diff --git a/api/waf_ip_lookup.go b/api/waf_ip_lookup.go
index 3d70893..abab13c 100644
--- a/api/waf_ip_lookup.go
+++ b/api/waf_ip_lookup.go
@@ -11,10 +11,10 @@ import (
type WafIPLookupApi struct {
}
-// LookupApi IP归属查询
-// @Summary IP归属查询
+// LookupApi IP策略命中查询
+// @Summary IP策略命中查询
// @Description 查一个IP当前落在哪些名单里：IP黑/白名单、IP组、威胁情报IP、IP失败封禁、CC封禁、系统防火墙封禁、CDN回源段
-// @Tags 网站防护-IP归属查询
+// @Tags 网站防护-IP策略命中查询
// @Produce json
// @Param ip query string true "待查询的IP"
// @Param sources query string false "只查指定来源(逗号分隔)，留空查全部"
diff --git a/api/waf_log.go b/api/waf_log.go
index 6e8591a..1aca1b0 100644
--- a/api/waf_log.go
+++ b/api/waf_log.go
@@ -26,6 +26,19 @@ import (
type WafLogAPi struct {
}
+var logRequestIDPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.:-]{0,63}$`)
+
+func normalizeLogRequestID(value string, required bool) (string, error) {
+ value = strings.TrimSpace(value)
+ if value == "" && !required {
+ return "", nil
+ }
+ if !logRequestIDPattern.MatchString(value) {
+ return "", fmt.Errorf("访问识别码格式不正确（需为 1–64 位字母、数字或分隔符）")
+ }
+ return value, nil
+}
+
// GetDetailApi 获取攻击日志详情
// @Summary 获取攻击日志详情
// @Description 根据 req_uuid 获取单条攻击日志详情（含请求体、响应体）
@@ -47,7 +60,16 @@ func (w *WafLogAPi) GetDetailApi(c *gin.Context) {
response.FailWithMessage("正在切换数据库请等待", c)
return
}
- wafLog, _ := wafLogService.GetDetailApi(req)
+ req.REQ_UUID, err = normalizeLogRequestID(req.REQ_UUID, true)
+ if err != nil {
+ response.FailWithMessage(err.Error(), c)
+ return
+ }
+ wafLog, err := wafLogService.GetDetailApi(req)
+ if err != nil {
+ response.FailWithMessage("获取日志详情失败:"+err.Error(), c)
+ return
+ }
response.OkWithDetailed(wafLog, "获取成功", c)
} else {
response.FailWithMessage("解析失败", c)
@@ -73,6 +95,11 @@ func (w *WafLogAPi) GetListApi(c *gin.Context) {
response.FailWithMessage("正在切换数据库请等待", c)
return
}
+ req.ReqUuid, err = normalizeLogRequestID(req.ReqUuid, false)
+ if err != nil {
+ response.FailWithMessage(err.Error(), c)
+ return
+ }
wafLogs, total, meta, err2 := wafLogService.GetListApiWithMeta(req)
if err2 != nil {
response.FailWithMessage("访问列表失败:"+err2.Error(), c)
@@ -317,7 +344,16 @@ func (w *WafLogAPi) GetHttpCopyMaskApi(c *gin.Context) {
response.FailWithMessage("正在切换数据库请等待", c)
return
}
- wafLog, _ := wafLogService.GetDetailApi(req)
+ req.REQ_UUID, err = normalizeLogRequestID(req.REQ_UUID, true)
+ if err != nil {
+ response.FailWithMessage(err.Error(), c)
+ return
+ }
+ wafLog, err := wafLogService.GetDetailApi(req)
+ if err != nil {
+ response.FailWithMessage("获取日志详情失败:"+err.Error(), c)
+ return
+ }
if req.OutputFormat == "curl" {
response.OkWithDetailed(GenerateCurlRequest(wafLog), "获取成功", c)
diff --git a/api/waf_log_test.go b/api/waf_log_test.go
new file mode 100644
index 0000000..9d3a4dc
