Skip to content

Commit 643f357

Browse files
abedraabedra
committed
Various updates
* Directives are available in all locations * Enables writing to Repsheet * Fixes broken test
1 parent 1318a6e commit 643f357

7 files changed

+57
-25
lines changed

‎README.md

+17
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
* [bot_verifier_redis_connection_timeout](#bot_verifier_redis_connection_timeout)
1414
* [bot_verifier_redis_read_timeout](#bot_verifier_redis_read_timeout)
1515
* [bot_verifier_redis_expiry](#bot_verifier_redis_expiry)
16+
* [bot_verifier_repsheet_enabled](#bot_verifier_repsheet_enabled)
1617
* [Installation](#installation)
1718
* [Verifying Functionality](#verifying-functionality)
1819
* [Developer Setup](#developer-setup)
@@ -40,6 +41,7 @@ location / {
4041
bot_verifier_redis_connection_timeout 10;
4142
bot_verifier_redis_read_timeout 10;
4243
bot_verifier_redis_expiry 3600;
44+
bot_verifier_repsheet_enabled on;
4345
}
4446
```
4547

@@ -148,6 +150,21 @@ Sets the timeout when querying Redis. This setting is used to connect to the Red
148150

149151
[Back to TOC](#table-of-contents)
150152

153+
bot_verifier_repsheet_enabled
154+
-------------------------
155+
156+
**syntax:** *bot_verifier_repsheet_enabled* \[on|off\]
157+
158+
**default:** *off*
159+
160+
**context:** *location*
161+
162+
**phase:** *access*
163+
164+
Enables blacklisting of failed actors in Repsheet. Assumes Repsheet cache lives on already configured redis server.
165+
166+
[Back to TOC](#table-of-contents)
167+
151168
## Installation
152169

153170
You can add this module to the static build of NGINX or as a dynamic module. To add as a static module add the following line to the `configure` command when compiling NGINX.

‎nginx.conf

+13-12
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
11
events {
2-
worker_connections 1024;
2+
worker_connections 1024;
33
}
44

55
http {
6-
server {
7-
listen 8888;
6+
server {
7+
bot_verifier_redis_host localhost;
8+
bot_verifier_redis_port 6379;
9+
bot_verifier_redis_connection_timeout 10;
10+
bot_verifier_redis_read_timeout 10;
11+
bot_verifier_redis_expiry 3600;
12+
bot_verifier_enable_repsheet on;
813

9-
location / {
10-
bot_verifier on;
11-
bot_verifier_redis_host localhost;
12-
bot_verifier_redis_port 6379;
13-
bot_verifier_redis_connection_timeout 10;
14-
bot_verifier_redis_read_timeout 10;
15-
bot_verifier_redis_expiry 3600;
14+
listen 8888;
15+
16+
location / {
17+
bot_verifier on;
18+
}
1619
}
17-
}
1820
}
19-

‎ngx_http_bot_verifier_cache.c

+6-3
Original file line numberDiff line numberDiff line change
@@ -93,14 +93,17 @@ lookup_verification_status(redisContext *context, char *address)
9393
}
9494

9595
ngx_int_t
96-
persist_verification_status(redisContext *context, char *address, ngx_int_t status, ngx_int_t expiry)
96+
persist_verification_status(ngx_http_bot_verifier_module_loc_conf_t *loc_conf, char *address, ngx_int_t status)
9797
{
9898
redisReply *reply = NULL;
9999

100100
if (status == NGX_OK) {
101-
reply = redisCommand(context, "SETEX %s:bvs %d %s", address, expiry, "success");
101+
reply = redisCommand(loc_conf->redis.connection, "SETEX %s:bvs %d %s", address, loc_conf->redis.expiry, "success");
102102
} else if (status == NGX_DECLINED) {
103-
reply = redisCommand(context, "SETEX %s:bvs %d %s", address, expiry, "failure");
103+
reply = redisCommand(loc_conf->redis.connection, "SETEX %s:bvs %d %s", address, loc_conf->redis.expiry, "failure");
104+
if (loc_conf->repsheet_enabled) {
105+
reply = redisCommand(loc_conf->redis.connection, "REPSHEET.BLACKLIST %s %d %s", address, loc_conf->redis.expiry, "http.bot.provider_validation");
106+
}
104107
}
105108

106109
if (reply) {

‎ngx_http_bot_verifier_cache.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ ngx_int_t check_connection(redisContext *context);
55
void cleanup_connection(ngx_http_bot_verifier_module_loc_conf_t *loc_conf);
66
ngx_int_t reset_connection(ngx_http_bot_verifier_module_loc_conf_t *loc_conf);
77
ngx_int_t lookup_verification_status(redisContext *context, char *address);
8-
ngx_int_t persist_verification_status(redisContext *context, char *address, ngx_int_t status, ngx_int_t expiry);
8+
ngx_int_t persist_verification_status(ngx_http_bot_verifier_module_loc_conf_t *loc_conf, char *address, ngx_int_t status);
99

1010
#endif

‎ngx_http_bot_verifier_module.c

+18-8
Original file line numberDiff line numberDiff line change
@@ -85,10 +85,10 @@ ngx_http_bot_verifier_module_handler(ngx_http_request_t *r)
8585
ret = ngx_http_bot_verifier_module_verify_bot(r, loc_conf, address);
8686
if (ret == NGX_OK) {
