github_mirrors/lua-resty-coraza
3
0
Fork 1
mirror of https://github.com/potats0/lua-resty-coraza.git synced 2025-11-18 10:10:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

chore: updated the code

Browse Source
This commit is contained in:
potatso
2023-07-18 11:39:25 +08:00
parent 83b2dbeada
commit 83f80c1d44
9 changed files with 527 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files

112
lib/resty/coraza/coraza.lua
View File

@@ -144,12 +144,10 @@ function _M.new_transaction(waf)
local ok, msg = pcall(coraza.coraza_new_transaction, waf, nil)
if ok then
ngx.ctx.request_id = ngx.var.request_id
nlog(debug_fmt("Success to creat new transaction id %s",
ngx.ctx.request_id))
nlog(debug_fmt("Success to creat new transaction"))
return msg
else
nlog(debug_fmt("Failed to creat new transaction id %s, msg: %s",
ngx.ctx.request_id, msg))
nlog(debug_fmt("Failed to creat new transaction, msg: %s", msg))
end
end
@@ -159,13 +157,13 @@ function _M.process_connection(transaction, sourceAddress, clientPort, serverHos
local ok, msg = pcall(coraza.coraza_process_connection, transaction, cast_to_c_char(sourceAddress),
tonumber(clientPort), cast_to_c_char(serverHost), tonumber(serverPort))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_connection with " ..
nlog(debug_fmt("success to invoke coraza_process_connection with " ..
"sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s",
ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort))
sourceAddress, clientPort, serverHost, serverPort))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_connection with " ..
nlog(err_fmt("failed to invoke coraza_process_connection with " ..
"sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s msg: %s",
ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort, msg))
sourceAddress, clientPort, serverHost, serverPort, msg))
end
end
@@ -175,11 +173,11 @@ function _M.process_uri(transaction, uri, method, proto)
local ok, msg = pcall(coraza.coraza_process_uri, transaction, cast_to_c_char(uri),
cast_to_c_char(method), cast_to_c_char(proto))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_uri with %s %s %s",
ngx.ctx.request_id, method, uri, proto))
nlog(debug_fmt("success to invoke coraza_process_uri with %s %s %s",
method, uri, proto))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_uri with %s %s %s. msg: %s",
ngx.ctx.request_id, ngx.ctx.request_id, method, uri, proto, msg))
nlog(err_fmt("failed to invoke coraza_process_uri with %s %s %s. msg: %s",
method, uri, proto, msg))
end
end
@@ -189,11 +187,11 @@ function _M.add_request_header(transaction, header_name, header_value)
local ok, msg = pcall(coraza.coraza_add_request_header, transaction,
cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_add_request_header with %s:%s",
ngx.ctx.request_id, header_name, header_value))
nlog(debug_fmt("success to invoke coraza_add_request_header with %s:%s",
header_name, header_value))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_add_request_header with %s:%s. msg: %s",
ngx.ctx.request_id, header_name, header_value, msg))
nlog(err_fmt("failed to invoke coraza_add_request_header with %s:%s. msg: %s",
header_name, header_value, msg))
end
end
@@ -202,11 +200,11 @@ function _M.add_get_args(transaction, header_name, header_value)
local ok, msg = pcall(coraza.coraza_add_get_args, transaction,
cast_to_c_char(header_name), cast_to_c_char(header_value))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_add_get_args with %s:%s",
ngx.ctx.request_id, header_name, header_value))
nlog(debug_fmt("success to invoke coraza_add_get_args with %s:%s",
header_name, header_value))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_add_get_args with %s:%s. msg: %s",
ngx.ctx.request_id, header_name, header_value, msg))
nlog(err_fmt("failed to invoke coraza_add_get_args with %s:%s. msg: %s",
header_name, header_value, msg))
end
end
@@ -214,11 +212,9 @@ function _M.process_request_headers(transaction)
-- extern int coraza_process_request_headers(coraza_transaction_t t);
local ok, msg = pcall(coraza.coraza_process_request_headers, transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_headers",
ngx.ctx.request_id))
nlog(debug_fmt("success to invoke coraza_process_request_headers"))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_headers. msg: %s",
ngx.ctx.request_id, msg))
nlog(err_fmt("failed to invoke coraza_process_request_headers. msg: %s", msg))
end
end
@@ -233,11 +229,10 @@ function _M.intervention(transaction)
if status_code == 0 then
status_code = 403
end
nlog(debug_fmt("Transaction %s disrupted with status %s action %s",
ngx.ctx.request_id, status_code, action))
nlog(debug_fmt("disrupted with status %s action %s", status_code, action))
return action, status_code
else
nlog(debug_fmt("Failed to disrupt transaction %s, action is nil", ngx.ctx.request_id))
nlog(debug_fmt("Failed to disrupt, action is nil"))
return nil, nil
end
