利用openresty+lua+redis封掉恶意请求IP

系统管理员 2021-04-12 15:21 507阅读 0赞

封IP有很多种方法，比如

1.在os上使用iptables进行处理

2.在web server上使用nginx自带的deny(或限制)或者使用nginx的lua插件配置黑名单

3.在app server上配置黑名单

这里介绍使用nginx的lua插件封掉恶意请求的IP

[openresty][]是一个基于 Nginx 与 Lua 的高性能 Web 平台，其内部集成了大量精良的 Lua 库、第三方模块以及大多数的依赖项。用于方便地搭建能够处理超高并发、扩展性极高的动态 Web 应用、Web 服务和动态网关。(我这里不使用nginx添加模块的方式，而是直接使用openresty)

Nginx Lua Redis 防止CC攻击实现原理：同一个外网IP、同一个网址(ngx.var.request\_uri)、同一个客户端(http\_user\_agent)在某一段时间(CCseconds)内访问某个网址(ngx.var.request\_uri)超过指定次数(CCcount)，则禁止这个外网IP+同一个客户端(md5(IP+ngx.var.http\_user\_agent)访问这个网址(ngx.var.request\_uri)一段时间(blackseconds)。

提前安装redis,可以不用AOF和RDB

wget -c https://openresty.org/download/openresty-1.13.6.1.tar.gz
    
    tar zxvf openresty-1.13.6.1.tar.gz
    
    cd openresty-1.13.6.1/ && ./configure && gmake && gmake install
    
    cd /usr/local/openresty/lualib/redis
    
    wget -c https://github.com/openresty/lua-resty-redis/raw/master/lib/resty/redis.lua
    
    wget "https://gist.github.com/ivmm/231e974afba1edcde6776e1e827e238a/raw/4eef07d2c7d42695c1abcba3876c437c4f4cb0b7/waf.lua"

验证是否成功,在server层上配置

location /hello_lua { 
          default_type 'text/plain'; 
          content_by_lua 'ngx.say("hello, lua")'; 
    }

加载redis

vim /usr/local/openresty/nginx/conf/nginx.conf

写到http层上

lua\_package\_path "/usr/local/openresty/lualib/redis/redis.lua;;";

加载waf

写到虚拟主机的server层上

access\_by\_lua\_file "/usr/local/openresty/lualib/redis/waf.lua";

重载nginx，就可以测试效果了。测试过程中可以进去redis删掉key哦

主要看waf.lua

local CCcount = 20
    local CCseconds = 60
    local RedisIP = '127.0.0.1'
    local RedisPORT = 6379
    local blackseconds = 7200
    if ua == nil then
        ua = "unknown"
    end
    if (uri == "/index.html") then
        CCcount=10
        CCseconds=60
    end
    
    全局设置60秒内访问超过20次就会503(可以提示您访问的频率太高)
    单个URL匹配index.html60秒内超过10次就会503
    单个IP在7200秒(2个小时)内redis的KEY会过期，也就是说，如果被封了，在2个小时内你对这个URL请求多少次，都只会返回503，过了2个小时后解封，触发规则后继续被封，如此循环。

redis.lua

-- Copyright (C) Yichun Zhang (agentzh)
    
    
    local sub = string.sub
    local byte = string.byte
    local tcp = ngx.socket.tcp
    local null = ngx.null
    local type = type
    local pairs = pairs
    local unpack = unpack
    local setmetatable = setmetatable
    local tonumber = tonumber
    local tostring = tostring
    local rawget = rawget
    --local error = error
    
    
    local ok, new_tab = pcall(require, "table.new")
    if not ok or type(new_tab) ~= "function" then
        new_tab = function (narr, nrec) return {} end
    end
    
    
    local _M = new_tab(0, 54)
    
    _M._VERSION = '0.26'
    
    
    local common_cmds = {
        "get",      "set",          "mget",     "mset",
        "del",      "incr",         "decr",                 -- Strings
        "llen",     "lindex",       "lpop",     "lpush",
        "lrange",   "linsert",                              -- Lists
        "hexists",  "hget",         "hset",     "hmget",
        --[[ "hmset", ]]            "hdel",                 -- Hashes
        "smembers", "sismember",    "sadd",     "srem",
        "sdiff",    "sinter",       "sunion",               -- Sets
        "zrange",   "zrangebyscore", "zrank",   "zadd",
        "zrem",     "zincrby",                              -- Sorted Sets
        "auth",     "eval",         "expire",   "script",
        "sort"                                              -- Others
    }
    
