# 下载并编译
wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz 
tar -zxvf LuaJIT-2.0.5.tar.gz
cd LuaJIT-2.0.5
make install PREFIX=/usr/local/luajit

# 设置环境变量
vi /etc/profile
export LUAJIT_LIB=/usr/local/luajit/lib
export LUAJIT_INC=/usr/local/luajit/include/luajit-2.0
source /etc/profile
echo "/usr/local/luajit/lib" >> /etc/ld.so.conf
ldconfig

wget https://github.com/simpl/ngx_devel_kit/archive/v0.3.0.tar.gz
tar -zxvf v0.3.0.tar.gz

wget https://github.com/openresty/lua-nginx-module/archive/v0.10.9rc7.tar.gz
tar -zxvf v0.10.9rc7.tar.gz

# 准备nginx安装包
wget http://nginx.org/download/nginx-1.20.1.tar.gz
tar -zxvf nginx-1.20.1.tar.gz
cd nginx-1.20.1

# 查看原始编译，在末尾处添加ndk、lnm文件路径
# --add-module=/waf/ngx_devel_kit-0.3.0
# --add-module=/waf/lua-nginx-module-0.10.9rc7
nginx -V
./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-google_perftools_module --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' --add-module=/waf/ngx_devel_kit-0.3.0  --add-module=/waf/lua-nginx-module-0.10.9rc7
systemctl stop nginx

# configure无法通过，补环境
error: SSL modules require the OpenSSL library
    yum -y install openssl openssl-devel

error: the HTTP XSLT module requires the libxml2/libxslt libraries.
    yum -y install libxslt-devel

error: the HTTP image filter module requires the GD library
    yum -y install gd gd-devel

error: the Google perftools module requires the Google perftools library
    yum -y install gperftools

# 编译
make
cd ./objs

# 备份原文件，拷贝新文件
which nginx
mv /usr/sbin/nginx /usr/sbin/nginx.old
cp nginx /usr/sbin/nginx
systemctl restart nginx

# 测试使用content_by_lua响应http请求
vi /etc/nginx/nginx.conf
server {
    listen       80;
    listen       [::]:80;
    server_name  _;
    root         /usr/share/nginx/html;

    location /lua {
        default_type 'text/html';
        content_by_lua 'ngx.say("hello lua")';
    }

nginx -s reload
curl 127.0.0.1/lua

# 下载文件
wget https://github.com/loveshell/ngx_lua_waf/archive/refs/tags/v0.7.2.tar.gz
tar -zxvf v0.7.2.tar.gz
cp -r ngx_lua_waf-0.7.2 /etc/nginx/conf.d/waf/

# 修改配置文件路径
vi /etc/nginx/conf.d/waf/config.lua
RulePath = "/etc/nginx/conf.d/waf/wafconf/" 
attacklog = "on"
logdir = "/var/log/nginx/attacklog/"

# 写入nginx
vi /etc/nginx/nginx.conf
http {
    ...
    # lua_waf
    lua_package_path "/etc/nginx/conf.d/waf/?.lua";
    lua_shared_dict limit 10m;
    init_by_lua_file /etc/nginx/conf.d/waf/init.lua;
    access_by_lua_file /etc/nginx/conf.d/waf/waf.lua;
}

nginx -s reload

http://ip/?id=<script>alert(1)</script>

.
├── README.md
├── config.lua
├── init.lua
├── install.sh
├── waf.lua
└── wafconf
    ├── args
    ├── cookie
    ├── post
    ├── url
    ├── user-agent
    └── whiteurl

http {
    ...
    # lua_waf
    lua_package_path "/etc/nginx/conf.d/waf/?.lua";
    lua_shared_dict limit 10m;
    init_by_lua_file /etc/nginx/conf.d/waf/init.lua;
    access_by_lua_file /etc/nginx/conf.d/waf/waf.lua;
    ...
}

RulePath = "/usr/local/nginx/conf/waf/wafconf/"
attacklog = "on"
logdir = "/usr/local/nginx/logs/hack/"
UrlDeny="on"
Redirect="on"
CookieMatch="on"
postMatch="on" 
whiteModule="on" 
black_fileExt={"php","jsp"}
ipWhitelist={"127.0.0.1"}
ipBlocklist={"1.0.0.1"}
CCDeny="off"
CCrate="100/60"
html=[[ 403 ]]

