Next Generation (DSL-based engine) | 全面升级（基于 DSL 的引擎）

[ADD-SP]

This discussion is to introduce the next generation of this project, and show the progress.
我将在这里介绍全新的 ngx_waf 并更新最新的进展。

This discussion is still in progress.
内容持续更新中······

Why?

• Now, this project is very hard to maintain as there are many feature in C code, it is time to migrate complex thing into modern language.
• 因使用 C 实现了太多功能，当前项目的维护难度太高，应该早些将复杂的逻辑迁移到现代语言中。
• Rules are not flexible, you might have to do some complex thing for a easy case.
• 规则过于死板，一些简单的需求可能需要一连串复杂的配置才能满足。
• ...

Progress

• Pure Rust rule engine
• Rust 实现的规则引擎
• FFI binding for above Rust library
• 为 Rust 库实现 FFI 接口
• A tools for testing your rules (learning tool)
• 一个用来测试规则的工具（其实就是学习工具）
• ......

A brand new rule syntax | 全新的规则语法

You can write rules with new flexible and readable syntax.

引入了灵活且易读的规则语法。

For example:

下面是一些例子：

// block this request if URL is '/etc/password',
// and then logging this operation into the log file.
// 如果 URL 是 ‘/etc/passwd’ 则拦截请求
Rule "$URL == '/etc/passwd'" deny,log;

// block this request if URL starts with '/etc'.
// 如果 URL 的前缀是 '/etc' 则拦截请求
Rule "$URL ^= '/etc' deny;

// block this request if the regex maches the URL.
// 如果 regex 被匹配则拦截请求
Rule "$URL ~= '^foo[0-9]bar' deny;

// block this request if the server port is greater than 10000
// 如果服务器端口大于 10000 则拦截请求
Rule "$PORT > 10000" deny;

// block this request if this request is from the 192.168.0.0/16
// 如果客户端的 IP 在 192.168.0.0/16 里则拦截请求
Rule "$CLIENT_IP in 192.168.0.0/16" deny;

// block this request if it is from the non-loopback network and
// has no correct token
// 如果客户端来自非回环网络且没有传递正确的 Token 则拦截请求。
Rule "$CLIENT_IP not in 127.0.0.0/8 && $HEADERS.X-Token != 'xxxxxx' deny;

// block this request if its score is too high
// 如果分数太高则拦截
Rule "'scanner' in $HEADER.User-Agent" var:$score="1" log;
Rule "$URL ^= '/eval.php'" var:$score="$socre+1" log;
Rule "$score >= 2" msg:'High score!' deny;

As you can see, it is powerful. But you don't have to worry though, the old configuration file is still compatible, but you can write these flexible rules in a new file.

如你所见，我认为规则足够显而易见，并且十分灵活，而且新的版本将保持与旧的配置文件的兼容性，但你可以在一个新的文件中编写这些规则。

WIP

[hibobmaster]

看到官方组织有个
https://github.com/nginxinc/ngx-rust

[ADD-SP]

我对 ngx-rust 能被维护多久比较担心，而且看起来并没有改变模块的开发方式，有些别扭。