Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 clawbot
|
478c3affad | ||
|
clawbot
|
50c50bfcae | ||
|
clawbot
|
b84a33fb57 |
No files matched your search
@@ -43,8 +43,7 @@ It protects against:
|
|||||||
- give the clients of chosen networks and countries a fraction of every
|
- give the clients of chosen networks and countries a fraction of every
|
||||||
limit, so that they are banned sooner;
|
limit, so that they are banned sooner;
|
||||||
- refuse or limit clients on a blocklist, a DNS blocklist, or with a high
|
- refuse or limit clients on a blocklist, a DNS blocklist, or with a high
|
||||||
AbuseIPDB score;
|
AbuseIPDB score.
|
||||||
- ban clients named by your own CrowdSec engine.
|
|
||||||
- Slow and oversized requests. Every request and every answer has a time limit
|
- Slow and oversized requests. Every request and every answer has a time limit
|
||||||
and a size limit.
|
and a size limit.
|
||||||
|
|
||||||
@@ -290,8 +289,6 @@ Every setting the code reads, with its default:
|
|||||||
| `SWW_WAF_ABUSEIPDB_KEY` | unset | The key of your AbuseIPDB account; set, a client that has committed an offence is checked in the background. |
|
| `SWW_WAF_ABUSEIPDB_KEY` | unset | The key of your AbuseIPDB account; set, a client that has committed an offence is checked in the background. |
|
||||||
| `SWW_WAF_ABUSEIPDB_MIN_SCORE` | `75` | The least AbuseIPDB abuse confidence score, from 0 to 100, that is a hit. |
|
| `SWW_WAF_ABUSEIPDB_MIN_SCORE` | `75` | The least AbuseIPDB abuse confidence score, from 0 to 100, that is a hit. |
|
||||||
| `SWW_WAF_ABUSEIPDB_DAILY_BUDGET` | `900` | The most AbuseIPDB checks made in a day. |
|
| `SWW_WAF_ABUSEIPDB_DAILY_BUDGET` | `900` | The most AbuseIPDB checks made in a day. |
|
||||||
| `SWW_WAF_CROWDSEC_LAPI_URL` | unset | The local API of a CrowdSec engine you run, such as `http://172.17.0.1:8080`; its decision list is fetched every minute, and a listed client is banned. |
|
|
||||||
| `SWW_WAF_CROWDSEC_LAPI_KEY` | unset | The key the engine gave for `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it; set with the URL, never alone. |
|
|
||||||
| `SWW_WAF_DNSBL_ABUSEIPDB_ACTION` | `limit:25` | What a client listed by a DNS blocklist, or scored a hit by AbuseIPDB, gets: `deny`, `limit:<percent>` or `log`. |
|
| `SWW_WAF_DNSBL_ABUSEIPDB_ACTION` | `limit:25` | What a client listed by a DNS blocklist, or scored a hit by AbuseIPDB, gets: `deny`, `limit:<percent>` or `log`. |
|
||||||
| `SWW_WAF_IP_REPUTATION_CACHE_TTL` | `24h` | How long a DNS blocklist verdict or an AbuseIPDB score is used. |
|
| `SWW_WAF_IP_REPUTATION_CACHE_TTL` | `24h` | How long a DNS blocklist verdict or an AbuseIPDB score is used. |
|
||||||
| `SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS` | `2000` | How long a DNS blocklist query or an AbuseIPDB check may take, in milliseconds. |
|
| `SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS` | `2000` | How long a DNS blocklist query or an AbuseIPDB check may take, in milliseconds. |
|
||||||
@@ -570,8 +567,7 @@ Each request gets tags from what `waf` knows of its client, written in the
|
|||||||
- `asn=<number>` and `country=<code>`, from the lookup;
|
- `asn=<number>` and `country=<code>`, from the lookup;
|
||||||
- one tag per list of `SWW_WAF_TAG_LISTS` that holds the client, such as
|
- one tag per list of `SWW_WAF_TAG_LISTS` that holds the client, such as
|
||||||
`torexit` or `vpn=mullvad`;
|
`torexit` or `vpn=mullvad`;
|
||||||
- `crowdsec`, `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists
|
- `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists the client;
|
||||||
the client;
|
|
||||||
- `exploitsignature`, when a rule file or the Core Rule Set matched the request;
|
- `exploitsignature`, when a rule file or the Core Rule Set matched the request;
|
||||||
- `asn=<number>` and `prefix=<netblock>`, from a routewatch instance, while
|
- `asn=<number>` and `prefix=<netblock>`, from a routewatch instance, while
|
||||||
`SWW_WAF_ROUTEWATCH_URL` is set.
