[i].Ip == weblogbean.SRC_IP {
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "【全局】IP黑名单", "您的访问被阻止了IP限制")
|
||||
return
|
||||
}
|
||||
@@ -227,6 +232,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
(waf.HostTarget[host].UrlBlockLists[i].CompareType == "前缀匹配" && strings.HasPrefix(weblogbean.URL, waf.HostTarget[host].UrlBlockLists[i].Url)) ||
|
||||
(waf.HostTarget[host].UrlBlockLists[i].CompareType == "后缀匹配" && strings.HasSuffix(weblogbean.URL, waf.HostTarget[host].UrlBlockLists[i].Url)) ||
|
||||
(waf.HostTarget[host].UrlBlockLists[i].CompareType == "包含匹配" && strings.Contains(weblogbean.URL, waf.HostTarget[host].UrlBlockLists[i].Url)) {
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "URL黑名单", "您的访问被阻止了URL限制")
|
||||
return
|
||||
}
|
||||
@@ -239,6 +245,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].CompareType == "前缀匹配" && strings.HasPrefix(weblogbean.URL, waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].Url)) ||
|
||||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].CompareType == "后缀匹配" && strings.HasSuffix(weblogbean.URL, waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].Url)) ||
|
||||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].CompareType == "包含匹配" && strings.Contains(weblogbean.URL, waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].Url)) {
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "【全局】URL黑名单", "您的访问被阻止了URL限制")
|
||||
return
|
||||
}
|
||||
@@ -247,6 +254,19 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
if jumpGuardFlag == false {
|
||||
|
||||
//检测爬虫bot
|
||||
isBot, isNormalBot, BotName := wafbot.DetermineNormalSearch(weblogbean.USER_AGENT, weblogbean.SRC_IP)
|
||||
if isBot == true {
|
||||
if isNormalBot {
|
||||
weblogbean.GUEST_IDENTIFICATION = BotName
|
||||
} else {
|
||||
weblogbean.GUEST_IDENTIFICATION = BotName
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, BotName, "请正确访问")
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
var sqlFlag = false
|
||||
//检测sql注入
|
||||
if libinjection.IsSQLiNotReturnPrint(weblogbean.URL) ||
|
||||
@@ -264,6 +284,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
if sqlFlag == true {
|
||||
weblogbean.RISK_LEVEL = 2
|
||||
EchoErrorInfo(w, r, weblogbean, "SQL注入", "请正确访问")
|
||||
return
|
||||
}
|
||||
@@ -283,6 +304,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
if xssFlag == true {
|
||||
weblogbean.RISK_LEVEL = 2
|
||||
EchoErrorInfo(w, r, weblogbean, "XSS跨站注入", "请正确访问")
|
||||
return
|
||||
}
|
||||
@@ -294,6 +316,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
scanFlag = true
|
||||
}
|
||||
if scanFlag == true {
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "扫描工具", "请正确访问")
|
||||
return
|
||||
}
|
||||
@@ -301,7 +324,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
if waf.HostTarget[host].PluginIpRateLimiter != nil {
|
||||
limiter := waf.HostTarget[host].PluginIpRateLimiter.GetLimiter(weblogbean.SRC_IP)
|
||||
if !limiter.Allow() {
|
||||
fmt.Println("超量了")
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "触发IP频次访问限制1", "您的访问被阻止超量了1")
|
||||
return
|
||||
}
|
||||
@@ -310,7 +333,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
if waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].Host.GUARD_STATUS == 1 && waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].PluginIpRateLimiter != nil {
|
||||
limiter := waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].PluginIpRateLimiter.GetLimiter(weblogbean.SRC_IP)
|
||||
if !limiter.Allow() {
|
||||
fmt.Println("超量了")
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "【全局】触发IP频次访问限制", "您的访问被阻止超量了")
|
||||
return
|
||||
}
|
||||
@@ -327,6 +350,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
rulestr = rulestr + v.RuleDescription + ","
|
||||
}
|
||||
w.Header().Set("WAF", "SAMWAF DROP")
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, rulestr, "您的访问被阻止触发规则")
|
||||
return
|
||||
}
|
||||
@@ -346,6 +370,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
rulestr = rulestr + v.RuleDescription + ","
|
||||
}
|
||||
w.Header().Set("WAF", "SAMWAF DROP")
|
||||
weblogbean.RISK_LEVEL = 1
|
||||
EchoErrorInfo(w, r, weblogbean, "【全局】"+rulestr, "您的访问被阻止触发规则")
|
||||
return
|
||||
}
|
||||
@@ -469,9 +494,9 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
func EchoErrorInfo(w http.ResponseWriter, r *http.Request, weblogbean innerbean.WebLog, ruleName string, blockInfo string) {
|
||||
//通知信息
|
||||
noticeStr := fmt.Sprintf("网站域名:%s 访问IP:%s 归属地区：%s 规则：%s 阻止信息：%s", weblogbean.HOST, weblogbean.SRC_IP, utils.GetCountry(weblogbean.SRC_IP), ruleName, blockInfo)
|
||||
/* noticeStr := fmt.Sprintf("网站域名:%s 访问IP:%s 归属地区：%s 规则：%s 阻止信息：%s", weblogbean.HOST, weblogbean.SRC_IP, utils.GetCountry(weblogbean.SRC_IP), ruleName, blockInfo)
|
||||
|
||||
zlog.Debug(noticeStr)
|
||||
zlog.Debug(noticeStr)*/
|
||||
//发送微信推送消息
|
||||
global.GQEQUE_MESSAGE_DB.PushBack(innerbean.RuleMessageInfo{
|
||||
BaseMessageInfo: innerbean.BaseMessageInfo{OperaType: "命中保护规则", Server: global.GWAF_CUSTOM_SERVER_NAME},
|
||||
|
||||
@@ -92,7 +92,7 @@ func TaskCounter() {
|
||||
//一、 主机聚合统计
|
||||
{
|
||||
var resultHosts []CountHostResult
|
||||
global.GWAF_LOCAL_LOG_DB.Raw("SELECT host_code, user_code,tenant_id ,action,count(req_uuid) as count,day,host FROM \"web_logs\" where task_flag = ? and unix_add_time > ? GROUP BY host_code, user_code,action,tenant_id,day,host",
|
||||
global.GWAF_LOCAL_LOG_DB.Debug().Raw("SELECT host_code, user_code,tenant_id ,action,count(req_uuid) as count,day,host FROM \"web_logs\" where task_flag = ? and unix_add_time > ? GROUP BY host_code, user_code,action,tenant_id,day,host",
|
||||
1, currenyDayMillisecondsBak).Scan(&resultHosts)
|
||||
/****
|
||||
1.如果不存在则创建
|
||||
@@ -363,6 +363,20 @@ func TaskLoadSetting() {
|
||||
}
|
||||
wafSystemConfigService.AddApi(wafSystemConfigAddReq)
|
||||
}
|
||||
|
||||
//dns查询
|
||||
configItem = wafSystemConfigService.GetDetailByItem("dns_server")
|
||||
if configItem.Id != "" {
|
||||
if global.GWAF_RUNTIME_DNS_SERVER != configItem.Value {
|
||||
global.GWAF_RUNTIME_DNS_SERVER = configItem.Value
|
||||
}
|
||||
} else {
|
||||
wafSystemConfigService.AddApi(request.WafSystemConfigAddReq{
|
||||
Item: "dns_server",
|
||||
Value: global.GWAF_RUNTIME_DNS_SERVER,
|
||||
Remarks: "DNS服务器",
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
Reference in New Issue
Block a user