script/gitea-requests, and the gitea refusals it confirms named in SPEC.md (closes #30)

script/gitea-requests runs gitea 1.27.3 behind the image at its
defaults, sends through it the requests that reading gitea's source
found the Core Rule Set refuses, with a short sample of ordinary use,
and prints each request with the rule ids that matched it. make
gitea-requests runs it; make check does not.

Every case still holds, and each fix would let through what SPEC.md
says stays refused, so the notes specific to gitea now name them with
how each refusal plays out: file names in query parameters that read as
Java, script, PowerShell or SQL, such paths, and an image push that
reuses a layer of an image named like a command.

Model: opus-5-5

internal/bans/admin_test.go

@@ -61,59 +61,6 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 0, third: 1})
 }
 
-func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
-	t.Parallel()
-
-	rules := defaultRules()
-	rules.MaxBans = 2
-	ledger := bans.New(rules)
-	netblock := netip.MustParsePrefix("203.0.113.1/32")
-	other := netip.MustParsePrefix("203.0.113.2/32")
-
-	// An admin bans the netblock for a minute, and it then breaks a limit
-	// twice, each time after its last ban has ended.
-	ledger.BanForAdmin(netblock, midnight(), midnight().Add(time.Minute),
-		"probes for logins")
-	first, _ := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
-	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
-
-	// A ban on another netblock fills the ledger, and the netblock's first
-	// ban for a limit, its earliest that is not an admin's, goes.
-	ledger.BanForLimit(other, second.Start, bans.Notes{})
-	wantBans(t, ledger, map[netip.Prefix]int{netblock: 2, other: 1})
-
-	// The netblock's next ban still counts it.
-	third, _ := ledger.BanForLimit(netblock, second.Expires, bans.Notes{})
-	if third.Notes.EarlierBans != (bans.EarlierBans{Limit: 2, Admin: 1}) {
-		t.Errorf("the third ban for a limit has earlier bans %+v, "+
-			"want 2 for a limit and 1 an admin's", third.Notes.EarlierBans)
-	}
-}
-
-func TestEarlierBansCountABanAnAdminKeepsOnce(t *testing.T) {
-	t.Parallel()
-
-	ledger := bans.New(defaultRules())
-	netblock := netip.MustParsePrefix("203.0.113.1/32")
-
-	// The netblock breaks a limit twice, the second time after its first
-	// ban has ended, and the second ban's notes count the first. An admin
-	// then keeps the first ban.
-	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
-	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
-
-	kept := first
-	kept.Cause = bans.CauseAdmin
-	ledger.LoadEdit([]bans.Ban{kept, second})
-
-	// The netblock's next ban counts the kept ban once, as an admin's.
-	third, _ := ledger.BanForLimit(netblock, second.Expires, bans.Notes{})
-	if third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Admin: 1}) {
-		t.Errorf("the third ban for a limit has earlier bans %+v, "+
-			"want 1 for a limit and 1 an admin's", third.Notes.EarlierBans)
-	}
-}
-
 func TestReasonOfTheBansSmallwebwafMakes(t *testing.T) {
 	t.Parallel()
 

internal/bans/bans.go

@@ -687,51 +687,26 @@ func (l *Ledger) ban(
 }
 
 // earlierBans returns how many bans a netblock with the bans held, oldest
-// first, has had, by cause. Each ban held gives a count: the bans its
-// notes count before it, and one for it and each ban held after it. A
-// ban's count misses a ban dropped after it to make room, and that of an
-// admin's ban added to bans.json without notes misses the bans before it,
-// so the count that names the most bans is taken, whole: a ban an admin
-// keeps by giving it CauseAdmin is still counted under its old cause in
-// later bans' notes, and taking each cause from another count would count
-// it twice.
+// first, has had, by cause: the first ban held counts the bans the
+// netblock had before that one, since dropped to make room, and each ban
+// held adds one.
 func earlierBans(held []Ban) EarlierBans {
-	// fromHere counts ban and the bans held after it.
-	var most, fromHere EarlierBans
+	earlier := held[0].Notes.EarlierBans
 
-	for _, ban := range slices.Backward(held) {
+	for _, ban := range held {
 		switch ban.Cause {
 		case CauseLimit:
-			fromHere.Limit++
+			earlier.Limit++
 		case CauseAttack:
-			fromHere.Attack++
+			earlier.Attack++
 		case CauseAdmin:
-			fromHere.Admin++
+			earlier.Admin++
 		case CauseCrowdSec:
-			fromHere.CrowdSec++
-		}
-
-		notes := ban.Notes.EarlierBans
-		count := EarlierBans{
-			Limit:    notes.Limit + fromHere.Limit,
-			Attack:   notes.Attack + fromHere.Attack,
-			Admin:    notes.Admin + fromHere.Admin,
-			CrowdSec: notes.CrowdSec + fromHere.CrowdSec,
-		}
-
-		// Of counts that name as many bans, the earlier ban's is taken: it
-		// counts more of the bans held by the cause they have now.
-		if count.total() >= most.total() {
-			most = count
+			earlier.CrowdSec++
 		}
 	}
 
-	return most
-}
-
-// total returns how many bans e counts, of all causes.
-func (e EarlierBans) total() int {
-	return e.Limit + e.Attack + e.Admin + e.CrowdSec
+	return earlier
 }
 
 // markChanged has Changed receive a value, unless one is waiting already.

script/gitea-requests

@@ -244,11 +244,8 @@ push_images() {
         docker import - "$address/owner/python3-app:1" >/dev/null
     docker tag "$address/owner/python3-app:1" "$address/owner/app:1"
 
-    # The login is written here rather than made with docker login, which
-    # would keep it in the host's credential helper when it has one.
-    mkdir "$WORK/docker"
-    printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$address" \
-        "$(printf 'owner:%s' "$PASSWORD" | base64)" >"$WORK/docker/config.json"
+    echo "$PASSWORD" | DOCKER_CONFIG="$WORK/docker" docker login --username owner \
+        --password-stdin "$address" >/dev/null 2>&1 || fail "docker login failed"
     for image in "$address/owner/python3-app:1" "$address/owner/app:1"; do
         DOCKER_CONFIG="$WORK/docker" docker push --quiet "$image" >/dev/null ||
             echo "gitea-requests: the push of $image failed" >&2