|
`SWW_WAF_ROUTEWATCH_URL` is set.
|
||||||
|
|||||||
@@ -176,7 +176,6 @@ field gives that name. `refusal_limit` and `byte_limits` give theirs in
|
|||||||
8. The reputation sources (see "Reputation"), in this order:
|
8. The reputation sources (see "Reputation"), in this order:
|
||||||
- A client on a fetched blocklist gets `SWW_WAF_BLOCKLIST_ACTION`
|
- A client on a fetched blocklist gets `SWW_WAF_BLOCKLIST_ACTION`
|
||||||
(`blocklists`).
|
(`blocklists`).
|
||||||
- A client on the CrowdSec decision list is banned (`crowdsec`).
|
|
||||||
- A client listed by a DNS blocklist gets `SWW_WAF_DNSBL_ABUSEIPDB_ACTION`
|
- A client listed by a DNS blocklist gets `SWW_WAF_DNSBL_ABUSEIPDB_ACTION`
|
||||||
(`dnsbl`).
|
(`dnsbl`).
|
||||||
- A client scored at least `SWW_WAF_ABUSEIPDB_MIN_SCORE` by AbuseIPDB gets
|
- A client scored at least `SWW_WAF_ABUSEIPDB_MIN_SCORE` by AbuseIPDB gets
|
||||||
@@ -301,14 +300,6 @@ without a ban, because the Core Rule Set has false positives. A `block` rule
|
|||||||
does the same. Those refusals count toward the refusal limit, so a client that
|
does the same. Those refusals count toward the refusal limit, so a client that
|
||||||
keeps setting them off is banned for a broken limit.
|
keeps setting them off is banned for a broken limit.
|
||||||
|
|
||||||
A client on the CrowdSec decision list is banned until the decision ends, with
|
|
||||||
the cause `crowdsec`. Only a client that sends a request is banned, so a long
|
|
||||||
list does not fill `bans.json`. Such a ban is never made permanent. It does not
|
|
||||||
make the netblock's next ban for a broken limit longer. A ban lifted while the
|
|
||||||
decision is in force is made again at the client's next request. To lift it for
|
|
||||||
good, delete the decision in CrowdSec, then lift the ban once the list has been
|
|
||||||
fetched again.
|
|
||||||
|
|
||||||
These refuse each request they cover, record nothing in `bans.json`, and count
|
These refuse each request they cover, record nothing in `bans.json`, and count
|
||||||
no offence:
|
no offence:
|
||||||
|
|
||||||
@@ -338,10 +329,10 @@ toward `SWW_WAF_MAX_BANS`, so such bans can never fill the table.
|
|||||||
|
|
||||||
A request refused under a ban that runs out is logged with the action
|
A request refused under a ban that runs out is logged with the action
|
||||||
`temporarily_banned`. Under a permanent ban the action is `permanently_banned`.
|
`temporarily_banned`. Under a permanent ban the action is `permanently_banned`.
|
||||||
A request refused for a clear sign of attack or a CrowdSec decision takes the
|
A request refused for a clear sign of attack takes the action for the ban it
|
||||||
action for the ban it made. A request that makes a ban permanent is logged as
|
made. A request that makes a ban permanent is logged as `permanently_banned`. A
|
||||||
`permanently_banned`. A request over a rate limit is logged as
|
request over a rate limit is logged as `client_is_rate_limited`, whichever ban
|
||||||
`client_is_rate_limited`, whichever ban it makes.
