kong中默认有安全插件，黑白名单限流等，限制UA暂时没找到。可以自己开发一个
-- handler.lua
local BasePlugin = require "kong.plugins.base_plugin"
local MyPluginHandler = BasePlugin:extend()
MyPluginHandler.VERSION = "1.0.0"
MyPluginHandler.PRIORITY = 10
function MyPluginHandler:new()
MyPluginHandler.super.new(self, "block-user-agent")
end
function MyPluginHandler:access(conf)
MyPluginHandler.super.access(self)
-- 检查 User-Agent 请求头
local user_agent = kong.request.get_header("User-Agent")
for i, ua in ipairs(conf.blocked_user_agents) do
if user_agent == ua then
-- 如果 User-Agent 被阻止，使用 kong.response.exit 返回响应并停止处理
return kong.response.exit(conf.response_code, { message = conf.response_message })
end
end
end
-- schema.lua
local typedefs = require "kong.db.schema.typedefs"
return {
name = "block-user-agent",
fields = {
{ consumer = typedefs.no_consumer },
{ config = {
type = "record",
fields = {
{ blocked_user_agents = { type = "array", default = {}, elements = { type = "string", }, }, },
{ response_code = { type = "number", default = 403 }, },
{ response_message = { type = "string", default = "Forbidden" }, },
},
},
},
},
}
docker启动时注意修改kong/constants.lua，在插件底部加入UA_block
docker stop kong-gateway
docker rm kong-gateway
docker run -d --name kong-gateway \
--network=kong-net \
-e "KONG_DATABASE=postgres" \
-e "KONG_PG_HOST=kong-database" \
-e "KONG_PG_USER=kong" \
-e "KONG_PG_PASSWORD=kongpass" \
-e "KONG_PROXY_ACCESS_LOG=/dev/stdout" \
-e "KONG_ADMIN_ACCESS_LOG=/dev/stdout" \
-e "KONG_PROXY_ERROR_LOG=/dev/stderr" \
-e "KONG_ADMIN_ERROR_LOG=/dev/stderr" \
-e "KONG_ADMIN_LISTEN=0.0.0.0:8001" \
-e "KONG_ADMIN_GUI_URL=http://localhost:8002" \
-v /data/UA-block:/usr/local/share/lua/5.1/kong/plugins/UA-block \
-v /data/constants.lua:/usr/local/share/lua/5.1/kong/constants.lua \
-p 8000:8000 \
-p 8443:8443 \
-p 8001:8001 \
-p 8444:8444 \
-p 8002:8002 \
-p 8445:8445 \
-p 8003:8003 \
-p 8004:8004 \
kong/kong-gateway:2.6.1.0-alpine
