github_mirrors/lua-resty-coraza
3
0
Fork 1
mirror of https://github.com/potats0/lua-resty-coraza.git synced 2025-11-16 17:31:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

refactor: update code

Browse Source
This commit is contained in:
potatso
2023-07-12 19:07:44 +08:00
parent 6b1f5da26c
commit fcf62802b9
4 changed files with 419 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
lib/resty/coraza.lua
View File

@@ -4,9 +4,6 @@ local coraza = require "resty.coraza.coraza"
local consts = require "resty.coraza.constants"
local nlog = ngx.log
local ngx_var = ngx.var
local ngx_ctx = ngx.ctx
local ngx_req = ngx.req
local fmt = string.format
local debug_fmt = log.debug_fmt
@@ -34,13 +31,13 @@ function _M.rules_add(waf, directives)
end
function _M.do_access_filter()
local transaction = ngx_ctx.transaction
local transaction = ngx.ctx.transaction
coraza.process_connection(transaction, ngx_var.remote_addr, ngx_var.remote_port,
ngx_var.server_addr, ngx_var.server_port)
coraza.process_connection(transaction, ngx.var.remote_addr, ngx.var.remote_port,
ngx.var.server_addr, ngx.var.server_port)
-- process uri
coraza.process_uri(transaction, ngx_var.request_uri, ngx_req.get_method(), ngx_var.server_protocol)
coraza.process_uri(transaction, ngx.var.request_uri, ngx.req.get_method(), ngx.var.server_protocol)
-- process http get args.The coraza_process_uri function recommends using AddGetRequestArgument to add get args
request.build_and_process_get_args(transaction)
@@ -51,20 +48,20 @@ function _M.do_access_filter()
-- process http req body if has
request.build_and_process_body(transaction)
ngx_ctx.action, ngx_ctx.status_code = coraza.intervention(transaction)
ngx.ctx.action, ngx.ctx.status_code = coraza.intervention(transaction)
end
function _M.do_create_transaction(waf)
-- each connection will be created a transaction
ngx_ctx.transaction = coraza.new_transaction(waf)
ngx.ctx.transaction = coraza.new_transaction(waf)
end
function _M.do_free_transaction()
local transaction = ngx_ctx.transaction
local transaction = ngx.ctx.transaction
if transaction ~= nil then
nlog(debug_fmt("transaction %s is freed by coraza_free_transaction", ngx_ctx.request_id))
ngx_ctx.transaction = nil
nlog(debug_fmt("transaction %s is freed by coraza_free_transaction", ngx.ctx.request_id))
ngx.ctx.transaction = nil
coraza.free_transaction(transaction)
end
end
@@ -73,11 +70,11 @@ function _M.do_handle()
-- transaction is interrupted by policy, be free firstly.
-- If request has disrupted by coraza, the transaction is freed and set to nil.
-- Response which was disrupted doesn't make sense.
if ngx_ctx.action ~= nil and ngx_ctx.transaction ~= nil then
nlog(warn_fmt([[Transaction %s request: "%s" is interrupted by policy. Action is %s]], ngx_ctx.request_id, ngx_var.request, ngx_ctx.action))
if ngx_ctx.action == "drop" or ngx_ctx.action == "deny" then
ngx_ctx.is_disrupted = true
return ngx_ctx.status_code, fmt(consts.BLOCK_CONTENT_FORMAT, ngx_ctx.status_code)
if ngx.ctx.action ~= nil and ngx.ctx.transaction ~= nil then
nlog(warn_fmt([[Transaction %s request: "%s" is interrupted by policy. Action is %s]], ngx.ctx.request_id, ngx.var.request, ngx.ctx.action))
if ngx.ctx.action == "drop" or ngx.ctx.action == "deny" then
ngx.ctx.is_disrupted = true
return ngx.ctx.status_code, fmt(consts.BLOCK_CONTENT_FORMAT, ngx.ctx.status_code)
end
end
end
@@ -86,14 +83,14 @@ function _M.do_interrupt()
-- transaction is interrupted by policy, be free firstly.
-- If request has disrupted by coraza, the transaction is freed and set to nil.
-- Response which was disrupted doesn't make sense.
if ngx_ctx.is_disrupted == true and ngx.get_phase() == "header_filter" then
if ngx.ctx.is_disrupted == true and ngx.get_phase() == "header_filter" then
nlog(debug_fmt("Transaction %s has been disrupted at request phrase. ignore",
ngx_ctx.request_id))
ngx.ctx.request_id))
return
end
local status_code, block_msg = _M.do_handle()
if status_code ~= nil then
ngx.status = ngx_ctx.status_code
ngx.status = ngx.ctx.status_code
local ok, msg = pcall(ngx.say, block_msg)
if ok == false then
nlog(err_fmt(msg))
@@ -103,21 +100,21 @@ function _M.do_interrupt()
end
function _M.do_header_filter()
if ngx_ctx.is_disrupted == true then
-- If request was interrupted by coraza at access_by_lua phrase, the ngx_ctx.transaction will be set nil.
if ngx.ctx.is_disrupted == true then
-- If request was interrupted by coraza at access_by_lua phrase, the ngx.ctx.transaction will be set nil.
-- We can bypass the check.
nlog(debug_fmt("Transaction %s has been disrupted at request phrase. ignore",
ngx_ctx.request_id))
ngx.ctx.request_id))
return
end
local h = ngx.resp.get_headers(0, true)
for k, v in pairs(h) do
coraza.add_response_header(ngx_ctx.transaction, k, v)
coraza.add_response_header(ngx.ctx.transaction, k, v)
end
-- copy from https://github.com/SpiderLabs/ModSecurity-nginx/blob/d59e4ad121df702751940fd66bcc0b3ecb51a079/src/ngx_http_modsecurity_header_filter.c#L527
coraza.process_response_headers(ngx_ctx.transaction, ngx.status, "HTTP 1.1")
coraza.process_response_headers(ngx.ctx.transaction, ngx.status, "HTTP 1.1")
ngx_ctx.action, ngx_ctx.status_code = coraza.intervention(ngx_ctx.transaction)
ngx.ctx.action, ngx.ctx.status_code = coraza.intervention(ngx.ctx.transaction)
end
function _M.do_body_filter()
@@ -125,8 +122,7 @@ function _M.do_body_filter()
end
function _M.do_log()
coraza.process_logging(ngx_ctx.transaction)
coraza.process_logging(ngx.ctx.transaction)
end
return _M