|
it makes.
|
||||||
|
|
||||||
## Settings
|
## Settings
|
||||||
|
|
||||||
@@ -575,9 +566,9 @@ Each tag and where it comes from:
|
|||||||
- One tag per list of `SWW_WAF_TAG_LISTS` that holds the client (`tag_lists`),
|
- One tag per list of `SWW_WAF_TAG_LISTS` that holds the client (`tag_lists`),
|
||||||
the tag being the list's name, such as `torexit` or `vpn=mullvad`. These lists
|
the tag being the list's name, such as `torexit` or `vpn=mullvad`. These lists
|
||||||
are fetched and kept like a blocklist. `waf` ships none of its own.
|
are fetched and kept like a blocklist. `waf` ships none of its own.
|
||||||
- `crowdsec`, `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists
|
- `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists the client,
|
||||||
the client, whatever the source's action. A zone with a key is named with the
|
whatever the source's action. A zone with a key is named with the key masked,
|
||||||
key masked, as the `reputation` field gives it.
|
as the `reputation` field gives it.
|
||||||
- `exploitsignature`, when a rule file or the Core Rule Set matched the request.
|
- `exploitsignature`, when a rule file or the Core Rule Set matched the request.
|
||||||
For the Core Rule Set a match is a score at or over
|
For the Core Rule Set a match is a score at or over
|
||||||
`SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD`.
|
`SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD`.
|
||||||
@@ -888,7 +879,8 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
|
|||||||
- a repository's branches, tags and packages pages;
|
- a repository's branches, tags and packages pages;
|
||||||
- an owner's packages page;
|
- an owner's packages page;
|
||||||
- the admin page of packages;
|
- the admin page of packages;
|
||||||
- the API's search of packages.
|
- the API's search of packages;
|
||||||
|
- the searches of the Composer and Conan registries.
|
||||||
|
|
||||||
- `q` on gitea's other searches, for the same four rules. Words such as
|
- `q` on gitea's other searches, for the same four rules. Words such as
|
||||||
`python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
|
`python3`, `powershell`, `ls -la` and `.htaccess` were refused there. The
|
||||||
@@ -905,7 +897,9 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
|
|||||||
- the admin lists of users, organisations, repositories, unadopted
|
- the admin lists of users, organisations, repositories, unadopted
|
||||||
repositories and emails;
|
repositories and emails;
|
||||||
- the API's searches of topics, of an organisation's teams and of
|
- the API's searches of topics, of an organisation's teams and of
|
||||||
emails.
|
emails;
|
||||||
|
- the searches of the Cargo, Chef, Composer and Conan registries, and
|
||||||
|
the NuGet registry's search service.
|
||||||
|
|
||||||
Most send `q` in the query string. The admin forms that adopt a
|
Most send `q` in the query string. The admin forms that adopt a
|
||||||
repository or activate an email send it in the body. gitea serves its
|
repository or activate an email send it in the body. gitea serves its
|
||||||
@@ -916,6 +910,31 @@ one entry of `apps` in `internal/coreruleset/coreruleset.go`. gitea's fixes are:
|
|||||||
and a name, such as `alice/python3-app`;
|
and a name, such as `alice/python3-app`;
|
||||||
- `name` of the search of a repository's milestones.
|
- `name` of the search of a repository's milestones.
|
||||||
|
|
||||||
|
- Fields of the package registries' searches:
|
||||||
|
- `text` of the npm registry's search, for the same four rules and the
|
||||||
|
rule for shell paths (932160). An npm name can hold a slash, as
|
||||||
|
`@alice/tools-cli` does.
|
||||||
|
- `searchTerm` of the NuGet v2 API's searches, for the same four rules.
