--在nginx.conf的HTTP中加入
--lua_shared_dict limit 50m; 根据主机内存调合适的值
--lua_shared_dict iplimit 20m;
--lua_shared_dict blockiplimit 5m;
-------------------------------------------------------------
CCDeny="on" --cc攻击开关
CCrate="60/60"--基于url的计数 次/秒
ipCCrate="600/60"--基于ip的计数 次/秒
-------------------------------------------------
ccdenyrules={"ccdeny1","ccdeny","","","","logon"}
function gethost()
host = ngx.var.host
if host == nil or type(host) ~= "string" then
math.randomseed(os.time())
host = "nohost"..math.random()
end
return host
end
function denycc(clientdata)
if CCDeny=="on" then
local uri=clientdata[2]
local host = gethost()
CCcount=tonumber(string.match(CCrate,'(.*)/'))
CCseconds=tonumber(string.match(CCrate,'/(.*)'))
ipCCcount=tonumber(string.match(ipCCrate,'(.*)/'))
ipCCseconds=tonumber(string.match(ipCCrate,'/(.*)'))
local token = clientdata[1]..host..uri
local clientip = clientdata[1]..host
local limit = ngx.shared.limit
local iplimit = ngx.shared.iplimit
local blockiplimit = ngx.shared.blockiplimit
local req,_=limit:get(token)
local ipreq,_=iplimit:get(clientip)
local blockipreq,_=blockiplimit:get(clientip)
if blockipreq or ipreq then
if blockipreq or req then
if blockipreq or req >= CCcount or ipreq >= ipCCcount then
log(ccdenyrules,clientdata)
blockiplimit:set(clientip,1,300)
ngx.exit(403)
return true
else
limit:incr(token,1)
iplimit:incr(clientip,1)
end
else
limit:set(token,1,CCseconds)
end
else
iplimit:set(clientip,1,ipCCseconds)
end
end
return false
end
原文链接：https://www.cnblogs.com/youlechang123/p/5319085.html
原创文章，作者：优速盾-小U，如若转载，请注明出处：https://www.cdnb.net/bbs/archives/20962