@@ -247,11 +242,9 @@ function _M.free_transaction(transaction)
-- extern int coraza_free_transaction(coraza_transaction_t t);
local ok, msg = coraza.coraza_free_transaction(transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_free_transaction",
ngx.ctx.request_id))
nlog(debug_fmt("success to invoke coraza_free_transaction"))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_free_transaction. msg: %s",
ngx.ctx.request_id, msg))
nlog(err_fmt("failed to invoke coraza_free_transaction. msg: %s", msg))
end
end
@@ -260,11 +253,9 @@ function _M.append_request_body(transaction, body)
local ok, msg = pcall(coraza.coraza_append_request_body, transaction,
cast_to_c_char(body), #body)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_append_request_body with %s",
ngx.ctx.request_id, body))
nlog(debug_fmt("success to invoke coraza_append_request_body with %s", body))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_append_request_body with %s. msg: %s",
ngx.ctx.request_id, body, msg))
nlog(err_fmt("failed to invoke coraza_append_request_body with %s. msg: %s", body, msg))
end
end
@@ -274,11 +265,9 @@ function _M.request_body_from_file(transaction, file_path)
local ok, msg = pcall(coraza.coraza_request_body_from_file,
transaction, cast_to_c_char(file_path))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_request_body_from_file with %s",
ngx.ctx.request_id, file_path))
nlog(debug_fmt("success to invoke coraza_request_body_from_file with %s", file_path))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_request_body_from_file with %s. msg: %s",
ngx.ctx.request_id, file_path, msg))
nlog(err_fmt("failed to invoke coraza_request_body_from_file with %s. msg: %s", file_path, msg))
end
end
@@ -286,11 +275,9 @@ function _M.process_request_body(transaction)
-- extern int coraza_process_request_body(coraza_transaction_t t);
local ok, msg = pcall(coraza.coraza_process_request_body, transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_body",
ngx.ctx.request_id))
nlog(debug_fmt("success to invoke coraza_process_request_body"))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_body. msg: %s",
ngx.ctx.request_id, msg))
nlog(err_fmt("failed to invoke coraza_process_request_body. msg: %s", msg))
end
end
@@ -300,11 +287,11 @@ function _M.process_response_headers(transaction, status_code, proto)
local ok, msg = pcall(coraza.coraza_process_response_headers,transaction,
tonumber(status_code), cast_to_c_char(proto))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_headers with %s %s",
ngx.ctx.request_id, status_code, proto))
nlog(debug_fmt("success to invoke coraza_process_response_headers with %s %s",
status_code, proto))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_headers with %s %s",
ngx.ctx.request_id, status_code, proto))
nlog(err_fmt("failed to invoke coraza_process_response_headers with %s %s, msg: %s",
status_code, proto, msg))
end
end
@@ -313,11 +300,11 @@ function _M.add_response_header(transaction, header_name, header_value)
-- int name_len, char* value, int value_len);
local ok, msg = pcall(coraza.coraza_add_response_header, transaction, cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_add_response_header with %s:%s",
ngx.ctx.request_id, header_name, header_value))
nlog(debug_fmt("success to invoke coraza_add_response_header with %s:%s",
header_name, header_value))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_add_response_header with %s:%s. msg: %s",
ngx.ctx.request_id, header_name, header_value, msg))
nlog(err_fmt("failed to invoke coraza_add_response_header with %s:%s. msg: %s",
header_name, header_value, msg))
end
end
@@ -325,33 +312,18 @@ function _M.append_response_body(transaction, body)
local ok, msg = pcall(coraza.coraza_append_response_body, transaction,
cast_to_c_char(body), #body)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_append_response_body with %s",
ngx.ctx.request_id, body))
nlog(debug_fmt("success to invoke coraza_append_response_body with %s", body))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_append_response_body with %s, msg: %s",
ngx.ctx.request_id, body, msg))
nlog(err_fmt("failed to invoke coraza_append_response_body with %s, msg: %s", body, msg))
end
end
function _M.process_response_body(transaction)
local ok, msg = pcall(coraza.coraza_process_response_body,transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_body",
ngx.ctx.request_id))
nlog(debug_fmt("success to invoke coraza_process_response_body"))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_body. msg: %s",
ngx.ctx.request_id, msg))
end
end
function _M.process_logging(transaction)
local ok, msg = pcall(coraza.coraza_process_logging, transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_logging",
ngx.ctx.request_id))
else
nlog(debug_fmt("Transaction %s failed to invoke coraza_process_logging. msg: %s",
ngx.ctx.request_id, msg))
nlog(err_fmt("failed to invoke coraza_process_response_body. msg: %s", msg))
end
end

