firewallconfigs

package
v1.3.9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 17, 2024 License: BSD-3-Clause Imports: 12 Imported by: 1

Documentation

Index

Constants

View Source 
const (
	GlobalBlackListId int64 = 2_000_000_000
	GlobalWhiteListId int64 = 2_000_000_001
	GlobalGreyListId  int64 = 2_000_000_002

	DefaultEventLevel = "critical"
)
View Source 
const (
	HTTPFirewallRuleConnectorAnd = "and"
	HTTPFirewallRuleConnectorOr  = "or"
)
View Source 
const DefaultMaxRequestBodySize int64 = 256 << 10

Variables

View Source 
var AllActions = []*HTTPFirewallActionDefinition{
	{
		Name:        "显示网页",
		Code:        HTTPFirewallActionPage,
		Description: "显示请求被拦截的网页。",
		Category:    HTTPFirewallActionCategoryBlock,
	},
	{
		Name:        "阻止",
		Code:        HTTPFirewallActionBlock,
		Description: "阻止请求并中断当前连接，并自动将当前客户端IP加入到系统黑名单；使用此动作时，请先自行严格测试设置的规则是否正确，避免因错误封禁而导致用户无法正常访问的严重后果！",
		Category:    HTTPFirewallActionCategoryBlock,
	},
	{
		Name:        "Captcha人机识别",
		Code:        HTTPFirewallActionCaptcha,
		Description: "在浏览器使用人机识别机制（比如验证码）来验证客户端。",
		Category:    HTTPFirewallActionCategoryVerify,
	},
	{
		Name:        "JS Cookie验证",
		Code:        HTTPFirewallActionJavascriptCookie,
		Description: "首次访问网站时通过Javascript设置Cookie来验证请求。",
		Category:    HTTPFirewallActionCategoryVerify,
	},
	{
		Name:        "记录IP",
		Code:        HTTPFirewallActionRecordIP,
		Description: "将此IP记录到某个IP名单中。",
		Category:    HTTPFirewallActionCategoryBlock,
	},
	{
		Name:        "跳转",
		Code:        HTTPFirewallActionRedirect,
		Description: "跳转到新的URL。",
		Category:    HTTPFirewallActionCategoryBlock,
	},
	{
		Name:        "允许通过",
		Code:        HTTPFirewallActionAllow,
		Description: "允许跳过规则集正常通过防火墙。",
		Category:    HTTPFirewallActionCategoryAllow,
	},
	{
		Name:        "允许并记录日志",
		Code:        HTTPFirewallActionLog,
		Description: "允许正常通过并记录到日志。",
		Category:    HTTPFirewallActionCategoryAllow,
	},
	{
		Name:        "标签",
		Code:        HTTPFirewallActionTag,
		Description: "为匹配的请求打上标签。",
		Category:    HTTPFirewallActionCategoryAllow,
	},
	{
		Name:        "告警",
		Code:        HTTPFirewallActionNotify,
		Description: "向集群的消息接收人发送消息通知（商业版）。",
		Category:    HTTPFirewallActionCategoryVerify,
	},
	{
		Name:        "GET 302",
		Code:        HTTPFirewallActionGet302,
		Description: "通过302重定向GET请求验证客户端真实性。",
		Category:    HTTPFirewallActionCategoryVerify,
	},
	{
		Name:        "POST 307",
		Code:        HTTPFirewallActionPost307,
		Description: "通过307重定向POST请求验证客户端真实性。",
		Category:    HTTPFirewallActionCategoryVerify,
	},
	{
		Name:     "跳到下一个规则分组",
		Code:     HTTPFirewallActionGoGroup,
		Type:     reflect.TypeOf(new(HTTPFirewallGoGroupAction)).Elem(),
		Category: HTTPFirewallActionCategoryVerify,
	},
	{
		Name:     "跳到下一个规则集",
		Code:     HTTPFirewallActionGoSet,
		Type:     reflect.TypeOf(new(HTTPFirewallGoSetAction)).Elem(),
		Category: HTTPFirewallActionCategoryVerify,
	},
}
View Source 
var AllCheckpoints = []*HTTPFirewallCheckpointDefinition{
	{
		Name:        "通用请求报头长度限制",
		Prefix:      "requestGeneralHeaderLength",
		Description: "通用报头比如Cache-Control、Accept之类的长度限制，防止缓冲区溢出攻击。",
		IsRequest:   true,
		IsComposed:  true,
		Priority:    100,
	},
	{
		Name:        "通用响应报头长度限制",
		Prefix:      "responseGeneralHeaderLength",
		Description: "通用报头比如Cache-Control、Date之类的长度限制，防止缓冲区溢出攻击。",
		IsRequest:   false,
		IsComposed:  true,
		Priority:    100,
	},
	{
		Name:        "客户端地址（IP）",
		Prefix:      "remoteAddr",
		Description: "试图通过分析X-Forwarded-For等报头获取的客户端地址，比如192.168.1.100，存在伪造的可能。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "客户端源地址（IP）",
		Prefix:      "rawRemoteAddr",
		Description: "直接连接的客户端地址，比如192.168.1.100。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "客户端端口",
		Prefix:      "remotePort",
		Description: "直接连接的客户端地址端口。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "客户端用户名",
		Prefix:      "remoteUser",
		Description: "通过BasicAuth登录的客户端用户名。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "请求URI",
		Prefix:      "requestURI",
		Description: "包含URL参数的请求URI，类似于 /hello/world?lang=go，不包含域名部分。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "请求路径",
		Prefix:      "requestPath",
		Description: "不包含URL参数的请求路径，类似于 /hello/world，不包含域名部分。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "请求完整URL",
		Prefix:      "requestURL",
		Description: "完整的请求URL，包含协议、域名、请求路径、参数等，类似于 https://example.com/hello?name=lily 。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "请求内容长度",
		Prefix:      "requestLength",
		Description: "请求报头中的Content-Length。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "请求体内容",
		Prefix:      "requestBody",
		Description: "通常在POST或者PUT等操作时会附带请求体，最大限制32M。",
		IsRequest:   true,
		Priority:    5,
	},
	{
		Name:        "请求URI和请求体组合",
		Prefix:      "requestAll",
		Description: "${requestURI}和${requestBody}组合。",
		IsRequest:   true,
		Priority:    5,
	},
	{
		Name:        "请求表单参数",
		Prefix:      "requestForm",
		Description: "获取POST或者其他方法发送的表单参数，最大请求体限制32M。",
		IsRequest:   true,
		HasParams:   true,
		Priority:    5,
	},
	{
		Name:        "上传文件",
		Prefix:      "requestUpload",
		Description: "获取POST上传的文件信息，最大请求体限制32M。",
		Params: []*KeyValue{
			NewKeyValue("最小文件尺寸", "minSize"),
			NewKeyValue("最大文件尺寸", "maxSize"),
			NewKeyValue("扩展名(如.txt)", "ext"),
			NewKeyValue("原始文件名", "name"),
			NewKeyValue("表单字段名", "field"),
		},
		IsRequest: true,
		HasParams: true,
		Priority:  20,
	},
	{
		Name:        "请求JSON参数",
		Prefix:      "requestJSON",
		Description: "获取POST或者其他方法发送的JSON，最大请求体限制32M，使用点（.）符号表示多级数据。",
		IsRequest:   true,
		HasParams:   true,
		Priority:    5,
	},
	{
		Name:        "请求方法",
