From c0b1a331d33e2e90bba3d97c4025e3014fe5142f Mon Sep 17 00:00:00 2001 From: samwaf Date: Thu, 11 Jan 2024 14:05:32 +0800 Subject: [PATCH] =?UTF-8?q?feat:=E5=A2=9E=E5=8A=A0=E6=90=9C=E7=B4=A2?= =?UTF-8?q?=E7=88=AC=E8=99=AB=E7=9A=84=E6=A3=80=E9=AA=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- global/global.go | 4 + innerbean/web_log.go | 34 ++-- localwaf/src/layouts/components/Header.vue | 2 +- service/waf_service/waf_host.go | 9 +- utils/common.go | 24 +++ wafbot/determine_search.go | 221 +++++++++++++++++++++ wafbot/dns_search.go | 37 ++++ wafbot/dns_search_test.go | 15 ++ wafenginecore/wafengine.go | 83 +++++--- waftask/localtaskcounter.go | 16 +- 10 files changed, 394 insertions(+), 51 deletions(-) create mode 100644 wafbot/determine_search.go create mode 100644 wafbot/dns_search.go create mode 100644 wafbot/dns_search_test.go diff --git a/global/global.go b/global/global.go index c52a08a..c179e05 100644 --- a/global/global.go +++ b/global/global.go @@ -30,6 +30,7 @@ var ( GWAF_RUNTIME_QPS uint64 = 0 //当前qps GWAF_RUNTIME_LOG_PROCESS uint64 = 0 //log 处理速度 + GWAF_RUNTIME_DNS_SERVER string = "119.29.29.29" //反向查询DNS的IP /** 遥测数据 */ @@ -106,6 +107,9 @@ var ( //通讯加密 GWAF_COMMUNICATION_KEY = []byte("7E@u*has$d*@s5YX") //通讯加密密钥 + + //资源下载 + GWAF_BOT_IP_URL_MAIN string = "https://raw.githubusercontent.com/samwafgo/SamWafBotIPDatabase/main/allowlist/index.json" ) func GetCurrentVersionInt() int { diff --git a/innerbean/web_log.go b/innerbean/web_log.go index 10e7f38..cda2a9f 100644 --- a/innerbean/web_log.go +++ b/innerbean/web_log.go @@ -15,22 +15,24 @@ type WebLog struct { CITY string `json:"city"` CREATE_TIME string `gorm:"index:idx_weblog_time" json:"create_time"` //CREATE_TIME string ` json:"create_time"` - CONTENT_LENGTH int64 `json:"content_length"` - COOKIES string `json:"cookies"` - BODY string `json:"body"` - REQ_UUID string `json:"req_uuid"` - USER_CODE string `json:"user_code"` - TenantId string `json:"tenant_id"` //租户ID（主要键） - HOST_CODE string `json:"host_code"` //主机ID （主要键） - Day int `json:"day"` //日 （主要键） - ACTION string `json:"action"` - RULE string `json:"rule"` - STATUS string `json:"status"` //状态 - STATUS_CODE int `json:"status_code"` //状态编码 - RES_BODY string `json:"res_body"` //返回信息 - POST_FORM string `json:"post_form"` //提交的表单数据 - TASK_FLAG int `json:"task_flag" gorm:"default:-1"` //任务处理标记 -1 等待处理 ；1 可以进行处理 （定时任务处理），2 处理完毕 - UNIX_ADD_TIME int64 `json:"unix_add_time"` //添加日期unix + CONTENT_LENGTH int64 `json:"content_length"` + COOKIES string `json:"cookies"` + BODY string `json:"body"` + REQ_UUID string `json:"req_uuid"` + USER_CODE string `json:"user_code"` + TenantId string `json:"tenant_id"` //租户ID（主要键） + HOST_CODE string `json:"host_code"` //主机ID （主要键） + Day int `json:"day"` //日 （主要键） + ACTION string `json:"action"` + RULE string `json:"rule"` + STATUS string `json:"status"` //状态 + STATUS_CODE int `json:"status_code"` //状态编码 + RES_BODY string `json:"res_body"` //返回信息 + POST_FORM string `json:"post_form"` //提交的表单数据 + TASK_FLAG int `json:"task_flag" gorm:"default:-1"` //任务处理标记 -1 等待处理 ；1 可以进行处理 （定时任务处理），2 处理完毕 + UNIX_ADD_TIME int64 `json:"unix_add_time"` //添加日期unix + RISK_LEVEL int `json:"risk_level"` //危险等级 0:正常 1: 轻微 2: 有害 3: 严重 4: 特别严重 + GUEST_IDENTIFICATION string `json:"guest_identification"` //访客身份识别 } type WAFLog struct { REQ_UUID string `json:"req_uuid"` diff --git a/localwaf/src/layouts/components/Header.vue b/localwaf/src/layouts/components/Header.vue index 73243d5..d26e5ff 100644 --- a/localwaf/src/layouts/components/Header.vue +++ b/localwaf/src/layouts/components/Header.vue @@ -17,7 +17,7 @@ - + diff --git a/service/waf_service/waf_host.go b/service/waf_service/waf_host.go index 99e4b4f..a9c372c 100644 --- a/service/waf_service/waf_host.go +++ b/service/waf_service/waf_host.go @@ -37,6 +37,7 @@ func (receiver *WafHostService) AddApi(wafHostAddReq request.WafHostAddReq) (str Certfile: wafHostAddReq.Certfile, Keyfile: wafHostAddReq.Keyfile, REMARKS: wafHostAddReq.REMARKS, + GLOBAL_HOST: 0, } global.GWAF_LOCAL_DB.Create(wafHost) return wafHost.Code, nil @@ -69,10 +70,10 @@ func (receiver *WafHostService) ModifyApi(wafHostEditReq request.WafHostEditReq) "Remote_ip": wafHostEditReq.Remote_ip, "Remote_port": wafHostEditReq.Remote_port, "REMARKS": wafHostEditReq.REMARKS, - - "Certfile": wafHostEditReq.Certfile, - "Keyfile": wafHostEditReq.Keyfile, - "UPDATE_TIME": customtype.JsonTime(time.Now()), + "GLOBAL_HOST": 0, + "Certfile": wafHostEditReq.Certfile, + "Keyfile": wafHostEditReq.Keyfile, + "UPDATE_TIME": customtype.JsonTime(time.Now()), } err := global.GWAF_LOCAL_DB.Debug().Model(model.Hosts{}).Where("CODE=?", wafHostEditReq.CODE).Updates(hostMap).Error diff --git a/utils/common.go b/utils/common.go index a9f9a6a..33a8621 100644 --- a/utils/common.go +++ b/utils/common.go @@ -151,3 +151,27 @@ func PortCheck(port int) bool { defer conn.Close() return false // Port is not available } + +/* +* +通过ip段（CIDR）来查询是否在这个段内 +*/ +func CheckIPInRanges(ip string, ipRanges []string) bool { + parsedIP := net.ParseIP(ip) + if parsedIP == nil { + return false // 如果IP地址解析失败，则返回false + } + + for _, ipRange := range ipRanges { + _, ipNet, err := net.ParseCIDR(ipRange) + if err != nil { + return false // 如果CIDR格式解析失败，则返回false + } + + if ipNet.Contains(parsedIP) { + return true // 如果IP地址在指定的CIDR范围内，则返回true + } + } + + return false // 如果IP地址不在任何一个CIDR范围内，则返回false +} diff --git a/wafbot/determine_search.go b/wafbot/determine_search.go new file mode 100644 index 0000000..1bde048 --- /dev/null +++ b/wafbot/determine_search.go @@ -0,0 +1,221 @@ +package wafbot + +import ( + "SamWaf/utils" + "strings" +) + +/* +* +判断是否正确的搜索引擎 返回值： 是否是爬虫，是否是正常爬虫， 爬虫名称 +*/ +func DetermineNormalSearch(userAgent, ip string) (bool, bool, string) { + if strings.Contains(userAgent, "Baiduspider") { + return baiduSpider(ip) + } else if strings.Contains(userAgent, "google") { + return googleSpider(ip) + } else if strings.Contains(userAgent, "bingbot") || strings.Contains(userAgent, "msn.com") { + return bingSpider(ip) + } else if strings.Contains(userAgent, "sogou") { + return sogouSpider(ip) + } else if strings.Contains(userAgent, "360Spider") { + return spider360(ip) + } else if strings.Contains(userAgent, "YisouSpider") { + return yisouSpider(ip) + } else if strings.Contains(userAgent, "Bytespider") { + return byteSpider(ip) + } + return false, false, "未知" +} + +/* +* +百度的蜘蛛 +*/ +func baiduSpider(ip string) (bool, bool, string) { + //先查询本地库 + //然后远端查询 + lookup, err := ReverseDNSLookup(ip) + if err == nil { + if len(lookup) > 0 { + if