2025-12-25 02:38:15 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文阐述基于OpenResty与Lua设计简单WAF的架构，涵盖项目目录结构及Nginx核心配置详解。重点分析worker进程、MIME类型、Lua脚本挂载点及共享内存字典配置，深入解析access、body_filter等阶段实现请求检查与响应过滤。同时说明反向代理设置及常用Nginx指令含义，为后续Lua规则引擎开发与测试奠定基础，指导开发者构建基础Web应用防护系统。 综合评分： 84 文章分类： 安全开发,安全工具,WEB安全

cover_image

安全开发设计一个简单的waf（一）

原创

pr0phet

千兆安全

2025年12月24日 19:22 山西

在看文章前，建议先得有点预备知识，以下三点必须学会初步运用

lua
openresty
nginx

项目结构

simplewaf/├── conf/│ &nbsp; ├── nginx.conf &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# OpenResty主配置│ &nbsp; ├── waf-config.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# WAF主配置│ &nbsp; ├── mime.types &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# MIME类型配置│ &nbsp; └── rules/│ &nbsp; &nbsp; &nbsp; ├── sql-injection.json &nbsp; &nbsp; &nbsp;&nbsp;# SQL注入规则│ &nbsp; &nbsp; &nbsp; ├── xss.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# XSS规则│ &nbsp; &nbsp; &nbsp; ├── path-traversal.json &nbsp; &nbsp; &nbsp;# 路径遍历规则│ &nbsp; &nbsp; &nbsp; ├── command-injection.json &nbsp;&nbsp;# 命令注入规则│ &nbsp; &nbsp; &nbsp; └── bad-bots.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 恶意爬虫规则├── lua/│ &nbsp; ├── simplewaf.lua &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 主入口模块│ &nbsp; ├── simplewaf-admin.lua &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 管理接口模块（新增）│ &nbsp; ├── rule-engine.lua &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 规则引擎│ &nbsp; ├──&nbsp;request-processor.lua &nbsp; &nbsp; &nbsp;&nbsp;# 请求处理器│ &nbsp; ├── response-processor.lua &nbsp; &nbsp; &nbsp;# 响应处理器│ &nbsp; ├── logging.lua &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 日志模块│ &nbsp; ├── ip-blacklist.lua &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# IP黑名单│ &nbsp; ├── utils.lua &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 工具函数│ &nbsp; └── resty/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 第三方库目录│ &nbsp; &nbsp; &nbsp; └── README.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 库说明├── html/│ &nbsp; ├── block.html &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 拦截页面│ &nbsp; └── index.html &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 测试页面├── logs/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 日志目录（运行时生成）├── docker/│ &nbsp; ├── Dockerfile &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Docker容器配置│ &nbsp; └── docker-compose.yml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Docker Compose配置├── test/│ &nbsp; ├──&nbsp;test-attacks.lua &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 攻击测试脚本│ &nbsp; ├──&nbsp;test-waf.lua &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# WAF功能测试│ &nbsp; └──&nbsp;test-data/│ &nbsp; &nbsp; &nbsp; └── sample-attacks.txt &nbsp; &nbsp; &nbsp;# 测试攻击载荷└── README.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 项目说明文档