		Prefix:      "requestMethod",
		Description: "比如GET、POST。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "请求协议",
		Prefix:      "scheme",
		Description: "比如http或https。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "HTTP协议版本",
		Prefix:      "proto",
		Description: "比如HTTP/1.1。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "主机名",
		Prefix:      "host",
		Description: "比如example.com。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "CNAME",
		Prefix:      "cname",
		Description: "当前网站服务CNAME，比如38b48e4f.example.com。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "是否为CNAME",
		Prefix:      "isCNAME",
		Description: "是否为CNAME，值为1（是）或0（否）。",
		IsRequest:   true,
		Priority:    100,
		DataType:    "bool",
	},
	{
		Name:        "请求来源",
		Prefix:      "refererOrigin",
		Description: "请求报头中的Referer和Origin值。",
		IsRequest:   true,
		Priority:    100,
		Version:     "1.3.2",
	},
	{
		Name:        "请求来源Referer",
		Prefix:      "referer",
		Description: "请求报头中的Referer值。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "客户端信息",
		Prefix:      "userAgent",
		Description: "比如Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "内容类型",
		Prefix:      "contentType",
		Description: "请求报头的Content-Type。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "所有cookie组合字符串",
		Prefix:      "cookies",
		Description: "比如sid=IxZVPFhE&city=beijing&uid=18237。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "单个cookie值",
		Prefix:      "cookie",
		Description: "单个cookie值。",
		IsRequest:   true,
		HasParams:   true,
		Priority:    100,
	},
	{
		Name:        "所有URL参数组合",
		Prefix:      "args",
		Description: "比如name=lu&age=20。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "单个URL参数值",
		Prefix:      "arg",
		Description: "单个URL参数值。",
		IsRequest:   true,
		HasParams:   true,
		Priority:    100,
	},
	{
		Name:        "所有请求报头内容",
		Prefix:      "headers",
		Description: "使用换行符（\\n）隔开的报头内容字符串，每行均为\"NAME: VALUE格式\"。",
		IsRequest:   true,
		Priority:    100,
	},
	{
		Name:        "所有请求报头名称",
		Prefix:      "headerNames",
		Description: "使用换行符（\\n）隔开的报头名称字符串，每行一个名称。",
		IsRequest:   true,
		Priority:    100,
		Version:     "1.3.2",
	},
	{
		Name:        "单个请求报头值",
		Prefix:      "header",
		Description: "单个报头值。",
		IsRequest:   true,
		HasParams:   true,
		Priority:    100,
	},
	{
		Name:        "请求报头最大长度",
		Prefix:      "headerMaxLength",
		Description: "最长的请求报头的长度。",
		IsRequest:   true,
		HasParams:   false,
		Priority:    100,
	},
	{
		Name:        "国家/地区名称",
		Prefix:      "geoCountryName",
		Description: "当前客户端所处国家/地区名称。",
		IsRequest:   true,
		HasParams:   false,
		Priority:    90,
	},
	{
		Name:        "省份名称",
		Prefix:      "geoProvinceName",
		Description: "当前客户端所处中国省份名称。",
		IsRequest:   true,
		HasParams:   false,
		Priority:    90,
	},
	{
		Name:        "城市名称",
		Prefix:      "geoCityName",
		Description: "当前客户端所处中国城市名称。",
		IsRequest:   true,
		HasParams:   false,
		Priority:    90,
	},
	{
		Name:        "ISP名称",
		Prefix:      "ispName",
		Description: "当前客户端所处ISP名称。",
		IsRequest:   true,
		HasParams:   false,
		Priority:    90,
	},
	{
		Name:        "CC统计",
		Prefix:      "cc2",
		Description: "对统计对象进行统计。",
		HasParams:   false,
		IsRequest:   true,
		IsComposed:  true,
		Priority:    10,
	},
	{
		Name:        "防盗链",
		Prefix:      "refererBlock",
		Description: "对统计对象进行统计。",
		HasParams:   false,
		IsRequest:   true,
		IsComposed:  true,
		Priority:    20,
	},
	{
		Name:        "CC统计（旧）",
		Prefix:      "cc",
		Description: "统计某段时间段内的请求信息（不推荐再使用，请使用新的CC2统计代替）。",
		HasParams:   true,
		Params: []*KeyValue{
			NewKeyValue("请求数", "requests"),
		},
		Options: []OptionInterface{
			&FieldOption{
				Type:        "field",
				Name:        "统计周期",
				Code:        "period",
				Value:       "60",
				IsRequired:  false,
				Size:        8,
				Comment:     "",
				Placeholder: "",
				RightLabel:  "秒",
				MaxLength:   8,
				Validate: func(value string) (ok bool, message string) {
					if regexp.MustCompile(`^\d+$`).MatchString(value) {
						ok = true
						return
					}
					message = "周期需要是一个整数数字"
					return
				},
			},
			&OptionsOption{
				Type:       "options",
				Name:       "用户识别读取来源",
				Code:       "userType",
				Value:      "",
				IsRequired: false,
				Size:       10,
				Comment:    "",
				RightLabel: "",
				Validate:   nil,
				Options: []maps.Map{
					{
						"name":  "IP",
						"value": "ip",
					},
					{
						"name":  "Cookie",
						"value": "cookie",
					},
					{
						"name":  "URL参数",
						"value": "get",
					},
					{
						"name":  "POST参数",
						"value": "post",
					},
					{
						"name":  "HTTP Header",
						"value": "header",
					},
				},
			},
			&FieldOption{
				Type:    "field",
				Name:    "用户识别字段",
				Code:    "userField",
				Comment: "识别用户的唯一性字段，在用户读取来源不是IP时使用",
			},
			&FieldOption{
				Type:      "field",
				Name:      "字段读取位置",
				Code:      "userIndex",
				Size:      5,
				MaxLength: 5,
				Comment:   "读取用户识别字段的位置，从0开始，比如user12345的数字ID 12345的位置就是5，在用户读取来源不是IP时使用",
			},
		},
		IsRequest: true,
		Priority:  10,
	},
	{
		Name:        "响应状态码",
		Prefix:      "status",
		Description: "响应状态码，比如200、404、500。",
		IsRequest:   false,
		Priority:    100,
	},
	{
		Name:        "响应报头",
		Prefix:      "responseHeader",
		Description: "响应报头值。",
		IsRequest:   false,
		HasParams:   true,
		Priority:    100,
	},
	{
		Name:        "响应内容",
		Prefix:      "responseBody",
		Description: "响应内容字符串。",
		IsRequest:   false,
		Priority:    5,
	},
	{
		Name:        "响应内容长度",
		Prefix:      "bytesSent",
		Description: "响应内容长度，通过响应的报头Content-Length获取。",
		IsRequest:   false,
		Priority:    100,
	},
}

