diff --git a/Dockerfile b/Dockerfile index bed2446..0da84e0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -155,7 +155,7 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \ -o /usr/local/bin/runsvinit . # The image, described under "Deployment" in SPEC.md. It runs rproxy unless -# SWW_COMMAND says discriminator, and an app's Dockerfile can build FROM it. +# SWW_COMMAND says waf, and an app's Dockerfile can build FROM it. # It is the last stage, so a plain `docker build .` builds it. # # ubuntu 26.04, 2026-09-27 @@ -223,7 +223,7 @@ RUN groupadd --system --gid 65532 sww \ # The state files' directory, SWW_STATE_DIR by default, where a volume # is mounted to keep them across deploys. The run script gives it to the -# sww user at each start of discriminator. +# sww user at each start of waf. RUN mkdir /var/lib/sww # The default rule file, in SWW_RULES_DIR by default, where a Dockerfile diff --git a/README.md b/README.md index 6685da4..91460ff 100644 --- a/README.md +++ b/README.md @@ -11,16 +11,15 @@ refuses the ones that look like abuse. `smallwebwaf` is one program, `sww`, shipped in one image, with two commands that do this together: - `sww rproxy` is a small reverse proxy in front of one app. traefik routes to - it. It asks `discriminator` about each request, passes the allowed ones to the - app, and passes the app's answers back. It keeps nothing and never touches - disk. -- `sww discriminator` decides. It runs the checks and keeps the bans, the - counters and each client's history. One `discriminator` serves many sites: a - client banned through one site is refused on all of them, and its requests on - all of them count toward one set of limits. + it. It asks `waf` about each request, passes the allowed ones to the app, and + passes the app's answers back. It keeps nothing and never touches disk. +- `sww waf` decides. It runs the checks and keeps the bans, the counters and + each client's history. One `waf` serves many sites: a client banned through + one site is refused on all of them, and its requests on all of them count + toward one set of limits. -The site keeps answering while `discriminator` is down, slow or restarting: -without an answer in time, `rproxy` passes the request to the app. +The site keeps answering while `waf` is down, slow or restarting: without an +answer in time, `rproxy` passes the request to the app. It protects against: @@ -80,11 +79,11 @@ make docker Push the image to a registry your hosts pull from, and name it there by digest. -The image runs `rproxy` by default. To run `discriminator` from the same image, -set the container's `SWW_COMMAND` to `discriminator`. The image's health check -follows the command: in `rproxy`'s container it passes once `rproxy` answers and -the app accepts connections, whether or not `discriminator` answers; in -`discriminator`'s container, once `discriminator` answers. +The image runs `rproxy` by default. To run `waf` from the same image, set the +container's `SWW_COMMAND` to `waf`. The image's health check follows the +command: in `rproxy`'s container it passes once `rproxy` answers and the app +accepts connections, whether or not `waf` answers; in `waf`'s container, once +`waf` answers. ### The usual setup: three containers @@ -92,24 +91,24 @@ The usual setup is three containers on one private network: - the app; - `rproxy`, in front of the app, which traefik routes to: `SWRP_WAF_BACKEND` - names `discriminator` and `SWRP_UPSTREAM_URL` names the app; -- `discriminator`, with `SWW_COMMAND=discriminator` and a volume at - `/var/lib/sww` for its state files. + names `waf` and `SWRP_UPSTREAM_URL` names the app; +- `waf`, with `SWW_COMMAND=waf` and a volume at `/var/lib/sww` for its state + files. Point traefik's labels at port 8080 of `rproxy` (`traefik.http.services..loadbalancer.server.port=8080`). Publish no port -of the app or of `discriminator`. Anything on that network can reach the app -around `rproxy`, and can ask `discriminator` questions, so the network holds -only what you trust. Each further app adds its own container and its own -`rproxy`, whose `SWRP_WAF_BACKEND` names the same `discriminator`. The "Smallest -setup" example below shows this shape. +of the app or of `waf`. Anything on that network can reach the app around +`rproxy`, and can ask `waf` questions, so the network holds only what you trust. +Each further app adds its own container and its own `rproxy`, whose +`SWRP_WAF_BACKEND` names the same `waf`. The "Smallest setup" example below +shows this shape. ### `rproxy` in the app's container An app's image can instead be built on the `smallwebwaf` image, so that `rproxy` -runs beside the app in one container. `discriminator` still runs in a container -of its own. The app's `Dockerfile` starts `FROM` the `smallwebwaf` image, named -by digest, and adds: +runs beside the app in one container. `waf` still runs in a container of its +own. The app's `Dockerfile` starts `FROM` the `smallwebwaf` image, named by +digest, and adds: - the app's binary; - the packages the app needs, from the nixpkgs in the image; @@ -169,26 +168,25 @@ does. - A log line with `"msg":"starting"` gives the version, the address and every setting in effect, with secrets masked. - A request to the site through traefik gets the app's answer. - `https:///_sww/healthz` answers `ok`. `discriminator`'s log lines about - the request have `"action":"forward"`. -- To see a refusal without banning yourself, run `discriminator` with - `SWW_MODE=observe` and ask for `/.env`. The request reaches the app. - `discriminator`'s log lines have `"would_action":"temporarily_banned"` and - `"rule_ids":["env-file"]`. A ban you get in `enforce` mode is lifted as - "Clients and bans" below describes. + `https:///_sww/healthz` answers `ok`. `waf`'s log lines about the + request have `"action":"forward"`. +- To see a refusal without banning yourself, run `waf` with `SWW_MODE=observe` + and ask for `/.env`. The request reaches the app. `waf`'s log lines have + `"would_action":"temporarily_banned"` and `"rule_ids":["env-file"]`. A ban you + get in `enforce` mode is lifted as "Clients and bans" below describes. - With `SWW_METRICS_TOKEN` set, this answers with the metrics, from a host on - `discriminator`'s network: - `curl -H "Authorization: Bearer $TOKEN" http://discriminator:8080/_sww/metrics`. + `waf`'s network: + `curl -H "Authorization: Bearer $TOKEN" http://waf:8080/_sww/metrics`. - `make example-app` builds the image and an app on it, runs them, and checks the whole exchange (see "Entrypoints"). ## Configuration Every setting is an environment variable, read once at start; changing one means -restarting the container. `rproxy` reads only the `SWRP_` settings, and -`discriminator` only the `SWW_` ones. Every setting but `SWRP_WAF_BACKEND` has a -default, chosen for a service on the open internet. A setting that needs an -account, a key, a token or an alert destination stays off until you give one. +restarting the container. `rproxy` reads only the `SWRP_` settings, and `waf` +only the `SWW_` ones. Every setting but `SWRP_WAF_BACKEND` has a default, chosen +for a service on the open internet. A setting that needs an account, a key, a +token or an alert destination stays off until you give one. - Any `SWW_` setting can be given as a file instead, for secrets and long lists: `SWW_ADMIN_TOKEN_FILE` names the file that holds `SWW_ADMIN_TOKEN`. The file's @@ -222,23 +220,23 @@ Every setting the code reads, with its default: | Variable | Default | What it does | | ---------------------------------------- | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `SWW_COMMAND` | `rproxy` | Which command the image runs, and its health check checks: `rproxy` or `discriminator`. | -| `SWRP_WAF_BACKEND` | required | `discriminator`'s URL, such as `http://discriminator:8080`. | +| `SWW_COMMAND` | `rproxy` | Which command the image runs, and its health check checks: `rproxy` or `waf`. | +| `SWRP_WAF_BACKEND` | required | `waf`'s URL, such as `http://waf:8080`. | | `SWRP_UPSTREAM_URL` | `http://127.0.0.1:8081` | The app's URL: a scheme, a host and an optional port, nothing more. | | `SWRP_LISTEN_ADDR` | `:8080` | Where `rproxy` listens; leave the host part empty. | | `SWRP_TRUSTED_PROXIES` | `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16` | The netblocks whose `X-Forwarded-For` `rproxy` believes; set but empty, it believes none. | -| `SWRP_TIMEOUT_MS` | `2000` | How long `rproxy` waits for `discriminator`'s answer to a question and to a report, in milliseconds. | -| `SWRP_DEFAULT_DISPOSITION` | `allow` | What `rproxy` does with a request when `discriminator` cannot be reached or does not answer in time: `allow` passes it to the app, `deny` answers `503`. | +| `SWRP_TIMEOUT_MS` | `2000` | How long `rproxy` waits for `waf`'s answer to a question and to a report, in milliseconds. | +| `SWRP_DEFAULT_DISPOSITION` | `allow` | What `rproxy` does with a request when `waf` cannot be reached or does not answer in time: `allow` passes it to the app, `deny` answers `503`. | | `SWRP_MAX_REQUEST_SIZE` | `100M` | The largest request body, a size or `off`; a larger one is answered `413`. | | `SWRP_MAX_RESPONSE_SIZE` | `1G` | The largest response body, a size or `off`. The visitor gets `502` in place of a larger one, or it is cut off if it has already started. | | `SWRP_MAX_REQUEST_TIME_MS` | `60000` | Two time limits, each this long, in milliseconds or `off`: one for the visitor to send its request line and headers, then one for the whole request to reach the app. | | `SWRP_MAX_RESPONSE_TIME_MS` | `1800000` | How long the answer may take, from the end of the request to its last byte reaching the visitor, in milliseconds or `off`. | -| `SWW_LISTEN_ADDR` | `:8080` | Where `discriminator` listens; leave the host part empty. | -| `SWW_INSTANCE_NAME` | the container's host name | The name in every line `discriminator` logs, and in every alert and metric, such as `fsn1/discriminator`. | +| `SWW_LISTEN_ADDR` | `:8080` | Where `waf` listens; leave the host part empty. | +| `SWW_INSTANCE_NAME` | the container's host name | The name in every line `waf` logs, and in every alert and metric, such as `fsn1/waf`. | | `SWW_MODE` | `enforce` | `observe` refuses nothing and makes no ban; each log line says what `enforce` would have done. | | `SWW_IPV6_GROUP_PREFIX` | `64` | The prefix length of the IPv6 netblock that counts as one client, from 32 to 128. | | `SWW_MAX_TRACKED_CLIENTS` | `20000` | The most clients kept, in memory and in `clients.json`; the least recently seen is dropped first. | -| `SWW_MAX_BANS` | `5000` | The most bans `discriminator` keeps of its own; bans an admin made do not count. | +| `SWW_MAX_BANS` | `5000` | The most bans `waf` keeps of its own; bans an admin made do not count. | | `SWW_ALLOW_NETS` | empty | Netblocks whose clients skip every check, such as your monitoring. | | `SWW_RATE_LIMIT_EXEMPT_NETS` | empty | Netblocks whose clients are exempt from rate limiting and the byte limits. | | `SWW_DENY_NETS` | empty | Netblocks whose clients are refused. | @@ -296,9 +294,9 @@ Every setting the code reads, with its default: | `SWW_STATE_DIR` | `/var/lib/sww` | The directory of the state files, an absolute path. | | `SWW_STATE_WRITE_DELAY` | `10s` | How long `bans.json` waits to be written after a ban is made, lifted or made permanent. | | `SWW_STATE_COUNTER_INTERVAL` | `15m` | How often every state file is written. | -| `SWW_LOG_LEVEL` | `info` | The least severe of `discriminator`'s own messages that are written: `debug`, `info`, `warn` or `error`; request lines are always written. | +| `SWW_LOG_LEVEL` | `info` | The least severe of `waf`'s own messages that are written: `debug`, `info`, `warn` or `error`; request lines are always written. | | `SWW_LOG_REQUEST_HEADERS` | `accept,accept-language,accept-encoding,content-type,origin,range` | The request headers whose values the request log records; `Authorization` and `Cookie` are never recorded. | -| `SWW_LOG_REMOTE_URL` | unset | A syslog server that also gets every line `discriminator` writes: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://` with a host and a port. | +| `SWW_LOG_REMOTE_URL` | unset | A syslog server that also gets every line `waf` writes: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://` with a host and a port. | | `SWW_LOG_REMOTE_TLS_CA_FILE` | unset | A file of PEM certificates a `syslog+tls` server's certificate must chain to, instead of the host's own. | | `SWW_LOG_REMOTE_BUFFER` | `10000` | The most lines held while they wait to be sent; past it, the oldest is dropped. | | `SWW_LOG_REMOTE_FACILITY` | `local0` | The syslog facility of each record sent. | @@ -351,8 +349,8 @@ own, where each reaches the others by service name. Each example publishes ### Smallest setup -One app, `rproxy` in front of it, and `discriminator` with a volume for its -state files, every setting at its default. +One app, `rproxy` in front of it, and `waf` with a volume for its state files, +every setting at its default. ```yaml services: @@ -363,20 +361,20 @@ services: rproxy: image: smallwebwaf environment: - SWRP_WAF_BACKEND: http://discriminator:8080 + SWRP_WAF_BACKEND: http://waf:8080 SWRP_UPSTREAM_URL: http://app:8081 ports: - "8080:8080" - discriminator: + waf: image: smallwebwaf environment: - SWW_COMMAND: discriminator + SWW_COMMAND: waf volumes: - - discriminator-state:/var/lib/sww + - waf-state:/var/lib/sww volumes: - discriminator-state: + waf-state: ``` ### Custom per-address limits @@ -399,15 +397,15 @@ services: rproxy: image: smallwebwaf environment: - SWRP_WAF_BACKEND: http://discriminator:8080 + SWRP_WAF_BACKEND: http://waf:8080 SWRP_UPSTREAM_URL: http://app:8081 ports: - "8080:8080" - discriminator: + waf: image: smallwebwaf environment: - SWW_COMMAND: discriminator + SWW_COMMAND: waf # Monitoring skips every check. SWW_ALLOW_NETS: 192.0.2.10 # The office and the automation host are never rate limited. @@ -426,18 +424,18 @@ services: SWW_BAN_RESPONSE: "429" SWW_LIMIT_BAN_DURATION: 30m volumes: - - discriminator-state:/var/lib/sww + - waf-state:/var/lib/sww volumes: - discriminator-state: + waf-state: ``` ### `rproxy` beside the app The app is built on the `smallwebwaf` image, with `rproxy` inside its container. `app/` holds the `Dockerfile` and `app.run` from "`rproxy` in the app's -container". `rproxy` answers `503` to every request while `discriminator` is -down, and `discriminator`: +container". `rproxy` answers `503` to every request while `waf` is down, and +`waf`: - observes before it enforces; - looks addresses up in a local database rather than GeoJS; @@ -450,17 +448,17 @@ services: # A Dockerfile built FROM the smallwebwaf image, with rproxy inside. build: ./app environment: - SWRP_WAF_BACKEND: http://discriminator:8080 - # Answer 503 rather than pass a request on while discriminator is down. + SWRP_WAF_BACKEND: http://waf:8080 + # Answer 503 rather than pass a request on while waf is down. SWRP_DEFAULT_DISPOSITION: deny ports: - "8080:8080" - discriminator: + waf: image: smallwebwaf environment: - SWW_COMMAND: discriminator - SWW_INSTANCE_NAME: fsn1/discriminator + SWW_COMMAND: waf + SWW_INSTANCE_NAME: fsn1/waf # Refuse nothing yet; log what enforce mode would have done. SWW_MODE: observe # Look addresses up in a local IPinfo Lite database, never GeoJS. @@ -471,12 +469,12 @@ services: SWW_ALERT_NTFY_TOKEN_FILE: /etc/sww/tokens/ntfy SWW_ALERT_EVENTS: ban,permanent_ban,core_rule_set_match,source_failure,file_error volumes: - - discriminator-state:/var/lib/sww + - waf-state:/var/lib/sww - /srv/ipinfo:/var/lib/ipinfo:ro - /srv/sww/tokens:/etc/sww/tokens:ro volumes: - discriminator-state: + waf-state: ``` The database is mounted by its directory, not by file, so that a replaced @@ -498,18 +496,18 @@ How it works inside. [`SPEC.md`](SPEC.md) gives every rule in full, and why. ### What happens to a request -A request goes through these steps, in this order. Once `discriminator` refuses -a request, the steps after that are skipped, apart from the report, and nothing -of the request reaches the app. +A request goes through these steps, in this order. Once `waf` refuses a request, +the steps after that are skipped, apart from the report, and nothing of the +request reaches the app. `rproxy` takes the first two: 1. The health check, `GET /_sww/healthz`, is answered at once. 2. The visitor's address is worked out from `X-Forwarded-For`, believed only - from `SWRP_TRUSTED_PROXIES`. `rproxy` sends `discriminator` the request as - the visitor sent it, with the first 64 KiB of its body. + from `SWRP_TRUSTED_PROXIES`. `rproxy` sends `waf` the request as the visitor + sent it, with the first 64 KiB of its body. -`discriminator` takes the checks: +`waf` takes the checks: 3. The tag lists. 4. The static lists, `SWW_ALLOW_NETS` and `SWW_DENY_NETS`. @@ -528,13 +526,13 @@ of the request reaches the app. 16. A path under `/_sww/` is answered `404`, so that the app never sees that prefix. -`rproxy` takes the rest, with `discriminator` counting at the end: +`rproxy` takes the rest, with `waf` counting at the end: 17. The request is passed to the app, streaming. -18. After the answer, `rproxy` sends `discriminator` a report with the status - and the body bytes each way. For an allowed request, `discriminator` counts - the bytes `SWW_BYTES_COUNT` names toward the byte limits, bans the client if - they take it past one, and adds the request to the client's history. +18. After the answer, `rproxy` sends `waf` a report with the status and the body + bytes each way. For an allowed request, `waf` counts the bytes + `SWW_BYTES_COUNT` names toward the byte limits, bans the client if they take + it past one, and adds the request to the client's history. A refused visitor is answered with `SWW_BAN_RESPONSE`. A `block` rule or a Core Rule Set match answers `403` and bans nobody, since the Core Rule Set has false @@ -560,8 +558,8 @@ status for a size or time limit, such as `413` for a body too large. ### Request tags -Each request gets tags from what `discriminator` knows of its client, written in -the `tags` field of its log line: +Each request gets tags from what `waf` knows of its client, written in the +`tags` field of its log line: - `asn=` and `country=`, from the lookup; - one tag per list of `SWW_TAG_LISTS` that holds the client, such as `torexit` @@ -612,17 +610,17 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md). - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own fields or paths. - Rule files are plain text, one rule to a line, edited by hand and read again - while `discriminator` runs. The image ships one file of probes no real visitor - sends (see [`docs/rules.md`](docs/rules.md)). + while `waf` runs. The image ships one file of probes no real visitor sends + (see [`docs/rules.md`](docs/rules.md)). ### State files -`discriminator` keeps everything in memory, and the five JSON files in -`SWW_STATE_DIR` hold a copy: `bans.json`, `clients.json`, `lookups.json`, -`reputation.json` and `alerts.json`. Each is written whole, to a temporary file -renamed over the real one, so a crash leaves a complete file. `discriminator` -notices a file edited on disk and takes the edit in; an edit that does not parse -is set aside as `.bad`, and never stops the running process (see +`waf` keeps everything in memory, and the five JSON files in `SWW_STATE_DIR` +hold a copy: `bans.json`, `clients.json`, `lookups.json`, `reputation.json` and +`alerts.json`. Each is written whole, to a temporary file renamed over the real +one, so a crash leaves a complete file. `waf` notices a file edited on disk and +takes the edit in; an edit that does not parse is set aside as `.bad`, and +never stops the running process (see [`docs/state-files.md`](docs/state-files.md)). ### The image and its processes @@ -632,20 +630,19 @@ is set aside as `.bad`, and never stops the running process (see `Dockerfile` installs a package with `nix-env -iA nixpkgs.` and gets the same package each time it is built (see [`docs/image.md`](docs/image.md)). - runit, a service supervisor, runs `sww` as the `sww` user (uid and gid 65532) - and starts it again when it exits. The `run` script of `discriminator` gives - the state directory to the `sww` user at each start, so a volume needs no - change of owner. -- `rproxy` and `discriminator` use no token between them. `discriminator`'s own - endpoints, under `/_sww/`, are for your admin tools and your metrics - collector, at its own address on the private network; nothing routes the - internet there. + and starts it again when it exits. The `run` script of `waf` gives the state + directory to the `sww` user at each start, so a volume needs no change of + owner. +- `rproxy` and `waf` use no token between them. `waf`'s own endpoints, under + `/_sww/`, are for your admin tools and your metrics collector, at its own + address on the private network; nothing routes the internet there. - `docker stop` gives requests in progress five seconds to finish. With `rproxy` in the app's container, the app must keep answering for five seconds after `SIGTERM` for that to help them. - Only faults found at start stop a process: an invalid setting, a rule file or state file that does not parse, a lookup database that cannot be read, or an address it cannot listen on. Once running, a failing lookup service, - reputation source or alert destination never takes `discriminator` down. + reputation source or alert destination never takes `waf` down. ### Packages @@ -653,8 +650,8 @@ is set aside as `.bad`, and never stops the running process (see - `internal/sww`: the process, as the command it is given, and the health check. - `internal/config`: reads the settings, the one place they are read. - `internal/rproxy`: the reverse proxy in front of one app. -- `internal/discriminator`: `discriminator`'s server, which runs the checks and - answers its own endpoints. +- `internal/waf`: `waf`'s server, which runs the checks and answers its own + endpoints. - `internal/ratelimit`, `internal/bans`, `internal/rules`, `internal/coreruleset`, `internal/lookup`, `internal/reputation`, `internal/routewatch`, `internal/anomaly` and `internal/alerts`: one check or @@ -734,25 +731,25 @@ on the host. - `script/precommit`: run by the git pre-commit hook; runs `script/check`. - `script/install-precommit`: installs that hook. `make hooks`. - `script/build`: builds `bin/sww` with the Go on your host. `make build`. -- `script/run`: builds `bin/sww` and runs `discriminator` and `rproxy` on the - host, with the settings in your environment. `make run`. Unless your settings - say otherwise: +- `script/run`: builds `bin/sww` and runs `waf` and `rproxy` on the host, with + the settings in your environment. `make run`. Unless your settings say + otherwise: - `rproxy` listens on port 8080, in front of an app at `http://127.0.0.1:8081`; - - `discriminator` listens on port 8090; + - `waf` listens on port 8090; - its state files go in `bin/state`; - its rule files are those of `share/rules.d`. - `script/example-app`: builds the image and the example app (`deploy/example-app`) on it, runs the app with `rproxy` in its container and - `discriminator` in another, and checks them. Then it removes the containers, - the network, the volumes and the images. Needs network access. - `make example-app`. It checks: + `waf` in another, and checks them. Then it removes the containers, the + network, the volumes and the images. Needs network access. `make example-app`. + It checks: - the health checks; - a request passed to the app; - a ban for a broken limit, and a ban for a probe made permanent; - - that only `discriminator`'s container changes the state directory's owner; - - with `discriminator` stopped, the app still answering through `rproxy`; - - with `discriminator` started again, bans applying again; + - that only `waf`'s container changes the state directory's owner; + - with `waf` stopped, the app still answering through `rproxy`; + - with `waf` started again, bans applying again; - orderly stops with `sv stop` and `docker stop`; - bans surviving a new container on the same volume; - a setting given as a file. diff --git a/SPEC.md b/SPEC.md index 5e6e6e1..fb56d77 100644 --- a/SPEC.md +++ b/SPEC.md @@ -4,7 +4,7 @@ binary, `sww`, and two of its commands do the work: - `sww rproxy` is a reverse proxy between traefik and one app. -- `sww discriminator` decides what happens to each request, for many sites. +- `sww waf` decides what happens to each request, for many sites. This document says what it must do and why, each requirement once. Everything in it is built, except what the last section lists. `README.md` says how to run it. @@ -16,12 +16,12 @@ to them. - It protects self-hosted apps on the open internet from scrapers, scanners and other abusers. It does so from an app's first request. `rproxy` requires only - the address of `discriminator`. In a container of its own it also needs the - app's address. Every other setting has a default chosen for a service facing - the internet in 2026. A setting that needs an alert destination, an account - key or a token stays off until the operator supplies it. + the address of `waf`. In a container of its own it also needs the app's + address. Every other setting has a default chosen for a service facing the + internet in 2026. A setting that needs an alert destination, an account key or + a token stays off until the operator supplies it. - It keeps a site answering while the part that decides is down, slow or - restarting (see "Without an answer from `discriminator`"). + restarting (see "Without an answer from `waf`"). - It limits each client's requests and body bytes per minute, hour and day. It bounds the size and duration of every request and answer. It detects attacks. - It bans abusers: briefly at first, for seven days on a clear sign of attack, @@ -29,9 +29,9 @@ to them. - It looks up each client's AS number and country. It can refuse whole countries and netblocks, lower its limits for listed AS numbers and countries, consult reputation sources, and send alerts. -- Everything is set by environment variables. The names of `discriminator`'s - start with `SWW_`, and those of `rproxy` with `SWRP_`. The only other inputs - are `discriminator`'s files: +- Everything is set by environment variables. The names of `waf`'s start with + `SWW_`, and those of `rproxy` with `SWRP_`. The only other inputs are `waf`'s + files: - the rule files; - the state files; - a lookup database; @@ -51,29 +51,28 @@ to them. ## Architecture -- One statically linked Go binary. Only `discriminator` writes to disk, and only - to its state directory. It ships in one image, which runs either command (see +- One statically linked Go binary. Only `waf` writes to disk, and only to its + state directory. It ships in one image, which runs either command (see "Deployment"). - No database of any kind. Nothing is read from disk while serving a request. - Packages: - `cmd/sww`: the binary, which only calls `internal/sww`. - - `internal/sww`: the process, as the command it is given. - `sww discriminator` reads the settings, the rule files, the lookup - database and the state files, listens, and serves until `SIGTERM` or - `SIGINT`. Then it stops, writing the state files (see "`discriminator`"). - `sww rproxy` reads only that command's settings, and runs - `internal/rproxy` until `SIGTERM` or `SIGINT` (see "`rproxy`"). - `sww healthcheck` is the image's health check. With no command, or one it - does not know, the binary prints the commands and exits with status 2. + - `internal/sww`: the process, as the command it is given. `sww waf` reads + the settings, the rule files, the lookup database and the state files, + listens, and serves until `SIGTERM` or `SIGINT`. Then it stops, writing + the state files (see "`waf`"). `sww rproxy` reads only that command's + settings, and runs `internal/rproxy` until `SIGTERM` or `SIGINT` (see + "`rproxy`"). `sww healthcheck` is the image's health check. With no + command, or one it does not know, the binary prints the commands and exits + with status 2. - `internal/config`: reads the settings, the one place they are read. - - `internal/discriminator`: `discriminator`'s server. It runs the checks in - `check`, and holds `discriminator`'s question, answer and report. It - answers `discriminator`'s own endpoints in `answerOwnEndpoint`. It counts - bytes, refusals and anomalies, and writes the log lines. - - `internal/rproxy`: the reverse proxy in front of one app that asks - `discriminator` about each request. It passes a request to the app with - the standard library's `httputil.ReverseProxy`, within the time and size - limits. + - `internal/waf`: `waf`'s server. It runs the checks in `check`, and holds + `waf`'s question, answer and report. It answers `waf`'s own endpoints in + `answerOwnEndpoint`. It counts bytes, refusals and anomalies, and writes + the log lines. + - `internal/rproxy`: the reverse proxy in front of one app that asks `waf` + about each request. It passes a request to the app with the standard + library's `httputil.ReverseProxy`, within the time and size limits. - `internal/ratelimit`: the table of clients. It counts requests, bytes and refusals, and keeps each client's history. - `internal/bans`: the bans. It holds each netblock's bans with their notes, @@ -100,8 +99,7 @@ to them. - `internal/metrics`: the metrics, in the Prometheus text format. - `Dockerfile`: the lint and test phases, then the image. `deploy/example-app` is an app built on the image, with `rproxy` in its - container, which `script/example-app` checks with `discriminator` in - another. + container, which `script/example-app` checks with `waf` in another. - Libraries, checked against the owner's Go dependency defaults: - the standard library for the reverse proxy, HTTP clients, DNS, logging (`log/slog`) and the state files (`encoding/json`, `os.Rename`); @@ -121,14 +119,14 @@ to them. ## What happens to a request -`rproxy` runs steps 1, 2 and 17, and sends the report of step 18. -`discriminator` runs steps 3 to 16, and does the counting of step 18. The first -step that produces a final answer ends the checks. Step 18 runs for each request -`discriminator` answers with `allow`, `deny` or `close`. `rproxy`'s size and -time limits apply to the whole exchange. Each step names the section that holds -its rules. A step that names a heuristic in parentheses runs that heuristic. The -request log's `heuristic` field gives that name. `refusal_limit` and -`byte_limits` give theirs in `after_answer_heuristic` instead. +`rproxy` runs steps 1, 2 and 17, and sends the report of step 18. `waf` runs +steps 3 to 16, and does the counting of step 18. The first step that produces a +final answer ends the checks. Step 18 runs for each request `waf` answers with +`allow`, `deny` or `close`. `rproxy`'s size and time limits apply to the whole +exchange. Each step names the section that holds its rules. A step that names a +heuristic in parentheses runs that heuristic. The request log's `heuristic` +field gives that name. `refusal_limit` and `byte_limits` give theirs in +`after_answer_heuristic` instead. 1. `GET /_sww/healthz` is answered at once by `rproxy`, before any check, so a health checker never needs an exemption and is never refused. @@ -142,8 +140,8 @@ request log's `heuristic` field gives that name. `refusal_limit` and not an address ends the walk. With no header, the peer is the client. - If the peer is outside `SWRP_TRUSTED_PROXIES`, it is the client, and the header is ignored. - - `rproxy` then sends `discriminator` the question (see "The question"). - `discriminator` takes the address the question gives as the client. + - `rproxy` then sends `waf` the question (see "The question"). `waf` takes + the address the question gives as the client. - An IPv6 client is its group: the netblock of `SWW_IPV6_GROUP_PREFIX` around its address, a /64 by default, since one abuser usually controls a whole /64. A client is therefore one IPv4 address or one IPv6 group. @@ -197,7 +195,7 @@ request log's `heuristic` field gives that name. `refusal_limit` and unknown is left out. Whatever that setting says, any such header the client sent is removed. 18. After the visitor's answer has ended, `rproxy` sends the report (see "The - report"). `discriminator` then counts: + report"). `waf` then counts: - For a request it allowed, the body bytes of the response, of the request or of both are added to the byte counters, as `SWW_BYTES_COUNT` says. For a WebSocket, what it carried each way counts once it closes. A client @@ -207,15 +205,15 @@ request log's `heuristic` field gives that name. `refusal_limit` and - For a request it allowed, the client's history and the anomaly counters are updated, and the alert thresholds are evaluated. - For a request it refused, `discriminator` adds nothing to the byte limits. - It updates the history and the anomaly counters at its decision. It counts - the refusals the error burst counts at the decision too (`refusal_limit`; - see "Attack detection"). + For a request it refused, `waf` adds nothing to the byte limits. It updates + the history and the anomaly counters at its decision. It counts the refusals + the error burst counts at the decision too (`refusal_limit`; see "Attack + detection"). In `SWW_MODE=observe`, every refusal above is logged as what would have -happened, nothing is refused, and `discriminator` makes no ban of its own. A -path under `/_sww/` is still answered `404`, and `rproxy`'s size and time limits -still apply. +happened, nothing is refused, and `waf` makes no ban of its own. A path under +`/_sww/` is still answered `404`, and `rproxy`'s size and time limits still +apply. ## Counting method @@ -245,7 +243,7 @@ address or one /64, so a permanent ban does not reach neighbours who did nothing. Requests refused under a ban are not counted against limits. They are counted in the client's history and in the ban's notes. -An offence is a request `discriminator` holds against the client. It is one of: +An offence is a request `waf` holds against the client. It is one of: - a clear sign of attack; - a broken limit; @@ -305,23 +303,23 @@ no offence: - `SWW_TAG_DENY`. Every ban carries notes with what an admin needs to decide whether to lift it, -drawn from what `discriminator` already knows. No lookup is made for the notes -alone. `docs/state-files.md` lists the notes with the rest of a ban's entry. +drawn from what `waf` already knows. No lookup is made for the notes alone. +`docs/state-files.md` lists the notes with the rest of a ban's entry. An admin adds, keeps or lifts a ban by editing `bans.json` (see "Persistent state") or through the ban endpoints (see "Admin endpoints"). A ban an admin -makes has the cause `admin`; an admin who wants to keep a ban `discriminator` -made sets its cause to `admin`. A ban lifted before it ends is kept, marked as -lifted, and does not count toward a longer ban; it refuses nothing. Deleting its -entry from `bans.json` forgets it entirely. +makes has the cause `admin`; an admin who wants to keep a ban `waf` made sets +its cause to `admin`. A ban lifted before it ends is kept, marked as lifted, and +does not count toward a longer ban; it refuses nothing. Deleting its entry from +`bans.json` forgets it entirely. -A permanent ban does not run out. It ends when an admin lifts it, or when -`discriminator` drops it from a full table, as below. When `discriminator` holds -`SWW_MAX_BANS` bans of its own, it drops the earliest ban of one netblock: the -netblock that has gone longest without a request. A past, active or permanent -ban is dropped alike. A scanner whose ban was dropped that way is refused and -banned again by its next probe. A ban whose cause is `admin` is never dropped -and does not count toward `SWW_MAX_BANS`, so such bans can never fill the table. +A permanent ban does not run out. It ends when an admin lifts it, or when `waf` +drops it from a full table, as below. When `waf` holds `SWW_MAX_BANS` bans of +its own, it drops the earliest ban of one netblock: the netblock that has gone +longest without a request. A past, active or permanent ban is dropped alike. A +scanner whose ban was dropped that way is refused and banned again by its next +probe. A ban whose cause is `admin` is never dropped and does not count toward +`SWW_MAX_BANS`, so such bans can never fill the table. A request refused under a ban that runs out is logged with the action `temporarily_banned`. Under a permanent ban the action is `permanently_banned`. @@ -334,8 +332,7 @@ action for the ban it made. A request that makes a ban permanent is logged as `docs/settings.md` lists every setting with its default and the values it takes, in the groups below. It also gives the form each kind of value takes. The groups -below are `discriminator`'s settings; "`rproxy`" gives the use of `rproxy`'s. -Conventions: +below are `waf`'s settings; "`rproxy`" gives the use of `rproxy`'s. Conventions: - These settings take `off`, which switches them off: - `SWW_LOOKUP_SOURCE` and `SWW_WAF_MODE`; @@ -359,8 +356,8 @@ Conventions: `_FILE` form. `SWW_COMMAND` cannot be given as a file. No `SWRP_` setting has one, since `rproxy` never touches disk. - Settings, files included, are read once at start. Changing one means - restarting the container. The files `discriminator` watches while it runs are - its state files, its rule files and the lookup database. + restarting the container. The files `waf` watches while it runs are its state + files, its rule files and the lookup database. - An invalid setting stops the process at start with one log line, marked `"type":"process"` with `"msg":"invalid setting"`. The line names the variable and what is wrong with the value; "Each container's processes" says what @@ -370,9 +367,9 @@ Conventions: ### Core -- `SWW_INSTANCE_NAME` is in each line `discriminator` logs, and in each metric - and alert, so that instances can be told apart. The default, the container's - host name, changes at every redeploy; a name set by the operator survives it. +- `SWW_INSTANCE_NAME` is in each line `waf` logs, and in each metric and alert, + so that instances can be told apart. The default, the container's host name, + changes at every redeploy; a name set by the operator survives it. - `SWW_MODE=observe` lets a configuration be tried before it is enforced (see "What happens to a request"). - `SWW_IPV6_GROUP_PREFIX` sets the group size. After a change, each IPv6 client @@ -384,8 +381,8 @@ Conventions: - `SWW_ADMIN_TOKEN` switches on the ban endpoints and `/_sww/clients/`. The metrics are off until `SWW_METRICS_TOKEN` is set, since without a token they - would be open to anything on `discriminator`'s network. The two are separate, - so the metrics collector, which holds the metrics token, cannot manage bans. + would be open to anything on `waf`'s network. The two are separate, so the + metrics collector, which holds the metrics token, cannot manage bans. - A token is a long random value. One shorter than 32 characters stops the start. The file form keeps a token out of the container's environment (see "Tokens" under "Deployment"). @@ -509,16 +506,16 @@ service that keeps its visitors' addresses on its own host. else treats it differently. - GeoJS publishes no rate limit, but its terms forbid "an excessive amount of API requests", judged by GeoJS alone, and let it block a caller. While GeoJS - is slow, down or refusing `discriminator`, new clients count as unknown. GeoJS - is then left alone for a second, and twice as long after each further failure, - up to five minutes. Each failure raises a `source_failure` alert (see - "Alerting"). A service that cannot accept this uses the file. + is slow, down or refusing `waf`, new clients count as unknown. GeoJS is then + left alone for a second, and twice as long after each further failure, up to + five minutes. Each failure raises a `source_failure` alert (see "Alerting"). A + service that cannot accept this uses the file. - The file is the free IPinfo Lite database (`ipinfo_lite.mmdb`), whose `asn`, `as_name` and `country_code` fields are read. The operator downloads it with a - free IPinfo account and mounts it read-only; `discriminator` never fetches it - and holds no account or token for it. IPinfo updates it daily. Its licence is - Creative Commons Attribution-ShareAlike 4.0, and IPinfo asks for a link to it - on the site that uses it, such as "IP address data is powered by IPinfo". + free IPinfo account and mounts it read-only; `waf` never fetches it and holds + no account or token for it. IPinfo updates it daily. Its licence is Creative + Commons Attribution-ShareAlike 4.0, and IPinfo asks for a link to it on the + site that uses it, such as "IP address data is powered by IPinfo". - The file is read whole at start; one that is missing or unreadable stops the start. It is read again once it has gone 2 seconds without a change after being replaced. A replacement that cannot be read is logged, sent as one @@ -547,10 +544,9 @@ client by what it does, not by where it comes from. A `country=` tag in ### Request tags -Each request gets tags from what `discriminator` knows of its client and what -the checks found. The operator refuses or slows clients by tag. Tags appear in -the log line as `tags`, sorted, with empty lists left out (see -`docs/request-log.md`). +Each request gets tags from what `waf` knows of its client and what the checks +found. The operator refuses or slows clients by tag. Tags appear in the log line +as `tags`, sorted, with empty lists left out (see `docs/request-log.md`). Each tag and where it comes from: @@ -560,7 +556,7 @@ Each tag and where it comes from: before the lookup. - One tag per list of `SWW_TAG_LISTS` that holds the client (`tag_lists`), the tag being the list's name, such as `torexit` or `vpn=mullvad`. These lists are - fetched and kept like a blocklist. `discriminator` ships none of its own. + fetched and kept like a blocklist. `waf` ships none of its own. - `crowdsec`, `dnsbl=` and `abuseipdb`, when that reputation source lists the client, whatever the source's action. A zone with a key is named with the key masked, as the `reputation` field gives it. @@ -576,8 +572,8 @@ Each tag and where it comes from: they differ, it has both. - They are added before `deny_nets`, so the log line of a request it refused has them. - - `discriminator` asks routewatch in the background and never waits for it. - An answer is kept for 1 hour, in memory only. + - `waf` asks routewatch in the background and never waits for it. An answer + is kept for 1 hour, in memory only. - After a query fails, routewatch is not asked for 1 minute. - A request without these tags gives the reason in the log field `routewatch_tags_missing` (see @@ -620,10 +616,9 @@ abuse comes from. number they list, they replace its `asn=` tag's percentage and its entry in `SWW_ASN_LIMIT_PERCENT_URL`; for a country, its `country=` tag's percentage. - `SWW_ASN_LIMIT_PERCENT_URL` names a text file of `AS:percent` lines, so one - abuse-source list can be shared by every `discriminator` in the fleet. It is - fetched and kept like a blocklist (see "Reputation"). Each entry counts like - an `asn=` tag in `SWW_TAG_LIMIT_PERCENT`. Where both give a percentage, the - lower applies. + abuse-source list can be shared by every `waf` in the fleet. It is fetched and + kept like a blocklist (see "Reputation"). Each entry counts like an `asn=` tag + in `SWW_TAG_LIMIT_PERCENT`. Where both give a percentage, the lower applies. - A client's limit percentage is the lowest of those that apply to it: its AS number's, its country's, its tags', or a reputation hit's `limit:`. A client without a country gets `SWW_UNKNOWN_LIMIT_PERCENT` in place of a @@ -678,8 +673,8 @@ files, the limits and the bans still apply to the client that sends it. only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file holds an app's own exclusions. The eighth to fourteenth changes below hold those of the apps they name. - - `discriminator` loads the file after `smallwebwaf`'s own setup rules and - before the Core Rule Set's rules. The Core Rule Set loads its own + - `waf` loads the file after `smallwebwaf`'s own setup rules and before the + Core Rule Set's rules. The Core Rule Set loads its own `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point. - So the file holds only `SecAction` and `SecRule` lines that exclude with `ctl:ruleRemoveTargetById` or `ctl:ruleRemoveById`. These run with each @@ -696,10 +691,10 @@ files, the limits and the bans still apply to the client that sends it. rules is loaded yet. - `SWW_WAF_BODY_LIMIT` switches body inspection on, up to that size. It takes at - most `64K`, since `discriminator` gets no more of a body than that (see "The - answer"). Form data and multipart bodies are read up to the size. JSON and XML - bodies are read only when no larger than the size, since those cannot be read - in part. Any other body is not read: the Core Rule Set would read it as form + most `64K`, since `waf` gets no more of a body than that (see "The answer"). + Form data and multipart bodies are read up to the size. JSON and XML bodies + are read only when no larger than the size, since those cannot be read in + part. Any other body is not read: the Core Rule Set would read it as form data, where binary content such as a git push trips rules written for text. A body the Core Rule Set cannot parse adds 5 to the score, and so does a multipart body cut by the limit in the middle of a part's header. Body @@ -1578,9 +1573,9 @@ No source is on by default. A source acts on a list kept elsewhere; the defaults judge a client only by what it does here. AbuseIPDB and CrowdSec also need an account or an engine of the operator's own. The list best suited to be on by default, Spamhaus DROP, has terms, below, that forbid frequent fetching, and -Spamhaus may block an address that breaks them. Each `discriminator` fetches its -own copy, so several of them on one host, sharing one address, would often fetch -too close together. +Spamhaus may block an address that breaks them. Each `waf` fetches its own copy, +so several of them on one host, sharing one address, would often fetch too close +together. - Blocklists (`SWW_BLOCKLIST_URLS`) are text files of addresses and netblocks, one to a line, as the Spamhaus DROP list is written. Anything after a `;` or @@ -1619,8 +1614,8 @@ too close together. "Bans"). Only decisions of the type `ban` on an address or a netblock are used; any other, such as a captcha or a country, is left out. A decision lasts for the `duration` it had left when the engine answered. This is how a - fleet-wide blocklist can arrive without `discriminator` depending on CrowdSec. - A fetch fails when: + fleet-wide blocklist can arrive without `waf` depending on CrowdSec. A fetch + fails when: - the engine answers other than `200`, a redirect included; - the fetch does not finish within a minute; - the answer is longer than 16 MiB; @@ -1640,8 +1635,8 @@ too close together. DNS blocklists made for mail servers list residential ranges, and would block ordinary visitors, so they should not be used. Spamhaus zones need - their keyed query service, given as a zone name that contains the key. - `discriminator` shows the key as `********` wherever it names the zone. Only + their keyed query service, given as a zone name that contains the key. `waf` + shows the key as `********` wherever it names the zone. Only `reputation.json` keeps the key. `SWW_DNSBL_RESOLVER` names a resolver, since public resolvers are refused by several list operators. @@ -1710,24 +1705,24 @@ percentage for its `asn=` tag in `SWW_TAG_LIMIT_PERCENT` is the response. - an AS number; - the whole service; - a named netblock in `SWW_WATCH_NETS`. -- Every request `discriminator` answers with `allow`, `deny` or `close` is - counted, an allowed one when its report comes. That holds whatever was done - with it, and for clients in `SWW_ALLOW_NETS` and `SWW_RATE_LIMIT_EXEMPT_NETS`, - since an exempt client misbehaving is worth knowing about. The counters are - kept in memory and in `alerts.json`. +- Every request `waf` answers with `allow`, `deny` or `close` is counted, an + allowed one when its report comes. That holds whatever was done with it, and + for clients in `SWW_ALLOW_NETS` and `SWW_RATE_LIMIT_EXEMPT_NETS`, since an + exempt client misbehaving is worth knowing about. The counters are kept in + memory and in `alerts.json`. ## Rule files -`discriminator` reads every `*.rules` file in `SWW_RULES_DIR` and checks each -request against them. `docs/rules.md` gives the format, the targets and actions, -and the default file. +`waf` reads every `*.rules` file in `SWW_RULES_DIR` and checks each request +against them. `docs/rules.md` gives the format, the targets and actions, and the +default file. - The files are plain text meant to be edited by hand, so that a new scanning - pattern seen in the request log becomes a rule in one line. `discriminator` - watches the directory: a file edited, added or removed there takes effect - while it runs. It reads the files again once the directory has had no change - for 2 seconds, so that a file still being written is read whole. A file whose - name starts with `.