--- /dev/null
+++ b/api/waf_log_test.go
@@ -0,0 +1,172 @@
+package api
+
+import (
+ "SamWaf/global"
+ "SamWaf/innerbean"
+ "SamWaf/model"
+ "SamWaf/model/common/response"
+ "SamWaf/service/waf_service"
+ "SamWaf/wafdb/dialect"
+ "bytes"
+ "encoding/json"
+ "errors"
+ "net/http"
+ "net/http/httptest"
+ "net/url"
+ "strings"
+ "testing"
+
+ "github.com/gin-gonic/gin"
+ "gorm.io/gorm"
+)
+
+func setupLogAPITest(t *testing.T) *gorm.DB {
+ t.Helper()
+ priorDialect := func() (d dialect.DBDialect) {
+ defer func() { _ = recover() }()
+ return dialect.Get()
+ }()
+ dialect.Register(&dialect.SQLiteDialect{})
+ db := openNotifyTestDB(t)
+ if err := db.AutoMigrate(&model.ShareDb{}, &model.AccessLog{}, &model.SecurityEvent{}, &model.EventPayload{}, &innerbean.WebLog{}); err != nil {
+ t.Fatal(err)
+ }
+ oldCore, oldLog := global.GWAF_LOCAL_DB, global.GWAF_LOCAL_LOG_DB
+ oldTenant, oldUser, oldChanging := global.GWAF_TENANT_ID, global.GWAF_USER_CODE, global.GDATA_CURRENT_CHANGE
+ global.GWAF_LOCAL_DB, global.GWAF_LOCAL_LOG_DB = db, db
+ global.GWAF_TENANT_ID, global.GWAF_USER_CODE, global.GDATA_CURRENT_CHANGE = "api-log-tenant", "api-log-user", false
+ waf_service.InvalidateShardCounts()
+ t.Cleanup(func() {
+ global.GWAF_LOCAL_DB, global.GWAF_LOCAL_LOG_DB = oldCore, oldLog
+ global.GWAF_TENANT_ID, global.GWAF_USER_CODE, global.GDATA_CURRENT_CHANGE = oldTenant, oldUser, oldChanging
+ waf_service.InvalidateShardCounts()
+ dialect.Register(priorDialect)
+ })
+ if err := db.Callback().Query().Before("gorm:query").Register("tenant_plugin:before_query", func(d *gorm.DB) {
+ d.Where("tenant_id = ? and user_code = ?", global.GWAF_TENANT_ID, global.GWAF_USER_CODE)
+ }); err != nil {
+ t.Fatal(err)
+ }
+ row := model.SecurityEvent{LogNarrow: model.LogNarrow{
+ ReqUUID: "req_nonstandard_0", TenantId: global.GWAF_TENANT_ID, UserCode: global.GWAF_USER_CODE,
+ URL: "https://example.test/check", Method: "GET", HostCode: "api-host", UNIX_ADD_TIME: 1,
+ }}
+ if err := db.Create(&row).Error; err != nil {
+ t.Fatal(err)
+ }
+ if err := db.Create(&model.AccessLog{LogNarrow: row.LogNarrow}).Error; err != nil {
+ t.Fatal(err)
+ }
+ return db
+}
+
+func callLogTestAPI(t *testing.T, handler gin.HandlerFunc, method, target, body string) response.Response {
+ t.Helper()
+ gin.SetMode(gin.TestMode)
+ r := gin.New()
+ r.Use(func(c *gin.Context) { c.Set("is_openapi", true) })
+ r.Handle(method, "/t", handler)
+ req := httptest.NewRequest(method, target, bytes.NewBufferString(body))
+ if method == http.MethodPost {
+ req.Header.Set("Content-Type", "application/json")
+ }
+ rec := httptest.NewRecorder()
+ r.ServeHTTP(rec, req)
+ var result response.Response
+ if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