AllCheckpoints all check points list

View Source 
var AllRuleOperators = []*RuleOperatorDefinition{
	{
		Name:            "正则匹配",
		Code:            HTTPFirewallRuleOperatorMatch,
		Description:     "使用正则表达式匹配，在头部使用(?i)表示不区分大小写，<a href=\"https://goedge.cn/docs/Appendix/Regexp/Index.md\" target=\"_blank\">正则表达式语法 &raquo;</a>。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveYes,
		DataType:        "regexp",
	},
	{
		Name:            "正则不匹配",
		Code:            HTTPFirewallRuleOperatorNotMatch,
		Description:     "使用正则表达式不匹配，在头部使用(?i)表示不区分大小写，<a href=\"https://goedge.cn/docs/Appendix/Regexp/Index.md\" target=\"_blank\">正则表达式语法 &raquo;</a>。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveYes,
		DataType:        "regexp",
	},
	{
		Name:            "通配符匹配",
		Code:            HTTPFirewallRuleOperatorWildcardMatch,
		Description:     "判断是否和指定的通配符匹配，可以在对比值中使用星号通配符（*）表示任意字符。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveYes,
		DataType:        "wildcard",
	},
	{
		Name:            "通配符不匹配",
		Code:            HTTPFirewallRuleOperatorWildcardNotMatch,
		Description:     "判断是否和指定的通配符不匹配，可以在对比值中使用星号通配符（*）表示任意字符。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveYes,
		DataType:        "wildcard",
	},
	{
		Name:            "字符串等于",
		Code:            HTTPFirewallRuleOperatorEqString,
		Description:     "使用字符串对比等于。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "字符串不等于",
		Code:            HTTPFirewallRuleOperatorNeqString,
		Description:     "使用字符串对比不等于。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "包含字符串",
		Code:            HTTPFirewallRuleOperatorContains,
		Description:     "包含某个字符串，比如Hello World包含了World。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "不包含字符串",
		Code:            HTTPFirewallRuleOperatorNotContains,
		Description:     "不包含某个字符串，比如Hello字符串中不包含Hi。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "包含任一字符串",
		Code:            HTTPFirewallRuleOperatorContainsAny,
		Description:     "包含字符串列表中的任意一个，比如/hello/world包含/hello和/hi中的/hello，对比值中每行一个字符串。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "strings",
	},
	{
		Name:            "包含所有字符串",
		Code:            HTTPFirewallRuleOperatorContainsAll,
		Description:     "包含字符串列表中的所有字符串，比如/hello/world必须包含/hello和/world，对比值中每行一个字符串。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "strings",
	},
	{
		Name:            "包含前缀",
		Code:            HTTPFirewallRuleOperatorPrefix,
		Description:     "包含字符串前缀部分，比如/hello前缀会匹配/hello, /hello/world等。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "包含后缀",
		Code:            HTTPFirewallRuleOperatorSuffix,
		Description:     "包含字符串后缀部分，比如/hello后缀会匹配/hello, /hi/hello等。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "包含任一单词",
		Code:            HTTPFirewallRuleOperatorContainsAnyWord,
		Description:     "包含某个独立单词，对比值中每行一个单词，比如mozilla firefox里包含了mozilla和firefox两个单词，但是不包含fire和fox这两个单词。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "strings",
	},
	{
		Name:            "包含所有单词",
		Code:            HTTPFirewallRuleOperatorContainsAllWords,
		Description:     "包含所有的独立单词，对比值中每行一个单词，比如mozilla firefox里包含了mozilla和firefox两个单词，但是不包含fire和fox这两个单词。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "strings",
	},
	{
		Name:            "不包含任一单词",
		Code:            HTTPFirewallRuleOperatorNotContainsAnyWord,
		Description:     "不包含某个独立单词，对比值中每行一个单词，比如mozilla firefox里包含了mozilla和firefox两个单词，但是不包含fire和fox这两个单词。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "strings",
	},
	{
		Name:            "包含SQL注入",
		Code:            HTTPFirewallRuleOperatorContainsSQLInjection,
		Description:     "检测字符串内容是否包含SQL注入。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "none",
	},
	{
		Name:            "包含SQL注入-严格模式",
		Code:            HTTPFirewallRuleOperatorContainsSQLInjectionStrictly,
		Description:     "更加严格地检测字符串内容是否包含SQL注入，相对于非严格模式，有一定的误报几率。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "none",
	},
	{
		Name:            "包含XSS注入",
		Code:            HTTPFirewallRuleOperatorContainsXSS,
		Description:     "检测字符串内容是否包含XSS注入。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "none",
	},
	{
		Name:            "包含XSS注入-严格模式",
		Code:            HTTPFirewallRuleOperatorContainsXSSStrictly,
		Description:     "更加严格地检测字符串内容是否包含XSS注入，相对于非严格模式，此时xml、audio、video等标签也会被匹配。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "none",
	},
	{
		Name:            "包含二进制数据",
		Code:            HTTPFirewallRuleOperatorContainsBinary,
		Description:     "包含一组二进制数据。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "不包含二进制数据",
		Code:            HTTPFirewallRuleOperatorNotContainsBinary,
		Description:     "不包含一组二进制数据。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string",
	},
	{
		Name:            "数值大于",
		Code:            HTTPFirewallRuleOperatorGt,
		Description:     "使用数值对比大于，对比值需要是一个数字。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "数值大于等于",
		Code:            HTTPFirewallRuleOperatorGte,
		Description:     "使用数值对比大于等于，对比值需要是一个数字。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "数值小于",
		Code:            HTTPFirewallRuleOperatorLt,
		Description:     "使用数值对比小于，对比值需要是一个数字。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "数值小于等于",
		Code:            HTTPFirewallRuleOperatorLte,
		Description:     "使用数值对比小于等于，对比值需要是一个数字。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "数值等于",
		Code:            HTTPFirewallRuleOperatorEq,
		Description:     "使用数值对比等于，对比值需要是一个数字。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "数值不等于",
		Code:            HTTPFirewallRuleOperatorNeq,
		Description:     "使用数值对比不等于，对比值需要是一个数字。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "包含索引",
		Code:            HTTPFirewallRuleOperatorHasKey,
		Description:     "对于一组数据拥有某个键值或者索引。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNo,
		DataType:        "string|number",
	},
	{
		Name:            "版本号大于",
		Code:            HTTPFirewallRuleOperatorVersionGt,
		Description:     "对比版本号大于。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "version",
	},
	{
		Name:            "版本号小于",
		Code:            HTTPFirewallRuleOperatorVersionLt,
		Description:     "对比版本号小于。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "version",
	},
	{
		Name:            "版本号范围",
		Code:            HTTPFirewallRuleOperatorVersionRange,
		Description:     "判断版本号在某个范围内，格式为 起始version1,结束version2。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "versionRange",
	},
	{
		Name:            "IP等于",
		Code:            HTTPFirewallRuleOperatorEqIP,
		Description:     "将参数转换为IP进行对比，只能对比单个IP。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ip",
	},
	{
		Name:            "在一组IP中",
		Code:            HTTPFirewallRuleOperatorInIPList,
		Description:     "判断参数IP在一组IP内，对比值中每行一个IP。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ips",
	},
	{
		Name:            "IP大于",
		Code:            HTTPFirewallRuleOperatorGtIP,
		Description:     "将参数转换为IP进行对比。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ip",
	},
	{
		Name:            "IP大于等于",
		Code:            HTTPFirewallRuleOperatorGteIP,
		Description:     "将参数转换为IP进行对比。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ip",
	},
	{
		Name:            "IP小于",
		Code:            HTTPFirewallRuleOperatorLtIP,
		Description:     "将参数转换为IP进行对比。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ip",
	},
	{
		Name:            "IP小于等于",
		Code:            HTTPFirewallRuleOperatorLteIP,
		Description:     "将参数转换为IP进行对比。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ip",
	},
	{
		Name:            "IP范围",
		Code:            HTTPFirewallRuleOperatorIPRange,
		Description:     "IP在某个范围之内，范围格式可以是英文逗号分隔的<code-label>开始IP,结束IP</code-label>，比如<code-label>192.168.1.100,192.168.2.200</code-label>；或者CIDR格式的ip/bits，比如<code-label>192.168.2.1/24</code-label>；或者单个IP。可以填写多行，每行一个IP范围。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ips",
	},
	{
		Name:            "不在IP范围",
		Code:            HTTPFirewallRuleOperatorNotIPRange,
		Description:     "IP不在某个范围之内，范围格式可以是英文逗号分隔的<code-label>开始IP,结束IP</code-label>，比如<code-label>192.168.1.100,192.168.2.200</code-label>；或者CIDR格式的ip/bits，比如<code-label>192.168.2.1/24</code-label>；或者单个IP。可以填写多行，每行一个IP范围。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "ips",
	},
	{
		Name:            "IP取模10",
		Code:            HTTPFirewallRuleOperatorIPMod10,
		Description:     "对IP参数值取模，除数为10，对比值为余数。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "IP取模100",
		Code:            HTTPFirewallRuleOperatorIPMod100,
		Description:     "对IP参数值取模，除数为100，对比值为余数。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
	{
		Name:            "IP取模",
		Code:            HTTPFirewallRuleOperatorIPMod,
		Description:     "对IP参数值取模，对比值格式为：除数,余数，比如10,1。",
		CaseInsensitive: HTTPFirewallRuleCaseInsensitiveNone,
		DataType:        "number",
	},
}
View Source 
var DefaultHTTPFirewallPolicyLogConfig = &HTTPFirewallPolicyLogConfig{
	IsOn:          true,
	RequestBody:   true,
	RegionDenying: false,
}