|
||||||
|
These are the searches:
|
||||||
|
- `Search()` and `Packages()`;
|
||||||
|
- `Search()/$count` and `Packages()/$count`, which count their
|
||||||
|
results.
|
||||||
|
- `$filter` of those searches, for the lists of system files and Windows
|
||||||
|
commands (930120, 932120). It holds an expression such as
|
||||||
|
`tolower(Id) eq 'python3'`.
|
||||||
|
- The names `$filter`, `$orderby` and `$top` on those searches, for the
|
||||||
|
rule for MongoDB operators (942290). It refused every such search.
|
||||||
|
- `q` of a Conan search, for the rule for SQL injection (942100), which
|
||||||
|
refused the pattern `zlib/*`. `q` skips it only when the request has
|
||||||
|
one `q`, in the query string or the body. That `q` has the shape of a
|
||||||
|
Conan reference. A reference is a name, then optionally `/` and a
|
||||||
|
version, then optionally `@` and a user, then optionally `/` and a
|
||||||
|
channel. Each part is made of letters, digits, `_`, `.`, `-` and `*`.
|
||||||
|
A part holds no `+`, since 942100 reads `+` as a space. `q` also holds
|
||||||
|
no `*/`, which ends an SQL comment, and no `--`, which starts one. And
|
||||||
|
942100 finds no SQL injection in `q` once each comment that `/*`
|
||||||
|
starts, an unclosed one included, is replaced by a space.
|
||||||
|
|
||||||
- The path of these requests, which names a file:
|
- The path of these requests, which names a file:
|
||||||
- a file's page;
|
- a file's page;
|
||||||
- its raw file;
|
- its raw file;
|
||||||
@@ -1932,12 +1951,11 @@ to the surrounding netblock. The four ban lengths are under "Bans".
|
|||||||
### Reputation
|
### Reputation
|
||||||
|
|
||||||
No source is on by default. A source acts on a list kept elsewhere; the defaults
|
No source is on by default. A source acts on a list kept elsewhere; the defaults
|
||||||
judge a client only by what it does here. AbuseIPDB and CrowdSec also need an
|
judge a client only by what it does here. AbuseIPDB also needs an account of the
|
||||||
account or an engine of the operator's own. The list best suited to be on by
|
operator's own. The list best suited to be on by default, Spamhaus DROP, has
|
||||||
default, Spamhaus DROP, has terms, below, that forbid frequent fetching, and
|
terms, below, that forbid frequent fetching, and Spamhaus may block an address
|
||||||
Spamhaus may block an address that breaks them. Each `waf` fetches its own copy,
|
that breaks them. Each `waf` fetches its own copy, so several of them on one
|
||||||
so several of them on one host, sharing one address, would often fetch too close
|
host, sharing one address, would often fetch too close together.
|
||||||
together.
|
|
||||||
|
|
||||||
- Blocklists (`SWW_WAF_BLOCKLIST_URLS`) are text files of addresses and
|
- Blocklists (`SWW_WAF_BLOCKLIST_URLS`) are text files of addresses and
|
||||||
netblocks, one to a line, as the Spamhaus DROP list is written. Anything after
|
netblocks, one to a line, as the Spamhaus DROP list is written. Anything after
|
||||||
@@ -1970,18 +1988,6 @@ together.
|
|||||||
percentage of every request and byte limit, and suits a list of addresses
|
percentage of every request and byte limit, and suits a list of addresses
|
||||||
shared with ordinary visitors, such as Tor exits. `log` only notes the hit in
|
shared with ordinary visitors, such as Tor exits. `log` only notes the hit in
|
||||||
the log line and raises an alert.
|
the log line and raises an alert.
|
||||||
- A CrowdSec engine on the host (`SWW_WAF_CROWDSEC_LAPI_URL`) has its decision
|
|
||||||
list fetched every minute, with `SWW_WAF_CROWDSEC_LAPI_KEY` in the `X-Api-Key`
|
|
||||||
header. The list is kept like a fetched blocklist, and a client on it is
|
|
||||||
banned (see "Bans"). Only decisions of the type `ban` on an address or a
|
|
||||||
netblock are used; any other, such as a captcha or a country, is left out. A
|
|
||||||
decision lasts for the `duration` it had left when the engine answered. This
|
|
||||||
is how a fleet-wide blocklist can arrive without `waf` depending on CrowdSec.
