Cdn on Wanzi's Blog – Notes on life, tech, and DevOps.

Open Source WAF Security Protection Solution

wzdushu@gmail.com (wanzi) — Sun, 16 Jun 2024 16:22:42 +0800

Recently, after adding a CDN to the website, there have been a lot of junk requests in the early morning, some are scans, some have large model UserAgents, and some are black spiders.

To save on CDN costs and prevent various injection attacks, I started researching open-source WAF solutions (which is sufficient for my small site). For enterprise use, it is still recommended to use commercial versions, such as Alibaba Cloud’s DCDN, Tencent’s EdgeOne, or overseas options like Cloudflare (preferred for overseas business).

1. Function Introduction

Leichi (SafeLine) is an open-source WAF solution from Chaitin Technology, driven by intelligent semantic analysis algorithms.

The main function is a network security gateway, focusing on WAF, which can defend against all web attacks, such as SQL injection, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XSS, XXE, SSRF, path traversal, backdoors, brute force attacks, HTTP floods, robot abuse, etc.

I briefly reviewed the project source code; the API uses Golang, and the core WAF functionality uses Tengine + Lua, similar to OpenResty.

Project address: https://github.com/chaitin/safeline

Official website: https://waf-ce.chaitin.cn/

https://waf.chaitin.com/

Note: Other popular gateways include Apisix, Kong, Openresty, etc.

2. Installation

Download Offline Image

Since many domestic Docker Hub mirror accelerators have become unavailable recently, we can only use offline methods here.

# mkdir /opt/safeline
# cd /opt/safeline
# wget https://demo.waf-ce.chaitin.cn/image.tar.gz
# cat image.tar.gz | gzip -d | docker load
# docker ps 
REPOSITORY                                                           TAG       IMAGE ID       CREATED         SIZE
chaitin/safeline-fvm                                                 latest    d9589d01be57   3 days ago      175MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-fvm        latest    d9589d01be57   3 days ago      175MB
chaitin/safeline-mgt                                                 latest    56ef6365e4c3   3 days ago      81.6MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-mgt        latest    56ef6365e4c3   3 days ago      81.6MB
chaitin/safeline-luigi                                               latest    1423e012eef0   3 days ago      31.8MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-luigi      latest    1423e012eef0   3 days ago      31.8MB
chaitin/safeline-mario                                               latest    758fd16c3d30   3 days ago      201MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-mario      latest    758fd16c3d30   3 days ago      201MB
chaitin/safeline-bridge                                              latest    94aaed2a1b5a   3 days ago      17.9MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-bridge     latest    94aaed2a1b5a   3 days ago      17.9MB
chaitin/safeline-tengine                                             latest    c67893333287   3 days ago      140MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-tengine    latest    c67893333287   3 days ago      140MB
chaitin/safeline-detector                                            latest    f5cff5cc7e35   3 days ago      179MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-detector   latest    f5cff5cc7e35   3 days ago      179MB
chaitin/safeline-chaos                                               latest    71b05b47e3fd   3 days ago      118MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-chaos      latest    71b05b47e3fd   3 days ago      118MB
chaitin/safeline-postgres                                            15.2      bf700010ce28   13 months ago   379MB
swr.cn-east-3.myhuaweicloud.com/chaitin-safeline/safeline-postgres   15.2      bf700010ce28   13 months ago   379MB

Configure Environment

# cd  /opt/safeline
# vim .env
SAFELINE_DIR=/opt/safeline
IMAGE_TAG=latest
MGT_PORT=9443
POSTGRES_PASSWORD=Pgssf201Waf
SUBNET_PREFIX=172.22.222
IMAGE_PREFIX=chaitin

SAFELINE_DIR: Leichi installation directory, configured as /opt/safeline here.
IMAGE_TAG: The version of Leichi to install, keep the default latest.
MGT_PORT: The port for the Leichi console, keep the default 9443.
POSTGRES_PASSWORD: The initial password for the database required by Leichi, please generate one randomly.
SUBNET_PREFIX: The subnet prefix for the internal network of Leichi, keep the default 172.22.222.
IMAGE_PREFIX: The prefix for the Leichi image source, keep the default chaitin.