+ t.Fatalf("response decode: %v, body=%s", err, rec.Body.String())
+ }
+ return result
+}
+
+func TestLogDetailAPIsHandleErrorsAndLegacyIDs(t *testing.T) {
+ db := setupLogAPITest(t)
+ api := &WafLogAPi{}
+ for _, handler := range []struct {
+ name string
+ call gin.HandlerFunc
+ }{{"detail", api.GetDetailApi}, {"copy", api.GetHttpCopyMaskApi}} {
+ for _, format := range []string{"raw", "curl"} {
+ for _, tc := range []struct {
+ name, id, shard, wantMsg string
+ wantCode int
+ }{
+ {"legacy-form", "req_nonstandard_0", "local_log.db", "获取成功", response.SUCCESS},
+ {"trimmed", " req_nonstandard_0 ", "local_log.db", "获取成功", response.SUCCESS},
+ {"missing", "req_missing", "local_log.db", "未找到该识别码", response.ERROR},
+ {"missing-auto", "req_missing", "auto", "未找到该识别码", response.ERROR},
+ {"missing-shard", "req_missing", "local_log_199901.db", "存储已不存在", response.ERROR},
+ {"empty", "", "local_log.db", "解析失败", response.ERROR},
+ {"whitespace", " ", "local_log.db", "格式不正确", response.ERROR},
+ {"too-long", strings.Repeat("a", 65), "local_log.db", "解析失败", response.ERROR},
+ {"invalid", "req_bad\nvalue", "local_log.db", "格式不正确", response.ERROR},
+ } {
+ t.Run(handler.name+"/"+format+"/"+tc.name, func(t *testing.T) {
+ query := url.Values{"REQ_UUID": {tc.id}, "current_db_name": {tc.shard}, "output_format": {format}}
+ got := callLogTestAPI(t, handler.call, http.MethodGet, "/t?"+query.Encode(), "")
+ if got.Code != tc.wantCode || !strings.Contains(got.Msg, tc.wantMsg) {
+ t.Fatalf("expected code=%d msg contains %q, got %+v", tc.wantCode, tc.wantMsg, got)
+ }
+ if got.Code != response.SUCCESS {
+ data, ok := got.Data.(map[string]interface{})
+ if !ok || len(data) != 0 {
+ t.Fatalf("failure must not return empty detail or generated request: %+v", got.Data)
+ }
+ } else if handler.name == "detail" {
+ data, ok := got.Data.(map[string]interface{})
+ if !ok || data["req_uuid"] != "req_nonstandard_0" {
+ t.Fatalf("REQ_UUID form binding failed: %+v", got.Data)
+ }
+ } else if data, ok := got.Data.(string); !ok || !strings.Contains(data, "GET") || strings.Contains(data, "curl -X ") {
+ t.Fatalf("copy should contain a populated request: %+v", got.Data)
+ }
+ })
+ }
+ }
+ }
+ if err := db.Callback().Query().Before("gorm:query").Register("test:read_error", func(db *gorm.DB) { db.AddError(errors.New("test read failure")) }); err != nil {
+ t.Fatal(err)
+ }
+ for _, handler := range []gin.HandlerFunc{api.GetDetailApi, api.GetHttpCopyMaskApi} {
+ got := callLogTestAPI(t, handler, http.MethodGet, "/t?REQ_UUID=req_nonstandard_0¤t_db_name=local_log.db&output_format=curl", "")
+ if got.Code != response.ERROR || !strings.Contains(got.Msg, "查询日志详情失败") {
+ t.Fatalf("read failure must propagate: %+v", got)
+ }
+ }
+}
+
+func TestLogListAPIUUIDValidationAndSelectedShard(t *testing.T) {