|
|
||||||
A fetch fails when:
|
|
||||||
- the engine answers other than `200`, a redirect included;
|
|
||||||
- the fetch does not finish within a minute;
|
|
||||||
- the answer is longer than 16 MiB;
|
|
||||||
- the answer is not a list of decisions.
|
|
||||||
- Each DNS blocklist (`SWW_WAF_DNSBL_ZONES`) is asked about a client's own
|
- Each DNS blocklist (`SWW_WAF_DNSBL_ZONES`) is asked about a client's own
|
||||||
address in the background, the first time the client is seen. No request waits
|
address in the background, the first time the client is seen. No request waits
|
||||||
for the answer. The name asked about is the one RFC 5782 gives: the numbers of
|
for the answer. The name asked about is the one RFC 5782 gives: the numbers of
|
||||||
@@ -2409,14 +2415,13 @@ client without an answer by then counts as unknown. No question waits on these,
|
|||||||
which run in the background:
|
which run in the background:
|
||||||
|
|
||||||
- the DNS blocklists and AbuseIPDB;
|
- the DNS blocklists and AbuseIPDB;
|
||||||
- fetching the blocklists, the tag lists, the CrowdSec decision list and the
|
- fetching the blocklists, the tag lists and the file
|
||||||
file `SWW_WAF_ASN_LIMIT_PERCENT_URL` names.
|
`SWW_WAF_ASN_LIMIT_PERCENT_URL` names.
|
||||||
|
|
||||||
In `enforce` mode, a question does not wait for GeoJS when it is a request:
|
In `enforce` mode, a question does not wait for GeoJS when it is a request:
|
||||||
|
|
||||||
- from a client on a fetched blocklist, while `SWW_WAF_BLOCKLIST_ACTION` is
|
- from a client on a fetched blocklist, while `SWW_WAF_BLOCKLIST_ACTION` is
|
||||||
`deny`;
|
`deny`;
|
||||||
- from a client on the CrowdSec decision list;
|
|
||||||
- that would take its client over a rate limit at 100% of it, since a percentage
|
- that would take its client over a rate limit at 100% of it, since a percentage
|
||||||
can only lower a limit.
|
can only lower a limit.
|
||||||
|
|
||||||
|
|||||||
+3
-5
@@ -13,9 +13,8 @@ back or dropped.
|
|||||||
threshold. The request was refused unless the alert's `detail` gives `mode`:
|
threshold. The request was refused unless the alert's `detail` gives `mode`:
|
||||||
`detect` or `observe`.
|
`detect` or `observe`.
|
||||||
- `anomaly`: a count over an anomaly threshold.
|
- `anomaly`: a count over an anomaly threshold.
|
||||||
- `reputation_hit`: a request from a client on a blocklist, the CrowdSec
|
- `reputation_hit`: a request from a client on a blocklist or a DNS blocklist,
|
||||||
decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
|
or with an AbuseIPDB score that is a hit. One alert per source.
|
||||||
One alert per source.
