开源蜜罐HFish使用心得2 - 高交互Web蜜罐

local cjson = require "cjson"
local http = require "resty.http"

local function http_post(url, body)
    local httpc = http.new()
    httpc:set_timeout(30000)
    local res, err_ = httpc:request_uri(url, {
        method = "POST",
        body = body,
        headers = {["Content-Type"] = "application/json"}
    })
    httpc:set_keepalive(5000, 100)
    httpc:close()
end

local function get_data()
    local data = {
        host = ngx.var.host,
        uri = ngx.var.uri,
        method = ngx.var.request_method,
        remote_addr = ngx.var.http_x_forwarded_for,
        time_local = ngx.var.time_local,
        http_user_agent = ngx.var.http_user_agent,
        request_time = ngx.var.request_time
    }

    if "GET" == ngx.var.request_method then
        data["args"] = ngx.req.get_uri_args()
    elseif "POST" == ngx.var.request_method then
        ngx.req.read_body()
        data["args"] = ngx.req.get_post_args()
    end


    function string.split(input, delimiter)
        input = tostring(input)
    	delimiter = tostring(delimiter)
        if (delimiter=='') then return false end
    	local pos,arr = 0, {}
    	-- for each divider found
    	for st,sp in function() return string.find(input, delimiter, pos, true) end do
    	    table.insert(arr, string.sub(input, pos, st - 1))
    	    pos = sp + 1
    	end
    	table.insert(arr, string.sub(input, pos))
    	return arr
    end

    local headers=ngx.req.get_headers()
    local clientIP=headers["X_FORWARDED_FOR"]
    if clientIP == nil or string.len(clientIP) == 0 or clientIP == "unknown" then
        clientIP = ngx.var.remote_addr    
    end
    if clientIP ~= nil and string.len(clientIP) >15  then
        local pos  = string.split(clientIP,',')
        clientIP = pos[1]

    end

    local result = {
        name = ngx.var.hfish_name,
        info = data,
        sec_key = ngx.var.hfish_sec_key,
        ip = clientIP
    }

    return cjson.encode(result)
end

http_post(ngx.var.hfish_api, get_data())

set $hfish_name '攻击行为感知';  # 插件名称
set $hfish_sec_key 'xxx';  # 接口安全密钥
set $hfish_api 'http://127.0.0.1:8989/api/v1/post/plug_report';    # 插件接口
    # HFish 插件核心模块
access_by_lua_file '/usr/local/src/honeypot/hfish.lua';