nginx+lua+redis 限制ip的访问次数

向右看齐 2022-05-10 10:20 382阅读 0赞

原文 地址：  
[https://www.superman2014.com/2015/08/30/nginxluaredis-%E9%99%90%E5%88%B6ip%E7%9A%84%E8%AE%BF%E9%97%AE%E6%AC%A1%E6%95%B0/][https_www.superman2014.com_2015_08_30_nginxluaredis-_E9_99_90_E5_88_B6ip_E7_9A_84_E8_AE_BF_E9_97_AE_E6_AC_A1_E6_95_B0]  
  
一、安装环境：

*  阿里云centos 6.5
 *  Nginx-1.4.4
 *  Redis 3.0.3
 *  LuaJIT-2.0.2

二、安装步骤：

1、安装LuaJIT-2.0.2

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 </td> 
 <td> wget http://luajit.org/download/LuaJIT-2.0.2.tar.gz tar -xzvf LuaJIT-2.0.2.tar.gz cd LuaJIT-2.0.2 make &amp;&amp; make install </td> 
 </tr> 
 </tbody> 
</table>

注：64位系统安装完成后或许还需要将/usr/local/lib/libluajit-5.1.so.2建立软连接到/usr/lib64/libluajit-5.1.so.2，否则在后面nginx启动时会提示找不到依赖库。

2.redis安装过程

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 </td> 
 <td> $ wget http://download.redis.io/releases/redis-3.0.3.tar.gz $ tar xzf redis-3.0.3.tar.gz $ cd redis-3.0.3 $ make </td> 
 </tr> 
 </tbody> 
</table>

3. nginx1.4.4的安装

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 </td> 
 <td> wget https://codeload.github.com/chaoslawful/lua-nginx-module/tar.gz/v0.8.3 &nbsp; wget https://codeload.github.com/agentzh/redis2-nginx-module/tar.gz/v0.10 &nbsp; tar -xzvf lua-nginx-module-0.8.3.tar.gz tar -xzvf redis2-nginx-module-0.10.tar.gz &nbsp; wget http://nginx.org/download/nginx-1.4.4.tar.gz &nbsp; &nbsp; ./configure --prefix=/usr/local/nginx --with-http_realip_module --with-http_sub_module --with-http_gzip_static_module --with-http_stub_status_module --with-pcre --with-http_realip_module&nbsp;&nbsp; --with-http_gzip_static_module&nbsp;&nbsp;--add-module=redis2-nginx-module-0.10&nbsp;&nbsp; --add-module=lua-nginx-module-0.8.3 &amp;&amp; make &amp;&amp; make install </td> 
 </tr> 
 </tbody> 
</table>

4. 下载nginx中lua使用redis需要的依赖包redis.lua到nginx安装目录

https://codeload.github.com/agentzh/lua-resty-redis/tar.gz/v0.15

5. 修改nginx.conf文件

[![QQ20150830-1@2x][QQ20150830-1_2x]][QQ20150830-1_2x_QQ20150830-1_2x]

test.lua内容如下：

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 </td> 
 <td> $ cat /usr/local/nginx/test.lua &nbsp; local redis = require "resty.redis" local red = redis:new() &nbsp; red:set_timeout(1000) -- 1 sec &nbsp; -- or connect to a unix domain socket file listened -- by a redis server: --&nbsp;&nbsp;&nbsp;&nbsp; local ok, err = red:connect("unix:/path/to/redis.sock") &nbsp; local ok, err = red:connect("127.0.0.1", 6379) if not ok then &nbsp;&nbsp;&nbsp;&nbsp;ngx.say("failed to connect: ", err) &nbsp;&nbsp;&nbsp;&nbsp;return end &nbsp; ok, err = red:set("dog", "an aniaml") if not ok then &nbsp;&nbsp;&nbsp;&nbsp;ngx.say("failed to set dog: ", err) &nbsp;&nbsp;&nbsp;&nbsp;return end &nbsp; ngx.say("set result: ", ok) &nbsp; local res, err = red:get("dog") if not res then &nbsp;&nbsp;&nbsp;&nbsp;ngx.say("failed to get dog: ", err) &nbsp;&nbsp;&nbsp;&nbsp;return end &nbsp; if res == ngx.null then &nbsp;&nbsp;&nbsp;&nbsp;ngx.say("dog not found.") &nbsp;&nbsp;&nbsp;&nbsp;return end &nbsp; ngx.say("dog: ", res) &nbsp; red:init_pipeline() red:set("cat", "Marry") red:set("horse", "Bob") red:get("cat") red:get("horse") local results, err = red:commit_pipeline() if not results then &nbsp;&nbsp;&nbsp;&nbsp;ngx.say("failed to commit the pipelined requests: ", err) &nbsp;&nbsp;&nbsp;&nbsp;return end &nbsp; for i, res in ipairs(results) do &nbsp;&nbsp;&nbsp;&nbsp;if type(res) == "table" then &nbsp;&nbsp;&nbsp;&nbsp;if not res[1] then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ngx.say("failed to run command ", i, ": ", res[2]) &nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-- process the table value &nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;-- process the scalar value &nbsp;&nbsp;&nbsp;&nbsp;end end &nbsp; -- put it into the connection pool of size 100, -- with 0 idle timeout local ok, err = red:set_keepalive(0, 100) if not ok then &nbsp;&nbsp;&nbsp;&nbsp;ngx.say("failed to set keepalive: ", err) &nbsp;&nbsp;&nbsp;&nbsp;return end &nbsp; -- or just close the connection right away: -- local ok, err = red:close() -- if not ok then --&nbsp;&nbsp;&nbsp;&nbsp; ngx.say("failed to close: ", err) --&nbsp;&nbsp;&nbsp;&nbsp; return -- end </td> 
 </tr> 
 </tbody> 
</table>