`, such as an editor's lock file, is not a rule file. + pattern seen in the request log becomes a rule in one line. `waf` watches the + directory: a file edited, added or removed there takes effect while it runs. + It reads the files again once the directory has had no change for 2 seconds, + so that a file still being written is read whole. A file whose name starts + with `.`, such as an editor's lock file, is not a rule file. - Files are read in name order (`00-default.rules` before `50-site.rules`), rules in line order. - A rule's regex is Go's RE2 syntax. It has no backreferences or lookaround; in @@ -1761,21 +1756,20 @@ and the default file. `///src/branch/main/.env.example` is a file in a repository that any visitor may open. Anchor the paths of your own `ban` rules at the site root too. A rule has one target, so a `path` rule applies on every site behind - that `discriminator`. A directory mounted over `SWW_RULES_DIR` replaces the - default file; single files mounted into it add to it. -- Rules meant to be edited while `discriminator` runs belong in a mounted - directory, not a mounted file. Many editors save a file by replacing it, and a - container keeps seeing the old one when the file alone is mounted. The lookup - database is mounted the same way, for the same reason. To run without rule - files, mount an empty directory or set `SWW_RULES_ENABLED=false`. + that `waf`. A directory mounted over `SWW_RULES_DIR` replaces the default + file; single files mounted into it add to it. +- Rules meant to be edited while `waf` runs belong in a mounted directory, not a + mounted file. Many editors save a file by replacing it, and a container keeps + seeing the old one when the file alone is mounted. The lookup database is + mounted the same way, for the same reason. To run without rule files, mount an + empty directory or set `SWW_RULES_ENABLED=false`. ## Persistent state All state lives in memory, and the files in `SWW_STATE_DIR` hold a copy of it, so an orderly stop loses nothing. The files are meant for people as well: an -admin can read or edit them at any time, and the running `discriminator` takes -the edit in. `docs/state-files.md` lists the files, what each holds, and their -sizes. +admin can read or edit them at any time, and the running `waf` takes the edit +in. `docs/state-files.md` lists the files, what each holds, and their sizes. - Each file holds one kind of state, as JSON with: - a top-level `version` number; @@ -1795,8 +1789,8 @@ sizes. held up. It goes to a temporary file in the same directory, which is synced and renamed over the real name, and the directory is synced. A crash at any point leaves either the old complete file or the new complete file, never a - partial one. Before writing a file, `discriminator` takes in any edit made to - it on disk, so an admin's edit is never overwritten. + partial one. Before writing a file, `waf` takes in any edit made to it on + disk, so an admin's edit is never overwritten. - At start, the files are read back. Active bans go into an in-memory lookup by netblock, everything else into maps. Expired cache entries are discarded. A missing file means empty state, and is normal on first run. These stop the @@ -1810,19 +1804,19 @@ sizes. Since writes are atomic, a broken file can only come from a hand edit, which the editor should hear about. -- While running, `discriminator` notices a file that is edited, replaced or - added. It tells its own writes from an admin's by comparing the file with what - it last read or wrote. An edit that parses is taken in at once: what the file - says replaces what `discriminator` held for that file. An edit to `bans.json` - makes, lifts or forgets bans as "Bans" describes. A change `discriminator` - made after the admin opened the file, such as a new ban, is lost when the - admin saves over it. Most editors warn when a file changed on disk while it - was open. A file that is removed is written again at its next write. -- An edit that does not parse never stops the running `discriminator`. It keeps - the state it has and sets the edited file aside as `.bad`, so the edit - is kept. It writes the file again from memory, and names the file and the - position of the error in the log and in one `file_error` alert. The admin - mends the `.bad` file and moves it back. +- While running, `waf` notices a file that is edited, replaced or added. It + tells its own writes from an admin's by comparing the file with what it last + read or wrote. An edit that parses is taken in at once: what the file says + replaces what `waf` held for that file. An edit to `bans.json` makes, lifts or + forgets bans as "Bans" describes. A change `waf` made after the admin opened + the file, such as a new ban, is lost when the admin saves over it. Most + editors warn when a file changed on disk while it was open. A file that is + removed is written again at its next write. +- An edit that does not parse never stops the running `waf`. It keeps the state + it has and sets the edited file aside as `.bad`, so the edit is kept. It + writes the file again from memory, and names the file and the position of the + error in the log and in one `file_error` alert. The admin mends the `.bad` + file and moves it back. - A write that fails leaves the state correct in memory. It is logged, counted in the metrics and sent as one `file_error` alert per cooldown, and retried at the next write. @@ -1833,17 +1827,17 @@ sizes. ## Request log -`rproxy` and `discriminator` each write request lines on stdout, one JSON object -to a line, refused requests included. "The log" says which lines a request gets, -and `docs/request-log.md` lists the fields. Bodies are never logged, and no -header but those listed there. Query strings are logged as received; an app that +`rproxy` and `waf` each write request lines on stdout, one JSON object to a +line, refused requests included. "The log" says which lines a request gets, and +`docs/request-log.md` lists the fields. Bodies are never logged, and no header +but those listed there. Query strings are logged as received; an app that carries secrets in query strings needs that fixed in the app. Each process's own messages (start, the settings, stop, errors) share its stream as JSON lines with `"type":"process"`; request lines carry `"type":"request"`. -When `SWW_LOG_REMOTE_URL` is set, every line `discriminator` writes on stdout is -also sent there as an RFC 5424 syslog record. So a deployment can stop depending -on docker's log handling while `docker logs` keeps working. `rproxy` writes its +When `SWW_LOG_REMOTE_URL` is set, every line `waf` writes on stdout is also sent +there as an RFC 5424 syslog record. So a deployment can stop depending on +docker's log handling while `docker logs` keeps working. `rproxy` writes its lines to stdout only. - Over UDP each record is one datagram; a line too long for one datagram is @@ -1858,26 +1852,26 @@ lines to stdout only. stops stdout. When the buffer is full, the oldest line is dropped and counted in the metrics. A failed connection is tried again a second later, and twice as long after each further failure, up to a minute. -- As `discriminator` stops, it spends at most two seconds sending the lines - still waiting, and drops the rest; stdout has carried them. +- As `waf` stops, it spends at most two seconds sending the lines still waiting, + and drops the rest; stdout has carried them. ## Metrics endpoint -`GET /_sww/metrics`, at `discriminator`'s own address, answers in the Prometheus -text format, for a request carrying `SWW_METRICS_TOKEN`. `docs/metrics.md` lists -the metrics. No metric carries a client IP address as a label. Per-address -questions are answered by the request log and `GET /_sww/clients/`. +`GET /_sww/metrics`, at `waf`'s own address, answers in the Prometheus text +format, for a request carrying `SWW_METRICS_TOKEN`. `docs/metrics.md` lists the +metrics. No metric carries a client IP address as a label. Per-address questions +are answered by the request log and `GET /_sww/clients/`. ## Admin endpoints -`discriminator`'s own endpoints are paths under `/_sww/`, at its own address on -the private network. Admins and the metrics collector reach them there, and -nothing routes the internet to that address. The prefix carries the tool's name, -so it takes no path an app uses. `docs/admin-endpoints.md` lists the endpoints, -what each takes and what each answers. +`waf`'s own endpoints are paths under `/_sww/`, at its own address on the +private network. Admins and the metrics collector reach them there, and nothing +routes the internet to that address. The prefix carries the tool's name, so it +takes no path an app uses. `docs/admin-endpoints.md` lists the endpoints, what +each takes and what each answers. - `GET /_sww/healthz` answers `200` with `ok` to anyone, without a token, while - `discriminator` is running. + `waf` is running. - `POST /_sww/report` takes `rproxy`'s report, without a token (see "The report"). - Every other endpoint needs its token, sent as `Authorization: Bearer ` @@ -1889,20 +1883,19 @@ what each takes and what each answers. - A ban made through the endpoints starts at once. `rproxy` answers `GET /_sww/healthz` itself. It never passes a path under the -prefix to the app (see "Without an answer from `discriminator`"). +prefix to the app (see "Without an answer from `waf`"). -## `discriminator` +## `waf` -`sww discriminator` runs the checks for `sww rproxy`, a small reverse proxy in -front of each app. `rproxy` asks `discriminator` about each visitor's request. -`discriminator` answers `rproxy` and passes nothing to an app itself. One -`discriminator` serves many sites. +`sww waf` runs the checks for `sww rproxy`, a small reverse proxy in front of +each app. `rproxy` asks `waf` about each visitor's request. `waf` answers +`rproxy` and passes nothing to an app itself. One `waf` serves many sites. This section is the agreement between the two. The header names, the fields and the statuses below are exact. -`discriminator` reads the settings, the rule files, the lookup database and the -state files, and listens at `SWW_LISTEN_ADDR`. On `SIGTERM` or `SIGINT` it stops +`waf` reads the settings, the rule files, the lookup database and the state +files, and listens at `SWW_LISTEN_ADDR`. On `SIGTERM` or `SIGINT` it stops taking requests and gives those in progress five seconds to finish. It then writes the state files. @@ -1936,32 +1929,32 @@ comes with a `Content-Length` of the part it carries. `rproxy` sets these headers, replacing any the visitor sent, and adds no others: - `X-Sww-Client`: the visitor's address, which `rproxy` has worked out, without - any IPv6 zone. `discriminator` takes it as the client, and groups an IPv6 - address as "What happens to a request" says. + any IPv6 zone. `waf` takes it as the client, and groups an IPv6 address as + "What happens to a request" says. - `X-Sww-Peer`: the address of `rproxy`'s own TCP peer, for the log line's `peer_ip`. - `X-Sww-Content-Length`: the body length the visitor announced. It is absent when the visitor announced none. - `X-Request-ID`: the request's id, which `rproxy` makes fresh for every request - when it arrives. `discriminator` takes it as given and never makes one. + when it arrives. `waf` takes it as given and never makes one. - `X-Forwarded-Proto`: the scheme. -Before any check, `discriminator` removes the three `X-Sww-` headers. It also -sets `Content-Length` to the length the visitor announced, or removes it. So the -rule files and the Core Rule Set see the headers the visitor sent, with -`rproxy`'s `X-Request-ID` and `X-Forwarded-Proto`. +Before any check, `waf` removes the three `X-Sww-` headers. It also sets +`Content-Length` to the length the visitor announced, or removes it. So the rule +files and the Core Rule Set see the headers the visitor sent, with `rproxy`'s +`X-Request-ID` and `X-Forwarded-Proto`. -`discriminator` refuses a question with `400` when: +`waf` refuses a question with `400` when: - `X-Sww-Client` is not an address, or is an address with a zone, such as `2001:db8::1%eth0`; - `X-Request-ID` is absent, empty, over 128 bytes or not valid UTF-8; -- `X-Request-ID` is the id of a question `discriminator` is still handling, or - of a request it holds (see "The report"); +- `X-Request-ID` is the id of a question `waf` is still handling, or of a + request it holds (see "The report"); - the body is over 64 KiB. -For a refused question, `discriminator` writes a process warning. It runs no -check, writes no request log line and counts nothing in the metrics. +For a refused question, `waf` writes a process warning. It runs no check, writes +no request log line and counts nothing in the metrics. These do not refuse a question: @@ -1969,19 +1962,17 @@ These do not refuse a question: `invalid IP`. - `X-Sww-Content-Length` not a whole number, or negative: it counts as absent. - `X-Forwarded-Proto` absent: the log line's `scheme` is `http`. -- One of the five headers above sent more than once: `discriminator` uses its - first value. +- One of the five headers above sent more than once: `waf` uses its first value. -`discriminator` reads the whole body before any check. A question whose body -stops arriving gets no answer. `discriminator` closes the connection once the 60 -seconds below run out, or as soon as `rproxy` closes its side. It writes a -process warning, runs no check, writes no request log line and counts nothing in -the metrics. +`waf` reads the whole body before any check. A question whose body stops +arriving gets no answer. `waf` closes the connection once the 60 seconds below +run out, or as soon as `rproxy` closes its side. It writes a process warning, +runs no check, writes no request log line and counts nothing in the metrics. ### The answer -`discriminator` runs steps 3 to 16 of "What happens to a request", in that -order. Every answer but the last below carries `X-Sww-Disposition`. +`waf` runs steps 3 to 16 of "What happens to a request", in that order. Every +answer but the last below carries `X-Sww-Disposition`. - `X-Sww-Disposition: allow`, status `200`, no body. `rproxy` passes the request to the app. With `SWW_ADD_LOOKUP_HEADERS` the answer also carries @@ -1998,9 +1989,9 @@ order. Every answer but the last below carries `X-Sww-Disposition`. - `X-Sww-Disposition: close`, status `200`, no body. This takes the place of a refusal while `SWW_BAN_RESPONSE` is `close`. `rproxy` closes the visitor's connection without an answer. -- No such header, status `400`, for a question `discriminator` refuses. `rproxy` - gives the visitor its status, headers and body, as it does for any answer - without a valid `X-Sww-Disposition`. +- No such header, status `400`, for a question `waf` refuses. `rproxy` gives the + visitor its status, headers and body, as it does for any answer without a + valid `X-Sww-Disposition`. In `observe` mode a request that `enforce` mode would refuse is answered `allow`, and its log line has `would_action`. A path under `/_sww/` is still @@ -2013,10 +2004,10 @@ short. ### Answering in time -`rproxy` stops waiting for `discriminator` after `SWRP_TIMEOUT_MS`, by default 2 -seconds, and `SWRP_DEFAULT_DISPOSITION` then decides. The longest a question -waits on an outside source is `SWW_LOOKUP_TIMEOUT`, by default 800 milliseconds, -well within that time. +`rproxy` stops waiting for `waf` after `SWRP_TIMEOUT_MS`, by default 2 seconds, +and `SWRP_DEFAULT_DISPOSITION` then decides. The longest a question waits on an +outside source is `SWW_LOOKUP_TIMEOUT`, by default 800 milliseconds, well within +that time. GeoJS is the only outside source a question can wait on. A question waits only when step 6 says so, and for at most `SWW_LOOKUP_TIMEOUT`, by default 800 @@ -2051,8 +2042,8 @@ still wait for GeoJS: - a rule file; - the Core Rule Set. -The header limits are fixed, with no setting. `discriminator` refuses a request -over either one: +The header limits are fixed, with no setting. `waf` refuses a request over +either one: - more than 50 cookies. Each part of its `Cookie` headers between semicolons counts as one, unless it is empty or only spaces and tabs. @@ -2072,16 +2063,15 @@ does not read it. The Core Rule Set runs each of its rules on each cookie, so thousands of small cookies would keep it busy for over a second. Within the limits, one long cookie or query string can still keep it busy for a fraction of a second. So enough -such requests at once can overload `discriminator` past `SWRP_TIMEOUT_MS`. +such requests at once can overload `waf` past `SWRP_TIMEOUT_MS`. ### The report Once the visitor's answer has ended, `rproxy` sends `POST /_sww/report` for each -request `discriminator` answered with `allow`, `deny` or `close`. It sends none -after: +request `waf` answered with `allow`, `deny` or `close`. It sends none after: - an answer without a valid `X-Sww-Disposition`, such as a `400`; -- an answer it cannot pass on (see "Without an answer from `discriminator`"); +- an answer it cannot pass on (see "Without an answer from `waf`"); - no answer. The report carries no `X-Sww-Client`. Its body is one JSON object with all of @@ -2098,7 +2088,7 @@ these fields, named as the request log's fields of the same meaning: the end of the answer, in the same range, and `0` for a request not passed to the app. -`discriminator` answers `400` and writes a process warning when the body: +`waf` answers `400` and writes a process warning when the body: - is not one JSON object, such as `null`, or an object followed by other data; - lacks one of these fields, or gives it as `null`; @@ -2109,8 +2099,8 @@ It answers `204` to any other report, also for a request it does not hold, which it ignores. It ignores a field not listed here. `rproxy` does not act on the answer. -For a request it holds, `discriminator` writes the request's last log line (see -"The log"). For a request it allowed, it first: +For a request it holds, `waf` writes the request's last log line (see "The +log"). For a request it allowed, it first: - counts the body bytes `SWW_BYTES_COUNT` names, toward the client's byte limits at the percentages it gave that request; @@ -2121,36 +2111,36 @@ For a request it holds, `discriminator` writes the request's last log line (see A denied request's counting is finished at its decision, so its report counts nothing. -`discriminator` holds each answered request until its report comes, up to 10,000 -requests. Past that, the request answered longest ago is dropped. A request -whose report never comes gets no last log line. If it was allowed, it is in -neither the client's history nor the metrics, and its bytes are not counted. +`waf` holds each answered request until its report comes, up to 10,000 requests. +Past that, the request answered longest ago is dropped. A request whose report +never comes gets no last log line. If it was allowed, it is in neither the +client's history nor the metrics, and its bytes are not counted. -`discriminator` holds only the decision's log line and what counting needs. It -never holds the request or response objects, and no `Authorization` or `Cookie`. -A report reaches only what is held, so it can never reach a question still being -handled. `discriminator` ignores a report naming such a question. +`waf` holds only the decision's log line and what counting needs. It never holds +the request or response objects, and no `Authorization` or `Cookie`. A report +reaches only what is held, so it can never reach a question still being handled. +`waf` ignores a report naming such a question. ### The log -A request `discriminator` answers with `allow`, `deny` or `close` gets three -request log lines, joined by `request_id`: +A request `waf` answers with `allow`, `deny` or `close` gets three request log +lines, joined by `request_id`: - `rproxy`'s short line; -- `discriminator`'s line at its decision; -- `discriminator`'s line when the report comes, with everything known: the - decision line's fields and the report's together. +- `waf`'s line at its decision; +- `waf`'s line when the report comes, with everything known: the decision line's + fields and the report's together. -The repetition is intended. The field `discriminator_line` says which of -`discriminator`'s two lines a line is. A request `discriminator` is not asked -about, such as the health check, gets only `rproxy`'s line. A request without a -report gets no third line. `docs/request-log.md` gives the fields. +The repetition is intended. The field `waf_line` says which of `waf`'s two lines +a line is. A request `waf` is not asked about, such as the health check, gets +only `rproxy`'s line. A request without a report gets no third line. +`docs/request-log.md` gives the fields. -### `discriminator`'s own endpoints +### `waf`'s own endpoints -A request without `X-Sww-Client` is for `discriminator` itself, at its own -address on the private network. The internet must not be able to reach that -address. Its endpoints are: +A request without `X-Sww-Client` is for `waf` itself, at its own address on the +private network. The internet must not be able to reach that address. Its +endpoints are: - the health check, the metrics, and the ban and client endpoints, as `docs/admin-endpoints.md` lists them, with their tokens; @@ -2161,66 +2151,61 @@ Anything else gets `404`. No check runs on these requests, since their peers are private network can send one or ask a question. A request and its answer have 60 seconds together, from the request's headers. -`discriminator` closes a connection idle for 120 seconds. It takes a request -line and headers up to 1 MiB, Go's default, so that it never refuses a question -for the size of a visitor's headers. +`waf` closes a connection idle for 120 seconds. It takes a request line and +headers up to 1 MiB, Go's default, so that it never refuses a question for the +size of a visitor's headers. ### Sites -One `discriminator` keeps one table of clients, counters and bans for every site -that asks it. A client banned through one site is refused on all of them, and -its requests on all of them count toward one set of limits. Log lines, alerts -raised by a request and ban notes name the site by its host. +One `waf` keeps one table of clients, counters and bans for every site that asks +it. A client banned through one site is refused on all of them, and its requests +on all of them count toward one set of limits. Log lines, alerts raised by a +request and ban notes name the site by its host. `docs/metrics.md` says how its metrics count. ## `rproxy` -`sww rproxy` is the reverse proxy in front of one app. It asks `discriminator` -about each request, and passes on what `discriminator` allows. It keeps nothing -between requests and never touches disk. When `discriminator` cannot be -connected to, does not answer at all, or does not answer within -`SWRP_TIMEOUT_MS`, `SWRP_DEFAULT_DISPOSITION` decides. Its default, `allow`, -keeps the site answering. +`sww rproxy` is the reverse proxy in front of one app. It asks `waf` about each +request, and passes on what `waf` allows. It keeps nothing between requests and +never touches disk. When `waf` cannot be connected to, does not answer at all, +or does not answer within `SWRP_TIMEOUT_MS`, `SWRP_DEFAULT_DISPOSITION` decides. +Its default, `allow`, keeps the site answering. `rproxy` reads only its `SWRP_` settings, which `docs/settings.md` lists. One of -them is required: `SWRP_WAF_BACKEND`, `discriminator`'s URL. It has no metrics, -no rule files and no state files, and it writes its lines to stdout only. The -image runs it by default (see "Deployment"). +them is required: `SWRP_WAF_BACKEND`, `waf`'s URL. It has no metrics, no rule +files and no state files, and it writes its lines to stdout only. The image runs +it by default (see "Deployment"). ### What `rproxy` does with a request -1. `GET /_sww/healthz` is answered `ok` at once, without asking `discriminator`. +1. `GET /_sww/healthz` is answered `ok` at once, without asking `waf`. 2. `rproxy` works out the visitor's address. It believes `X-Forwarded-For` only from `SWRP_TRUSTED_PROXIES`, and reads it as step 2 of "What happens to a request" says. It removes any IPv6 zone. -3. It makes a fresh request id, whatever id the request came with. - `discriminator` and the app get it as `X-Request-ID`, and `rproxy`'s log line - gives it. +3. It makes a fresh request id, whatever id the request came with. `waf` and the + app get it as `X-Request-ID`, and `rproxy`'s log line gives it. 4. It refuses a request with a method it does not pass on, or one it cannot put - to `discriminator` as the visitor sent it (see "Requests `rproxy` refuses - itself"). + to `waf` as the visitor sent it (see "Requests `rproxy` refuses itself"). 5. It reads up to the first 64 KiB of the body into memory. -6. It sends `discriminator` the question (see "The question"). It speaks - HTTP/1.1 to `discriminator`, whatever `discriminator` offers. Go's HTTP/2 - client would refuse to send a visitor's `Upgrade` header, and most - `Connection` headers. The question never carries the visitor's `Trailer`. +6. It sends `waf` the question (see "The question"). It speaks HTTP/1.1 to + `waf`, whatever `waf` offers. Go's HTTP/2 client would refuse to send a + visitor's `Upgrade` header, and most `Connection` headers. The question never + carries the visitor's `Trailer`. 7. It does what the answer says (see "The answer"): - `allow`: it passes the request to the app. - `close`: it closes the visitor's connection without an answer. - Any other answer: the visitor gets its status, headers and body, less - `X-Sww-Disposition`. That holds for a `deny`, for an error such as - `discriminator`'s `400` or a `5xx`, and for an answer without a valid - `X-Sww-Disposition`. + `X-Sww-Disposition`. That holds for a `deny`, for an error such as `waf`'s + `400` or a `5xx`, and for an answer without a valid `X-Sww-Disposition`. 8. Once the answer has ended, it writes its log line. `docs/request-log.md` gives the fields. An app's answer can end just after the line: Go's server sends the closing chunk of a chunked answer, and may send all of an empty one, only once `rproxy` has finished with the request. -9. It then sends the report, if `discriminator` answered `allow`, `deny` or - `close` (see "The report"). The visitor does not wait for it. A report that - fails is dropped, with a process warning. A status above `599` from the app - goes to the visitor as it is, and into the report as `599`, the highest - `discriminator` takes. +9. It then sends the report, if `waf` answered `allow`, `deny` or `close` (see + "The report"). The visitor does not wait for it. A report that fails is + dropped, with a process warning. A status above `599` from the app goes to + the visitor as it is, and into the report as `599`, the highest `waf` takes. ### Requests `rproxy` refuses itself @@ -2274,10 +2259,10 @@ Go's HTTP server answers `OPTIONS *` itself, before `rproxy` sees it. goes away or stops its sending side. There is no question and no report, and the log line has status `0`. -### Without an answer from `discriminator` +### Without an answer from `waf` `SWRP_DEFAULT_DISPOSITION` decides what is done with the request only when -`discriminator`: +`waf`: - cannot be connected to; - does not answer at all; @@ -2290,10 +2275,10 @@ An answer whose body breaks off counts as no answer at all. Either way `rproxy` writes a process warning, its log line has `default_disposition`, and it sends no report. -A visitor can make `discriminator` slow. A request that keeps `discriminator` -busy past `SWRP_TIMEOUT_MS`, like any request while `discriminator` is -overloaded, gets `SWRP_DEFAULT_DISPOSITION`. With `deny`, such a request gets -`503` instead of reaching the app. +A visitor can make `waf` slow. A request that keeps `waf` busy past +`SWRP_TIMEOUT_MS`, like any request while `waf` is overloaded, gets +`SWRP_DEFAULT_DISPOSITION`. With `deny`, such a request gets `503` instead of +reaching the app. A path under `/_sww/` that `allow` would pass on is answered `404` instead, so that the app never sees that prefix. @@ -2303,9 +2288,9 @@ below `200`. The visitor gets `502` from `rproxy`, never the default. `rproxy` writes a process warning, its log line has no `disposition`, and it sends no report. -A visitor that goes away while `discriminator` is being asked is no failure of -`discriminator`. `rproxy` closes the connection, with no warning, no default and -no report. Its log line has status `0` and no `disposition`. +A visitor that goes away while `waf` is being asked is no failure of `waf`. +`rproxy` closes the connection, with no warning, no default and no report. Its +log line has status `0` and no `disposition`. ### Passing a request to the app @@ -2328,9 +2313,9 @@ but for these headers: the host it asked for, and `X-Forwarded-Proto` plain `http`. The other headers in which traefik tells an app about a visitor are removed. - `X-Request-ID`, which carries the fresh id. -- `X-Client-ASN` and `X-Client-Country`, which carry what `discriminator` - answered. A header it did not give is left out. Any of the two the visitor - sent is removed. +- `X-Client-ASN` and `X-Client-Country`, which carry what `waf` answered. A + header it did not give is left out. Any of the two the visitor sent is + removed. - The headers that concern only the connection to `rproxy` never reach the app: - `Connection`, and any header it names; - `Keep-Alive`; @@ -2340,7 +2325,7 @@ but for these headers: - `Te`, though one holding `trailers` goes on as `Te: trailers`; - `Upgrade`. -A chunked body's trailers reach the app, but not `discriminator`. +A chunked body's trailers reach the app, but not `waf`. A WebSocket upgrade passes through, with `Connection: Upgrade` and its `Upgrade`. The report of a WebSocket comes when it closes, with what it carried @@ -2354,7 +2339,7 @@ These limits apply per request, in both directions: - `SWRP_MAX_RESPONSE_SIZE` is the largest response body. - `SWRP_MAX_REQUEST_TIME_MS` bounds the request line and headers. From their end, it then bounds the time until the app has been sent the whole request. - The wait for `discriminator` counts toward it. + The wait for `waf` counts toward it. - `SWRP_MAX_RESPONSE_TIME_MS` runs from the end of the request to the last byte of the answer reaching the visitor. The request ends when the app has been sent all of it, or when the app's answer arrives if that is sooner. An answer @@ -2379,12 +2364,11 @@ What the visitor gets when a limit is passed: the connection, nothing reaches the app, and the request log gets no line. - A visitor too slow to send the first 64 KiB of its body is answered `408`, with no question and no report. -- `rproxy` applies the request size limit only after `discriminator` has allowed - the request. So a request `discriminator` denies gets `discriminator`'s - answer, whatever its size. A request `discriminator` allows is answered `413` - when its body is over the limit: at once for a length it announced, otherwise - when the limit is reached. If part of the body has gone to the app by then, - the request to the app is cut off. +- `rproxy` applies the request size limit only after `waf` has allowed the + request. So a request `waf` denies gets `waf`'s answer, whatever its size. A + request `waf` allows is answered `413` when its body is over the limit: at + once for a length it announced, otherwise when the limit is reached. If part + of the body has gone to the app by then, the request to the app is cut off. - A limit passed after that, but before the response has started, is answered by `rproxy`: - `408` for a visitor too slow to send the rest of its body; @@ -2413,9 +2397,8 @@ such as that of a WebSocket that closes later. ## Deployment One image runs either command. `SWW_COMMAND`, in a container's environment, -chooses: `discriminator` runs `discriminator`, and with it unset the image runs -`rproxy`. `docs/image.md` lists what the image holds and how each part is -pinned. +chooses: `waf` runs `waf`, and with it unset the image runs `rproxy`. +`docs/image.md` lists what the image holds and how each part is pinned. ### The usual setup @@ -2423,22 +2406,20 @@ The usual setup is three containers on one private network: - the app; - `rproxy`, which traefik routes to, with `SWRP_UPSTREAM_URL` naming the app and - `SWRP_WAF_BACKEND` naming `discriminator`; -- `discriminator`, with `SWW_COMMAND=discriminator` and a volume for its state - files. + `SWRP_WAF_BACKEND` naming `waf`; +- `waf`, with `SWW_COMMAND=waf` and a volume for its state files. Each further app adds its own container and its own `rproxy`, whose -`SWRP_WAF_BACKEND` names the same `discriminator` (see "Sites"). Anything on -that network can reach an app around `rproxy`, and can ask `discriminator` -questions or send it reports. So the network holds only what you trust. +`SWRP_WAF_BACKEND` names the same `waf` (see "Sites"). Anything on that network +can reach an app around `rproxy`, and can ask `waf` questions or send it +reports. So the network holds only what you trust. ### `rproxy` in the app's container An app's Dockerfile can build `FROM` the `smallwebwaf` image instead, so that `rproxy` runs beside the app in one container. The app is then hardened by -changing its base image, and can add packages from nixpkgs. `discriminator` -still runs in a container of its own, and the app's container sets -`SWRP_WAF_BACKEND`. +changing its base image, and can add packages from nixpkgs. `waf` still runs in +a container of its own, and the app's container sets `SWRP_WAF_BACKEND`. Beyond its `FROM` line, the app's Dockerfile adds: @@ -2460,10 +2441,9 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start moves to the next LTS release when that ships. Its packages come from Ubuntu's archive, whose packages change with every update. - The Ubuntu image has no CA certificates. Without them Nix cannot download - packages and `discriminator` cannot reach GeoJS, so `ca-certificates` is - installed by name. apt fetches the packages over plain HTTP and checks each - one against the archive's signed package lists, so the install needs no CA - certificates. + packages and `waf` cannot reach GeoJS, so `ca-certificates` is installed by + name. apt fetches the packages over plain HTTP and checks each one against the + archive's signed package lists, so the install needs no CA certificates. - nixpkgs comes from a release file on `releases.nixos.org`, named with its hash, not from a GitHub archive, whose bytes can change. Root uses Nix directly; no Nix daemon runs. `nix-bin` creates no build users, so @@ -2481,13 +2461,12 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start writes. `runsvinit` starts runit's `runsvdir`, which runs the `run` script of each directory under `/etc/service`. Ubuntu's `sv` looks for services there too. -- The image's `run` script is `/etc/service/sww/run`. It starts `discriminator` - when `SWW_COMMAND` is `discriminator`, and `rproxy` when it is `rproxy`, unset - or empty. It runs either as the `sww` user (uid and gid 65532), with runit's - `chpst`. For `discriminator`, it first makes `SWW_STATE_DIR` and every file in - it belong to that user. For `rproxy` it changes no owner. With any other - value, it starts nothing, and stops with a message naming `SWW_COMMAND` and - its value. +- The image's `run` script is `/etc/service/sww/run`. It starts `waf` when + `SWW_COMMAND` is `waf`, and `rproxy` when it is `rproxy`, unset or empty. It + runs either as the `sww` user (uid and gid 65532), with runit's `chpst`. For + `waf`, it first makes `SWW_STATE_DIR` and every file in it belong to that + user. For `rproxy` it changes no owner. With any other value, it starts + nothing, and stops with a message naming `SWW_COMMAND` and its value. Every `run` script, the app's included, is a bash script. It starts with `#!