|
|
||||||
- `source_failure`: one of:
|
- `source_failure`: one of:
|
||||||
- GeoJS failing;
|
- GeoJS failing;
|
||||||
- a list that cannot be fetched;
|
- a list that cannot be fetched;
|
||||||
@@ -69,8 +68,7 @@ on one line:
|
|||||||
"earlier_bans": {
|
"earlier_bans": {
|
||||||
"limit": 0,
|
"limit": 0,
|
||||||
"attack": 0,
|
"attack": 0,
|
||||||
"admin": 0,
|
"admin": 0
|
||||||
"crowdsec": 0
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|||||||
+1
-4
@@ -97,7 +97,7 @@ Every one of these lines has:
|
|||||||
- `client_denied`: refused for `SWW_WAF_DENY_NETS`, for a reputation source
|
- `client_denied`: refused for `SWW_WAF_DENY_NETS`, for a reputation source
|
||||||
with the action `deny`, or for a tag in `SWW_WAF_TAG_DENY`;
|
with the action `deny`, or for a tag in `SWW_WAF_TAG_DENY`;
|
||||||
- `temporarily_banned`: refused under a ban that runs out, or for a `ban`
|
- `temporarily_banned`: refused under a ban that runs out, or for a `ban`
|
||||||
rule, a trap path or a CrowdSec decision that made such a ban;
|
rule or a trap path that made such a ban;
|
||||||
- `permanently_banned`: refused under a ban that never runs out, including a
|
- `permanently_banned`: refused under a ban that never runs out, including a
|
||||||
ban this request made or made permanent;
|
ban this request made or made permanent;
|
||||||
- `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
|
- `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
|
||||||
@@ -118,8 +118,6 @@ Every one of these lines has:
|
|||||||
- `countries`: `country`, and `setting`, the country list that refused it;
|
- `countries`: `country`, and `setting`, the country list that refused it;
|
||||||
- `tag_deny`: `tag`, the tag of `SWW_WAF_TAG_DENY` the request carries;
|
- `tag_deny`: `tag`, the tag of `SWW_WAF_TAG_DENY` the request carries;
|
||||||
- `blocklists`: `lists`, the blocklist URLs that list the client;
|
- `blocklists`: `lists`, the blocklist URLs that list the client;
|
||||||
- `crowdsec`: `scenario`, the decision's scenario, and `expires`, when the
|
|
||||||
decision ends;
|
|
||||||
- `dnsbl`: `zones`, the DNS blocklist zones that list the client, their keys
|
- `dnsbl`: `zones`, the DNS blocklist zones that list the client, their keys
|
||||||
masked;
|
masked;
|
||||||
- `abuseipdb`: `score`, and `min_score`, `SWW_WAF_ABUSEIPDB_MIN_SCORE`;
|
- `abuseipdb`: `score`, and `min_score`, `SWW_WAF_ABUSEIPDB_MIN_SCORE`;
|
||||||
@@ -171,7 +169,6 @@ Every one of these lines has:
|
|||||||
and the rules that matched, for a request it inspected.
|
and the rules that matched, for a request it inspected.
|
||||||
- `reputation`: the sources the client is on, in this order:
|
- `reputation`: the sources the client is on, in this order:
|
||||||
- blocklist URLs;
|
- blocklist URLs;
|
||||||
- the CrowdSec decision list's URL;
|
|
||||||
- DNS blocklist zones;
|
- DNS blocklist zones;
|
||||||
- `abuseipdb`.
|
- `abuseipdb`.
|
||||||
- `tags`: the request's tags, sorted, left out when it has none. Each tag and
|
- `tags`: the request's tags, sorted, left out when it has none. Each tag and
|
||||||
|
|||||||
+2
-13
@@ -180,8 +180,8 @@ in [`SPEC.md`](../SPEC.md).
|
|||||||
`name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the
|
`name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the
|
||||||
tag, and may hold `=`, such as `vpn=mullvad`. Each list is an `http` or
|
tag, and may hold `=`, such as `vpn=mullvad`. Each list is an `http` or
|
||||||
`https` URL fetched like a blocklist. A name or URL listed twice is refused.
|
`https` URL fetched like a blocklist. A name or URL listed twice is refused.
|
||||||
So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS`,
|
So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS` or is
|
||||||
`SWW_WAF_ASN_LIMIT_PERCENT_URL`, or the CrowdSec decision list.
|
`SWW_WAF_ASN_LIMIT_PERCENT_URL`.
