Skip to content

Add W-COOKIE and TLS Fingerprinting #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: current
Choose a base branch
from
Open

Add W-COOKIE and TLS Fingerprinting #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e96af9
Add W-COOKIE to waf_priority
minin-lex Oct 3, 2023
387e5f9
Add variables (waf_ssl_greased, waf_ssl_ja3, waf_ssl_ja3_hash)
minin-lex Oct 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions inc/ngx_http_waf_module_check.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,14 @@ ngx_int_t ngx_http_waf_handler_check_white_referer(ngx_http_request_t* r);
ngx_int_t ngx_http_waf_handler_check_black_referer(ngx_http_request_t* r);


/**
* @brief 检查 Cookie 是否在黑名单中
* @return 如果在返回 MATCHED，反之返回 NOT_MATCHED。
* @retval MATCHED 在黑名单中。
* @retval NOT_MATCHED 不在黑名单中
*/
ngx_int_t ngx_http_waf_handler_check_white_cookie(ngx_http_request_t* r);

/**
* @brief 检查 Cookie 是否在黑名单中
* @return 如果在返回 MATCHED，反之返回 NOT_MATCHED。
Expand All @@ -125,6 +133,22 @@ ngx_int_t ngx_http_waf_handler_check_black_referer(ngx_http_request_t* r);
*/
ngx_int_t ngx_http_waf_handler_check_black_cookie(ngx_http_request_t* r);

/**
* @brief 检查 TLS Fingerprint 是否在黑名单中
* @return 如果在返回 MATCHED，反之返回 NOT_MATCHED。
* @retval MATCHED 在黑名单中。
* @retval NOT_MATCHED 不在黑名单中
*/
//ngx_int_t ngx_http_waf_handler_check_white_tls_fprint(ngx_http_request_t* r);

/**
* @brief 检查 TLS Fingerprint 是否在黑名单中
* @return 如果在返回 MATCHED，反之返回 NOT_MATCHED。
* @retval MATCHED 在黑名单中。
* @retval NOT_MATCHED 不在黑名单中
*/
//ngx_int_t ngx_http_waf_handler_check_black_tls_fprint(ngx_http_request_t* r);


/**
* @brief 检查请求体内容是否存在于黑名单中，存在则拦截，反之放行。
Expand Down
10 changes: 10 additions & 0 deletions inc/ngx_http_waf_module_macro.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,9 @@
#define NGX_HTTP_WAF_ARGS_FILE ("args")
#define NGX_HTTP_WAF_UA_FILE ("user-agent")
#define NGX_HTTP_WAF_REFERER_FILE ("referer")
//#define NGX_HTTP_WAF_WHITE_TLS_FPRINT_FILE ("white-tls-fingerprint")
//#define NGX_HTTP_WAF_TLS_FPRINT_FILE ("tls-fingerprint")
#define NGX_HTTP_WAF_WHITE_COOKIE_FILE ("white-cookie")
#define NGX_HTTP_WAF_COOKIE_FILE ("cookie")
#define NGX_HTTP_WAF_POST_FILE ("post")
#define NGX_HTTP_WAF_WHITE_IPV4_FILE ("white-ipv4")
Expand Down Expand Up @@ -243,6 +246,12 @@
*/
#define NGX_HTTP_WAF_MODE_INSPECT_REFERER (NGX_HTTP_WAF_MODE_INSPECT_COOKIE << 1)

/**
* @def NGX_HTTP_WAF_MODE_INSPECT_TLS_FINGERPRINT
* @brief 启用 TLS FINGERPRINT 检查规则
*/
#define NGX_HTTP_WAF_MODE_INSPECT_TLS_FINGERPRINT (NGX_HTTP_WAF_MODE_INSPECT_REFERER << 1)