Manage Containers with docker-compose:

# cd "/opt/safeline"
# wget "https://waf-ce.chaitin.cn/release/latest/compose.yaml"  -O docker-compose.yaml
# docker-compose  up -d
# docker-compose ps 
Name                     Command                  State                            Ports
--------------------------------------------------------------------------------------------------------------------
safeline-bridge     /app/bridge serve -n unix  ...   Up
safeline-chaos      ./entrypoint.sh                  Up             9000/tcp
safeline-detector   /detector/entrypoint.sh          Up (healthy)   8000/tcp, 8001/tcp
safeline-fvm        ./fvm /app/config.yml            Up
safeline-luigi      /bin/sh -c /app/luigi            Up             80/tcp
safeline-mario      /mario/entrypoint.sh             Up (healthy)
safeline-mgt        /docker-entrypoint.sh /bin ...   Up (healthy)   0.0.0.0:9443->1443/tcp,:::9443->1443/tcp, 80/tcp
safeline-pg         docker-entrypoint.sh postg ...   Up (healthy)   5432/tcp
safeline-tengine    entrypoint.sh nginx -g dae ...   Up

The first login to Leichi requires initializing the admin account. Execute the following command:

`1`	`docker exec safeline-mgt resetadmin`

After executing the command, the admin account password will be randomly reset, and the output will be as follows:

[SafeLine] Initial username：admin
[SafeLine] Initial password：**********
[SafeLine] Done

At this point, the basic installation is complete. You just need to open port 9443 in the cloud ACL.

You can access the Leichi console by opening a browser and visiting https://:9443/.

3. Website Configuration

SSL Certificate Configuration:

Supports both custom uploading of certificates and applying for free certificates.

Add Site:

Add a site. By default, CAPTCHA, identity verification, and dynamic protection are already enabled. Note that when adding upstream servers, the origin configuration is somewhat vague, such as the origin port and protocol.

Proxy Configuration:

Security Protection Settings:

Here, you mainly configure rate limits (similar to Nginx limit), custom rules (based on HTTP header information), and semantic analysis (related to injections).

Rate Limiting: The underlying logic is similar to Nginx’s limit_req, limit_conn, and limit_rate.

Custom Rules: Mainly based on HTTP header information to set policies, similar to common CDN access control, but this feature is more flexible.

Semantic Analysis: Mainly for identifying various injections and bot detection.

4. Summary

After two days of testing, Leichi basically meets the needs of my small site, but it also has many areas where it falls short.

For example: Free certificate application does not support wildcard domains, and the origin server protocol is vague.

Finally, here is a screenshot of the Leichi backend homepage.

References: https://docs.waf-ce.chaitin.cn/zh/home

Some summaries and reflections on CDN construction

wzdushu@gmail.com (wanzi) — Wed, 07 Sep 2022 12:22:42 +0800

The ongoing COVID-19 pandemic has repeatedly disrupted daily life and work. Over the past half year, I’ve experienced a lot—family members fell seriously ill, my grandmother passed away, and there were numerous personal matters to handle, which led me to pause blogging for six months.

Amid economic downturns, many industries have begun layoffs and business scaling back. Taking advantage of recent free time, I’m summarizing my past experience with CDN services.

I. Architectural Analysis of Large-Scale Websites

In the mobile internet era, designing architectures for high-concurrency large-scale websites is far from simple. Here’s a concise overview across several key aspects:

1. Client Side:

Devices include desktop PCs, mobile phones, smart devices, etc.

Browser layers mainly consist of Chrome, Microsoft IE/Edge, Safari, Firefox, Opera, etc.—classification is primarily based on browser engines.

Protocol layer:

(1) Standard web pages: HTTP/1.1, HTTP/2, QUIC
(2) Streaming media: RTMP, HTTP-FLV, HLS (m3u8)

2. CDN Layer:

For small to medium-sized websites, commercial CDN services are usually sufficient.

For large or ultra-large websites, a hybrid approach—combining self-built and commercial CDN—is recommended. This will be discussed in detail later.

In the CDN domain, two core components dominate: caching layer and routing layer.

Depending on business scenarios, typical use cases include:

Static content acceleration
Dynamic content acceleration
Download acceleration
Audio acceleration
Video acceleration
Live streaming acceleration
P2P acceleration
Security acceleration

3. Static Services:

Frontend delivery models typically involve H5, mini-programs, Android, iOS. Core assets include HTML/CSS/JS.

Popular frontend frameworks: Vue, React, Angular.

Typically served via Nginx or OpenResty on the backend, with SSL certificates, expiration policies, CORS configurations, etc., properly set up.

4. Dynamic Services:

Based on the company’s primary programming language—commonly PHP, Java, Go, Python, etc.

Most companies now run dynamic services within Docker or Kubernetes clusters.