首先看openresty的主配置–nginx.conf

worker_processes auto;error_log logs/error.log&nbsp;warn;pid logs/nginx.pid;events {&nbsp; &nbsp; worker_connections&nbsp;1024;}http {&nbsp; &nbsp;&nbsp;# 基础配置&nbsp; &nbsp; include mime.types;&nbsp; &nbsp; default_type application/octet-stream;&nbsp; &nbsp; sendfile on;&nbsp; &nbsp; keepalive_timeout&nbsp;65;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;# Lua包路径&nbsp; &nbsp; lua_package_path&nbsp;"$prefix/lua/?.lua;;";&nbsp; &nbsp; lua_package_cpath&nbsp;"$prefix/lib/?.so;;";&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;# 共享内存字典（用于IP黑名单等）&nbsp; &nbsp; lua_shared_dict waf_ip_blacklist 10m;&nbsp; &nbsp; lua_shared_dict waf_request_counter 10m;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;# 初始化阶段&nbsp; &nbsp; init_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp; -- 加载WAF主模块&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;require("simplewaf").init()&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;# 初始化worker&nbsp; &nbsp; init_worker_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;require("simplewaf").init_worker()&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;# 主服务器配置&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;listen&nbsp;80;&nbsp; &nbsp; &nbsp; &nbsp; server_name localhost;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# WAF检查阶段&nbsp; &nbsp; &nbsp; &nbsp; access_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;local&nbsp;waf =&nbsp;require("simplewaf")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; waf.check_request()&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 内容处理阶段（可选响应检查）&nbsp; &nbsp; &nbsp; &nbsp; body_filter_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;local&nbsp;waf =&nbsp;require("simplewaf")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; waf.check_response()&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 日志阶段&nbsp; &nbsp; &nbsp; &nbsp; log_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;local&nbsp;waf =&nbsp;require("simplewaf")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; waf.log_request()&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 默认后端应用（模拟被保护的应用）&nbsp; &nbsp; &nbsp; &nbsp; location / {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_pass http://backend_app;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header Host&nbsp;$host;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header X-Real-IP&nbsp;$remote_addr;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# WAF管理接口&nbsp; &nbsp; &nbsp; &nbsp; location /waf-admin {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; access_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -- 简单的管理认证&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;local&nbsp;auth = ngx.req.get_headers()["X-WAF-Admin-Token"]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;auth ~=&nbsp;"your-secret-token"&nbsp;then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ngx.exit(403)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; content_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;require("simplewaf.admin").handle_request()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 拦截页面&nbsp; &nbsp; &nbsp; &nbsp; location /waf-block {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; internal;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default_type text/html;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; content_by_lua_block {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ngx.say(require("simplewaf").get_block_page())&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;# 后端应用（模拟）&nbsp; &nbsp; upstream backend_app {&nbsp; &nbsp; &nbsp; &nbsp; server&nbsp;127.0.0.1:8080;&nbsp; &nbsp; }}

这里就设计到nginx的配置，这里简单说下都是什么意思

worker_processes auto;设置值为auto，表示设置 Nginx 工作进程数根据cpu核心数来自动设置
error_log logs/error.log warn;错误日志为 logs/error.log，日志告警级别为warn
pid logs/nginx.pid;指定 Nginx 的进程 ID 文件路径为 logs/nginx.pid
events {&nbsp; &nbsp; worker_connections 1024;}每个进程设置连接数最大为1024