/**
* @def NGX_HTTP_WAF_MODE_CMN_METH
Expand Down Expand Up @@ -305,6 +314,7 @@
| NGX_HTTP_WAF_MODE_INSPECT_ARGS \
| NGX_HTTP_WAF_MODE_INSPECT_UA \
| NGX_HTTP_WAF_MODE_INSPECT_COOKIE \
| NGX_HTTP_WAF_MODE_INSPECT_TLS_FINGERPRINT \
| NGX_HTTP_WAF_MODE_CMN_METH)


Expand Down
16 changes: 16 additions & 0 deletions inc/ngx_http_waf_module_tls_fingerprint.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
#ifndef __NGX_HTTP_WAF_TLS_FINGERPRINT_H__
#define __NGX_HTTP_WAF_TLS_FINGERPRINT_H__

#include <ngx_http_waf_module_macro.h>
#include <ngx_http_waf_module_type.h>
#include <ngx_http_waf_module_util.h>
#include <ngx_http_waf_module_check.h>
#include <ngx_core.h>
#include <ngx_http_v2.h>

#define IS_GREASE_CODE(code) (((code)&0x0f0f) == 0x0a0a && ((code)&0xff) == ((code)>>8))

int ngx_ssl_fingerprint(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *fingerprint);
int ngx_http2_fingerprint(ngx_connection_t *c, ngx_http_v2_connection_t *h2c, ngx_pool_t *pool, ngx_str_t *fingerprint);

#endif // __NGX_HTTP_WAF_TLS_FINGERPRINT_H__
7 changes: 7 additions & 0 deletions inc/ngx_http_waf_module_type.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,6 +257,7 @@ typedef enum {
ACTION_FLAG_FROM_CC_DENY = 0x200,
ACTION_FLAG_FROM_MODSECURITY = 0x400,
ACTION_FLAG_FROM_CAPTCHA = 0x800,
ACTION_FLAG_FROM_TLS_FINGERPRINT= 0x900,
ACTION_FLAG_FROM_UNDER_ATTACK = 0x1000,
ACTION_FLAG_FROM_VERIFY_BOT = 0x2000,
ACTION_FLAG_CAPTCHA = 0x4000,
Expand Down Expand Up @@ -392,6 +393,9 @@ typedef struct ngx_http_waf_loc_conf_s {
ngx_array_t *black_args; /**< args 黑名单 */
ngx_array_t *black_ua; /**< user-agent 黑名单 */
ngx_array_t *black_referer; /**< Referer 黑名单 */
// ngx_array_t *white_tls_fprint; /**< White TLS Fingerprint 黑名单 */
// ngx_array_t *black_tls_fprint; /**< TLS Fingerprint 黑名单 */
ngx_array_t *white_cookie; /**< White Cookie 黑名单 */
ngx_array_t *black_cookie; /**< Cookie 黑名单 */
ngx_array_t *black_post; /**< 请求体内容黑名单 */
ip_trie_t *white_ipv4; /**< IPV4 白名单 */
Expand All @@ -406,6 +410,9 @@ typedef struct ngx_http_waf_loc_conf_s {
lru_cache_t *black_args_inspection_cache; /**< ARGS 黑名单检查缓存 */
lru_cache_t *black_ua_inspection_cache; /**< User-Agent 黑名单检查缓存 */
lru_cache_t *black_referer_inspection_cache; /**< Referer 黑名单检查缓存 */
// lru_cache_t *white_tls_fprint_inspection_cache; /**< White TLS Fingerprint 黑名单检查缓存 */
// lru_cache_t *black_tls_fprint_inspection_cache; /**< TLS Fingerprint 黑名单检查缓存 */
lru_cache_t *white_cookie_inspection_cache; /**< White Cookie 黑名单检查缓存 */
lru_cache_t *black_cookie_inspection_cache; /**< Cookie 黑名单检查缓存 */
lru_cache_t *white_url_inspection_cache; /**< URL 白名单检查缓存 */
lru_cache_t *white_referer_inspection_cache; /**< Referer 白名单检查缓存 */
Expand Down
Binary file added src/.ngx_http_waf_module_var.c.swp
View file
Open in desktop
Binary file not shown.
Loading