/usr/bin/env bash` and `set -euo pipefail`, and puts its code in a `main` @@ -2504,10 +2483,9 @@ process that stops at start is started again every second, not in a tight loop. - When a service exits, runit runs its `run` script again, and the container does not stop. Beside an app, the other process keeps running. - While `rproxy` is down, traefik answers `502`. While the app is down, `rproxy` - answers `502`, which is not a client offence. While `discriminator` is down, - `SWRP_DEFAULT_DISPOSITION` decides (see "Without an answer from - `discriminator`"). -- Only faults found at start stop `discriminator`: + answers `502`, which is not a client offence. While `waf` is down, + `SWRP_DEFAULT_DISPOSITION` decides (see "Without an answer from `waf`"). +- Only faults found at start stop `waf`: - invalid configuration; - a lookup database that is missing or unreadable; - a rule file or state file that does not parse; @@ -2519,11 +2497,10 @@ process that stops at start is started again every second, not in a tight loop. - A process that stops at start logs its message at each try until the cause is fixed; its container's health check fails meanwhile. Once running, a failing GeoJS, reputation source or alert destination, or a broken edit, never takes - `discriminator` down. + `waf` down. - `docker stop` sends `SIGTERM` to `runsvinit`, which has runit stop every service at once, each with `SIGTERM`, and exits once they have stopped. - `rproxy` and `discriminator` then stop as "`rproxy`" and "`discriminator`" - say. + `rproxy` and `waf` then stop as "`rproxy`" and "`waf`" say. - With `rproxy` beside the app, an app that exits at once on `SIGTERM` ends the requests in progress: the visitor gets `502`, or a response cut short. To let them finish, the app must keep answering for five seconds after `SIGTERM`. @@ -2535,12 +2512,12 @@ process that stops at start is started again every second, not in a tight loop. The image's `HEALTHCHECK` runs `sww healthcheck`. `SWW_COMMAND` says what it checks: -- With `SWW_COMMAND=discriminator`, it passes while `discriminator` answers - `GET /_sww/healthz` on `127.0.0.1`, at the port in `SWW_LISTEN_ADDR`. +- With `SWW_COMMAND=waf`, it passes while `waf` answers `GET /_sww/healthz` on + `127.0.0.1`, at the port in `SWW_LISTEN_ADDR`. - With `SWW_COMMAND` unset, empty or `rproxy`, it passes while `rproxy` answers that request on `127.0.0.1`, at the port in `SWRP_LISTEN_ADDR`, and the app - accepts connections at `SWRP_UPSTREAM_URL`. It does not ask `discriminator`, - so that the site stays in traefik's routes while `discriminator` is down. + accepts connections at `SWRP_UPSTREAM_URL`. It does not ask `waf`, so that the + site stays in traefik's routes while `waf` is down. - With any other value, it fails with a message naming `SWW_COMMAND` and its value. @@ -2558,8 +2535,8 @@ follows the setting, and traefik's port label (`traefik.http.services..loadbalancer.server.port`) must name it. An app beside `rproxy` must leave that port free. -`discriminator` listens on no port but the one in `SWW_LISTEN_ADDR`, 8080 by -default. The questions, the reports and its own endpoints all come there. +`waf` listens on no port but the one in `SWW_LISTEN_ADDR`, 8080 by default. The +questions, the reports and its own endpoints all come there. The address part of either setting stays empty (`:9000`, never `127.0.0.1:9000`). That way the others reach the process on the container's @@ -2571,11 +2548,11 @@ the container. ### State -`discriminator` keeps its state files in `SWW_STATE_DIR`, belonging to the `sww` -user. Without a volume there, the files survive a restart of the container and -are lost when a deploy replaces it. A volume mounted at `/var/lib/sww`, named or -a host directory, keeps them across deploys. A host directory mounted there -needs no change of owner, and files an earlier owner left in it can be read and +`waf` keeps its state files in `SWW_STATE_DIR`, belonging to the `sww` user. +Without a volume there, the files survive a restart of the container and are +lost when a deploy replaces it. A volume mounted at `/var/lib/sww`, named or a +host directory, keeps them across deploys. A host directory mounted there needs +no change of owner, and files an earlier owner left in it can be read and replaced. The volume holds a few tens of MiB at most with the defaults, and needs no backup beyond the host's own. The image declares no volume, since every app image built on it would inherit it. `rproxy` keeps nothing, and needs no @@ -2586,8 +2563,8 @@ volume. A token given as a file (`SWW_ADMIN_TOKEN_FILE`, `SWW_METRICS_TOKEN_FILE`) stays out of the container's environment. The operator makes the file on the host, owned by uid 65532, the `sww` user, with mode `0400`, and mounts the directory -that holds it into `discriminator`'s container read-only. The container sees the -same owner and mode. "Settings given as files" in `docs/settings.md` shows the +that holds it into `waf`'s container read-only. The container sees the same +owner and mode. "Settings given as files" in `docs/settings.md` shows the commands. ### Forwarded headers @@ -2611,9 +2588,9 @@ upaas rebuilds and restarts an app's Docker container when its repository changes. An app it deploys takes the shape of "`rproxy` in the app's container" with no change to upaas. upaas builds the app's Dockerfile and runs the one container as it runs any app. The traefik labels route to port 8080, and the -`SWRP_` settings go with the app's environment variables. `discriminator` runs -in a container of its own, on a network the app's container can reach, with its -state volume and the directory of any token file. +`SWRP_` settings go with the app's environment variables. `waf` runs in a +container of its own, on a network the app's container can reach, with its state +volume and the directory of any token file. ## Planned, not built diff --git a/cmd/sww/main.go b/cmd/sww/main.go index c527578..97e0dc7 100644 --- a/cmd/sww/main.go +++ b/cmd/sww/main.go @@ -1,6 +1,6 @@ // Command sww is a web application firewall. `sww rproxy` is the reverse -// proxy in front of one app, which asks discriminator about each request. -// `sww discriminator` decides, for many sites, and keeps what lasts. `sww +// proxy in front of one app, which asks waf about each request. +// `sww waf` decides, for many sites, and keeps what lasts. `sww // healthcheck` is the container's health check. Everything it does is in // internal/sww. package main diff --git a/docs/admin-endpoints.md b/docs/admin-endpoints.md index c1f31da..ab674a7 100644 --- a/docs/admin-endpoints.md +++ b/docs/admin-endpoints.md @@ -1,8 +1,8 @@ # Admin endpoints -The endpoints under `/_sww/`, what each takes and what each answers. -`sww discriminator` answers them at its own address, on the private network. -"Admin endpoints" in [`SPEC.md`](../SPEC.md) says how their tokens work. +The endpoints under `/_sww/`, what each takes and what each answers. `sww waf` +answers them at its own address, on the private network. "Admin endpoints" in +[`SPEC.md`](../SPEC.md) says how their tokens work. - `GET /_sww/healthz`: `200` and `ok`, to anyone. - `GET /_sww/metrics`: the metrics, for `SWW_METRICS_TOKEN` (see @@ -20,10 +20,10 @@ The endpoints under `/_sww/`, what each takes and what each answers. - one that names an IPv4-mapped netblock, or an address with a zone. - `DELETE /_sww/bans/`: lifts every active ban covering the address ``. It answers `404` when none is active. -- `GET /_sww/clients/`: what `discriminator` knows of the client. Under - `client`, its counters and history as `clients.json` holds them, or `null` - when `clients.json` does not hold it. Under `bans`, every ban covering the - address, with its notes. +- `GET /_sww/clients/`: what `waf` knows of the client. Under `client`, its + counters and history as `clients.json` holds them, or `null` when + `clients.json` does not hold it. Under `bans`, every ban covering the address, + with its notes. - `POST /_sww/report`: takes `rproxy`'s report, without a token. It answers `204`, or `400` to a body that is no report (see "The report" in [`SPEC.md`](../SPEC.md)). @@ -32,29 +32,29 @@ No check runs on these requests. A missing or wrong token is answered `401`. An endpoint whose token is unset answers `404`, as does any other path. `sww rproxy` answers only the health check of these, at its own address. It asks -`discriminator` about any other request under `/_sww/`. One that passes the -checks is answered `404`, so that the app never sees that prefix (see "`rproxy`" -in [`SPEC.md`](../SPEC.md)). +`waf` about any other request under `/_sww/`. One that passes the checks is +answered `404`, so that the app never sees that prefix (see "`rproxy`" in +[`SPEC.md`](../SPEC.md)). ## Examples -With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `discriminator` reached -as `discriminator:8080` on its network: +With `SWW_ADMIN_TOKEN` set, the token in `$TOKEN`, and `waf` reached as +`waf:8080` on its network: ```sh # Every ban. -curl -H "Authorization: Bearer $TOKEN" http://discriminator:8080/_sww/bans +curl -H "Authorization: Bearer $TOKEN" http://waf:8080/_sww/bans # Ban 203.0.113.0/24 for seven days. curl -H "Authorization: Bearer $TOKEN" \ --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \ - http://discriminator:8080/_sww/bans + http://waf:8080/_sww/bans # Lift the bans on 203.0.113.9. curl -H "Authorization: Bearer $TOKEN" -X DELETE \ - http://discriminator:8080/_sww/bans/203.0.113.9 + http://waf:8080/_sww/bans/203.0.113.9 -# What discriminator knows of 203.0.113.9. +# What waf knows of 203.0.113.9. curl -H "Authorization: Bearer $TOKEN" \ - http://discriminator:8080/_sww/clients/203.0.113.9 + http://waf:8080/_sww/clients/203.0.113.9 ``` diff --git a/docs/alerts.md b/docs/alerts.md index 0f321ed..98d2f2d 100644 --- a/docs/alerts.md +++ b/docs/alerts.md @@ -6,7 +6,7 @@ back or dropped. ## Events -- `ban`: a ban `discriminator` made. +- `ban`: a ban `waf` made. - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by a request. - `core_rule_set_match`: the Core Rule Set scored a request at or over the @@ -34,7 +34,7 @@ on one line: ```json { - "instance": "fsn1/discriminator", + "instance": "fsn1/waf", "time": "2026-10-06T12:00:50.123461Z", "event": "ban", "host": "app.example", @@ -79,9 +79,8 @@ on one line: - `instance`: `SWW_INSTANCE_NAME`. `time`: when the alert was raised. `event`: one of the events above. -- `host`: the site of the request that raised the alert, since one - `discriminator` serves many sites. It is left out of `source_failure`, - `file_error` and `summary`. +- `host`: the site of the request that raised the alert, since one `waf` serves + many sites. It is left out of `source_failure`, `file_error` and `summary`. - `client`: the address whose request raised the alert. Empty for `source_failure`, `file_error` and `summary`. - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise @@ -111,8 +110,8 @@ on one line: ## Slack and ntfy Slack and ntfy get a message with a title and a text. The title is the instance -and the event, such as `fsn1/discriminator: ban`. The text is the `reason`, then -one line for each of these that the alert has: +and the event, such as `fsn1/waf: ban`. The text is the `reason`, then one line +for each of these that the alert has: - the host, the client, the netblock and the country; - the file, the source, the error and the mode from `detail`; diff --git a/docs/image.md b/docs/image.md index 4f9bf09..3928693 100644 --- a/docs/image.md +++ b/docs/image.md @@ -1,9 +1,9 @@ # What the image holds The contents of the `smallwebwaf` image, and how each part is pinned. The image -runs `rproxy` by default, or `discriminator` with `SWW_COMMAND=discriminator`. -"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it -is pinned that way. +runs `rproxy` by default, or `waf` with `SWW_COMMAND=waf`. "Deployment" in +[`SPEC.md`](../SPEC.md) says why each part is there and why it is pinned that +way. ## Contents @@ -18,8 +18,8 @@ is pinned that way. - The `sww` binary, and the user `sww` (uid and gid 65532). - The service directory `/etc/service/sww`, with the `run` script `share/sww.run`. -- `/var/lib/sww` for `discriminator`'s state files, and `/etc/sww/rules.d` with - the default rule file `share/rules.d/00-default.rules`. +- `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the + default rule file `share/rules.d/00-default.rules`. - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`. ## Pins diff --git a/docs/metrics.md b/docs/metrics.md index d17d057..ccd4cd5 100644 --- a/docs/metrics.md +++ b/docs/metrics.md @@ -1,8 +1,8 @@ # The metrics -What `GET /_sww/metrics` answers with, at `discriminator`'s own address. -"Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus -keeps the `instance` label as `exported_instance` unless the scrape sets +What `GET /_sww/metrics` answers with, at `waf`'s own address. "Metrics +endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps +the `instance` label as `exported_instance` unless the scrape sets `honor_labels: true`. `rproxy` has no metrics. Every `sww_*request_bytes_total` and `sww_*response_bytes_total` series counts @@ -15,7 +15,7 @@ body bytes, never headers, whatever `SWW_BYTES_COUNT` says. - `sww_request_duration_seconds` and `sww_upstream_duration_seconds`, as histograms; - `sww_requests_in_flight`: the questions and requests to its own endpoints that - `discriminator` is handling. + `waf` is handling. ## Limits and bans @@ -78,8 +78,8 @@ By `file`: ## When a request is counted -`discriminator` counts a denied request at its decision, and a request to its -own endpoints when it is answered. It counts an allowed request when its report +`waf` counts a denied request at its decision, and a request to its own +endpoints when it is answered. It counts an allowed request when its report comes, with the status, bytes and times the report gives. These are not counted: - a report itself; diff --git a/docs/request-log.md b/docs/request-log.md index bafd9c0..c72ea14 100644 --- a/docs/request-log.md +++ b/docs/request-log.md @@ -1,32 +1,32 @@ # The request log's fields -The fields of the JSON objects `rproxy` and `discriminator` write about each -request. "Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line -is written and how the log is sent to a syslog server. A field that does not -apply to a request is left out. +The fields of the JSON objects `rproxy` and `waf` write about each request. +"Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line is +written and how the log is sent to a syslog server. A field that does not apply +to a request is left out. -## `discriminator`'s lines +## `waf`'s lines -`sww discriminator` writes two lines for each question it answers, joined by -`request_id`. The field `discriminator_line` says which of the two a line is: +`sww waf` writes two lines for each question it answers, joined by `request_id`. +The field `waf_line` says which of the two a line is: - `decision`: the line it writes once it has answered the question; - `report`: the line it writes when `rproxy`'s report comes, with everything known. The repetition is intended. -A request to its own endpoints writes one line, without `discriminator_line`. A -report writes no line but the `report` line of the request it names. +A request to its own endpoints writes one line, without `waf_line`. A report +writes no line but the `report` line of the request it names. These questions write no line: -- a question refused with `400` (see "The question" under "`discriminator`" in +- a question refused with `400` (see "The question" under "`waf`" in [`SPEC.md`](../SPEC.md)); - a question whose body stopped arriving, which gets no answer. A `report` line: ``` -{"type":"request","discriminator_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/discriminator","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"core_rule_set_score":0,"duration_total_ms":3.217,"duration_checks_ms":0.041,"duration_core_rule_set_ms":0.029,"duration_upstream_total_ms":3.104} +{"type":"request","waf_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/waf","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"core_rule_set_score":0,"duration_total_ms":3.217,"duration_checks_ms":0.041,"duration_core_rule_set_ms":0.029,"duration_upstream_total_ms":3.104} ``` ### Every line @@ -41,9 +41,8 @@ Every one of these lines has: ### Standard web log fields -- `time`: when `discriminator` had read the question's body, RFC 3339 with - milliseconds, in UTC. The `report` line gives the same time as the `decision` - line. +- `time`: when `waf` had read the question's body, RFC 3339 with milliseconds, + in UTC. The `report` line gives the same time as the `decision` line. - `instance`: `SWW_INSTANCE_NAME`. - `client_ip`: the visitor's address, as `rproxy` worked it out. - `method`, `path` and `query`: the visitor's request. @@ -52,9 +51,8 @@ Every one of these lines has: - `host`: the site the visitor asked for. - `protocol`: the question's own, `HTTP/1.1`. - `status`: - - on the `decision` line, what `discriminator` answered: `200` for `allow`, - the status of `deny`, or `0` for `close`, as the visitor is then sent - nothing; + - on the `decision` line, what `waf` answered: `200` for `allow`, the status + of `deny`, or `0` for `close`, as the visitor is then sent nothing; - on the `report` line, what the visitor got, `0` if nothing. - `request_bytes`: - on the `decision` line, how much of the question's body the Core Rule Set @@ -62,7 +60,7 @@ Every one of these lines has: - on the `report` line, the bytes of the visitor's body that `rproxy` read, with what a WebSocket carried from the visitor. - `response_bytes`: - - on the `decision` line, the body of `discriminator`'s answer; + - on the `decision` line, the body of `waf`'s answer; - on the `report` line, the bytes of the answer's body, with what a WebSocket carried from the app. - `referer` and `user_agent`. @@ -79,7 +77,7 @@ Every one of these lines has: - lookups are off; - the client is not looked up; - the source cannot place the client; - - GeoJS had not answered by the time `discriminator` answered. + - GeoJS had not answered by the time `waf` answered. - `content_type`: the visitor's `Content-Type`. - `content_length`: the body length the visitor announced. - `request_headers`: the headers listed in `SWW_LOG_REQUEST_HEADERS`, by name in @@ -89,7 +87,7 @@ Every one of these lines has: ### Response detail -- `response_content_type`: the type of `discriminator`'s own answer. +- `response_content_type`: the type of `waf`'s own answer. - `aborted`: true when `rproxy` went away before the answer. ### Decision @@ -105,8 +103,8 @@ Every one of these lines has: - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and `blocked_by_core_rule_set`: refused by that check; - `request_header_too_large`: over a header limit; - - `own_endpoint`: answered at one of `discriminator`'s own endpoints, or - `404` for a path under `/_sww/`. + - `own_endpoint`: answered at one of `waf`'s own endpoints, or `404` for a + path under `/_sww/`. - `would_action`: in `observe` mode, what `enforce` mode would have done with a request it would have refused. `action` then names what was done, normally `forward`. @@ -131,9 +129,8 @@ Every one of these lines has: - `core_rule_set`: `score`, and `threshold`, `SWW_WAF_ANOMALY_THRESHOLD`; - `refusal_limit`: `window`, `count` and `limit`, of the error burst; - `byte_limits`: `window`, `count` and `limit`, the count in bytes. -- `after_answer_heuristic`: the heuristic that banned the client after - `discriminator` answered the request, in `observe` mode too: `refusal_limit` - or `byte_limits`. +- `after_answer_heuristic`: the heuristic that banned the client after `waf` + answered the request, in `observe` mode too: `refusal_limit` or `byte_limits`. - `after_answer_heuristic_figures`: an object of the figures that heuristic acted on, as listed above. @@ -191,8 +188,8 @@ Every one of these lines has: All in milliseconds: - `duration_total_ms`: - - on the `decision` line, from `discriminator` having read the question's - body to the line; + - on the `decision` line, from `waf` having read the question's body to the + line; - on the `report` line, from `rproxy` having read the request's headers to the end of the answer. - `duration_checks_ms`: to the end of the checks; @@ -202,8 +199,8 @@ All in milliseconds: ### Requests to its own endpoints -The line of a request to `discriminator`'s own endpoints has these fields, with -these meanings where they differ: +The line of a request to `waf`'s own endpoints has these fields, with these +meanings where they differ: - `client_ip` and `peer_ip`: the request's TCP peer. - `request_id`: a new random one of 26 letters and digits. @@ -216,7 +213,7 @@ these meanings where they differ: ## `rproxy`'s line `sww rproxy` writes one short line for each request. `request_id` joins it to -`discriminator`'s two. It has these fields and no others: +`waf`'s two. It has these fields and no others: - `type`: `request`. - `time`: when the request arrived, RFC 3339 with milliseconds, in UTC. @@ -231,15 +228,15 @@ these meanings where they differ: carried from the app. - `duration_request_ms`: milliseconds from the request's headers being read until the app had been sent the whole request, or the answer started if that - was sooner. It includes the wait for `discriminator`. + was sooner. It includes the wait for `waf`. - `duration_response_ms`: milliseconds from then until the end of the answer. - `disposition`: what was done with the request: `allow`, `deny` or `close`. It - is `discriminator`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is - left out when: - - `discriminator` was not asked, as for the health check; - - the visitor went away while `discriminator` was being asked; - - `discriminator`'s answer had no valid `X-Sww-Disposition`; - - `rproxy` could not pass on `discriminator`'s answer, and answered `502`. + is `waf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left out + when: + - `waf` was not asked, as for the health check; + - the visitor went away while `waf` was being asked; + - `waf`'s answer had no valid `X-Sww-Disposition`; + - `rproxy` could not pass on `waf`'s answer, and answered `502`. - `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave `disposition`, and otherwise left out. diff --git a/docs/rules.md b/docs/rules.md index cfa69e7..38c787d 100644 --- a/docs/rules.md +++ b/docs/rules.md @@ -54,20 +54,18 @@ empty-agent user_agent log ^$ ## A file of your own -`discriminator` reads the rule files in its own container. Rules of your own go -in a file named to sort after the default, such as `50-site.rules`: +`waf` reads the rule files in its own container. Rules of your own go in a file +named to sort after the default, such as `50-site.rules`: ``` # 50-site.rules: WordPress probes, which this site never serves wp-probe path ban (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/) ``` -A `Dockerfile` built on the `smallwebwaf` image, for `discriminator` to run -from, adds it: +A `Dockerfile` built on the `smallwebwaf` image, for `waf` to run from, adds it: ```dockerfile COPY 50-site.rules /etc/sww/rules.d/50-site.rules ``` -Or mount it there. A `path` rule applies on every site behind that -`discriminator`. +Or mount it there. A `path` rule applies on every site behind that `waf`. diff --git a/docs/settings.md b/docs/settings.md index d6e36de..5abd9a7 100644 --- a/docs/settings.md +++ b/docs/settings.md @@ -4,9 +4,9 @@ Every setting, its default and the values it takes, in the groups of "Settings" in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings that take `off`, the `_FILE` form, and what each group does and why. -The settings that start with `SWW_` are `discriminator`'s. Those that start with -`SWRP_` are `rproxy`'s, and are under "`rproxy`" below. `SWW_COMMAND` chooses -between the two (see "The image's command" below). +The settings that start with `SWW_` are `waf`'s. Those that start with `SWRP_` +are `rproxy`'s, and are under "`rproxy`" below. `SWW_COMMAND` chooses between +the two (see "The image's command" below). ## Forms of values @@ -28,21 +28,20 @@ between the two (see "The image's command" below). ## Core -- `SWW_LISTEN_ADDR` (default `:8080`): where `discriminator` listens: `:` and a - port, such as `:9000`. Leave the host out (see "Ports" in - [`SPEC.md`](../SPEC.md)). +- `SWW_LISTEN_ADDR` (default `:8080`): where `waf` listens: `:` and a port, such + as `:9000`. Leave the host out (see "Ports" in [`SPEC.md`](../SPEC.md)). - `SWW_INSTANCE_NAME` (default: the container's host name): the `instance` name - in each line `discriminator` logs, and in each alert and metric, such as - `fsn1/discriminator`. Valid UTF-8. No control character while - `SWW_ALERT_NTFY_URL` is set. 1 to 48 printable ASCII characters without a - space while `SWW_LOG_REMOTE_URL` is set and `SWW_LOG_REMOTE_APP_NAME` is not. + in each line `waf` logs, and in each alert and metric, such as `fsn1/waf`. + Valid UTF-8. No control character while `SWW_ALERT_NTFY_URL` is set. 1 to 48 + printable ASCII characters without a space while `SWW_LOG_REMOTE_URL` is set + and `SWW_LOG_REMOTE_APP_NAME` is not. - `SWW_MODE` (default `enforce`): `enforce` or `observe`. - `SWW_IPV6_GROUP_PREFIX` (default `64`): the prefix length of an IPv6 client's group, from 32 to 128. - `SWW_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole number above zero. -- `SWW_MAX_BANS` (default `5000`): how many of its own bans `discriminator` - keeps, a whole number above zero. +- `SWW_MAX_BANS` (default `5000`): how many of its own bans `waf` keeps, a whole + number above zero. ## Tokens @@ -62,8 +61,8 @@ between the two (see "The image's command" below). ## Logging -- `SWW_LOG_LEVEL` (default `info`): the least severe of `discriminator`'s own - messages that are written: `debug`, `info`, `warn` or `error`. +- `SWW_LOG_LEVEL` (default `info`): the least severe of `waf`'s own messages + that are written: `debug`, `info`, `warn` or `error`. - `SWW_LOG_REQUEST_HEADERS` (default `accept,accept-language,accept-encoding,content-type,origin,range`): the request headers recorded in the log line, in either case. `Host` and @@ -167,8 +166,8 @@ cut off; the client is banned. ## Request tags -Every request gets tags from what `discriminator` knows of its client. See -"Request tags" in [`SPEC.md`](../SPEC.md). +Every request gets tags from what `waf` knows of its client. See "Request tags" +in [`SPEC.md`](../SPEC.md). - `SWW_TAG_LISTS` (default empty): address lists that each add a tag, as `name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the @@ -188,10 +187,10 @@ Every request gets tags from what `discriminator` knows of its client. See - `SWW_ROUTEWATCH_URL` (default unset): the `http` or `https` URL of a routewatch instance. [routewatch](https://git.eeqj.de/sneak/routewatch) is a - service that gives an address's announced netblock and origin AS. - `discriminator` asks it about each client, in the background, and adds the - tags `asn=` and `prefix=` from its answer. While it is - unset, nothing asks routewatch and no request gets a `prefix=` tag. + service that gives an address's announced netblock and origin AS. `waf` asks + it about each client, in the background, and adds the tags `asn=` and + `prefix=` from its answer. While it is unset, nothing asks + routewatch and no request gets a `prefix=` tag. `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT` accept tags in either case. A tag that no request can get stops the start. A request can get only these: @@ -377,7 +376,7 @@ Then mount its directory into the container read-only, and name the file: ```sh docker run \ -v /srv/app/tokens:/etc/sww/tokens:ro \ - -e SWW_COMMAND=discriminator \ + -e SWW_COMMAND=waf \ -e SWW_METRICS_TOKEN_FILE=/etc/sww/tokens/metrics \ ... ``` @@ -391,21 +390,20 @@ A few limits are fixed rather than settings: - at most 1,000 DNS blocklist queries are under way at once; - at most 20,000 anomaly counters are kept; - each alert destination's queue holds at most 1,000 alerts; -- `discriminator` holds at most 10,000 answered requests awaiting their reports; -- `discriminator` refuses a request with more than 50 cookies or more than 100 - header fields (see "Answering in time" under "`discriminator`" in - [`SPEC.md`](../SPEC.md)); +- `waf` holds at most 10,000 answered requests awaiting their reports; +- `waf` refuses a request with more than 50 cookies or more than 100 header + fields (see "Answering in time" under "`waf`" in [`SPEC.md`](../SPEC.md)); - `rproxy` takes a request line and headers of at most 32 KiB, and closes a kept-open connection idle for 120 seconds; -- `rproxy` reads at most 1 MiB of the body of `discriminator`'s answer, and - answers `502` to a longer one. +- `rproxy` reads at most 1 MiB of the body of `waf`'s answer, and answers `502` + to a longer one. -## `discriminator`'s answer and `rproxy`'s wait +## `waf`'s answer and `rproxy`'s wait `SWW_LOOKUP_TIMEOUT` is the longest a question waits on an outside source. Keep it well under `rproxy`'s `SWRP_TIMEOUT_MS`, as the default is. No question waits for `SWW_REPUTATION_TIMEOUT`, since the DNS blocklists and AbuseIPDB are asked -in the background (see "Answering in time" under "`discriminator`" in +in the background (see "Answering in time" under "`waf`" in [`SPEC.md`](../SPEC.md)). ## `rproxy` @@ -417,16 +415,15 @@ they do. A time here is a whole number of milliseconds above zero, such as `2000`. -- `SWRP_WAF_BACKEND` (required, no default): `discriminator`'s URL. An `http` or - `https` URL with a host and an optional port, and nothing more. `rproxy` - speaks HTTP/1.1 to it. -- `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for - `discriminator`'s answer, to a question and to a report. A time; never `off`. +- `SWRP_WAF_BACKEND` (required, no default): `waf`'s URL. An `http` or `https` + URL with a host and an optional port, and nothing more. `rproxy` speaks + HTTP/1.1 to it. +- `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for `waf`'s + answer, to a question and to a report. A time; never `off`. - `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request when - `discriminator` cannot be connected to, does not answer at all, or does not - answer within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` - answers `503`. It does not apply to an answer `discriminator` gives, such as - an error. + `waf` cannot be connected to, does not answer at all, or does not answer + within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` answers + `503`. It does not apply to an answer `waf` gives, such as an error. - `SWRP_MAX_REQUEST_SIZE` (default `100M`): the largest request body. A size or `off`. - `SWRP_MAX_RESPONSE_SIZE` (default `1G`): the largest response body. A size or @@ -452,8 +449,8 @@ A time here is a whole number of milliseconds above zero, such as `2000`. ## The image's command `SWW_COMMAND` (default `rproxy`) chooses what the image runs and what its health -check checks: `rproxy` or `discriminator` (see "Deployment" in -[`SPEC.md`](../SPEC.md)). It cannot be given as a file. +check checks: `rproxy` or `waf` (see "Deployment" in [`SPEC.md`](../SPEC.md)). +It cannot be given as a file. ## Where earlier settings went diff --git a/docs/state-files.md b/docs/state-files.md index e88466a..28a1a68 100644 --- a/docs/state-files.md +++ b/docs/state-files.md @@ -7,7 +7,7 @@ a top-level `version` of 1. ## `bans.json` Active and past bans: every ban an admin made, and up to `SWW_MAX_BANS` of those -`discriminator` made. Per entry: +`waf` made. Per entry: - `netblock`, `start` and `expires` (`null` for a permanent ban); - `cause`: `attack`, `limit`, `admin` or `crowdsec`; diff --git a/internal/alerts/alerts.go b/internal/alerts/alerts.go index aca6557..7acce5d 100644 --- a/internal/alerts/alerts.go +++ b/internal/alerts/alerts.go @@ -151,7 +151,7 @@ type Params struct { // Alert is one alert, as the webhook is sent it and alerts.json holds it, // with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and // Country are, for a ban, the client's as the ban's notes give them. Host is -// the site of the request that raised the alert, while one discriminator serves +// the site of the request that raised the alert, while one waf serves // many sites, and "" otherwise. // //nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case diff --git a/internal/config/config.go b/internal/config/config.go index 8cb82d1..1765836 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -1,6 +1,6 @@ // Package config reads sww's settings, and is the one place they are // read. Every setting is an environment variable. The settings of `sww -// discriminator` start with SWW_, every one of them has a default, and most can be +// waf` start with SWW_, every one of them has a default, and most can be // given as a file instead. Those of `sww rproxy` start with SWRP_. Each // of them but SWRP_WAF_BACKEND has a default, and none can be given as a file, // since rproxy never touches disk. SWW_COMMAND chooses which of the two @@ -32,10 +32,10 @@ import ( "sneak.berlin/go/smallwebwaf/internal/remotelog" ) -// Config is the settings of `sww discriminator`. A time or size limit of +// Config is the settings of `sww waf`. A time or size limit of // zero is off. type Config struct { - // ListenAddr is where discriminator listens (SWW_LISTEN_ADDR). + // ListenAddr is where waf listens (SWW_LISTEN_ADDR). ListenAddr string // InstanceName is the name every log line and alert gives as instance, // and every metric carries as its label instance (SWW_INSTANCE_NAME), @@ -239,7 +239,7 @@ type Config struct { // attack (SWW_TRAP_PATHS), each starting with / and without a ?. TrapPaths []string // ErrorBurstThreshold is the most requests of a client within a minute - // that discriminator may refuse after a rule file or Core Rule Set match; one + // that waf may refuse after a rule file or Core Rule Set match; one // more breaks a limit (SWW_ERROR_BURST_THRESHOLD). 0 is off. ErrorBurstThreshold int64 // LogRemoteURL is where every line on stdout is also sent @@ -378,8 +378,8 @@ var ( errNeedsDBPath = errors.New("it names the file to look clients up in") errDBPathUnused = errors.New("only file reads it") errOver64K = errors.New( - "is more than 64K, the most discriminator gets of a body") - errNotCommand = errors.New("is not rproxy or discriminator") + "is more than 64K, the most waf gets of a body") + errNotCommand = errors.New("is not rproxy or waf") errNotDurationAboveZero = errors.New( "is not a duration above zero, such as 1h or 7d") errNotNumberAboveZero = errors.New( @@ -627,7 +627,7 @@ func FromEnvironment( } // Command reads only SWW_COMMAND, the command the image runs and its -// health check checks: rproxy when it is unset or empty, or discriminator. It cannot +// health check checks: rproxy when it is unset or empty, or waf. It cannot // be given as a file. Any other value is an error that names the setting. func Command(lookupEnv func(string) (string, bool)) (string, error) { command, _ := lookupEnv("SWW_COMMAND") @@ -635,17 +635,17 @@ func Command(lookupEnv func(string) (string, bool)) (string, error) { switch command { case "", "rproxy": return "rproxy", nil - case "discriminator": + case "waf": return command, nil default: return "", fmt.Errorf("SWW_COMMAND: %q %w", command, errNotCommand) } } -// DiscriminatorListenAddr reads only SWW_LISTEN_ADDR, which may be given as a -// file, as FromEnvironment does. The health check in discriminator's container needs +// WAFListenAddr reads only SWW_LISTEN_ADDR, which may be given as a +// file, as FromEnvironment does. The health check in waf's container needs // no other setting, so it reads no other, nor a file that another names. -func DiscriminatorListenAddr(lookupEnv func(string) (string, bool)) (string, error) { +func WAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) { env := &environment{lookupEnv: lookupEnv} listenAddr := env.address("SWW_LISTEN_ADDR") @@ -1610,7 +1610,7 @@ func parseSize(value string) (int64, error) { } // parseWAFBodyLimit reads the most of a request body the Core Rule Set -// reads: a size as parseSize reads it, or off, but at most 64K, since discriminator +// reads: a size as parseSize reads it, or off, but at most 64K, since waf // gets no more of a body than that. func parseWAFBodyLimit(value string) (int64, error) { limit, err := parseSize(value) @@ -1955,7 +1955,7 @@ func ParseASN(value string) (string, error) { return "AS" + strconv.FormatUint(number, 10), nil } -// The tags a request can get that the settings can name, as discriminator +// The tags a request can get that the settings can name, as waf // writes them. The prefixes are followed by a value. const ( ASNTagPrefix = "asn=" diff --git a/internal/config/config_test.go b/internal/config/config_test.go index 37e8b7b..47a460a 100644 --- a/internal/config/config_test.go +++ b/internal/config/config_test.go @@ -636,11 +636,11 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) { wafBodyLimit, "128KB", `"128KB" is not a size such as 512K, 100M or 5G, or off`, }, - {wafBodyLimit, "65K", `"65K" is more than 64K, the most discriminator ` + + {wafBodyLimit, "65K", `"65K" is more than 64K, the most waf ` + `gets of a body`}, { wafBodyLimit, "65537", - `"65537" is more than 64K, the most discriminator gets of a body`, + `"65537" is more than 64K, the most waf gets of a body`, }, } { t.Run(tc.name+"="+tc.value, func(t *testing.T) { diff --git a/internal/config/rproxy.go b/internal/config/rproxy.go index 3f2988c..0dbf608 100644 --- a/internal/config/rproxy.go +++ b/internal/config/rproxy.go @@ -22,12 +22,12 @@ type RProxy struct { // TrustedProxies are the netblocks whose X-Forwarded-For is believed // (SWRP_TRUSTED_PROXIES). TrustedProxies []netip.Prefix - // WAFBackend is discriminator's URL (SWRP_WAF_BACKEND). + // WAFBackend is waf's URL (SWRP_WAF_BACKEND). WAFBackend *url.URL - // Timeout is how long rproxy waits for discriminator's answer to a question, + // Timeout is how long rproxy waits for waf's answer to a question, // and to a report (SWRP_TIMEOUT_MS). It cannot be off. Timeout time.Duration - // DefaultDisposition is what is done with a request when discriminator cannot be + // DefaultDisposition is what is done with a request when waf cannot be // connected to, does not answer at all, or does not answer within Timeout: // allow or deny (SWRP_DEFAULT_DISPOSITION). DefaultDisposition string @@ -50,7 +50,7 @@ type RProxy struct { var ( errNeedsWAFBackend = errors.New( - "is required: it is discriminator's URL, such as http://discriminator:8080") + "is required: it is waf's URL, such as http://waf:8080") errNotDisposition = errors.New("is not allow or deny") errNotMilliseconds = errors.New( "is not a whole number of milliseconds above zero, such as 2000") @@ -124,7 +124,7 @@ func (c *RProxy) LogValue() slog.Value { return slog.GroupValue(c.settings...) } -// wafBackend reads the setting that is discriminator's URL, which must be set. +// wafBackend reads the setting that is waf's URL, which must be set. func (e *environment) wafBackend(name string) *url.URL { value := e.value(name, "") if value == "" { @@ -139,7 +139,7 @@ func (e *environment) wafBackend(name string) *url.URL { return backend } -// disposition reads the setting that is what is done with a request when discriminator +// disposition reads the setting that is what is done with a request when waf // cannot be connected to, does not answer at all, or does not answer in time: // allow or deny. func (e *environment) disposition(name, defaultValue string) string { diff --git a/internal/config/rproxy_test.go b/internal/config/rproxy_test.go index ae72bf5..719d187 100644 --- a/internal/config/rproxy_test.go +++ b/internal/config/rproxy_test.go @@ -24,7 +24,7 @@ const ( rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE" rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS" rproxyAnswerTime = "SWRP_MAX_RESPONSE_TIME_MS" - backendURL = "http://discriminator:8080" + backendURL = "http://waf:8080" rproxyDefaultAddr = ":8080" rproxyDefaultApp = "http://127.0.0.1:8081" notASize = "a lot" @@ -114,8 +114,8 @@ func TestRProxyInvalidSettingsAreRefused(t *testing.T) { name, value string }{ {wafBackend, ""}, - {wafBackend, "discriminator:8080"}, - {wafBackend, "http://discriminator:8080/path"}, + {wafBackend, "waf:8080"}, + {wafBackend, "http://waf:8080/path"}, {rproxyTimeout, "0"}, {rproxyTimeout, "-1"}, {rproxyTimeout, off}, diff --git a/internal/ratelimit/ratelimit.go b/internal/ratelimit/ratelimit.go index f39eecb..9560af4 100644 --- a/internal/ratelimit/ratelimit.go +++ b/internal/ratelimit/ratelimit.go @@ -92,7 +92,7 @@ type History struct { ASName string `json:"as_name,omitempty"` Country string `json:"country,omitempty"` LookedUp time.Time `json:"looked_up,omitzero"` - // Requests are all the client's requests: Forwarded those discriminator allowed, + // Requests are all the client's requests: Forwarded those waf allowed, // Refused those it refused, and neither those for a path under // /_sww/. Requests int64 `json:"requests"` @@ -136,7 +136,7 @@ type Offences struct { // Request is what a client's history keeps of one of its requests. type Request struct { - // Forwarded is true for a request discriminator allowed, and Refused for one it + // Forwarded is true for a request waf allowed, and Refused for one it // refused. Both are false for a request for a path under /_sww/. Forwarded bool Refused bool diff --git a/internal/requestlog/requestlog.go b/internal/requestlog/requestlog.go index b7e681f..d5a98b7 100644 --- a/internal/requestlog/requestlog.go +++ b/internal/requestlog/requestlog.go @@ -1,5 +1,5 @@ // Package requestlog writes the lines sww prints on stdout: one -// JSON object per request, two from discriminator and a short one from rproxy, +// JSON object per request, two from waf and a short one from rproxy, // marked "type":"request", and the process's own messages as JSON lines marked // "type":"process". package requestlog @@ -14,9 +14,9 @@ import ( "sneak.berlin/go/smallwebwaf/internal/ratelimit" ) -// The action a request line names: what discriminator did with the request. +// The action a request line names: what waf did with the request. const ( - // ActionForward is a request discriminator allowed, which rproxy passes to + // ActionForward is a request waf allowed, which rproxy passes to // the app. ActionForward = "forward" @@ -55,7 +55,7 @@ const ( // ActionCountryDenied is a request refused because its client's country // is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES. ActionCountryDenied = "country_denied" - // ActionOwnEndpoint is a request discriminator answered at one of its own + // ActionOwnEndpoint is a request waf answered at one of its own // endpoints, or a question about a path under /_sww/. ActionOwnEndpoint = "own_endpoint" ) @@ -69,14 +69,14 @@ const OffenceLimit = "limit" // that broke the error burst. const LimitHitMinuteRefusals = "minute_refusals" -// The discriminator_line a request line names, which says which of -// discriminator's two lines about a question it is. +// The waf_line a request line names, which says which of +// waf's two lines about a question it is. const ( - // DiscriminatorLineDecision is discriminator's line at its decision. - DiscriminatorLineDecision = "decision" - // DiscriminatorLineReport is discriminator's line when rproxy's report + // WAFLineDecision is waf's line at its decision. + WAFLineDecision = "decision" + // WAFLineReport is waf's line when rproxy's report // comes, with the decision's fields and the report's together. - DiscriminatorLineReport = "report" + WAFLineReport = "report" ) // timeLayout is RFC 3339 with milliseconds. @@ -89,9 +89,9 @@ const timeLayout = "2006-01-02T15:04:05.000Z07:00" //nolint:tagliatelle // docs/request-log.md names the fields in snake_case type Line struct { Type string `json:"type"` - // DiscriminatorLine is DiscriminatorLineDecision or DiscriminatorLineReport - // on discriminator's two lines about a question. - DiscriminatorLine string `json:"discriminator_line,omitempty"` + // WAFLine is WAFLineDecision or WAFLineReport + // on waf's two lines about a question. + WAFLine string `json:"waf_line,omitempty"` // The standard web log fields. Scheme is how the client reached rproxy, or // the trusted proxy in front of it. @@ -111,7 +111,7 @@ type Line struct { UserAgent string `json:"user_agent"` // Request detail. RequestID is the id rproxy made for the request, or for a - // request to discriminator's own endpoints a new one. ForwardedFor is the + // request to waf's own endpoints a new one. ForwardedFor is the // X-Forwarded-For header as received. ClientGroup is the netblock the // client is counted as. ASN, ASName and Country are the client's AS // number, AS name and country, as looked up. @@ -131,7 +131,7 @@ type Line struct { HasAuthorization bool `json:"has_authorization,omitempty"` HasCookie bool `json:"has_cookie,omitempty"` - // Response detail, of discriminator's own answer. Aborted is true when + // Response detail, of waf's own answer. Aborted is true when // rproxy, or the admin's tool, went away before the answer. ResponseContentType string `json:"response_content_type,omitempty"` Aborted bool `json:"aborted,omitempty"` @@ -142,7 +142,7 @@ type Line struct { // taken with a request it would have refused: ActionClientDenied, // ActionTemporarilyBanned, ActionPermanentlyBanned, ActionCountryDenied, // ActionClientIsRateLimited, ActionBlockedByBlockRule, - // ActionBlockedByCoreRuleSet, or, in discriminator, + // ActionBlockedByCoreRuleSet, or, in waf, // ActionRequestHeaderTooLarge for the header limits. WouldAction string `json:"would_action,omitempty"` // Heuristic is the name of the heuristic that refused the request, in @@ -151,7 +151,7 @@ type Line struct { Heuristic string `json:"heuristic,omitempty"` HeuristicFigures map[string]any `json:"heuristic_figures,omitempty"` // AfterAnswerHeuristic and AfterAnswerHeuristicFigures are the same for - // the heuristic that banned the client after discriminator answered the + // the heuristic that banned the client after waf answered the // request. AfterAnswerHeuristic string `json:"after_answer_heuristic,omitempty"` AfterAnswerHeuristicFigures map[string]any `json:"after_answer_heuristic_figures,omitempty"` //nolint:lll // a struct tag cannot be split @@ -231,7 +231,7 @@ type RProxyLine struct { // sooner. DurationResponseMS runs from then until the answer ends. DurationRequestMS float64 `json:"duration_request_ms"` DurationResponseMS float64 `json:"duration_response_ms"` - // Disposition is the valid disposition discriminator answered or, while + // Disposition is the valid disposition waf answered or, while // DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is "" // when neither gave one. Disposition string `json:"disposition,omitempty"` diff --git a/internal/rproxy/client.go b/internal/rproxy/client.go index 21476ce..e569bbf 100644 --- a/internal/rproxy/client.go +++ b/internal/rproxy/client.go @@ -18,7 +18,7 @@ const ( ) // peerAddress is the address of the request's TCP peer, normally traefik, without -// any IPv6 zone, which discriminator refuses. +// any IPv6 zone, which waf refuses. func peerAddress(r *http.Request) netip.Addr { addrPort, err := netip.ParseAddrPort(r.RemoteAddr) if err != nil { @@ -34,7 +34,7 @@ func peerAddress(r *http.Request) netip.Addr { // address outside them is the visitor; if every address in it is inside, the // leftmost is, and with no header, the peer. An entry that is not an address // ends the reading, since nothing to its left can be believed. The visitor's -// address never has an IPv6 zone, which discriminator refuses. +// address never has an IPv6 zone, which waf refuses. func clientAddress( peer netip.Addr, forwardedFor []string, trusted []netip.Prefix, ) netip.Addr { diff --git a/internal/rproxy/limits_test.go b/internal/rproxy/limits_test.go index 2425043..685f05b 100644 --- a/internal/rproxy/limits_test.go +++ b/internal/rproxy/limits_test.go @@ -17,9 +17,9 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/config" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/requestlog" "sneak.berlin/go/smallwebwaf/internal/rproxy" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // post is the start of a POST whose headers end with what follows it. @@ -59,7 +59,7 @@ func TestServerHasTheFixedLimits(t *testing.T) { } } -func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing.T) { +func TestABodyAnnouncedOverItsLimitIsRefusedOnceWAFAllowsIt(t *testing.T) { t.Parallel() for _, tc := range []struct { @@ -72,7 +72,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(http.ResponseWriter, *http.Request) { t.Error("the app was asked") }) @@ -101,7 +101,7 @@ func TestABodyAnnouncedOverItsLimitIsRefusedOnceDiscriminatorAllowsIt(t *testing func TestADenyOutranksTheBodySizeLimit(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{ maxRequestSize: "1K", @@ -110,7 +110,7 @@ func TestADenyOutranksTheBodySizeLimit(t *testing.T) { got := visit(t, newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(make([]byte, 1025)))) if got.status != http.StatusForbidden { - t.Errorf("answered %+v, want discriminator's 403", got) + t.Errorf("answered %+v, want waf's 403", got) } } @@ -133,7 +133,7 @@ func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) { var asked atomic.Bool - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, r *http.Request) { asked.Store(true) greet(w, r) @@ -166,7 +166,7 @@ func TestAResponseOverItsLimit(t *testing.T) { t.Run("announced, is refused", func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { w.Header().Set(contentLengthHeader, strconv.Itoa(len(large))) _, _ = io.WriteString(w, large) @@ -188,7 +188,7 @@ func TestAResponseOverItsLimit(t *testing.T) { t.Run("not announced, is cut off", func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { _, _ = io.WriteString(w, large[:1]) _ = http.NewResponseController(w).Flush() @@ -218,7 +218,7 @@ func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing. const announced = "2048" - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { w.Header().Set(contentLengthHeader, announced) }) @@ -241,7 +241,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) { t.Run(setting, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{ setting: "off", @@ -252,7 +252,7 @@ func TestASettingOfOffSetsNoLimit(t *testing.T) { wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body")))) - if got := get(t, addr, discriminator.HealthPath); got.status != http.StatusOK { + if got := get(t, addr, waf.HealthPath); got.status != http.StatusOK { t.Errorf("answered %+v, want rproxy's own 200", got) } }) @@ -271,7 +271,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{ maxRequestTime: "500", @@ -290,7 +290,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) { } if len(standIn.questions) != 0 { - t.Error("discriminator was asked") + t.Error("waf was asked") } standIn.wantNoReport(t) @@ -301,7 +301,7 @@ func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) { func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out := startRProxy(t, standIn.URL, app.URL, nil) @@ -315,7 +315,7 @@ func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) { } if len(standIn.questions) != 0 { - t.Error("discriminator was asked") + t.Error("waf was asked") } } @@ -335,7 +335,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out := startRProxy(t, standIn.URL, app.URL, nil) @@ -366,7 +366,7 @@ func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) { } if len(standIn.questions) != 0 { - t.Error("discriminator was asked") + t.Error("waf was asked") } }) } @@ -412,7 +412,7 @@ func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) { announced = 100 * questionBodyMaxBytes ) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }) @@ -456,13 +456,13 @@ func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) { name, target string status int }{ - {"discriminator's deny", "/", http.StatusForbidden}, + {"waf's deny", "/", http.StatusForbidden}, {"rproxy's own 400", "x:admin", http.StatusBadRequest}, } { t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) _, _, server := startServer(t, standIn.URL, app.URL, map[string]string{ maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10), @@ -494,7 +494,7 @@ func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) { const least = 10 * time.Second - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) _, _, server := startServer(t, standIn.URL, app.URL, map[string]string{ maxResponseTime: "300", @@ -516,7 +516,7 @@ func TestAnAnswerRProxyGivesItselfHasTenSecondsToBeSentAtLeast(t *testing.T) { func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{ maxRequestTime: "3000", @@ -585,7 +585,7 @@ func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) { writeSize = 32 << 10 ) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) addr, _ := startRProxy(t, standIn.URL, startAppThatTakesNothing(t), map[string]string{maxRequestTime: "3000"}) @@ -612,7 +612,7 @@ func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) { t.Parallel() release := make(chan struct{}) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(http.ResponseWriter, *http.Request) { <-release }) @@ -658,7 +658,7 @@ func visitAsTheTimeRunsOut(t *testing.T) { // answerAfter is how long the app waits before it answers. var answerAfter atomic.Int64 - backend := startDiscriminatorAnsweringReports(t, allow, + backend := startWAFAnsweringReports(t, allow, func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }) @@ -701,7 +701,7 @@ func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) { const start = "the start" release := make(chan struct{}) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { _, _ = io.WriteString(w, start) _ = http.NewResponseController(w).Flush() @@ -750,7 +750,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) { writeSize = 32 << 10 ) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { part := make([]byte, writeSize) @@ -787,7 +787,7 @@ func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) { func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) addr, _ := startRProxy(t, standIn.URL, nowhere, nil) got := get(t, addr, "/") @@ -803,7 +803,7 @@ func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) { func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { _, _ = io.WriteString(w, greeting) }) @@ -867,7 +867,7 @@ func readAnswer(t *testing.T, conn net.Conn) answered { func TestAVisitorThatStopsALittleShortGetsTheAppsAnswerAtOnce(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, answerBeforeTheBody) // The request time limit is longer than the 10 seconds the status and headers // of an answer have to be sent, and than dial's deadline. @@ -887,7 +887,7 @@ func TestAVisitorThatStopsALittleShortIsReadUntilTheRequestTimeLimit(t *testing. const limit = 2 * time.Second - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, answerBeforeTheBody) addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{ maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10), @@ -914,7 +914,7 @@ func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) { t.Parallel() working := make(chan struct{}) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(_ http.ResponseWriter, r *http.Request) { close(working) <-r.Context().Done() @@ -955,7 +955,7 @@ func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing const answer = "the end of a long answer" - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, r *http.Request) { _, _ = io.Copy(io.Discard, r.Body) _ = http.NewResponseController(w).Flush() @@ -984,14 +984,14 @@ func TestAVisitorThatStopsALittleShortGetsAnAnswerRProxyGivesAtOnce(t *testing.T {"a deny", post, http.StatusForbidden}, { "the health check", - "GET " + discriminator.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n", + "GET " + waf.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n", http.StatusOK, }, } { t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) // The request time limit is longer than the 10 seconds an answer rproxy // gives itself has to be sent, and than dial's deadline. diff --git a/internal/rproxy/question_test.go b/internal/rproxy/question_test.go index 9211b01..b65587e 100644 --- a/internal/rproxy/question_test.go +++ b/internal/rproxy/question_test.go @@ -12,11 +12,11 @@ import ( "strings" "testing" - "sneak.berlin/go/smallwebwaf/internal/discriminator" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // questionBodyMaxBytes is the most of a body a question carries. -const questionBodyMaxBytes = discriminator.QuestionBodyMaxBytes +const questionBodyMaxBytes = waf.QuestionBodyMaxBytes // chunked is the encoding of a body whose length the visitor did not announce. const chunked = "chunked" @@ -29,7 +29,7 @@ const pathGoReencodes = "/some%2Fpath/with%20space|pipe" func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, nil) @@ -42,9 +42,9 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) { req.Header.Set(forwardedForHeader, "198.51.100.1") req.Header.Set(forwardedProtoHeader, "gopher") req.Header.Set(requestIDHeader, "the-visitor's") - req.Header.Set(discriminator.ClientHeader, "198.51.100.2") - req.Header.Set(discriminator.PeerHeader, "198.51.100.3") - req.Header.Set(discriminator.ContentLengthHeader, "12345") + req.Header.Set(waf.ClientHeader, "198.51.100.2") + req.Header.Set(waf.PeerHeader, "198.51.100.3") + req.Header.Set(waf.ContentLengthHeader, "12345") // Go's client then sends no User-Agent, so that one in the question would be // Go's own. req.Header["User-Agent"] = nil @@ -68,8 +68,8 @@ func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) { want.Set(forwardedForHeader, "198.51.100.1") want.Set(forwardedProtoHeader, "http") want.Set(requestIDHeader, asked.header.Get(requestIDHeader)) - want.Set(discriminator.ClientHeader, localhost) - want.Set(discriminator.PeerHeader, localhost) + want.Set(waf.ClientHeader, localhost) + want.Set(waf.PeerHeader, localhost) if !maps.EqualFunc(asked.header, want, slices.Equal) { t.Errorf("the question's headers are %v, want %v", asked.header, want) @@ -93,7 +93,7 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) forwarded := make(chan http.Header, 1) app := startApp(t, func(w http.ResponseWriter, r *http.Request) { forwarded <- r.Header.Clone() @@ -110,8 +110,8 @@ func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) { wantGreeting(t, visit(t, req)) asked := standIn.question(t) - if asked.header.Get(discriminator.ClientHeader) != tc.client || - asked.header.Get(discriminator.PeerHeader) != localhost || + if asked.header.Get(waf.ClientHeader) != tc.client || + asked.header.Get(waf.PeerHeader) != localhost || asked.header.Get(forwardedForHeader) != visitor || asked.header.Get(forwardedProtoHeader) != tc.proto { t.Errorf("the question's headers are %v", asked.header) @@ -157,7 +157,7 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{ trustedProxies: localhost + "/32,10.0.0.0/8", @@ -167,7 +167,7 @@ func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) { req.Header[forwardedForHeader] = tc.header wantGreeting(t, visit(t, req)) - if got := standIn.question(t).header.Get(discriminator.ClientHeader); got != + if got := standIn.question(t).header.Get(waf.ClientHeader); got != tc.client { t.Errorf("the question names %s, want %s", got, tc.client) } @@ -183,7 +183,7 @@ func randomBytes(n int) []byte { return body } -func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) { +func TestFirst64KiBReachWAFAndTheWholeBodyTheApp(t *testing.T) { t.Parallel() for _, size := range []int{ @@ -198,7 +198,7 @@ func TestFirst64KiBReachDiscriminatorAndTheWholeBodyTheApp(t *testing.T) { t.Parallel() body := randomBytes(size) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) received := make(chan []byte, 1) app := startApp(t, func(w http.ResponseWriter, r *http.Request) { whole, _ := io.ReadAll(r.Body) @@ -244,7 +244,7 @@ func wantQuestionBody( len(want)) } - values := asked.header.Values(discriminator.ContentLengthHeader) + values := asked.header.Values(waf.ContentLengthHeader) if announced { if !slices.Equal(values, []string{strconv.Itoa(size)}) || @@ -265,7 +265,7 @@ func wantQuestionBody( func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, nil) @@ -276,7 +276,7 @@ func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) { strings.Repeat("x", questionBodyMaxBytes)) if status := readStatus(t, conn); status != http.StatusForbidden { - t.Errorf("status %d, want discriminator's 403", status) + t.Errorf("status %d, want waf's 403", status) } if report := standIn.report(t); report.RequestBytes != questionBodyMaxBytes { @@ -307,14 +307,14 @@ func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) { t.Run(method+" "+tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) addr, _ := startRProxy(t, standIn.URL, nowhere, nil) conn := dial(t, addr) send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing) if status := readStatus(t, conn); status != http.StatusForbidden { - t.Errorf("status %d, want discriminator's 403", status) + t.Errorf("status %d, want waf's 403", status) } asked := standIn.question(t) @@ -335,7 +335,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) { t.Run(method, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(http.ResponseWriter, *http.Request) { t.Error("the app was asked") }) @@ -356,7 +356,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) { } if len(standIn.questions) != 0 { - t.Error("discriminator was asked") + t.Error("waf was asked") } standIn.wantNoReport(t) @@ -364,7 +364,7 @@ func TestAMethodNotPassedOnIsAnswered405(t *testing.T) { } } -func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) { +func TestEachMethodPassedOnReachesWAFAndTheApp(t *testing.T) { t.Parallel() for _, method := range []string{ @@ -377,7 +377,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) { t.Parallel() reached := make(chan string, 1) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(_ http.ResponseWriter, r *http.Request) { reached <- r.Method }) @@ -389,7 +389,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) { } if asked := standIn.question(t); asked.method != method { - t.Errorf("discriminator was asked about %s", asked.method) + t.Errorf("waf was asked about %s", asked.method) } if atApp := <-reached; atApp != method { @@ -399,7 +399,7 @@ func TestEachMethodPassedOnReachesDiscriminatorAndTheApp(t *testing.T) { } } -func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) { +func TestARequestThatCannotGoToWAFAsSentIsRefused(t *testing.T) { t.Parallel() const host = "Host: site.example\r\n\r\n" @@ -421,7 +421,7 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out := startRProxy(t, standIn.URL, app.URL, nil) @@ -439,7 +439,7 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) { } if len(standIn.questions) != 0 { - t.Error("discriminator was asked") + t.Error("waf was asked") } standIn.wantNoReport(t) @@ -447,12 +447,12 @@ func TestARequestThatCannotGoToDiscriminatorAsSentIsRefused(t *testing.T) { } } -func TestAHostWithAPercentSignButNoBracketGoesToDiscriminator(t *testing.T) { +func TestAHostWithAPercentSignButNoBracketGoesToWAF(t *testing.T) { t.Parallel() const host = "a%b" - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, nil) @@ -473,7 +473,7 @@ func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) { const want = "http" - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{ trustedProxies: localhost + "/32", @@ -502,7 +502,7 @@ func TestAQuestionNamesNoZone(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) _, out, server := startServer(t, standIn.URL, app.URL, map[string]string{ trustedProxies: localhost + "/32", @@ -515,8 +515,8 @@ func TestAQuestionNamesNoZone(t *testing.T) { server.Handler.ServeHTTP(httptest.NewRecorder(), req) asked := standIn.question(t) - if asked.header.Get(discriminator.ClientHeader) != tc.client || - asked.header.Get(discriminator.PeerHeader) != tc.peer { + if asked.header.Get(waf.ClientHeader) != tc.client || + asked.header.Get(waf.PeerHeader) != tc.peer { t.Errorf("the question's headers are %v", asked.header) } diff --git a/internal/rproxy/request.go b/internal/rproxy/request.go index cbd2d03..c346dae 100644 --- a/internal/rproxy/request.go +++ b/internal/rproxy/request.go @@ -16,16 +16,16 @@ import ( "sync/atomic" "time" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/requestlog" "sneak.berlin/go/smallwebwaf/internal/rules" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as // soon as it arrives. const flushAfterEachWrite time.Duration = -1 -// reportStatusMax is the highest status discriminator takes in a report. An app can +// reportStatusMax is the highest status waf takes in a report. An app can // send a higher one, up to 999, and the visitor gets that as it is. const reportStatusMax = 599 @@ -60,14 +60,14 @@ type request struct { peerTrusted bool start time.Time - // disposition is what is done with the request: discriminator's valid disposition, + // disposition is what is done with the request: waf's valid disposition, // or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one. disposition string - // answered is true when discriminator gave disposition, which makes a report due, + // answered is true when waf gave disposition, which makes a report due, // and byDefault when SWRP_DEFAULT_DISPOSITION did. answered bool byDefault bool - // asn and country are discriminator's X-Client-ASN and X-Client-Country, for the + // asn and country are waf's X-Client-ASN and X-Client-Country, for the // app. asn, country string @@ -131,14 +131,14 @@ func (rq *request) answerHealth() { // visitor too slow to send it is answered 408. For a malformed chunk, or a // visitor that went away or stopped its sending side, the connection is closed // without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part -// read, so that discriminator is asked first; passToApp then refuses it. +// read, so that waf is asked first; passToApp then refuses it. func (rq *request) readFirstPartOfBody() bool { if rq.body == nil { return true } _ = rq.rc.SetReadDeadline(rq.requestDeadline()) - held, err := io.ReadAll(io.LimitReader(rq.body, discriminator.QuestionBodyMaxBytes)) + held, err := io.ReadAll(io.LimitReader(rq.body, waf.QuestionBodyMaxBytes)) // From here on, the request timer ends a read of the rest of the body, so that // the answer can name the side rproxy was waiting on. _ = rq.rc.SetReadDeadline(time.Time{}) @@ -200,7 +200,7 @@ func (rq *request) forward(ctx context.Context) { // rewrite makes the request the app receives: the visitor's request, unchanged, // sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set, // without any X-Client-ASN or X-Client-Country the visitor sent, and with -// discriminator's. +// waf's. func (rq *request) rewrite(pr *httputil.ProxyRequest) { upstream := rq.h.config.UpstreamURL pr.Out.URL.Scheme = upstream.Scheme @@ -333,7 +333,7 @@ func (rq *request) answer(status int) { // handler has returned, after finish has written the log line and sent the report. // Without Content-Length, the flush would send the body in chunks, the last of // which would still wait for the handler. A HEAD's answer has no body, so any -// Content-Length it has stays as discriminator gave it. +// Content-Length it has stays as waf gave it. func (rq *request) send(status int, body []byte) { if rq.in.Method != http.MethodHead { rq.out.Header().Set("Content-Length", strconv.Itoa(len(body))) @@ -379,7 +379,7 @@ func (rq *request) refuse(status int) { } } -// finish ends the request's time limits, writes its log line and, if discriminator +// finish ends the request's time limits, writes its log line and, if waf // answered the question, sends the report. ctx is the request's own context. func (rq *request) finish(ctx context.Context) { rq.stopTimers() @@ -416,7 +416,7 @@ func (rq *request) finish(ctx context.Context) { return } - report := &discriminator.Report{ + report := &waf.Report{ RequestID: rq.id, Status: min(rq.out.status, reportStatusMax), RequestBytes: requestBytes, diff --git a/internal/rproxy/rproxy.go b/internal/rproxy/rproxy.go index e049bcb..d3785bc 100644 --- a/internal/rproxy/rproxy.go +++ b/internal/rproxy/rproxy.go @@ -1,10 +1,10 @@ -// Package rproxy is the reverse proxy in front of one app that asks discriminator -// about each request. It passes a request discriminator allows to the app and the +// Package rproxy is the reverse proxy in front of one app that asks waf +// about each request. It passes a request waf allows to the app and the // app's answer back, within the size and time limits. Any other answer from -// discriminator goes to the visitor as discriminator gave it. SWRP_DEFAULT_DISPOSITION -// decides only when discriminator cannot be connected to, does not answer at all, or +// waf goes to the visitor as waf gave it. SWRP_DEFAULT_DISPOSITION +// decides only when waf cannot be connected to, does not answer at all, or // does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a -// method it does not pass on, or one it cannot put to discriminator as the visitor +// method it does not pass on, or one it cannot put to waf as the visitor // sent it. It keeps nothing between requests and never touches disk. "rproxy" in // SPEC.md says what it does. package rproxy @@ -22,10 +22,10 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/config" - "sneak.berlin/go/smallwebwaf/internal/discriminator" + "sneak.berlin/go/smallwebwaf/internal/waf" ) -// How rproxy keeps connections to the app and to discriminator open between +// How rproxy keeps connections to the app and to waf open between // requests. const ( idleConns = 100 @@ -80,14 +80,14 @@ func New(params Params) *Server { backend := params.Config.WAFBackend errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn) h := &handler{ - config: params.Config, - requestLog: params.RequestLog, - processLog: params.ProcessLog, - errorLog: errorLog, - transport: newTransport(), - discriminatorTransport: newDiscriminatorTransport(), + config: params.Config, + requestLog: params.RequestLog, + processLog: params.ProcessLog, + errorLog: errorLog, + transport: newTransport(), + wafTransport: newWAFTransport(), reportURL: (&url.URL{ - Scheme: backend.Scheme, Host: backend.Host, Path: discriminator.ReportPath, + Scheme: backend.Scheme, Host: backend.Host, Path: waf.ReportPath, }).String(), } @@ -122,10 +122,10 @@ type handler struct { requestLog io.Writer processLog *slog.Logger errorLog *log.Logger - // transport carries requests to the app, and discriminatorTransport questions and - // reports to discriminator. - transport http.RoundTripper - discriminatorTransport http.RoundTripper + // transport carries requests to the app, and wafTransport questions and + // reports to waf. + transport http.RoundTripper + wafTransport http.RoundTripper // reportURL is where the reports go. reportURL string // reports waits for the reports being sent. reportsMu guards starting one @@ -147,11 +147,11 @@ func newTransport() *http.Transport { } } -// newDiscriminatorTransport returns what carries questions and reports to -// discriminator. It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send +// newWAFTransport returns what carries questions and reports to +// waf. It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send // a visitor's Upgrade header, or a Connection header other than close or -// keep-alive, and that would read as discriminator giving no answer. -func newDiscriminatorTransport() *http.Transport { +// keep-alive, and that would read as waf giving no answer. +func newWAFTransport() *http.Transport { transport := newTransport() transport.Protocols = new(http.Protocols) transport.Protocols.SetHTTP1(true) @@ -160,15 +160,15 @@ func newDiscriminatorTransport() *http.Transport { } // ServeHTTP handles one request: it answers the health check itself, refuses a -// request with a method it does not pass on or one it cannot put to discriminator as +// request with a method it does not pass on or one it cannot put to waf as // the visitor sent it, and for any other request reads the first part of the -// body, asks discriminator, and does what the answer says. Once the answer has ended, +// body, asks waf, and does what the answer says. Once the answer has ended, // it writes the request's log line and sends its report. func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { rq := h.newRequest(w, r) defer rq.finish(r.Context()) - if r.Method == http.MethodGet && r.URL.Path == discriminator.HealthPath { + if r.Method == http.MethodGet && r.URL.Path == waf.HealthPath { rq.answerHealth() return @@ -201,9 +201,9 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { rq.noteAnswer(answer) switch rq.disposition { - case discriminator.DispositionAllow: + case waf.DispositionAllow: rq.passToApp(r.Context()) - case discriminator.DispositionClose: + case waf.DispositionClose: // This panic has Go's server close the connection without an answer, // and log nothing; the deferred finish still runs. panic(http.ErrAbortHandler) @@ -213,7 +213,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { } // passToApp passes the request on to the app, unless a limit or its path keeps -// it from the app. discriminator answers a path under ownEndpointPrefix itself, so +// it from the app. waf answers a path under ownEndpointPrefix itself, so // such a request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the // request's own context. func (rq *request) passToApp(ctx context.Context) { diff --git a/internal/rproxy/rproxy_test.go b/internal/rproxy/rproxy_test.go index ec6d08e..0e6e2e8 100644 --- a/internal/rproxy/rproxy_test.go +++ b/internal/rproxy/rproxy_test.go @@ -19,9 +19,9 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/config" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/requestlog" "sneak.berlin/go/smallwebwaf/internal/rproxy" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -54,27 +54,27 @@ const ( // The headers the tests set and look at. const ( - dispositionHeader = discriminator.DispositionHeader + dispositionHeader = waf.DispositionHeader forwardedForHeader = "X-Forwarded-For" forwardedProtoHeader = "X-Forwarded-Proto" requestIDHeader = "X-Request-ID" asnHeader = "X-Client-Asn" countryHeader = "X-Client-Country" contentLengthHeader = "Content-Length" - // fromDiscriminatorHeader is a header the stand-in for discriminator adds to a deny. - fromDiscriminatorHeader = "X-From-Discriminator" + // fromWAFHeader is a header the stand-in for waf adds to a deny. + fromWAFHeader = "X-From-Waf" // addedHeaderValue is the value of a header a test adds to an answer, to see it // reach the visitor. addedHeaderValue = "yes" ) -// What the stand-in for discriminator answers. +// What the stand-in for waf answers. const ( - dispositionAllow = discriminator.DispositionAllow - dispositionDeny = discriminator.DispositionDeny - dispositionClose = discriminator.DispositionClose + dispositionAllow = waf.DispositionAllow + dispositionDeny = waf.DispositionDeny + dispositionClose = waf.DispositionClose // deniedBody is the body of a deny. - deniedBody = "refused by discriminator" + deniedBody = "refused by waf" ) // output collects what rproxy writes on stdout. @@ -158,7 +158,7 @@ func (l heldLog) Write(p []byte) (int, error) { return len(p), nil } -// question is what the stand-in for discriminator received as a question. +// question is what the stand-in for waf received as a question. type question struct { method, target, host string header http.Header @@ -167,26 +167,26 @@ type question struct { transferEncoding []string } -// Discriminator is a stand-in for discriminator that answers each question as +// WAF is a stand-in for waf that answers each question as // answer does, and keeps the questions and the reports it gets. -type Discriminator struct { +type WAF struct { *httptest.Server questions chan question - reports chan discriminator.Report + reports chan waf.Report } -// startDiscriminator starts a stand-in for discriminator. -func startDiscriminator(t *testing.T, answer http.HandlerFunc) *Discriminator { +// startWAF starts a stand-in for waf. +func startWAF(t *testing.T, answer http.HandlerFunc) *WAF { t.Helper() - s := &Discriminator{ + s := &WAF{ questions: make(chan question, 10), - reports: make(chan discriminator.Report, 10), + reports: make(chan waf.Report, 10), } s.Server = httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, r *http.Request) { - if r.Header.Get(discriminator.ClientHeader) == "" { + if r.Header.Get(waf.ClientHeader) == "" { s.takeReport(t, w, r) return @@ -209,17 +209,17 @@ func startDiscriminator(t *testing.T, answer http.HandlerFunc) *Discriminator { return s } -// takeReport keeps a report and answers it as discriminator does. -func (s *Discriminator) takeReport( +// takeReport keeps a report and answers it as waf does. +func (s *WAF) takeReport( t *testing.T, w http.ResponseWriter, r *http.Request, ) { t.Helper() - var report discriminator.Report + var report waf.Report err := json.NewDecoder(r.Body).Decode(&report) if err != nil || r.Method != http.MethodPost || - r.URL.Path != discriminator.ReportPath { + r.URL.Path != waf.ReportPath { t.Errorf("%s %s is no report: %v", r.Method, r.URL.Path, err) } @@ -229,7 +229,7 @@ func (s *Discriminator) takeReport( } // wantNoReport checks that no report comes for a moment. -func (s *Discriminator) wantNoReport(t *testing.T) { +func (s *WAF) wantNoReport(t *testing.T) { t.Helper() select { @@ -240,7 +240,7 @@ func (s *Discriminator) wantNoReport(t *testing.T) { } // report waits for a report. -func (s *Discriminator) report(t *testing.T) discriminator.Report { +func (s *WAF) report(t *testing.T) waf.Report { t.Helper() select { @@ -249,12 +249,12 @@ func (s *Discriminator) report(t *testing.T) discriminator.Report { case <-time.After(waitLimit): t.Fatal("no report") - return discriminator.Report{} + return waf.Report{} } } // question waits for a question. -func (s *Discriminator) question(t *testing.T) question { +func (s *WAF) question(t *testing.T) question { t.Helper() select { @@ -267,17 +267,17 @@ func (s *Discriminator) question(t *testing.T) question { } } -// startDiscriminatorAnsweringReports starts a stand-in for discriminator that +// startWAFAnsweringReports starts a stand-in for waf that // answers each question as answer does and each report as report does, and // returns its URL. -func startDiscriminatorAnsweringReports( +func startWAFAnsweringReports( t *testing.T, answer, report http.HandlerFunc, ) string { t.Helper() backend := httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, r *http.Request) { - if r.Header.Get(discriminator.ClientHeader) != "" { + if r.Header.Get(waf.ClientHeader) != "" { answer(w, r) return @@ -299,7 +299,7 @@ func allow(w http.ResponseWriter, _ *http.Request) { // deny answers a question with deny, status 403 and a body of its own. func deny(w http.ResponseWriter, _ *http.Request) { w.Header().Set(dispositionHeader, dispositionDeny) - w.Header().Set(fromDiscriminatorHeader, addedHeaderValue) + w.Header().Set(fromWAFHeader, addedHeaderValue) w.WriteHeader(http.StatusForbidden) _, _ = io.WriteString(w, deniedBody) } @@ -320,7 +320,7 @@ func greet(w http.ResponseWriter, r *http.Request) { _, _ = io.WriteString(w, greeting) } -// startRProxy starts rproxy with discriminator at backend and the app at appURL, and +// startRProxy starts rproxy with waf at backend and the app at appURL, and // the settings in env on top of the defaults. It returns where rproxy listens // and what it writes. func startRProxy( @@ -502,7 +502,7 @@ func readStatus(t *testing.T, conn net.Conn) int { func TestPassesAnAllowedRequestToTheAppAndItsAnswerBack(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, func(w http.ResponseWriter, r *http.Request) { + standIn := startWAF(t, func(w http.ResponseWriter, r *http.Request) { w.Header().Set(asnHeader, "AS64496") w.Header().Set(countryHeader, "DE") allow(w, r) @@ -561,7 +561,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) { "X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip", } - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) seen := make(chan http.Header, 1) app := startApp(t, func(w http.ResponseWriter, r *http.Request) { seen <- r.Header.Clone() @@ -606,7 +606,7 @@ func TestAPeerNotTrustedHasItsForwardedHeadersReplaced(t *testing.T) { func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) seen := make(chan http.Header, 1) app := startApp(t, func(w http.ResponseWriter, r *http.Request) { seen <- r.Header.Clone() @@ -645,7 +645,7 @@ func TestATrustedProxysForwardedHeadersPassOn(t *testing.T) { func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { w.Header()["Content-Type"] = nil _, _ = io.WriteString(w, "") @@ -667,19 +667,19 @@ func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) { } } -func TestRemovesTheVisitorsLookupHeadersWhenDiscriminatorGivesNone(t *testing.T) { +func TestRemovesTheVisitorsLookupHeadersWhenWAFGivesNone(t *testing.T) { t.Parallel() for _, tc := range []struct { name string backend func(t *testing.T) string }{ - {"discriminator allows", func(t *testing.T) string { + {"waf allows", func(t *testing.T) string { t.Helper() - return startDiscriminator(t, allow).URL + return startWAF(t, allow).URL }}, - {"discriminator is down", func(*testing.T) string { return nowhere }}, + {"waf is down", func(*testing.T) string { return nowhere }}, } { t.Run(tc.name, func(t *testing.T) { t.Parallel() @@ -705,10 +705,10 @@ func TestRemovesTheVisitorsLookupHeadersWhenDiscriminatorGivesNone(t *testing.T) } } -func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) { +func TestDenyGivesTheVisitorWAFsAnswer(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, func(http.ResponseWriter, *http.Request) { t.Error("the app was asked") }) @@ -716,8 +716,8 @@ func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) { got := get(t, addr, "/") if got.status != http.StatusForbidden || got.body != deniedBody || - got.header.Get(fromDiscriminatorHeader) != addedHeaderValue { - t.Errorf("answered %+v, want discriminator's answer", got) + got.header.Get(fromWAFHeader) != addedHeaderValue { + t.Errorf("answered %+v, want waf's answer", got) } if len(got.header.Values(dispositionHeader)) != 0 { @@ -733,21 +733,21 @@ func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) { line := out.requestLine(t) if line["disposition"] != dispositionDeny || line["default_disposition"] != nil { - t.Errorf("line %v, want discriminator's deny", line) + t.Errorf("line %v, want waf's deny", line) } } -func TestADeniedHeadKeepsDiscriminatorsContentLength(t *testing.T) { +func TestADeniedHeadKeepsWAFsContentLength(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, nil) got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody)) if got.status != http.StatusForbidden || got.header.Get(contentLengthHeader) != strconv.Itoa(len(deniedBody)) { - t.Errorf("answered %+v, want discriminator's 403 and its length", got) + t.Errorf("answered %+v, want waf's 403 and its length", got) } } @@ -762,13 +762,13 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) { }{ {"a deny", "GET /" + host, deniedBody, http.StatusForbidden}, {"rproxy's own answer", "GET x:admin" + host, "Bad Request\n", http.StatusBadRequest}, - {"the health check", "GET " + discriminator.HealthPath + host, "ok\n", http.StatusOK}, + {"the health check", "GET " + waf.HealthPath + host, "ok\n", http.StatusOK}, } { t.Run(tc.name, func(t *testing.T) { t.Parallel() log := heldLog{release: make(chan struct{})} - standIn := startDiscriminator(t, deny) + standIn := startWAF(t, deny) app := startApp(t, greet) addr, _ := startServerLogging(t, standIn.URL, app.URL, nil, log, io.Discard) @@ -798,7 +798,7 @@ func TestAnAnswerRProxyHoldsWholeIsSentBeforeItsLogLine(t *testing.T) { func TestRProxysOwnAnswerIsPlainText(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, nil) @@ -821,7 +821,7 @@ func TestRProxysOwnAnswerIsPlainText(t *testing.T) { func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) { + standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) { w.Header().Set(dispositionHeader, dispositionClose) w.WriteHeader(http.StatusOK) }) @@ -853,7 +853,7 @@ func TestCloseClosesTheConnectionWithoutAnAnswer(t *testing.T) { func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) { t.Parallel() - backend := startDiscriminatorAnsweringReports(t, + backend := startWAFAnsweringReports(t, func(w http.ResponseWriter, _ *http.Request) { w.Header().Set(dispositionHeader, dispositionClose) }, @@ -878,17 +878,17 @@ func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) { } } -// answeringWith returns what starts a stand-in for discriminator that answers each +// answeringWith returns what starts a stand-in for waf that answers each // question as answer does, and returns its URL. func answeringWith(answer http.HandlerFunc) func(t *testing.T) string { return func(t *testing.T) string { t.Helper() - return startDiscriminator(t, answer).URL + return startWAF(t, answer).URL } } -// noAnswers are the ways discriminator can leave the decision to the default. +// noAnswers are the ways waf can leave the decision to the default. func noAnswers() map[string]func(t *testing.T) string { return map[string]func(t *testing.T) string{ "no connection": func(*testing.T) string { return nowhere }, @@ -920,7 +920,7 @@ func noAnswers() map[string]func(t *testing.T) string { } } -func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing.T) { +func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) { t.Parallel() for _, tc := range []struct { @@ -929,7 +929,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing. }{ {"a refusal", dispositionDeny, deniedBody, http.StatusForbidden}, {"a refusal, 429", dispositionDeny, deniedBody, http.StatusTooManyRequests}, - {"discriminator's 400", "", "refused\n", http.StatusBadRequest}, + {"waf's 400", "", "refused\n", http.StatusBadRequest}, {"a 500", "", "broken\n", http.StatusInternalServerError}, {"a 503 denied", dispositionDeny, "busy\n", http.StatusServiceUnavailable}, {"no header", "", "who knows\n", http.StatusOK}, @@ -939,12 +939,12 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing. t.Run(tc.name+" with the default "+setting, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) { + standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) { if tc.disposition != "" { w.Header().Set(dispositionHeader, tc.disposition) } - w.Header().Set(fromDiscriminatorHeader, addedHeaderValue) + w.Header().Set(fromWAFHeader, addedHeaderValue) w.WriteHeader(tc.status) _, _ = io.WriteString(w, tc.body) }) @@ -957,8 +957,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing. got := get(t, addr, "/") if got.status != tc.status || got.body != tc.body || - got.header.Get(fromDiscriminatorHeader) != addedHeaderValue { - t.Errorf("answered %+v, want discriminator's answer", got) + got.header.Get(fromWAFHeader) != addedHeaderValue { + t.Errorf("answered %+v, want waf's answer", got) } if len(got.header.Values(dispositionHeader)) != 0 { @@ -970,8 +970,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing. t.Errorf("line %v, want status %d and no default", line, tc.status) } - if out.has("discriminator gave no answer") { - t.Error("rproxy warned that discriminator gave no answer") + if out.has("waf gave no answer") { + t.Error("rproxy warned that waf gave no answer") } }) } @@ -981,14 +981,14 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsDiscriminatorGaveIt(t *testing. func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) { + standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) { http.Error(w, "refused", http.StatusBadRequest) }) app := startApp(t, greet) addr, out := startRProxy(t, standIn.URL, app.URL, nil) if got := get(t, addr, "/"); got.status != http.StatusBadRequest { - t.Errorf("answered %+v, want discriminator's 400", got) + t.Errorf("answered %+v, want waf's 400", got) } if line := out.requestLine(t); line["disposition"] != nil { @@ -1001,7 +1001,7 @@ func TestAnAnswerWithoutAValidDispositionGetsNoReport(t *testing.T) { func TestAnAnswerWithoutAContentTypeGoesToTheVisitorWithNone(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) { + standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) { w.Header()["Content-Type"] = nil w.WriteHeader(http.StatusInternalServerError) _, _ = io.WriteString(w, "broken") @@ -1019,7 +1019,7 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) { const size = 1 << 20 - standIn := startDiscriminator(t, func(w http.ResponseWriter, _ *http.Request) { + standIn := startWAF(t, func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusInternalServerError) _, _ = w.Write(make([]byte, size)) }) @@ -1027,15 +1027,15 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) { got := get(t, addr, "/") if got.status != http.StatusInternalServerError || len(got.body) != size { - t.Errorf("answered %d with %d bytes, want discriminator's 500 with %d", + t.Errorf("answered %d with %d bytes, want waf's 500 with %d", got.status, len(got.body), size) } } -// startDiscriminatorWriting starts a stand-in for discriminator that reads +// startWAFWriting starts a stand-in for waf that reads // each question and answers it with text, as it is, and returns its URL. It // can send what Go's server would not. -func startDiscriminatorWriting(t *testing.T, text string) string { +func startWAFWriting(t *testing.T, text string) string { t.Helper() listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0") @@ -1105,7 +1105,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) { "a status below 100": func(t *testing.T) string { t.Helper() - return startDiscriminatorWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n") + return startWAFWriting(t, "HTTP/1.1 099 Odd\r\nContent-Length: 0\r\n\r\n") }, "a 101 that holds its connection open": answeringWith(switchAndHold), } { @@ -1130,7 +1130,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) { t.Errorf("line %v, want status 502 and no disposition", line) } - out.waitFor(t, "discriminator's answer is dropped") + out.waitFor(t, "waf's answer is dropped") }) } } @@ -1139,7 +1139,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) { func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, overOneMiB(dispositionDeny)) + standIn := startWAF(t, overOneMiB(dispositionDeny)) addr, out := startRProxy(t, standIn.URL, nowhere, nil) if got := get(t, addr, "/"); got.status != http.StatusBadGateway { @@ -1196,14 +1196,14 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) { } } -func TestAVisitorThatGoesAwayWhileDiscriminatorIsAskedGetsNoDefault(t *testing.T) { +func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) { t.Parallel() for _, disposition := range []string{dispositionAllow, dispositionDeny} { t.Run("with the default "+disposition, func(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) { + standIn := startWAF(t, func(_ http.ResponseWriter, r *http.Request) { <-r.Context().Done() }) app := startApp(t, func(http.ResponseWriter, *http.Request) { @@ -1226,8 +1226,8 @@ func TestAVisitorThatGoesAwayWhileDiscriminatorIsAskedGetsNoDefault(t *testing.T t.Errorf("line %v, want status 0 and no disposition", line) } - if out.has("discriminator gave no answer") { - t.Error("rproxy warned that discriminator gave no answer") + if out.has("waf gave no answer") { + t.Error("rproxy warned that waf gave no answer") } standIn.wantNoReport(t) @@ -1242,13 +1242,13 @@ func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) { addr, out := startRProxy(t, nowhere, app.URL, nil) wantGreeting(t, get(t, addr, "/")) - out.waitFor(t, "discriminator gave no answer") + out.waitFor(t, "waf gave no answer") } func TestSendsNoReportWithoutAnAnswer(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, func(_ http.ResponseWriter, r *http.Request) { + standIn := startWAF(t, func(_ http.ResponseWriter, r *http.Request) { <-r.Context().Done() }) app := startApp(t, greet) @@ -1275,29 +1275,29 @@ func TestAPathUnderOwnPrefixNeverReachesTheApp(t *testing.T) { } } -func TestHealthCheckIsAnsweredWhileDiscriminatorIsDown(t *testing.T) { +func TestHealthCheckIsAnsweredWhileWAFIsDown(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out := startRProxy(t, nowhere, app.URL, nil) - got := get(t, addr, discriminator.HealthPath) + got := get(t, addr, waf.HealthPath) if got.status != http.StatusOK || got.body != "ok\n" { t.Errorf("answered %+v, want ok", got) } line := out.requestLine(t) - if line["path"] != discriminator.HealthPath || line["disposition"] != nil { + if line["path"] != waf.HealthPath || line["disposition"] != nil { t.Errorf("line %v, want one with no disposition", line) } - // With discriminator up too, it is not asked. + // With waf up too, it is not asked. addr, _ = startRProxy(t, standIn.URL, app.URL, nil) - get(t, addr, discriminator.HealthPath) + get(t, addr, waf.HealthPath) if len(standIn.questions) != 0 { - t.Error("discriminator was asked about the health check") + t.Error("waf was asked about the health check") } } @@ -1305,7 +1305,7 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) { t.Parallel() release := make(chan struct{}) - backend := startDiscriminatorAnsweringReports(t, deny, + backend := startWAFAnsweringReports(t, deny, func(w