If true static/dynamic separation isn’t feasible and traffic must go through CDN, it’s advisable to configure origin-pull strategies to minimize routing overhead.

5. Data Caching Layer:

Common solutions: Redis, Memcached.

In cloud-native ecosystems, etcd and TiKV are also used for caching purposes.

6. Database Servers:

Traditional relational databases: MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, DB2.

NoSQL alternatives: MongoDB, HBase, Cassandra (Facebook), etc.

With increasing demands for performance and massive data handling, modern distributed databases are gaining traction:

TiDB (open-source by PingCAP)
Greenplum
DorisDB (open-source by Baidu)
ClickHouse

7. Distributed Storage:

Common choices: Ceph, HDFS, GlusterFS, GFS—selected based on specific use cases.

Currently, Ceph and HDFS dominate the market:

Ceph: Supports block storage, object storage, and file systems; widely adopted by cloud providers. It integrates well with OpenStack and Kubernetes.
HDFS: Ideal for massive data storage, often paired with Hadoop and Spark. However, its support for cloud-native environments is limited.

II. Self-Built CDN vs. Commercial CDN?

1. Choosing Between CDN Options

Deciding between self-building a CDN or using a commercial one depends on your company’s scale, cost constraints, and operational needs.

For general static file acceleration, if traffic is under 10M PV/month, avoid self-building—commercial CDNs suffice. Prioritize vendors offering low cost and strong performance.
For large file downloads, if your bandwidth is constrained, don’t build your own CDN—stick with commercial options.
For audio and on-demand video acceleration, if your R&D team lacks expertise, opt for commercial CDNs with wide node coverage, low pricing, and proven results.
For live streaming, where user experience is critical, prioritize CDN providers with excellent network quality across their edge nodes—preferably major cloud-based CDN vendors.
For dynamic acceleration and security acceleration, choose vendors with robust origin-pull paths and mature security mechanisms.

2. How to Build Your Own CDN?

Hardware: Select servers with high cost-performance ratios—focus on disk, memory, and CPU specs.
Data Center Bandwidth: Partner with telecom agents. Prefer data centers with:
- High outbound capacity
- Excellent network links
- Strong DDoS protection
Cache Nodes: Choose from Nginx, Apache Traffic Server, Varnish, Squid.
Routing System: Use third-party intelligent CDN solutions. If you have strong R&D capabilities, consider Bind View or Bind DLZ.
High Availability & Load Balancing: Options include LVS, Nginx, Keepalived, HAProxy.

3. How to Choose a Commercial CDN?

Domestic CDN Providers: Alibaba Cloud, Tencent Cloud, NetEase Cloud, Huawei Cloud, Baidu Cloud, Kingsoft Cloud, White Mountain Cloud, Qiniu Cloud, Blue Network, UpYun, Dalian, UCloud, QingCloud, etc.

International CDN Providers: AWS CloudFront, Akamai, Google Cloud CDN, Fastly, Limelight, Cloudflare, StackPath, CDNetworks, etc.

When selecting a CDN provider—domestic or international—consider these metrics:

Metric	Evaluation Criteria
(1) Node Distribution	More nodes closer to users → better acceleration
(2) First Screen Time	Shorter loading time → better UX
(3) Node Latency	Lower latency → better network path
(4) Download Speed	Faster download → strong server + network performance
(5) Packet Loss Rate	Low loss → stable end-user connectivity
(6) Origin Pull Rate	Lower ratio of origin requests/traffic → better offloading
(7) Hit Rate	Higher hit rate → more cached content → better performance
(8) Platform Features	Rich functionality, complete features, good UI/UX
(9) Support Responsiveness	How quickly the operations team responds and resolves issues
(10) Routing Strategy	Evaluate whether the vendor’s routing logic is rational and effective

III. Summary

In recent years, with the rise of cloud computing, China’s CDN industry has undergone significant consolidation. Former giants like NetEase Cloud and Blue Network have been largely overtaken by Alibaba Cloud and Tencent Cloud. Once-prominent Dalian’s business has declined, Kuaiwang was acquired by CenturyLink, White Mountain Cloud has pivoted toward edge computing, while mid-tier players like Kingsoft Cloud, UCloud, Qiniu Cloud, UpYun are gradually capturing market share.

In conclusion, the future direction of the CDN industry remains uncertain. But current trends show all major vendors aggressively investing in edge computing. With advancements in 5G, AI, and containerization technologies, CDN is no longer just a standalone technology—it must continuously integrate with other innovations and ultimately serve real-world applications in our daily lives.