OpenResty WAF 与安全防护实战：用 Lua 构建 Web 防火墙

-- 安全防护的黄金法则：越早拦截，成本越低
-- 攻击请求在网关层 403，连上游连接都不会建立
ngx.exit(ngx.HTTP_FORBIDDEN)

http {
    lua_shared_dict waf_blacklist 10m;
    lua_shared_dict waf_ratelimit 100m;

    server {
        listen 8080;
        location / {
            access_by_lua_block {
                -- 安全链：黑名单 -> 限流 -> 参数校验
                require("waf.blacklist").check()
                require("waf.ratelimit").check()
                require("waf.paramcheck").check()
            }
            proxy_pass http://backend;
        }
    }
}

-- waf/ratelimit.lua：滑动窗口限流
local shared = ngx.shared.waf_ratelimit

local WINDOW = 60          -- 窗口 60 秒
local LIMIT = 120          -- 每窗口最多 120 次

local _M = {}

function _M.check(key, limit, window)
    limit = limit or LIMIT
    window = window or WINDOW

    local now = ngx.now()
    local slot = math.floor(now / window)
    local cur_key = key .. ":" .. slot
    local prev_key = key .. ":" .. (slot - 1)

    -- 当前窗口计数
    local cur = shared:incr(cur_key, 1, 0, window + 1)
    -- 上一窗口计数（用于平滑）
    local prev = shared:get(prev_key) or 0
    -- 按窗口剩余时间加权
    local remain = (slot + 1) * window - now
    local weight = remain / window

    if cur + prev * weight > limit then
        ngx.log(ngx.WARN, "rate limited: ", key)
        ngx.exit(ngx.HTTP_TOO_MANY_REQUESTS)   -- 429
    end
end

return _M

-- access 阶段：按 IP + 路径维度限流
local ratelimit = require("waf.ratelimit")
ratelimit.check(ngx.var.binary_remote_addr .. ngx.var.uri, 100, 60)

-- waf/blacklist.lua：计分制动态封禁
local shared = ngx.shared.waf_blacklist
local BLOCK_TIME = 3600        -- 封禁 1 小时
local SCORE_LIMIT = 5          -- 累计 5 分触发封禁

local _M = {}

function _M.ban(ip, reason)
    shared:set("block:" .. ip, true, BLOCK_TIME)
    ngx.log(ngx.ERR, "ban ip: ", ip, " reason: ", reason)
end

function _M.check(ip)
    -- 先查静态黑名单，再查动态封禁
    if shared:get("static:" .. ip) then
        ngx.exit(ngx.HTTP_FORBIDDEN)
    end
    if shared:get("block:" .. ip) then
        ngx.exit(ngx.HTTP_FORBIDDEN)
    end
end

function _M.score(ip, add)
    -- 每次违规累加分数，达到阈值自动封禁
    local key = "score:" .. ip
    local s = shared:incr(key, add, 0, BLOCK_TIME)
    if s >= SCORE_LIMIT then
        _M.ban(ip, "score reached " .. s)
        shared:delete(key)
    end
    return s
end

return _M

-- 使用：登录接口连续失败 5 次即封禁
local blacklist = require("waf.blacklist")
local ip = ngx.var.binary_remote_addr

blacklist.check(ip)

local pwd_ok = verify_password(ngx.var.arg_user, ngx.var.arg_pass)
if not pwd_ok then
    blacklist.score(ip, 1)      -- 记一次失败
    ngx.exit(ngx.HTTP_FORBIDDEN)
end

-- waf/paramcheck.lua：参数校验 + 注入特征检测
local ngx_re = require("ngx.re")

local _M = {}

-- 注入特征：覆盖常见 SQLi 与 XSS 向量
local SUSPICIOUS = {
    "['\"]%s*(or|and)%s+%d",           -- ' or 1=1
    "%s+union%s+select",               -- union select
    "insert%s+into",                    -- insert into
    "drop%s+table",                     -- drop table
    "<script[^>]*>",                    -- <script>
    "javascript%s*:",
    "onerror%s*=",
}

local function is_suspicious(value)
    if type(value) ~= "string" then return false end
    for _, pat in ipairs(SUSPICIOUS) do
        if ngx_re.find(value, pat, "isj") then
            return true
        end
    end
    return false
end

function _M.check()
    local args = ngx.req.get_uri_args()
    for k, v in pairs(args) do
        -- 过滤危险键名
        if k:find("__proto__", 1, true) or k:find("constructor", 1, true) then
            ngx.log(ngx.ERR, "proto pollution attempt: ", k)
            ngx.exit(ngx.HTTP_FORBIDDEN)
        end
        -- 遍历单个值与 table 值
        if type(v) == "table" then
            for _, item in ipairs(v) do
                if is_suspicious(item) then
                    ngx.exit(ngx.HTTP_FORBIDDEN)
                end
            end
        elseif is_suspicious(v) then
            ngx.exit(ngx.HTTP_FORBIDDEN)
        end
    end

    -- 请求体（表单/JSON）的校验
    local body = ngx.req.read_body()
    local data = ngx.req.get_body_data()
    if data and is_suspicious(data) then
        ngx.exit(ngx.HTTP_FORBIDDEN)
    end
end

return _M

local PARAM_RULES = {
    ["/api/user"] = {
        id   = { kind = "int", min = 1, max = 99999999 },
        name = { kind = "string", maxlen = 32 },
    },
}

function _M.validate(uri, args)
    local rules = PARAM_RULES[uri]
    if not rules then return true end
    for key, rule in pairs(rules) do
        local v = args[key]
        if v == nil then
            if rule.required then return false end
        else
            if rule.kind == "int" and not v:match("^%d+$") then return false end
            if rule.kind == "string" and #v > (rule.maxlen or 64) then return false end
        end
    end
    return true
end

# 安装依赖后配置 lua-resty-waf
http {
    lua_package_path "/usr/local/openresty/lualib/?.lua;;";

    server {
        listen 8080;
        location / {
            access_by_lua_block {
                local waf = require("resty.waf")
                local waf_instance = waf:new()

                waf_instance:set_option("mode", "ACTIVE")     -- ACTIVE 拦截 / SIMULATE 只记录
                waf_instance:set_option("debug", false)
                waf_instance:set_option("score_threshold", 5)
                waf_instance:set_option("storage", "none")    -- 或用 "cookies"

                waf_instance:exec()
            }
            proxy_pass http://backend;
        }
    }
}

{
    "rules": {
        "custom": {
            "block_healthz": {
                "op": "contains",
                "input": "PATH",
                "pattern": "/debug/healthz",
                "action": "DENY"
            }
        }
    }
}