TRKJ/EdgeNode
2
0
Fork 0
mirror of https://github.com/TeaOSLab/EdgeNode.git synced 2025-12-09 19:30:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

WAF策略增加观察模式和通过模式

Browse Source
This commit is contained in:
刘祥超
2021-09-30 11:30:58 +08:00
parent 771d2d8013
commit 12bddc6e82
4 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/nodes/http_request_waf.go
View File

@@ -53,7 +53,7 @@ func (this *HTTPRequest) doWAFRequest() (blocked bool) {
func (this *HTTPRequest) checkWAFRequest(firewallPolicy *firewallconfigs.HTTPFirewallPolicy) (blocked bool, breakChecking bool) { func (this *HTTPRequest) checkWAFRequest(firewallPolicy *firewallconfigs.HTTPFirewallPolicy) (blocked bool, breakChecking bool) {
// 检查配置是否为空 // 检查配置是否为空
if firewallPolicy == nil || !firewallPolicy.IsOn || firewallPolicy.Inbound == nil || !firewallPolicy.Inbound.IsOn { if firewallPolicy == nil || !firewallPolicy.IsOn || firewallPolicy.Inbound == nil || !firewallPolicy.Inbound.IsOn || firewallPolicy.Mode == firewallconfigs.FirewallModePass {
return return
} }
@@ -221,7 +221,7 @@ func (this *HTTPRequest) doWAFResponse(resp *http.Response) (blocked bool) {
} }
func (this *HTTPRequest) checkWAFResponse(firewallPolicy *firewallconfigs.HTTPFirewallPolicy, resp *http.Response) (blocked bool) { func (this *HTTPRequest) checkWAFResponse(firewallPolicy *firewallconfigs.HTTPFirewallPolicy, resp *http.Response) (blocked bool) {
if firewallPolicy == nil || !firewallPolicy.IsOn || !firewallPolicy.Outbound.IsOn { if firewallPolicy == nil || !firewallPolicy.IsOn || !firewallPolicy.Outbound.IsOn || firewallPolicy.Mode == firewallconfigs.FirewallModePass {
return return
} }

1
internal/nodes/waf_manager.go
View File

@@ -61,6 +61,7 @@ func (this *WAFManager) convertWAF(policy *firewallconfigs.HTTPFirewallPolicy) (
Id: strconv.FormatInt(policy.Id, 10), Id: strconv.FormatInt(policy.Id, 10),
IsOn: policy.IsOn, IsOn: policy.IsOn,
Name: policy.Name, Name: policy.Name,
Mode: policy.Mode,
} }
// inbound // inbound

5
internal/waf/rule_set.go
View File

@@ -1,6 +1,7 @@
package waf package waf
import ( import (
"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
"github.com/TeaOSLab/EdgeNode/internal/remotelogs" "github.com/TeaOSLab/EdgeNode/internal/remotelogs"
"github.com/TeaOSLab/EdgeNode/internal/waf/requests" "github.com/TeaOSLab/EdgeNode/internal/waf/requests"
"github.com/iwind/TeaGo/lists" "github.com/iwind/TeaGo/lists"
@@ -117,6 +118,10 @@ func (this *RuleSet) ActionCodes() []string {
} }
func (this *RuleSet) PerformActions(waf *WAF, group *RuleGroup, req requests.Request, writer http.ResponseWriter) bool { func (this *RuleSet) PerformActions(waf *WAF, group *RuleGroup, req requests.Request, writer http.ResponseWriter) bool {
if waf.Mode != firewallconfigs.FirewallModeDefend {
return true
}
// 先执行allow // 先执行allow
for _, instance := range this.actionInstances { for _, instance := range this.actionInstances {
if !instance.WillChange() { if !instance.WillChange() {

14
internal/waf/waf.go
View File

@@ -2,6 +2,7 @@ package waf
import ( import (
"errors" "errors"
"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs/firewallconfigs"
teaconst "github.com/TeaOSLab/EdgeNode/internal/const" teaconst "github.com/TeaOSLab/EdgeNode/internal/const"
"github.com/TeaOSLab/EdgeNode/internal/waf/checkpoints" "github.com/TeaOSLab/EdgeNode/internal/waf/checkpoints"
"github.com/TeaOSLab/EdgeNode/internal/waf/requests" "github.com/TeaOSLab/EdgeNode/internal/waf/requests"
@@ -15,12 +16,13 @@ import (
) )
type WAF struct { type WAF struct {
Id string `yaml:"id" json:"id"` Id string `yaml:"id" json:"id"`
IsOn bool `yaml:"isOn" json:"isOn"` IsOn bool `yaml:"isOn" json:"isOn"`
Name string `yaml:"name" json:"name"` Name string `yaml:"name" json:"name"`
Inbound []*RuleGroup `yaml:"inbound" json:"inbound"` Inbound []*RuleGroup `yaml:"inbound" json:"inbound"`
Outbound []*RuleGroup `yaml:"outbound" json:"outbound"` Outbound []*RuleGroup `yaml:"outbound" json:"outbound"`
CreatedVersion string `yaml:"createdVersion" json:"createdVersion"` CreatedVersion string `yaml:"createdVersion" json:"createdVersion"`
Mode firewallconfigs.FirewallMode `yaml:"mode" json:"mode"`
DefaultBlockAction *BlockAction DefaultBlockAction *BlockAction