+ setupLogAPITest(t)
+ api := &WafLogAPi{}
+ for _, tc := range []struct {
+ name, id string
+ wantCode int
+ wantTotal float64
+ }{
+ {"legacy-trimmed", " req_nonstandard_0 ", response.SUCCESS, 1},
+ {"missing", "req_missing", response.SUCCESS, 0},
+ {"too-long", strings.Repeat("a", 65), response.ERROR, 0},
+ {"invalid", "req_bad value", response.ERROR, 0},
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ body, err := json.Marshal(map[string]interface{}{
+ "req_uuid": tc.id, "current_db_name": "local_log_199901.db",
+ "unix_add_time_begin": "4102444800000", "unix_add_time_end": "4102531200000",
+ "sort_by": "unix_add_time", "sort_descending": "desc", "pageIndex": 1, "pageSize": 10,
+ })
+ if err != nil {
+ t.Fatal(err)
+ }
+ got := callLogTestAPI(t, api.GetListApi, http.MethodPost, "/t", string(body))
+ if got.Code != tc.wantCode {
+ t.Fatalf("expected code=%d got %+v", tc.wantCode, got)
+ }
+ if got.Code == response.SUCCESS {
+ data, ok := got.Data.(map[string]interface{})
+ if !ok || data["total"] != tc.wantTotal || data["uuid_lookup"] != true {
+ t.Fatalf("selected shard/date UUID query: %+v", got.Data)
+ }
+ }
+ })
+ }
+}
diff --git a/global/template_config.go b/global/template_config.go
index 7d5102e..efadf0f 100644
--- a/global/template_config.go
+++ b/global/template_config.go
@@ -1,4 +1,4 @@
package global
// GLOBAL_DEFAULT_BLOCK_INFO 默认被拦截的HTML的内容
-var GLOBAL_DEFAULT_BLOCK_INFO string = "\n \n \n \n \n 您的访问被阻止\n \n \n \n \n
您的访问被阻止
\n
由于安全策略，您的请求被阻止。
如果有疑问，请将下面的访问识别码发给管理员，以便进一步排查。
\n
访问识别码：[[.SAMWAF_REQ_UUID]]
\n\t\t \n
\n
您的访问被阻止
\n
由于安全策略，您的请求被阻止。
如果有疑问，请将下面的访问识别码和您的 IP 发给管理员，以便进一步排查。
\n
访问识别码：[[.SAMWAF_REQ_UUID]]
\n
您的 IP：[[.SAMWAF_IP]]
\n\t\t \n
legacy uuid=[[.SAMWAF_REQ_UUID]]
`
+ inputs := []struct {
+ name string
+ ip string
+ want string
+ }{
+ {"IPv4", "203.0.113.10", "203.0.113.10"},
+ {"IPv6", "2001:0DB8:0000:0000:0000:0000:0000:0001", "2001:db8::1"},
+ {"invalid", "203.0.113.10", ""},
+ {"empty", "", ""},
+ }
+
+ for _, entry := range []string{"request", "response", "backend"} {
+ for _, mode := range []string{"default", "host", "global", "legacy"} {
+ for _, input := range inputs {
+ t.Run(entry+"/"+mode+"/"+input.name, func(t *testing.T) {
+ hostSafe := &wafenginmodel.HostSafe{BlockingPage: map[string]model.BlockingPage{}}
+ globalSafe := &wafenginmodel.HostSafe{BlockingPage: map[string]model.BlockingPage{}}
+ content := customTemplate
+ if mode == "default" {
+ content = global.GLOBAL_DEFAULT_BLOCK_INFO
+ } else if mode == "legacy" {
+ content = legacyTemplate
+ }
+ configuredPage := model.BlockingPage{ResponseCode: "403", ResponseContent: content}
+ if mode == "global" {
+ globalSafe.BlockingPage["403"] = configuredPage
