TRKJ/EdgeNode
2
0
Fork 0
mirror of https://github.com/TeaOSLab/EdgeNode.git synced 2025-11-09 03:50:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

WAF拦截动作可以设置最大封禁时间，从而实现封禁时间随机

Browse Source
This commit is contained in:
GoEdgeLab
2023-03-01 19:00:08 +08:00
parent 3b7c3bc31d
commit 4940e12711
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
internal/waf/action_block.go
View File

@@ -6,6 +6,7 @@ import (
"github.com/TeaOSLab/EdgeNode/internal/waf/requests" "github.com/TeaOSLab/EdgeNode/internal/waf/requests"
"github.com/iwind/TeaGo/Tea" "github.com/iwind/TeaGo/Tea"
"github.com/iwind/TeaGo/logs" "github.com/iwind/TeaGo/logs"
"github.com/iwind/TeaGo/rands"
"io" "io"
"net/http" "net/http"
"os" "os"
@@ -25,6 +26,7 @@ type BlockAction struct {
Body string `yaml:"body" json:"body"` // supports HTML Body string `yaml:"body" json:"body"` // supports HTML
URL string `yaml:"url" json:"url"` URL string `yaml:"url" json:"url"`
Timeout int32 `yaml:"timeout" json:"timeout"` Timeout int32 `yaml:"timeout" json:"timeout"`
TimeoutMax int32 `yaml:"timeoutMax" json:"timeoutMax"`
Scope string `yaml:"scope" json:"scope"` Scope string `yaml:"scope" json:"scope"`
} }
@@ -41,6 +43,7 @@ func (this *BlockAction) Init(waf *WAF) error {
} }
if this.Timeout <= 0 { if this.Timeout <= 0 {
this.Timeout = waf.DefaultBlockAction.Timeout this.Timeout = waf.DefaultBlockAction.Timeout
this.TimeoutMax = waf.DefaultBlockAction.TimeoutMax // 只有没有填写封锁时长的时候才会使用默认的封锁时长最大值
} }
} }
return nil return nil
@@ -65,6 +68,12 @@ func (this *BlockAction) Perform(waf *WAF, group *RuleGroup, set *RuleSet, reque
timeout = 300 // 默认封锁300秒 timeout = 300 // 默认封锁300秒
} }
// 随机时长
var timeoutMax = this.TimeoutMax
if timeoutMax > timeout {
timeout = timeout + int32(rands.Int64()%int64(timeoutMax-timeout+1))
}
SharedIPBlackList.RecordIP(IPTypeAll, this.Scope, request.WAFServerId(), request.WAFRemoteIP(), time.Now().Unix()+int64(timeout), waf.Id, waf.UseLocalFirewall, group.Id, set.Id, "") SharedIPBlackList.RecordIP(IPTypeAll, this.Scope, request.WAFServerId(), request.WAFRemoteIP(), time.Now().Unix()+int64(timeout), waf.Id, waf.UseLocalFirewall, group.Id, set.Id, "")
if writer != nil { if writer != nil {

1
internal/waf/waf_manager.go
View File

@@ -180,6 +180,7 @@ func (this *WAFManager) ConvertWAF(policy *firewallconfigs.HTTPFirewallPolicy) (
Body: policy.BlockOptions.Body, Body: policy.BlockOptions.Body,
URL: policy.BlockOptions.URL, URL: policy.BlockOptions.URL,
Timeout: policy.BlockOptions.Timeout, Timeout: policy.BlockOptions.Timeout,
TimeoutMax: policy.BlockOptions.TimeoutMax,
} }
} }