TRKJ/EdgeAdmin
2
0
Fork 0
mirror of https://github.com/TeaOSLab/EdgeAdmin.git synced 2025-12-25 11:36:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

可以单个服务中的WAF中设置出入站规则、黑白名单等

Browse Source
This commit is contained in:
刘祥超
2021-01-18 20:39:58 +08:00
parent 6468605325
commit c6a14708df
11 changed files with 477 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
internal/web/actions/default/servers/server/settings/waf/group.go Normal file
View File

@@ -0,0 +1,110 @@
package waf
import (
"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
"github.com/iwind/TeaGo/lists"
"github.com/iwind/TeaGo/maps"
"strconv"
"strings"
)
type GroupAction struct {
actionutils.ParentAction
}
func (this *GroupAction) Init() {
this.Nav("", "setting", this.ParamString("type"))
this.SecondMenu("waf")
}
func (this *GroupAction) RunGet(params struct {
FirewallPolicyId int64
GroupId int64
Type string
}) {
this.Data["type"] = params.Type
this.Data["firewallPolicyId"] = params.FirewallPolicyId
// policy
firewallPolicy, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
if err != nil {
this.ErrorPage(err)
return
}
if firewallPolicy == nil {
this.NotFound("firewallPolicy", params.FirewallPolicyId)
return
}
// group config
groupConfig, err := dao.SharedHTTPFirewallRuleGroupDAO.FindRuleGroupConfig(this.AdminContext(), params.GroupId)
if err != nil {
this.ErrorPage(err)
return
}
if groupConfig == nil {
this.NotFound("firewallRuleGroup", params.GroupId)
return
}
this.Data["group"] = groupConfig
// rule sets
this.Data["sets"] = lists.Map(groupConfig.Sets, func(k int, v interface{}) interface{} {
set := v.(*firewallconfigs.HTTPFirewallRuleSet)
// 动作说明
actionLinks := []maps.Map{}
if set.Action == firewallconfigs.HTTPFirewallActionGoGroup {
nextGroup := firewallPolicy.FindRuleGroup(set.ActionOptions.GetInt64("groupId"))
if nextGroup != nil {
actionLinks = append(actionLinks, maps.Map{
"name": nextGroup.Name,
"url": "/servers/components/waf/group?firewallPolicyId=" + strconv.FormatInt(params.FirewallPolicyId, 10) + "&type=" + params.Type + "&groupId=" + strconv.FormatInt(nextGroup.Id, 10),
})
}
} else if set.Action == firewallconfigs.HTTPFirewallActionGoSet {
nextGroup := firewallPolicy.FindRuleGroup(set.ActionOptions.GetInt64("groupId"))
if nextGroup != nil {
actionLinks = append(actionLinks, maps.Map{
"name": nextGroup.Name,
"url": "/servers/components/waf/group?firewallPolicyId=" + strconv.FormatInt(params.FirewallPolicyId, 10) + "&type=" + params.Type + "&groupId=" + strconv.FormatInt(nextGroup.Id, 10),
})
nextSet := nextGroup.FindRuleSet(set.ActionOptions.GetInt64("setId"))
if nextSet != nil {
actionLinks = append(actionLinks, maps.Map{
"name": nextSet.Name,
"url": "/servers/components/waf/group?firewallPolicyId=" + strconv.FormatInt(params.FirewallPolicyId, 10) + "&type=" + params.Type + "&groupId=" + strconv.FormatInt(nextGroup.Id, 10),
})
}
}
}
return maps.Map{
"id": set.Id,
"name": set.Name,
"rules": lists.Map(set.Rules, func(k int, v interface{}) interface{} {
rule := v.(*firewallconfigs.HTTPFirewallRule)
return maps.Map{
"param": rule.Param,
"paramFilters": rule.ParamFilters,
"operator": rule.Operator,
"value": rule.Value,
"isCaseInsensitive": rule.IsCaseInsensitive,
"isComposed": firewallconfigs.CheckCheckpointIsComposed(rule.Prefix()),
}
}),
"isOn": set.IsOn,
"action": strings.ToUpper(set.Action),
"actionOptions": set.ActionOptions,
"actionName": firewallconfigs.FindActionName(set.Action),
"actionLinks": actionLinks,
"connector": strings.ToUpper(set.Connector),
}
})
this.Show()
}

74
internal/web/actions/default/servers/server/settings/waf/groups.go Normal file
View File

