mirror of
https://github.com/TeaOSLab/EdgeNode.git
synced 2025-11-03 23:20:25 +08:00
b772085ef2
* 信息加密使用struct代替map，以缩短加密后内容长度 * 拦截动作、人机识别动作增加是否尝试全局封禁选项 * JSCookie识别动作增加默认设置选项 * 人机识别中传入info参数异常时，尝试跳转到来源地址，避免直接提示invalid request
87 lines
2.0 KiB
Go
87 lines
2.0 KiB
Go
package waf
|
|
|
|
import (
|
|
"github.com/TeaOSLab/EdgeNode/internal/remotelogs"
|
|
"github.com/TeaOSLab/EdgeNode/internal/utils"
|
|
"github.com/TeaOSLab/EdgeNode/internal/waf/requests"
|
|
"github.com/iwind/TeaGo/types"
|
|
"net/http"
|
|
"net/url"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
Get302Path = "/WAF/VERIFY/GET"
|
|
)
|
|
|
|
// Get302Action
|
|
// 原理： origin url --> 302 verify url --> origin url
|
|
// TODO 将来支持meta refresh验证
|
|
type Get302Action struct {
|
|
BaseAction
|
|
|
|
Life int32 `yaml:"life" json:"life"`
|
|
Scope string `yaml:"scope" json:"scope"`
|
|
}
|
|
|
|
func (this *Get302Action) Init(waf *WAF) error {
|
|
return nil
|
|
}
|
|
|
|
func (this *Get302Action) Code() string {
|
|
return ActionGet302
|
|
}
|
|
|
|
func (this *Get302Action) IsAttack() bool {
|
|
return false
|
|
}
|
|
|
|
func (this *Get302Action) WillChange() bool {
|
|
return true
|
|
}
|
|
|
|
func (this *Get302Action) Perform(waf *WAF, group *RuleGroup, set *RuleSet, request requests.Request, writer http.ResponseWriter) PerformResult {
|
|
// 仅限于Get
|
|
if request.WAFRaw().Method != http.MethodGet {
|
|
return PerformResult{
|
|
ContinueRequest: true,
|
|
}
|
|
}
|
|
|
|
// 是否已经在白名单中
|
|
if SharedIPWhiteList.Contains("set:"+types.String(set.Id), this.Scope, request.WAFServerId(), request.WAFRemoteIP()) {
|
|
return PerformResult{
|
|
ContinueRequest: true,
|
|
}
|
|
}
|
|
|
|
var m = InfoArg{
|
|
URL: request.WAFRaw().URL.String(),
|
|
Timestamp: time.Now().Unix(),
|
|
Life: this.Life,
|
|
Scope: this.Scope,
|
|
PolicyId: waf.Id,
|
|
GroupId: group.Id,
|
|
SetId: set.Id,
|
|
UseLocalFirewall: false,
|
|
}
|
|
info, err := utils.SimpleEncryptObject(m)
|
|
if err != nil {
|
|
remotelogs.Error("WAF_GET_302_ACTION", "encode info failed: "+err.Error())
|
|
return PerformResult{
|
|
ContinueRequest: true,
|
|
}
|
|
}
|
|
|
|
request.DisableStat()
|
|
request.ProcessResponseHeaders(writer.Header(), http.StatusFound)
|
|
http.Redirect(writer, request.WAFRaw(), Get302Path+"?info="+url.QueryEscape(info), http.StatusFound)
|
|
|
|
flusher, ok := writer.(http.Flusher)
|
|
if ok {
|
|
flusher.Flush()
|
|
}
|
|
|
|
return PerformResult{}
|
|
}
|