Cavemanon/haproxy-protection
8
Fork 0
mirror of https://gitgud.io/fatchan/haproxy-protection.git synced 2025-05-09 02:05:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

ne wjson map format for excluding exits

Browse Source
This commit is contained in:
Thomas Lynch
2023-06-15 20:52:36 +10:00
parent 1df8277ee2
commit eb82a3d391
4 changed files with 26 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
haproxy/haproxy.cfg
View File

@ -84,8 +84,8 @@ frontend http-in
# acl ORs for when ddos_mode_enabled # acl ORs for when ddos_mode_enabled
acl ddos_mode_enabled_override str("true"),map(/etc/haproxy/map/ddos_global.map) -m found acl ddos_mode_enabled_override str("true"),map(/etc/haproxy/map/ddos_global.map) -m found
acl ddos_mode_enabled hdr(host),lower,map(/etc/haproxy/map/ddos.map) -m bool acl ddos_mode_enabled hdr(host),lower,map(/etc/haproxy/map/ddos.map) -m found
acl ddos_mode_enabled base,map(/etc/haproxy/map/ddos.map) -m bool acl ddos_mode_enabled base,map(/etc/haproxy/map/ddos.map) -m found
# serve challenge page scripts directly from haproxy # serve challenge page scripts directly from haproxy
http-request return file /etc/haproxy/js/auto.min.js status 200 content-type "application/javascript; charset=utf-8" hdr "Cache-Control" "public, max-age=86400" if { path /.basedflare/js/auto.min.js } http-request return file /etc/haproxy/js/auto.min.js status 200 content-type "application/javascript; charset=utf-8" hdr "Cache-Control" "public, max-age=86400" if { path /.basedflare/js/auto.min.js }

2
haproxy/map/crawler-whitelist.map
View File

@ -1,2 +0,0 @@
#127.0.0.1/24
#10.0.0.0/24

8
haproxy/map/ddos.map
View File

@ -1,4 +1,4 @@
127.0.0.1 1 127.0.0.1 {"m":1,"t":true}
127.0.0.1/captcha 2 127.0.0.1/captcha {"m":2}
localhost 1 localhost {"m":1}
localhost/captcha 2 localhost/captcha {"m":2}

27
src/lua/scripts/bot-check.lua
View File

@ -53,7 +53,7 @@ local pow_cookie_secret = os.getenv("POW_COOKIE_SECRET")
local hmac_cookie_secret = os.getenv("HMAC_COOKIE_SECRET") local hmac_cookie_secret = os.getenv("HMAC_COOKIE_SECRET")
local ray_id = os.getenv("RAY_ID") local ray_id = os.getenv("RAY_ID")
-- load captcha map and set hcaptcha/recaptch based off env vars -- load captcha map and set hcaptcha/recaptch based off env vars
local captcha_map = Map.new("/etc/haproxy/map/ddos.map", Map._str); local ddos_map = Map.new("/etc/haproxy/map/ddos.map", Map._str);
local captcha_provider_domain = "" local captcha_provider_domain = ""
local captcha_classname = "" local captcha_classname = ""
local captcha_script_src = "" local captcha_script_src = ""
@ -156,11 +156,13 @@ function _M.view(applet)
local captcha_enabled = false local captcha_enabled = false
local path = applet.qs; --because on /.basedflare/bot-check?/whatever, .qs (query string) holds the "path" local path = applet.qs; --because on /.basedflare/bot-check?/whatever, .qs (query string) holds the "path"
local captcha_map_lookup = captcha_map:lookup(host..path) or captcha_map:lookup(host) or 0 local ddos_map_lookup = ddos_map:lookup(host..path) or ddos_map:lookup(host)
captcha_map_lookup = tonumber(captcha_map_lookup) if ddos_map_lookup ~= nil then
if captcha_map_lookup == 2 then ddos_map_json = json.decode(ddos_map_lookup)
if ddos_map_json.m == 2 then
captcha_enabled = true captcha_enabled = true
end end
end
-- return simple json if they send accept: application/json header -- return simple json if they send accept: application/json header
local accept_header = applet.headers['accept'] local accept_header = applet.headers['accept']
@ -412,15 +414,20 @@ end
function _M.decide_checks_necessary(txn) function _M.decide_checks_necessary(txn)
local host = txn.sf:hdr("Host") local host = txn.sf:hdr("Host")
local path = txn.sf:path(); local path = txn.sf:path();
local captcha_map_lookup = captcha_map:lookup(host..path) or captcha_map:lookup(host) or 0 local ddos_map_lookup = ddos_map:lookup(host..path) or ddos_map:lookup(host)
captcha_map_lookup = tonumber(captcha_map_lookup) if ddos_map_lookup ~= nil then
if captcha_map_lookup == 1 then ddos_map_json = json.decode(ddos_map_lookup)
if ddos_map_json.m == 0
or (ddos_map_json.t == true and txn.sf:hdr("X-Country-Code") ~= "T1") then
return
elseif ddos_map_json.m == 1 then
txn:set_var("txn.validate_pow", true)
elseif ddos_map_json.m == 2 then
txn:set_var("txn.validate_pow", true) txn:set_var("txn.validate_pow", true)
elseif captcha_map_lookup == 2 then
txn:set_var("txn.validate_captcha", true) txn:set_var("txn.validate_captcha", true)
txn:set_var("txn.validate_pow", true)
end end
-- otherwise, domain+path was set to 0 (whitelist) or there is no entry in the map end
-- no entry in the map
end end
-- check if captcha cookie is valid, separate secret from POW -- check if captcha cookie is valid, separate secret from POW