10
lib/resty/coraza/log.lua
View File

@@ -15,9 +15,13 @@ local WARN = ngx.WARN
local DEBUG = ngx.DEBUG
local function log(formatstring, ...)
return fmt("PID: "..ngx.worker.pid()..
"\tphrase: "..ngx.get_phase()..
"\tlua-resty-coraza: "..formatstring, ...)
local str = "PID: "..ngx.worker.pid()..
"\tphrase: "..ngx.get_phase()
if ngx.ctx.request_id ~= nil then
str = str.."\tTransaction: "..ngx.ctx.request_id
end
str = str.."\tlua-resty-coraza: "..formatstring
return fmt(str, ...)
end
function _M.err_fmt(formatstring, ...)

22
lib/resty/coraza/request.lua
View File

@@ -1,6 +1,9 @@
local coraza = require "resty.coraza.coraza"
local log = require "resty.coraza.log"
local fmt = string.format
local warn_fmt = log.warn_fmt
local ngx = ngx
local nlog = ngx.log
@@ -11,13 +14,21 @@ local _M = {
function _M.build_and_process_header(transaction)
-- https://github.com/openresty/lua-nginx-module#ngxreqget_headers
local headers, err = ngx.req.get_headers(0, true)
if err then
err = fmt("failed to call ngx.req.get_headers: %s", err)
nlog(ngx.ERR, err)
end
for k, v in pairs(headers) do
coraza.add_request_header(transaction, k, v)
if type(v) == "table" then
nlog(warn_fmt("http request headers potentially has HPP!"))
for _, value in ipairs(v) do
coraza.add_request_header(transaction, k, value)
end
else
coraza.add_request_header(transaction, k, v)
end
end
coraza.process_request_headers(transaction)
end
@@ -39,7 +50,14 @@ function _M.build_and_process_get_args(transaction)
-- process http get args if has
local arg = ngx.req.get_uri_args()
for k,v in pairs(arg) do
coraza.add_get_args(transaction, k, v)
if type(v) == "table" then
nlog(warn_fmt("http get args potentially has HPP!"))
for _, value in ipairs(v) do
coraza.add_get_args(transaction, k, value)
end
else
coraza.add_get_args(transaction, k, v)
end
end
end

60
lib/resty/coraza/response.lua Normal file
View File

@@ -0,0 +1,60 @@
local coraza = require "resty.coraza.coraza"
local log = require "resty.coraza.log"
local fmt = string.format
local warn_fmt = log.warn_fmt
local ngx = ngx
local nlog = ngx.log
local _M = {
_VERSION = '1.0.0',
}
function _M.clear_header_as_body_modified()
ngx.header.content_length = nil
-- in case of upstream content is compressed content
ngx.header.content_encoding = nil
-- clear cache identifier
ngx.header.last_modified = nil
ngx.header.etag = nil
end
function _M.build_and_process_body(transaction)
local chunk, eof = ngx.arg[1], ngx.arg[2]
if type(chunk) == "string" and chunk ~= "" then
-- TODO: 为了性能，客户端响应的二进制内容很有可能是下载或者加密等，
-- 目前不支持检测二进制响应
coraza.append_response_body(transaction, chunk)
end
if eof then
coraza.process_response_body(transaction)
end
end
-- process http req headers
function _M.build_and_process_header(transaction)
local h = ngx.resp.get_headers(0, true)
for k, v in pairs(h) do
if type(v) == "table" then
nlog(warn_fmt("http response headers potentially has HPP!"))
for _, value in ipairs(v) do
coraza.add_response_header(transaction, k, value)
end
else
coraza.add_response_header(transaction, k, v)
end
end
local http_version = ngx.req.http_version()
if http_version == nil then
http_version = 1.1
end
http_version = fmt("HTTP/%.1f", http_version)
coraza.process_response_headers(transaction, ngx.status, http_version)
end
return _M