Functions

func CheckCheckpointIsComposed 

func CheckCheckpointIsComposed(prefix string) bool

CheckCheckpointIsComposed 判断Checkpoint是否为组合的

func DefaultCaptchaType added in v1.3.0 

func DefaultCaptchaType() *shared.Definition

func FindAllCaptchaTypes added in v1.3.0 

func FindAllCaptchaTypes() []*shared.Definition

FindAllCaptchaTypes Find all captcha types

func FindAllFirewallModes 

func FindAllFirewallModes() []*shared.Definition

func FindCaptchaType added in v1.3.0 

func FindCaptchaType(code CaptchaType) *shared.Definition

func FindFirewallActionTypeName 

func FindFirewallActionTypeName(actionType FirewallActionType) string

func FindFirewallEventLevelName 

func FindFirewallEventLevelName(code string) string

func FindFirewallMode 

func FindFirewallMode(code FirewallMode) *shared.Definition

func FindGlobalListIdStrings added in v1.3.9 

func FindGlobalListIdStrings() []string

func FindGlobalListIdWithType added in v1.3.9 

func FindGlobalListIdWithType(listType ipconfigs.IPListType) int64

func FindGlobalListIds added in v1.3.9 

func FindGlobalListIds() []int64

func FindGlobalListNameWithType added in v1.3.9 

func FindGlobalListNameWithType(listType ipconfigs.IPListType) string

func FindRuleOperatorName 

func FindRuleOperatorName(code string) string

func IsGlobalListId added in v1.3.9 

func IsGlobalListId(listId int64) bool

Types

type Action 

type Action struct {
}

type AllowScope added in v1.3.3 

type AllowScope = string
const (
	AllowScopeGroup  AllowScope = "group"
	AllowScopeServer AllowScope = "server"
	AllowScopeGlobal AllowScope = "global"
)

type CaptchaType added in v1.3.0 

type CaptchaType = string
const (
	CaptchaTypeDefault  CaptchaType = "default"
	CaptchaTypeOneClick CaptchaType = "oneClick"
	CaptchaTypeSlide    CaptchaType = "slide"
	CaptchaTypeGeeTest  CaptchaType = "geetest"
)

type FieldOption 

type FieldOption struct {
	Type        string                                       `json:"type"`
	Name        string                                       `json:"name"`
	Code        string                                       `json:"code"`
	Value       string                                       `json:"value"` // default value
	IsRequired  bool                                         `json:"isRequired"`
	Size        int                                          `json:"size"`
	Comment     string                                       `json:"comment"`
	Placeholder string                                       `json:"placeholder"`
	RightLabel  string                                       `json:"rightLabel"`
	MaxLength   int                                          `json:"maxLength"`
	Validate    func(value string) (ok bool, message string) `json:"-"`
}

attach option

func NewFieldOption 

func NewFieldOption(name string, code string) *FieldOption

type FirewallActionConfig 

type FirewallActionConfig struct {
	Id         int64    `yaml:"id" json:"id"`                 // Id
	Type       string   `yaml:"type" json:"type"`             // 类型
	Params     maps.Map `yaml:"params" json:"params"`         // 参数
	EventLevel string   `yaml:"eventLevel" json:"eventLevel"` // 事件级别
}

FirewallActionConfig 防火墙动作配置

func (*FirewallActionConfig) Init 

func (this *FirewallActionConfig) Init() error

Init 初始化

type FirewallActionFirewalldConfig 

type FirewallActionFirewalldConfig struct {
	Path string `json:"path"` // 命令路径 TODO 暂时不实现

}

type FirewallActionHTMLConfig 

type FirewallActionHTMLConfig struct {
	Content string `json:"content"` // 完整的HTML内容
}

FirewallActionHTMLConfig HTML配置

type FirewallActionHTTPAPIConfig 

type FirewallActionHTTPAPIConfig struct {
	URL            string `json:"url"`            // URL路径
	TimeoutSeconds int    `json:"timeoutSeconds"` // 超时时间 TODO 暂时不实现
	Secret         string `json:"secret"`         // 认证密钥 TODO 暂时不实现

}

FirewallActionHTTPAPIConfig HTTP API配置

type FirewallActionIPSetConfig 

type FirewallActionIPSetConfig struct {
	Path string `json:"path"` // 命令路径 TODO 暂时不实现

	WhiteName string `json:"whiteName"` // IPSet白名单名称
	BlackName string `json:"blackName"` // IPSet黑名单名称

	WhiteNameIPv6 string `json:"whiteNameIPv6"` // IPv6白名单名称
	BlackNameIPv6 string `json:"blackNameIPv6"` // IPv6黑名单名称

	MaxElements        int  `json:"maxElements"`        // 最多IP数量 TODO 暂时不实现
	AutoAddToIPTables  bool `json:"autoAddToIPTables"`  // 是否自动创建IPTables规则
	AutoAddToFirewalld bool `json:"autoAddToFirewalld"` // 是否自动加入到Firewalld

}

type FirewallActionIPTablesConfig 

type FirewallActionIPTablesConfig struct {
	Path string `json:"path"` // 命令路径 TODO 暂时不实现

}

type FirewallActionScriptConfig 

type FirewallActionScriptConfig struct {
	Path string   `json:"path"` // 脚本路径
	Cwd  string   `json:"cwd"`  // 工作目录 TODO 暂时不实现
	Args []string `json:"args"` // 附加参数 TODO 暂时不实现

}

type FirewallActionType 

type FirewallActionType = string
const (
	FirewallActionTypeIPSet     FirewallActionType = "ipset"
	FirewallActionTypeFirewalld FirewallActionType = "firewalld"
	FirewallActionTypeIPTables  FirewallActionType = "iptables"
	FirewallActionTypeScript    FirewallActionType = "script"
	FirewallActionTypeHTTPAPI   FirewallActionType = "httpAPI"
	FirewallActionTypeHTML      FirewallActionType = "html"
)

type FirewallActionTypeDefinition 

type FirewallActionTypeDefinition struct {
	Name        string             `json:"name"`
	Code        FirewallActionType `json:"code"`
	Description string             `json:"description"`
}

func FindAllFirewallActionTypes 

func FindAllFirewallActionTypes() []*FirewallActionTypeDefinition

type FirewallEventLevelDefinition 

type FirewallEventLevelDefinition struct {
	Name        string `json:"name"`
	Code        string `json:"code"`
	Description string `json:"description"`
}

func FindAllFirewallEventLevels 

func FindAllFirewallEventLevels() []*FirewallEventLevelDefinition

type FirewallMode 

type FirewallMode = string

FirewallMode 模式 

const (
	FirewallModeDefend  FirewallMode = "defend"  // 防御模式
	FirewallModeObserve FirewallMode = "observe" // 观察模式
	FirewallModeBypass  FirewallMode = "bypass"  // 通过模式
)

type FirewallScope 

type FirewallScope = string
const (
	FirewallScopeGlobal FirewallScope = "global"
	FirewallScopeServer FirewallScope = "service" // 历史原因，代号为 service 而非 server
)

type GeeTestConfig added in v1.3.2 

type GeeTestConfig struct {
	IsOn       bool   `yaml:"isOn" json:"isOn"`
	CaptchaId  string `yaml:"captchaId" json:"captchaId"`
	CaptchaKey string `yaml:"captchaKey" json:"captchaKey"`
}

type HTTPFirewallActionCategory 

type HTTPFirewallActionCategory = string
const (
	HTTPFirewallActionCategoryBlock  HTTPFirewallActionCategory = "block"
	HTTPFirewallActionCategoryAllow  HTTPFirewallActionCategory = "allow"
	HTTPFirewallActionCategoryVerify HTTPFirewallActionCategory = "verify"
)

type HTTPFirewallActionConfig 

type HTTPFirewallActionConfig struct {
	Code    HTTPFirewallActionString `yaml:"code" json:"code"`
	Options maps.Map                 `yaml:"options" json:"options"`
}

HTTPFirewallActionConfig 单个动作配置

type HTTPFirewallActionDefinition 

type HTTPFirewallActionDefinition struct {
	Name        string                     `json:"name"`
	Code        HTTPFirewallActionString   `json:"code"`
	Description string                     `json:"description"`
	Type        reflect.Type               `json:"type"`
	Category    HTTPFirewallActionCategory `json:"category"`
}

