《Nginx+Lua在网络安全方面的应用》理财范 周为

NGINX防护的基本方式UserAgentFrequencyLimit/MasterreMEMMasterreMEMRead/WriteWorkeWorkerWorkerWorkerWorkerNGINX配置继承模型MMainentsServerLocationLocationServer复合条件下复合条件下的IF配置实例if($remote_addr~"^(12.34|56.78)"){set$flag"${flag}1";}if($http_user_agent~*"spider"){set$flag"${flag}1";}if($flag="011"){return403;}违反直觉的违反直觉的IF配置实例location/test{set$true1;if($true){add_headerX-First1;}if($true){add_headerX-Second2;}return204;}NginNginx被广泛应用的Web服务器NginxNginx+Lua技术栈NginxInitPhaseNginxRewriteNginxInitPhaseNginxRewrite/AccessNginxContentPhaseNginxLogPhaseinitinit_by_luainitinit_worker_by_luasetset_by_luarewriterewrite_by_luaaccessaccess_by_luacontentcontent_by_luabodybody_filter_by_lualoglog_by_luaHelloworldworker_processes1;events{worker_connections1024;}http{server{listen8080;location/{default_typetext/html;content_by_lua'ngx.say("<p>hello,world</p>")';}}}WAFdemolocation/{access_by_lua'localua=ngx.var.http_user_agentlocalip=ngx.var.remote_addrifngx.re.find(ua,"spider","i")andngx.re.find(ip,"12.34|56.78","i")thenngx.exit(403)end}NginxNginxngx_lua_moduleNginx,,OpenRestyOpenResty之间的关系OpenRestyNgxNgx_Lua_ModuleNginxAPI多个Nginx模块EchoNginxModuleHeaderMoreNginxModuleAuthRequetNginxModule…rykLibraryLuaRestyMemcachedLibrary…lokeulokeueeeqJavaScriptUpStreamwithoutcookiesJavascriptwithJavaScriptUpStreamwithoutcookiesJavascriptwithcookiesUpStreamNginxUpStreamVerifyToken验证洲览器特验证洲览器特征SetCookiesClientJavascriptRuntimeReturnReturnJavasc