再看http模块

首先设置mime类型，根据文件后缀设置对应的Content-type，默认的mime类型为application/octet-stream

types {&nbsp; &nbsp; text/html &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; html htm shtml;&nbsp; &nbsp; text/css &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;css;&nbsp; &nbsp; text/xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xml;&nbsp; &nbsp; image/gif &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; gif;&nbsp; &nbsp; image/jpeg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jpeg jpg;&nbsp; &nbsp; application/javascript &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;js;&nbsp; &nbsp; application/atom+xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;atom;&nbsp; &nbsp; application/rss+xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rss;
&nbsp; &nbsp; text/mathml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mml;&nbsp; &nbsp; text/plain &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;txt;&nbsp; &nbsp; text/vnd.sun.j2me.app-descriptor &nbsp; &nbsp; &nbsp;jad;&nbsp; &nbsp; text/vnd.wap.wml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;wml;&nbsp; &nbsp; text/x-component &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;htc;
&nbsp; &nbsp; image/png &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; png;&nbsp; &nbsp; image/svg+xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; svg svgz;&nbsp; &nbsp; image/tiff &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;tif tiff;&nbsp; &nbsp; image/vnd.wap.wbmp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;wbmp;&nbsp; &nbsp; image/webp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;webp;&nbsp; &nbsp; image/x-icon &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ico;&nbsp; &nbsp; image/x-jng &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jng;&nbsp; &nbsp; image/x-ms-bmp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bmp;
&nbsp; &nbsp; font/woff &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; woff;&nbsp; &nbsp; font/woff2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;woff2;
&nbsp; &nbsp; application/java-archive &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jar war ear;&nbsp; &nbsp; application/json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;json;&nbsp; &nbsp; application/mac-binhex40 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;hqx;&nbsp; &nbsp; application/msword &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;doc;&nbsp; &nbsp; application/pdf &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pdf;&nbsp; &nbsp; application/postscript &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ps eps ai;&nbsp; &nbsp; application/rtf &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; rtf;&nbsp; &nbsp; application/vnd.apple.mpegurl &nbsp; &nbsp; &nbsp; &nbsp; m3u8;&nbsp; &nbsp; application/vnd.ms-excel &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xls;&nbsp; &nbsp; application/vnd.ms-fontobject &nbsp; &nbsp; &nbsp; &nbsp; eot;&nbsp; &nbsp; application/vnd.ms-powerpoint &nbsp; &nbsp; &nbsp; &nbsp; ppt;&nbsp; &nbsp; application/vnd.wap.wmlc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;wmlc;&nbsp; &nbsp; application/vnd.google-earth.kml+xml &nbsp;kml;&nbsp; &nbsp; application/vnd.google-earth.kmz &nbsp; &nbsp; &nbsp;kmz;&nbsp; &nbsp; application/x-7z-compressed &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 7z;&nbsp; &nbsp; application/x-cocoa &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cco;&nbsp; &nbsp; application/x-java-archive-diff &nbsp; &nbsp; &nbsp; jardiff;&nbsp; &nbsp; application/x-java-jnlp-file &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnlp;&nbsp; &nbsp; application/x-makeself &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;run;&nbsp; &nbsp; application/x-perl &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;pl pm;&nbsp; &nbsp; application/x-pilot &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prc pdb;&nbsp; &nbsp; application/x-rar-compressed &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;rar;&nbsp; &nbsp; application/x-redhat-package-manager &nbsp;rpm;&nbsp; &nbsp; application/x-sea &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sea;&nbsp; &nbsp; application/x-shockwave-flash &nbsp; &nbsp; &nbsp; &nbsp; swf;&nbsp; &nbsp; application/x-stuffit &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sit;&nbsp; &nbsp; application/x-tcl &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tcl tk;&nbsp; &nbsp; application/x-x509-ca-cert &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;der pem crt;&nbsp; &nbsp; application/x-xpinstall &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xpi;&nbsp; &nbsp; application/xhtml+xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xhtml;&nbsp; &nbsp; application/xspf+xml &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xspf;&nbsp; &nbsp; application/zip &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; zip;
&nbsp; &nbsp; application/octet-stream &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bin exe dll;&nbsp; &nbsp; application/octet-stream &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;deb;&nbsp; &nbsp; application/octet-stream &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;dmg;&nbsp; &nbsp; application/octet-stream &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;iso img;&nbsp; &nbsp; application/octet-stream &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;msi msp msm;
&nbsp; &nbsp; audio/midi &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mid midi kar;&nbsp; &nbsp; audio/mpeg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mp3;&nbsp; &nbsp; audio/ogg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ogg;&nbsp; &nbsp; audio/x-m4a &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; m4a;&nbsp; &nbsp; audio/x-realaudio &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ra;
&nbsp; &nbsp; video/3gpp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3gpp 3gp;&nbsp; &nbsp; video/mp2t &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ts;&nbsp; &nbsp; video/mp4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mp4;&nbsp; &nbsp; video/mpeg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mpeg mpg;&nbsp; &nbsp; video/quicktime &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov;&nbsp; &nbsp; video/webm &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;webm;&nbsp; &nbsp; video/x-flv &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; flv;&nbsp; &nbsp; video/x-m4v &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; m4v;&nbsp; &nbsp; video/x-mng &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mng;&nbsp; &nbsp; video/x-ms-asf &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;asx asf;&nbsp; &nbsp; video/x-ms-wmv &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;wmv;&nbsp; &nbsp; video/x-msvideo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; avi;}

sendfile开启，允许操作系统直接从文件系统将文件内容传输到网络缓冲区keepalive_timeout长连接超时时间

server模块大部分我都写了注解，重点说一下代理方面的

location&nbsp;/ {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;proxy_pass&nbsp;http://backend_app;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;proxy_set_header&nbsp;Host&nbsp;$host;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;proxy_set_header&nbsp;X-Real-IP&nbsp;$remote_addr;&nbsp; &nbsp; &nbsp; &nbsp; }

这段配置的作用是：

将所有对 Nginx 服务器的请求（路径为 /）代理到后端应用服务器 backend_app。
在代理请求时，设置请求头 Host 为客户端请求的主机名，确保后端服务器能够正确识别请求的主机名。
设置请求头 X-Real-IP 为客户端的真实 IP 地址，确保后端服务器能够获取客户端的真实 IP 地址。

&nbsp;upstream&nbsp;backend_app {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;server&nbsp;127.0.0.1:8080;&nbsp;}

后端应用组一般搭配proxy_pass一起用，常用于负载均衡

配置中还有设置的一些模块如下

set_by_lua：设置变量；&nbsp;rewrite_by_lua：转发、重定向等；&nbsp;access_by_lua：准入、权限等；&nbsp;content_by_lua：生成返回内容；&nbsp;header_filter_by_lua：应答头过滤处理；&nbsp;body_filter_by_lua：应答体过滤处理；&nbsp;log_by_lua：日志记录。

这些主要搭配lua脚本执行

下期将开始讲解lua脚本，把核心处理逻辑脚本过一遍，最后一期编写测试用例和规则

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：千兆安全 pr0phet《安全开发设计一个简单的waf（一）》