strings.HasSuffix(lookup[0], ".baidu.com.") || strings.HasSuffix(lookup[0], ".baidu.jp.") { + return true, true, "百度爬虫" + } else { + return true, false, "可能不是百度爬虫" + } + } else { + return true, false, "可能不是百度爬虫" + } + } else { + return true, false, "伪装百度爬虫" + } +} + +/* +* +谷歌的蜘蛛 +*/ +func googleSpider(ip string) (bool, bool, string) { + //先查询本地库 + //然后远端查询 + lookup, err := ReverseDNSLookup(ip) + if err == nil { + if len(lookup) > 0 { + if strings.HasSuffix(lookup[0], ".googlebot.com.") { + return true, true, "Google爬虫" + } else if strings.HasSuffix(lookup[0], ".google.com.") { + return true, true, "Google爬虫(特殊)" + } else if strings.HasSuffix(lookup[0], ".googleusercontent.com.") { + return true, true, "Google爬虫(用户触发)" + } else { + return true, false, "可能不是Google爬虫" + } + } else { + return true, false, "可能不是Google爬虫" + } + } else { + return true, false, "伪装Google爬虫" + } +} + +/* +* +bing的蜘蛛 +*/ +func bingSpider(ip string) (bool, bool, string) { + //先查询本地库 + //然后远端查询 + lookup, err := ReverseDNSLookup(ip) + if err == nil { + if len(lookup) > 0 { + if strings.HasSuffix(lookup[0], ".msn.com.") { + return true, true, "Bing爬虫" + } else { + return true, false, "可能不是Bing爬虫" + } + } else { + return true, false, "可能不是Bing爬虫" + } + } else { + return true, false, "伪装Bing爬虫" + } +} + +/* +* +sogou蜘蛛 +*/ +func sogouSpider(ip string) (bool, bool, string) { + //先查询本地库 + //然后远端查询 + lookup, err := ReverseDNSLookup(ip) + if err == nil { + if len(lookup) > 0 { + if strings.HasSuffix(lookup[0], ".sogou.com.") { + return true, true, "搜狗爬虫" + } else { + return true, false, "可能不是搜狗爬虫" + } + } else { + return true, false, "可能不是搜狗爬虫" + } + } else { + return true, false, "伪装搜狗爬虫" + } +} + +/* +* +360 搜索引擎 +*/ +func spider360(ip string) (bool, bool, string) { + // 将要检查的 IP 地址段转换成数组 + ipRanges := []string{ + "180.153.232.", + "180.153.234.", + "180.153.236.", + "180.163.220.", + "42.236.101.", + "42.236.102.", + "42.236.103.", + "42.236.10.", + "42.236.12.", + "42.236.13.", + "42.236.14.", + "42.236.15.", + "42.236.16.", + "42.236.17.", + "42.236.46.", + "42.236.48.", + "42.236.49.", + "42.236.50.", + "42.236.51.", + "42.236.52.", + "42.236.53.", + "42.236.54.", + "42.236.55.", + "42.236.99.", + } + // 判断指定 IP 是否在数组中的 IP 地址段范围内 + isInRange := false + for _, ipRange := range ipRanges { + if strings.HasPrefix(ip, ipRange) { + isInRange = true + break + } + } + if isInRange { + return true, true, "360爬虫" + } else { + return true, false, "伪装360爬虫" + } +} + +/* +* +UC 搜索 +*/ +func yisouSpider(ip string) (bool, bool, string) { + //先查询本地库 + //然后远端查询 + lookup, err := ReverseDNSLookup(ip) + if err == nil { + if len(lookup) > 0 { + if strings.HasSuffix(lookup[0], ".sm.cn.") { + return true, true, "神马搜索爬虫" + } else { + return true, false, "可能不是神马搜索爬虫" + } + } else { + return true, false, "可能不是神马搜索爬虫" + } + } else { + return true, false, "伪装神马搜索爬虫" + } +} + +/* +* +字节跳动的爬虫 +*/ +func byteSpider(ip string) (bool, bool, string) { + ipRanges := []string{ + "110.249.201.0/24", + "110.249.202.0/24", + "111.225.148.0/24", + "111.225.149.0/24", + "220.243.135.0/24", + "220.243.136.0/24", + "220.243.188.0/24", + "220.243.189.0/24", + "60.8.123.0/24", + "60.8.151.0/24", + } + + isInRanges := utils.CheckIPInRanges(ip, ipRanges) + if isInRanges { + return true, true, "字节跳动爬虫" + } else { + return true, false, "伪装字节跳动爬虫" + } +} diff --git a/wafbot/dns_search.go b/wafbot/dns_search.go new file mode 100644 index 0000000..02be4b9 --- /dev/null +++ b/wafbot/dns_search.go @@ -0,0 +1,37 @@ +package wafbot + +import ( + "SamWaf/global" + "context" + "fmt" + "net" + "time" +) + +func ReverseDNSLookup(ipAddress string) ([]string, error) { + startTime := time.Now() + + ctx := context.Background() + d := net.Dialer{Resolver: &net.Resolver{ + PreferGo: true, + Dial: func(ctx context.Context, network, address string) (net.Conn, error) { + return net.Dial("udp", global.GWAF_RUNTIME_DNS_SERVER+":53") + }, + }} + ctxWithTimeout, cancel := context.WithTimeout(ctx, 500*time.Millisecond) + defer cancel() + names, err := d.Resolver.LookupAddr(ctxWithTimeout, ipAddress) + + elapsed := time.Since(startTime) + + fmt.Println(elapsed) + if err != nil { + return nil, fmt.Errorf("逆向 DNS 查询失败: %s", err) + } + + if len(names) == 0 { + return nil, fmt.Errorf("未找到与该 IP 地址关联的域名") + } + + return names, nil +} diff --git a/wafbot/dns_search_test.go b/wafbot/dns_search_test.go new file mode 100644 index 0000000..3807ae4 --- /dev/null +++ b/wafbot/dns_search_test.go @@ -0,0 +1,15 @@ +package wafbot + +import ( + "fmt" + "testing" +) + +func TestReverseDNSLookup(t *testing.T) { + lookup, err := ReverseDNSLookup("114.119.151.1") + if err == nil { + for _, s := range lookup { + fmt.Println(s) + } + } +} diff --git a/wafenginecore/wafengine.go b/wafenginecore/wafengine.go index b060824..c26b00c 100644 --- a/wafenginecore/wafengine.go +++ b/wafenginecore/wafengine.go @@ -11,6 +11,7 @@ import ( "SamWaf/plugin" "SamWaf/utils" "SamWaf/utils/zlog" + "SamWaf/wafbot" "SamWaf/wafproxy" "bufio" "bytes" @@ -117,31 +118,33 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { } datetimeNow := time.Now() weblogbean := innerbean.WebLog{ - HOST: host, - URL: enEscapeUrl, - REFERER: r.Referer(), - USER_AGENT: r.UserAgent(), - METHOD: r.Method, - HEADER: string(header), - COUNTRY: region[0], - PROVINCE: region[2], - CITY: region[3], - SRC_IP: ipAndPort[0], - SRC_PORT: ipAndPort[1], - CREATE_TIME: datetimeNow.Format("2006-01-02 15:04:05"), - UNIX_ADD_TIME: datetimeNow.UnixNano() / 1e6, - CONTENT_LENGTH: contentLength, - COOKIES: string(cookies), - BODY: string(bodyByte), - REQ_UUID: uuid.NewV4().String(), - USER_CODE: global.GWAF_USER_CODE, - HOST_CODE: waf.HostTarget[host].Host.Code, - TenantId: global.GWAF_TENANT_ID, - RULE: "", - ACTION: "通过", - Day: currentDay, - POST_FORM: r.PostForm.Encode(), - TASK_FLAG: -1, + HOST: host, + URL: enEscapeUrl, + REFERER: r.Referer(), + USER_AGENT: r.UserAgent(), + METHOD: r.Method, + HEADER: string(header), + COUNTRY: region[0], + PROVINCE: region[2], + CITY: region[3], + SRC_IP: ipAndPort[0], + SRC_PORT: ipAndPort[1], + CREATE_TIME: datetimeNow.Format("2006-01-02 15:04:05"), + UNIX_ADD_TIME: datetimeNow.UnixNano() / 1e6, + CONTENT_LENGTH: contentLength, + COOKIES: string(cookies), + BODY: string(bodyByte), + REQ_UUID: uuid.NewV4().String(), + USER_CODE: global.GWAF_USER_CODE, + HOST_CODE: waf.HostTarget[host].Host.Code, + TenantId: global.GWAF_TENANT_ID, + RULE: "", + ACTION: "通过", + Day: currentDay, + POST_FORM: r.PostForm.Encode(), + TASK_FLAG: -1, + RISK_LEVEL: 0, //危险等级 + GUEST_IDENTIFICATION: "正常访客", //访客身份识别 } formValues := url.Values{} @@ -205,6 +208,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { if waf.HostTarget[host].IPBlockLists != nil { for i := 0; i < len(waf.HostTarget[host].IPBlockLists); i++ { if waf.HostTarget[host].IPBlockLists[i].Ip == weblogbean.SRC_IP { + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "IP黑名单", "您的访问被阻止了IP限制") return } @@ -214,6 +218,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { if waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].Host.GUARD_STATUS == 1 && waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].IPBlockLists != nil { for i := 0; i < len(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].IPBlockLists); i++ { if waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].IPBlockLists[i].Ip == weblogbean.SRC_IP { + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "【全局】IP黑名单", "您的访问被阻止了IP限制") return } @@ -227,6 +232,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { (waf.HostTarget[host].UrlBlockLists[i].CompareType == "前缀匹配" && strings.HasPrefix(weblogbean.URL, waf.HostTarget[host].UrlBlockLists[i].Url)) || (waf.HostTarget[host].UrlBlockLists[i].CompareType == "后缀匹配" && strings.HasSuffix(weblogbean.URL, waf.HostTarget[host].UrlBlockLists[i].Url)) || (waf.HostTarget[host].UrlBlockLists[i].CompareType == "包含匹配" && strings.Contains(weblogbean.URL, waf.HostTarget[host].UrlBlockLists[i].Url)) { + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "URL黑名单", "您的访问被阻止了URL限制") return } @@ -239,6 +245,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].CompareType == "前缀匹配" && strings.HasPrefix(weblogbean.URL, waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].Url)) || (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].CompareType == "后缀匹配" && strings.HasSuffix(weblogbean.URL, waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].Url)) || (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].CompareType == "包含匹配" && strings.Contains(weblogbean.URL, waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].UrlBlockLists[i].Url)) { + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "【全局】URL黑名单", "您的访问被阻止了URL限制") return } @@ -247,6 +254,19 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { if jumpGuardFlag == false { + //检测爬虫bot + isBot, isNormalBot, BotName := wafbot.DetermineNormalSearch(weblogbean.USER_AGENT, weblogbean.SRC_IP) + if isBot == true { + if isNormalBot { + weblogbean.GUEST_IDENTIFICATION = BotName + } else { + weblogbean.GUEST_IDENTIFICATION = BotName + weblogbean.RISK_LEVEL = 1 + EchoErrorInfo(w, r, weblogbean, BotName, "请正确访问") + return + } + } + var sqlFlag = false //检测sql注入 if libinjection.IsSQLiNotReturnPrint(weblogbean.URL) || @@ -264,6 +284,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { } } if sqlFlag == true { + weblogbean.RISK_LEVEL = 2 EchoErrorInfo(w, r, weblogbean, "SQL注入", "请正确访问") return } @@ -283,6 +304,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { } } if xssFlag == true { + weblogbean.RISK_LEVEL = 2 EchoErrorInfo(w, r, weblogbean, "XSS跨站注入", "请正确访问") return } @@ -294,6 +316,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { scanFlag = true } if scanFlag == true { + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "扫描工具", "请正确访问") return } @@ -301,7 +324,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { if waf.HostTarget[host].PluginIpRateLimiter != nil { limiter := waf.HostTarget[host].PluginIpRateLimiter.GetLimiter(weblogbean.SRC_IP) if !limiter.Allow() { - fmt.Println("超量了") + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "触发IP频次访问限制1", "您的访问被阻止超量了1") return } @@ -310,7 +333,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { if waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].Host.GUARD_STATUS == 1 && waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].PluginIpRateLimiter != nil { limiter := waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].PluginIpRateLimiter.GetLimiter(weblogbean.SRC_IP) if !limiter.Allow() { - fmt.Println("超量了") + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "【全局】触发IP频次访问限制", "您的访问被阻止超量了") return } @@ -327,6 +350,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { rulestr = rulestr + v.RuleDescription + "," } w.Header().Set("WAF", "SAMWAF DROP") + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, rulestr, "您的访问被阻止触发规则") return } @@ -346,6 +370,7 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { rulestr = rulestr + v.RuleDescription + "," } w.Header().Set("WAF", "SAMWAF DROP") + weblogbean.RISK_LEVEL = 1 EchoErrorInfo(w, r, weblogbean, "【全局】"+rulestr, "您的访问被阻止触发规则") return } @@ -469,9 +494,9 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) { } func EchoErrorInfo(w http.ResponseWriter, r *http.Request, weblogbean innerbean.WebLog, ruleName string, blockInfo string) { //通知信息 - noticeStr := fmt.Sprintf("网站域名:%s 访问IP:%s 归属地区：%s 规则：%s 阻止信息：%s", weblogbean.HOST, weblogbean.SRC_IP, utils.GetCountry(weblogbean.SRC_IP), ruleName, blockInfo) + /* noticeStr := fmt.Sprintf("网站域名:%s 访问IP:%s 归属地区：%s 规则：%s 阻止信息：%s", weblogbean.HOST, weblogbean.SRC_IP, utils.GetCountry(weblogbean.SRC_IP), ruleName, blockInfo) - zlog.Debug(noticeStr) + zlog.Debug(noticeStr)*/ //发送微信推送消息 global.GQEQUE_MESSAGE_DB.PushBack(innerbean.RuleMessageInfo{ BaseMessageInfo: innerbean.BaseMessageInfo{OperaType: "命中保护规则", Server: global.GWAF_CUSTOM_SERVER_NAME}, diff --git a/waftask/localtaskcounter.go b/waftask/localtaskcounter.go index 27e5804..4063670 100644 --- a/waftask/localtaskcounter.go +++ b/waftask/localtaskcounter.go @@ -92,7 +92,7 @@ func TaskCounter() { //一、 主机聚合统计 { var resultHosts []CountHostResult - global.GWAF_LOCAL_LOG_DB.Raw("SELECT host_code, user_code,tenant_id ,action,count(req_uuid) as count,day,host FROM \"web_logs\" where task_flag = ? and unix_add_time > ? GROUP BY host_code, user_code,action,tenant_id,day,host", + global.GWAF_LOCAL_LOG_DB.Debug().Raw("SELECT host_code, user_code,tenant_id ,action,count(req_uuid) as count,day,host FROM \"web_logs\" where task_flag = ? and unix_add_time > ? GROUP BY host_code, user_code,action,tenant_id,day,host", 1, currenyDayMillisecondsBak).Scan(&resultHosts) /**** 1.如果不存在则创建 @@ -363,6 +363,20 @@ func TaskLoadSetting() { } wafSystemConfigService.AddApi(wafSystemConfigAddReq) } + + //dns查询 + configItem = wafSystemConfigService.GetDetailByItem("dns_server") + if configItem.Id != "" { + if global.GWAF_RUNTIME_DNS_SERVER != configItem.Value { + global.GWAF_RUNTIME_DNS_SERVER = configItem.Value + } + } else { + wafSystemConfigService.AddApi(request.WafSystemConfigAddReq{ + Item: "dns_server", + Value: global.GWAF_RUNTIME_DNS_SERVER, + Remarks: "DNS服务器", + }) + } } /*