+ } else if mode != "default" || entry == "backend" {
+ hostSafe.BlockingPage["403"] = configuredPage
+ }
+ log := &innerbean.WebLog{REQ_UUID: reqUUID, SRC_IP: input.ip}
+ var got string
+ switch entry {
+ case "request":
+ r := httptest.NewRequest("GET", "http://example.test/", nil)
+ r.RemoteAddr = "198.51.100.20:12345"
+ r.Header.Set("X-Forwarded-For", "192.0.2.30")
+ w := httptest.NewRecorder()
+ code := EchoErrorInfo(w, r, log, "test", "blocked", hostSafe, globalSafe, false, "")
+ if code != 403 || w.Code != 403 {
+ t.Fatalf("unexpected status: returned=%d response=%d", code, w.Code)
+ }
+ got = w.Body.String()
+ case "response":
+ resp := newBackendResp(200, "200 OK", "text/plain", []byte("backend"))
+ EchoResponseErrorInfo(resp, log, "test", "blocked", hostSafe, globalSafe, false, "")
+ got = string(readBody(t, resp))
+ if resp.StatusCode != 403 || resp.ContentLength != int64(len(got)) || resp.Header.Get("Content-Length") != strconv.Itoa(len(got)) {
+ t.Fatalf("response metadata differs from rendered page: %+v", resp)
+ }
+ case "backend":
+ resp := newBackendResp(403, "403 Forbidden", "text/html", nil)
+ p := resolveCustomErrorPage(hostSafe, globalSafe, 403)
+ if p == nil {
+ t.Fatal("configured backend page not resolved")
+ }
+ result := applyCustomErrorPage(resp, p, 403, resp.Status, log.REQ_UUID, log.SRC_IP)
+ if !result.TemplateApplied {
+ t.Fatal("backend page not rendered")
+ }
+ got = string(readBody(t, resp))
+ if resp.StatusCode != 403 || resp.ContentLength != int64(len(got)) || resp.Header.Get("Content-Length") != strconv.Itoa(len(got)) {
+ t.Fatalf("backend response metadata differs from rendered page: %+v", resp)
+ }
+ }
+
+ if mode == "legacy" {
+ if want := "legacy uuid=" + reqUUID + "
"; got != want {
+ t.Fatalf("legacy template changed: got %q, want %q", got, want)
+ }
+ } else if mode == "default" {
+ for _, want := range []string{
+ "访问识别码：" + reqUUID,
+ `您的 IP：` + input.want + "
",
+ "访问识别码和您的 IP 发给管理员",
+ "overflow-wrap: anywhere;",
+ "width: calc(100% - 32px);",
+ "box-sizing: border-box;",
+ } {
+ if !strings.Contains(got, want) {
+ t.Fatalf("default page missing %q", want)
+ }
+ }
+ if strings.Index(got, "您的 IP：") < strings.Index(got, "访问识别码：") {
+ t.Fatal("IP should appear below request UUID")
+ }
+ } else if want := "uuid=" + reqUUID + " ip=" + input.want; got != want {
+ t.Fatalf("rendered page = %q, want %q", got, want)
+ }
+ if log.SRC_IP != input.ip {
+ t.Fatalf("log source IP changed: %q", log.SRC_IP)
+ }
+ })
+ }
+ }
+ }
+}
diff --git a/wafenginecore/wafengine.go b/wafenginecore/wafengine.go
index 493c7fb..d9962ef 100644
--- a/wafenginecore/wafengine.go
+++ b/wafenginecore/wafengine.go
@@ -599,7 +599,8 @@ func (waf *WafEngine) ServeHTTP(w http.ResponseWriter, r *http.Request) {