HTTPFirewallActionDefinition action definition

func FindActionDefinition 

func FindActionDefinition(actionCode HTTPFirewallActionString) *HTTPFirewallActionDefinition

type HTTPFirewallActionString 

type HTTPFirewallActionString = string
const (
	HTTPFirewallActionLog              HTTPFirewallActionString = "log"       // allow and log
	HTTPFirewallActionBlock            HTTPFirewallActionString = "block"     // block
	HTTPFirewallActionCaptcha          HTTPFirewallActionString = "captcha"   // block and show captcha
	HTTPFirewallActionJavascriptCookie HTTPFirewallActionString = "js_cookie" // Javascript Cookie
	HTTPFirewallActionNotify           HTTPFirewallActionString = "notify"    // 告警
	HTTPFirewallActionGet302           HTTPFirewallActionString = "get_302"   // 针对GET的302重定向认证
	HTTPFirewallActionPost307          HTTPFirewallActionString = "post_307"  // 针对POST的307重定向认证
	HTTPFirewallActionRecordIP         HTTPFirewallActionString = "record_ip" // 记录IP
	HTTPFirewallActionTag              HTTPFirewallActionString = "tag"       // 标签
	HTTPFirewallActionPage             HTTPFirewallActionString = "page"      // 显示页面
	HTTPFirewallActionRedirect         HTTPFirewallActionString = "redirect"  // 跳转
	HTTPFirewallActionAllow            HTTPFirewallActionString = "allow"     // allow
	HTTPFirewallActionGoGroup          HTTPFirewallActionString = "go_group"  // go to next rule group
	HTTPFirewallActionGoSet            HTTPFirewallActionString = "go_set"    // go to next rule set
)

type HTTPFirewallAllowAction 

type HTTPFirewallAllowAction struct {
	Scope AllowScope `yaml:"scope" json:"scope"`
}

type HTTPFirewallBlockAction 

type HTTPFirewallBlockAction struct {
	IsPrior bool `yaml:"isPrior" json:"isPrior"`

	StatusCode int           `yaml:"statusCode" json:"statusCode"`
	Body       string        `yaml:"body" json:"body"` // supports HTML
	URL        string        `yaml:"url" json:"url"`
	Timeout    int32         `yaml:"timeout" json:"timeout"`       // 最小封禁时长
	TimeoutMax int32         `yaml:"timeoutMax" json:"timeoutMax"` // 最大封禁时长
	Scope      FirewallScope `yaml:"scope" json:"scope"`

	FailBlockScopeAll bool `yaml:"failBlockScopeAll" json:"failBlockScopeAll"`
}

HTTPFirewallBlockAction default block action

func NewHTTPFirewallBlockAction added in v1.3.5 

func NewHTTPFirewallBlockAction() *HTTPFirewallBlockAction

type HTTPFirewallCaptchaAction 

type HTTPFirewallCaptchaAction struct {
	IsPrior bool `yaml:"isPrior" json:"isPrior"`

	CaptchaType CaptchaType `yaml:"captchaType" json:"captchaType"` // 类型

	Life              int32 `yaml:"life" json:"life"`                           // 有效期
	MaxFails          int   `yaml:"maxFails" json:"maxFails"`                   // 最大失败次数
	FailBlockTimeout  int   `yaml:"failBlockTimeout" json:"failBlockTimeout"`   // 失败拦截时间
	FailBlockScopeAll bool  `yaml:"failBlockScopeAll" json:"failBlockScopeAll"` // 是否全局有效

	CountLetters int8 `yaml:"countLetters" json:"countLetters"` // 字符数量

	UIIsOn          bool   `yaml:"uiIsOn" json:"uiIsOn"`                   // 是否使用自定义UI
	UITitle         string `yaml:"uiTitle" json:"uiTitle"`                 // 消息标题
	UIPrompt        string `yaml:"uiPrompt" json:"uiPrompt"`               // 消息提示
	UIButtonTitle   string `yaml:"uiButtonTitle" json:"uiButtonTitle"`     // 按钮标题
	UIShowRequestId bool   `yaml:"uiShowRequestId" json:"uiShowRequestId"` // 是否显示请求ID
	UICss           string `yaml:"uiCss" json:"uiCss"`                     // CSS样式
	UIFooter        string `yaml:"uiFooter" json:"uiFooter"`               // 页脚
	UIBody          string `yaml:"uiBody" json:"uiBody"`                   // 内容轮廓

	CookieId string `yaml:"cookieId" json:"cookieId"` // TODO

	Lang string `yaml:"lang" json:"lang"` // 语言，zh-CN, en-US ... TODO 需要实现，目前是根据浏览器Accept-Language动态获取

	// 极验相关配置
	// MUST be struct
	GeeTestConfig GeeTestConfig `yaml:"geeTestConfig" json:"geeTestConfig"`
}

func NewHTTPFirewallCaptchaAction added in v1.3.5 

func NewHTTPFirewallCaptchaAction() *HTTPFirewallCaptchaAction

type HTTPFirewallCheckpointDefinition 

type HTTPFirewallCheckpointDefinition struct {
	Name        string            `json:"name"`        // 名称
	Description string            `json:"description"` // 描述
	Prefix      string            `json:"prefix"`      // 前缀
	IsRequest   bool              `json:"isRequest"`   // 是否为请求
	HasParams   bool              `json:"hasParams"`   // 是否有子参数
	Params      []*KeyValue       `json:"params"`      // 参数
	Options     []OptionInterface `json:"options"`     // 选项
	IsComposed  bool              `json:"isComposed"`  // 是否为组合的checkpoint
	Priority    int               `json:"priority"`    // 优先级
	DataType    string            `json:"dataType"`    // 数据类型：number, bool等
	Version     string            `json:"version"`     // 被加入的版本号
}

HTTPFirewallCheckpointDefinition check point definition

func FindCheckpointDefinition 

func FindCheckpointDefinition(prefix string) *HTTPFirewallCheckpointDefinition

FindCheckpointDefinition 查找Checkpoint定义

type HTTPFirewallGet302Action 

type HTTPFirewallGet302Action struct {
	IsPrior bool `yaml:"isPrior" json:"isPrior"`

	Life  int32         `yaml:"life" json:"life"`
	Scope FirewallScope `yaml:"scope" json:"scope"`
}

type HTTPFirewallGoGroupAction 

type HTTPFirewallGoGroupAction struct {
	GroupId string `yaml:"groupId" json:"groupId"`
}

type HTTPFirewallGoSetAction 

type HTTPFirewallGoSetAction struct {
	GroupId string `yaml:"groupId" json:"groupId"`
	SetId   string `yaml:"setId" json:"setId"`
}

type HTTPFirewallInboundConfig 

type HTTPFirewallInboundConfig struct {
	IsOn      bool                        `yaml:"isOn" json:"isOn"`
	GroupRefs []*HTTPFirewallRuleGroupRef `yaml:"groupRefs" json:"groupRefs"`
	Groups    []*HTTPFirewallRuleGroup    `yaml:"groups" json:"groups"`

	// 地区相关
	Region *HTTPFirewallRegionConfig `yaml:"region" json:"region"`

	// IP名单
	AllowListRef *ipconfigs.IPListRef `yaml:"whiteListRef" json:"whiteListRef"`
	DenyListRef  *ipconfigs.IPListRef `yaml:"blackListRef" json:"blackListRef"`
	GreyListRef  *ipconfigs.IPListRef `yaml:"greyListRef" json:"greyListRef"`

	// 绑定的IP名单
	PublicAllowListRefs []*ipconfigs.IPListRef `yaml:"publicWhiteListRefs" json:"publicWhiteListRefs"`
	PublicDenyListRefs  []*ipconfigs.IPListRef `yaml:"publicBlackListRefs" json:"publicBlackListRefs"`
	PublicGreyListRefs  []*ipconfigs.IPListRef `yaml:"publicGreyListRefs" json:"publicGreyListRefs"`
	// contains filtered or unexported fields
}

HTTPFirewallInboundConfig HTTP防火墙入口配置

func (*HTTPFirewallInboundConfig) AddPublicList 

func (this *HTTPFirewallInboundConfig) AddPublicList(listId int64, listType string)

AddPublicList 绑定公用的IP名单

func (*HTTPFirewallInboundConfig) AllAllowListRefs 

func (this *HTTPFirewallInboundConfig) AllAllowListRefs() []*ipconfigs.IPListRef

AllAllowListRefs 获取所有允许的IP名单

func (*HTTPFirewallInboundConfig) AllDenyListRefs 

func (this *HTTPFirewallInboundConfig) AllDenyListRefs() []*ipconfigs.IPListRef

AllDenyListRefs 获取所有禁止的IP名单

func (*HTTPFirewallInboundConfig) FindGroupWithCode 

func (this *HTTPFirewallInboundConfig) FindGroupWithCode(code string) *HTTPFirewallRuleGroup

