Http on IT 运维小秋

firewalld

chenwx716@139.com — Fri, 10 Feb 2023 10:00:00 +0800

基础

systemctl stop firewalld
systemctl disable firewalld

firewall-cmd --reload       # 如果是 --permanent 持久化规则, 则还需要reload一次

show

firewall-cmd --state                # 查询运行状态

firewall-cmd --get-zone-of-interface=eth0               # 查看接口所属区域
firewall-cmd --get-default-zone                         # 获取默认区域
firewall-cmd --get-active-zones                         # 获取活动的区域
firewall-cmd --permanent --zone=public --get-target     # 获取此区域的默认动作

firewall-cmd --zone=public --list-all   # 获取全部规则

管理

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=100-500/tcp           # 临时添加端口范围

firewall-cmd --zone=work --add-source=10.2.1.200

# 更换网卡所匹配的区域
firewall-cmd --zone=drop --change-interface=eth0

firewall-cmd --set-default-zone=drop

高级规则



# 列出高级规则
firewall-cmd --list-rich-rules

# 添加细化的规则
firewall-cmd --zone=public --permanent --add-rich-rule 'rule family="ipv4" source address=10.27.10.181 port port=26379 protocol=tcp accept'

firewall-cmd --zone=public --permanent --remove-rich-rule='rule family="ipv4" source address="10.27.10.0/24" port port="22" protocol="tcp" accept'

# 添加某个网段的访问策略
firewall-cmd --zone=drop --permanent --add-rich-rule 'rule family="ipv4" source address=10.27.10.0/24 port port=9001 protocol=tcp accept'

示例-一般初始化

firewall-cmd --zone=public  --remove-service=ssh
firewall-cmd --zone=public  --remove-service=ssh --permanent
firewall-cmd --zone=public  --remove-service=dhcpv6-client --permanent
firewall-cmd --zone=public  --remove-service=cockpit --permanent

firewall-cmd --zone=public  --add-icmp-block=echo-request
firewall-cmd --zone=public  --add-icmp-block=echo-reply

firewall-cmd --permanent --zone=trusted --add-source=10.2.2.0/24
firewall-cmd --permanent --zone=trusted --add-source=10.3.0.1/32
firewall-cmd --permanent --zone=trusted --add-source=192.168.0.175/32

firewall-cmd --permanent --zone=trusted --remove-source=192.168.0.175/24
firewall-cmd --permanent --zone=trusted --remove-source=10.2.1.5/32

firewall-cmd --permanent --zone=trusted --remove-source=192.168.0.175/32

firewall-cmd --zone=trusted --list-all

http-curl

chenwx716@139.com — Fri, 10 Feb 2023 10:00:00 +0800

跨域


# 跨域测试
curl -i -X OPTIONS https://api.xxx.xyz/admin/captcha \
    -H "Origin: https://xxxxx1.xxx.xyz"

curl -i -X POST https://api.xxx.xyz/admin/captcha \
    -H "Origin: https://xxxxx1.xxx.xyz" \
    -d '{"a":"1"}'

提交和上传


# POST
curl -d "name=abc" http://127.0.0.1:2000/echoback

# 表单提交
curl -d "user=nickwolfe&password=12345" http://10.248.13.7:18001/registerNameajax.htm

# json
curl -i -X POST -H 'Content-type':'application/json' \
    -d "userName=user1&password=zz123456" http://192.168.183.100:8050/nature/login

curl -i -X POST -H 'Content-type':'multipart/form-data' \
    -d "userName=user1&password=zz123456" http://192.168.183.100:8050/nature/login

curl -i -X POST -H 'Content-type':'application/x-www-form-urlencoded' \
    -d "userName=user1&password=zz123456" http://192.168.183.100:8050/nature/login

curl -X POST http://localhost:8080/api -H "Content-Type: application/json" -d '{"a":"b"}'