    
    local sub_commands = {
        "subscribe", "psubscribe"
    }
    
    
    local unsub_commands = {
        "unsubscribe", "punsubscribe"
    }
    
    
    local mt = { __index = _M }
    
    
    function _M.new(self)
        local sock, err = tcp()
        if not sock then
            return nil, err
        end
        return setmetatable({ _sock = sock, _subscribed = false }, mt)
    end
    
    
    function _M.set_timeout(self, timeout)
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        return sock:settimeout(timeout)
    end
    
    
    function _M.connect(self, ...)
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        self._subscribed = false
    
        return sock:connect(...)
    end
    
    
    function _M.set_keepalive(self, ...)
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        if rawget(self, "_subscribed") then
            return nil, "subscribed state"
        end
    
        return sock:setkeepalive(...)
    end
    
    
    function _M.get_reused_times(self)
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        return sock:getreusedtimes()
    end
    
    
    local function close(self)
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        return sock:close()
    end
    _M.close = close
    
    
    local function _read_reply(self, sock)
        local line, err = sock:receive()
        if not line then
            if err == "timeout" and not rawget(self, "_subscribed") then
                sock:close()
            end
            return nil, err
        end
    
        local prefix = byte(line)
    
        if prefix == 36 then    -- char '$'
            -- print("bulk reply")
    
            local size = tonumber(sub(line, 2))
            if size < 0 then
                return null
            end
    
            local data, err = sock:receive(size)
            if not data then
                if err == "timeout" then
                    sock:close()
                end
                return nil, err
            end
    
            local dummy, err = sock:receive(2) -- ignore CRLF
            if not dummy then
                return nil, err
            end
    
            return data
    
        elseif prefix == 43 then    -- char '+'
            -- print("status reply")
    
            return sub(line, 2)
    
        elseif prefix == 42 then -- char '*'
            local n = tonumber(sub(line, 2))
    
            -- print("multi-bulk reply: ", n)
            if n < 0 then
                return null
            end
    
            local vals = new_tab(n, 0)
            local nvals = 0
            for i = 1, n do
                local res, err = _read_reply(self, sock)
                if res then
                    nvals = nvals + 1
                    vals[nvals] = res
    
                elseif res == nil then
                    return nil, err
    
                else
                    -- be a valid redis error value
                    nvals = nvals + 1
                    vals[nvals] = {false, err}
                end
            end
    
            return vals
    
        elseif prefix == 58 then    -- char ':'
            -- print("integer reply")
            return tonumber(sub(line, 2))
    
        elseif prefix == 45 then    -- char '-'
            -- print("error reply: ", n)
    
            return false, sub(line, 2)
    
        else
            -- when `line` is an empty string, `prefix` will be equal to nil.
            return nil, "unknown prefix: \"" .. tostring(prefix) .. "\""
        end
    end
    
    
    local function _gen_req(args)
        local nargs = #args
    
        local req = new_tab(nargs * 5 + 1, 0)
        req[1] = "*" .. nargs .. "\r\n"
        local nbits = 2
    
        for i = 1, nargs do
            local arg = args[i]
            if type(arg) ~= "string" then
                arg = tostring(arg)
            end
    
            req[nbits] = "$"
            req[nbits + 1] = #arg
            req[nbits + 2] = "\r\n"
            req[nbits + 3] = arg
            req[nbits + 4] = "\r\n"
    
            nbits = nbits + 5
        end
    
        -- it is much faster to do string concatenation on the C land
        -- in real world (large number of strings in the Lua VM)
        return req
    end
    
    
    local function _do_cmd(self, ...)
        local args = {...}
    
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        local req = _gen_req(args)
    
        local reqs = rawget(self, "_reqs")
        if reqs then
            reqs[#reqs + 1] = req
            return
        end
    
        -- print("request: ", table.concat(req))
    
        local bytes, err = sock:send(req)
        if not bytes then
            return nil, err
        end
    
        return _read_reply(self, sock)
    end
    
    
    local function _check_subscribed(self, res)
        if type(res) == "table"
           and (res[1] == "unsubscribe" or res[1] == "punsubscribe")
           and res[3] == 0
       then
            self._subscribed = false
        end
    end
    
    
    function _M.read_reply(self)
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        if not rawget(self, "_subscribed") then
            return nil, "not subscribed"
        end
    
        local res, err = _read_reply(self, sock)
        _check_subscribed(self, res)
    
        return res, err
    end
    
    
    for i = 1, #common_cmds do
        local cmd = common_cmds[i]
    
        _M[cmd] =
            function (self, ...)
                return _do_cmd(self, cmd, ...)
            end
    end
    
    
    for i = 1, #sub_commands do
        local cmd = sub_commands[i]
    