function log(method,url,data,ruletag)
    if attacklog then
        local realIp = getClientIp()
        local ua = ngx.var.http_user_agent
        local servername=ngx.var.server_name
        local time=ngx.localtime()
        if ua  then
            line = realIp.." ["..time.."] \""..method.." "..servername..url.."\" \""..data.."\"  \""..ua.."\" \""..ruletag.."\"\n"
        else
            line = realIp.." ["..time.."] \""..method.." "..servername..url.."\" \""..data.."\" - \""..ruletag.."\"\n"
        end
        local filename = logpath..'/'..servername.."_"..ngx.today().."_sec.log"
        write(filename,line)
    end
end

function args()
    for _,rule in pairs(argsrules) do
        local args = ngx.req.get_uri_args()
        for key, val in pairs(args) do
            if type(val)=='table' then
                if val ~= false then
                    data=table.concat(val, " ")
                end
            else
                data=val
            end
            if data and type(data) ~= "boolean" and rule ~="" and ngxmatch(unescape(data),rule,"isjo") then
                log('GET',ngx.var.request_uri,"-",rule)
                say_html()
                return true
            end
        end
    end
    return false
end

\.\./
\:\$
\$\{
select.+(from|limit)
(?:(union(.*?)select))
having|rongjitest
sleep\((\s*)(\d*)(\s*)\)
benchmark\((.*)\,(.*)\)
base64_decode\(
(?:from\W+information_schema\W)
(?:(?:current_)user|database|schema|connection_id)\s*\(
(?:etc\/\W*passwd)
into(\s+)+(?:dump|out)file\s*
group\s+by.+\(
xwork.MethodAccessor
(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(
xwork\.MethodAccessor
(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/
java\.lang
\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[
\<(iframe|script|body|img|layer|div|meta|style|base|object|input)
(onmouseover|onerror|onload)\=

--[[
    ngx.var.remote_addr api获取的ip值与config.lua中ipWhitelist做白名单匹配
]]

function whiteip()
    if next(ipWhitelist) ~= nil then
        for _,ip in pairs(ipWhitelist) do
            if getClientIp()==ip then
                return true
            end
        end
    end
        return false
end

--[[
    ngx.var.remote_addr api获取的ip值与config.lua中ipBlocklist做黑名单匹配
]]

function blockip()
     if next(ipBlocklist) ~= nil then
         for _,ip in pairs(ipBlocklist) do
             if getClientIp()==ip then
                 ngx.exit(403)
                 return true
             end
         end
     end
         return false
end

--[[
    ngx.shared.limit申请一个共享空间用于请求计数
    每收到一个请求便会生成一个由$remote_addr和$uri组成的token，然后对token与limit数据进行做存在性匹配
    不存在则将token写入共享空间，此时计数为1，过期时间为config.lua配置的CCrate值，初始值为60秒
    存在则进行请求数量判断，当超过config.lua配置的CCrate参数值100次时返回503错误
    没有超过阀值便会incr(token,1)新增1次请求数
]]

function denycc()
    if CCDeny then
        local uri=ngx.var.uri
        CCcount=tonumber(string.match(CCrate,'(.*)/'))  -- 100/
        CCseconds=tonumber(string.match(CCrate,'/(.*)')) -- /60
        local token = getClientIp()..uri  -- 生成token 1.1.1.1/abc
        local limit = ngx.shared.limit  -- 初始化共享空间
        local req,_=limit:get(token)  -- 新token与共享空间做匹配
        if req then  -- 匹配成功，进入cc检测
            if req > CCcount then  -- 判断是否大于100
                 ngx.exit(503)  -- 返回503
                return true
            else  -- 存在token，但是没有达到100个数量
                 limit:incr(token,1)  -- 请求数增加1
            end
        else  -- 匹配失败，共享空间新增一个token，计数1，60秒过期时间
            limit:set(token,1,CCseconds)
        end
    end
    return false
end

--[[
    ngx.var.uri api获取的uri与规则库提取的whiteurl做白名单匹配
]]

function whiteurl()
    if WhiteCheck then
        if wturlrules ~=nil then
            for _,rule in pairs(wturlrules) do
                if ngxmatch(ngx.var.uri,rule,"isjo") then
                    return true 
                 end
            end
        end
    end
    return false
end

--[[
    ngx.var.http_user_agent api获取的ua值与规则库提取的uarules做黑名单匹配
    匹配成功时调用log()函数记录日志，并返回403页面
]]

function ua()
    local ua = ngx.var.http_user_agent
    if ua ~= nil then
        for _,rule in pairs(uarules) do
            if rule ~="" and ngxmatch(ua,rule,"isjo") then
                log('UA',ngx.var.request_uri,"-",rule)
                say_html()
            return true
            end
        end
    end
    return false
end

