File manager

File manager - Edit - /opt/imunify360-webshield/nginx/lua/reqrouter.lua

Back
local cookie = require('resty.cookie') local digest = require('openssl').digest local http = require "resty.http" local json = require "cjson" local pbi = require "ws_message_pb" local i360_socket = "unix:/var/run/defence360agent/protobuf.sock" local function captchacheck_make_captcha_cookie_expire() local cookie_obj, err = cookie:new() if not cookie_obj then ngx.log(ngx.ERR, "Failed to init cookie: ", err) return end local current_timestamp = os.time() local expiration_date = os.date( "!%a, %d-%b-%y %H:%M:%S GMT", current_timestamp - 86400) -- Let it expire local ok, err = cookie_obj:set({ key = "cl-bypass-cache", value = "no", domain = ngx.var.host, samesite = "Lax", httponly = true, path = "/", expires = expiration_date }) if not ok then ngx.log(ngx.ERR, "Could not set cookie: ", err) end end local function captchacheck_send_OK () ngx.status = ngx.HTTP_OK ngx.header.content_type = "application/json; charset=utf-8" ngx.say(json.encode({ success = true })) return ngx.exit(ngx.HTTP_OK) end local function captchacheck_send_ERR () ngx.status = ngx.HTTP_BAD_REQUEST return ngx.exit(ngx.HTTP_BAD_REQUEST) end local function captchacheck_get_value(key_name) ngx.req.read_body() local value local args = ngx.req.get_post_args() if args then for key, val in pairs(args) do if key == key_name then value = val break end end end return value end local function captchacheck_write_format(little_endian, format, ...) local res = '' local values = {...} for i=1,#format do local size = tonumber(format:sub(i,i)) local value = values[i] local str = "" for j=1,size do str = str .. string.char(value % 256) value = math.floor(value / 256) end if not little_endian then str = string.reverse(str) end res = res .. str end return res end local function captchacheck_composeMessage(uid, ip, success) local msg = pbi.SendInfo() msg.ip = ip msg.method = msg.WEBSHIELD msg.timestamp = os.time(os.date("!t")) if uid then -- yes, UID might be absent msg.websh.user_id = uid end if success then msg.websh.captcha = msg.websh.PASSED else msg.websh.captcha = msg.websh.FAILED end local serialized = msg:SerializeToString() return captchacheck_write_format(false, "2", string.len(serialized)) .. serialized end local function captchacheck_notify_peer (uid, ip, success) local sock = ngx.socket.tcp() sock:settimeout(1000) local ok, err = sock:connect(i360_socket) if not ok then ngx.log(ngx.ERR, "Could not connect to i360 socket: ", err) return end local sent, err = sock:send(captchacheck_composeMessage(uid, ip, success)) if not sent then ngx.log(ngx.ERR, "Could not send to i360 socket: ", err) end sock:close() end local function captchacheck_google_query (data, remote_address) local conn = http.new() local google_url = "https://www.google.com/recaptcha/api/siteverify" local default_secret_key = "6LfwghwUAAAAALdx_xobqogq6hpa4pR8usRovQl8" local custom_secret_key = ngx.var.wscaptcha_secret_key local captcha_secret_key = custom_secret_key or default_secret_key local body = string.format( "secret=%s&response=%s&remoteip=%s", captcha_secret_key, data, remote_address) local res, err = conn:request_uri(google_url, { method = "POST", body = body, headers = { ["Content-Type"] = "application/x-www-form-urlencoded", } }) if not res then ngx.log(ngx.ERR, "Could not query google: ", err) return end local decoded = json.decode(res.body) if not decoded.success then ngx.log(ngx.ERR, "Captcha site verification error: [", table.concat(decoded["error-codes"], ", "), "]") end return decoded.success end local function set_untrusted_uid_cookie() local cookie_obj, err = cookie:new() if not cookie_obj then ngx.log(ngx.ERR, "Failed to init cookie: ", err) return end local cookie_name = ngx.var.ws_cookie_name local user_agent = ngx.var.http_user_agent if user_agent == nil then user_agent = '' end local user_data = ngx.var.wsuserip .. user_agent local secret_key = ngx.var.ws_untrusted_secret_key local ttl = tostring(ngx.time() + ngx.var.ws_cookie_ttl) local hashsum = digest.digest('sha1', user_data .. secret_key .. ttl, false) local val = hashsum .. "." .. ttl .. ".0" local current_timestamp = os.time() local offset = 30 24 * 3600 -- 30 days local expiration_date = os.date( "!