feat(waf): 新增 UA 检查节点 ua_check

支持要求携带 UA、浏览器/OS 白名单 and-or 匹配，以及优先屏蔽爬虫与非正常 UA。

internal/apps/agent/nginx/manager_test.go

@@ -782,6 +782,9 @@ func TestManagedWAFLuaExecutesCompiledGraphWithoutRequestIO(t *testing.T) {
 	if !strings.Contains(openRestyWAFRuntimeLua, `node.type == "ip_match"`) {
 		t.Fatal("expected WAF runtime to execute compiled IP match nodes")
 	}
+	if !strings.Contains(openRestyWAFRuntimeLua, `node.type == "ua_check"`) {
+		t.Fatal("expected WAF runtime to execute compiled UA check nodes")
+	}
 	checkStart := strings.Index(openRestyWAFRuntimeLua, "function _M.check()")
 	if checkStart < 0 || strings.Contains(openRestyWAFRuntimeLua[checkStart:], "io.open") {
 		t.Fatal("expected WAF request path not to perform file I/O")

internal/apps/agent/nginx/waf_runtime.lua

@@ -294,6 +294,108 @@ local function matches_ip_values(config, ip)
     return false
 end
 
+local function ua_trim(value)
+    return (string.gsub(value or "", "^%s*(.-)%s*$", "%1"))
+end
+
+local function ua_label_in(items, value)
+    if type(items) ~= "table" or not value then return false end
+    for _, item in ipairs(items) do
+        if tostring(item) == value then return true end
+    end
+    return false
+end
+
+local function match_ua_rules(ua_lower, rules, fallback)
+    if ua_lower == "" then return "Unknown" end
+    for _, rule in ipairs(rules) do
+        local matched = false
+        for _, token in ipairs(rule.contains or {}) do
+            if string.find(ua_lower, token, 1, true) then
+                matched = true
+                break
+            end
+        end
+        if not matched and type(rule.all_of) == "table" and #rule.all_of > 0 then
+            matched = true
+            for _, token in ipairs(rule.all_of) do
+                if not string.find(ua_lower, token, 1, true) then
+                    matched = false
+                    break
+                end
+            end
+        end
+        if matched then
+            local excluded = false
+            for _, token in ipairs(rule.none_of or {}) do
+                if string.find(ua_lower, token, 1, true) then
+                    excluded = true
+                    break
+                end
+            end
+            if not excluded then return rule.label end
+        end
+    end
+    return fallback
+end
+
+-- Mirrors internal/repository/analytics/browser.go browserRules / osRules.
+local browser_rules = {
+    { label = "WeChat", contains = { "micromessenger" } },
+    { label = "Postman", contains = { "postman" } },
+    { label = "CLI", contains = { "curl/", "wget/" } },
+    { label = "Edge", contains = { "edg/", "edgios/", "edga/" } },
+    { label = "Opera", contains = { "opr/", "opera" } },
+    { label = "Firefox", contains = { "firefox", "fxios" } },
+    { label = "Chrome", contains = { "crios", "chrome" }, none_of = { "chromium" } },
+    { label = "Chromium", contains = { "chromium" } },
+    { label = "Safari", contains = { "safari" } },
+    { label = "Bot", contains = { "bot", "spider", "crawler", "slurp" } },
+}
+
+local os_rules = {
+    { label = "Android", contains = { "android" } },
+    { label = "iOS", contains = { "iphone", "ipad", "ipod", "ios" } },
+    { label = "Windows", contains = { "windows" } },
+    { label = "macOS", contains = { "mac os x", "macintosh", "macos" } },
+    { label = "Chrome OS", contains = { "cros" } },
+    { label = "Linux", contains = { "linux" } },
+    { label = "Bot", contains = { "bot", "spider", "crawler" } },
+}
+
+local function parse_browser_name(ua)
+    return match_ua_rules(string.lower(ua or ""), browser_rules, "Other")
+end
+
+local function parse_os_name(ua)
+    return match_ua_rules(string.lower(ua or ""), os_rules, "Other")
+end
+
+local function matches_ua_check(config)
+    config = config or {}
+    local ua = ua_trim(ngx.var.http_user_agent or "")
+    if config.require_ua and ua == "" then return false end
+    local browser = parse_browser_name(ua)
+    local os_name = parse_os_name(ua)
+    if config.block_common_bots and (browser == "Bot" or os_name == "Bot") then return false end
+    if config.block_abnormal_ua and (browser == "Bot" or browser == "Other" or browser == "Unknown") then
+        return false
+    end
+    local browsers = array_or_empty(config.browsers)
+    local operating_systems = array_or_empty(config.operating_systems)
+    local has_browsers = #browsers > 0
+    local has_os = #operating_systems > 0
+    if not has_browsers and not has_os then return true end
+    local browser_ok = ua_label_in(browsers, browser)
+    local os_ok = ua_label_in(operating_systems, os_name)
+    if has_browsers and not has_os then return browser_ok end
+    if has_os and not has_browsers then return os_ok end
+    local mode = config.match_mode
+    if mode ~= "and" and mode ~= "or" then mode = "or" end
+    if mode == "and" then return browser_ok and os_ok end
+    return browser_ok or os_ok
+end
+
 local function fail_closed(reason)
     local dict = ngx.shared and ngx.shared.openflare_waf_config
     if not dict or not dict.add or dict:add("_damaged_graph_logged", true, 60) then
@@ -347,6 +449,8 @@ local function execute_graph(graph)
             local region_required = type(config.regions) == "table" and #config.regions > 0
             local country, region = geo_lookup(ngx.var.remote_addr or "", region_required)
             handle = (list_contains(config.countries, country) or list_contains(config.regions, region)) and "true" or "false"
+        elseif node.type == "ua_check" then
+            handle = matches_ua_check(node.config or {}) and "true" or "false"
         elseif node.type == "pow" then
             if pow_runtime.evaluate(node.config or {}) ~= true then
                 return { kind = "takeover" }

internal/apps/agent/nginx/waf_runtime_spec.lua

@@ -79,8 +79,15 @@ local function load_runtime(config, options)
     return runtime
 end
 