201
lib/resty/coraza/coraza.lua
View File

@@ -7,8 +7,6 @@ local ffi = require "ffi"
local log = require "resty.coraza.log"
local nlog = ngx.log
local ngx_var = ngx.var
local ngx_ctx = ngx.ctx
local err_fmt = log.err_fmt
local debug_fmt = log.debug_fmt
@@ -143,78 +141,84 @@ function _M.new_transaction(waf)
-- checking whether the transaction objects are correctly released or not.
-- In end of process, or intervention.
-- extern coraza_transaction_t coraza_new_transaction(coraza_waf_t waf, void* logCb);
local res = coraza.coraza_new_transaction(waf, nil)
ngx_ctx.request_id = ngx_var.request_id
nlog(debug_fmt("Success to creat new transaction id %s", ngx_ctx.request_id))
return res
local ok, msg = pcall(coraza.coraza_new_transaction, waf, nil)
if ok then
ngx.ctx.request_id = ngx.var.request_id
nlog(debug_fmt("Success to creat new transaction id %s",
ngx.ctx.request_id))
return msg
else
nlog(debug_fmt("Failed to creat new transaction id %s, msg: %s",
ngx.ctx.request_id, msg))
end
end
function _M.process_connection(transaction, sourceAddress, clientPort, serverHost, serverPort)
-- extern int coraza_process_connection(coraza_transaction_t t, char* sourceAddress, int clientPort,
-- char* serverHost, int serverPort);
local res = coraza.coraza_process_connection(transaction, cast_to_c_char(sourceAddress),
local ok, msg = pcall(coraza.coraza_process_connection, transaction, cast_to_c_char(sourceAddress),
tonumber(clientPort), cast_to_c_char(serverHost), tonumber(serverPort))
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_process_connection with " ..
"sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s",
ngx_ctx.request_id, sourceAddress, clientPort, serverHost, serverPort))
else
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_connection with " ..
"sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s",
ngx_ctx.request_id, sourceAddress, clientPort, serverHost, serverPort))
"sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s",
ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_connection with " ..
"sourceAddress:%s clientPort:%s serverHost:%s serverPort:%s msg: %s",
ngx.ctx.request_id, sourceAddress, clientPort, serverHost, serverPort, msg))
end
end
function _M.process_uri(transaction, uri, method, proto)
-- This function won't add GET arguments, they must be added with AddArgument
-- extern int coraza_process_uri(coraza_transaction_t t, char* uri, char* method, char* proto);
local res = coraza.coraza_process_uri(transaction, cast_to_c_char(uri),
local ok, msg = pcall(coraza.coraza_process_uri, transaction, cast_to_c_char(uri),
cast_to_c_char(method), cast_to_c_char(proto))
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_process_uri with %s %s %s",
ngx_ctx.request_id, ngx_ctx.request_id, method, uri, proto))
else
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_uri with %s %s %s",
ngx_ctx.request_id, method, uri, proto))
ngx.ctx.request_id, method, uri, proto))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_uri with %s %s %s. msg: %s",
ngx.ctx.request_id, ngx.ctx.request_id, method, uri, proto, msg))
end
end
function _M.add_request_header(transaction, header_name, header_value)
-- extern int coraza_add_request_header(coraza_transaction_t t, char* name, int name_len,
-- char* value, int value_len);
local res = coraza.coraza_add_request_header(transaction, cast_to_c_char(header_name), #header_name,
cast_to_c_char(header_value), #header_value)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_add_request_header with %s:%s",
ngx_ctx.request_id, header_name, header_value))
else
local ok, msg = pcall(coraza.coraza_add_request_header, transaction,
cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_add_request_header with %s:%s",
ngx_ctx.request_id, header_name, header_value))
ngx.ctx.request_id, header_name, header_value))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_add_request_header with %s:%s. msg: %s",
ngx.ctx.request_id, header_name, header_value, msg))
end
end
function _M.add_get_args(transaction, header_name, header_value)
-- extern int coraza_add_get_args(coraza_transaction_t t, char* name, char* value);
local res = coraza.coraza_add_get_args(transaction, cast_to_c_char(header_name),
cast_to_c_char(header_value))
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_add_get_args with %s:%s",
ngx_ctx.request_id, header_name, header_value))
else
local ok, msg = pcall(coraza.coraza_add_get_args, transaction,
cast_to_c_char(header_name), cast_to_c_char(header_value))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_add_get_args with %s:%s",
ngx_ctx.request_id, header_name, header_value))
ngx.ctx.request_id, header_name, header_value))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_add_get_args with %s:%s. msg: %s",
ngx.ctx.request_id, header_name, header_value, msg))
end
end
function _M.process_request_headers(transaction)
-- extern int coraza_process_request_headers(coraza_transaction_t t);
local res = coraza.coraza_process_request_headers(transaction)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_headers",
ngx_ctx.request_id))
else
local ok, msg = pcall(coraza.coraza_process_request_headers, transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_headers",
ngx_ctx.request_id))
ngx.ctx.request_id))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_headers. msg: %s",
ngx.ctx.request_id, msg))
end
end
@@ -230,10 +234,10 @@ function _M.intervention(transaction)
status_code = 403
end
nlog(debug_fmt("Transaction %s disrupted with status %s action %s",
ngx_ctx.request_id, status_code, action))
ngx.ctx.request_id, status_code, action))
return action, status_code
else
nlog(debug_fmt("Failed to disrupt transaction %s", ngx_ctx.request_id))
nlog(debug_fmt("Failed to disrupt transaction %s, action is nil", ngx.ctx.request_id))
return nil, nil
end
@@ -241,107 +245,114 @@ end
function _M.free_transaction(transaction)
-- extern int coraza_free_transaction(coraza_transaction_t t);