FindGroupWithCode 根据Code查找Group

func (*HTTPFirewallInboundConfig) Init 

func (this *HTTPFirewallInboundConfig) Init() error

Init 初始化

func (*HTTPFirewallInboundConfig) RemovePublicList 

func (this *HTTPFirewallInboundConfig) RemovePublicList(listId int64, listType string)

RemovePublicList 解绑公用的IP名单

func (*HTTPFirewallInboundConfig) RemoveRuleGroup 

func (this *HTTPFirewallInboundConfig) RemoveRuleGroup(groupId int64)

RemoveRuleGroup 删除某个分组

type HTTPFirewallJavascriptCookieAction added in v0.5.2 

type HTTPFirewallJavascriptCookieAction struct {
	IsPrior bool `yaml:"isPrior" json:"isPrior"`

	Life              int32  `yaml:"life" json:"life"`                         // 有效期
	MaxFails          int    `yaml:"maxFails" json:"maxFails"`                 // 最大失败次数
	FailBlockTimeout  int    `yaml:"failBlockTimeout" json:"failBlockTimeout"` // 失败拦截时间
	Scope             string `yaml:"scope" json:"scope"`
	FailBlockScopeAll bool   `yaml:"failBlockScopeAll" json:"failBlockScopeAll"`
}

func NewHTTPFirewallJavascriptCookieAction added in v1.3.5 

func NewHTTPFirewallJavascriptCookieAction() *HTTPFirewallJavascriptCookieAction

type HTTPFirewallLogAction 

type HTTPFirewallLogAction struct {
}

type HTTPFirewallNotifyAction 

type HTTPFirewallNotifyAction struct {
}

type HTTPFirewallOutboundConfig 

type HTTPFirewallOutboundConfig struct {
	IsOn      bool                        `yaml:"isOn" json:"isOn"`
	GroupRefs []*HTTPFirewallRuleGroupRef `yaml:"groupRefs" json:"groupRefs"`
	Groups    []*HTTPFirewallRuleGroup    `yaml:"groups" json:"groups"`
}

func (*HTTPFirewallOutboundConfig) FindGroupWithCode 

func (this *HTTPFirewallOutboundConfig) FindGroupWithCode(code string) *HTTPFirewallRuleGroup

根据Code查找Group

func (*HTTPFirewallOutboundConfig) Init 

func (this *HTTPFirewallOutboundConfig) Init() error

初始化

func (*HTTPFirewallOutboundConfig) RemoveRuleGroup 

func (this *HTTPFirewallOutboundConfig) RemoveRuleGroup(groupId int64)

删除某个分组

type HTTPFirewallPageAction added in v1.3.3 

type HTTPFirewallPageAction struct {
	IsPrior bool `yaml:"isPrior" json:"isPrior"`

	Status int    `yaml:"status" json:"status"`
	Body   string `yaml:"body" json:"body"`
}

HTTPFirewallPageAction default page action

func NewHTTPFirewallPageAction added in v1.3.5 

func NewHTTPFirewallPageAction() *HTTPFirewallPageAction

type HTTPFirewallPolicy 

type HTTPFirewallPolicy struct {
	Id              int64                               `yaml:"id" json:"id"`
	IsOn            bool                                `yaml:"isOn" json:"isOn"`
	ServerId        int64                               `yaml:"serverId" json:"serverId"` // 所属网站ID
	Name            string                              `yaml:"name" json:"name"`
	Description     string                              `yaml:"description" json:"description"`
	Inbound         *HTTPFirewallInboundConfig          `yaml:"inbound" json:"inbound"`
	Outbound        *HTTPFirewallOutboundConfig         `yaml:"outbound" json:"outbound"`
	BlockOptions    *HTTPFirewallBlockAction            `yaml:"blockOptions" json:"blockOptions"`
	CaptchaOptions  *HTTPFirewallCaptchaAction          `yaml:"captchaOptions" json:"captchaOptions"`
	PageOptions     *HTTPFirewallPageAction             `yaml:"pageOptions" json:"pageOptions"`
	Get302Options   *HTTPFirewallGet302Action           `yaml:"get302Options" json:"get302Options"`
	Post307Options  *HTTPFirewallPost307Action          `yaml:"post307Options" json:"post307Options"`
	JSCookieOptions *HTTPFirewallJavascriptCookieAction `yaml:"jsCookieOptions" json:"jsCookieOptions"`

	Mode               FirewallMode                 `yaml:"mode" json:"mode"`
	UseLocalFirewall   bool                         `yaml:"useLocalFirewall" json:"useLocalFirewall"`
	SYNFlood           *SYNFloodConfig              `yaml:"synFlood" json:"synFlood"`
	Log                *HTTPFirewallPolicyLogConfig `yaml:"log" json:"log"`                               // 强制记录日志
	MaxRequestBodySize int64                        `yaml:"maxRequestBodySize" json:"maxRequestBodySize"` // 读取的请求最大尺寸
	DenyCountryHTML    string                       `yaml:"denyCountryHTML" json:"denyCountryHTML"`       // 默认地区禁用提示
	DenyProvinceHTML   string                       `yaml:"denyProvinceHTML" json:"denyProvinceHTML"`     // 默认省份禁用提示
}

HTTPFirewallPolicy 防火墙策略

func HTTPFirewallTemplate 

func HTTPFirewallTemplate() *HTTPFirewallPolicy

func (*HTTPFirewallPolicy) AllRuleGroups 

func (this *HTTPFirewallPolicy) AllRuleGroups() []*HTTPFirewallRuleGroup

AllRuleGroups 获取所有分组

func (*HTTPFirewallPolicy) FindRuleGroup 

func (this *HTTPFirewallPolicy) FindRuleGroup(groupId int64) *HTTPFirewallRuleGroup

FindRuleGroup 根据ID查找分组

func (*HTTPFirewallPolicy) FindRuleGroupWithCode 

func (this *HTTPFirewallPolicy) FindRuleGroupWithCode(code string) *HTTPFirewallRuleGroup

FindRuleGroupWithCode 根据代号查找分组

func (*HTTPFirewallPolicy) FindRuleGroupWithName 

func (this *HTTPFirewallPolicy) FindRuleGroupWithName(name string) *HTTPFirewallRuleGroup

FindRuleGroupWithName 根据名称查找分组

func (*HTTPFirewallPolicy) InboundJSON 

func (this *HTTPFirewallPolicy) InboundJSON() ([]byte, error)

InboundJSON Inbound JSON

func (*HTTPFirewallPolicy) Init 

func (this *HTTPFirewallPolicy) Init() error

Init 初始化

func (*HTTPFirewallPolicy) OutboundJSON 

func (this *HTTPFirewallPolicy) OutboundJSON() ([]byte, error)

OutboundJSON Outbound JSON

func (*HTTPFirewallPolicy) RemoveRuleGroup 

func (this *HTTPFirewallPolicy) RemoveRuleGroup(groupId int64)

RemoveRuleGroup 删除某个分组

type HTTPFirewallPolicyLogConfig 

type HTTPFirewallPolicyLogConfig struct {
	IsPrior       bool `yaml:"isPrior" json:"isPrior"`
	IsOn          bool `yaml:"isOn" json:"isOn"`
	RequestBody   bool `yaml:"requestBody" json:"requestBody"`     // 是否记录RequestBody
	RegionDenying bool `yaml:"regionDenying" json:"regionDenying"` // 是否记录区域封禁日志
}

func (*HTTPFirewallPolicyLogConfig) Init 

func (this *HTTPFirewallPolicyLogConfig) Init() error

type HTTPFirewallPost307Action 

type HTTPFirewallPost307Action struct {
	IsPrior bool `yaml:"isPrior" json:"isPrior"`

	Life  int32         `yaml:"life" json:"life"`
	Scope FirewallScope `yaml:"scope" json:"scope"`
}

type HTTPFirewallRecordIPAction 

type HTTPFirewallRecordIPAction struct {
	Type     string        `yaml:"type" json:"type"`
	IPListId int64         `yaml:"ipListId" json:"ipListId"`
	Level    string        `yaml:"level" json:"level"`
	Timeout  int32         `yaml:"timeout" json:"timeout"`
	Scope    FirewallScope `yaml:"scope" json:"scope"`
}

type HTTPFirewallRef 

type HTTPFirewallRef struct {
	IsPrior           bool  `yaml:"isPrior" json:"isPrior"`
	IsOn              bool  `yaml:"isOn" json:"isOn"`
	FirewallPolicyId  int64 `yaml:"firewallPolicyId" json:"firewallPolicyId"`
	IgnoreGlobalRules bool  `yaml:"ignoreGlobalRules" json:"ignoreGlobalRules"` // 忽略系统定义的全局规则

