diff --git a/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoint_definition.go b/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoint_definition.go index 465463c..d94cf18 100644 --- a/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoint_definition.go +++ b/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoint_definition.go @@ -18,8 +18,9 @@ type HTTPFirewallCheckpointDefinition struct { Description string `json:"description"` // 描述 Prefix string `json:"prefix"` // 前缀 IsRequest bool `json:"isRequest"` // 是否为请求 - HasParams bool `json:"hasParams"` // 是否有子参数 + HasParams bool `json:"hasParams"` // 是否有子参数 Params []*KeyValue `json:"params"` // 参数 Options []OptionInterface `json:"options"` // 选项 IsComposed bool `json:"isComposed"` // 是否为组合的checkpoint + Priority int `json:"priority"` // 优先级 } diff --git a/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoints.go b/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoints.go index 89d50a6..94bcca2 100644 --- a/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoints.go +++ b/pkg/serverconfigs/firewallconfigs/http_firewall_checkpoints.go @@ -13,6 +13,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "通用Header比如Cache-Control、Accept之类的长度限制，防止缓冲区溢出攻击", IsRequest: true, IsComposed: true, + Priority: 100, }, { Name: "通用响应Header长度限制", @@ -20,66 +21,77 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "通用Header比如Cache-Control、Date之类的长度限制，防止缓冲区溢出攻击", IsRequest: false, IsComposed: true, + Priority: 100, }, { Name: "客户端地址（IP）", Prefix: "remoteAddr", Description: "试图通过分析X-Forwarded-For等Header获取的客户端地址，比如192.168.1.100，存在伪造的可能", IsRequest: true, + Priority: 100, }, { Name: "客户端源地址（IP）", Prefix: "rawRemoteAddr", Description: "直接连接的客户端地址，比如192.168.1.100", IsRequest: true, + Priority: 100, }, { Name: "客户端端口", Prefix: "remotePort", Description: "直接连接的客户端地址端口", IsRequest: true, + Priority: 100, }, { Name: "客户端用户名", Prefix: "remoteUser", Description: "通过BasicAuth登录的客户端用户名", IsRequest: true, + Priority: 100, }, { Name: "请求URI", Prefix: "requestURI", Description: "包含URL参数的请求URI，类似于 /hello/world?lang=go，不包含域名部分", IsRequest: true, + Priority: 100, }, { Name: "请求路径", Prefix: "requestPath", Description: "不包含URL参数的请求路径，类似于 /hello/world，不包含域名部分", IsRequest: true, + Priority: 100, }, { Name: "请求完整URL", Prefix: "requestURL", Description: "完整的请求URL，包含协议、域名、请求路径、参数等，类似于 https://example.com/hello?name=lily", IsRequest: true, + Priority: 100, }, { Name: "请求内容长度", Prefix: "requestLength", Description: "请求Header中的Content-Length", IsRequest: true, + Priority: 100, }, { Name: "请求体内容", Prefix: "requestBody", Description: "通常在POST或者PUT等操作时会附带请求体，最大限制32M", IsRequest: true, + Priority: 5, }, { Name: "请求URI和请求体组合", Prefix: "requestAll", Description: "${requestURI}和${requestBody}组合", IsRequest: true, + Priority: 5, }, { Name: "请求表单参数", @@ -87,6 +99,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "获取POST或者其他方法发送的表单参数，最大请求体限制32M", IsRequest: true, HasParams: true, + Priority: 5, }, { Name: "上传文件", @@ -101,6 +114,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ }, IsRequest: true, HasParams: true, + Priority: 20, }, { Name: "请求JSON参数", @@ -108,54 +122,63 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "获取POST或者其他方法发送的JSON，最大请求体限制32M，使用点（.）符号表示多级数据", IsRequest: true, HasParams: true, + Priority: 5, }, { Name: "请求方法", Prefix: "requestMethod", Description: "比如GET、POST", IsRequest: true, + Priority: 100, }, { Name: "请求协议", Prefix: "scheme", Description: "比如http或https", IsRequest: true, + Priority: 100, }, { Name: "HTTP协议版本", Prefix: "proto", Description: "比如HTTP/1.1", IsRequest: true, + Priority: 100, }, { Name: "主机名", Prefix: "host", Description: "比如goedge.cn", IsRequest: true, + Priority: 100, }, { Name: "请求来源URL", Prefix: "referer", Description: "请求Header中的Referer值", IsRequest: true, + Priority: 100, }, { Name: "客户端信息", Prefix: "userAgent", Description: "比如Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103", IsRequest: true, + Priority: 100, }, { Name: "内容类型", Prefix: "contentType", Description: "请求Header的Content-Type", IsRequest: true, + Priority: 100, }, { Name: "所有cookie组合字符串", Prefix: "cookies", Description: "比如sid=IxZVPFhE&city=beijing&uid=18237", IsRequest: true, + Priority: 100, }, { Name: "单个cookie值", @@ -163,12 +186,14 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "单个cookie值", IsRequest: true, HasParams: true, + Priority: 100, }, { Name: "所有URL参数组合", Prefix: "args", Description: "比如name=lu&age=20", IsRequest: true, + Priority: 100, }, { Name: "单个URL参数值", @@ -176,12 +201,14 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "单个URL参数值", IsRequest: true, HasParams: true, + Priority: 100, }, { Name: "所有Header信息", Prefix: "headers", Description: "使用\\n隔开的Header信息字符串", IsRequest: true, + Priority: 100, }, { Name: "单个Header值", @@ -189,6 +216,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "单个Header值", IsRequest: true, HasParams: true, + Priority: 100, }, { Name: "国家/地区名称", @@ -196,6 +224,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "国家/地区名称", IsRequest: true, HasParams: false, + Priority: 90, }, { Name: "省份名称", @@ -203,6 +232,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "中国省份名称", IsRequest: true, HasParams: false, + Priority: 90, }, { Name: "城市名称", @@ -210,6 +240,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "中国城市名称", IsRequest: true, HasParams: false, + Priority: 90, }, { Name: "ISP名称", @@ -217,6 +248,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "ISP名称", IsRequest: true, HasParams: false, + Priority: 90, }, { Name: "CC统计", @@ -225,6 +257,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ HasParams: false, IsRequest: true, IsComposed: true, + Priority: 10, }, { Name: "防盗链", @@ -233,6 +266,7 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ HasParams: false, IsRequest: true, IsComposed: true, + Priority: 20, }, { Name: "CC统计（旧）", @@ -312,12 +346,14 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ }, }, IsRequest: true, + Priority: 10, }, { Name: "响应状态码", Prefix: "status", Description: "响应状态码，比如200、404、500", IsRequest: false, + Priority: 100, }, { Name: "响应Header", @@ -325,18 +361,21 @@ var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{ Description: "响应Header值", IsRequest: false, HasParams: true, + Priority: 100, }, { Name: "响应内容", Prefix: "responseBody", Description: "响应内容字符串", IsRequest: false, + Priority: 5, }, { Name: "响应内容长度", Prefix: "bytesSent", Description: "响应内容长度，通过响应的Header Content-Length获取", IsRequest: false, + Priority: 100, }, }