6. ip限制access.lua

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 </td> 
 <td> $ cat /usr/local/nginx/access.lua ip_bind_time = 600&nbsp;&nbsp;--封禁IP时间 ip_time_out = 30&nbsp;&nbsp;&nbsp;&nbsp;--指定ip访问频率时间段 connect_count = 50 --指定ip访问频率计数最大值 &nbsp; --连接redis local redis = require "resty.redis" local red = redis:new() local ok, err = red:connect("127.0.0.1", 6379) red:set_timeout(1000) -- 1 sec &nbsp; --如果连接失败，跳转到脚本结尾 if not ok then &nbsp;&nbsp;&nbsp;&nbsp;goto A end &nbsp; -- --查询ip是否在封禁段内，若在则返回403错误代码 --因封禁时间会大于ip记录时间，故此处不对ip时间key和计数key做处理 is_bind, err = red:get("bind:"..ngx.var.remote_addr) if is_bind == '1' then &nbsp;&nbsp;&nbsp;&nbsp;ngx.exit(403) &nbsp;&nbsp;&nbsp;&nbsp;goto A end &nbsp; --如果ip记录时间大于指定时间间隔或者记录时间或者不存在ip时间key则重置时间key和计数key --如果ip时间key小于时间间隔，则ip计数+1，且如果ip计数大于ip频率计数，则设置ip的封禁key为1 --同时设置封禁key的过期时间为封禁ip的时间 start_time, err = red:get("time:"..ngx.var.remote_addr) ip_count, err = red:get("count:"..ngx.var.remote_addr) &nbsp; if start_time == ngx.null or os.time() - start_time &gt; ip_time_out then &nbsp;&nbsp;&nbsp;&nbsp;res, err = red:set("time:"..ngx.var.remote_addr , os.time()) &nbsp;&nbsp;&nbsp;&nbsp;res, err = red:set("count:"..ngx.var.remote_addr , 1) else &nbsp;&nbsp;&nbsp;&nbsp;ip_count = ip_count + 1 &nbsp;&nbsp;&nbsp;&nbsp;res, err = red:incr("count:"..ngx.var.remote_addr) &nbsp;&nbsp;&nbsp;&nbsp;if ip_count &gt;= connect_count then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;res, err = red:set("bind:"..ngx.var.remote_addr, 1) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;res, err = red:expire("bind:"..ngx.var.remote_addr, ip_bind_time) &nbsp;&nbsp;&nbsp;&nbsp;end end &nbsp; -- 结束标记 ::A:: local ok, err = red:close() </td> 
 </tr> 
 </tbody> 
</table>

7.新的nginx.conf配置如下：

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 </td> 
 <td> location ~ \.php$ { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;access_by_lua_file /usr/local/nginx/access.lua; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;include fastcgi.conf; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fastcgi_pass 127.0.0.1:9000; } </td> 
 </tr> 
 </tbody> 
</table>

8.访问记录，在redis内的截图：

[![QQ20150831-1@2x][QQ20150831-1_2x]][QQ20150831-1_2x]

9.访问次数过多，返回结果：

[![QQ20150902-1@2x][QQ20150902-1_2x]][QQ20150902-1_2x]

[https_www.superman2014.com_2015_08_30_nginxluaredis-_E9_99_90_E5_88_B6ip_E7_9A_84_E8_AE_BF_E9_97_AE_E6_AC_A1_E6_95_B0]: https://www.superman2014.com/2015/08/30/nginxluaredis-%E9%99%90%E5%88%B6ip%E7%9A%84%E8%AE%BF%E9%97%AE%E6%AC%A1%E6%95%B0/
[QQ20150830-1_2x]: http://www.superman2014.com/wp-content/uploads/2015/08/QQ20150830-1@2x-1024x416.png
[QQ20150830-1_2x_QQ20150830-1_2x]: http://www.superman2014.com/wp-content/uploads/2015/08/QQ20150830-1@2x.png
[QQ20150831-1_2x]: http://www.superman2014.com/wp-content/uploads/2015/08/QQ20150831-1@2x.png
[QQ20150902-1_2x]: http://www.superman2014.com/wp-content/uploads/2015/08/QQ20150902-1@2x.png