weblogbean.RULE = "CC封禁"
} else {
notifyCCBanOnce(hitKey, banIP, region)
- EchoErrorInfo(w, r, &weblogbean, "", "当前IP由于访问频次太高暂时无法访问", hostTarget, waf.rt().HostTarget[waf.rt().HostCode[global.GWAF_GLOBAL_HOST_CODE]], false, "cc_attack")
+ responseCode := EchoErrorInfo(w, r, &weblogbean, "", "当前IP由于访问频次太高暂时无法访问", hostTarget, waf.rt().HostTarget[waf.rt().HostCode[global.GWAF_GLOBAL_HOST_CODE]], false, "cc_attack")
+ global.GQEQUE_LOG_DB.Enqueue(ccBanLog(&weblogbean, responseCode))
return
}
}
@@ -1422,7 +1423,7 @@ func (waf *WafEngine) modifyResponse() func(*http.Response) error {
)
if customBlockingPage != nil {
- pageResult := applyCustomErrorPage(resp, customBlockingPage, backendStatusCode, backendStatus, weblogfrist.REQ_UUID)
+ pageResult := applyCustomErrorPage(resp, customBlockingPage, backendStatusCode, backendStatus, weblogfrist.REQ_UUID, weblogfrist.SRC_IP)
if pageResult.TemplateApplied {
// 记录响应Header信息
diff --git a/wafqueue/log_tier.go b/wafqueue/log_tier.go
index 53143d9..ba7d494 100644
--- a/wafqueue/log_tier.go
+++ b/wafqueue/log_tier.go
@@ -70,8 +70,10 @@ func tierForStore(logs []*innerbean.WebLog) (events []*model.SecurityEvent, acce
if isEvent {
events = dedupByUUID(events, seenEvent, lg.REQ_UUID,
&model.SecurityEvent{LogNarrow: ln, PayloadHash: PayloadHash(lg.RULE, lg.BodyHash)})
- if p := extractPayload(lg, PayloadKindEvent); p != nil {
- payloads = dedupByUUID(payloads, seenPayload, p.ReqUUID, p)
+ if !lg.SkipPayloadStore {
+ if p := extractPayload(lg, PayloadKindEvent); p != nil {
+ payloads = dedupByUUID(payloads, seenPayload, p.ReqUUID, p)
+ }
}
}
if watched {
@@ -105,48 +107,48 @@ func narrowFromLog(lg *innerbean.WebLog) model.LogNarrow {
truncated = 1
}
return model.LogNarrow{
- ReqUUID: lg.REQ_UUID,
- TenantId: lg.TenantId,
- UserCode: lg.USER_CODE,
- HostCode: lg.HOST_CODE,
- Host: lg.HOST,
- URL: url,
- RawQuery: rawQuery,
- Method: lg.METHOD,
- Scheme: lg.Scheme,
- REFERER: cutUTF8N(lg.REFERER, 1024),
- USER_AGENT: cutUTF8N(lg.USER_AGENT, 500),
- SRC_IP: lg.SRC_IP,
- SRC_PORT: lg.SRC_PORT,
- NetSrcIp: lg.NetSrcIp,
- COUNTRY: lg.COUNTRY,
- PROVINCE: lg.PROVINCE,
- CITY: lg.CITY,
- ACTION: lg.ACTION,
- RULE: lg.RULE,
- STATUS: lg.STATUS,
- STATUS_CODE: lg.STATUS_CODE,
- RISK_LEVEL: lg.RISK_LEVEL,
- AI_SCORE: lg.AI_SCORE,
- IsBot: lg.IsBot,
- LogOnlyMode: lg.LogOnlyMode,
+ ReqUUID: lg.REQ_UUID,
+ TenantId: lg.TenantId,
+ UserCode: lg.USER_CODE,
+ HostCode: lg.HOST_CODE,
+ Host: lg.HOST,
+ URL: url,
+ RawQuery: rawQuery,
+ Method: lg.METHOD,
+ Scheme: lg.Scheme,
+ REFERER: cutUTF8N(lg.REFERER, 1024),
+ USER_AGENT: cutUTF8N(lg.USER_AGENT, 500),
+ SRC_IP: lg.SRC_IP,
+ SRC_PORT: lg.SRC_PORT,
+ NetSrcIp: lg.NetSrcIp,
+ COUNTRY: lg.COUNTRY,
+ PROVINCE: lg.PROVINCE,
+ CITY: lg.CITY,