http.ResponseWriter, r *http.Request) { select { case <-release: @@ -1340,16 +1340,16 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) { _ = res.Body.Close() if res.StatusCode != http.StatusForbidden { - t.Errorf("status %d, want discriminator's 403", res.StatusCode) + t.Errorf("status %d, want waf's 403", res.StatusCode) } } } -func TestAReportDiscriminatorLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) { +func TestAReportWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) { t.Parallel() release := make(chan struct{}) - backend := startDiscriminatorAnsweringReports(t, allow, + backend := startWAFAnsweringReports(t, allow, func(w http.ResponseWriter, _ *http.Request) { <-release @@ -1369,10 +1369,10 @@ func TestAReportDiscriminatorLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing. out.waitFor(t, "a report is dropped") } -func TestAReportDiscriminatorRefusesIsDroppedWithAWarning(t *testing.T) { +func TestAReportWAFRefusesIsDroppedWithAWarning(t *testing.T) { t.Parallel() - backend := startDiscriminatorAnsweringReports(t, allow, + backend := startWAFAnsweringReports(t, allow, func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusBadRequest) }) @@ -1387,7 +1387,7 @@ func TestAReportDiscriminatorRefusesIsDroppedWithAWarning(t *testing.T) { func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) { t.Parallel() - backend := startDiscriminatorAnsweringReports(t, allow, switchAndHold) + backend := startWAFAnsweringReports(t, allow, switchAndHold) app := startApp(t, greet) addr, out := startRProxy(t, backend, app.URL, map[string]string{ timeoutSetting: "60000", @@ -1400,7 +1400,7 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) { func TestAReportDueAfterWaitForReportsIsDropped(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out, server := startServer(t, standIn.URL, app.URL, nil) @@ -1416,7 +1416,7 @@ func TestReportGivesWhatHappened(t *testing.T) { const body = "the visitor's body" - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out := startRProxy(t, standIn.URL, app.URL, nil) @@ -1446,7 +1446,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) { release := make(chan struct{}) backend := httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, r *http.Request) { - if r.Header.Get(discriminator.ClientHeader) != "" { + if r.Header.Get(waf.ClientHeader) != "" { allow(w, r) return @@ -1501,7 +1501,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) { func TestReportOfAWebSocketCountsWhatItCarried(t *testing.T) { t.Parallel() - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, echoAfterUpgrade) addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{ maxRequestTime: "2000", @@ -1556,7 +1556,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) { const goodbye = "sent after the visitor stopped sending\n" - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { conn, buffered, err := http.NewResponseController(w).Hijack() if err != nil { @@ -1614,7 +1614,7 @@ func TestAWebSocketPassesOnThatTheVisitorStoppedSending(t *testing.T) { //nolint:paralleltest // see above func TestASwitchNotPassedOnClosesTheAppsConnection(t *testing.T) { closed := make(chan error, 1) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, func(w http.ResponseWriter, _ *http.Request) { conn, buffered, err := http.NewResponseController(w).Hijack() if err != nil { @@ -1685,7 +1685,7 @@ func TestEachRequestGetsAFreshID(t *testing.T) { const fromTraefik = "an-id-from-traefik" - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{ trustedProxies: localhost + "/32", @@ -1715,7 +1715,7 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) { body = "the visitor's body" ) - standIn := startDiscriminator(t, allow) + standIn := startWAF(t, allow) app := startApp(t, greet) addr, out := startRProxy(t, standIn.URL, app.URL, nil) diff --git a/internal/rproxy/discriminator.go b/internal/rproxy/waf.go similarity index 70% rename from internal/rproxy/discriminator.go rename to internal/rproxy/waf.go index d5a5832..b47c425 100644 --- a/internal/rproxy/discriminator.go +++ b/internal/rproxy/waf.go @@ -11,15 +11,15 @@ import ( "net/http" "strings" - "sneak.berlin/go/smallwebwaf/internal/discriminator" + "sneak.berlin/go/smallwebwaf/internal/waf" ) -// answerBodyMaxBytes is the most of the body of discriminator's answer that is read. +// answerBodyMaxBytes is the most of the body of waf's answer that is read. // It is far above any answer's. const answerBodyMaxBytes = 1 << 20 // reportAnswerMaxBytes is the most of the answer to a report that is read, -// which has no body when discriminator takes the report. +// which has no body when waf takes the report. const reportAnswerMaxBytes = 4 << 10 var ( @@ -27,22 +27,22 @@ var ( errReportRefused = errors.New("the report was answered") ) -// discriminatorAnswer is what discriminator answered to a question. -type discriminatorAnswer struct { +// wafAnswer is what waf answered to a question. +type wafAnswer struct { status int header http.Header body []byte } -// noteAnswer notes what discriminator answered. An answer without a valid disposition -// notes nothing, and no report is due for it: discriminator holds no decision to report +// noteAnswer notes what waf answered. An answer without a valid disposition +// notes nothing, and no report is due for it: waf holds no decision to report // on. -func (rq *request) noteAnswer(answer *discriminatorAnswer) { - disposition := answer.header.Get(discriminator.DispositionHeader) +func (rq *request) noteAnswer(answer *wafAnswer) { + disposition := answer.header.Get(waf.DispositionHeader) switch disposition { - case discriminator.DispositionAllow, discriminator.DispositionDeny, - discriminator.DispositionClose: + case waf.DispositionAllow, waf.DispositionDeny, + waf.DispositionClose: rq.disposition = disposition rq.answered = true rq.asn = answer.header.Get(asnHeader) @@ -55,27 +55,27 @@ func (rq *request) noteAnswer(answer *discriminatorAnswer) { func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) { switch { case ctx.Err() != nil: - // The visitor went away while discriminator was being asked. discriminator has not + // The visitor went away while waf was being asked. waf has not // failed, and nothing is noted. This panic has Go's server close the // connection without an answer, and log nothing; the deferred finish still // runs. panic(http.ErrAbortHandler) case errors.Is(err, errCannotPassOn): - rq.h.processLog.Warn("discriminator's answer is dropped", "error", err.Error()) + rq.h.processLog.Warn("waf's answer is dropped", "error", err.Error()) rq.answer(http.StatusBadGateway) default: - // discriminator cannot be connected to, does not answer at all, or does not answer - // within SWRP_TIMEOUT_MS. A request that keeps discriminator busy past - // SWRP_TIMEOUT_MS, like any request while discriminator is overloaded, gets + // waf cannot be connected to, does not answer at all, or does not answer + // within SWRP_TIMEOUT_MS. A request that keeps waf busy past + // SWRP_TIMEOUT_MS, like any request while waf is overloaded, gets // SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503 - // whenever discriminator is slow. Making such requests hard to send is + // whenever waf is slow. Making such requests hard to send is // https://git.eeqj.de/sneak/smallwebwaf/issues/182. - rq.h.processLog.Warn("discriminator gave no answer", "error", err.Error()) + rq.h.processLog.Warn("waf gave no answer", "error", err.Error()) rq.disposition = rq.h.config.DefaultDisposition rq.byDefault = true - if rq.disposition == discriminator.DispositionAllow { + if rq.disposition == waf.DispositionAllow { rq.passToApp(ctx) } else { rq.answer(http.StatusServiceUnavailable) @@ -83,10 +83,10 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) { } } -// ask sends discriminator the question, and returns its answer, which must have come +// ask sends waf the question, and returns its answer, which must have come // whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes // away. -func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) { +func (rq *request) ask(ctx context.Context) (*wafAnswer, error) { ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout) defer cancel() @@ -95,7 +95,7 @@ func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) { return nil, err } - res, err := rq.h.discriminatorTransport.RoundTrip(question) + res, err := rq.h.wafTransport.RoundTrip(question) if err != nil { return nil, fmt.Errorf("send the question: %w", err) } @@ -120,17 +120,17 @@ func (rq *request) ask(ctx context.Context) (*discriminatorAnswer, error) { return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn) } - return &discriminatorAnswer{res.StatusCode, res.Header, body}, nil + return &wafAnswer{res.StatusCode, res.Header, body}, nil } -// canBeAsked reports whether Go's client can send discriminator r as the visitor sent +// canBeAsked reports whether Go's client can send waf r as the visitor sent // it. It cannot send these as they came: // - a target that does not start with /, or that starts with //; -// - an empty Host, for which it sends discriminator's own address; +// - an empty Host, for which it sends waf's own address; // - a Host holding an IPv6 zone, which it removes; // - more than one User-Agent, of which it sends the first; // - an empty User-Agent, which it leaves out, the one case that still goes to -// discriminator. +// waf. func canBeAsked(r *http.Request) bool { target, host := r.RequestURI, r.Host hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%") @@ -170,13 +170,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) { question.TransferEncoding = in.TransferEncoding question.Header = in.Header.Clone() - question.Header.Set(discriminator.ClientHeader, rq.client.String()) - question.Header.Set(discriminator.PeerHeader, rq.peer.String()) - question.Header.Del(discriminator.ContentLengthHeader) + question.Header.Set(waf.ClientHeader, rq.client.String()) + question.Header.Set(waf.PeerHeader, rq.peer.String()) + question.Header.Del(waf.ContentLengthHeader) announced := in.Header.Get("Content-Length") if announced != "" { - question.Header.Set(discriminator.ContentLengthHeader, announced) + question.Header.Set(waf.ContentLengthHeader, announced) } question.Header.Set(requestIDHeader, rq.id) @@ -191,13 +191,13 @@ func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) { return question, nil } -// answerWith gives the visitor discriminator's answer, less its disposition. -func (rq *request) answerWith(answer *discriminatorAnswer) { +// answerWith gives the visitor waf's answer, less its disposition. +func (rq *request) answerWith(answer *wafAnswer) { rq.prepareOwnAnswer(rq.requestDeadline()) header := rq.out.Header() maps.Copy(header, answer.header) - header.Del(discriminator.DispositionHeader) + header.Del(waf.DispositionHeader) // Go's server adds a Content-Type it guesses from the body to a response whose // headers have no Content-Type key. The key with no value sends none. @@ -208,10 +208,10 @@ func (rq *request) answerWith(answer *discriminatorAnswer) { rq.send(answer.status, answer.body) } -// sendReport sends discriminator report on a goroutine of its own, so that the +// sendReport sends waf report on a goroutine of its own, so that the // visitor does not wait for it. The report goes on after ctx, the request's own // context, has ended. -func (h *handler) sendReport(ctx context.Context, report *discriminator.Report) { +func (h *handler) sendReport(ctx context.Context, report *waf.Report) { h.reportsMu.Lock() defer h.reportsMu.Unlock() @@ -227,9 +227,9 @@ func (h *handler) sendReport(ctx context.Context, report *discriminator.Report) }) } -// postReport posts report to discriminator, and waits for its answer for up to +// postReport posts report to waf, and waits for its answer for up to // SWRP_TIMEOUT_MS. -func (h *handler) postReport(ctx context.Context, report *discriminator.Report) error { +func (h *handler) postReport(ctx context.Context, report *waf.Report) error { body, err := json.Marshal(report) if err != nil { return fmt.Errorf("encode the report: %w", err) @@ -246,7 +246,7 @@ func (h *handler) postReport(ctx context.Context, report *discriminator.Report) req.Header.Set("Content-Type", "application/json") - res, err := h.discriminatorTransport.RoundTrip(req) + res, err := h.wafTransport.RoundTrip(req) if err != nil { return fmt.Errorf("send the report: %w", err) } diff --git a/internal/sww/healthcheck.go b/internal/sww/healthcheck.go index e56e8ee..1357b57 100644 --- a/internal/sww/healthcheck.go +++ b/internal/sww/healthcheck.go @@ -11,7 +11,7 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/config" - "sneak.berlin/go/smallwebwaf/internal/discriminator" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // healthCheckTimeout bounds the whole health check. @@ -19,8 +19,8 @@ const healthCheckTimeout = 5 * time.Second var errHealthEndpoint = errors.New("the health endpoint answered") -// HealthCheck is the container's health check. In discriminator's container, where -// SWW_COMMAND is discriminator, it returns 0 while discriminator answers its health +// HealthCheck is the container's health check. In waf's container, where +// SWW_COMMAND is waf, it returns 0 while waf answers its health // endpoint on 127.0.0.1, at the port in SWW_LISTEN_ADDR. In rproxy's container, // where SWW_COMMAND is rproxy, unset or empty, it returns 0 while rproxy // answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and @@ -49,8 +49,8 @@ func HealthCheck( switch { case err != nil: err = fmt.Errorf("invalid setting: %w", err) - case command == "discriminator": - err = checkDiscriminator(ctx, lookupEnv) + case command == "waf": + err = checkWAF(ctx, lookupEnv) default: err = checkRProxyAndApp(ctx, lookupEnv) } @@ -64,18 +64,18 @@ func HealthCheck( return 0 } -// checkDiscriminator asks discriminator's health endpoint. -func checkDiscriminator( +// checkWAF asks waf's health endpoint. +func checkWAF( ctx context.Context, lookupEnv func(string) (string, bool), ) error { - listenAddr, err := config.DiscriminatorListenAddr(lookupEnv) + listenAddr, err := config.WAFListenAddr(lookupEnv) if err != nil { return fmt.Errorf("invalid setting: %w", err) } err = askHealthEndpoint(ctx, listenAddr) if err != nil { - return fmt.Errorf("ask discriminator: %w", err) + return fmt.Errorf("ask waf: %w", err) } return nil @@ -109,7 +109,7 @@ func checkRProxyAndApp( // listenAddr, which the settings have checked has one. func askHealthEndpoint(ctx context.Context, listenAddr string) error { _, port, _ := net.SplitHostPort(listenAddr) - health := "http://" + net.JoinHostPort("127.0.0.1", port) + discriminator.HealthPath + health := "http://" + net.JoinHostPort("127.0.0.1", port) + waf.HealthPath req, err := http.NewRequestWithContext(ctx, http.MethodGet, health, http.NoBody) if err != nil { diff --git a/internal/sww/healthcheck_test.go b/internal/sww/healthcheck_test.go index 50a9bf4..e16537e 100644 --- a/internal/sww/healthcheck_test.go +++ b/internal/sww/healthcheck_test.go @@ -19,11 +19,11 @@ const ( // commandSetting says which command a container runs, and which the health // check checks. commandSetting = "SWW_COMMAND" - // discriminatorCommand is the command that runs discriminator. - discriminatorCommand = "discriminator" + // wafCommand is the command that runs waf. + wafCommand = "waf" ) -func TestHealthCheckInDiscriminatorsContainer(t *testing.T) { +func TestHealthCheckInWAFsContainer(t *testing.T) { t.Parallel() ctx, stop := context.WithCancel(t.Context()) @@ -47,7 +47,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) { // The container's settings: an address to listen on with an empty // host part, which the health check asks at 127.0.0.1. wantHealthCheck(t, map[string]string{ - commandSetting: discriminatorCommand, listenAddr: ":" + port, + commandSetting: wafCommand, listenAddr: ":" + port, }, 0, "") // The health check reads that setting alone, here given as a file: a removed @@ -59,7 +59,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) { {"SWW_MODE", "neither"}, } { wantHealthCheck(t, map[string]string{ - commandSetting: discriminatorCommand, + commandSetting: wafCommand, listenAddr + "_FILE": writeFile(t, ":"+port+"\n"), other.name: other.value, }, 0, "") @@ -68,10 +68,10 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) { // Listening on port 0 takes any free port, so nothing listens on port 0 // itself. wantHealthCheck(t, map[string]string{ - commandSetting: discriminatorCommand, listenAddr: ":0", - }, 1, "unhealthy: ask discriminator: ") + commandSetting: wafCommand, listenAddr: ":0", + }, 1, "unhealthy: ask waf: ") wantHealthCheck(t, map[string]string{ - commandSetting: discriminatorCommand, listenAddr: "8080", + commandSetting: wafCommand, listenAddr: "8080", }, 1, "unhealthy: invalid setting: SWW_LISTEN_ADDR: ") stop() @@ -90,7 +90,7 @@ func TestHealthCheckInRProxysContainer(t *testing.T) { defer app.Close() // Nothing listens at the backend. The health check asks rproxy and the app, - // whether or not discriminator answers. + // whether or not waf answers. site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL) _, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://")) settings := func(more ...string) map[string]string { @@ -107,7 +107,7 @@ func TestHealthCheckInRProxysContainer(t *testing.T) { wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "") // SWW_COMMAND cannot be given as a file. - wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "discriminator\n")), + wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "waf\n")), 0, "") // Another setting does not fail it, even an invalid one, and neither does @@ -137,7 +137,7 @@ func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) { wantHealthCheck(t, map[string]string{commandSetting: "healthcheck"}, 1, "unhealthy: invalid setting: SWW_COMMAND: "+ - "\"healthcheck\" is not rproxy or discriminator\n") + "\"healthcheck\" is not rproxy or waf\n") } func TestHealthCheckRefusesAnArgument(t *testing.T) { diff --git a/internal/sww/rproxy_test.go b/internal/sww/rproxy_test.go index 167e5ae..8baa305 100644 --- a/internal/sww/rproxy_test.go +++ b/internal/sww/rproxy_test.go @@ -19,18 +19,18 @@ import ( "testing" "time" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/sww" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( - // wafBackend is the setting that names discriminator to rproxy. + // wafBackend is the setting that names waf to rproxy. wafBackend = "SWRP_WAF_BACKEND" // rproxyListenAddr is the setting that says where rproxy listens. rproxyListenAddr = "SWRP_LISTEN_ADDR" // rproxyUpstreamURL is the setting that says where the app is. rproxyUpstreamURL = "SWRP_UPSTREAM_URL" - // rproxyTimeout is the setting that says how long rproxy waits for discriminator. + // rproxyTimeout is the setting that says how long rproxy waits for waf. rproxyTimeout = "SWRP_TIMEOUT_MS" // bannedProbe is a path the default rule file bans a client for. bannedProbe = "/.env" @@ -52,7 +52,7 @@ func runRProxy(ctx context.Context, env map[string]string, out *output) int { }) } -// startRProxy runs rproxy with discriminator at backend and the app at appURL, and +// startRProxy runs rproxy with waf at backend and the app at appURL, and // returns its URL and what it writes. It believes X-Forwarded-For from the // tests. It stops as the test ends, and that it stopped in order is checked. func startRProxy(t *testing.T, backend, appURL string) (string, *output) { @@ -91,10 +91,10 @@ func startRProxy(t *testing.T, backend, appURL string) (string, *output) { return "http://" + addr, out } -// startDiscriminator runs discriminator with the settings in env, and returns +// startWAF runs waf with the settings in env, and returns // its address and URL, what it writes, and what stops it, which checks that it // stopped in order. -func startDiscriminator(t *testing.T, env map[string]string) (string, *output, func()) { +func startWAF(t *testing.T, env map[string]string) (string, *output, func()) { t.Helper() ctx, stop := context.WithCancel(t.Context()) @@ -113,17 +113,17 @@ func startDiscriminator(t *testing.T, env map[string]string) (string, *output, f select { case status := <-exited: if status != 0 { - t.Fatalf("discriminator's exit status %d, want 0; output:\n%s", status, out.text()) + t.Fatalf("waf's exit status %d, want 0; output:\n%s", status, out.text()) } case <-time.After(waitLimit): - t.Fatal("discriminator still running after being told to stop") + t.Fatal("waf still running after being told to stop") } } } -// discriminatorSettings are discriminator's settings with the default rule +// wafSettings are waf's settings with the default rule // file, to listen at any free port. -func discriminatorSettings(t *testing.T) map[string]string { +func wafSettings(t *testing.T) map[string]string { t.Helper() return map[string]string{ @@ -136,7 +136,7 @@ func discriminatorSettings(t *testing.T) map[string]string { func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) { t.Parallel() - addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t)) + addr, wafOut, stop := startWAF(t, wafSettings(t)) defer stop() backend := "http://" + addr @@ -151,32 +151,32 @@ func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) { wantStatus(t, second+"/", placed, http.StatusForbidden) wantStatus(t, second+"/", otherClient, http.StatusOK) - // One request's three lines carry one id, rproxy's with discriminator's answer. + // One request's three lines carry one id, rproxy's with waf's answer. line := firstOut.line(t, "path", bannedProbe) - if line["disposition"] != discriminator.DispositionDeny || + if line["disposition"] != waf.DispositionDeny || line["client_ip"] != placed { t.Errorf("rproxy's line is %v", line) } id, _ := line["request_id"].(string) - decision := discriminatorLine(t, discriminatorOut, id, "decision") - report := discriminatorLine(t, discriminatorOut, id, "report") + decision := wafLine(t, wafOut, id, "decision") + report := wafLine(t, wafOut, id, "report") if decision["host"] != line["host"] || decision["client_ip"] != placed || report["status"] != float64(http.StatusForbidden) { - t.Errorf("discriminator's lines are %v and %v", decision, report) + t.Errorf("waf's lines are %v and %v", decision, report) } } -// discriminatorLine waits for discriminator's line with request id and -// discriminator_line kind. -func discriminatorLine(t *testing.T, out *output, id, kind string) map[string]any { +// wafLine waits for waf's line with request id and +// waf_line kind. +func wafLine(t *testing.T, out *output, id, kind string) map[string]any { t.Helper() deadline := time.Now().Add(waitLimit) for time.Now().Before(deadline) { line := out.findLine(t, func(fields map[string]any) bool { - return fields["request_id"] == id && fields["discriminator_line"] == kind + return fields["request_id"] == id && fields["waf_line"] == kind }) if line != nil { return line @@ -190,14 +190,14 @@ func discriminatorLine(t *testing.T, out *output, id, kind string) map[string]an return nil } -func TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain(t *testing.T) { +func TestTheSiteAnswersWhileWAFIsStoppedAndStartedAgain(t *testing.T) { t.Parallel() - env := discriminatorSettings(t) - addr, _, stop := startDiscriminator(t, env) + env := wafSettings(t) + addr, _, stop := startWAF(t, env) - // rproxy asks discriminator through an address the test holds throughout, - // so no other test can take it while discriminator is stopped. + // rproxy asks waf through an address the test holds throughout, + // so no other test can take it while waf is stopped. backend, forwardTo := startForwarder(t) forwardTo(addr) @@ -228,22 +228,22 @@ func TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain(t *testing.T) wantStatus(t, site+bannedProbe, placed, http.StatusForbidden) wantStatus(t, site+"/", placed, http.StatusForbidden) - // rproxy's connections are closed at once from here, before discriminator + // rproxy's connections are closed at once from here, before waf // stops and frees its port. forwardTo("") stop() - // With discriminator down, the site answers, and rproxy says the default did it. + // With waf down, the site answers, and rproxy says the default did it. wantStatus(t, site+"/after-stop", placed, http.StatusOK) line := out.line(t, "path", "/after-stop") - if line["disposition"] != discriminator.DispositionAllow || + if line["disposition"] != waf.DispositionAllow || line["default_disposition"] != true { t.Errorf("rproxy's line is %v", line) } // Started again with its state files, it applies the ban again. - addr, _, stop = startDiscriminator(t, env) + addr, _, stop = startWAF(t, env) forwardTo(addr) defer func() { @@ -397,10 +397,10 @@ func sendRaw(t *testing.T, site, request string) int { return res.StatusCode } -func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) { +func TestAChunkedBodyStaysABodyAtWAF(t *testing.T) { t.Parallel() - addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t)) + addr, wafOut, stop := startWAF(t, wafSettings(t)) defer stop() site, _ := startRProxy(t, "http://"+addr, startApp(t)) @@ -409,7 +409,7 @@ func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) { const smuggledID = "smuggled-request" smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" + - discriminator.ClientHeader + ": " + otherClient + "\r\n" + + waf.ClientHeader + ": " + otherClient + "\r\n" + "X-Request-ID: " + smuggledID + "\r\n\r\n" status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+ @@ -425,18 +425,18 @@ func TestAChunkedBodyStaysABodyAtDiscriminator(t *testing.T) { time.Sleep(pollInterval) } - line := discriminatorOut.findLine(t, func(fields map[string]any) bool { + line := wafOut.findLine(t, func(fields map[string]any) bool { return fields["request_id"] == smuggledID }) if line != nil { - t.Errorf("discriminator read the body as a request: %v", line) + t.Errorf("waf read the body as a request: %v", line) } } -func TestATargetThatCannotGoToDiscriminatorIsRefusedForABannedClient(t *testing.T) { +func TestATargetThatCannotGoToWAFIsRefusedForABannedClient(t *testing.T) { t.Parallel() - addr, _, stop := startDiscriminator(t, discriminatorSettings(t)) + addr, _, stop := startWAF(t, wafSettings(t)) defer stop() site, out := startRProxy(t, "http://"+addr, startApp(t)) @@ -460,7 +460,7 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) { const zoned = "2001:db8::1%eth0" - addr, _, stop := startDiscriminator(t, discriminatorSettings(t)) + addr, _, stop := startWAF(t, wafSettings(t)) defer stop() site, out := startRProxy(t, "http://"+addr, startApp(t)) @@ -475,7 +475,7 @@ func TestAClientWithAZoneIsTheClientWithout(t *testing.T) { } } -func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) { +func TestAStatusWAFDoesNotTakeIsReportedAs599(t *testing.T) { t.Parallel() const status = 799 @@ -486,7 +486,7 @@ func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) { })) t.Cleanup(app.Close) - addr, discriminatorOut, stop := startDiscriminator(t, discriminatorSettings(t)) + addr, wafOut, stop := startWAF(t, wafSettings(t)) defer stop() site, out := startRProxy(t, "http://"+addr, app.URL) @@ -500,9 +500,9 @@ func TestAStatusDiscriminatorDoesNotTakeIsReportedAs599(t *testing.T) { id, _ := line["request_id"].(string) - report := discriminatorLine(t, discriminatorOut, id, "report") + report := wafLine(t, wafOut, id, "report") if report["status"] != 599.0 { - t.Errorf("discriminator's line is %v, want status 599", report) + t.Errorf("waf's line is %v, want status 599", report) } } @@ -544,16 +544,16 @@ func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output return addr, cmd, out } -func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) { +func TestRProxyAsksAWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) { t.Parallel() protocols := make(chan string, 10) backend := httptest.NewUnstartedServer(http.HandlerFunc( func(w http.ResponseWriter, r *http.Request) { - if r.Header.Get(discriminator.ClientHeader) != "" { + if r.Header.Get(waf.ClientHeader) != "" { protocols <- r.Proto - w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionDeny) + w.Header().Set(waf.DispositionHeader, waf.DispositionDeny) w.WriteHeader(http.StatusForbidden) } })) @@ -563,7 +563,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) { // rproxy has no setting for the certificates it trusts, so it is told of this // one as Go's client is told of any, in a process of its own. - certificates := filepath.Join(t.TempDir(), "discriminator.pem") + certificates := filepath.Join(t.TempDir(), "waf.pem") err := os.WriteFile(certificates, pem.EncodeToMemory(&pem.Block{ Type: "CERTIFICATE", Bytes: backend.Certificate().Raw, @@ -585,7 +585,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) { } { status := sendRaw(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n") if status != http.StatusForbidden { - t.Errorf("with %s: status %d, want discriminator's 403", name, status) + t.Errorf("with %s: status %d, want waf's 403", name, status) } select { @@ -594,7 +594,7 @@ func TestRProxyAsksADiscriminatorThatSpeaksHTTP2OverHTTP1(t *testing.T) { t.Errorf("with %s: asked over %s, want HTTP/1.1", name, protocol) } case <-time.After(waitLimit): - t.Errorf("with %s: discriminator was not asked", name) + t.Errorf("with %s: waf was not asked", name) } } } @@ -623,8 +623,8 @@ func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) { release := make(chan struct{}) backend := httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, r *http.Request) { - if r.Header.Get(discriminator.ClientHeader) != "" { - w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow) + if r.Header.Get(waf.ClientHeader) != "" { + w.Header().Set(waf.DispositionHeader, waf.DispositionAllow) return } @@ -731,7 +731,7 @@ func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) { backend := httptest.NewServer(http.HandlerFunc( func(w http.ResponseWriter, _ *http.Request) { - w.Header().Set(discriminator.DispositionHeader, discriminator.DispositionAllow) + w.Header().Set(waf.DispositionHeader, waf.DispositionAllow) })) t.Cleanup(backend.Close) @@ -794,7 +794,7 @@ func TestRProxyInvalidSettingStopsTheStart(t *testing.T) { {"no backend", wafBackend, nil}, { "another invalid", rproxyTimeout, - map[string]string{wafBackend: "http://discriminator:8080", rproxyTimeout: "soon"}, + map[string]string{wafBackend: "http://waf:8080", rproxyTimeout: "soon"}, }, } { t.Run(tc.name, func(t *testing.T) { @@ -831,7 +831,7 @@ func TestRProxyAddressInUseStopsTheStart(t *testing.T) { out := &output{} status := runRProxy(t.Context(), map[string]string{ - wafBackend: "http://discriminator:8080", + wafBackend: "http://waf:8080", rproxyListenAddr: taken.Addr().String(), }, out) if status != 1 { @@ -848,7 +848,7 @@ func TestMainRunsRProxy(t *testing.T) { addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9") req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, - "http://"+addr+discriminator.HealthPath, http.NoBody) + "http://"+addr+waf.HealthPath, http.NoBody) if err != nil { t.Fatalf("new request: %v", err) } diff --git a/internal/sww/sww.go b/internal/sww/sww.go index a3a15c1..c43f192 100644 --- a/internal/sww/sww.go +++ b/internal/sww/sww.go @@ -1,9 +1,9 @@ // Package sww runs the sww process, as the command it is given. -// `sww discriminator` reads the settings, the rule files, the lookup database +// `sww waf` reads the settings, the rule files, the lookup database // and the state files, answers rproxy's questions until it is told to stop, and // then stops in an orderly way, writing the state files. `sww rproxy` // reads rproxy's settings alone, and runs the reverse proxy in front of one app -// that asks discriminator about each request. `sww healthcheck` is the +// that asks waf about each request. `sww healthcheck` is the // container's health check. package sww @@ -23,13 +23,13 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/config" "sneak.berlin/go/smallwebwaf/internal/coreruleset" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/lookup" "sneak.berlin/go/smallwebwaf/internal/remotelog" "sneak.berlin/go/smallwebwaf/internal/reputation" "sneak.berlin/go/smallwebwaf/internal/requestlog" "sneak.berlin/go/smallwebwaf/internal/rules" "sneak.berlin/go/smallwebwaf/internal/state" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // shutdownTimeout is how long requests in progress may take to finish @@ -37,7 +37,7 @@ import ( // runit and docker wait a little longer before they kill the process. const shutdownTimeout = 5 * time.Second -// remoteLogStopTimeout is how long, as discriminator stops, the log lines still +// remoteLogStopTimeout is how long, as waf stops, the log lines still // waiting are sent to SWW_LOG_REMOTE_URL before they are given up. stdout has // carried them. const remoteLogStopTimeout = 2 * time.Second @@ -51,11 +51,11 @@ const usage = `usage: sww commands: rproxy the reverse proxy in front of one app - discriminator decides for rproxy, and keeps bans, counters and history + waf decides for rproxy, and keeps bans, counters and history healthcheck the container's health check ` -// Params are what RunDiscriminator and RunRProxy need from the process. +// Params are what RunWAF and RunRProxy need from the process. type Params struct { // Version is the version of the binary, set when it is built. Version string @@ -66,7 +66,7 @@ type Params struct { } // Main runs the command os.Args names, and returns the process's exit status. -// `sww rproxy` and `sww discriminator` run until SIGTERM or SIGINT. +// `sww rproxy` and `sww waf` run until SIGTERM or SIGINT. // With no command, or one it does not know, it prints the commands and returns // usageStatus. func Main(version string) int { @@ -84,8 +84,8 @@ func Main(version string) int { switch args[0] { case "rproxy": return RunRProxy(ctx, params) - case "discriminator": - return RunDiscriminator(ctx, params) + case "waf": + return RunWAF(ctx, params) case "healthcheck": return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr) default: @@ -100,10 +100,10 @@ func printUsage(w io.Writer) int { return usageStatus } -// RunDiscriminator is `sww discriminator`: it reads the settings, the rule files, +// RunWAF is `sww waf`: it reads the settings, the rule files, // the lookup database and the state files, then serves requests until ctx is -// done. It returns the process's exit status, 1 when discriminator cannot start. -func RunDiscriminator(ctx context.Context, params Params) int { +// done. It returns the process's exit status, 1 when waf cannot start. +func RunWAF(ctx context.Context, params Params) int { // Until the settings are read, the one message is an invalid setting's // error, which every SWW_LOG_LEVEL lets through. processLog := requestlog.NewProcessLogger(params.Stdout, @@ -151,7 +151,7 @@ func RunDiscriminator(ctx context.Context, params Params) int { return 1 } - crs, err := discriminator.NewCoreRuleSet(cfg) + crs, err := waf.NewCoreRuleSet(cfg) if err != nil { processLog.Error("cannot use the Core Rule Set", "error", err.Error()) @@ -191,14 +191,14 @@ func RunDiscriminator(ctx context.Context, params Params) int { return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog) } -// newServer returns the server discriminator runs, with the metrics of the alerts, +// newServer returns the server waf runs, with the metrics of the alerts, // after reading the lookup database while SWW_LOOKUP_SOURCE is file. A lookup // database that cannot be read is an error. func newServer( cfg *config.Config, stdout io.Writer, processLog *slog.Logger, now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue, crs *coreruleset.CoreRuleSet, -) (*discriminator.Server, error) { +) (*waf.Server, error) { var lookupFile *lookup.File if cfg.LookupSource == "file" { @@ -215,7 +215,7 @@ func newServer( } } - server := discriminator.New(discriminator.Params{ + server := waf.New(waf.Params{ Config: cfg, RequestLog: stdout, ProcessLog: processLog, @@ -239,7 +239,7 @@ func newServer( // loadStateFiles reads the state files into the parts of server and into // alertQueue, as state.Load does. func loadStateFiles( - cfg *config.Config, server *discriminator.Server, alertQueue *alerts.Queue, + cfg *config.Config, server *waf.Server, alertQueue *alerts.Queue, now func() time.Time, processLog *slog.Logger, ) (*state.Files, error) { return state.Load(state.Params{ @@ -325,7 +325,7 @@ func startSending( // shutdownTimeout to finish, and writes every state file, alerts.json with // the alerts still waiting. func serve( - ctx context.Context, server *discriminator.Server, listener net.Listener, + ctx context.Context, server *waf.Server, listener net.Listener, files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue, processLog *slog.Logger, ) int { diff --git a/internal/sww/sww_test.go b/internal/sww/sww_test.go index 3087637..84b9b1f 100644 --- a/internal/sww/sww_test.go +++ b/internal/sww/sww_test.go @@ -20,9 +20,9 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/config" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest" "sneak.berlin/go/smallwebwaf/internal/sww" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -123,11 +123,11 @@ func (o *output) text() string { return o.buf.String() } -// run runs `sww discriminator` with the settings in env until ctx is done, +// run runs `sww waf` with the settings in env until ctx is done, // and returns its exit status. SWW_LOOKUP_SOURCE is off unless env sets it, // so that no test sends GeoJS its clients' addresses. func run(ctx context.Context, env map[string]string, out *output) int { - return sww.RunDiscriminator(ctx, sww.Params{ + return sww.RunWAF(ctx, sww.Params{ Version: testVersion, LookupEnv: func(name string) (string, bool) { value, ok := env[name] @@ -1245,7 +1245,7 @@ func startApp(t *testing.T) string { return app.URL } -// runUntilStopped runs `sww discriminator` with the settings in env, has use +// runUntilStopped runs `sww waf` with the settings in env, has use // send it requests at url, then stops it as SIGTERM does, checks that it // stopped in order, and returns its output. func runUntilStopped( @@ -1319,7 +1319,7 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) { } } -// wantAllowed checks that discriminator at url allows a request from localhost. +// wantAllowed checks that waf at url allows a request from localhost. func wantAllowed(t *testing.T, url string) { t.Helper() @@ -1504,7 +1504,7 @@ func onlyBan(t *testing.T, dir string) map[string]any { return file.Bans[0] } -// wantRefused checks that discriminator at url refuses a request from localhost with +// wantRefused checks that waf at url refuses a request from localhost with // 403, the default SWW_BAN_RESPONSE. func wantRefused(t *testing.T, url string) { t.Helper() @@ -1681,8 +1681,8 @@ func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost } // statusFrom returns the status a request to url from the client at from is -// answered with. The request serves rproxy and discriminator alike. rproxy reads the -// client from X-Forwarded-For, and replaces the other two headers. To discriminator, +// answered with. The request serves rproxy and waf alike. rproxy reads the +// client from X-Forwarded-For, and replaces the other two headers. To waf, // they make it a question about that client. func statusFrom(t *testing.T, url, from string) int { t.Helper() @@ -1694,7 +1694,7 @@ func statusFrom(t *testing.T, url, from string) int { } req.Header.Set("X-Forwarded-For", from) - req.Header.Set(discriminator.ClientHeader, from) + req.Header.Set(waf.ClientHeader, from) req.Header.Set("X-Request-ID", rand.Text()) transport := &http.Transport{} diff --git a/internal/sww/discriminator_test.go b/internal/sww/waf_test.go similarity index 77% rename from internal/sww/discriminator_test.go rename to internal/sww/waf_test.go index 077b7bf..2c3a713 100644 --- a/internal/sww/discriminator_test.go +++ b/internal/sww/waf_test.go @@ -14,8 +14,8 @@ import ( "testing" "time" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/sww" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // commandForMain, while set in the environment, has this test binary run Main @@ -34,7 +34,7 @@ func TestMain(m *testing.M) { os.Exit(sww.Main(testVersion)) } -func TestMainRunsDiscriminator(t *testing.T) { +func TestMainRunsWAF(t *testing.T) { t.Parallel() binary, err := os.Executable() @@ -50,7 +50,7 @@ func TestMainRunsDiscriminator(t *testing.T) { cmd.Stdout = out cmd.Env = append(os.Environ(), - commandForMain+"="+discriminatorCommand, + commandForMain+"="+wafCommand, listenAddr+"="+localhost+":0", stateDir+"="+t.TempDir(), rulesDir+"="+t.TempDir(), @@ -67,7 +67,7 @@ func TestMainRunsDiscriminator(t *testing.T) { }) addr, _ := out.line(t, "msg", "starting")["address"].(string) - ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow) + ask(t, addr, "/", http.StatusOK, waf.DispositionAllow) err = cmd.Process.Signal(syscall.SIGTERM) if err != nil { @@ -108,7 +108,7 @@ func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) { t.Errorf("exit status %d (%v), want 2", code, err) } - for _, name := range []string{"rproxy", discriminatorCommand, "healthcheck"} { + for _, name := range []string{"rproxy", wafCommand, "healthcheck"} { if !strings.Contains(stderr.String(), name) { t.Errorf("stderr %q does not name %s", stderr.String(), name) } @@ -121,7 +121,7 @@ func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) { } } -// ask sends discriminator at addr rproxy's question about a request for path from +// ask sends waf at addr rproxy's question about a request for path from // placed, checks the answer's status and disposition, and closes it. func ask(t *testing.T, addr, path string, status int, disposition string) { t.Helper() @@ -132,7 +132,7 @@ func ask(t *testing.T, addr, path string, status int, disposition string) { t.Fatalf("new request: %v", err) } - req.Header.Set(discriminator.ClientHeader, placed) + req.Header.Set(waf.ClientHeader, placed) req.Header.Set("X-Request-ID", rand.Text()) transport := &http.Transport{} @@ -147,16 +147,16 @@ func ask(t *testing.T, addr, path string, status int, disposition string) { _ = res.Body.Close() if res.StatusCode != status || - res.Header.Get(discriminator.DispositionHeader) != disposition { + res.Header.Get(waf.DispositionHeader) != disposition { t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode, - res.Header.Get(discriminator.DispositionHeader), status, disposition) + res.Header.Get(waf.DispositionHeader), status, disposition) } } -// runDiscriminator runs `sww discriminator` with the settings in env, has use +// runWAF runs `sww waf` with the settings in env, has use // send it requests at the address it listens on, stops it as SIGTERM does, and // checks that it stopped in order. -func runDiscriminator(t *testing.T, env map[string]string, use func(addr string)) { +func runWAF(t *testing.T, env map[string]string, use func(addr string)) { t.Helper() ctx, stop := context.WithCancel(t.Context()) @@ -183,7 +183,7 @@ func runDiscriminator(t *testing.T, env map[string]string, use func(addr string) out.line(t, "msg", "stopped") } -func TestDiscriminatorKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) { +func TestWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) { t.Parallel() env := map[string]string{ @@ -192,13 +192,13 @@ func TestDiscriminatorKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) { rulesDir: filepath.Join("..", "..", "share", "rules.d"), } - runDiscriminator(t, env, func(addr string) { - ask(t, addr, "/", http.StatusOK, discriminator.DispositionAllow) + runWAF(t, env, func(addr string) { + ask(t, addr, "/", http.StatusOK, waf.DispositionAllow) // The default rule file bans a probe for this. - ask(t, addr, "/.env", http.StatusForbidden, discriminator.DispositionDeny) + ask(t, addr, "/.env", http.StatusForbidden, waf.DispositionDeny) }) - runDiscriminator(t, env, func(addr string) { - ask(t, addr, "/", http.StatusForbidden, discriminator.DispositionDeny) + runWAF(t, env, func(addr string) { + ask(t, addr, "/", http.StatusForbidden, waf.DispositionDeny) }) } diff --git a/internal/discriminator/abuseipdb.go b/internal/waf/abuseipdb.go similarity index 98% rename from internal/discriminator/abuseipdb.go rename to internal/waf/abuseipdb.go index 0edcc58..6fca7fd 100644 --- a/internal/discriminator/abuseipdb.go +++ b/internal/waf/abuseipdb.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic abuseipdb. It reads SWW_ABUSEIPDB_KEY, // SWW_ABUSEIPDB_MIN_SCORE and SWW_REPUTATION_ACTION. diff --git a/internal/discriminator/admin.go b/internal/waf/admin.go similarity index 97% rename from internal/discriminator/admin.go rename to internal/waf/admin.go index ba686bf..e3a1497 100644 --- a/internal/discriminator/admin.go +++ b/internal/waf/admin.