-local function reset_request(site, ip, uri, is_internal)
-    ngx.var = { openflare_waf_site = site, remote_addr = ip or "192.0.2.1", uri = uri or "/", request_id = "request-1", openflare_internal = is_internal == true }
+local function reset_request(site, ip, uri, is_internal, user_agent)
+    ngx.var = {
+        openflare_waf_site = site,
+        remote_addr = ip or "192.0.2.1",
+        uri = uri or "/",
+        request_id = "request-1",
+        openflare_internal = is_internal == true,
+        http_user_agent = user_agent,
+    }
     ngx.ctx = {}
     ngx.header = {}
     output = {}
@@ -531,6 +538,98 @@ local function test_request_path_has_no_file_io()
     io.open = original_open
 end
 
+local function test_ua_check_require_block_and_whitelist()
+    local chrome_ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+    local safari_ios_ua = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"
+    local bot_ua = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
+    local weird_ua = "TotallyUnknownClient/1.0"
+
+    local function ua_graph(config)
+        return graph({
+            start = start_to("ua"),
+            ua = node("ua_check", config, { ["true"] = "allow", ["false"] = "blocked" }),
+            blocked = node("block", { status_code = 403, response_body = "ua blocked" }),
+            allow = node("allow"),
+        })
+    end
+
+    local runtime = load_runtime({
+        rule_groups = { rule(1, false, ua_graph({ require_ua = true })) },
+        bindings = { binding("ua-site", { 1 }) },
+    })
+    reset_request("ua-site", nil, nil, nil, nil)
+    runtime.check()
+    assert_equal(output.exit, 403, "missing UA with require_ua should block")
+    reset_request("ua-site", nil, nil, nil, chrome_ua)
+    output = {}
+    runtime.check()
+    assert_equal(output.exit, nil, "present UA with require_ua should allow")
+
+    runtime = load_runtime({
+        rule_groups = { rule(1, false, ua_graph({ block_common_bots = true })) },
+        bindings = { binding("ua-site", { 1 }) },
+    })
+    reset_request("ua-site", nil, nil, nil, bot_ua)
+    runtime.check()
+    assert_equal(output.exit, 403, "common bot should be blocked")
+
+    runtime = load_runtime({
+        rule_groups = { rule(1, false, ua_graph({ block_abnormal_ua = true })) },
+        bindings = { binding("ua-site", { 1 }) },
+    })
+    reset_request("ua-site", nil, nil, nil, weird_ua)
+    runtime.check()
+    assert_equal(output.exit, 403, "abnormal UA should be blocked")
+    reset_request("ua-site", nil, nil, nil, chrome_ua)
+    output = {}
+    runtime.check()
+    assert_equal(output.exit, nil, "normal browser should pass abnormal check")
+
+    runtime = load_runtime({
+        rule_groups = { rule(1, false, ua_graph({ browsers = { "Chrome" }, match_mode = "or" })) },
+        bindings = { binding("ua-site", { 1 }) },
+    })
+    reset_request("ua-site", nil, nil, nil, safari_ios_ua)
+    runtime.check()
+    assert_equal(output.exit, 403, "Safari should miss Chrome whitelist")
+    reset_request("ua-site", nil, nil, nil, chrome_ua)
+    output = {}
+    runtime.check()
+    assert_equal(output.exit, nil, "Chrome should hit whitelist")
+
+    runtime = load_runtime({
+        rule_groups = { rule(1, false, ua_graph({
+            browsers = { "Chrome" },
+            operating_systems = { "iOS" },
+            match_mode = "and",
+        })) },
+        bindings = { binding("ua-site", { 1 }) },
+    })
+    reset_request("ua-site", nil, nil, nil, chrome_ua)
+    runtime.check()
+    assert_equal(output.exit, 403, "Chrome desktop should fail Chrome+iOS and")
+    reset_request("ua-site", nil, nil, nil, safari_ios_ua)
+    output = {}
+    runtime.check()
+    assert_equal(output.exit, 403, "Safari iOS should fail Chrome+iOS and")
+
+    runtime = load_runtime({
+        rule_groups = { rule(1, false, ua_graph({
+            browsers = { "Chrome" },
+            operating_systems = { "iOS" },
+            match_mode = "or",
+        })) },
+        bindings = { binding("ua-site", { 1 }) },
+    })
+    reset_request("ua-site", nil, nil, nil, chrome_ua)
+    runtime.check()
+    assert_equal(output.exit, nil, "Chrome desktop should pass Chrome|iOS or")
+    reset_request("ua-site", nil, nil, nil, safari_ios_ua)
+    output = {}
+    runtime.check()
+    assert_equal(output.exit, nil, "Safari iOS should pass Chrome|iOS or")
+end
+
 test_ip_true_and_false()
 test_ipv6_exact_cidr_and_group()
 test_geo_true_and_false()
@@ -546,5 +645,6 @@ test_block_config_and_rule_order()
 test_damaged_graphs_fail_closed()
 test_null_binding_ids_are_treated_as_empty()
 test_request_path_has_no_file_io()
+test_ua_check_require_block_and_whitelist()
 
 return true