local res = coraza.coraza_free_transaction(transaction)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_free_transaction",
ngx_ctx.request_id))
else
local ok, msg = coraza.coraza_free_transaction(transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_free_transaction",
ngx_ctx.request_id))
ngx.ctx.request_id))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_free_transaction. msg: %s",
ngx.ctx.request_id, msg))
end
end
function _M.append_request_body(transaction, body)
-- extern int coraza_append_request_body(coraza_transaction_t t, unsigned char* data, int length);
local res = coraza.coraza_append_request_body(transaction, cast_to_c_char(body), #body)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_append_request_body with %s",
ngx_ctx.request_id, body))
else
local ok, msg = pcall(coraza.coraza_append_request_body, transaction,
cast_to_c_char(body), #body)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_append_request_body with %s",
ngx_ctx.request_id, body))
ngx.ctx.request_id, body))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_append_request_body with %s. msg: %s",
ngx.ctx.request_id, body, msg))
end
end
function _M.request_body_from_file(transaction, file_path)
-- extern int coraza_request_body_from_file(coraza_transaction_t t, char* file);
-- return 0 if success, otherwish return 1
local res = coraza.coraza_request_body_from_file(transaction, cast_to_c_char(file_path))
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_request_body_from_file with %s",
ngx_ctx.request_id, file_path))
else
local ok, msg = pcall(coraza.coraza_request_body_from_file,
transaction, cast_to_c_char(file_path))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_request_body_from_file with %s",
ngx_ctx.request_id, file_path))
ngx.ctx.request_id, file_path))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_request_body_from_file with %s. msg: %s",
ngx.ctx.request_id, file_path, msg))
end
end
function _M.process_request_body(transaction)
-- extern int coraza_process_request_body(coraza_transaction_t t);
local res = coraza.coraza_process_request_body(transaction)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_body",
ngx_ctx.request_id))
else
local ok, msg = pcall(coraza.coraza_process_request_body, transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_request_body",
ngx_ctx.request_id))
ngx.ctx.request_id))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_request_body. msg: %s",
ngx.ctx.request_id, msg))
end
end
-- for processing response
function _M.process_response_headers(transaction, status_code, proto)
-- extern int coraza_process_response_headers(coraza_transaction_t t, int status, char* proto);
local res = coraza.coraza_process_response_headers(transaction, tonumber(status_code), cast_to_c_char(proto))
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_headers with %s %s",
ngx_ctx.request_id, status_code, proto))
else
local ok, msg = pcall(coraza.coraza_process_response_headers,transaction,
tonumber(status_code), cast_to_c_char(proto))
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_headers with %s %s",
ngx_ctx.request_id, status_code, proto))
ngx.ctx.request_id, status_code, proto))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_headers with %s %s",
ngx.ctx.request_id, status_code, proto))
end
end
function _M.add_response_header(transaction, header_name, header_value)
-- extern int coraza_add_response_header(coraza_transaction_t t, char* name,
-- int name_len, char* value, int value_len);
local res = coraza.coraza_add_response_header(transaction, cast_to_c_char(header_name), #header_name,
cast_to_c_char(header_value), #header_value)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_add_response_header with %s:%s",
ngx_ctx.request_id, header_name, header_value))
else
local ok, msg = pcall(coraza.coraza_add_response_header, transaction, cast_to_c_char(header_name), #header_name, cast_to_c_char(header_value), #header_value)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_add_response_header with %s:%s",
ngx_ctx.request_id, header_name, header_value))
ngx.ctx.request_id, header_name, header_value))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_add_response_header with %s:%s. msg: %s",
ngx.ctx.request_id, header_name, header_value, msg))
end
end
function _M.append_response_body(transaction, body)
local res = coraza.coraza_append_response_body(transaction, cast_to_c_char(body), #body)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_append_response_body with %s",
ngx_ctx.request_id, body))
else
local ok, msg = pcall(coraza.coraza_append_response_body, transaction,
cast_to_c_char(body), #body)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_append_response_body with %s",
ngx_ctx.request_id, body))
ngx.ctx.request_id, body))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_append_response_body with %s, msg: %s",
ngx.ctx.request_id, body, msg))
end
end
function _M.process_response_body(transaction)
local res = coraza.coraza_process_response_body(transaction)
if res == 1 then
nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_body",
ngx_ctx.request_id))
else
local ok, msg = pcall(coraza.coraza_process_response_body,transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_response_body",
ngx_ctx.request_id))
ngx.ctx.request_id))
else
nlog(err_fmt("Transaction %s failed to invoke coraza_process_response_body. msg: %s",
ngx.ctx.request_id, msg))
end
end
function _M.process_logging(transaction)
coraza.coraza_process_logging(transaction)
nlog(debug_fmt("Transaction %s success to invoke coraza_process_logging",
ngx_ctx.request_id))
local ok, msg = pcall(coraza.coraza_process_logging, transaction)
if ok then
nlog(debug_fmt("Transaction %s success to invoke coraza_process_logging",
ngx.ctx.request_id))
else
nlog(debug_fmt("Transaction %s failed to invoke coraza_process_logging. msg: %s",
ngx.ctx.request_id, msg))
end
end
return _M

