chaitin/lua-resty-t1k

# lua-resty-t1k [](https://luarocks.org/modules/blaisewang/lua-resty-t1k) [](https://github.com/chaitin/lua-resty-t1k/releases) [](https://github.com/chaitin/lua-resty-t1k/blob/main/LICENSE) ## 名称 [Chaitin/SafeLine](https://github.com/chaitin/safeline) Web Application Firewall 的 T1K 协议的 Lua 实现。 ## 状态 已准备好用于生产环境。 [](https://github.com/chaitin/lua-resty-t1k/actions) ## 安装 ``` luarocks install lua-resty-t1k ``` 如果您在中国大陆 ``` luarocks install lua-resty-t1k --server https://luarocks.cn ``` ## 概要 ``` location / { access_by_lua_block { local t1k = require "resty.t1k" local t = { mode = "block", -- block or monitor or off, default off host = "unix:/workdir/snserver.sock", -- required, SafeLine WAF detection service host, unix domain socket, IP, or domain is supported, string port = 8000, -- required when the host is an IP or domain, SafeLine WAF detection service port, integer connect_timeout = 1000, -- connect timeout, in milliseconds, integer, default 1s (1000ms) send_timeout = 1000, -- send timeout, in milliseconds, integer, default 1s (1000ms) read_timeout = 1000, -- read timeout, in milliseconds, integer, default 1s (1000ms) req_body_size = 1024, -- request body size, in KB, integer, default 1MB (1024KB) keepalive_size = 256, -- maximum concurrent idle connections to the SafeLine WAF detection service, integer, default 256 keepalive_timeout = 60000, -- idle connection timeout, in milliseconds, integer, default 60s (60000ms) remote_addr = "http_x_forwarded_for: 1", -- remote address from ngx.var.VARIABLE, string, default from ngx.var.remote_addr log_resp = false, -- report the response to the SafeLine WAF detection service, boolean, default false resp_body_size = 4, -- response body size to report, in KB, integer, default 4KB, only used when log_resp is true extra_ignored_content_types = "text/csv", -- extra response content types to skip, comma separated, string, only used when log_resp is true } local ok, err, _ = t1k.do_access(t, true) if not ok then ngx.log(ngx.ERR, err) end } header_filter_by_lua_block { local t1k = require "resty.t1k" t1k.do_header_filter() } -- the following two blocks are only required when log_resp is true body_filter_by_lua_block { local t1k = require "resty.t1k" t1k.do_body_filter() } log_by_lua_block { local t1k = require "resty.t1k" t1k.do_log() } } ``` ### 响应日志记录 当启用 `log_resp` 时，响应状态行、headers 以及最多 `resp_body_size` KB 的响应 body 将在请求完成后 报告给 SafeLine WAF 检测服务。该报告通过 `ngx.timer` 发送，因此 不会增加响应本身的延迟。 当请求已被拦截，或者响应的 `Content-Type` 匹配内置的 忽略类型（音频、视频、字体、图像和其他二进制媒体类型）时，将跳过响应。使用 `extra_ignored_content_types` 可以跳过 额外的内容类型。 ## Lua Resty T1K 与 C T1K [C T1K](https://t1k.chaitin.com/) 作为 SafeLine 企业版的一部分，是一种使用 C 语言编写以增强性能的部署模式。 它兼容所有版本的 Nginx，并且不需要通过 OpenResty (lua_nginx_module) 进行部署。 | | Lua Resty T1K | C T1K | |-----------------------|---------------|-------| | Request Detection | ✅ | ✅ | | Response Detection | ❌ | ✅ | | Health Checks* | ❌ | ✅ | | Cookie Protection | ❌ | ✅ | | Bot Protection | ❌ | ✅ | | Proxy-side Statistics | ❌ | ✅ | * APISIX 为 `chaitin-waf` 插件实现了健康检查功能。有关更多信息，请参阅 [chaitin-waf 文档](https://apisix.apache.org/docs/apisix/next/plugins/chaitin-waf/)。

标签：AppImage, Lua, OpenResty, rizin, URL发现, WAF插件, Web应用防火墙, 安全检测, 网络通信协议