https://github.com/wubonetcn/luawaf

A secure and privately deployable web application firewall(WAF).一个安全、可私有部署的Web应用防火墙(WAF)。
https://github.com/wubonetcn/luawaf

firewalls lua nginx waf

Last synced: 2 months ago
JSON representation

A secure and privately deployable web application firewall(WAF).一个安全、可私有部署的Web应用防火墙(WAF)。

• Host: GitHub
• URL: https://github.com/wubonetcn/luawaf
• Owner: wubonetcn
• Created: 2019-06-12T07:18:08.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2022-06-11T07:48:59.000Z (over 2 years ago)
• Last Synced: 2024-08-03T17:12:06.429Z (6 months ago)
• Topics: firewalls, lua, nginx, waf
• Language: Lua
• Homepage:
• Size: 10.7 KB
• Stars: 64
• Watchers: 3
• Forks: 16
• Open Issues: 7
• Metadata Files:
  • Readme: README.MD

Awesome Lists containing this project

• awesome-network-stuff - **38**星

README

        
# LUAWAF

A web application firewall(WAF) written in lua.

## How to use

1. Install OpenResty

```shell

yum update -y

yum install readline-devel pcre-devel openssl-devel perl gcc automake autoconf libtool make epel-release redis -y

cd Downloads

wget https://openresty.org/download/openresty-1.15.8.1.tar.gz

tar -xzvf openresty-1.15.8.1.tar.gz

cd openresty-1.15.8.1

./configure --with-luajit\

            --with-http_iconv_module

gmake

gmake install

echo export PATH=$PATH:/usr/local/openresty/nginx/sbin >> /etc/profile

source /etc/profile

```

2. Clone this project

```shell

git clone https://github.com/wubonetcn/luawaf.git

cp luawaf /usr/local/openresty/nginx/conf/

```

3. Edit `/usr/local/openresty/nginx/conf/nginx.conf`

```

vim /usr/local/openresty/nginx/conf/nginx.conf

```

/usr/local/openresty/nginx/conf/nginx.conf

```

#user  nobody;

worker_processes  1;

error_log  logs/error.log;

#error_log  logs/error.log  notice;

#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

events {

    worker_connections  1024;

}

http {

    include       mime.types;

    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '

    #                  '$status $body_bytes_sent "$http_referer" '

    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;

    #tcp_nopush     on;

    #keepalive_timeout  0;

    keepalive_timeout  65;

    #gzip  on;

    server {

        listen       80;

        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {

            root   html;

            index  index.html index.htm;

        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html

        #

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {

            root   html;

        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80

        #

        #location ~ \.php$ {

        #    proxy_pass   http://127.0.0.1;

        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

        #

        #location ~ \.php$ {

        #    root           html;

        #    fastcgi_pass   127.0.0.1:9000;

        #    fastcgi_index  index.php;

        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;

        #    include        fastcgi_params;

        #}

        # deny access to .htaccess files, if Apache's document root

        # concurs with nginx's one

        #

        #location ~ /\.ht {

        #    deny  all;

        #}

    }

    # another virtual host using mix of IP-, name-, and port-based configuration

    #

    #server {

    #    listen       8000;

    #    listen       somename:8080;

    #    server_name  somename  alias  another.alias;

    #    location / {

    #        root   html;

    #        index  index.html index.htm;

    #    }

    #}

    # HTTPS server

    #

    #server {

    #    listen       443 ssl;

    #    server_name  localhost;

    #    ssl_certificate      cert.pem;

    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;

    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;

    #    ssl_prefer_server_ciphers  on;

    #    location / {

    #        root   html;

    #        index  index.html index.htm;

    #    }

    #}

    

    

    lua_package_path "/usr/local/openresty/nginx/conf/luawaf/?.lua;/usr/local/openresty/lualib/?.lua;;";

    lua_shared_dict limit 10m;

    init_by_lua_file  /usr/local/openresty/nginx/conf/luawaf/init.lua; 

    access_by_lua_file /usr/local/openresty/nginx/conf/luawaf/main.lua;

}

```

4. Run Nginx

```

nginx

```

Enjoy it!

## Fix bug

Please read this post.

[《openresty的unescape_uri函数处理百分号后面字符的小特性》](https://www.cnxct.com/openresty-unescape_uri-feature-to-decode-char-after-percent-sign/)