# json - file
curl -X POST http://localhost:8080/api -H "Content-Type: application/json" -d @sendfile.json

综合

# 添加 host 头
curl -H "Host: minio.services.wait" http://10.2.1.75:80/static/css/style.css

# 修改 agent 和 xff
curl -i --user-agent myagent \
    -H "X-Forwarded-For: 1.1.1.1, 2.2.2.2" \
    -H "Host: www.baidu.com" \
    http://10.1.2.1:18001/


# 请求 ipv6 服务
curl -6 -g http://[2409:8081:1120:6010:7002::12c]:17101
curl -6 -g -k https://[2409:8081:1120:6010:7002::20]:443/services/LoginForWap?wsdl


# socket5
curl --socks5 127.0.0.1:15733 http://myip.ipip.net
curl --socks5-h 192.168.5.9:20323 http://10.10.55.4:8000/

# http 获取返回码
curl -sL -w "%{http_code}\\n" www.baidu.com -o /dev/null
curl -i -s -o /dev/null -w "%{http_code}\n" http://blog.services.wait
curl -s --connect-timeout 5  -o /dev/null -w "%{http_code}" "https://www.baidu.com"


# GET 请求多条参数的情况下对中文进行 urlencode 转码
curl -G --data-urlencode 'phone=1111111,222222' \
    --data-urlencode 'body= 【服务器故障】 10.26.2.20 故障, 请及时检查处理 ' \
    'http://10.1.2.1:9002/api/v1/sms/send'

curl 其它参数

curk -k         # 跳过 https 证书
-e  referer
    -e http://shop.10086.cn
--interface eth0
    使用指定网卡

执行网络脚本

# 执行网络脚本, 不需要下载
curl http://xxx.com/xx/xx.sh | bash
# 传递参数方式
curl -s http://xxx.com/xx/xx.sh | bash -s arg1 arg2
bash <(curl -s http://xxx.com/xx/xx.sh) arg1 arg2


# 具名参 - 区分是 bash 的参数, 还是 脚本的参数, 使用 -- 作为区分
# -- 前面的比如 -s 属于 bash, 后面的 -x abc -y xyz 属于远程脚本的参数
curl -L http://xxx.com/xx/xx.sh | bash -s -- -x abc -y xyz

小技巧

# 压缩请求
curl -i -H "Accept-Encoding: gzip" http://xxxxx.xxx

# 跟踪 url 重定向后的链接
curl -i -L http://10.35.18.166:8050/naturalMan/userQuit

# 超时控制, tcp 2s 超时, 数据包 20s 超时
curl -i --connect-timeout 2 -m 20 http://10.230.88.61:11003/services

# 查询耗时情况
-w 'time_connect %{time_connect}\ntime_starttransfer %{time_starttransfer}\ntime_total %{time_total}\n'

# 不输出正文
-o /dev/null

# 设置 cookie
curl -b "sign=UnbvXIf06L3wtSwHMw3C" http://127.0.0.1


# 循环测试某接口
for i in $(seq 2000);
do
    curl -sL -w "%{http_code}\\n" --connect-timeout 3 http://10.1.170.1:9086/uac -o /dev/null >> ~/a.log
    echo $i
    sleep 1
done

# 测试 tcp 端口的开放
curl -v telnet://192.168.5.9:22

iptables

chenwx716@139.com — Fri, 10 Feb 2023 10:00:00 +0800

base

1
2
3


iptables-save > conf                    # 持久化配置
iptables-restore < conf                 # 恢复配置

show


iptables -L -n --line-number       # 查看规则
iptables -L -n                     # 查看规则
iptables -t nat -nL                # 查看转发表规则

管理

iptables -D INPUT 6                     # 删除规则

iptables -I INPUT -p tcp --dport 17105 -j DROP      # 拒绝
iptables -I INPUT -p tcp --dport 8080 -j ACCEPT     # 允许

# 多端口
iptables -I INPUT -p tcp -m multiport --destination-ports 2022,20022 -s 10.1.136.43 -j ACCEPT -m comment --comment 'local network'