+ ACTION: lg.ACTION,
+ RULE: lg.RULE,
+ STATUS: lg.STATUS,
+ STATUS_CODE: lg.STATUS_CODE,
+ RISK_LEVEL: lg.RISK_LEVEL,
+ AI_SCORE: lg.AI_SCORE,
+ IsBot: lg.IsBot,
+ LogOnlyMode: lg.LogOnlyMode,
GUEST_IDENTIFICATION: lg.GUEST_IDENTIFICATION,
- TimeSpent: lg.TimeSpent,
- CONTENT_LENGTH: lg.CONTENT_LENGTH,
- ResContentLength: lg.RES_CONTENT_LENGTH,
- PreCheckCost: lg.PreCheckCost,
- ForwardCost: lg.ForwardCost,
- BackendCheckCost: lg.BackendCheckCost,
- IsBalance: lg.IsBalance,
- BalanceInfo: lg.BalanceInfo,
- BodyHash: lg.BodyHash,
- Truncated: truncated,
- ActorKey: ActorKey(lg.SRC_IP),
- UaHash: UaHash(lg.USER_AGENT),
- PathNorm: NormalizePath(lg.URL),
- CREATE_TIME: lg.CREATE_TIME,
- UNIX_ADD_TIME: lg.UNIX_ADD_TIME,
- Day: lg.Day,
+ TimeSpent: lg.TimeSpent,
+ CONTENT_LENGTH: lg.CONTENT_LENGTH,
+ ResContentLength: lg.RES_CONTENT_LENGTH,
+ PreCheckCost: lg.PreCheckCost,
+ ForwardCost: lg.ForwardCost,
+ BackendCheckCost: lg.BackendCheckCost,
+ IsBalance: lg.IsBalance,
+ BalanceInfo: lg.BalanceInfo,
+ BodyHash: lg.BodyHash,
+ Truncated: truncated,
+ ActorKey: ActorKey(lg.SRC_IP),
+ UaHash: UaHash(lg.USER_AGENT),
+ PathNorm: NormalizePath(lg.URL),
+ CREATE_TIME: lg.CREATE_TIME,
+ UNIX_ADD_TIME: lg.UNIX_ADD_TIME,
+ Day: lg.Day,
}
}
diff --git a/wafqueue/log_tier_db_test.go b/wafqueue/log_tier_db_test.go
index 44ca0c8..9919e51 100644
--- a/wafqueue/log_tier_db_test.go
+++ b/wafqueue/log_tier_db_test.go
@@ -91,6 +91,23 @@ func TestStoreTieredCrossEngine(t *testing.T) {
if offAccess != 0 {
t.Fatalf("off 档正常请求不应有窄行，实际 %d", offAccess)
}
+ for _, mode := range []string{"db", "sample", "off"} {
+ global.GDATA_ACCESS_LOG_MODE = mode
+ uid := "cc-ban-" + mode
+ lg := mk(uid, "203.0.113.10", "阻止", "CC封禁")
+ lg.SkipPayloadStore = true
+ storeTiered([]*innerbean.WebLog{lg})
+ for _, table := range []string{model.AccessLogTableName, model.SecurityEventTableName} {
+ var count int64
+ if err := db.Table(table).Where("req_uuid = ?", uid).Count(&count).Error; err != nil || count != 1 {
+ t.Fatalf("%s %s narrow row: count=%d err=%v", mode, table, count, err)
+ }
+ }
+ var payloadCount int64
+ if err := db.Model(&model.EventPayload{}).Where("req_uuid = ?", uid).Count(&payloadCount).Error; err != nil || payloadCount != 0 {
+ t.Fatalf("%s payload: count=%d err=%v", mode, payloadCount, err)
+ }
+ }
global.GDATA_ACCESS_LOG_MODE = "db"
})
}
diff --git a/wafqueue/log_tier_test.go b/wafqueue/log_tier_test.go
index 60aaa0c..84fbbdd 100644
--- a/wafqueue/log_tier_test.go
+++ b/wafqueue/log_tier_test.go
@@ -53,6 +53,25 @@ func TestTier_EventWritesAllLayers(t *testing.T) {
}
}
+func TestTier_CCBanNarrowOnly(t *testing.T) {
+ for _, mode := range []string{"db", "sample", "off"} {
+ t.Run(mode, func(t *testing.T) {
+ defer resetTier(mode)()
