lua-nginx针对post上传内容解析

基于lua-nginx针对post上传请求，解析上传请求内容，这里做了畸形报文检测。

在针对http上传请求流量时，可以采取这种方法进行解析和过滤识别上传内容。

根据解析后的内容，可以手动写规则进行拦截过滤等。

进一步的还可以获取上传的文件内容，文件名，文件大小等信息。

针对文件进行实时的或者离线的文件内容分析，判断是否是恶意的文件上传webshell等。

这里只贴出解析部分代码，后续扩展可自行实现。

function _M.parse_request_body(waf, request_headers, collections)
    local content_type_header = request_headers["content-type"]
    -- multiple content-type headers are likely an evasion tactic
    -- or result from misconfigured proxies. may consider relaxing
    -- this or adding an option to disable this checking in the future
    if type(content_type_header) == "table" then
        Util.crsDebug(waf.transaction_id .. "Request contained multiple content-type headers, bailing!")
        ngx.exit(400)
    end

    -- ignore the request body if no Content-Type header is sent
    -- this does technically violate the RFC
    -- but its necessary for us to properly handle the request
    -- and its likely a sign of nogoodnickery anyway
--[[
    if not content_type_header then
        --if waf._debug == true then ngx.log(waf._debug_log_level, '[', waf.transaction_id, '] ', "Request has no content type, ignoring the body") end
        --if waf._debug == true then Util.crsDebug(waf.transaction_id .. "Request has no content type, ignoring the body") end
        return nil
    end
--]]
--按照上面的说法，可能会产生构造空content-type绕过waf的情况

    if not content_type_header then
        ngx.req.read_body()

        if ngx.req.get_body_file() == nil then
            return ngx.req.get_post_args()
        else
            return nil
        end
    end

    -- handle the request body based on the Content-Type header
    -- multipart/form-data requests will be streamed in via lua-resty-upload,
    -- which provides some basic sanity checking as far as form and protocol goes
    -- (but its much less strict that ModSecurity's strict checking)
    if ngx.re.find(content_type_header, [=[^multipart/form-data; boundary=]=], waf._pcre_flags) then
        if not waf._process_multipart_body then
            return
        end
        if ngx.ctx.files == nil and ngx.ctx.form_file_name == nil and ngx.ctx.file_sizes == nil and ngx.ctx.files_tmp_content == nil and ngx.ctx.files_combined_size == nil then

            local form, err = upload:new()
            if not form then
                logger.warn(waf, "failed to parse multipart request: ", err)
                ngx.exit(400) -- may move this into a ruleset along with other strict checking
            end

            local FILES = {}
            local FILES_NAMES = {}
            local FILES_SIZES = {}
            local FILES_TMP_CONTENT = {}

            ngx.req.init_body()
            form:set_timeout(1000)

            ngx.req.append_body("--" .. form.boundary)

            -- this is gonna need some tlc, but it seems to work for now
            local lasttype, chunk, file, body, body_size, files_size
            files_size = 0
            body_size  = 0
            body = ''
            while true do
                local typ, res, err = form:read()
                if not typ then
                    logger.fatal_fail("failed to stream request body: " .. err)
                end

                if typ == "header" then
                    if res[1]:lower() == 'content-disposition' then
                        local header = res[2]

                        local s, f = header:find(' name="([^"]+")')
                        file = header:sub(s + 7, f - 1)
                        table.insert(FILES_NAMES, file)

                        s, f = header:find('filename="([^"]+")')
                        if s then table.insert(FILES, header:sub(s + 10, f - 1)) end
                    end

                    chunk = res[3] -- form:read() returns { key, value, line } here
                    ngx.req.append_body("rn" .. chunk)
                elseif typ == "body" then
                    chunk = res
                    if lasttype == "header" then
                        ngx.req.append_body("rnrn")
                    end

                    local chunk_size = #chunk

                    body = body .. chunk
                    body_size = body_size + #chunk

                    if waf._debug == true then Util.crsDebug(waf.transaction_id .. "chunk_size: " .. chunk_size .. ", body_size: " .. body_size) end
                    ngx.req.append_body(chunk)
                elseif typ == "part_end" then
                    table.insert(FILES_SIZES, body_size)
                    files_size = files_size + body_size
                    body_size = 0

                    FILES_TMP_CONTENT[file] = body
                    body = ''

                    ngx.req.append_body("rn--" .. form.boundary)
                elseif typ == "eof" then
                    ngx.req.append_body("--rn")
                    break
                end

                lasttype = typ
            end

            -- lua-resty-upload docs use one final read, i think it's needed to get
            -- the last part of the data off the socket
            form:read()
            ngx.req.finish_body()
      
            collections.FILES = FILES
            collections.FILES_NAMES = FILES_NAMES
            collections.FILES_SIZES = FILES_SIZES
            collections.FILES_TMP_CONTENT = FILES_TMP_CONTENT
            collections.FILES_COMBINED_SIZE = files_size
        else
        
            collections.FILES = ngx.ctx.files
            collections.FILES_NAMES = ngx.ctx.form_file_name
            collections.FILES_SIZES = ngx.ctx.file_sizes
            collections.FILES_TMP_CONTENT = ngx.ctx.files_tmp_content
            collections.FILES_COMBINED_SIZE = ngx.ctx.files_combined_size
        end
        return nil
    elseif ngx.re.find(content_type_header, [=[^application/x-www-form-urlencoded]=], waf._pcre_flags) then
        -- use the underlying ngx API to read the request body
        -- ignore processing the request body if the content length is larger than client_body_buffer_size
        -- to avoid wasting resources on ruleset matching of very large data sets
        ngx.req.read_body()
        --如果上传文件大小小于设定的buffer，则临时文件get_body_file不会产生
        if ngx.req.get_body_file() == nil then
            return ngx.req.get_post_args()
        else
            if waf._debug == true then Util.crsDebug(waf.transaction_id .. "Request body size larger than client_body_buffer_size, ignoring request body") end
                return nil
        end

    --[[elseif util.table_has_key(content_type_header, waf._allowed_content_types) then
        -- if the content type has been whitelisted by the user, set REQUEST_BODY as a string
        ngx.req.read_body()

        if ngx.req.get_body_file() == nil then
            return ngx.req.get_body_data()
        else
            if waf._debug == true then ngx.log(waf._debug_log_level, '[', waf.transaction_id, '] ', "Request body size larger than client_body_buffer_size, ignoring request body") end
                return nil
        end]]--
    else
        --[[if waf._allow_unknown_content_types then
            if waf._debug == true then ngx.log(waf._debug_log_level, '[', waf.transaction_id, '] ', "Allowing request with content type " .. tostring(content_type_header)) end
            return nil
        else
            if waf._debug == true then ngx.log(waf._debug_log_level, '[', waf.transaction_id, '] ', tostring(content_type_header) .. " not a valid content type!") end
                ngx.exit(ngx.HTTP_FORBIDDEN)
        end]]--
    end
end

最后

以上就是强健大侠为你收集整理的lua-nginx针对post上传内容解析的全部内容，希望文章能够帮你解决lua-nginx针对post上传内容解析所遇到的程序开发问题。

如果觉得靠谱客网站的内容还不错，欢迎将靠谱客网站推荐给程序员好友。