        _M[cmd] =
            function (self, ...)
                self._subscribed = true
                return _do_cmd(self, cmd, ...)
            end
    end
    
    
    for i = 1, #unsub_commands do
        local cmd = unsub_commands[i]
    
        _M[cmd] =
            function (self, ...)
                local res, err = _do_cmd(self, cmd, ...)
                _check_subscribed(self, res)
                return res, err
            end
    end
    
    
    function _M.hmset(self, hashname, ...)
        if select('#', ...) == 1 then
            local t = select(1, ...)
    
            local n = 0
            for k, v in pairs(t) do
                n = n + 2
            end
    
            local array = new_tab(n, 0)
    
            local i = 0
            for k, v in pairs(t) do
                array[i + 1] = k
                array[i + 2] = v
                i = i + 2
            end
            -- print("key", hashname)
            return _do_cmd(self, "hmset", hashname, unpack(array))
        end
    
        -- backwards compatibility
        return _do_cmd(self, "hmset", hashname, ...)
    end
    
    
    function _M.init_pipeline(self, n)
        self._reqs = new_tab(n or 4, 0)
    end
    
    
    function _M.cancel_pipeline(self)
        self._reqs = nil
    end
    
    
    function _M.commit_pipeline(self)
        local reqs = rawget(self, "_reqs")
        if not reqs then
            return nil, "no pipeline"
        end
    
        self._reqs = nil
    
        local sock = rawget(self, "_sock")
        if not sock then
            return nil, "not initialized"
        end
    
        local bytes, err = sock:send(reqs)
        if not bytes then
            return nil, err
        end
    
        local nvals = 0
        local nreqs = #reqs
        local vals = new_tab(nreqs, 0)
        for i = 1, nreqs do
            local res, err = _read_reply(self, sock)
            if res then
                nvals = nvals + 1
                vals[nvals] = res
    
            elseif res == nil then
                if err == "timeout" then
                    close(self)
                end
                return nil, err
    
            else
                -- be a valid redis error value
                nvals = nvals + 1
                vals[nvals] = {false, err}
            end
        end
    
        return vals
    end
    
    
    function _M.array_to_hash(self, t)
        local n = #t
        -- print("n = ", n)
        local h = new_tab(0, n / 2)
        for i = 1, n, 2 do
            h[t[i]] = t[i + 1]
        end
        return h
    end
    
    
    -- this method is deperate since we already do lazy method generation.
    function _M.add_commands(...)
        local cmds = {...}
        for i = 1, #cmds do
            local cmd = cmds[i]
            _M[cmd] =
                function (self, ...)
                    return _do_cmd(self, cmd, ...)
                end
        end
    end
    
    
    setmetatable(_M, {__index = function(self, cmd)
        local method =
            function (self, ...)
                return _do_cmd(self, cmd, ...)
            end
    
        -- cache the lazily generated method in our
        -- module table
        _M[cmd] = method
        return method
    end})
    
    
    return _M

waf.lua

local get_headers = ngx.req.get_headers
    local ua = ngx.var.http_user_agent
    local uri = ngx.var.request_uri
    local url = ngx.var.host .. uri
    local redis = require 'redis'
    local red = redis.new()
    local CCcount = 20
    local CCseconds = 60
    local RedisIP = '127.0.0.1'
    local RedisPORT = 6379
    local blackseconds = 7200
    if ua == nil then
        ua = "unknown"
    end
    if (uri == "/wp-admin.php") then
        CCcount=20
        CCseconds=60
    end
    red:set_timeout(100)
    local ok, err = red.connect(red, RedisIP, RedisPORT)
    if ok then
        red.connect(red, RedisIP, RedisPORT)
        function getClientIp()
            IP = ngx.req.get_headers()["X-Real-IP"]
            if IP == nil then
                IP = ngx.req.get_headers()["x_forwarded_for"]
            end
            if IP == nil then
                IP  = ngx.var.remote_addr
            end
            if IP == nil then
                IP  = "unknown"
            end
            return IP
        end
        local token = getClientIp() .. "." .. ngx.md5(url .. ua)
        local req = red:exists(token)
        if req == 0 then
            red:incr(token)
            red:expire(token,CCseconds)
        else
            local times = tonumber(red:get(token))
            if times >= CCcount then
                local blackReq = red:exists("black." .. token)
                if (blackReq == 0) then
                    red:set("black." .. token,1)
                    red:expire("black." .. token,blackseconds)
                    red:expire(token,blackseconds)
                    ngx.exit(503)
                else
                    ngx.exit(503)
                end
                return
            else
                red:incr(token)
            end
        end
        return
    end

[openresty]: https://openresty.org/cn/