# 允许单个IP
iptables -I INPUT -p tcp --dport 9092 -s 10.24.10.100 -j ACCEPT -m comment --comment 'log app'

# IP范围
iptables -A INPUT -p tcp --dport 22 -m iprange --src-range 10.255.246.53-10.255.246.57 -j ACCEPT -m comment --comment 'ssh manager'

# 允许网段
iptables -I INPUT -p tcp --dport 9092 -s 10.24.10.0/24 -j ACCEPT -m comment --comment 'log app'

# 记录日志
iptables  -I cali-tw-cali03efd0d9a4d -s 10.20.4.241 -j LOG --log-prefix "test-2"
iptables  -D cali-tw-cali03efd0d9a4d -s 10.20.4.241 -j LOG --log-prefix "test-2"

docker network

因为没有直接走 filter 表, 所以需要在 manager 或 raw 表上进行限制

# 拒绝某IP
iptables -t mangle -I PREROUTING -s 114.254.171.148 -j DROP
iptables -t raw -I PREROUTING -p tcp -m tcp --dport 80 -j DROP

iptables -t mangle -I PREROUTING -D 1

ip_conntrack

el5

cat /etc/sysconfig/iptables

sysctl -a | grep ip_conntrack_max
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count

wc -l /proc/net/ip_conntrack

awk '{print $3}' /proc/net/ip_conntrack | sort -n | head

echo 'net.ipv4.ip_conntrack_max = 1024000' >> /etc/sysctl.conf
echo 'net.ipv4.netfilter.ip_conntrack_max = 1024000' >> /etc/sysctl.conf

sysctl -p

el6

cat /etc/sysconfig/iptables

sysctl -a | grep net.nf_conntrack_max
wc -l /proc/net/nf_conntrack
cat /proc/sys/net/netfilter/nf_conntrack_count

echo 'net.nf_conntrack_max = 1024000' >>  /etc/sysctl.conf
echo 'net.netfilter.nf_conntrack_max = 1024000' >> /etc/sysctl.conf

sysctl -p

端口转发

# 80 端口转 8080
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to:8088

sysctl -w net.ipv4.ip_forward=1

# 清空nat表
iptables -F -t nat

ipv6

chenwx716@139.com — Fri, 10 Feb 2023 10:00:00 +0800

检测

ping -4
ping -6

ping6 -I eth1

# 查看路由
/sbin/ip -6 route show dev br0

route -A inet6

telnet 2408:400a:6c:3cff:d219:5fcd:9528:535 80

http


curl -6 http://[2409:8089:1111:6010:7001::0021]:10002/

curl -6 -g -i -L 'http://[2409:8089:1111:6010:7001::0021]:443'

# LocalLink:
curl -g -6 http://[fe80::5054:ff:feab:185%eth0]:8080/

# curl v7.61.0+ 无论本地是否启用 ipv6, 都会先尝试 ipv6 连接, 不需要显式使用 -6 参数
curl -i http://[2408:400a:6c:1111:d219:5fcd:9528:535]
curl -i -6 http://[2408:400a:6c:1111:d219:5fcd:9528:535]
curl -i -6 https://[2408:400a:6c:1111:d219:5fcd:9528:535]:443/

nginx

1
2

listen 80;
listen [::]:80;

抓包

chenwx716@139.com — Fri, 10 Feb 2023 10:00:00 +0800

抓包

tcpdump

tcpdump -i bond0 port 8716
tcpdump -i bond0 host 10.248.13.11 and port 18009 -w 20150804.pcap
tcpdump -i bond0 host 10.27.10.140 or 10.27.10.141 or 10.27.10.142 -w new_memc.pcap

# 解析报文 - 只能简单解析
tcpdump -i bond0 port 8716 -A

wireshark

常用规则

http.response.code==500

http.request.method=="GET"              # 请求方法类型
http.request.method==POST

http.request.uri matches "V4=..1"       # 正则

http.request                            # 过滤所有的http请求
http.request==1

http.request.uri=="/online/setpoint"
http.request.uri contains "/dll/test.htm?"
http.request.full_uri=="http://task.xxxx.xxxx.cn/online/setpoint"