# 编辑 /usr/local/lua/access_by_limit_ip.lualocal function close_redis(red)if not red then  returnend  --释放连接(连接池实现)  local pool_max_idle_time = 10000 --毫秒  local pool_size = 100 --连接池大小  local ok, err = red:set_keepalive(pool_max_idle_time, pool_size)  if not ok then  ngx.say("set keepalive error : ", err)  end
endlocal function errlog(...)ngx.log(ngx.ERR, "redis: ", ...)
endlocal function duglog(...)ngx.log(ngx.DEBUG, "redis: ", ...)
endlocal function getIp()local myIP = ngx.req.get_headers()["X-Real-IP"]if myIP == nil thenmyIP = ngx.req.get_headers()["x_forwarded_for"]endif myIP == nil thenmyIP = ngx.var.remote_addrendreturn myIP;
endlocal key = "limit:ip:blacklist"
local ip = getIp();
local shared_ip_blacklist = ngx.shared.shared_ip_blacklist--获得本地缓存的最新刷新时间
local last_update_time = shared_ip_blacklist:get("last_update_time");if last_update_time ~= nil then local dif_time = ngx.now() - last_update_time if dif_time < 60 then --缓存1分钟,没有过期if shared_ip_blacklist:get(ip) thenreturn ngx.exit(ngx.HTTP_FORBIDDEN) --直接返回403endreturnend
endlocal redis = require "resty.redis"  --引入redis模块
local red = redis:new()  --创建一个对象，注意是用冒号调用的--设置超时（毫秒）
red:set_timeout(1000)
--建立连接
local ip = "10.11.0.215"
local port = 6379
local ok, err = red:connect(ip, port)
if not ok then  close_redis(red)errlog("limit ip cannot connect redis");
elselocal ip_blacklist, err = red:smembers(key);if err thenerrlog("limit ip smembers");else--刷新本地缓存，重新设置
        shared_ip_blacklist:flush_all();--同步redis黑名单 到 本地缓存for i,bip in ipairs(ip_blacklist) do--本地缓存redis中的黑名单shared_ip_blacklist:set(bip,true);end--设置本地缓存的最新更新时间shared_ip_blacklist:set("last_update_time",ngx.now());end
end  if shared_ip_blacklist:get(ip) thenreturn ngx.exit(ngx.HTTP_FORBIDDEN) --直接返回403
end

local function close_reis(red)if not red thenreturnendlocal pool_max_idle_time = 10000local pool_size = 100local ok, err = red:set_keepalive(pool_max_idle_time, pool_size)if not ok thenngx.say("set keepalive error :", err)end
endlocal function errlog(...)ngx.log(ngx.ERR, "redis: ", ...)
endlocal function duglog(...)ngx.log(ngx.DEBUG, "redis: ",...)
endlocal function getIp()local myip = ngx.req.get_headers()["X-Real-IP"]if myip == nil thenmyip = ngx.req.get_headers()["x_forwarded_for"]endif myip == nil thenmyip = ngx.var.remote_addrendreturn myip
endlocal key = "limit:ip:blacklist"
local ip = getIp();
local shared_ip_blacklist = ngx.shared.shared_ip_blacklistlocal last_update_time = shared_ip_blacklist:get("last_update_time");if last_update_time ~= nil thenlocal dif_time = ngx.now() - last_update_timeif dif_time < 60 thenif shared_ip_blacklist:get(ip) thenreturn ngx.exit(ngx.HTTP_FORBIDDEN)endreturnend
endlocal redis = require "resty.redis"
local red = redis:new()red:set_timeout(1000)
local ip = "10.11.0.215"
local port = 6379
local ok, err = red:connect(ip,port)local count, err = red:get_reused_times()
if 0 == count then ----新建连接，需要认证密码ok, err = red:auth("redis123")if not ok thenngx.say("failed to auth: ", err)returnend
elseif err then  ----从连接池中获取连接，无需再次认证密码ngx.say("failed to get reused times: ", err)return
endif not ok thenclose_redis(red)errlog("limit ip cannot connect redis");
elselocal ip_blacklist, err = red:smembers(key)if err thenerrlog("limit ip smembers")elseshared_ip_blacklist:flush_all();for i,bip in ipairs(ip_blacklist) doshared_ip_blacklist:set(bip, true);endshared_ip_blacklist:set("last_update_time", ngx.now());end
endif shared_ip_blacklist:get(ip) thenreturn ngx.exit(ngx.HTTP_FORBIDDEN)
end

local function close_redis(red)if not red thenreturnendlocal pool_max_idle_time = 10000local pool_size = 100local ok, err = red:set_keepalive(pool_max_idle_tme, pool_size)if not ok thenngx.say("set keepalive err : ", err)end
endlocal ip_block_time=300 --封禁IP时间（秒）
local ip_time_out=30    --指定ip访问频率时间段（秒）
local ip_max_count=20 --指定ip访问频率计数最大值（秒）
local BUSINESS = ngx.var.business --nginx的location中定义的业务标识符--连接redis
local redis = require "resty.redis"
local conn = redis:new()
ok, err = conn:connect("10.11.0.215", 6379)
conn:set_timeout(2000) --超时时间2秒--如果连接失败，跳转到脚本结尾
if not ok then--goto FLAG
   close_redis(conn)
endlocal count, err = conn:get_reused_times()
if 0 == count then ----新建连接，需要认证密码ok, err = conn:auth("redis123")if not ok thenngx.say("failed to auth: ", err)returnend
elseif err then  ----从连接池中获取连接，无需再次认证密码ngx.say("failed to get reused times: ", err)return
end--查询ip是否被禁止访问，如果存在则返回403错误代码
is_block, err = conn:get(BUSINESS.."-BLOCK-"..ngx.var.remote_addr)
if is_block == '1' thenngx.exit(403)close_redis(conn)
end--查询redis中保存的ip的计数器
ip_count, err = conn:get(BUSINESS.."-COUNT-"..ngx.var.remote_addr)if ip_count == ngx.null then --如果不存在，则将该IP存入redis，并将计数器设置为1、该KEY的超时时间为ip_time_outres, err = conn:set(BUSINESS.."-COUNT-"..ngx.var.remote_addr, 1)res, err = conn:expire(BUSINESS.."-COUNT-"..ngx.var.remote_addr, ip_time_out)
elseip_count = ip_count + 1 --存在则将单位时间内的访问次数加1if ip_count >= ip_max_count then --如果超过单位时间限制的访问次数，则添加限制访问标识，限制时间为ip_block_timeres, err = conn:set(BUSINESS.."-BLOCK-"..ngx.var.remote_addr, 1)res, err = conn:expire(BUSINESS.."-BLOCK-"..ngx.var.remote_addr, ip_block_time)elseres, err = conn:set(BUSINESS.."-COUNT-"..ngx.var.remote_addr,ip_count)res, err = conn:expire(BUSINESS.."-COUNT-"..ngx.var.remote_addr, ip_time_out)end
end-- 结束标记
local ok, err = conn:close()