	DefaultCaptchaType ServerCaptchaType `yaml:"defaultCaptchaType" json:"defaultCaptchaType"` // 默认人机识别方式
}

func (*HTTPFirewallRef) Init 

func (this *HTTPFirewallRef) Init() error

type HTTPFirewallRegionConfig 

type HTTPFirewallRegionConfig struct {
	IsOn bool `yaml:"isOn" json:"isOn"`

	AllowCountryIds   []int64 `yaml:"allowCountryIds" json:"allowCountryIds"`     // 允许的国家/地区
	DenyCountryIds    []int64 `yaml:"denyCountryIds" json:"denyCountryIds"`       // 封禁的国家/地区
	AllowProvinceIds  []int64 `yaml:"allowProvinceIds" json:"allowProvinceIds"`   // 允许的省或自治区
	DenyProvinceIds   []int64 `yaml:"denyProvinceIds" json:"denyProvinceIds"`     // 封禁的省或自治区
	AllowSearchEngine bool    `yaml:"allowSearchEngine" json:"allowSearchEngine"` // 允许搜索引擎

	CountryOnlyURLPatterns   []*shared.URLPattern `yaml:"countryOnlyURLPatterns" json:"countryOnlyURLPatterns"`     // 仅限的URL
	CountryExceptURLPatterns []*shared.URLPattern `yaml:"countryExceptURLPatterns" json:"countryExceptURLPatterns"` // 排除的URL
	CountryHTML              string               `yaml:"countryHTML" json:"countryHTML"`                           // 提示HTML

	ProvinceOnlyURLPatterns   []*shared.URLPattern `yaml:"provinceOnlyURLPatterns" json:"provinceOnlyURLPatterns"`     // 仅限的URL
	ProvinceExceptURLPatterns []*shared.URLPattern `yaml:"provinceExceptURLPatterns" json:"provinceExceptURLPatterns"` // 排除的URL
	ProvinceHTML              string               `yaml:"provinceHTML" json:"provinceHTML"`                           // 提示HTML
	// contains filtered or unexported fields
}

func (*HTTPFirewallRegionConfig) Init 

func (this *HTTPFirewallRegionConfig) Init() error

func (*HTTPFirewallRegionConfig) IsAllowedCountry added in v1.2.1 

func (this *HTTPFirewallRegionConfig) IsAllowedCountry(countryId int64, provinceId int64) bool

func (*HTTPFirewallRegionConfig) IsAllowedProvince added in v1.2.1 

func (this *HTTPFirewallRegionConfig) IsAllowedProvince(countryId int64, provinceId int64) bool

func (*HTTPFirewallRegionConfig) IsNotEmpty 

func (this *HTTPFirewallRegionConfig) IsNotEmpty() bool

func (*HTTPFirewallRegionConfig) MatchCountryURL added in v1.1.0 

func (this *HTTPFirewallRegionConfig) MatchCountryURL(url string) bool

func (*HTTPFirewallRegionConfig) MatchProvinceURL added in v1.1.0 

func (this *HTTPFirewallRegionConfig) MatchProvinceURL(url string) bool

type HTTPFirewallRule 

type HTTPFirewallRule struct {
	Id                int64                  `yaml:"id" json:"id"`
	IsOn              bool                   `yaml:"isOn" json:"isOn"`
	Param             string                 `yaml:"param" json:"param"`
	ParamFilters      []*ParamFilter         `yaml:"paramFilters" json:"paramFilters"`
	Operator          string                 `yaml:"operator" json:"operator"`
	Value             string                 `yaml:"value" json:"value"`
	IsCaseInsensitive bool                   `yaml:"isCaseInsensitive" json:"isCaseInsensitive"`
	IsComposed        bool                   `yaml:"isComposed" json:"isComposed"`
	CheckpointOptions map[string]interface{} `yaml:"checkpointOptions" json:"checkpointOptions"`
	Description       string                 `yaml:"description" json:"description"`
}

func (*HTTPFirewallRule) Init 

func (this *HTTPFirewallRule) Init() error

func (*HTTPFirewallRule) Prefix 

func (this *HTTPFirewallRule) Prefix() string

func (*HTTPFirewallRule) Summary 

func (this *HTTPFirewallRule) Summary() string

type HTTPFirewallRuleCaseInsensitive 

type HTTPFirewallRuleCaseInsensitive = string

type HTTPFirewallRuleConnector 

type HTTPFirewallRuleConnector = string

type HTTPFirewallRuleGroup 

type HTTPFirewallRuleGroup struct {
	Id          int64                     `yaml:"id" json:"id"`
	IsOn        bool                      `yaml:"isOn" json:"isOn"`
	Name        string                    `yaml:"name" json:"name"`
	Description string                    `yaml:"description" json:"description"`
	Code        string                    `yaml:"code" json:"code"`
	SetRefs     []*HTTPFirewallRuleSetRef `yaml:"setRefs" json:"setRefs"`
	Sets        []*HTTPFirewallRuleSet    `yaml:"sets" json:"sets"`
	IsTemplate  bool                      `yaml:"isTemplate" json:"isTemplate"`
}

HTTPFirewallRuleGroup 规则组

func (*HTTPFirewallRuleGroup) AddRuleSet 

func (this *HTTPFirewallRuleGroup) AddRuleSet(ruleSet *HTTPFirewallRuleSet)

AddRuleSet 添加规则集

func (*HTTPFirewallRuleGroup) FindRuleSet 

func (this *HTTPFirewallRuleGroup) FindRuleSet(ruleSetId int64) *HTTPFirewallRuleSet

FindRuleSet 根据ID查找规则集

func (*HTTPFirewallRuleGroup) FindRuleSetWithCode 

func (this *HTTPFirewallRuleGroup) FindRuleSetWithCode(code string) *HTTPFirewallRuleSet

FindRuleSetWithCode 根据Code查找规则集

func (*HTTPFirewallRuleGroup) Init 

func (this *HTTPFirewallRuleGroup) Init() error

Init 初始化

type HTTPFirewallRuleGroupRef 

type HTTPFirewallRuleGroupRef struct {
	IsOn    bool  `yaml:"isOn" json:"isOn"`
	GroupId int64 `yaml:"groupId" json:"groupId"`
}