11
lib/resty/coraza/request.lua
View File

@@ -4,7 +4,6 @@ local fmt = string.format
local ngx = ngx
local nlog = ngx.log
local ngx_req = ngx.req
local _M = {
_VERSION = '1.0.0',
@@ -12,9 +11,9 @@ local _M = {
function _M.build_and_process_header(transaction)
local headers, err = ngx_req.get_headers(0, true)
local headers, err = ngx.req.get_headers(0, true)
if err then
err = fmt("failed to call ngx_req.get_headers: %s", err)
err = fmt("failed to call ngx.req.get_headers: %s", err)
nlog(ngx.ERR, err)
end
for k, v in pairs(headers) do
@@ -24,10 +23,10 @@ function _M.build_and_process_header(transaction)
end
function _M.build_and_process_body(transaction)
local req_body = ngx_req.get_body_data()
local req_body = ngx.req.get_body_data()
if req_body then
-- TODO: fix code to process multipart/formdata
-- local path = ngx_req.get_body_file()
-- local path = ngx.req.get_body_file()
-- coraza.request_body_from_file(path)
local req_body_size = #req_body
-- TODO req_body_size > req_body_size_opt
@@ -38,7 +37,7 @@ end
function _M.build_and_process_get_args(transaction)
-- process http get args if has
local arg = ngx_req.get_uri_args()
local arg = ngx.req.get_uri_args()
for k,v in pairs(arg) do
coraza.add_get_args(transaction, k, v)
end