@@ -0,0 +1,74 @@
package waf
import (
"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/actionutils"
"github.com/TeaOSLab/EdgeCommon/pkg/rpc/dao"
"github.com/iwind/TeaGo/maps"
)
type GroupsAction struct {
actionutils.ParentAction
}
func (this *GroupsAction) Init() {
this.Nav("", "setting", this.ParamString("type"))
this.SecondMenu("waf")
}
func (this *GroupsAction) RunGet(params struct {
FirewallPolicyId int64
Type string
}) {
this.Data["firewallPolicyId"] = params.FirewallPolicyId
this.Data["type"] = params.Type
firewallPolicy, err := dao.SharedHTTPFirewallPolicyDAO.FindEnabledHTTPFirewallPolicyConfig(this.AdminContext(), params.FirewallPolicyId)
if err != nil {
this.ErrorPage(err)
return
}
if firewallPolicy == nil {
this.NotFound("firewallPolicy", params.FirewallPolicyId)
return
}
groupMaps := []maps.Map{}
// inbound
if params.Type == "inbound" {
if firewallPolicy.Inbound != nil {
for _, g := range firewallPolicy.Inbound.Groups {
groupMaps = append(groupMaps, maps.Map{
"id": g.Id,
"name": g.Name,
"code": g.Code,
"isOn": g.IsOn,
"description": g.Description,
"countSets": len(g.Sets),
"canDelete": len(g.Code) == 0,
})
}
}
}
// outbound
if params.Type == "outbound" {
if firewallPolicy.Outbound != nil {
for _, g := range firewallPolicy.Outbound.Groups {
groupMaps = append(groupMaps, maps.Map{
"id": g.Id,
"name": g.Name,
"code": g.Code,
"isOn": g.IsOn,
"description": g.Description,
"countSets": len(g.Sets),
"canDelete": len(g.Code) == 0,
})
}
}
}
this.Data["groups"] = groupMaps
this.Show()
}

12
internal/web/actions/default/servers/server/settings/waf/index.go
View File

@@ -45,6 +45,18 @@ func (this *IndexAction) RunGet(params struct {
this.Data["firewallPolicy"] = nil
}
// 当前的Server独立设置
if webConfig.FirewallRef == nil || webConfig.FirewallRef.FirewallPolicyId == 0 {
firewallPolicyId, err := dao.SharedHTTPWebDAO.InitEmptyHTTPFirewallPolicy(this.AdminContext(), webConfig.Id, webConfig.FirewallRef != nil && webConfig.FirewallRef.IsOn)
if err != nil {
this.ErrorPage(err)
return
}
this.Data["firewallPolicyId"] = firewallPolicyId
} else {
this.Data["firewallPolicyId"] = webConfig.FirewallRef.FirewallPolicyId
}
this.Show()
}

4
internal/web/actions/default/servers/server/settings/waf/init.go
View File

@@ -22,6 +22,10 @@ func init() {
GetPost("/ipadmin/createIPPopup", new(ipadmin.CreateIPPopupAction)).
GetPost("/ipadmin/updateIPPopup", new(ipadmin.UpdateIPPopupAction)).
Post("/ipadmin/deleteIP", new(ipadmin.DeleteIPAction)).
// 规则相关
Get("/groups", new(GroupsAction)).
Get("/group", new(GroupAction)).
EndAll()
})
}

4
internal/web/actions/default/servers/server/settings/waf/ipadmin/allowList.go
View File

@@ -18,9 +18,11 @@ func (this *AllowListAction) Init() {
}
func (this *AllowListAction) RunGet(params struct {
ServerId int64
ServerId int64
FirewallPolicyId int64
}) {
this.Data["featureIsOn"] = true
this.Data["firewallPolicyId"] = params.FirewallPolicyId
listId, err := dao.SharedIPListDAO.FindAllowIPListIdWithServerId(this.AdminContext(), params.ServerId)
if err != nil {

4
internal/web/actions/default/servers/server/settings/waf/ipadmin/denyList.go
View File

@@ -18,9 +18,11 @@ func (this *DenyListAction) Init() {
}
func (this *DenyListAction) RunGet(params struct {
ServerId int64
FirewallPolicyId int64
ServerId int64
}) {
this.Data["featureIsOn"] = true
this.Data["firewallPolicyId"] = params.FirewallPolicyId
listId, err := dao.SharedIPListDAO.FindDenyIPListIdWithServerId(this.AdminContext(), params.ServerId)
if err != nil {