Method checkWAFRequest

internal/nodes/http_request_waf.go:197–357

check waf inbound rules

(firewallPolicy *firewallconfigs.HTTPFirewallPolicy, forceLog bool, logRequestBody bool, logDenying bool, ignoreRules bool)

// check waf inbound rules
func (this *HTTPRequest) checkWAFRequest(firewallPolicy *firewallconfigs.HTTPFirewallPolicy, forceLog bool, logRequestBody bool, logDenying bool, ignoreRules bool) (blocked bool, breakChecking bool) {
	// 检查配置是否为空
	if firewallPolicy == nil || !firewallPolicy.IsOn || firewallPolicy.Inbound == nil || !firewallPolicy.Inbound.IsOn || firewallPolicy.Mode == firewallconfigs.FirewallModeBypass {
		return
	}

	var isDefendMode = firewallPolicy.Mode == firewallconfigs.FirewallModeDefend

	// 检查IP白名单
	var remoteAddrs []string
	if len(this.remoteAddr) > 0 {
		remoteAddrs = []string{this.remoteAddr}
	} else {
		remoteAddrs = this.requestRemoteAddrs()
	}

	var inbound = firewallPolicy.Inbound
	if inbound == nil {
		return
	}

	// 检查地区封禁
	if firewallPolicy.Inbound.Region != nil && firewallPolicy.Inbound.Region.IsOn {
		var regionConfig = firewallPolicy.Inbound.Region
		if regionConfig.IsNotEmpty() {
			for _, remoteAddr := range remoteAddrs {
				var result = iplib.LookupIP(remoteAddr)
				if result != nil && result.IsOk() {
					var currentURL = this.URL()
					if regionConfig.MatchCountryURL(currentURL) {
						// 检查国家/地区级别封禁
						if !regionConfig.IsAllowedCountry(result.CountryId(), result.ProvinceId()) {
							this.firewallPolicyId = firewallPolicy.Id

							if isDefendMode {
								var promptHTML string
								if len(regionConfig.CountryHTML) > 0 {
									promptHTML = regionConfig.CountryHTML
								} else if this.ReqServer != nil && this.ReqServer.HTTPFirewallPolicy != nil && len(this.ReqServer.HTTPFirewallPolicy.DenyCountryHTML) > 0 {
									promptHTML = this.ReqServer.HTTPFirewallPolicy.DenyCountryHTML
								}

								if len(promptHTML) > 0 {
									var formattedHTML = this.Format(promptHTML)
									this.writer.Header().Set("Content-Type", "text/html; charset=utf-8")
									this.writer.Header().Set("Content-Length", types.String(len(formattedHTML)))
									this.writer.WriteHeader(http.StatusForbidden)
									_, _ = this.writer.Write([]byte(formattedHTML))
								} else {
									this.writeCode(http.StatusForbidden, "The region has been denied.", "当前区域禁止访问")
								}

								// 延时返回，避免攻击
								time.Sleep(1 * time.Second)
							}

							// 停止日志
							if !logDenying {