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "bytes" @@ -49,7 +49,7 @@ func (rq *request) answerHealth() { _, _ = io.WriteString(rq.out, "ok\n") } -// answerAdmin answers a request for one of discriminator's own endpoints. Each +// answerAdmin answers a request for one of waf's own endpoints. Each // needs a token, sent as Authorization: Bearer : the metrics // SWW_METRICS_TOKEN, the others SWW_ADMIN_TOKEN. A request without it is // refused with 401. An endpoint whose token is unset answers 404, as any other @@ -250,7 +250,7 @@ type clientAnswer struct { Bans []state.BanEntry `json:"bans"` } -// showClient answers GET ClientsPath with what discriminator knows of the client: +// showClient answers GET ClientsPath with what waf knows of the client: // its counters, its history, which holds its country as last looked up and its // offences, and its bans with their notes. func (rq *request) showClient() { diff --git a/internal/discriminator/admin_test.go b/internal/waf/admin_test.go similarity index 87% rename from internal/discriminator/admin_test.go rename to internal/waf/admin_test.go index e679954..13d65dc 100644 --- a/internal/discriminator/admin_test.go +++ b/internal/waf/admin_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "encoding/json" @@ -10,10 +10,10 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/requestlog" "sneak.berlin/go/smallwebwaf/internal/state" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -88,11 +88,11 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) { // Any other request under /_sww/ is not found. for _, e := range []adminEndpoint{ - {http.MethodPut, discriminator.BansPath, banOtherClient}, - {http.MethodDelete, discriminator.BansPath, ""}, - {http.MethodGet, discriminator.BansPath + "/" + otherClient, ""}, - {http.MethodPost, discriminator.ClientsPath + otherClient, ""}, - {http.MethodGet, strings.TrimSuffix(discriminator.ClientsPath, "/"), ""}, + {http.MethodPut, waf.BansPath, banOtherClient}, + {http.MethodDelete, waf.BansPath, ""}, + {http.MethodGet, waf.BansPath + "/" + otherClient, ""}, + {http.MethodPost, waf.ClientsPath + otherClient, ""}, + {http.MethodGet, strings.TrimSuffix(waf.ClientsPath, "/"), ""}, } { s.admin(e.method, e.path, e.body, http.StatusNotFound) } @@ -118,7 +118,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) { Reason: "probes for logins", } - wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, banOtherClient, + wantBans(t, s.admin(http.MethodPost, waf.BansPath, banOtherClient, http.StatusOK), want) line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned) @@ -129,7 +129,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) { // Its notes count the request it refused. want.Notes.Requests, want.Notes.Refused = 1, 1 - wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want) + wantBans(t, s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK), want) // Ten minutes on, lifting the bans on client lifts that one, which is // kept, marked lifted. @@ -138,13 +138,13 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) { lifted := clk.Now() want.Lifted = &lifted - wantBans(t, s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "", + wantBans(t, s.admin(http.MethodDelete, waf.BansPath+"/"+client, "", http.StatusOK), want) s.get(client, http.StatusOK, requestlog.ActionForward) - wantBans(t, s.admin(http.MethodGet, discriminator.BansPath, "", http.StatusOK), want) + wantBans(t, s.admin(http.MethodGet, waf.BansPath, "", http.StatusOK), want) // No ban on it is active any more. - s.admin(http.MethodDelete, discriminator.BansPath+"/"+client, "", http.StatusNotFound) + s.admin(http.MethodDelete, waf.BansPath+"/"+client, "", http.StatusNotFound) } func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) { @@ -181,7 +181,7 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) { want.Expires = &expires } - wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, body, http.StatusOK), + wantBans(t, s.admin(http.MethodPost, waf.BansPath, body, http.StatusOK), want) } } @@ -251,7 +251,7 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) { "request body too large", }, } { - got := s.admin(http.MethodPost, discriminator.BansPath, tc.body, + got := s.admin(http.MethodPost, waf.BansPath, tc.body, http.StatusBadRequest) if !strings.Contains(string(got.body), tc.want) { t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want) @@ -285,7 +285,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) { Bans []state.BanEntry `json:"bans"` } - decode(t, s.admin(http.MethodGet, discriminator.ClientsPath+addr, "", + decode(t, s.admin(http.MethodGet, waf.ClientsPath+addr, "", http.StatusOK), &got) if got.Client == nil { @@ -308,15 +308,15 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) { // Of an address no request came from and no ban covers, nothing is // known. - got := s.admin(http.MethodGet, discriminator.ClientsPath+"198.51.100.99", "", + got := s.admin(http.MethodGet, waf.ClientsPath+"198.51.100.99", "", http.StatusOK) if string(got.body) != "{\n \"client\": null,\n \"bans\": []\n}\n" { t.Errorf("an unknown client is answered\n%s", got.body) } - s.admin(http.MethodGet, discriminator.ClientsPath+"203.0.113", "", + s.admin(http.MethodGet, waf.ClientsPath+"203.0.113", "", http.StatusBadRequest) - s.admin(http.MethodDelete, discriminator.BansPath+"/203.0.113.0/24", "", + s.admin(http.MethodDelete, waf.BansPath+"/203.0.113.0/24", "", http.StatusBadRequest) } @@ -347,14 +347,14 @@ type adminEndpoint struct { // bans on otherClient, and asking about otherClient. func adminEndpoints() []adminEndpoint { return []adminEndpoint{ - {http.MethodGet, discriminator.BansPath, ""}, - {http.MethodPost, discriminator.BansPath, banOtherClient}, - {http.MethodDelete, discriminator.BansPath + "/" + otherClient, ""}, - {http.MethodGet, discriminator.ClientsPath + otherClient, ""}, + {http.MethodGet, waf.BansPath, ""}, + {http.MethodPost, waf.BansPath, banOtherClient}, + {http.MethodDelete, waf.BansPath + "/" + otherClient, ""}, + {http.MethodGet, waf.ClientsPath + otherClient, ""}, } } -// admin sends a request with method for path, with body, to discriminator's own +// admin sends a request with method for path, with body, to waf's own // address, with the admin token, and checks that it is answered with status, its // log line's action own_endpoint. It returns the answer. func (s *sender) admin(method, path, body string, status int) answer { @@ -370,7 +370,7 @@ func (s *sender) ownEndpointRequest( ) answer { s.t.Helper() - req := newRequest(s.t, method, s.discriminatorAddr, path, strings.NewReader(body)) + req := newRequest(s.t, method, s.wafAddr, path, strings.NewReader(body)) if authorization != "" { req.Header.Set("Authorization", authorization) } diff --git a/internal/discriminator/alerts_test.go b/internal/waf/alerts_test.go similarity index 97% rename from internal/discriminator/alerts_test.go rename to internal/waf/alerts_test.go index 4370aad..54c2266 100644 --- a/internal/discriminator/alerts_test.go +++ b/internal/waf/alerts_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "maps" @@ -10,8 +10,8 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -203,7 +203,7 @@ func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) { // never sent them, and returns the queue they wait in as well. func startWithAlerts( t *testing.T, env map[string]string, -) (*sender, *clock, *discriminator.Server, *alerts.Queue) { +) (*sender, *clock, *waf.Server, *alerts.Queue) { t.Helper() return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env) @@ -212,7 +212,7 @@ func startWithAlerts( // startAppWithAlerts is startWithAlerts in front of the app handler. func startAppWithAlerts( t *testing.T, handler http.HandlerFunc, env map[string]string, -) (*sender, *clock, *discriminator.Server, *alerts.Queue) { +) (*sender, *clock, *waf.Server, *alerts.Queue) { t.Helper() app := startApp(t, handler) @@ -226,7 +226,7 @@ func startAppWithAlerts( addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings) - s := &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out} + s := &sender{t: t, addr: addr, wafAddr: server.Addr, out: out} return s, clk, server, queue } diff --git a/internal/discriminator/anomaly_internal_test.go b/internal/waf/anomaly_internal_test.go similarity index 97% rename from internal/discriminator/anomaly_internal_test.go rename to internal/waf/anomaly_internal_test.go index 03b4759..0703e7c 100644 --- a/internal/discriminator/anomaly_internal_test.go +++ b/internal/waf/anomaly_internal_test.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "net/netip" diff --git a/internal/discriminator/anomaly_test.go b/internal/waf/anomaly_test.go similarity index 98% rename from internal/discriminator/anomaly_test.go rename to internal/waf/anomaly_test.go index 504a883..d7b70b6 100644 --- a/internal/discriminator/anomaly_test.go +++ b/internal/waf/anomaly_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "maps" @@ -13,9 +13,9 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/anomaly" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // The anomaly thresholds: the prefix of a scope followed by the end of a @@ -319,7 +319,7 @@ func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) { // kept. geojsURL, _, release := startHeldGeoJS(t) - var server atomic.Pointer[discriminator.Server] + var server atomic.Pointer[waf.Server] app := startApp(t, func(http.ResponseWriter, *http.Request) { release() diff --git a/internal/discriminator/answertime_test.go b/internal/waf/answertime_test.go similarity index 83% rename from internal/discriminator/answertime_test.go rename to internal/waf/answertime_test.go index 388fd0b..c6e7208 100644 --- a/internal/discriminator/answertime_test.go +++ b/internal/waf/answertime_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "fmt" @@ -15,16 +15,16 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/lookup" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/reputation" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( // answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time - // discriminator has to answer. + // waf has to answer. answerTimeLimit = 2 * time.Second // defaultLookupWait is the default of SWW_LOOKUP_TIMEOUT. defaultLookupWait = 800 * time.Millisecond @@ -33,7 +33,7 @@ const ( headerFieldLimit = 100 // cookieHeader is the header the cookie limit counts. cookieHeader = "Cookie" - // tooLarge is how discriminator refuses a request over the header limits. + // tooLarge is how waf refuses a request over the header limits. tooLarge = http.StatusRequestHeaderFieldsTooLarge // silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in // that silentGeoJSURL names too. @@ -56,7 +56,7 @@ func cookies(count int) string { } // fillHeaders adds headers to a question until the checks see total header -// fields: all but ClientHeader and PeerHeader, which discriminator removes. Go's +// fields: all but ClientHeader and PeerHeader, which waf removes. Go's // client sends nothing else but Host, which the limit does not count, once // User-Agent is set. func fillHeaders(req *http.Request, total int) { @@ -70,13 +70,13 @@ func fillHeaders(req *http.Request, total int) { func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{wafMode: block}) + s := startWAF(t, "", map[string]string{wafMode: block}) req := s.question(siteA, client, "/") req.Header.Set(cookieHeader, strings.Repeat("a;", 16000)) got := do(t, req) - wantDisposition(t, got, tooLarge, discriminator.DispositionDeny) + wantDisposition(t, got, tooLarge, waf.DispositionDeny) line := s.out.requestLine(t) wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge) @@ -89,7 +89,7 @@ func TestSixteenThousandCookiesAreRefusedBeforeTheCoreRuleSetReadsThem(t *testin func TestHeaderLimitRefusalNamesItsHeuristicCountsAndLimits(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) req := s.question(siteA, client, "/") fillHeaders(req, headerFieldLimit+1) do(t, req) @@ -143,7 +143,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{wafMode: block}) + s := startWAF(t, "", map[string]string{wafMode: block}) req := s.question(siteA, client, "/") tc.make(req) @@ -151,13 +151,13 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) { line := s.out.requestLine(t) if tc.refused { - wantDisposition(t, got, tooLarge, discriminator.DispositionDeny) + wantDisposition(t, got, tooLarge, waf.DispositionDeny) wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge) return } - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) wantLine(t, line, http.StatusOK, requestlog.ActionForward) if line.DurationCoreRuleSetMS == nil { @@ -178,11 +178,11 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) { t.Run(fmt.Sprint(env), func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", env) + s := startWAF(t, "", env) req := s.question(siteA, client, "/") req.Header.Set(cookieHeader, cookies(cookieLimit+1)) - wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny) + wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny) }) } } @@ -190,23 +190,23 @@ func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) { func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{wafMode: block, allowNets: client}) + s := startWAF(t, "", map[string]string{wafMode: block, allowNets: client}) req := s.question(siteA, client, "/") req.Header.Set(cookieHeader, cookies(cookieLimit+1)) - wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow) } func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{mode: observe, wafMode: block}) + s := startWAF(t, "", map[string]string{mode: observe, wafMode: block}) req := s.question(siteA, client, "/") req.Header.Set(cookieHeader, strings.Repeat("a;", 16000)) got := do(t, req) - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) line := s.out.requestLine(t) if line.WouldAction != requestlog.ActionRequestHeaderTooLarge || @@ -219,7 +219,7 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) { func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{rateLimitPerMinute: "1"}) + s := startWAF(t, "", map[string]string{rateLimitPerMinute: "1"}) ask := func() answer { req := s.question(siteA, client, "/") req.Header.Set(cookieHeader, cookies(cookieLimit+1)) @@ -227,8 +227,8 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) { return do(t, req) } - wantDisposition(t, ask(), tooLarge, discriminator.DispositionDeny) - wantDisposition(t, ask(), http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, ask(), tooLarge, waf.DispositionDeny) + wantDisposition(t, ask(), http.StatusForbidden, waf.DispositionDeny) lines := s.out.requestLines(t, 2) wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionClientIsRateLimited) @@ -246,13 +246,13 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ trapPaths: trapPathList, rulesDir: writeRules(t, testRules), }) req := s.question(siteA, client, tc.path) req.Header.Set(cookieHeader, cookies(cookieLimit+1)) - wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, do(t, req), http.StatusForbidden, waf.DispositionDeny) wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action) }) } @@ -262,13 +262,13 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) { t.Parallel() geojsURL, _ := startGeoJS(t) - s := startDiscriminator(t, geojsURL, map[string]string{ + s := startWAF(t, geojsURL, map[string]string{ unknownLimitPercent: "0", lookupTimeout: "1h", }) req := s.question(siteA, fromDE, "/") req.Header.Set(cookieHeader, cookies(cookieLimit+1)) - wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny) + wantDisposition(t, do(t, req), tooLarge, waf.DispositionDeny) line := s.out.requestLine(t) wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge) @@ -278,14 +278,14 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) { } // The client is under no ban, and GeoJS places it in a country. - wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, waf.DispositionAllow) } func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) { t.Parallel() geojsURL, _ := startGeoJS(t) - s := startDiscriminator(t, geojsURL, map[string]string{unknownLimitPercent: "0"}) + s := startWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"}) s.server.GeoJS.Load([]lookup.Answer{{ Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512", Answered: s.clock.Now(), Used: s.clock.Now(), @@ -294,7 +294,7 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T req := s.question(siteA, client, "/") req.Header.Set(cookieHeader, cookies(cookieLimit+1)) - wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, do(t, req), http.StatusForbidden, waf.DispositionDeny) wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionClientIsRateLimited) } @@ -303,14 +303,14 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) { t.Parallel() geojsURL, _ := startGeoJS(t) - s := startDiscriminator(t, geojsURL, map[string]string{ + s := startWAF(t, geojsURL, map[string]string{ mode: observe, addLookupHeaders: on, lookupTimeout: "1h", }) req := s.question(siteA, fromDE, "/") req.Header.Set(cookieHeader, cookies(cookieLimit+1)) got := do(t, req) - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country") if asn != asnDE || country != "DE" { @@ -319,18 +319,18 @@ func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) { } } -// newDiscriminatorInBubble makes a discriminator for a synctest bubble: GeoJS never +// newWAFInBubble makes a waf for a synctest bubble: GeoJS never // answers, a setting needs its answer, and everything is at its default but // for env. No request to it may use the network. -func newDiscriminatorInBubble( +func newWAFInBubble( t *testing.T, env map[string]string, -) (*discriminator.Server, *output) { +) (*waf.Server, *output) { t.Helper() settings := map[string]string{tagDeny: "country=KP"} maps.Copy(settings, env) - server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, settings) + server, out, _ := newWAF(t, silentGeoJSURL, time.Now, settings) return server, out } @@ -338,13 +338,13 @@ func newDiscriminatorInBubble( // askDirectly hands a question about a request from client straight to server, // as change leaves it, and returns the answer's status and how long it took. func askDirectly( - t *testing.T, server *discriminator.Server, change func(*http.Request), + t *testing.T, server *waf.Server, change func(*http.Request), ) (int, time.Duration) { t.Helper() req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody) req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234") - req.Header.Set(discriminator.ClientHeader, client) + req.Header.Set(waf.ClientHeader, client) req.Header.Set(requestIDHeader, "the-id") change(req) @@ -357,17 +357,17 @@ func askDirectly( } // banClient bans client at now. -func banClient(_ *testing.T, server *discriminator.Server, now time.Time) { +func banClient(_ *testing.T, server *waf.Server, now time.Time) { server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{}) } // countClient counts one request from client at now for the rate limits. -func countClient(_ *testing.T, server *discriminator.Server, now time.Time) { +func countClient(_ *testing.T, server *waf.Server, now time.Time) { server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit) } // listClient puts client on the blocklist at dropURL. -func listClient(t *testing.T, server *discriminator.Server, now time.Time) { +func listClient(t *testing.T, server *waf.Server, now time.Time) { t.Helper() err := server.Lists.Load([]reputation.List{{ @@ -379,13 +379,13 @@ func listClient(t *testing.T, server *discriminator.Server, now time.Time) { } // decideOnClient puts client on the CrowdSec decision list. -func decideOnClient(t *testing.T, server *discriminator.Server, now time.Time) { +func decideOnClient(t *testing.T, server *waf.Server, now time.Time) { t.Helper() loadDecisions(t, server, now, clientsDecision) } // leaveAsItIs prepares nothing. -func leaveAsItIs(*testing.T, *discriminator.Server, time.Time) {} +func leaveAsItIs(*testing.T, *waf.Server, time.Time) {} func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) { t.Parallel() @@ -396,7 +396,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) { name string env map[string]string // prepare gets the server ready, at now, before the question. - prepare func(t *testing.T, server *discriminator.Server, now time.Time) + prepare func(t *testing.T, server *waf.Server, now time.Time) // cookie is the request's Cookie header. cookie string status int @@ -443,7 +443,7 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) { // In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays // says, so that a request that does not wait takes no time at all. synctest.Test(t, func(t *testing.T) { - server, out := newDiscriminatorInBubble(t, tc.env) + server, out := newWAFInBubble(t, tc.env) tc.prepare(t, server, time.Now()) status, took := askDirectly(t, server, func(req *http.Request) { @@ -471,7 +471,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) { name string env map[string]string // prepare gets the server ready, at now, before the question. - prepare func(t *testing.T, server *discriminator.Server, now time.Time) + prepare func(t *testing.T, server *waf.Server, now time.Time) status int action string }{ @@ -500,7 +500,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) { t.Parallel() synctest.Test(t, func(t *testing.T) { - server, out := newDiscriminatorInBubble(t, tc.env) + server, out := newWAFInBubble(t, tc.env) tc.prepare(t, server, time.Now()) status, took := askDirectly(t, server, func(*http.Request) {}) @@ -516,7 +516,7 @@ func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) { } } -func TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs( +func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs( t *testing.T, ) { t.Parallel() @@ -531,12 +531,12 @@ func TestDiscriminatorAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs( t.Cleanup(func() { _ = resolver.Close() }) - server, out, _ := newDiscriminatorWith(t, func( - params discriminator.Params, - ) *discriminator.Server { + server, out, _ := newWAFWith(t, func( + params waf.Params, + ) *waf.Server { params.AbuseIPDBURL = silentAbuseIPDBURL - return discriminator.New(params) + return waf.New(params) }, held, time.Now, map[string]string{ tagDeny: "country=KP", wafMode: block, dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(), diff --git a/internal/discriminator/bans.go b/internal/waf/bans.go similarity index 99% rename from internal/discriminator/bans.go rename to internal/waf/bans.go index f1227ab..c8dbc46 100644 --- a/internal/discriminator/bans.go +++ b/internal/waf/bans.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic active_ban, and the code that makes bans, which several // heuristics share. active_ban reads SWW_MODE; the bans are the ban ledger's. diff --git a/internal/discriminator/bans_test.go b/internal/waf/bans_test.go similarity index 95% rename from internal/discriminator/bans_test.go rename to internal/waf/bans_test.go index cd3d2bb..1e37f23 100644 --- a/internal/discriminator/bans_test.go +++ b/internal/waf/bans_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "bufio" @@ -15,8 +15,8 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -393,14 +393,14 @@ func (c *clock) advance(d time.Duration) { c.now = c.now.Add(d) } -// startWithClock starts discriminator, and rproxy in front of an app that answers 200, +// startWithClock starts waf, and rproxy in front of an app that answers 200, // with the settings in env on top of trusting localhost's // X-Forwarded-For, clients' AS numbers and countries looked up at // geojsURL, and a clock set to midnight, the start of a bucket in every // window. func startWithClock( t *testing.T, geojsURL string, env map[string]string, -) (*sender, *clock, *discriminator.Server) { +) (*sender, *clock, *waf.Server) { t.Helper() app := startApp(t, func(http.ResponseWriter, *http.Request) {}) @@ -410,20 +410,20 @@ func startWithClock( addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings) - return &sender{t: t, addr: addr, discriminatorAddr: server.Addr, out: out}, clk, server + return &sender{t: t, addr: addr, wafAddr: server.Addr, out: out}, clk, server } // sender sends requests to rproxy one after another, each on a connection of its -// own, and checks each one's answer and log line. discriminatorAddr is where -// discriminator's own endpoints are, which ownEndpointRequest asks. Every request -// discriminator gets must come through the sender, since the log lines are +// own, and checks each one's answer and log line. wafAddr is where +// waf's own endpoints are, which ownEndpointRequest asks. Every request +// waf gets must come through the sender, since the log lines are // matched to them in order. type sender struct { - t *testing.T - addr string - discriminatorAddr string - out *output - sent int + t *testing.T + addr string + wafAddr string + out *output + sent int } // get sends a GET request for / from the client at from. diff --git a/internal/discriminator/biased.go b/internal/waf/biased.go similarity index 99% rename from internal/discriminator/biased.go rename to internal/waf/biased.go index ef97adc..5df6418 100644 --- a/internal/discriminator/biased.go +++ b/internal/waf/biased.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "sneak.berlin/go/smallwebwaf/internal/config" diff --git a/internal/discriminator/biased_test.go b/internal/waf/biased_test.go similarity index 97% rename from internal/discriminator/biased_test.go rename to internal/waf/biased_test.go index 8f2746b..54091bf 100644 --- a/internal/discriminator/biased_test.go +++ b/internal/waf/biased_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "fmt" @@ -15,9 +15,9 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // The biased thresholds. @@ -291,7 +291,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) { // In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays // says, with a GeoJS that never answers. synctest.Test(t, func(t *testing.T) { - server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, + server, out, _ := newWAF(t, silentGeoJSURL, time.Now, map[string]string{unknownLimitPercent: "0"}) // Once the time the request waits for its answer is up, the client @@ -335,7 +335,7 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) { // In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays // says, with a GeoJS that never answers. synctest.Test(t, func(t *testing.T) { - server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, + server, out, _ := newWAF(t, silentGeoJSURL, time.Now, map[string]string{ lookupTimeout: timeout.String(), tagLists: "vpn=" + vpnList, tc.setting: tc.value, }) @@ -437,7 +437,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T // clock. func startWithLookups( t *testing.T, env map[string]string, -) (*sender, *discriminator.Server, *alerts.Queue) { +) (*sender, *waf.Server, *alerts.Queue) { t.Helper() s, _, server, queue := startWithLookupsAndClock(t, env) @@ -452,7 +452,7 @@ func startWithLookups( // country, and no other address. func startWithLookupsAndClock( t *testing.T, env map[string]string, -) (*sender, *clock, *discriminator.Server, *alerts.Queue) { +) (*sender, *clock, *waf.Server, *alerts.Queue) { t.Helper() path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb") @@ -482,12 +482,12 @@ func (s *sender) uploadFrom(from string) logLine { // straight to server's handler, without the network, and returns once it is // answered. func serveFromDE( - t *testing.T, server *discriminator.Server, method string, body io.Reader, + t *testing.T, server *waf.Server, method string, body io.Reader, ) { t.Helper() req := httptest.NewRequestWithContext(t.Context(), method, "/", body) - req.Header.Set(discriminator.ClientHeader, fromDE) + req.Header.Set(waf.ClientHeader, fromDE) req.Header.Set(requestIDHeader, "the-id") server.Handler.ServeHTTP(httptest.NewRecorder(), req) diff --git a/internal/discriminator/blocklists.go b/internal/waf/blocklists.go similarity index 98% rename from internal/discriminator/blocklists.go rename to internal/waf/blocklists.go index fae5b0d..608fde6 100644 --- a/internal/discriminator/blocklists.go +++ b/internal/waf/blocklists.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic blocklists. It reads SWW_BLOCKLIST_ACTION, and the blocklists // through the reputation lists. diff --git a/internal/discriminator/bytelimits.go b/internal/waf/bytelimits.go similarity index 98% rename from internal/discriminator/bytelimits.go rename to internal/waf/bytelimits.go index 6996383..c665538 100644 --- a/internal/discriminator/bytelimits.go +++ b/internal/waf/bytelimits.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic byte_limits. It reads SWW_BYTES_COUNT, and the byte limits // and biased thresholds through the limiter and limitPercentages. diff --git a/internal/discriminator/bytelimits_test.go b/internal/waf/bytelimits_test.go similarity index 99% rename from internal/discriminator/bytelimits_test.go rename to internal/waf/bytelimits_test.go index 2170b0d..2b4b56b 100644 --- a/internal/discriminator/bytelimits_test.go +++ b/internal/waf/bytelimits_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "bufio" diff --git a/internal/discriminator/client.go b/internal/waf/client.go similarity index 98% rename from internal/discriminator/client.go rename to internal/waf/client.go index 4f72d24..2e2550a 100644 --- a/internal/discriminator/client.go +++ b/internal/waf/client.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "crypto/rand" diff --git a/internal/discriminator/coreruleset.go b/internal/waf/coreruleset.go similarity index 99% rename from internal/discriminator/coreruleset.go rename to internal/waf/coreruleset.go index e043087..4d4e804 100644 --- a/internal/discriminator/coreruleset.go +++ b/internal/waf/coreruleset.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic core_rule_set. It reads SWW_WAF_MODE, SWW_WAF_EXEMPT_PATHS // and SWW_WAF_ANOMALY_THRESHOLD. diff --git a/internal/discriminator/coreruleset_test.go b/internal/waf/coreruleset_test.go similarity index 99% rename from internal/discriminator/coreruleset_test.go rename to internal/waf/coreruleset_test.go index b2196be..c02f3a4 100644 --- a/internal/discriminator/coreruleset_test.go +++ b/internal/waf/coreruleset_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "io" diff --git a/internal/discriminator/countries.go b/internal/waf/countries.go similarity index 97% rename from internal/discriminator/countries.go rename to internal/waf/countries.go index 826f737..35d9d96 100644 --- a/internal/discriminator/countries.go +++ b/internal/waf/countries.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic countries. It reads SWW_EXCLUSIVELY_ALLOWED_COUNTRIES. diff --git a/internal/discriminator/countries_test.go b/internal/waf/countries_test.go similarity index 99% rename from internal/discriminator/countries_test.go rename to internal/waf/countries_test.go index 89311a2..8806ba0 100644 --- a/internal/discriminator/countries_test.go +++ b/internal/waf/countries_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "encoding/json" diff --git a/internal/discriminator/crowdsec.go b/internal/waf/crowdsec.go similarity index 98% rename from internal/discriminator/crowdsec.go rename to internal/waf/crowdsec.go index 6e1473f..a214a5a 100644 --- a/internal/discriminator/crowdsec.go +++ b/internal/waf/crowdsec.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic crowdsec. It reads SWW_CROWDSEC_LAPI_URL, and the decisions // through the reputation lists. diff --git a/internal/discriminator/crowdsec_test.go b/internal/waf/crowdsec_test.go similarity index 97% rename from internal/discriminator/crowdsec_test.go rename to internal/waf/crowdsec_test.go index 8a63627..368f4dd 100644 --- a/internal/discriminator/crowdsec_test.go +++ b/internal/waf/crowdsec_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" @@ -9,9 +9,9 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/reputation" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // The CrowdSec settings, and the tests' engine, which is never asked: each @@ -184,7 +184,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan( // decisionsURL, answer, the engine's answer, fetched at fetched, as // reputation.json would at start. func loadDecisions( - t *testing.T, server *discriminator.Server, fetched time.Time, answer string, + t *testing.T, server *waf.Server, fetched time.Time, answer string, ) { t.Helper() diff --git a/internal/discriminator/denynets.go b/internal/waf/denynets.go similarity index 96% rename from internal/discriminator/denynets.go rename to internal/waf/denynets.go index 41002e6..106aada 100644 --- a/internal/discriminator/denynets.go +++ b/internal/waf/denynets.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic deny_nets. It reads SWW_DENY_NETS. diff --git a/internal/discriminator/dnsbl.go b/internal/waf/dnsbl.go similarity index 98% rename from internal/discriminator/dnsbl.go rename to internal/waf/dnsbl.go index f00fd10..9b8bd7e 100644 --- a/internal/discriminator/dnsbl.go +++ b/internal/waf/dnsbl.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic dnsbl. It reads SWW_REPUTATION_ACTION, and the DNSBL zones' // verdicts through the DNSBL checker. diff --git a/internal/discriminator/headerlimits.go b/internal/waf/headerlimits.go similarity index 99% rename from internal/discriminator/headerlimits.go rename to internal/waf/headerlimits.go index ff9345a..c6ab162 100644 --- a/internal/discriminator/headerlimits.go +++ b/internal/waf/headerlimits.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic header_limits. It reads no setting: its limits are fixed. diff --git a/internal/discriminator/health_test.go b/internal/waf/health_test.go similarity index 86% rename from internal/discriminator/health_test.go rename to internal/waf/health_test.go index dcc64f3..2ef885b 100644 --- a/internal/discriminator/health_test.go +++ b/internal/waf/health_test.go @@ -1,11 +1,11 @@ -package discriminator_test +package waf_test import ( "net/http" "testing" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) func TestHealthEndpointCountsTowardNoLimit(t *testing.T) { @@ -21,7 +21,7 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) { ) for range healthChecks { - got := s.ownEndpointRequest("", http.MethodGet, discriminator.HealthPath, "", + got := s.ownEndpointRequest("", http.MethodGet, waf.HealthPath, "", http.StatusOK) if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType { diff --git a/internal/discriminator/heuristics.go b/internal/waf/heuristics.go similarity index 95% rename from internal/discriminator/heuristics.go rename to internal/waf/heuristics.go index 605d4a4..fbaa571 100644 --- a/internal/discriminator/heuristics.go +++ b/internal/waf/heuristics.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "context" @@ -9,7 +9,7 @@ import ( // and add one line for it to one of the lists below. Its settings go in // config.Config, and the comment at the top of its file names them. -// heuristic is one of the checks that decide what discriminator does with a +// heuristic is one of the checks that decide what waf does with a // request. type heuristic interface { // name is the heuristic's name, which the log line gives. @@ -70,7 +70,7 @@ func afterLookup() []heuristic { } } -// afterAnswer are the heuristics that run on a request once discriminator has +// afterAnswer are the heuristics that run on a request once waf has // answered it, before its decision line is written. They ban the client, and do // not change what the request got: their verdict's action is not used. func afterAnswer() []heuristic { diff --git a/internal/discriminator/history_test.go b/internal/waf/history_test.go similarity index 93% rename from internal/discriminator/history_test.go rename to internal/waf/history_test.go index 7671c18..b18d2a0 100644 --- a/internal/discriminator/history_test.go +++ b/internal/waf/history_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "io" @@ -8,9 +8,9 @@ import ( "testing" "time" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) { @@ -100,8 +100,8 @@ func TestOwnEndpointsAreNotInTheHistory(t *testing.T) { s, _, server := startWithClock(t, "", map[string]string{metricsToken: token}) - s.ownEndpointRequest("", http.MethodGet, discriminator.HealthPath, "", http.StatusOK) - s.ownEndpointRequest("", http.MethodGet, discriminator.MetricsPath, "", + s.ownEndpointRequest("", http.MethodGet, waf.HealthPath, "", http.StatusOK) + s.ownEndpointRequest("", http.MethodGet, waf.MetricsPath, "", http.StatusUnauthorized) s.scrape() @@ -128,7 +128,7 @@ func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) { // historyOf returns the history of the client at addr. func historyOf( - t *testing.T, server *discriminator.Server, addr string, + t *testing.T, server *waf.Server, addr string, ) ratelimit.History { t.Helper() diff --git a/internal/discriminator/lookup.go b/internal/waf/lookup.go similarity index 99% rename from internal/discriminator/lookup.go rename to internal/waf/lookup.go index 73558b2..63dcbd8 100644 --- a/internal/discriminator/lookup.go +++ b/internal/waf/lookup.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "context" diff --git a/internal/discriminator/lookup_test.go b/internal/waf/lookup_test.go similarity index 98% rename from internal/discriminator/lookup_test.go rename to internal/waf/lookup_test.go index 4e575fc..7923926 100644 --- a/internal/discriminator/lookup_test.go +++ b/internal/waf/lookup_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" @@ -379,13 +379,13 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) { // clock of the test's own: the wait lasts exactly as long as it should, // however slowly the test process runs. Nothing in it may wait on the // network, which would keep that clock from moving on: the request is - // handed to discriminator's handler, and GeoJS is one that never answers. + // handed to waf's handler, and GeoJS is one that never answers. synctest.Test(t, func(t *testing.T) { // Not the default. The exclusive list needs the answer, and the app // is never reached. const timeout = 3 * time.Second - server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, + server, out, _ := newWAF(t, silentGeoJSURL, time.Now, map[string]string{ lookupTimeout: timeout.String(), allowedCountries: "DE", diff --git a/internal/discriminator/metrics_test.go b/internal/waf/metrics_test.go similarity index 92% rename from internal/discriminator/metrics_test.go rename to internal/waf/metrics_test.go index 457ed1c..31d86bb 100644 --- a/internal/discriminator/metrics_test.go +++ b/internal/waf/metrics_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "io" @@ -11,9 +11,9 @@ import ( "time" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/lookup" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -32,7 +32,7 @@ func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) { // An empty token does not match the unset one either. for _, authorization := range []string{bearer, "Bearer ", ""} { - s.ownEndpointRequest(authorization, http.MethodGet, discriminator.MetricsPath, "", + s.ownEndpointRequest(authorization, http.MethodGet, waf.MetricsPath, "", http.StatusNotFound) } } @@ -46,19 +46,19 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) { method, path, authorization string status int }{ - {http.MethodGet, discriminator.MetricsPath, "", http.StatusUnauthorized}, + {http.MethodGet, waf.MetricsPath, "", http.StatusUnauthorized}, { - http.MethodGet, discriminator.MetricsPath, "Bearer " + strings.ToUpper(token), + http.MethodGet, waf.MetricsPath, "Bearer " + strings.ToUpper(token), http.StatusUnauthorized, }, - {http.MethodGet, discriminator.MetricsPath, "Basic " + token, + {http.MethodGet, waf.MetricsPath, "Basic " + token, http.StatusUnauthorized}, - {http.MethodGet, discriminator.MetricsPath, bearer, http.StatusOK}, - {http.MethodGet, discriminator.MetricsPath, "bearer " + token, http.StatusOK}, - {http.MethodPost, discriminator.MetricsPath, bearer, http.StatusNotFound}, - {http.MethodGet, discriminator.MetricsPath + "/", bearer, http.StatusNotFound}, + {http.MethodGet, waf.MetricsPath, bearer, http.StatusOK}, + {http.MethodGet, waf.MetricsPath, "bearer " + token, http.StatusOK}, + {http.MethodPost, waf.MetricsPath, bearer, http.StatusNotFound}, + {http.MethodGet, waf.MetricsPath + "/", bearer, http.StatusNotFound}, {http.MethodGet, "/_sww/bans", bearer, http.StatusNotFound}, - {http.MethodPost, discriminator.HealthPath, "", http.StatusNotFound}, + {http.MethodPost, waf.HealthPath, "", http.StatusNotFound}, } { got := s.ownEndpointRequest(tc.authorization, tc.method, tc.path, "", tc.status) @@ -181,7 +181,7 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) { wantMetric(t, s.scrape(), admins, 1) // And a ban made through the endpoint. - s.admin(http.MethodPost, discriminator.BansPath, banOtherClient, http.StatusOK) + s.admin(http.MethodPost, waf.BansPath, banOtherClient, http.StatusOK) wantMetric(t, s.scrape(), admins, 2) } @@ -361,12 +361,12 @@ func keptAnswer(addr, country string) lookup.Answer { } } -// scrape asks discriminator at addr for the metrics, with the token, and returns +// scrape asks waf at addr for the metrics, with the token, and returns // them. func scrape(t *testing.T, addr string) string { t.Helper() - req := newRequest(t, http.MethodGet, addr, discriminator.MetricsPath, http.NoBody) + req := newRequest(t, http.MethodGet, addr, waf.MetricsPath, http.NoBody) req.Header.Set("Authorization", bearer) got := do(t, req) @@ -381,7 +381,7 @@ func scrape(t *testing.T, addr string) string { func (s *sender) scrape() string { s.t.Helper() - return string(s.ownEndpointRequest(bearer, http.MethodGet, discriminator.MetricsPath, + return string(s.ownEndpointRequest(bearer, http.MethodGet, waf.MetricsPath, "", http.StatusOK).body) } diff --git a/internal/discriminator/observe_test.go b/internal/waf/observe_test.go similarity index 99% rename from internal/discriminator/observe_test.go rename to internal/waf/observe_test.go index 9d44220..d6d5a59 100644 --- a/internal/discriminator/observe_test.go +++ b/internal/waf/observe_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" diff --git a/internal/discriminator/proxy.go b/internal/waf/proxy.go similarity index 93% rename from internal/discriminator/proxy.go rename to internal/waf/proxy.go index 3e6215c..5c9587c 100644 --- a/internal/discriminator/proxy.go +++ b/internal/waf/proxy.go @@ -1,7 +1,7 @@ -// Package discriminator is the server the discriminator command runs. It answers +// Package waf is the server the waf command runs. It answers // rproxy's questions, takes rproxy's reports and answers its own endpoints, and // writes a log line for each. -package discriminator +package waf import ( "fmt" @@ -25,11 +25,11 @@ import ( "sneak.berlin/go/smallwebwaf/internal/rules" ) -// ownEndpointPrefix starts the path of each of discriminator's own endpoints. The app +// ownEndpointPrefix starts the path of each of waf's own endpoints. The app // never sees a path under it. const ownEndpointPrefix = "/_sww/" -// HealthPath is the health endpoint of discriminator and of rproxy, which the +// HealthPath is the health endpoint of waf and of rproxy, which the // container's health check asks. const HealthPath = "/_sww/healthz" @@ -41,7 +41,7 @@ const MetricsPath = "/_sww/metrics" // a client's address, lifts them, with SWW_ADMIN_TOKEN. const BansPath = "/_sww/bans" -// ClientsPath is where an admin asks what discriminator knows of a client, by +// ClientsPath is where an admin asks what waf knows of a client, by // the client's address after it, with SWW_ADMIN_TOKEN. const ClientsPath = "/_sww/clients/" @@ -49,7 +49,7 @@ const ClientsPath = "/_sww/clients/" type Params struct { Config *config.Config // RequestLog receives two JSON lines per question, one at its decision and - // one when its report comes, and one per request to discriminator's own + // one when its report comes, and one per request to waf's own // endpoints. RequestLog io.Writer // ProcessLog receives the process's own messages. @@ -73,7 +73,7 @@ type Params struct { // Rules are the rule files' rules, which each request is checked // against. Rules *rules.Files - // Alerts receive the alert for each ban discriminator makes or makes + // Alerts receive the alert for each ban waf makes or makes // permanent, for each count over an anomaly threshold, for each request // whose client a blocklist, the CrowdSec decision list, a DNSBL zone or // AbuseIPDB lists, for each request the Core Rule Set scores at or over @@ -83,7 +83,7 @@ type Params struct { Alerts *alerts.Queue } -// Server is the server discriminator runs, with the parts whose state the state +// Server is the server waf runs, with the parts whose state the state // files keep, the lookup database, nil unless SWW_LOOKUP_SOURCE is file, the // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts, // AbuseIPDB's scores and checks spent, and the metrics. RouteWatch, nil while @@ -248,7 +248,7 @@ func NewCoreRuleSet(cfg *config.Config) (*coreruleset.CoreRuleSet, error) { return coreRuleSet, nil } -// handler is discriminator's handler. It holds what every request shares; what +// handler is waf's handler. It holds what every request shares; what // belongs to one request is in a request. type handler struct { config *config.Config diff --git a/internal/discriminator/proxy_test.go b/internal/waf/proxy_test.go similarity index 89% rename from internal/discriminator/proxy_test.go rename to internal/waf/proxy_test.go index e98f866..fa0486e 100644 --- a/internal/discriminator/proxy_test.go +++ b/internal/waf/proxy_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "bufio" @@ -17,11 +17,11 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/config" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/lookup" "sneak.berlin/go/smallwebwaf/internal/requestlog" "sneak.berlin/go/smallwebwaf/internal/rproxy" "sneak.berlin/go/smallwebwaf/internal/rules" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -177,9 +177,9 @@ func (o *output) requestLine(t *testing.T) logLine { return o.requestLines(t, 1)[0] } -// endedLines waits for count requests that went through rproxy, or to discriminator's +// endedLines waits for count requests that went through rproxy, or to waf's // own endpoints, to have ended, and returns the last log line of each, in the -// order discriminator took them. A question's last line is the one its report writes. +// order waf took them. A question's last line is the one its report writes. func (o *output) endedLines(t *testing.T, count int) []logLine { t.Helper() @@ -189,7 +189,7 @@ func (o *output) endedLines(t *testing.T, count int) []logLine { ended := len(found) >= count for _, line := range found[:min(count, len(found))] { - if line.DiscriminatorLine == requestlog.DiscriminatorLineDecision { + if line.WAFLine == requestlog.WAFLineDecision { ended = false } } @@ -207,7 +207,7 @@ func (o *output) endedLines(t *testing.T, count int) []logLine { } // lastLines returns the last request log line written so far of each request, -// in the order discriminator took them. +// in the order waf took them. func (o *output) lastLines(t *testing.T) []logLine { t.Helper() @@ -273,9 +273,9 @@ func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server { return server } -// startProxy starts discriminator, and rproxy in front of the app at appURL, each with +// startProxy starts waf, and rproxy in front of the app at appURL, each with // the settings in env on top of the defaults, and returns where rproxy listens -// and what discriminator writes. +// and what waf writes. func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) { t.Helper() @@ -295,14 +295,14 @@ func startProxyWithGeoJS( } // startProxyWithClock is startProxyWithGeoJS with requests counted and -// bans made by the time now tells, and returns discriminator's server as well, whose -// Addr is where discriminator listens. Unless env sets SWW_RULES_DIR, it is an empty +// bans made by the time now tells, and returns waf's server as well, whose +// Addr is where waf listens. Unless env sets SWW_RULES_DIR, it is an empty // directory, of no rules, and unless it sets SWW_INSTANCE_NAME, that is app, // the label instance of every metric. func startProxyWithClock( t *testing.T, appURL, geojsURL string, now func() time.Time, env map[string]string, -) (string, *output, *discriminator.Server) { +) (string, *output, *waf.Server) { t.Helper() addr, out, server, _ := startProxyWithAlerts(t, appURL, geojsURL, now, env) @@ -311,14 +311,14 @@ func startProxyWithClock( } // startProxyWithAlerts is startProxyWithClock, and returns the queue of -// the alerts discriminator raises as well, as newDiscriminator makes them. +// the alerts waf raises as well, as newWAF makes them. func startProxyWithAlerts( t *testing.T, appURL, geojsURL string, now func() time.Time, env map[string]string, -) (string, *output, *discriminator.Server, *alerts.Queue) { +) (string, *output, *waf.Server, *alerts.Queue) { t.Helper() - server, out, alertQueue := newDiscriminator(t, geojsURL, now, env) + server, out, alertQueue := newWAF(t, geojsURL, now, env) serve(t, server) return startRProxy(t, server.Addr, appURL, env), out, server, alertQueue @@ -326,7 +326,7 @@ func startProxyWithAlerts( // serve serves server on a port of its own until the test ends, and sets its // Addr to where it listens. -func serve(t *testing.T, server *discriminator.Server) { +func serve(t *testing.T, server *waf.Server) { t.Helper() listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0") @@ -345,17 +345,17 @@ func serve(t *testing.T, server *discriminator.Server) { }) } -// startRProxy starts rproxy in front of the app at appURL, asking the discriminator -// at discriminatorAddr, with the settings in env on top of the defaults, and returns +// startRProxy starts rproxy in front of the app at appURL, asking the waf +// at wafAddr, with the settings in env on top of the defaults, and returns // where it listens. What it writes is dropped. SWRP_TIMEOUT_MS is a minute unless // env sets it, so that on a busy host SWRP_DEFAULT_DISPOSITION does not decide. func startRProxy( - t *testing.T, discriminatorAddr, appURL string, env map[string]string, + t *testing.T, wafAddr, appURL string, env map[string]string, ) string { t.Helper() settings := map[string]string{ - "SWRP_WAF_BACKEND": "http://" + discriminatorAddr, + "SWRP_WAF_BACKEND": "http://" + wafAddr, "SWRP_UPSTREAM_URL": appURL, "SWRP_TIMEOUT_MS": "60000", } @@ -392,7 +392,7 @@ func startRProxy( return listener.Addr().String() } -// newDiscriminator makes discriminator's server, without starting it, and +// newWAF makes waf's server, without starting it, and // returns it, what it writes, and the queue of the alerts it raises, as the // settings in env make it. No alert is sent from the queue: they wait in it, // for the test to look at. @@ -402,19 +402,19 @@ func startRProxy( // at abuseIPDBURL while env sets SWW_ABUSEIPDB_KEY. SWW_WAF_MODE is off unless // env sets it, so that only the tests of the Core Rule Set have their requests // inspected by it. -func newDiscriminator( +func newWAF( t *testing.T, geojsURL string, now func() time.Time, env map[string]string, -) (*discriminator.Server, *output, *alerts.Queue) { +) (*waf.Server, *output, *alerts.Queue) { t.Helper() - return newDiscriminatorWith(t, discriminator.New, geojsURL, now, env) + return newWAFWith(t, waf.New, geojsURL, now, env) } -// newDiscriminatorWith is newDiscriminator for the server build makes. -func newDiscriminatorWith( - t *testing.T, build func(discriminator.Params) *discriminator.Server, +// newWAFWith is newWAF for the server build makes. +func newWAFWith( + t *testing.T, build func(waf.Params) *waf.Server, geojsURL string, now func() time.Time, env map[string]string, -) (*discriminator.Server, *output, *alerts.Queue) { +) (*waf.Server, *output, *alerts.Queue) { t.Helper() settings := map[string]string{ @@ -466,12 +466,12 @@ func newDiscriminatorWith( } } - coreRuleSet, err := discriminator.NewCoreRuleSet(cfg) + coreRuleSet, err := waf.NewCoreRuleSet(cfg) if err != nil { t.Fatalf("Core Rule Set: %v", err) } - server := build(discriminator.Params{ + server := build(waf.Params{ Config: cfg, RequestLog: out, ProcessLog: processLog, @@ -516,7 +516,7 @@ func readAnswer(res *http.Response) answer { return answer{status: res.StatusCode, header: res.Header, body: body, err: err} } -// newRequest makes a request for path to addr, where rproxy or discriminator listens. +// newRequest makes a request for path to addr, where rproxy or waf listens. func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request { t.Helper() diff --git a/internal/discriminator/ratelimits.go b/internal/waf/ratelimits.go similarity index 99% rename from internal/discriminator/ratelimits.go rename to internal/waf/ratelimits.go index 482e42a..590e54d 100644 --- a/internal/discriminator/ratelimits.go +++ b/internal/waf/ratelimits.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic rate_limits. It reads SWW_RATE_LIMIT_EXEMPT_NETS, // SWW_RATE_LIMIT_EXEMPT_PATHS and SWW_BAN_RESPONSE, and the rate limits and diff --git a/internal/discriminator/ratelimits_test.go b/internal/waf/ratelimits_test.go similarity index 99% rename from internal/discriminator/ratelimits_test.go rename to internal/waf/ratelimits_test.go index 0e3a8b0..d7fafbb 100644 --- a/internal/discriminator/ratelimits_test.go +++ b/internal/waf/ratelimits_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" diff --git a/internal/discriminator/refusallimit.go b/internal/waf/refusallimit.go similarity index 97% rename from internal/discriminator/refusallimit.go rename to internal/waf/refusallimit.go index 1856811..56f8109 100644 --- a/internal/discriminator/refusallimit.go +++ b/internal/waf/refusallimit.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic refusal_limit. It reads SWW_ERROR_BURST_THRESHOLD and // SWW_BAN_RESPONSE. @@ -11,7 +11,7 @@ import ( "sneak.berlin/go/smallwebwaf/internal/requestlog" ) -// refusalLimit counts the request once it has been answered, if discriminator +// refusalLimit counts the request once it has been answered, if waf // refused it after a rule file match, a trap path or a Core Rule Set match, and // in observe mode if enforce mode would have: more than // SWW_ERROR_BURST_THRESHOLD such refusals of the client within a minute break diff --git a/internal/discriminator/refusallimit_test.go b/internal/waf/refusallimit_test.go similarity index 98% rename from internal/discriminator/refusallimit_test.go rename to internal/waf/refusallimit_test.go index c3142a5..4c2179e 100644 --- a/internal/discriminator/refusallimit_test.go +++ b/internal/waf/refusallimit_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "maps" @@ -10,14 +10,14 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const errorBurstThreshold = "SWW_ERROR_BURST_THRESHOLD" -// refused is a request the tests here send, which discriminator refuses after a rule +// refused is a request the tests here send, which waf refuses after a rule // file match. type refused int @@ -52,7 +52,7 @@ func (r refused) send(s *sender, from string) logLine { // SWW_ERROR_BURST_THRESHOLD at threshold, and the settings in env. func startForErrorBurst( t *testing.T, threshold string, env map[string]string, -) (*sender, *clock, *discriminator.Server) { +) (*sender, *clock, *waf.Server) { t.Helper() settings := map[string]string{ diff --git a/internal/discriminator/reputation.go b/internal/waf/reputation.go similarity index 98% rename from internal/discriminator/reputation.go rename to internal/waf/reputation.go index efabef6..f0a14c3 100644 --- a/internal/discriminator/reputation.go +++ b/internal/waf/reputation.go @@ -1,4 +1,4 @@ -package discriminator +package waf // What the reputation heuristics share: blocklists, crowdsec, dnsbl and // abuseipdb. diff --git a/internal/discriminator/reputation_test.go b/internal/waf/reputation_test.go similarity index 97% rename from internal/discriminator/reputation_test.go rename to internal/waf/reputation_test.go index 153ef50..0507f5b 100644 --- a/internal/discriminator/reputation_test.go +++ b/internal/waf/reputation_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "fmt" @@ -15,10 +15,10 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/reputation" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // The reputation settings. @@ -125,13 +125,13 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T) for _, tc := range []struct { heuristic string env map[string]string - load func(*testing.T, *discriminator.Server) + load func(*testing.T, *waf.Server) figures string }{ { "blocklists", map[string]string{blocklistURLs: dropURL, blocklistAction: actionDeny}, - func(t *testing.T, server *discriminator.Server) { + func(t *testing.T, server *waf.Server) { t.Helper() loadLists(t, server, map[string][]string{dropURL: {client}}) }, @@ -143,7 +143,7 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T) dnsblZones: dnsblZone, dnsblResolver: noResolver, reputationAction: actionDeny, }, - func(_ *testing.T, server *discriminator.Server) { + func(_ *testing.T, server *waf.Server) { loadVerdicts(server, map[string][]string{client: {dnsblZone}}) }, `{"zones": ["` + dnsblZone + `"]}`, @@ -151,7 +151,7 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T) { "abuseipdb", map[string]string{abuseIPDBKey: accountKey, reputationAction: actionDeny}, - func(_ *testing.T, server *discriminator.Server) { + func(_ *testing.T, server *waf.Server) { loadScores(server, map[string]int64{client: 80}) }, `{"score": 80, "min_score": 75}`, @@ -494,7 +494,7 @@ func TestReputationSourcesTagTheRequestWhateverTheirAction(t *testing.T) { for _, tc := range []struct { name string env map[string]string - load func(*discriminator.Server) + load func(*waf.Server) want []string }{ { @@ -502,7 +502,7 @@ func TestReputationSourcesTagTheRequestWhateverTheirAction(t *testing.T) { map[string]string{ dnsblZones: dnsblZone, dnsblResolver: noResolver, reputationAction: actionLog, }, - func(server *discriminator.Server) { + func(server *waf.Server) { loadVerdicts(server, map[string][]string{fromDE: {dnsblZone}}) }, []string{"asn=64496", "country=DE", "dnsbl=" + dnsblZone}, @@ -510,7 +510,7 @@ func TestReputationSourcesTagTheRequestWhateverTheirAction(t *testing.T) { { abuseipdb, map[string]string{abuseIPDBKey: accountKey, reputationAction: actionLog}, - func(server *discriminator.Server) { + func(server *waf.Server) { loadScores(server, map[string]int64{fromDE: 80}) }, []string{abuseipdb, "asn=64496", "country=DE"}, @@ -715,7 +715,7 @@ const ( // AbuseIPDB. const abuseipdb = reputation.AbuseIPDBSource -// abuseIPDBURL is where newDiscriminator has clients checked with AbuseIPDB: at +// abuseIPDBURL is where newWAF has clients checked with AbuseIPDB: at // abuseIPDBStandIn, which TestMain registers with Go's default transport, // through which AbuseIPDB is asked. const abuseIPDBURL = "abuseipdb://stand-in/api/v2/check" @@ -1075,7 +1075,7 @@ func verdictsFetched() time.Time { // verdictsFetched, as reputation.json would at start: one that lists the // client from each zone listedBy gives for it, and one that does not from // each other zone. -func loadVerdicts(server *discriminator.Server, listedBy map[string][]string) { +func loadVerdicts(server *waf.Server, listedBy map[string][]string) { verdicts := make([]reputation.Verdict, 0, len(listedBy)*len(server.DNSBL.Zones())) for client, zones := range listedBy { @@ -1093,7 +1093,7 @@ func loadVerdicts(server *discriminator.Server, listedBy map[string][]string) { // loadScores puts into server's AbuseIPDB the score scores gives each // client, an IPv4 address, fetched at verdictsFetched, as reputation.json // would at start. -func loadScores(server *discriminator.Server, scores map[string]int64) { +func loadScores(server *waf.Server, scores map[string]int64) { kept := make([]reputation.Score, 0, len(scores)) for client, score := range scores { kept = append(kept, reputation.Score{ @@ -1107,7 +1107,7 @@ func loadScores(server *discriminator.Server, scores map[string]int64) { // wantAbuseIPDBChecks checks how many clients server has checked with // AbuseIPDB. -func wantAbuseIPDBChecks(t *testing.T, server *discriminator.Server, want int) { +func wantAbuseIPDBChecks(t *testing.T, server *waf.Server, want int) { t.Helper() if got := server.AbuseIPDB.Checked(); got != want { @@ -1117,7 +1117,7 @@ func wantAbuseIPDBChecks(t *testing.T, server *discriminator.Server, want int) { // loadLists puts copies of lists into server's lists, by URL, each with // its lines, fetched at listsFetched, as reputation.json would at start. -func loadLists(t *testing.T, server *discriminator.Server, copies map[string][]string) { +func loadLists(t *testing.T, server *waf.Server, copies map[string][]string) { t.Helper() lists := make([]reputation.List, 0, len(copies)) diff --git a/internal/discriminator/request.go b/internal/waf/request.go similarity index 96% rename from internal/discriminator/request.go rename to internal/waf/request.go index e2a4407..a4508a4 100644 --- a/internal/discriminator/request.go +++ b/internal/waf/request.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "context" @@ -17,7 +17,7 @@ import ( "sneak.berlin/go/smallwebwaf/internal/rules" ) -// refusal is discriminator refusing a request: the status the visitor is to get, 0 +// refusal is waf refusing a request: the status the visitor is to get, 0 // to close its connection without an answer, and the action the log line names. type refusal struct { status int @@ -25,7 +25,7 @@ type refusal struct { } // decision is what the checks note of a request: its log line, and what -// counting the request needs once it has ended. discriminator keeps a copy of it +// counting the request needs once it has ended. waf keeps a copy of it // until the request's report comes. It holds no credentials, since the log line // never does, and neither the request's objects nor their bodies. type decision struct { @@ -34,7 +34,7 @@ type decision struct { // requestURI is the path with the query, as a ban's notes keep it. requestURI string // site is, for a question, the host the visitor asked for, which the - // alerts name, since one discriminator serves many sites. + // alerts name, since one waf serves many sites. site string // allowed is true for a question answered with DispositionAllow. allowed bool @@ -63,7 +63,7 @@ type decision struct { reputation []bans.ReputationHit } -// request is one request to discriminator, from the moment its headers have been +// request is one request to waf, from the moment its headers have been // read to its log line. type request struct { decision @@ -373,7 +373,7 @@ func (rq *request) answerAtTheEnd() (lookup.Answer, bool) { return rq.h.geojs.Kept(rq.h.clientGroup(rq.client)) } -// responseWriter is discriminator's answer to a request. It notes the status and +// responseWriter is waf's answer to a request. It notes the status and // size for the log line, and the first error writing the answer. type responseWriter struct { http.ResponseWriter diff --git a/internal/discriminator/requestlog_test.go b/internal/waf/requestlog_test.go similarity index 97% rename from internal/discriminator/requestlog_test.go rename to internal/waf/requestlog_test.go index 7c04695..c4886ab 100644 --- a/internal/discriminator/requestlog_test.go +++ b/internal/waf/requestlog_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "encoding/json" @@ -11,9 +11,9 @@ import ( "testing" "time" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( @@ -105,7 +105,7 @@ func wantFullLine(t *testing.T, line logLine) { headers := map[string]string{"accept": "text/html", "x-custom": "one, two"} want := withTimings(line, requestlog.Line{ - Type: requestType, DiscriminatorLine: requestlog.DiscriminatorLineReport, + Type: requestType, WAFLine: requestlog.WAFLineReport, Time: line.Time, Instance: instance, ClientIP: ipv6Client, Method: http.MethodPost, Scheme: secure, Host: appHost, Path: "/full", Protocol: protocol, @@ -131,7 +131,7 @@ func wantBareLine(t *testing.T, line logLine) { t.Helper() want := withTimings(line, requestlog.Line{ - Type: requestType, DiscriminatorLine: requestlog.DiscriminatorLineReport, + Type: requestType, WAFLine: requestlog.WAFLineReport, Time: line.Time, Instance: instance, ClientIP: localhost, Method: http.MethodPost, Scheme: plain, Host: appHost, Path: "/bare", Protocol: protocol, @@ -221,7 +221,7 @@ func TestTimingsAreInOrder(t *testing.T) { wantStatus(t, do(t, req), http.StatusForbidden) refused := out.endedLines(t, 2)[1] - wantStatus(t, get(t, server.Addr, discriminator.HealthPath), http.StatusOK) + wantStatus(t, get(t, server.Addr, waf.HealthPath), http.StatusOK) health := out.endedLines(t, 3)[2] // A request passed to the app has every timing; one refused, none of diff --git a/internal/discriminator/routewatchtags.go b/internal/waf/routewatchtags.go similarity index 98% rename from internal/discriminator/routewatchtags.go rename to internal/waf/routewatchtags.go index 33b469d..1814506 100644 --- a/internal/discriminator/routewatchtags.go +++ b/internal/waf/routewatchtags.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic routewatch_tags. It reads SWW_ROUTEWATCH_URL. diff --git a/internal/discriminator/routewatchtags_test.go b/internal/waf/routewatchtags_test.go similarity index 97% rename from internal/discriminator/routewatchtags_test.go rename to internal/waf/routewatchtags_test.go index 4b3e41b..f887018 100644 --- a/internal/discriminator/routewatchtags_test.go +++ b/internal/waf/routewatchtags_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "context" @@ -10,8 +10,8 @@ import ( "testing" "time" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) // routeWatchURL is SWW_ROUTEWATCH_URL, and tagsMissing the log line's field @@ -58,7 +58,7 @@ func startRouteWatch(t *testing.T, routes map[string]standInRoute) string { // waitForRouteWatch waits until routewatch's answer about from, in the client // group of the given length, is kept, so that the next request gets its tags. func waitForRouteWatch( - t *testing.T, server *discriminator.Server, from string, bits int, + t *testing.T, server *waf.Server, from string, bits int, ) { t.Helper() diff --git a/internal/discriminator/rulefiles.go b/internal/waf/rulefiles.go similarity index 98% rename from internal/discriminator/rulefiles.go rename to internal/waf/rulefiles.go index 1422a95..e3502a1 100644 --- a/internal/discriminator/rulefiles.go +++ b/internal/waf/rulefiles.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic rule_files. It reads the rules of the rule files, which // SWW_RULES_DIR and SWW_RULES_ENABLED name. diff --git a/internal/discriminator/rulefiles_test.go b/internal/waf/rulefiles_test.go similarity index 99% rename from internal/discriminator/rulefiles_test.go rename to internal/waf/rulefiles_test.go index dd8af4d..4979e80 100644 --- a/internal/discriminator/rulefiles_test.go +++ b/internal/waf/rulefiles_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" diff --git a/internal/discriminator/staticlists_test.go b/internal/waf/staticlists_test.go similarity index 99% rename from internal/discriminator/staticlists_test.go rename to internal/waf/staticlists_test.go index 04643da..e1a09e9 100644 --- a/internal/discriminator/staticlists_test.go +++ b/internal/waf/staticlists_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" diff --git a/internal/discriminator/tagdeny.go b/internal/waf/tagdeny.go similarity index 96% rename from internal/discriminator/tagdeny.go rename to internal/waf/tagdeny.go index b9a349d..923c6ae 100644 --- a/internal/discriminator/tagdeny.go +++ b/internal/waf/tagdeny.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic tag_deny. It reads SWW_TAG_DENY. diff --git a/internal/discriminator/tagdeny_test.go b/internal/waf/tagdeny_test.go similarity index 99% rename from internal/discriminator/tagdeny_test.go rename to internal/waf/tagdeny_test.go index 8222f43..220af6d 100644 --- a/internal/discriminator/tagdeny_test.go +++ b/internal/waf/tagdeny_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" diff --git a/internal/discriminator/taglists.go b/internal/waf/taglists.go similarity index 96% rename from internal/discriminator/taglists.go rename to internal/waf/taglists.go index dc3aba8..61407a7 100644 --- a/internal/discriminator/taglists.go +++ b/internal/waf/taglists.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic tag_lists. It reads the address lists of SWW_TAG_LISTS through // the reputation lists. diff --git a/internal/discriminator/taglists_test.go b/internal/waf/taglists_test.go similarity index 99% rename from internal/discriminator/taglists_test.go rename to internal/waf/taglists_test.go index b64c4c4..8bdf305 100644 --- a/internal/discriminator/taglists_test.go +++ b/internal/waf/taglists_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" diff --git a/internal/discriminator/trappaths.go b/internal/waf/trappaths.go similarity index 97% rename from internal/discriminator/trappaths.go rename to internal/waf/trappaths.go index adb80e6..c729ee0 100644 --- a/internal/discriminator/trappaths.go +++ b/internal/waf/trappaths.go @@ -1,4 +1,4 @@ -package discriminator +package waf // The heuristic trap_paths. It reads SWW_TRAP_PATHS. diff --git a/internal/discriminator/trappaths_test.go b/internal/waf/trappaths_test.go similarity index 99% rename from internal/discriminator/trappaths_test.go rename to internal/waf/trappaths_test.go index b2af734..5222195 100644 --- a/internal/discriminator/trappaths_test.go +++ b/internal/waf/trappaths_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "net/http" diff --git a/internal/discriminator/discriminator.go b/internal/waf/waf.go similarity index 89% rename from internal/discriminator/discriminator.go rename to internal/waf/waf.go index 1f78d37..17631b5 100644 --- a/internal/discriminator/discriminator.go +++ b/internal/waf/waf.go @@ -1,4 +1,4 @@ -package discriminator +package waf import ( "bytes" @@ -18,8 +18,8 @@ import ( "sneak.berlin/go/smallwebwaf/internal/requestlog" ) -// The headers of rproxy's question and of discriminator's answer, as -// "discriminator" in SPEC.md gives them. +// The headers of rproxy's question and of waf's answer, as +// "waf" in SPEC.md gives them. const ( // ClientHeader marks a request as rproxy's question, and gives the // visitor's address. @@ -28,7 +28,7 @@ const ( PeerHeader = "X-Sww-Peer" // ContentLengthHeader gives the body length the visitor announced. ContentLengthHeader = "X-Sww-Content-Length" - // DispositionHeader gives discriminator's answer. + // DispositionHeader gives waf's answer. DispositionHeader = "X-Sww-Disposition" ) @@ -41,12 +41,12 @@ const ( DispositionDeny = "deny" // DispositionClose tells rproxy to close the visitor's connection // without an answer, which SWW_BAN_RESPONSE asks for when it is close. - // discriminator closing the question's connection instead would read as - // discriminator being down, and rproxy would then let the request through. + // waf closing the question's connection instead would read as + // waf being down, and rproxy would then let the request through. DispositionClose = "close" ) -// ReportPath is where rproxy sends the report of each request discriminator +// ReportPath is where rproxy sends the report of each request waf // answered. const ReportPath = "/_sww/report" @@ -70,11 +70,11 @@ const ( // maxReportedMilliseconds is the longest duration a report may give, // about 31 years, so that it fits a time.Duration. maxReportedMilliseconds = 1e12 - // discriminatorTimeout bounds how long a request to discriminator takes to - // arrive, and its answer to leave, and discriminatorIdleTimeout how long a + // wafTimeout bounds how long a request to waf takes to + // arrive, and its answer to leave, and wafIdleTimeout how long a // kept-open connection waits for its next request. - discriminatorTimeout = 60 * time.Second - discriminatorIdleTimeout = 120 * time.Second + wafTimeout = 60 * time.Second + wafIdleTimeout = 120 * time.Second ) var ( @@ -97,7 +97,7 @@ type Report struct { DurationUpstreamTotalMS float64 `json:"duration_upstream_total_ms"` } -// New returns the server `sww discriminator` runs. It answers +// New returns the server `sww waf` runs. It answers // rproxy's questions, takes rproxy's reports and answers its own endpoints. It // passes nothing to an app. rproxy applies the size and time limits to the // visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it @@ -111,9 +111,9 @@ func New(params Params) *Server { Addr: params.Config.ListenAddr, Handler: h, ErrorLog: slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn), - ReadTimeout: discriminatorTimeout, - WriteTimeout: discriminatorTimeout, - IdleTimeout: discriminatorIdleTimeout, + ReadTimeout: wafTimeout, + WriteTimeout: wafTimeout, + IdleTimeout: wafIdleTimeout, }, Ledger: h.ledger, Limiter: h.limiter, @@ -128,8 +128,8 @@ func New(params Params) *Server { } } -// ServeHTTP handles one request to discriminator: a request carrying -// ClientHeader is rproxy's question, and any other is for discriminator +// ServeHTTP handles one request to waf: a request carrying +// ClientHeader is rproxy's question, and any other is for waf // itself. func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { if len(r.Header.Values(ClientHeader)) > 0 { @@ -146,7 +146,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { // its client: the heuristic crowdsec, header_limits, blocklists or rate_limits // will refuse it, as a function in that heuristic's file says. In observe mode, // which refuses nothing, none is. rproxy lets a request through when -// discriminator answers too late. +// waf answers too late. func (rq *request) refusedWhateverTheAnswer(now time.Time) bool { if rq.h.config.Observe { return false @@ -180,7 +180,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) { defer rq.finish() rq.site = r.Host - rq.line.DiscriminatorLine = requestlog.DiscriminatorLineDecision + rq.line.WAFLine = requestlog.WAFLineDecision refused := rq.check(r.Context()) rq.checked = time.Now() underOwnPrefix := strings.HasPrefix(r.URL.Path, ownEndpointPrefix) @@ -206,7 +206,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) { return } - // The app never sees this prefix. discriminator's own endpoints are at its + // The app never sees this prefix. waf's own endpoints are at its // own address, so this answers as a path with no endpoint does. rq.line.Action = requestlog.ActionOwnEndpoint rq.out.Header().Set(DispositionHeader, DispositionDeny) @@ -214,7 +214,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) { } // readQuestion returns the visitor's address and the body a question carries, -// and whether discriminator takes the question. It answers a question it does not +// and whether waf takes the question. It answers a question it does not // take with 400 and no disposition, which rproxy treats as it treats no // answer. The id of a question it takes is held from here on, without a // decision yet, so that another question with that id is refused while this @@ -257,7 +257,7 @@ func (h *handler) readQuestion( held, _ := h.awaitingReport.ContainsOrAdd(id, nil) if held { - h.refuseQuestion(w, requestIDHeader+" is the id of a request discriminator holds") + h.refuseQuestion(w, requestIDHeader+" is the id of a request waf holds") return netip.Addr{}, nil, false } @@ -265,14 +265,14 @@ func (h *handler) readQuestion( return client, body, true } -// refuseQuestion answers a question discriminator does not take, for reason. +// refuseQuestion answers a question waf does not take, for reason. func (h *handler) refuseQuestion(w http.ResponseWriter, reason string) { h.processLog.Warn("a question is refused", "reason", reason) http.Error(w, reason, http.StatusBadRequest) } // asTheVisitorSentIt returns a copy of r, a question, as the checks and the -// log line are to see it: without the headers rproxy adds for discriminator, +// log line are to see it: without the headers rproxy adds for waf, // with body, which has been read of r, and with the length the visitor // announced, as -1 when it announced none. The question's own length covers // only the part of the body it carries. @@ -340,7 +340,7 @@ func (rq *request) deny(r refusal) { http.Error(rq.out, http.StatusText(r.status), r.status) } -// answerOwnEndpoint answers a request to discriminator's own address. No check +// answerOwnEndpoint answers a request to waf's own address. No check // runs on it: the address is on the private network, where the peers are // rproxy and the admin's tools, not visitors. func (h *handler) answerOwnEndpoint(w http.ResponseWriter, r *http.Request) { @@ -455,7 +455,7 @@ func (h *handler) finishWith(ctx context.Context, held *decision, report Report) requestBytes: report.RequestBytes, } - rq.line.DiscriminatorLine = requestlog.DiscriminatorLineReport + rq.line.WAFLine = requestlog.WAFLineReport rq.line.Status = report.Status rq.line.RequestBytes = report.RequestBytes rq.line.ResponseBytes = report.ResponseBytes diff --git a/internal/discriminator/discriminator_test.go b/internal/waf/waf_test.go similarity index 77% rename from internal/discriminator/discriminator_test.go rename to internal/waf/waf_test.go index 44a3d2a..68d69d7 100644 --- a/internal/discriminator/discriminator_test.go +++ b/internal/waf/waf_test.go @@ -1,4 +1,4 @@ -package discriminator_test +package waf_test import ( "context" @@ -19,18 +19,18 @@ import ( "sneak.berlin/go/smallwebwaf/internal/alerts" "sneak.berlin/go/smallwebwaf/internal/bans" - "sneak.berlin/go/smallwebwaf/internal/discriminator" "sneak.berlin/go/smallwebwaf/internal/ratelimit" "sneak.berlin/go/smallwebwaf/internal/requestlog" + "sneak.berlin/go/smallwebwaf/internal/waf" ) const ( - // siteA and siteB are two sites behind one discriminator. + // siteA and siteB are two sites behind one waf. siteA = "a.example" siteB = "b.example" // rproxyPeer is what the tests' questions give as rproxy's TCP peer. rproxyPeer = "172.18.0.2" - // heldLimit is how many answered requests "discriminator" in SPEC.md says it + // heldLimit is how many answered requests "waf" in SPEC.md says it // holds. heldLimit = 10000 // reportedBytesLimit is the most bytes for each way SPEC.md lets a report @@ -42,7 +42,7 @@ const ( anomalyClientPerMinute = "SWW_ANOMALY_CLIENT_REQUESTS_PER_MINUTE" ) -// The fields of a report, as "discriminator" in SPEC.md names them. +// The fields of a report, as "waf" in SPEC.md names them. const ( reportID = "request_id" reportStatus = "status" @@ -52,46 +52,46 @@ const ( reportUpstreamDuration = "duration_upstream_total_ms" ) -// Discriminator is a discriminator running for one test, on a clock set to midnight. -type Discriminator struct { +// WAF is a waf running for one test, on a clock set to midnight. +type WAF struct { t *testing.T addr string out *output - server *discriminator.Server + server *waf.Server clock *clock queue *alerts.Queue } -// startDiscriminator starts discriminator with the settings in env, clients' AS numbers +// startWAF starts waf with the settings in env, clients' AS numbers // and countries looked up at geojsURL. -func startDiscriminator( +func startWAF( t *testing.T, geojsURL string, env map[string]string, -) *Discriminator { +) *WAF { t.Helper() - return startDiscriminatorWith(t, geojsURL, env, func(*discriminator.Server) {}) + return startWAFWith(t, geojsURL, env, func(*waf.Server) {}) } -// startDiscriminatorWith is startDiscriminator with change applied to the server before +// startWAFWith is startWAF with change applied to the server before // it starts. -func startDiscriminatorWith( +func startWAFWith( t *testing.T, geojsURL string, env map[string]string, - change func(*discriminator.Server), -) *Discriminator { + change func(*waf.Server), +) *WAF { t.Helper() clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)} settings := map[string]string{ - alertWebhookURL: "https://alerts.example/discriminator", + alertWebhookURL: "https://alerts.example/waf", instanceName: alertInstance, } maps.Copy(settings, env) - server, out, queue := newDiscriminator(t, geojsURL, clk.Now, settings) + server, out, queue := newWAF(t, geojsURL, clk.Now, settings) change(server) serve(t, server) - return &Discriminator{ + return &WAF{ t: t, addr: server.Addr, out: out, server: server, clock: clk, queue: queue, } } @@ -99,22 +99,22 @@ func startDiscriminatorWith( // questionWith makes rproxy's question about a request for path on host, from // the visitor at from, carrying body and a new id, as rproxy makes for every // request. -func (s *Discriminator) questionWith( +func (s *WAF) questionWith( method, host, from, path string, body io.Reader, ) *http.Request { s.t.Helper() req := newRequest(s.t, method, s.addr, path, body) req.Host = host - req.Header.Set(discriminator.ClientHeader, from) - req.Header.Set(discriminator.PeerHeader, rproxyPeer) + req.Header.Set(waf.ClientHeader, from) + req.Header.Set(waf.PeerHeader, rproxyPeer) req.Header.Set(requestIDHeader, rand.Text()) return req } // question makes rproxy's question about a request for path without a body. -func (s *Discriminator) question(host, from, path string) *http.Request { +func (s *WAF) question(host, from, path string) *http.Request { s.t.Helper() return s.questionWith(http.MethodGet, host, from, path, http.NoBody) @@ -122,7 +122,7 @@ func (s *Discriminator) question(host, from, path string) *http.Request { // ask sends the question about a request for path on siteA from the visitor at // from, and returns the answer. -func (s *Discriminator) ask(from, path string) answer { +func (s *WAF) ask(from, path string) answer { s.t.Helper() return do(s.t, s.question(siteA, from, path)) @@ -130,17 +130,17 @@ func (s *Discriminator) ask(from, path string) answer { // allowed asks about a request for / on siteA, checks that the answer is allow, // and returns the request's id. -func (s *Discriminator) allowed(from string) string { +func (s *WAF) allowed(from string) string { s.t.Helper() req := s.question(siteA, from, "/") - wantDisposition(s.t, do(s.t, req), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(s.t, do(s.t, req), http.StatusOK, waf.DispositionAllow) return req.Header.Get(requestIDHeader) } // report sends rproxy's report and returns the answer. -func (s *Discriminator) report(report discriminator.Report) answer { +func (s *WAF) report(report waf.Report) answer { s.t.Helper() body, err := json.Marshal(report) @@ -152,19 +152,19 @@ func (s *Discriminator) report(report discriminator.Report) answer { } // reportBody sends body as rproxy's report and returns the answer. -func (s *Discriminator) reportBody(body string) answer { +func (s *WAF) reportBody(body string) answer { s.t.Helper() - return do(s.t, newRequest(s.t, http.MethodPost, s.addr, discriminator.ReportPath, + return do(s.t, newRequest(s.t, http.MethodPost, s.addr, waf.ReportPath, strings.NewReader(body))) } // passedOn asks about a request from the visitor at from on siteA, and reports // it as answered 200 with bodyBytes and answerBytes. -func (s *Discriminator) passedOn(from string) { +func (s *WAF) passedOn(from string) { s.t.Helper() - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: s.allowed(from), Status: http.StatusOK, RequestBytes: bodyBytes, @@ -174,7 +174,7 @@ func (s *Discriminator) passedOn(from string) { } // history returns what the table of clients holds of client's history. -func (s *Discriminator) history() ratelimit.History { +func (s *WAF) history() ratelimit.History { held, _ := s.server.Limiter.Client(netip.MustParsePrefix(client + "/32")) return held.History @@ -182,10 +182,10 @@ func (s *Discriminator) history() ratelimit.History { // metrics returns what the metrics endpoint answers, for a server started with // the token as SWW_METRICS_TOKEN. -func (s *Discriminator) metrics() string { +func (s *WAF) metrics() string { s.t.Helper() - req := newRequest(s.t, http.MethodGet, s.addr, discriminator.MetricsPath, http.NoBody) + req := newRequest(s.t, http.MethodGet, s.addr, waf.MetricsPath, http.NoBody) req.Header.Set("Authorization", bearer) got := do(s.t, req) @@ -199,7 +199,7 @@ func wantDisposition(t *testing.T, got answer, status int, disposition string) { t.Helper() wantStatus(t, got, status) - if answered := got.header.Get(discriminator.DispositionHeader); answered != + if answered := got.header.Get(waf.DispositionHeader); answered != disposition { t.Errorf("answered with disposition %q, want %q", answered, disposition) } @@ -216,7 +216,7 @@ func wantBody(t *testing.T, got answer, want string) { // wantProcessMessages checks that msg is among the process's messages count // times, each from the server's log at the level warnings are. -func wantProcessMessages(t *testing.T, s *Discriminator, msg string, count int) { +func wantProcessMessages(t *testing.T, s *WAF, msg string, count int) { t.Helper() found := 0 @@ -234,7 +234,7 @@ func wantProcessMessages(t *testing.T, s *Discriminator, msg string, count int) } // wantNoRequestLines checks that no request log line has been written. -func wantNoRequestLines(t *testing.T, s *Discriminator) { +func wantNoRequestLines(t *testing.T, s *WAF) { t.Helper() for _, fields := range s.out.lines(t) { @@ -247,15 +247,15 @@ func wantNoRequestLines(t *testing.T, s *Discriminator) { func TestQuestionAllowedIsAnsweredAndLogged(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) req := s.question(siteA, client, "/page?q=1&token=visible") req.Header.Set(requestIDHeader, "the-id") req.Header.Set("X-Forwarded-Proto", "https") - req.Header.Set(discriminator.ContentLengthHeader, "1234") + req.Header.Set(waf.ContentLengthHeader, "1234") got := do(t, req) - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) wantBody(t, got, "") if id := got.header.Get(requestIDHeader); id != "" { @@ -269,7 +269,7 @@ func TestQuestionAllowedIsAnsweredAndLogged(t *testing.T) { line.Path != "/page" || line.Query != "q=1&token=visible" || line.RequestID != "the-id" || line.Scheme != "https" || line.ContentLength != 1234 || - line.DiscriminatorLine != requestlog.DiscriminatorLineDecision { + line.WAFLine != requestlog.WAFLineDecision { t.Errorf("log line is %+v", line.Line) } } @@ -277,23 +277,23 @@ func TestQuestionAllowedIsAnsweredAndLogged(t *testing.T) { func TestIPv6VisitorIsCountedInItsGroup(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{rateLimitPerMinute: "1"}) + s := startWAF(t, "", map[string]string{rateLimitPerMinute: "1"}) s.allowed("2001:db8::1") got := s.ask("2001:db8::2", "/") - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) } func TestIPv4VisitorInIPv6FormIsTheIPv4Client(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{denyNets: client}) + s := startWAF(t, "", map[string]string{denyNets: client}) req := s.question(siteA, "::ffff:"+client, "/") - req.Header.Set(discriminator.PeerHeader, "::ffff:"+rproxyPeer) + req.Header.Set(waf.PeerHeader, "::ffff:"+rproxyPeer) - wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, do(t, req), http.StatusForbidden, waf.DispositionDeny) line := s.out.requestLine(t) if line.ClientIP != client || line.PeerIP != rproxyPeer { @@ -309,13 +309,13 @@ func TestMalformedQuestionGets400AndAWarningAndNoLine(t *testing.T) { change func(*http.Request) }{ {"client not an address", func(req *http.Request) { - req.Header.Set(discriminator.ClientHeader, "not an address") + req.Header.Set(waf.ClientHeader, "not an address") }}, {"client empty", func(req *http.Request) { - req.Header.Set(discriminator.ClientHeader, "") + req.Header.Set(waf.ClientHeader, "") }}, {"client address with a zone", func(req *http.Request) { - req.Header.Set(discriminator.ClientHeader, "2001:db8::1%eth0") + req.Header.Set(waf.ClientHeader, "2001:db8::1%eth0") }}, {"id absent", func(req *http.Request) { req.Header.Del(requestIDHeader) @@ -333,7 +333,7 @@ func TestMalformedQuestionGets400AndAWarningAndNoLine(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{metricsToken: token}) + s := startWAF(t, "", map[string]string{metricsToken: token}) req := s.question(siteA, client, "/") tc.change(req) @@ -353,33 +353,33 @@ func TestMalformedQuestionGets400AndAWarningAndNoLine(t *testing.T) { func TestLongestValidIDIsTaken(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) req := s.question(siteA, client, "/") req.Header.Set(requestIDHeader, strings.Repeat("x", 128)) - wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow) } func TestQuestionWithABodyOver64KiBGets400(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) - over := strings.NewReader(strings.Repeat("x", discriminator.QuestionBodyMaxBytes+1)) + over := strings.NewReader(strings.Repeat("x", waf.QuestionBodyMaxBytes+1)) got := do(t, s.questionWith(http.MethodPost, siteA, client, "/", over)) wantDisposition(t, got, http.StatusBadRequest, "") wantProcessMessages(t, s, "a question is refused", 1) wantNoRequestLines(t, s) - whole := strings.NewReader(strings.Repeat("x", discriminator.QuestionBodyMaxBytes)) + whole := strings.NewReader(strings.Repeat("x", waf.QuestionBodyMaxBytes)) got = do(t, s.questionWith(http.MethodPost, siteA, client, "/", whole)) - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) } func TestQuestionWithAHeldIDIsRefused(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) id := s.allowed(client) @@ -389,15 +389,15 @@ func TestQuestionWithAHeldIDIsRefused(t *testing.T) { wantProcessMessages(t, s, "a question is refused", 1) // A denied request's id is held as well. - denied := s.question(siteA, otherClient, discriminator.HealthPath) - wantDisposition(t, do(t, denied), http.StatusNotFound, discriminator.DispositionDeny) + denied := s.question(siteA, otherClient, waf.HealthPath) + wantDisposition(t, do(t, denied), http.StatusNotFound, waf.DispositionDeny) again = s.question(siteA, client, "/") again.Header.Set(requestIDHeader, denied.Header.Get(requestIDHeader)) wantDisposition(t, do(t, again), http.StatusBadRequest, "") // The report ends the holding, and the refused questions changed nothing. - got := s.report(discriminator.Report{RequestID: id, ResponseBytes: answerBytes}) + got := s.report(waf.Report{RequestID: id, ResponseBytes: answerBytes}) wantStatus(t, got, http.StatusNoContent) if history := s.history(); history.ResponseBytes != answerBytes { @@ -406,14 +406,14 @@ func TestQuestionWithAHeldIDIsRefused(t *testing.T) { again = s.question(siteA, client, "/") again.Header.Set(requestIDHeader, id) - wantDisposition(t, do(t, again), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, do(t, again), http.StatusOK, waf.DispositionAllow) } func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) { t.Parallel() geojsURL, asked, release := startHeldGeoJS(t) - s := startDiscriminator(t, geojsURL, map[string]string{ + s := startWAF(t, geojsURL, map[string]string{ lookupTimeout: "1h", tagDeny: denyKP, bytesLimitPerMinute: byteLimit, }) @@ -440,7 +440,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) { // A report for a question not yet answered is ignored, and that question's // id is taken. - got := s.report(discriminator.Report{RequestID: id, ResponseBytes: 1000}) + got := s.report(waf.Report{RequestID: id, ResponseBytes: 1000}) wantStatus(t, got, http.StatusNoContent) // This would wait on the same lookup were the id not taken. @@ -455,14 +455,14 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) { select { case got := <-answered: - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) case <-time.After(waitLimit): t.Fatal("the question got no answer") } line := s.out.requestLine(t) if line.ResponseBytes != 0 || - line.DiscriminatorLine != requestlog.DiscriminatorLineDecision { + line.WAFLine != requestlog.WAFLineDecision { t.Errorf("the report reached the question being handled: %+v", line.Line) } @@ -471,7 +471,7 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) { } // The true report comes after, and is the one that counts. - got = s.report(discriminator.Report{RequestID: id, ResponseBytes: answerBytes}) + got = s.report(waf.Report{RequestID: id, ResponseBytes: answerBytes}) wantStatus(t, got, http.StatusNoContent) if history := s.history(); history.ResponseBytes != answerBytes { @@ -486,16 +486,16 @@ func TestPeerAbsentOrUnreadableIsAnsweredAndLoggedInvalid(t *testing.T) { t.Run(peer, func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) req := s.question(siteA, client, "/") - req.Header.Del(discriminator.PeerHeader) + req.Header.Del(waf.PeerHeader) if peer != "" { - req.Header.Set(discriminator.PeerHeader, peer) + req.Header.Set(waf.PeerHeader, peer) } - wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow) if line := s.out.requestLine(t); line.PeerIP != "invalid IP" { t.Errorf("log line has peer_ip %q, want invalid IP", line.PeerIP) @@ -511,13 +511,13 @@ func TestContentLengthUnreadableOrNegativeCountsAsAbsent(t *testing.T) { t.Run(announced, func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ rulesDir: writeRules(t, "any-length header:Content-Length block .