OpenResty通过“黑名单配置、动态规则更新、CIDR匹配算法”等技术实现恶意IP访问控制

http {
    lua_shared_dict ip_blacklist 10m;  # 创建10MB共享内存区域
    
    init_by_lua_block {
        -- 初始化加载黑名单（示例数据）
        local blacklist = {"58.96.132.0/24", "203.113.176.2"}
        ngx.shared.ip_blacklist:set("initial_load", 1)
        for _, ip in ipairs(blacklist) do
            ngx.shared.ip_blacklist:set(ip, true)
        end
    }

    server {
        listen 80;
        
        access_by_lua_block {
            local client_ip = ngx.var.remote_addr
            local blacklist = ngx.shared.ip_blacklist
            
            -- CIDR格式检测函数
            local function match_cidr(ip, cidr)
                -- 此处省略CIDR匹配算法实现（后文补充）
            end

            -- 遍历黑名单检查
            local keys = blacklist:get_keys(0)
            for _, key in ipairs(keys) do
                if key ~= "initial_load" and (key == client_ip or match_cidr(client_ip, key)) then
                    ngx.log(ngx.WARN, "Blocked IP:", client_ip)
                    return ngx.exit(403)
                end
            end
        }
    }
}

-- /usr/local/openresty/lualib/blacklist.lua
local _M = {}

function _M.update_blacklist()
    local http = require "resty.http"
    local c = http.new()
    
    -- 从管理API获取最新黑名单
    local res, err = c:request_uri("https://api.security.com/blacklist", {
        method = "GET",
        headers = {["Authorization"] = "Bearer xxxx"}
    })

    if not res then
        ngx.log(ngx.ERR, "更新黑名单失败: ", err)
        return nil, err
    end

    local data = cjson.decode(res.body)
    local dict = ngx.shared.ip_blacklist
    
    -- 增量更新策略
    dict:delete("initial_load")  -- 移除初始化标记
    for _, entry in ipairs(data) do
        if entry.action == "add" then
            dict:set(entry.ip, true, entry.ttl or 3600)
        elseif entry.action == "del" then
            dict:delete(entry.ip)
        end
    end
    return true
end

return _M

# 定时任务配置
init_worker_by_lua_block {
    local delay = 300  -- 5分钟间隔
    local handler
    handler = function()
        local blacklist = require "blacklist"
        blacklist.update_blacklist()
        local ok, err = ngx.timer.at(delay, handler)
        if not ok then
            ngx.log(ngx.ERR, "创建定时器失败: ", err)
        end
    end
    local ok, err = ngx.timer.at(delay, handler)
}

-- 高性能CIDR匹配实现
local bit = require "bit"
local band = bit.band
local bor = bit.bor
local lshift = bit.lshift

local function ip2long(ip)
    local bytes = {ip:match("(%d+)%.(%d+)%.(%d+)%.(%d+)")}
    if #bytes ~= 4 then return nil end
    return lshift(bytes[1],24) + lshift(bytes[2],16) + 
           lshift(bytes[3],8) + bytes[4]
end

function _M.match_cidr(client_ip, cidr)
    local base, mask = cidr:match("(.+)/(%d+)$")
    if not base then return client_ip == cidr end
    
    mask = tonumber(mask)
    if mask < 0 or mask > 32 then return false end
    
    local client_num = ip2long(client_ip)
    local cidr_num = ip2long(base)
    if not client_num or not cidr_num then return false end
    
    local mask_num = lshift(0xffffffff, 32 - mask)
    return band(client_num, mask_num) == band(cidr_num, mask_num)
end

access_by_lua_block {
    local limit = require "resty.limit.count"
    local dict = ngx.shared.ip_limits
    
    -- 创建限流器：10秒内允许20次请求
    local limiter = limit.new(dict.name, 20, 10)
    
    local client_ip = ngx.var.remote_addr
    local delay, err = limiter:incoming(client_ip, true)
    
    if not delay then
        if err == "rejected" then
            -- 自动加入临时黑名单
            ngx.shared.ip_blacklist:set(client_ip, true, 600)
            return ngx.exit(503)
        end
        ngx.log(ngx.ERR, "限流器错误: ", err)
        return ngx.exit(500)
    end
}

location / {
    deny 192.168.1.0/24; # 原生Nginx指令
    access_by_lua_block {
        -- Lua拦截逻辑
    }
}

-- 错误的内存操作
local dict = ngx.shared.ip_blacklist
for i=1,100000 do
    dict:set("ip_"..i, true) -- 可能引发内存溢出
end

-- 正确的批量操作
local batch = {}
for i=1,1000 do
    batch["ip_"..i] = true
end
dict:mset(batch)  -- 使用批量操作API