8787
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Verification successful, allowing request");
88-
persist_verification_status(loc_conf->redis.connection, address, ret, loc_conf->redis.expiry);
88+
persist_verification_status(loc_conf, address, ret);
8989
} else if (ret == NGX_DECLINED) {
9090
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Verification failed, blocking request");
91-
persist_verification_status(loc_conf->redis.connection, address, ret, loc_conf->redis.expiry);
91+
persist_verification_status(loc_conf, address, ret);
9292
return NGX_HTTP_FORBIDDEN;
9393
}
9494
}
@@ -118,47 +118,55 @@ static ngx_command_t
118118
ngx_http_bot_verifier_module_commands[] = {
119119
{
120120
ngx_string("bot_verifier"),
121-
NGX_HTTP_MAIN_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
121+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
122122
ngx_conf_set_flag_slot,
123123
NGX_HTTP_LOC_CONF_OFFSET,
124124
offsetof(ngx_http_bot_verifier_module_loc_conf_t, enabled),
125125
NULL
126126
},
127+
{
128+
ngx_string("bot_verifier_enable_repsheet"),
129+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
130+
ngx_conf_set_flag_slot,
131+
NGX_HTTP_LOC_CONF_OFFSET,
132+
offsetof(ngx_http_bot_verifier_module_loc_conf_t, repsheet_enabled),
133+
NULL
134+
},
127135
{
128136
ngx_string("bot_verifier_redis_host"),
129-
NGX_HTTP_MAIN_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
137+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
130138
ngx_conf_set_str_slot,
131139
NGX_HTTP_LOC_CONF_OFFSET,
132140
offsetof(ngx_http_bot_verifier_module_loc_conf_t, redis.host),
133141
NULL
134142
},
135143
{
136144
ngx_string("bot_verifier_redis_port"),
137-
NGX_HTTP_MAIN_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
145+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
138146
ngx_conf_set_num_slot,
139147
NGX_HTTP_LOC_CONF_OFFSET,
140148
offsetof(ngx_http_bot_verifier_module_loc_conf_t, redis.port),
141149
NULL
142150
},
143151
{
144152
ngx_string("bot_verifier_redis_connection_timeout"),
145-
NGX_HTTP_MAIN_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
153+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
146154
ngx_conf_set_num_slot,
147155
NGX_HTTP_LOC_CONF_OFFSET,
148156
offsetof(ngx_http_bot_verifier_module_loc_conf_t, redis.connection_timeout),
149157
NULL
150158
},
151159
{
152160
ngx_string("bot_verifier_redis_read_timeout"),
153-
NGX_HTTP_MAIN_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
161+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
154162
ngx_conf_set_num_slot,
155163
NGX_HTTP_LOC_CONF_OFFSET,
156164
offsetof(ngx_http_bot_verifier_module_loc_conf_t, redis.read_timeout),
157165
NULL
158166
},
159167
{
160168
ngx_string("bot_verifier_redis_expiry"),
161-
NGX_HTTP_MAIN_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
169+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
162170
ngx_conf_set_num_slot,
163171
NGX_HTTP_LOC_CONF_OFFSET,
164172
offsetof(ngx_http_bot_verifier_module_loc_conf_t, redis.expiry),
@@ -178,6 +186,7 @@ ngx_http_bot_verifier_module_create_loc_conf(ngx_conf_t *cf)
178186
}
179187

180188
conf->enabled = NGX_CONF_UNSET;
189+
conf->repsheet_enabled = NGX_CONF_UNSET;
181190
conf->redis.port = NGX_CONF_UNSET_UINT;
182191
conf->redis.connection_timeout = NGX_CONF_UNSET_UINT;
183192
conf->redis.read_timeout = NGX_CONF_UNSET_UINT;
@@ -231,6 +240,7 @@ ngx_http_bot_verifier_module_merge_loc_conf(ngx_conf_t *cf, void *parent, void *
231240
ngx_http_bot_verifier_module_loc_conf_t *conf = (ngx_http_bot_verifier_module_loc_conf_t *) child;
232241

233242
ngx_conf_merge_value(conf->enabled, prev->enabled, 0);
243+
ngx_conf_merge_value(conf->repsheet_enabled, prev->repsheet_enabled, 0);
234244
ngx_conf_merge_uint_value(conf->redis.port, prev->redis.port, 6379);
235245
ngx_conf_merge_uint_value(conf->redis.connection_timeout, prev->redis.connection_timeout, 10);
236246
ngx_conf_merge_uint_value(conf->redis.read_timeout, prev->redis.read_timeout, 10);

‎ngx_http_bot_verifier_module.h

+1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ typedef struct {
2222

2323
typedef struct {
2424
ngx_flag_t enabled;
25+
ngx_flag_t repsheet_enabled;
2526
redis_t redis;
2627
size_t provider_len;
2728
provider_t **providers;

‎t/enabled.t

+1-1
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ location = /t {
9696
"GET /t HTTP/1.1\r
9797
Host: 127.0.0.1\r
9898
Connection: close\r
99-
X-Forwarded-For: 65.52.104.9\r
99+
X-Forwarded-For: 157.55.39.5\r
100100
User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)\r
101101
\r
102102
"

0 commit comments

Comments
 (0)