\n"), }) req := s.question(siteA, client, "/") - req.Header.Set(discriminator.ContentLengthHeader, announced) - wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow) + req.Header.Set(waf.ContentLengthHeader, announced) + wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow) if line := s.out.requestLine(t); line.ContentLength != 0 { t.Errorf("log line has content_length %d, want none", line.ContentLength) @@ -529,16 +529,16 @@ func TestContentLengthUnreadableOrNegativeCountsAsAbsent(t *testing.T) { func TestHeaderSentTwiceUsesItsFirstValue(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) req := s.question(siteA, client, "/") - req.Header.Add(discriminator.ClientHeader, otherClient) - req.Header.Add(discriminator.PeerHeader, "172.18.0.3") + req.Header.Add(waf.ClientHeader, otherClient) + req.Header.Add(waf.PeerHeader, "172.18.0.3") req.Header.Set(requestIDHeader, "first") req.Header.Add(requestIDHeader, "second") - req.Header.Set(discriminator.ContentLengthHeader, "1234") - req.Header.Add(discriminator.ContentLengthHeader, "5678") - wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow) + req.Header.Set(waf.ContentLengthHeader, "1234") + req.Header.Add(waf.ContentLengthHeader, "5678") + wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow) line := s.out.requestLine(t) if line.ClientIP != client || line.PeerIP != rproxyPeer || @@ -550,7 +550,7 @@ func TestHeaderSentTwiceUsesItsFirstValue(t *testing.T) { func TestSchemeAbsentIsLoggedAsHTTP(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) s.allowed(client) @@ -567,7 +567,7 @@ func sendQuestionWithPartOfItsBody(t *testing.T, conn net.Conn) { _, err := fmt.Fprintf(conn, "POST / HTTP/1.1\r\nHost: %s\r\n%s: %s\r\n%s: an-id\r\n"+ "Content-Length: 100\r\n\r\npart", - siteA, discriminator.ClientHeader, client, requestIDHeader) + siteA, waf.ClientHeader, client, requestIDHeader) if err != nil { t.Fatalf("send the question: %v", err) } @@ -596,8 +596,8 @@ func TestQuestionWhoseBodyStopsArrivingGetsNoAnswer(t *testing.T) { t.Run(tc.name, func(t *testing.T) { t.Parallel() - s := startDiscriminatorWith(t, "", map[string]string{metricsToken: token}, - func(server *discriminator.Server) { server.ReadTimeout = readTimeout }) + s := startWAFWith(t, "", map[string]string{metricsToken: token}, + func(server *waf.Server) { server.ReadTimeout = readTimeout }) conn := dial(t, s.addr) sendQuestionWithPartOfItsBody(t, conn) @@ -620,7 +620,7 @@ func TestQuestionWhoseBodyStopsArrivingGetsNoAnswer(t *testing.T) { // The id was not taken. again := s.question(siteA, client, "/") again.Header.Set(requestIDHeader, "an-id") - wantDisposition(t, do(t, again), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, do(t, again), http.StatusOK, waf.DispositionAllow) }) } } @@ -632,12 +632,12 @@ func TestQuestionDeniedGetsTheBanResponse(t *testing.T) { t.Run(strconv.Itoa(status), func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ denyNets: client, banResponse: strconv.Itoa(status), }) got := s.ask(client, "/") - wantDisposition(t, got, status, discriminator.DispositionDeny) + wantDisposition(t, got, status, waf.DispositionDeny) wantBody(t, got, http.StatusText(status)+"\n") wantLine(t, s.out.requestLine(t), status, requestlog.ActionClientDenied) }) @@ -647,12 +647,12 @@ func TestQuestionDeniedGetsTheBanResponse(t *testing.T) { func TestBanResponseCloseIsAnAnswerOfItsOwn(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ denyNets: client, banResponse: banResponseClose, metricsToken: token, }) got := s.ask(client, "/") - wantDisposition(t, got, http.StatusOK, discriminator.DispositionClose) + wantDisposition(t, got, http.StatusOK, waf.DispositionClose) wantBody(t, got, "") // The visitor is sent nothing. wantLine(t, s.out.requestLine(t), 0, requestlog.ActionClientDenied) @@ -663,18 +663,18 @@ func TestBanResponseCloseIsAnAnswerOfItsOwn(t *testing.T) { func TestBlockRuleIsDeniedWith403AndABanRuleWithTheBanResponse(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ rulesDir: writeRules(t, testRules), banResponse: "429", }) got := s.ask(client, "/blocked") - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionBlockedByBlockRule) got = s.ask(client, "/.env") - wantDisposition(t, got, http.StatusTooManyRequests, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusTooManyRequests, waf.DispositionDeny) wantLine(t, s.out.requestLines(t, 2)[1], http.StatusTooManyRequests, requestlog.ActionTemporarilyBanned) } @@ -682,30 +682,30 @@ func TestBlockRuleIsDeniedWith403AndABanRuleWithTheBanResponse(t *testing.T) { func TestQuestionUnderTheOwnPrefixIsDeniedWith404AfterTheChecks(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ metricsToken: token, denyNets: otherClient, }) for _, path := range []string{ - discriminator.HealthPath, discriminator.MetricsPath, discriminator.ReportPath, + waf.HealthPath, waf.MetricsPath, waf.ReportPath, } { got := s.ask(client, path) - wantDisposition(t, got, http.StatusNotFound, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusNotFound, waf.DispositionDeny) } wantLine(t, s.out.requestLine(t), http.StatusNotFound, requestlog.ActionOwnEndpoint) - got := s.ask(otherClient, discriminator.MetricsPath) - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + got := s.ask(otherClient, waf.MetricsPath) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) } func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{mode: observe, denyNets: client}) + s := startWAF(t, "", map[string]string{mode: observe, denyNets: client}) got := s.ask(client, "/") - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) line := s.out.requestLine(t) wantLine(t, line, http.StatusOK, requestlog.ActionForward) @@ -715,13 +715,13 @@ func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) { func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ mode: observe, rulesDir: writeRules(t, testRules), errorBurstThreshold: "1", }) for range 2 { got := s.ask(client, "/blocked") - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) } lines := s.out.requestLines(t, 2) @@ -734,13 +734,13 @@ func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) { func TestDeniedQuestionCountsForTheErrorBurst(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ rulesDir: writeRules(t, testRules), errorBurstThreshold: "1", }) for range 2 { got := s.ask(client, "/blocked") - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) } lines := s.out.requestLines(t, 2) @@ -764,12 +764,12 @@ func TestAllowCarriesTheLookupHeadersWhileTheSettingIsSet(t *testing.T) { t.Parallel() geojsURL, _ := startGeoJS(t) - s := startDiscriminator(t, geojsURL, map[string]string{ + s := startWAF(t, geojsURL, map[string]string{ addLookupHeaders: tc.setting, lookupTimeout: "1h", tagDeny: denyKP, }) got := s.ask(fromDE, "/") - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country") if asn != tc.wantASN || country != tc.wantCountry { @@ -783,7 +783,7 @@ func TestAllowCarriesTheLookupHeadersWhileTheSettingIsSet(t *testing.T) { func TestReportCountsTowardAByteLimitWhichThenBans(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{bytesLimitPerMinute: byteLimit}) + s := startWAF(t, "", map[string]string{bytesLimitPerMinute: byteLimit}) // The request's own question counts no bytes: it is the report that does. id := s.allowed(client) @@ -794,7 +794,7 @@ func TestReportCountsTowardAByteLimitWhichThenBans(t *testing.T) { } // 100 bytes are over the limit of 99. - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: id, Status: http.StatusBadGateway, RequestBytes: bodyBytes, ResponseBytes: answerBytes, }) @@ -811,14 +811,14 @@ func TestReportCountsTowardAByteLimitWhichThenBans(t *testing.T) { } third := s.out.requestLines(t, 3)[2] - if third.DiscriminatorLine != requestlog.DiscriminatorLineReport || + if third.WAFLine != requestlog.WAFLineReport || third.LimitHit != minuteBytes || third.Offence != requestlog.OffenceLimit || third.BanExpires == "" { t.Errorf("the report's log line is %+v", third.Line) } got = s.ask(client, "/") - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) } func TestReportCountsAtThePercentageItsQuestionWasGiven(t *testing.T) { @@ -826,23 +826,23 @@ func TestReportCountsAtThePercentageItsQuestionWasGiven(t *testing.T) { geojsURL, _ := startGeoJS(t) // 100 bytes pass half of a limit of 99 and are within a limit of 199. - s := startDiscriminator(t, geojsURL, map[string]string{ + s := startWAF(t, geojsURL, map[string]string{ bytesLimitPerMinute: "199", countryBytesPercent: countryDEHalf, lookupTimeout: "1h", }) s.passedOn(fromKP) - wantDisposition(t, s.ask(fromKP, "/"), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, s.ask(fromKP, "/"), http.StatusOK, waf.DispositionAllow) s.passedOn(fromDE) wantDisposition(t, s.ask(fromDE, "/"), http.StatusForbidden, - discriminator.DispositionDeny) + waf.DispositionDeny) } func TestReportAddsTheRequestToItsClientsHistoryAndTheAnomalyCounters(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{anomalyClientPerMinute: "1000"}) + s := startWAF(t, "", map[string]string{anomalyClientPerMinute: "1000"}) id := s.allowed(client) @@ -854,7 +854,7 @@ func TestReportAddsTheRequestToItsClientsHistoryAndTheAnomalyCounters(t *testing t.Errorf("anomaly counters %v before the report, want none", counters) } - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: id, Status: http.StatusBadGateway, RequestBytes: bodyBytes, ResponseBytes: answerBytes, }) @@ -875,14 +875,14 @@ func TestReportAddsTheRequestToItsClientsHistoryAndTheAnomalyCounters(t *testing func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ rateLimitPerMinute: "1", metricsToken: token, anomalyClientPerMinute: "1000", }) s.allowed(client) denied := s.question(siteA, client, "/") - wantDisposition(t, do(t, denied), http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, do(t, denied), http.StatusForbidden, waf.DispositionDeny) counters := s.server.Anomalies.Snapshot() if len(counters) != 1 || counters[0].Minute.Current != 1 { @@ -899,7 +899,7 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) { wantMetric(t, s.metrics(), series, 1) - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: denied.Header.Get(requestIDHeader), Status: http.StatusForbidden, ResponseBytes: 1000, DurationTotalMS: 2, }) @@ -921,7 +921,7 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) { func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{metricsToken: token}) + s := startWAF(t, "", map[string]string{metricsToken: token}) id := s.allowed(client) @@ -932,7 +932,7 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) { wantMetric(t, metrics, `sww_requests_in_flight{instance="`+alertInstance+`"}`, 1) // the scrape itself - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: id, Status: http.StatusBadGateway, RequestBytes: bodyBytes, ResponseBytes: answerBytes, DurationTotalMS: 5, DurationUpstreamTotalMS: 4, @@ -948,9 +948,9 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) { // A scrape adds its own time to the request duration when it ends, so this // check needs a server that has not been scraped yet. - unscraped := startDiscriminator(t, "", map[string]string{metricsToken: token}) + unscraped := startWAF(t, "", map[string]string{metricsToken: token}) - got = unscraped.report(discriminator.Report{ + got = unscraped.report(waf.Report{ RequestID: unscraped.allowed(client), Status: http.StatusBadGateway, DurationTotalMS: 5, }) @@ -962,9 +962,9 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) { func TestReportForARequestNotHeldIsIgnored(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{bytesLimitPerMinute: byteLimit}) + s := startWAF(t, "", map[string]string{bytesLimitPerMinute: byteLimit}) - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: "no-such-request", ResponseBytes: 1000, }) wantStatus(t, got, http.StatusNoContent) @@ -983,7 +983,7 @@ func TestReportForARequestNotHeldIsIgnored(t *testing.T) { // A second report of the same request does not count it twice. id := s.allowed(client) for range 2 { - got = s.report(discriminator.Report{RequestID: id, ResponseBytes: answerBytes}) + got = s.report(waf.Report{RequestID: id, ResponseBytes: answerBytes}) wantStatus(t, got, http.StatusNoContent) } @@ -1032,7 +1032,7 @@ func encodedReport( func TestReportThatIsNotOneObjectWithAllItsFieldsIsRefused(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) id := s.allowed(client) whole := encodedReport(t, id, nil) @@ -1068,7 +1068,7 @@ func TestReportThatIsNotOneObjectWithAllItsFieldsIsRefused(t *testing.T) { func TestReportOver1MiBIsRefusedAndOneOfExactly1MiBIsTaken(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) id := s.allowed(client) // The padding is a field of no meaning here, so only the size can refuse it. @@ -1094,7 +1094,7 @@ func TestReportOver1MiBIsRefusedAndOneOfExactly1MiBIsTaken(t *testing.T) { func TestReportWithAValueOutOfRangeIsRefused(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) id := s.allowed(client) cases := []struct { @@ -1136,7 +1136,7 @@ func TestReportWithAValueOutOfRangeIsRefused(t *testing.T) { func TestReportValuesAtTheEndsOfTheirRangesAreTaken(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ bytesLimitPerMinute: off, bytesLimitPerHour: off, bytesLimitPerDay: off, }) @@ -1169,9 +1169,9 @@ func TestReportValuesAtTheEndsOfTheirRangesAreTaken(t *testing.T) { func TestBytesAtTheirMostEachWayBanRatherThanOverflow(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{bytesLimitPerMinute: byteLimit}) + s := startWAF(t, "", map[string]string{bytesLimitPerMinute: byteLimit}) - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: s.allowed(client), Status: http.StatusOK, RequestBytes: reportedBytesLimit, ResponseBytes: reportedBytesLimit, }) @@ -1187,7 +1187,7 @@ func TestBytesAtTheirMostEachWayBanRatherThanOverflow(t *testing.T) { func wantReportsFields(t *testing.T, line logLine) { t.Helper() - if line.DiscriminatorLine != requestlog.DiscriminatorLineReport || + if line.WAFLine != requestlog.WAFLineReport || line.Status != http.StatusCreated || line.RequestBytes != bodyBytes || line.ResponseBytes != answerBytes || line.DurationTotalMS != 12.5 || line.DurationUpstreamTotalMS == nil || @@ -1202,7 +1202,7 @@ func wantSameDecision(t *testing.T, reported, decided logLine) { t.Helper() same := reported.Line - same.DiscriminatorLine = decided.DiscriminatorLine + same.WAFLine = decided.WAFLine same.Status = decided.Status same.RequestBytes = decided.RequestBytes same.ResponseBytes = decided.ResponseBytes @@ -1218,12 +1218,12 @@ func wantSameDecision(t *testing.T, reported, decided logLine) { } } -// wantDecisionsFields checks what discriminator answered and noted on the decision's +// wantDecisionsFields checks what waf answered and noted on the decision's // line, of a request with these fields. func wantDecisionsFields(t *testing.T, line logLine, id, query, accept string) { t.Helper() - if line.DiscriminatorLine != requestlog.DiscriminatorLineDecision || + if line.WAFLine != requestlog.WAFLineDecision || line.Status != http.StatusOK || line.ResponseBytes != 0 || line.DurationUpstreamTotalMS != nil || line.DurationChecksMS == nil || line.RequestID != id || line.Query != query || @@ -1237,7 +1237,7 @@ func wantDecisionsFields(t *testing.T, line logLine, id, query, accept string) { func TestReportWritesTheLastLineWithTheDecisionsAndTheReportsFields(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ logRequestHeaders: "accept", rulesDir: writeRules(t, "seen path log ^/page$\n"), }) @@ -1256,9 +1256,9 @@ func TestReportWritesTheLastLineWithTheDecisionsAndTheReportsFields(t *testing.T req.Header.Set("X-Forwarded-Proto", "https") id := req.Header.Get(requestIDHeader) - wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow) - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: id, Status: http.StatusCreated, RequestBytes: bodyBytes, ResponseBytes: answerBytes, DurationTotalMS: 12.5, DurationUpstreamTotalMS: 10.25, @@ -1305,19 +1305,19 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) { "close", map[string]string{denyNets: client, banResponse: banResponseClose}, "/", 0, requestlog.ActionClientDenied, }, - {"own prefix", nil, discriminator.HealthPath, http.StatusNotFound, + {"own prefix", nil, waf.HealthPath, http.StatusNotFound, requestlog.ActionOwnEndpoint}, } { t.Run(tc.name, func(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", tc.env) + s := startWAF(t, "", tc.env) req := s.question(siteA, client, tc.path) id := req.Header.Get(requestIDHeader) do(t, req) - got := s.report(discriminator.Report{ + got := s.report(waf.Report{ RequestID: id, Status: tc.status, ResponseBytes: 8, DurationTotalMS: 3, }) wantStatus(t, got, http.StatusNoContent) @@ -1325,7 +1325,7 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) { line := s.out.requestLines(t, 2)[1] wantLine(t, line, tc.status, tc.action) - if line.DiscriminatorLine != requestlog.DiscriminatorLineReport || + if line.WAFLine != requestlog.WAFLineReport || line.RequestID != id || line.ResponseBytes != 8 || line.DurationTotalMS != 3 || line.DurationUpstreamTotalMS != nil { t.Errorf("the report's line is %+v", line.Line) @@ -1337,7 +1337,7 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) { func TestOldestAnsweredRequestIsDroppedPastTheBound(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ rateLimitExemptNets: otherClient, }) @@ -1353,18 +1353,18 @@ func TestOldestAnsweredRequestIsDroppedPastTheBound(t *testing.T) { t.Fatalf("question: %v", err) } - wantDisposition(t, readAnswer(res), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, readAnswer(res), http.StatusOK, waf.DispositionAllow) } // The table is full again with next and those, without oldest. - got := s.report(discriminator.Report{RequestID: oldest, ResponseBytes: answerBytes}) + got := s.report(waf.Report{RequestID: oldest, ResponseBytes: answerBytes}) wantStatus(t, got, http.StatusNoContent) if counted := s.history().Requests; counted != 0 { t.Errorf("history holds %d requests, want the dropped one not counted", counted) } - got = s.report(discriminator.Report{RequestID: next, ResponseBytes: answerBytes}) + got = s.report(waf.Report{RequestID: next, ResponseBytes: answerBytes}) wantStatus(t, got, http.StatusNoContent) if counted := s.history().Requests; counted != 1 { @@ -1375,13 +1375,13 @@ func TestOldestAnsweredRequestIsDroppedPastTheBound(t *testing.T) { func TestBanMadeThroughOneHostRefusesTheClientOnAnother(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{rulesDir: writeRules(t, testRules)}) + s := startWAF(t, "", map[string]string{rulesDir: writeRules(t, testRules)}) got := do(t, s.question(siteA, client, "/.env")) - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) got = do(t, s.question(siteB, client, "/")) - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) lines := s.out.requestLines(t, 2) if lines[0].Host != siteA || lines[1].Host != siteB { @@ -1402,19 +1402,19 @@ func TestBanMadeThroughOneHostRefusesTheClientOnAnother(t *testing.T) { func TestRequestsOnEverySiteCountTowardOneSetOfLimits(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{rateLimitPerMinute: "1"}) + s := startWAF(t, "", map[string]string{rateLimitPerMinute: "1"}) s.allowed(client) got := do(t, s.question(siteB, client, "/")) - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) } func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) { t.Parallel() // Were a check run on its requests, localhost's would be refused. - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ metricsToken: token, adminToken: adminSecret, denyNets: localhost, }) @@ -1422,13 +1422,13 @@ func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) { path, authorization string want int }{ - {discriminator.HealthPath, "", http.StatusOK}, - {discriminator.MetricsPath, bearer, http.StatusOK}, - {discriminator.MetricsPath, "", http.StatusUnauthorized}, - {discriminator.BansPath, adminBearer, http.StatusOK}, - {discriminator.BansPath, "", http.StatusUnauthorized}, - {discriminator.ClientsPath + client, adminBearer, http.StatusOK}, - {discriminator.ReportPath, "", http.StatusNotFound}, + {waf.HealthPath, "", http.StatusOK}, + {waf.MetricsPath, bearer, http.StatusOK}, + {waf.MetricsPath, "", http.StatusUnauthorized}, + {waf.BansPath, adminBearer, http.StatusOK}, + {waf.BansPath, "", http.StatusUnauthorized}, + {waf.ClientsPath + client, adminBearer, http.StatusOK}, + {waf.ReportPath, "", http.StatusNotFound}, {"/_sww/other", "", http.StatusNotFound}, {"/", "", http.StatusNotFound}, } { @@ -1441,9 +1441,9 @@ func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) { req.Header.Set("Authorization", tc.authorization) if strings.HasPrefix(tc.path, "/_sww/") { - wantDisposition(t, do(t, req), http.StatusNotFound, discriminator.DispositionDeny) + wantDisposition(t, do(t, req), http.StatusNotFound, waf.DispositionDeny) } else { - wantDisposition(t, do(t, req), http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, do(t, req), http.StatusOK, waf.DispositionAllow) } } } @@ -1451,13 +1451,13 @@ func TestOwnEndpointsAnswerOnlyWithoutTheClientHeader(t *testing.T) { func TestOwnEndpointsLinesDoNotSayWhichOfTheTwoTheyAre(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) - wantStatus(t, get(t, s.addr, discriminator.HealthPath), http.StatusOK) + wantStatus(t, get(t, s.addr, waf.HealthPath), http.StatusOK) line := s.out.requestLine(t) - if _, there := line.fields["discriminator_line"]; there || - line.Path != discriminator.HealthPath { + if _, there := line.fields["waf_line"]; there || + line.Path != waf.HealthPath { t.Errorf("the health check's log line is %+v", line.fields) } } @@ -1465,16 +1465,16 @@ func TestOwnEndpointsLinesDoNotSayWhichOfTheTwoTheyAre(t *testing.T) { func TestALargeBodyAnnouncedAndLongHeadersAreNoReasonToRefuse(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) req := s.questionWith(http.MethodPost, siteA, client, "/", strings.NewReader("a body")) - req.Header.Set(discriminator.ContentLengthHeader, "1073741824") + req.Header.Set(waf.ContentLengthHeader, "1073741824") req.Header.Set(forwardedFor, otherClient) req.Header.Set("X-Long", strings.Repeat("x", 40<<10)) got := do(t, req) - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) line := s.out.requestLine(t) if line.ClientIP != client || line.ContentLength != 1<<30 { @@ -1486,7 +1486,7 @@ func TestALargeBodyAnnouncedAndLongHeadersAreNoReasonToRefuse(t *testing.T) { func TestLogLevelHoldsBackNoRequestLine(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{"SWW_LOG_LEVEL": "error"}) + s := startWAF(t, "", map[string]string{"SWW_LOG_LEVEL": "error"}) // A refused question would write a process warning, held back at error. req := s.question(siteA, client, "/") @@ -1506,7 +1506,7 @@ func TestLogLevelHoldsBackNoRequestLine(t *testing.T) { func TestServerHasTheTimeLimitsSPECGives(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", nil) + s := startWAF(t, "", nil) if s.server.ReadTimeout != time.Minute || s.server.WriteTimeout != time.Minute || s.server.IdleTimeout != 2*time.Minute { @@ -1518,7 +1518,7 @@ func TestServerHasTheTimeLimitsSPECGives(t *testing.T) { func TestChecksSeeTheHeadersTheVisitorSent(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ rulesDir: writeRules(t, ` own-client header:X-Sww-Client block . own-peer header:X-Sww-Peer block . @@ -1542,7 +1542,7 @@ carried header:Content-Length block ^6$ strings.NewReader("a body")) if tc.announced != "" { - req.Header.Set(discriminator.ContentLengthHeader, tc.announced) + req.Header.Set(waf.ContentLengthHeader, tc.announced) } wantStatus(t, do(t, req), tc.want) @@ -1552,7 +1552,7 @@ carried header:Content-Length block ^6$ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{ + s := startWAF(t, "", map[string]string{ wafMode: block, wafBodyLimit: "64K", }) @@ -1560,28 +1560,28 @@ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) { req := s.questionWith(http.MethodPost, siteA, client, "/", strings.NewReader(body)) req.Header.Set("Content-Type", contentType) - req.Header.Set(discriminator.ContentLengthHeader, "100000") + req.Header.Set(waf.ContentLengthHeader, "100000") return do(t, req) } got := ask(formData, "id=1'%20OR%20'1'='1") - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) // The first 64 KiB of a longer JSON body cannot be parsed, which is no // attack, so the Core Rule Set does not read it. - cut := `{"text":"` + strings.Repeat("x", discriminator.QuestionBodyMaxBytes) - got = ask("application/json", cut[:discriminator.QuestionBodyMaxBytes]) - wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow) + cut := `{"text":"` + strings.Repeat("x", waf.QuestionBodyMaxBytes) + got = ask("application/json", cut[:waf.QuestionBodyMaxBytes]) + wantDisposition(t, got, http.StatusOK, waf.DispositionAllow) } func TestCoreRuleSetAlertNamesTheSite(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{wafMode: block}) + s := startWAF(t, "", map[string]string{wafMode: block}) got := s.ask(client, sqlInjection) - wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny) + wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny) waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook] if len(waiting) != 1 || waiting[0].Event != alerts.EventCoreRuleSetMatch || @@ -1594,11 +1594,11 @@ func TestCoreRuleSetAlertNamesTheSite(t *testing.T) { func TestReputationHitAlertNamesTheSite(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{blocklistURLs: dropURL}) + s := startWAF(t, "", map[string]string{blocklistURLs: dropURL}) loadLists(t, s.server, map[string][]string{dropURL: {client}}) wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, - discriminator.DispositionDeny) + waf.DispositionDeny) waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook] if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit || @@ -1610,7 +1610,7 @@ func TestReputationHitAlertNamesTheSite(t *testing.T) { func TestAnomalyAlertNamesTheSite(t *testing.T) { t.Parallel() - s := startDiscriminator(t, "", map[string]string{anomalyClientPerMinute: "1"}) + s := startWAF(t, "", map[string]string{anomalyClientPerMinute: "1"}) for range 2 { s.passedOn(client) diff --git a/script/example-app b/script/example-app index 3360636..9ad9026 100755 --- a/script/example-app +++ b/script/example-app @@ -1,25 +1,25 @@ #!/bin/sh # script/example-app: build the image, and on it the example app in # deploy/example-app, then run the app's container, with rproxy in it, and -# discriminator in a container of its own with a volume for the state files. It +# waf in a container of its own with a volume for the state files. It # checks: # - that the health checks pass; # - that a request is served through rproxy, and a second one in a minute # bans the client; # - that a probe for /.env bans another client, which its next request bans # for good; -# - that only discriminator's container changes the state directory's owner; -# - that the app still answers through rproxy with discriminator stopped, and -# that once discriminator has started again, bans apply again; +# - that only waf's container changes the state directory's owner; +# - that the app still answers through rproxy with waf stopped, and +# that once waf has started again, bans apply again; # - that `sv stop` stops rproxy in order, and `docker stop` stops each # container without having to kill it; -# - that a new discriminator container on the same volume still refuses the banned +# - that a new waf container on the same volume still refuses the banned # client; -# - that a discriminator container with its state files on a new volume mounted at +# - that a waf container with its state files on a new volume mounted at # the directory SWW_STATE_DIR_FILE names becomes healthy; -# - that one whose SWW_STATE_DIR does not exist logs discriminator's message +# - that one whose SWW_STATE_DIR does not exist logs waf's message # about it. -# discriminator runs with SWW_LOOKUP_SOURCE=off, so that no address is sent to +# waf runs with SWW_LOOKUP_SOURCE=off, so that no address is sent to # GeoJS. The containers, the network, the volumes and both images are removed # however the script ends. Building the app needs network access, for nixpkgs' # binary cache. script/check does not run this. @@ -35,7 +35,7 @@ IMAGE="$NAME-base" APP_IMAGE="$NAME-app" NETWORK="$NAME" APP="$NAME-app-container" -DISCRIMINATOR="$NAME-discriminator" +WAF="$NAME-waf" VOLUME="$NAME-state" # The volumes of the container whose state directory SWW_STATE_DIR_FILE # names: its state files, and the file that names their directory. @@ -43,7 +43,7 @@ MOVED_VOLUME="$NAME-moved-state" SETTINGS_VOLUME="$NAME-settings" cleanup() { - docker rm --force "$APP" "$DISCRIMINATOR" >/dev/null 2>&1 || true + docker rm --force "$APP" "$WAF" >/dev/null 2>&1 || true docker network rm "$NETWORK" >/dev/null 2>&1 || true docker volume rm --force "$VOLUME" "$MOVED_VOLUME" "$SETTINGS_VOLUME" \ >/dev/null 2>&1 || true @@ -53,8 +53,8 @@ cleanup() { fail() { echo "example-app: $*; the app container's output:" >&2 docker logs "$APP" >&2 || true - echo "example-app: discriminator's output:" >&2 - docker logs "$DISCRIMINATOR" >&2 || true + echo "example-app: waf's output:" >&2 + docker logs "$WAF" >&2 || true exit 1 } @@ -87,49 +87,49 @@ logged() { done } -# start_discriminator: run discriminator from the image, with the state files on the +# start_waf: run waf from the image, with the state files on the # volume, a rate limit of one request a minute and no client looked up, and wait # until it is healthy. -start_discriminator() { - docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \ +start_waf() { + docker run --detach --name "$WAF" --network "$NETWORK" \ --volume "$VOLUME:/var/lib/sww" \ - --env SWW_COMMAND=discriminator \ + --env SWW_COMMAND=waf \ --env SWW_RATE_LIMIT_PER_MINUTE=1 \ --env SWW_LOOKUP_SOURCE=off \ "$IMAGE" >/dev/null - wait_for "discriminator's health check did not pass" healthy "$DISCRIMINATOR" + wait_for "waf's health check did not pass" healthy "$WAF" } # start_app: run the app's container, with rproxy in it, and wait until it is # healthy. start_app() { docker run --detach --name "$APP" --network "$NETWORK" --publish 127.0.0.1::8080 \ - --env SWRP_WAF_BACKEND="http://$DISCRIMINATOR:8080" \ + --env SWRP_WAF_BACKEND="http://$WAF:8080" \ "$APP_IMAGE" >/dev/null wait_for "the app's health check did not pass" healthy "$APP" address="$(docker port "$APP" 8080/tcp)" } -# start_moved_discriminator: run discriminator with the state files on a new volume at +# start_moved_waf: run waf with the state files on a new volume at # /srv/state, which SWW_STATE_DIR_FILE names in a file only the sww # user can read, as under "Settings given as files" in docs/settings.md, and -# wait until it is healthy. discriminator can write the new volume only once the run +# wait until it is healthy. waf can write the new volume only once the run # script has given it to that user. -start_moved_discriminator() { +start_moved_waf() { docker volume create "$MOVED_VOLUME" >/dev/null docker volume create "$SETTINGS_VOLUME" >/dev/null docker run --rm --volume "$SETTINGS_VOLUME:/settings" \ --entrypoint bash "$IMAGE" -c 'echo /srv/state > /settings/state-dir && chown sww:sww /settings/state-dir && chmod 0400 /settings/state-dir' - docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \ + docker run --detach --name "$WAF" --network "$NETWORK" \ --volume "$MOVED_VOLUME:/srv/state" \ --volume "$SETTINGS_VOLUME:/etc/sww/settings:ro" \ - --env SWW_COMMAND=discriminator \ + --env SWW_COMMAND=waf \ --env SWW_STATE_DIR_FILE=/etc/sww/settings/state-dir \ --env SWW_LOOKUP_SOURCE=off \ "$IMAGE" >/dev/null - wait_for "discriminator's health check did not pass" healthy "$DISCRIMINATOR" + wait_for "waf's health check did not pass" healthy "$WAF" } # status_from : print the status a request for path from client, @@ -169,87 +169,87 @@ main() { docker network create "$NETWORK" >/dev/null docker volume create "$VOLUME" >/dev/null - start_discriminator + start_waf start_app echo "example-app: the health checks pass" - [ "$(owner_of_state_dir "$DISCRIMINATOR")" = sww ] || - fail "discriminator's container did not give the state directory to sww" + [ "$(owner_of_state_dir "$WAF")" = sww ] || + fail "waf's container did not give the state directory to sww" [ "$(owner_of_state_dir "$APP")" = root ] || fail "the app's container changed the state directory's owner" - echo "example-app: only discriminator's container changes the state directory's owner" + echo "example-app: only waf's container changes the state directory's owner" page="$(curl --fail --silent --show-error --max-time 10 "http://$address/")" || fail "no answer on port 8080" [ "$page" = "hello from the example app" ] || fail "port 8080 answered $page" - wait_for "discriminator logged no request it allowed" \ - logged "$DISCRIMINATOR" '"action":"forward"' '"discriminator_line":"report"' + wait_for "waf logged no request it allowed" \ + logged "$WAF" '"action":"forward"' '"waf_line":"report"' echo "example-app: rproxy passes a request to the app and its answer back" refused || fail "a second request in a minute was not refused" - wait_for "discriminator logged no ban" \ - logged "$DISCRIMINATOR" '"action":"client_is_rate_limited"' + wait_for "waf logged no ban" \ + logged "$WAF" '"action":"client_is_rate_limited"' echo "example-app: a second request in a minute bans the client" refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused" - wait_for "discriminator logged no ban for the probe" \ - logged "$DISCRIMINATOR" '"action":"temporarily_banned"' '"rule_ids":["env-file"]' + wait_for "waf logged no ban for the probe" \ + logged "$WAF" '"action":"temporarily_banned"' '"rule_ids":["env-file"]' refused_from 203.0.113.9 / || fail "the client of the probe was let through" wait_for "the client's next request did not make its ban permanent" \ - logged "$DISCRIMINATOR" '"action":"permanently_banned"' '"ban_expires":"permanent"' + logged "$WAF" '"action":"permanently_banned"' '"ban_expires":"permanent"' echo "example-app: a probe for /.env bans the client, its next request for good" - docker exec "$DISCRIMINATOR" sv stop sww >/dev/null || - fail "sv stop sww failed in discriminator's container" - wait_for "discriminator did not stop in order" logged "$DISCRIMINATOR" '"msg":"stopped"' + docker exec "$WAF" sv stop sww >/dev/null || + fail "sv stop sww failed in waf's container" + wait_for "waf did not stop in order" logged "$WAF" '"msg":"stopped"' [ "$(status_from 203.0.113.9 /)" = 200 ] || - fail "with discriminator stopped, the app did not answer through rproxy" + fail "with waf stopped, the app did not answer through rproxy" wait_for "rproxy logged no request SWRP_DEFAULT_DISPOSITION decided" \ logged "$APP" '"default_disposition":true' docker exec "$APP" /usr/local/bin/sww healthcheck || - fail "with discriminator stopped, the app's health check failed" - echo "example-app: with discriminator stopped, the app answers through rproxy" + fail "with waf stopped, the app's health check failed" + echo "example-app: with waf stopped, the app answers through rproxy" - docker exec "$DISCRIMINATOR" sv start sww >/dev/null || - fail "sv start sww failed in discriminator's container" - wait_for "once discriminator had started again, the ban did not apply" \ + docker exec "$WAF" sv start sww >/dev/null || + fail "sv start sww failed in waf's container" + wait_for "once waf had started again, the ban did not apply" \ refused_from 203.0.113.9 / - echo "example-app: once discriminator has started again, bans apply again" + echo "example-app: once waf has started again, bans apply again" docker exec "$APP" sv stop sww >/dev/null || fail "sv stop sww failed in the app's container" wait_for "rproxy did not stop in order" logged "$APP" '"msg":"stopped"' echo "example-app: sv stop stops rproxy in order" - for container in "$APP" "$DISCRIMINATOR"; do + for container in "$APP" "$WAF"; do docker stop "$container" >/dev/null status="$(docker inspect --format '{{.State.ExitCode}}' "$container")" [ "$status" = 0 ] || fail "docker stop left exit status $status" done echo "example-app: docker stop stops each container in order" - docker rm "$APP" "$DISCRIMINATOR" >/dev/null - start_discriminator + docker rm "$APP" "$WAF" >/dev/null + start_waf start_app - refused || fail "the new discriminator container let the banned client through" - wait_for "discriminator logged no request refused under the ban" \ - logged "$DISCRIMINATOR" '"action":"temporarily_banned"' - echo "example-app: a new discriminator container on the same volume keeps the ban" + refused || fail "the new waf container let the banned client through" + wait_for "waf logged no request refused under the ban" \ + logged "$WAF" '"action":"temporarily_banned"' + echo "example-app: a new waf container on the same volume keeps the ban" - docker rm --force "$DISCRIMINATOR" >/dev/null - start_moved_discriminator + docker rm --force "$WAF" >/dev/null + start_moved_waf echo "example-app: the run script gives the state files' directory named" \ "by SWW_STATE_DIR_FILE to the sww user" - docker rm --force "$DISCRIMINATOR" >/dev/null - docker run --detach --name "$DISCRIMINATOR" --network "$NETWORK" \ - --env SWW_COMMAND=discriminator \ + docker rm --force "$WAF" >/dev/null + docker run --detach --name "$WAF" --network "$NETWORK" \ + --env SWW_COMMAND=waf \ --env SWW_STATE_DIR=/srv/missing \ --env SWW_LOOKUP_SOURCE=off \ "$IMAGE" >/dev/null - wait_for "discriminator did not report the missing state directory" \ - logged "$DISCRIMINATOR" "SWW_STATE_DIR cannot be written" - echo "example-app: discriminator reports a state directory that does not exist" + wait_for "waf did not report the missing state directory" \ + logged "$WAF" "SWW_STATE_DIR cannot be written" + echo "example-app: waf reports a state directory that does not exist" } main "$@" diff --git a/script/run b/script/run index 5c00807..57a647b 100755 --- a/script/run +++ b/script/run @@ -1,9 +1,9 @@ #!/bin/sh -# script/run: build bin/sww with script/build and run discriminator and +# script/run: build bin/sww with script/build and run waf and # rproxy on the host, with the settings in the environment, until rproxy # exits or the script is told to stop. rproxy listens on port 8080 unless # SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL. -# discriminator listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and +# waf listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and # rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless # SWW_STATE_DIR is set, the state files go in bin/state, beside the binary, # and unless SWW_RULES_DIR is set, the rule files are those of share/rules.d, @@ -13,14 +13,14 @@ set -eu SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)" ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)" -DISCRIMINATOR="" +WAF="" RPROXY="" -# stop_both: stop what runs, and wait for it, so that discriminator writes its state +# stop_both: stop what runs, and wait for it, so that waf writes its state # files. stop_both() { trap '' HUP INT TERM - kill $DISCRIMINATOR $RPROXY 2>/dev/null || true + kill $WAF $RPROXY 2>/dev/null || true wait || true } @@ -42,8 +42,8 @@ main() { trap stop_both EXIT trap 'exit 1' HUP INT TERM - "$ROOT/bin/sww" discriminator & - DISCRIMINATOR=$! + "$ROOT/bin/sww" waf & + WAF=$! "$ROOT/bin/sww" rproxy & RPROXY=$! wait "$RPROXY" diff --git a/share/sww.run b/share/sww.run index 5b31932..1f8eeec 100755 --- a/share/sww.run +++ b/share/sww.run @@ -3,7 +3,7 @@ set -euo pipefail # runit's run script for sww, run again whenever sww # exits; the wait spaces out the restarts. SWW_COMMAND names the -# command to run: rproxy when it is unset or empty, or discriminator. With any +# command to run: rproxy when it is unset or empty, or waf. With any # other value the script starts nothing and stops with a message naming it. # exec, so that the signal `sv stop` sends reaches sww itself. main() { @@ -11,9 +11,9 @@ main() { local command="${SWW_COMMAND:-rproxy}" case "$command" in rproxy) ;; - discriminator) give_state_dir_to_sww ;; + waf) give_state_dir_to_sww ;; *) - printf 'SWW_COMMAND: "%s" is not rproxy or discriminator\n' \ + printf 'SWW_COMMAND: "%s" is not rproxy or waf\n' \ "$command" >&2 exit 1 ;; @@ -25,9 +25,9 @@ main() { # it to the sww user, so that a volume mounted there needs no change # of owner; chown -R changes a symbolic link itself, never what it points # to. When SWW_STATE_DIR, in either form, cannot be read or is not the -# absolute path of a directory, no owner is changed, and discriminator starts and +# absolute path of a directory, no owner is changed, and waf starts and # stops with a message naming the setting. A change of owner that fails, as -# on a volume mounted read-only, does not end the script either: discriminator +# on a volume mounted read-only, does not end the script either: waf # reports a directory it cannot write. give_state_dir_to_sww() { local dir