--[[
    ngx.var.request_uri api获取的url与规则库提取的urlrules做黑名单匹配
    匹配成功时调用log()函数记录日志，并返回403页面
]]

function url()
    if UrlDeny then
        for _,rule in pairs(urlrules) do
            if rule ~="" and ngxmatch(ngx.var.request_uri,rule,"isjo") then
                log('GET',ngx.var.request_uri,"-",rule)
                say_html()
                return true
            end
        end
    end
    return false
end

--[[
    ngx.req.get_uri_args() api获取url的args
    判断args值是否为table类型，如果是则使用concat拼接数据
    再将args的值与规则库提取的argsrules做黑名单匹配
    匹配成功时调用log()函数记录日志，并返回403页面
]]

function args()
    for _,rule in pairs(argsrules) do
        local args = ngx.req.get_uri_args()
        for key, val in pairs(args) do
            if type(val)=='table' then
                if val ~= false then
                    data=table.concat(val, " ")
                end
            else
                data=val
            end
            if data and type(data) ~= "boolean" and rule ~="" and ngxmatch(unescape(data),rule,"isjo") then
                log('GET',ngx.var.request_uri,"-",rule)
                say_html()
                return true
            end
        end
    end
    return false
end

--[[
    ngx.var.http_cookie api获取的cookie与规则库提取的ckrules做黑名单匹配
    匹配成功时调用log()函数记录日志，并返回403页面
]]

function cookie()
    local ck = ngx.var.http_cookie
    if CookieCheck and ck then
        for _,rule in pairs(ckrules) do
            if rule ~="" and ngxmatch(ck,rule,"isjo") then
                log('Cookie',ngx.var.request_uri,"-",rule)
                say_html()
            return true
            end
        end
    end
    return false
end

--[[
    ngx.req.init_body api创建一个4k的缓存区，sock接收每个请求最大4k数据进行检查
    正则匹配请求体数据，发现Content-Disposition: form-data时进入文件检查流程，对文件后缀名与规则库提取的black_fileExt做黑名单匹配
    然后对请求体与规则库提取的postrules做黑名单匹配
    匹配成功时调用log()函数记录日志，并返回403页面
]]

ngx.req.init_body(128 * 1024)  -- buffer 128k
sock:settimeout(0)
local content_length = nil
content_length=tonumber(ngx.req.get_headers()['content-length'])  -- 获取请求包总长度
local chunk_size = 4096
if content_length < chunk_size then
    chunk_size = content_length
local data, err, partial = sock:receive(chunk_size)  -- 默认最大取4k数据
data = data or partial
ngx.req.append_body(data)

local m = ngxmatch(data,[[Content-Disposition: form-data;(.+)filename="(.+)\\.(.*)"]],'ijo')  -- 匹配form-data
if m then
    fileExtCheck(m[3])  -- 匹配后缀名
    filetranslate = true
else
    if ngxmatch(data,"Content-Disposition:",'isjo') then
        filetranslate = false
    end
    if filetranslate==false then
            if body(data) then  -- 调用body()检查请求体
            return true
        end
    end
end
ngx.req.finish_body()

--[[
    ngx.req.get_post_args api获取body部分的args
    判断args值是否为table类型，如果是则使用concat拼接数据
    再将args的值与规则库提取的postrules做黑名单匹配
    匹配成功时调用log()函数记录日志，并返回403页面
]]

ngx.req.read_body()
local args = ngx.req.get_post_args()
if not args then
    return
end
for key, val in pairs(args) do
    if type(val) == "table" then
        if type(val[1]) == "boolean" then
            return
        end
        data=table.concat(val, ", ")
    else
        data=val
    end
    if data and type(data) ~= "boolean" and body(data) then
        body(key)
    end
end

error_log /var/log/nginx/error.log debug;
http {
    ...
    server{
        ...
        location /test {
        default_type 'text/html';
        content_by_lua "ngx.say('ok')";
        }
    }
}

-- waf.lua
local m = ngxmatch(data,[[Content-Disposition: form-data;(.+)filename="(.+)\\.(.*)"]],'ijo')
if m then
    fileExtCheck(m[3])  -- 匹配后缀名
    filetranslate = true

# Content-Disposition值大小写
Content-Disposition: form-datA; name="file"; filename="aaa.php"
Content-Type: image/png

# Content-Disposition值为空
Content-Disposition: ; name="file"; filename="aaa.php"
Content-Type: image/png

# Content-Disposition值多余数据
Content-Disposition: ~form-data; name="file"; filename="aaa.php"
Content-Type: image/png

-- waf.lua
local chunk_size = 4096
if content_length < chunk_size then
    chunk_size = content_length
local data, err, partial = sock:receive(chunk_size)