+ lg := mkLog("cc-ban-"+mode, "203.0.113.10")
+ lg.ACTION = "阻止"
+ lg.RULE = "CC封禁"
+ lg.SkipPayloadStore = true
+ events, accesses, payloads := tierForStore([]*innerbean.WebLog{lg, lg})
+ if len(events) != 1 || len(accesses) != 1 || len(payloads) != 0 {
+ t.Fatalf("CC narrow layers: %d/%d/%d", len(events), len(accesses), len(payloads))
+ }
+ if events[0].ReqUUID != lg.REQ_UUID || accesses[0].ReqUUID != lg.REQ_UUID || lg.BODY != "a=1" || lg.HEADER != "User-Agent: curl" {
+ t.Fatal("identifiers or original payload changed")
+ }
+ })
+ }
+}
+
// db 档：正常请求窄行全量进 access_log；报文不进本批——被蓄水池采中的攒在池里定期刷库（D2）
func TestTier_DBModeNormalNoPayload(t *testing.T) {
defer resetTier("db")()
diff --git a/wafupgradenotice/upgrade_notes.yaml b/wafupgradenotice/upgrade_notes.yaml
index 8c6ad9e..2faa32b 100644
--- a/wafupgradenotice/upgrade_notes.yaml
+++ b/wafupgradenotice/upgrade_notes.yaml
@@ -939,6 +939,35 @@ notes:
the Access IP Details dialog on the risk log page gained a time range (last 30 days by default) so it
no longer takes going through archives one by one.
+ - id: v1_3_25_cc_ban_request_logging
+ version: v1.3.25
+ kind: notice
+ level: normal
+ page: /waf/wafvisitlog
+ doc: https://doc.samwaf.com/guide/BlockingPage.html
+ apply:
+ type: navigate
+ zh:
+ title: CC 封禁期间的阻断请求可按访问识别码查询
+ detail: >-
+ CC 封禁期间，每次实际阻断请求保留独立的访问识别码，并记录来源 IP、站点、路径、方法、响应码与耗时等窄行信息。
+ 这些事件同时出现在访问日志和安全事件中，不保存重复请求的完整报文；首次触发封禁的日志仍按现有规则保留报文。
+ 封禁期间的请求数、拦截数与窄行磁盘占用会相应增加，通知仍沿用封禁提醒节流。
+ 日志异步写入，查询需开启日志持久化、写入成功且记录尚在对应视图保留期内。
+ 内置拦截页同时显示访客 IP；已有自定义模板可以自行加入 [[.SAMWAF_IP]]，其值与日志来源 IP 一致。
+ 顶部访问识别码查询忽略时间范围与所选分区，其余筛选条件仍生效；详情与请求复制会反馈未命中或读取错误。
+ en:
+ title: Requests blocked during a CC ban can be looked up by visit identifier
+ detail: >-
+ Each request blocked during a CC ban retains its own visit identifier and a narrow log row containing source IP,
+ site, path, method, response status and duration. These events appear in both access logs and security events,
+ without retaining repeated full payloads. The request that initially triggers the ban keeps its payload under the existing rules.
+ Request counts, blocked counts and narrow-row disk usage increase accordingly; ban notifications retain their throttling.
+ Logs are written asynchronously and require persistence to be enabled, a successful write and an unexpired record in the selected view.
+ The built-in block page also shows the visitor IP. Existing custom templates can add [[.SAMWAF_IP]], using the same source IP as the logs.
+ The top visit-identifier lookup ignores the date range and selected partition while other filters still apply.
+ Request details and request-copy actions report missing records or read errors.
+
- id: v1_3_25_httpauth_path_scope
version: v1.3.25
kind: notice