Nginx Lua Redis防止CC攻击

土小帽

Nginx Lua Redis防止CC攻击实现原理：同一个外网IP、同一个网址(ngx.var.request_uri)、同一个客户端(http_user_agent)在某一段时间(CCseconds)内访问某个网址(ngx.var.request_uri)超过指定次数(CCcount)，则禁止这个外网IP+同一个客户端(md5(IP+ngx.var.http_user_agent)访问这个网址(ngx.var.request_uri)一段时间(blackseconds)。

该脚本使用lua编写(依赖nginx+lua)，将信息写到redis(依赖redis.lua)。

Nginx lua模块安装
重新编译nginx，安装lua模块

1. pushd /root/oneinstack/src
   
2. wget -c http://nginx.org/download/nginx-1.12.1.tar.gz
   
3. wget -c http://mirrors.linuxeye.com/oneinstack/src/openssl-1.0.2l.tar.gz
   
4. wget -c http://mirrors.linuxeye.com/oneinstack/src/pcre-8.41.tar.gz
   
5. wget -c http://luajit.org/download/LuaJIT-2.0.5.tar.gz
   
6. git clone https://github.com/simpl/ngx_devel_kit.git
   
7. git clone https://github.com/openresty/lua-nginx-module.git
   
8. tar xzf nginx-1.12.1.tar.gz
   
9. tar xzf openssl-1.0.2l.tar.gz
   
10. tar xzf pcre-8.41.tar.gz
    
11. tar xzf LuaJIT-2.0.5.tar.gz
    
12. pushd LuaJIT-2.0.5
    
13. make && make install
    
14. popd
    
15. pushd nginx-1.12.1
    
16. ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_stub_status_module --with-http_v2_module --with-http_ssl_module --with-http_gzip_static_module --with-http_realip_module --with-http_flv_module --with-http_mp4_module --with-openssl=../openssl-1.0.2l --with-pcre=../pcre-8.41 --with-pcre-jit --with-ld-opt=-ljemalloc --add-module=../lua-nginx-module --add-module=../ngx_devel_kit
    
17. make
    
18. mv /usr/local/nginx/sbin/nginx{,_bk}
    
19. cp objs/nginx /usr/local/nginx/sbin
    
20. nginx -t #检查语法

复制代码

加载redis.lua

1. mkdir /usr/local/nginx/conf/lua
   
2. cd /usr/local/nginx/conf/lua
   
3. wget https://github.com/openresty/lua-resty-redis/raw/master/lib/resty/redis.lua

复制代码

在/usr/local/nginx/conf/nginx.conf http { }中添加：

1. #the Nginx bundle:
   
2. lua_package_path "/usr/local/nginx/conf/lua/redis.lua;;";

复制代码

防止CC规则waf.lua
将下面内容保存在/usr/local/nginx/conf/lua/waf.lua

1. local get_headers = ngx.req.get_headers
   
2. local ua = ngx.var.http_user_agent
   
3. local uri = ngx.var.request_uri
   
4. local url = ngx.var.host .. uri
   
5. local redis = require 'redis'
   
6. local red = redis.new()
   
7. local CCcount = 20
   
8. local CCseconds = 60
   
9. local RedisIP = '127.0.0.1'
   
10. local RedisPORT = 6379
    
11. local blackseconds = 7200
    
12. if ua == nil then
    
13.     ua = "unknown"
    
14. end
    
15. if (uri == "/wp-admin.php") then
    
16.     CCcount=20
    
17.     CCseconds=60
    
18. end
    
19. red:set_timeout(100)
    
20. local ok, err = red.connect(red, RedisIP, RedisPORT)
    
21. if ok then
    
22.     red.connect(red, RedisIP, RedisPORT)
    
23.     function getClientIp()
    
24.         IP = ngx.req.get_headers()["X-Real-IP"]
    
25.         if IP == nil then
    
26.             IP = ngx.req.get_headers()["x_forwarded_for"]
    
27.         end
    
28.         if IP == nil then
    
29.             IP  = ngx.var.remote_addr
    
30.         end
    
31.         if IP == nil then
    
32.             IP  = "unknown"
    
33.         end
    
34.         return IP
    
35.     end
    
36.     local token = getClientIp() .. "." .. ngx.md5(url .. ua)
    
37.     local req = red:exists(token)
    
38.     if req == 0 then
    
39.         red:incr(token)
    
40.         red:expire(token,CCseconds)
    
41.     else
    
42.         local times = tonumber(red:get(token))
    
43.         if times >= CCcount then
    
44.             local blackReq = red:exists("black." .. token)
    
45.             if (blackReq == 0) then
    
46.                 red:set("black." .. token,1)
    
47.                 red:expire("black." .. token,blackseconds)
    
48.                 red:expire(token,blackseconds)
    
49.                 ngx.exit(580)
    
50.             else
    
51.                 ngx.exit(580)
    
52.             end
    
53.             return
    
54.         else
    
55.             red:incr(token)
    
56.         end
    
57.     end
    
58.     return
    
59. end

复制代码

Nginx虚拟主机加载waf.lua
在虚拟主机配置文件/usr/local/nginx/conf/vhost/oneinstack.com.conf

1. access_by_lua_file "/usr/local/nginx/conf/lua/waf.lua";

复制代码