%a, %d-%b-%y %H:%M:%S GMT", current_timestamp + offset) local ok, err = cookie_obj:set({ key = cookie_name, value = val, domain = ngx.var.host, samesite = "Lax", httponly = true, path = "/", expires = expiration_date }) if not ok then ngx.log(ngx.ERR, "Could not set cookie: ", err) end end local function to_static() local uri, search_pattern = ngx.var.uri, "/a9bc224bd710f56d27affffddc764239b58c3faa0" local start_pos, end_pos = string.find(uri, search_pattern) if start_pos == 1 then return true end return false end local function request_is_text() if ngx.var.http_accept == nil then return false end if string.find(ngx.var.http_accept, "text/html") or ngx.var.http_accept == "/" then return true end return false end local function process_request() if to_static() then return ngx.exec("@to_static") end local ip_status = ngx.var.webshield_ip_status -- Whitelist ezoic traffic if a user wants to local trust_ezoic = ngx.var.trust_ezoic local ua_header = ngx.var.http_user_agent if trust_ezoic == "1" and ua_header ~= nil and ua_header:find('[Xx]%-[Mm]iddleton') then return ngx.exec("@to_backend") end -- Traffic from whitelisted sources is passed as is without checks if ip_status == "WHITE" then return ngx.exec("@to_backend") end -- Traffic from local blacklisted sources is denied if ip_status == "BLACK_LOCAL" then return ngx.exit(403) end if ip_status == "COUNTRY_BLACK" then return ngx.exit(403) end -- Traffic from static whitelisted sources is passed as is without checks if ip_status == "WHITE_STATIC" then return ngx.exec("@to_backend") end -- Traffic from blacklisted sources is denied if ip_status == "BLACK" then return ngx.exit(403) end local dest_domain_whitelisted = ngx.var.domain_whitelisted local wscheck = ngx.var.wscheck local wsuserid = ngx.var.wsuserid local userip = ngx.var.wsuserip -- client IP address local destination_port = ngx.var.destination_port -- initial destination port local splashscreen_antibot = ngx.var.splashscreen_antibot if dest_domain_whitelisted == "1" then -- If a user goes to a whitelisted domain if not wsuserid and splashscreen_antibot == "1" then set_untrusted_uid_cookie() -- client checks enabled but no UID found end -- set untrusted cookie (because we did not check its UA) return ngx.exec("@to_backend") -- let him proceed end if ip_status == "GRAY" then -- User is graylisted local remote_proxy = ngx.var.remote_proxy local cloudflare_captcha = ngx.var.cloudflare_captcha -- pass cloudflare traffic to backend without attempts to show captcha if remote_proxy == "cloudflare" and cloudflare_captcha == "0" then return ngx.exec("@to_backend") end if not wsuserid then ngx.var.wscaptcha = "1" -- indicate that splashscreen_as_captcha shown if request_is_text() then -- if text/html return ngx.exec("@to_splashscreen") -- show splashscreen to him end ngx.status = 415 -- otherwise return ngx.say("") -- custom error code return ngx.exit(415) end return ngx.exec("@to_backend") -- let him proceed end if splashscreen_antibot == "1" and not wsuserid and (destination_port == "2083" or destination_port == "2082") and ngx.var.cpanel_protection == "1" and ip_status ~= "WHITE" then return ngx.exec("@to_splashscreen") -- Show splashscreen end if splashscreen_antibot == "1" and not wsuserid and ip_status == "SPLASH" then return ngx.exec("@to_splashscreen") -- Show splashscreen end return ngx.exec("@to_backend") -- let him proceed end -- currently files reqrouter.lua and captchacheck.lua has been united -- because it's simpler to enable/disable functionality this way -- prefix 'captchacheck_' has been prepended to all routines added from -- captchacheck local function captchacheck () local ip_status = ngx.var.webshield_ip_status -- Traffic from static whitelisted sources is passed as is without checks if ip_status == "WHITE_STATIC" then return ngx.exec("@to_backend") end local value = captchacheck_get_value("captcha_value") -- get POST-passed value if not value then return captchacheck_send_ERR() end local userid = ngx.var.wsuserid local remote_address = ngx.var.wsuserip local response = captchacheck_google_query(value, remote_address) if response == nil then return captchacheck_send_ERR() end captchacheck_notify_peer(userid, remote_address, response) captchacheck_make_captcha_cookie_expire() if response then return captchacheck_send_OK() end return captchacheck_send_ERR() end if ngx.var.access_check_enabled == "0" then if ngx.var.uri == "/captchacheck" then return captchacheck() end if ngx.var.uri == "/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f" then return ngx.exec("@to_wsidchk") end return process_request() else return ngx.exec("@by_default") end

| ver. 1.4 | Github | . | PHP 8.2.31 | Generation time: 0.04 | proxy | phpinfo | Settings