type HTTPFirewallRuleOperator 

type HTTPFirewallRuleOperator = string
const (
	HTTPFirewallRuleOperatorGt                           HTTPFirewallRuleOperator = "gt"
	HTTPFirewallRuleOperatorGte                          HTTPFirewallRuleOperator = "gte"
	HTTPFirewallRuleOperatorLt                           HTTPFirewallRuleOperator = "lt"
	HTTPFirewallRuleOperatorLte                          HTTPFirewallRuleOperator = "lte"
	HTTPFirewallRuleOperatorEq                           HTTPFirewallRuleOperator = "eq"
	HTTPFirewallRuleOperatorNeq                          HTTPFirewallRuleOperator = "neq"
	HTTPFirewallRuleOperatorEqString                     HTTPFirewallRuleOperator = "eq string"
	HTTPFirewallRuleOperatorNeqString                    HTTPFirewallRuleOperator = "neq string"
	HTTPFirewallRuleOperatorMatch                        HTTPFirewallRuleOperator = "match"
	HTTPFirewallRuleOperatorNotMatch                     HTTPFirewallRuleOperator = "not match"
	HTTPFirewallRuleOperatorWildcardMatch                HTTPFirewallRuleOperator = "wildcard match"
	HTTPFirewallRuleOperatorWildcardNotMatch             HTTPFirewallRuleOperator = "wildcard not match"
	HTTPFirewallRuleOperatorContains                     HTTPFirewallRuleOperator = "contains"
	HTTPFirewallRuleOperatorNotContains                  HTTPFirewallRuleOperator = "not contains"
	HTTPFirewallRuleOperatorContainsAnyWord              HTTPFirewallRuleOperator = "contains any word"
	HTTPFirewallRuleOperatorContainsAllWords             HTTPFirewallRuleOperator = "contains all words"
	HTTPFirewallRuleOperatorNotContainsAnyWord           HTTPFirewallRuleOperator = "not contains any word"
	HTTPFirewallRuleOperatorPrefix                       HTTPFirewallRuleOperator = "prefix"
	HTTPFirewallRuleOperatorSuffix                       HTTPFirewallRuleOperator = "suffix"
	HTTPFirewallRuleOperatorContainsAny                  HTTPFirewallRuleOperator = "contains any"
	HTTPFirewallRuleOperatorContainsAll                  HTTPFirewallRuleOperator = "contains all"
	HTTPFirewallRuleOperatorContainsSQLInjection         HTTPFirewallRuleOperator = "contains sql injection"
	HTTPFirewallRuleOperatorContainsSQLInjectionStrictly HTTPFirewallRuleOperator = "contains sql injection strictly"
	HTTPFirewallRuleOperatorContainsXSS                  HTTPFirewallRuleOperator = "contains xss"
	HTTPFirewallRuleOperatorContainsXSSStrictly          HTTPFirewallRuleOperator = "contains xss strictly"
	HTTPFirewallRuleOperatorHasKey                       HTTPFirewallRuleOperator = "has key" // has key in slice or map
	HTTPFirewallRuleOperatorVersionGt                    HTTPFirewallRuleOperator = "version gt"
	HTTPFirewallRuleOperatorVersionLt                    HTTPFirewallRuleOperator = "version lt"
	HTTPFirewallRuleOperatorVersionRange                 HTTPFirewallRuleOperator = "version range"

	HTTPFirewallRuleOperatorContainsBinary    HTTPFirewallRuleOperator = "contains binary"     // contains binary
	HTTPFirewallRuleOperatorNotContainsBinary HTTPFirewallRuleOperator = "not contains binary" // not contains binary

	HTTPFirewallRuleOperatorEqIP       HTTPFirewallRuleOperator = "eq ip"
	HTTPFirewallRuleOperatorInIPList   HTTPFirewallRuleOperator = "in ip list"
	HTTPFirewallRuleOperatorGtIP       HTTPFirewallRuleOperator = "gt ip"
	HTTPFirewallRuleOperatorGteIP      HTTPFirewallRuleOperator = "gte ip"
	HTTPFirewallRuleOperatorLtIP       HTTPFirewallRuleOperator = "lt ip"
	HTTPFirewallRuleOperatorLteIP      HTTPFirewallRuleOperator = "lte ip"
	HTTPFirewallRuleOperatorIPRange    HTTPFirewallRuleOperator = "ip range"
	HTTPFirewallRuleOperatorNotIPRange HTTPFirewallRuleOperator = "not ip range"
	HTTPFirewallRuleOperatorIPMod10    HTTPFirewallRuleOperator = "ip mod 10"
	HTTPFirewallRuleOperatorIPMod100   HTTPFirewallRuleOperator = "ip mod 100"
	HTTPFirewallRuleOperatorIPMod      HTTPFirewallRuleOperator = "ip mod"

	HTTPFirewallRuleCaseInsensitiveNone = "none"
	HTTPFirewallRuleCaseInsensitiveYes  = "yes"
	HTTPFirewallRuleCaseInsensitiveNo   = "no"
)

type HTTPFirewallRuleRef 

type HTTPFirewallRuleRef struct {
	IsOn   bool  `yaml:"isOn" json:"isOn"`
	RuleId int64 `yaml:"ruleId" json:"ruleId"`
}

type HTTPFirewallRuleSet 

type HTTPFirewallRuleSet struct {
	Id                 int64                  `yaml:"id" json:"id"`
	IsOn               bool                   `yaml:"isOn" json:"isOn"`
	Name               string                 `yaml:"name" json:"name"`
	Code               string                 `yaml:"code" json:"code"`
	Description        string                 `yaml:"description" json:"description"`
	Connector          string                 `yaml:"connector" json:"connector"`
	RuleRefs           []*HTTPFirewallRuleRef `yaml:"ruleRefs" json:"ruleRefs"`
	Rules              []*HTTPFirewallRule    `yaml:"rules" json:"rules"`
	IgnoreLocal        bool                   `yaml:"ignoreLocal" json:"ignoreLocal"`
	IgnoreSearchEngine bool                   `yaml:"ignoreSearchEngine" json:"ignoreSearchEngine"`

	Actions []*HTTPFirewallActionConfig `yaml:"actions" json:"actions"`
}

HTTPFirewallRuleSet 规则集定义

func (*HTTPFirewallRuleSet) AddRule 

func (this *HTTPFirewallRuleSet) AddRule(rule *HTTPFirewallRule)

AddRule 添加规则

func (*HTTPFirewallRuleSet) Init 

func (this *HTTPFirewallRuleSet) Init() error

Init 初始化

type HTTPFirewallRuleSetRef 

type HTTPFirewallRuleSetRef struct {
	IsOn  bool  `yaml:"isOn" json:"isOn"`
	SetId int64 `yaml:"setId" json:"setId"`
}

type HTTPFirewallTagAction 

type HTTPFirewallTagAction struct {
	Tags []string `yaml:"tags" json:"tags"`
}

type KeyValue 

type KeyValue struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

func NewKeyValue 

func NewKeyValue(name string, value string) *KeyValue

type OptionInterface 

type OptionInterface interface {
}

type OptionsOption 

type OptionsOption struct {
	Type       string                                       `json:"type"`
	Name       string                                       `json:"name"`
	Code       string                                       `json:"code"`
	Value      string                                       `json:"value"` // default value
	IsRequired bool                                         `json:"isRequired"`
	Size       int                                          `json:"size"`
	Comment    string                                       `json:"comment"`
	RightLabel string                                       `json:"rightLabel"`
	Validate   func(value string) (ok bool, message string) `json:"-"`
	Options    []maps.Map                                   `json:"options"`
}

func NewOptionsOption 

func NewOptionsOption(name string, code string) *OptionsOption

func (*OptionsOption) SetOptions 

func (this *OptionsOption) SetOptions(options []maps.Map)

type ParamFilter 

type ParamFilter struct {
	Code    string   `yaml:"code" json:"code"`       // 过滤器编号
	Name    string   `yaml:"name" json:"name"`       // 名称
	Options maps.Map `yaml:"options" json:"options"` // 过滤器选项
}

对参数的过滤器

type RuleOperatorDefinition 

type RuleOperatorDefinition struct {
	Name            string                          `json:"name"`
	Code            string                          `json:"code"`
	Description     string                          `json:"description"`
	CaseInsensitive HTTPFirewallRuleCaseInsensitive `json:"caseInsensitive"` // default caseInsensitive setting
	DataType        string                          `json:"dataType"`
}

type SYNFloodConfig 

type SYNFloodConfig struct {
	IsPrior        bool  `yaml:"isPrior" json:"isPrior"`
	IsOn           bool  `yaml:"isOn" json:"isOn"`
	MinAttempts    int32 `yaml:"minAttempts" json:"minAttempts"`       // 最小尝试次数/分钟
	TimeoutSeconds int32 `yaml:"timeoutSeconds" json:"timeoutSeconds"` // 拦截超时时间
	IgnoreLocal    bool  `yaml:"ignoreLocal" json:"ignoreLocal"`       // 忽略本地IP
}

SYNFloodConfig Syn flood防护设置

func NewSYNFloodConfig added in v1.3.5 

func NewSYNFloodConfig() *SYNFloodConfig

func (*SYNFloodConfig) Init 

func (this *SYNFloodConfig) Init() error

type ServerCaptchaType added in v1.3.0 

type ServerCaptchaType = string
const (
	ServerCaptchaTypeNone     ServerCaptchaType = "none" // 不设置表示策略整体配置
	ServerCaptchaTypeDefault  ServerCaptchaType = CaptchaTypeDefault
	ServerCaptchaTypeOneClick ServerCaptchaType = CaptchaTypeOneClick
	ServerCaptchaTypeSlide    ServerCaptchaType = CaptchaTypeSlide
	ServerCaptchaTypeGeeTest  ServerCaptchaType = CaptchaTypeGeeTest
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.