引言

官方提供了API，剩下的主动型还是被动式的可以自己去开发了。但是狗血的是，每台轻量级服务器只能设置100个规则，所以，动态增删吧。

脚本

官方的签名文档在这里：签名方法3

这里提供一个demo

import requests
import hashlib, hmac
import time
from datetime import datetime
import json
import redis
import pymysql
import os

secret_id = "******"
secret_key = "******"
service = "lighthouse"
host = "lighthouse.tencentcloudapi.com"
endpoint = "https://" + host
region = "******"
version = "2017-03-12"
algorithm = "TC3-HMAC-SHA256"
InstanceId = "******"


def generate_auth(params):
    timestamp = int(time.time())
    date = datetime.utcfromtimestamp(timestamp).strftime("%Y-%m-%d")
    # ************* 步骤 1：拼接规范请求串 *************
    http_request_method = "POST"
    canonical_uri = "/"
    canonical_querystring = ""
    ct = "application/json; charset=utf-8"
    payload = json.dumps(params)
    canonical_headers = "content-type:%s\nhost:%s\n" % (ct, host)
    signed_headers = "content-type;host"
    hashed_request_payload = hashlib.sha256(payload.encode("utf-8")).hexdigest()
    canonical_request = (http_request_method + "\n" +
                         canonical_uri + "\n" +
                         canonical_querystring + "\n" +
                         canonical_headers + "\n" +
                         signed_headers + "\n" +
                         hashed_request_payload)

    # ************* 步骤 2：拼接待签名字符串 *************
    credential_scope = date + "/" + service + "/" + "tc3_request"
    hashed_canonical_request = hashlib.sha256(canonical_request.encode("utf-8")).hexdigest()
    string_to_sign = (algorithm + "\n" +
                      str(timestamp) + "\n" +
                      credential_scope + "\n" +
                      hashed_canonical_request)

    # ************* 步骤 3：计算签名 *************
    # 计算签名摘要函数
    def sign(key, msg):
        return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest()

    secret_date = sign(("TC3" + secret_key).encode("utf-8"), date)
    secret_service = sign(secret_date, service)
    secret_signing = sign(secret_service, "tc3_request")
    signature = hmac.new(secret_signing, string_to_sign.encode("utf-8"), hashlib.sha256).hexdigest()

    # ************* 步骤 4：拼接 Authorization *************
    authorization = (algorithm + " " +
                     "Credential=" + secret_id + "/" + credential_scope + ", " +
                     "SignedHeaders=" + signed_headers + ", " +
                     "Signature=" + signature)
    return authorization


def blockIP(ip):
    desc = "个性化防火墙"
    param = {
        "InstanceId": InstanceId
        "FirewallRules": [
            {
                "Protocol": "ALL",
                "Port": "ALL",
                "CidrBlock": ip,
                "Action": "DROP",
                "FirewallRuleDescription": desc
            }
        ],
    }
    post = requests.post(endpoint, headers={"Content-Type": "application/json; charset=utf-8",
                                            "Authorization": generate_auth(param), "Host": host,
                                            "X-TC-Action": "CreateFirewallRules", "X-TC-Version": "2020-03-24",
                                            "X-TC-Timestamp": str(int(time.time())), "X-TC-Region": region},
                         data=json.dumps(param))


def delBlockIP(ip):
    param = {
        "InstanceId": InstanceId,
        "FirewallRules": [
            {
                "Protocol": "ALL",
                "Port": "ALL",
                "CidrBlock": ip,
                "Action": "DROP",
            }
        ],
    }
    post = requests.post(endpoint, headers={"Content-Type": "application/json; charset=utf-8",
                                            "Authorization": generate_auth(param), "Host": host,
                                            "X-TC-Action": "DeleteFirewallRules", "X-TC-Version": "2020-03-24",
                                            "X-TC-Timestamp": str(int(time.time())), "X-TC-Region": region},
                         data=json.dumps(param))


def getAllBlockIP():
    rules = []
    param = {
        "InstanceId": InstanceId,
        "Offset": 0,
        "Limit": 100
    }
    while True:

        post = requests.post(endpoint, headers={"Content-Type": "application/json; charset=utf-8",
                                                "Authorization": generate_auth(param), "Host": host,
                                                "X-TC-Action": "DescribeFirewallRules", "X-TC-Version": "2020-03-24",
                                                "X-TC-Timestamp": str(int(time.time())), "X-TC-Region": region},
                             data=json.dumps(param))
        post_json = post.json()
        for i in post_json['Response']['FirewallRuleSet']:
            if i['FirewallRuleDescription'] == '个性化防火墙':
                rules.append(i)
        if param['Offset'] > post_json['Response']['TotalCount']:
            break
        else:
            param['Offset'] += param['Limit']
    return rules

宝剑在手

既然已经可以调通API了，那么就可以考虑主动防御和被动防御了。

主动防御：

这里只提供一下思路吧：
每次请求都会调用本地的一个映射表，这个映射表里存的是ip和威胁情报(并非广告，这里我比较喜欢的是微步云)，当然选择其它的也可以，默认是放行的，但是如果情报比较准确，并且是危险的，那就有理由block了。

这个映射表的设计可以使用redis，或者mysql，但是每次请求的拦截不太好做（如果使用nginx或者apache）

被动防御：

参考日志系统，定时查阅日志，或者看门狗，如果存在异常流量，就block

为什么使用API，而不是系统防火墙？

服务器防火墙是一种虚拟防火墙，具备有状态的数据包过滤功能。

操作系统防火墙由系统管理员在实例内部配置，设置一定的规则来控制数据包的进出。

说人话就是，所有的流量先经过应用服务器防火墙，再经过系统防火墙，系统防火墙即使block了，也会影响性能，但是服务器防火墙block了，那么系统是无感知的。

实战应用

这里引用了一段日志

{"id":"3","block_type":"apache_logs","block_ip":"223.223.178.12","block_time":"2023-03-21 18:00:02","command":"block"}
{"id":"4","block_type":"apache_logs","block_ip":"223.223.178.12","block_time":"2023-03-21 18:30:02","command":"block"}
{"id":"5","block_type":"remove_block","block_ip":"223.223.178.12","block_time":"2023-03-21 20:00:02","command":"allow"}
{"id":"6","block_type":"apache_logs","block_ip":"176.97.210.30","block_time":"2023-03-21 21:00:02","command":"block"}
{"id":"7","block_type":"apache_logs","block_ip":"176.97.210.30","block_time":"2023-03-21 21:30:02","command":"block"}
{"id":"8","block_type":"remove_block","block_ip":"176.97.210.30","block_time":"2023-03-21 22:30:03","command":"allow"}
{"id":"9","block_type":"apache_logs","block_ip":"104.238.212.223","block_time":"2023-03-22 05:00:03","command":"block"}
{"id":"10","block_type":"apache_logs","block_ip":"104.238.212.223","block_time":"2023-03-22 05:30:02","command":"block"}
{"id":"11","block_type":"remove_block","block_ip":"104.238.212.223","block_time":"2023-03-22 07:00:02","command":"allow"}