MAINHACK

Viewing / Editing File: accesscheck.lua

File is not writable. Editing disabled.
local ipset =   require "ipset_message_pb"
local ipset_socket = "unix:/var/run/imunify360/libiplists-daemon.sock"
local cacher = ngx.shared.ipset_check_cacher

local function write_size(little_endian, format, ...)
    local res = ''
    local values = {...}
    for i=1,#format do
        local size = tonumber(format:sub(i,i))
        local value = values[i]
        local str = ""
        for j=1,size do
            str = str .. string.char(value % 256)
            value = math.floor(value / 256)
        end
        if not little_endian then
            str = string.reverse(str)
        end
        res = res .. str
    end
    return res
end


local function read_size(big_endian, format, ...)
    values = {...}
    local total = 0
    for i=1,#format do
        local size = tonumber(format:sub(i,i))
        local value = values[i]
        if not big_endian then
            value = value:reverse()
        end
        local res = 0
        for j=1,size do
            res = res * 256 + string.byte(value:sub(j,j))
            print(res)
        end
        total = total + res
    end
    return total
end


local function composeMessage(ip)
    local msg = ipset.Request()

    msg.ip = ip

    local serialized = msg:SerializeToString()
    return write_size(false, "2", string.len(serialized)) .. serialized
end

local function decomposeMessage(pb_msg)
    local status_map = {
        [-1] = "ERROR",
        [0]  = "IP_NOT_FOUND",
        [10] = "IP_WHITE",
        [11] = "IP_REMOTE_PROXY",
        [12] = "IP_WHITE_STATIC",
        [20] = "IP_BLACK",
        [21] = "IP_COUNTRY_BLACK",
        [22] = "IP_BLACK_LOCAL",
        [30] = "IP_GRAY",
        [31] = "IP_GRAY_SPLASH"
    }
    local msg = ipset.Response()
    msg:ParseFromString(pb_msg)

    if msg == nil then
        return {["ip"] = nil, ["verdict"] = "ERROR"}
    end

    local status = status_map[msg.result]
    if status == nil then
        return {["ip"] = msg.ip, ["verdict"] = "ERROR"}
    end

    return {["ip"] = msg.ip, ["verdict"] = status}
end

local function query_peer(ip)

    local sock = ngx.socket.tcp()
    sock:settimeout(1000)
    local ok, err = sock:connect(ipset_socket)

    if not ok then
        ngx.log(ngx.ERR, "Could not connect to ipset socket: ", err)
        return
    end

    local sent, err = sock:send(composeMessage(ip))

    if not sent then
        ngx.log(ngx.ERR, "Could not send to ipset socket: ", err)
        return
    end

    local raw_size, err = sock:receive(2)
    if not raw_size then
        ngx.log(ngx.ERR, "Could not read size from ipset socket: ", err)
        return
    end

    local expected_size = read_size(true, "2", raw_size)

    local data, err = sock:receive(expected_size)
    if not data then
        ngx.log(ngx.ERR, "Could not read data from ipset socket: ", err)
        return
    end

    sock:close()

    return decomposeMessage(data)
end

local function check()

    local remote_addr = ngx.var.remote_addr

    if remote_addr == "127.0.0.1" or remote_addr == "::1" then
        ngx.var.webshield_ip_status = "NOT_FOUND"
        return
    end

    local remote_address = ngx.var.wsuserip or remote_addr

    local checked_result = cacher:get(remote_address)
    if checked_result then
        ngx.var.webshield_ip_status = checked_result
        return
    end

    local response = query_peer(remote_address)
    if response == nil then
        ngx.log(ngx.WARN, "Got empty response from IPSET daemon")
        ngx.var.webshield_ip_status = "NOT_FOUND"
        return
    end

    if response.ip ~= remote_address then
        ngx.log(ngx.WARN, "Sent IP does not match to received one.")
        ngx.var.webshield_ip_status = "NOT_FOUND"
        return
    end

    ngx.var.webshield_ip_status = response.verdict
    cacher:set(remote_address, response.verdict, 10)
end

return check()
Cancel / Back
[ MAINHACK ]

Viewing / Editing File: accesscheck.lua

Server Info

System Features

User Info