|
||||||
- `SWW_WAF_TAG_DENY` (default empty): tags whose requests are refused, such as
|
- `SWW_WAF_TAG_DENY` (default empty): tags whose requests are refused, such as
|
||||||
`torexit,country=CN`. A tag listed twice, an `asn=` tag without a number, or a
|
`torexit,country=CN`. A tag listed twice, an `asn=` tag without a number, or a
|
||||||
`country=` tag without a country, is refused.
|
`country=` tag without a country, is refused.
|
||||||
@@ -214,9 +214,6 @@ tag that no request can get stops the start. A request can get only these:
|
|||||||
`SWW_WAF_CORE_RULE_SET_MODE` nor `SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD` is
|
`SWW_WAF_CORE_RULE_SET_MODE` nor `SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD` is
|
||||||
`off`.
|
`off`.
|
||||||
|
|
||||||
`crowdsec` stops the start in both settings, because a CrowdSec decision refuses
|
|
||||||
the request first.
|
|
||||||
|
|
||||||
## Biased thresholds
|
## Biased thresholds
|
||||||
|
|
||||||
- `SWW_WAF_ASN_BYTES_LIMIT_PERCENT` and `SWW_WAF_COUNTRY_BYTES_LIMIT_PERCENT`
|
- `SWW_WAF_ASN_BYTES_LIMIT_PERCENT` and `SWW_WAF_COUNTRY_BYTES_LIMIT_PERCENT`
|
||||||
@@ -333,14 +330,6 @@ the request first.
|
|||||||
score, from 0 to 100, that is a hit.
|
score, from 0 to 100, that is a hit.
|
||||||
- `SWW_WAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a
|
- `SWW_WAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a
|
||||||
day, a whole number above zero. AbuseIPDB's free accounts may make 1,000.
|
day, a whole number above zero. AbuseIPDB's free accounts may make 1,000.
|
||||||
- `SWW_WAF_CROWDSEC_LAPI_URL` (default unset): the local API of a CrowdSec
|
|
||||||
engine you run, such as `http://172.17.0.1:8080`. An `http` or `https` URL
|
|
||||||
without a user or a fragment; its decision list is at `v1/decisions` under it.
|
|
||||||
Set without the key, it is refused. So is a decision list URL that is also in
|
|
||||||
`SWW_WAF_BLOCKLIST_URLS`, or that is `SWW_WAF_ASN_LIMIT_PERCENT_URL`.
|
|
||||||
- `SWW_WAF_CROWDSEC_LAPI_KEY` (default unset): the key the engine gave for
|
|
||||||
`smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it. Set without the
|
|
||||||
URL, it is refused.
|
|
||||||
- `SWW_WAF_DNSBL_ABUSEIPDB_ACTION` (default `limit:25`): `deny`,
|
- `SWW_WAF_DNSBL_ABUSEIPDB_ACTION` (default `limit:25`): `deny`,
|
||||||
`limit:<percent>` or `log`, for DNS blocklist and AbuseIPDB hits.
|
`limit:<percent>` or `log`, for DNS blocklist and AbuseIPDB hits.
|
||||||
- `SWW_WAF_IP_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict
|
- `SWW_WAF_IP_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict
|
||||||
|
|||||||
+1
-1
@@ -25,7 +25,7 @@ Active and past bans: every ban an admin made, and up to `SWW_WAF_MAX_BANS` of
|
|||||||
those `waf` made. Per entry:
|
those `waf` made. Per entry:
|
||||||
|
|
||||||
- `netblock`, `start` and `expires` (`null` for a permanent ban);
|
- `netblock`, `start` and `expires` (`null` for a permanent ban);
|
||||||
- `cause`: `attack`, `limit`, `admin` or `crowdsec`;
|
- `cause`: `attack`, `limit` or `admin`;
|
||||||
- `reason`: a short reason;
|
- `reason`: a short reason;
|
||||||
- `lifted`: when an admin lifted it, if one did;
|
- `lifted`: when an admin lifted it, if one did;
|
||||||
- `notes`: the notes below.
|
- `notes`: the notes below.
|
||||||
|
|||||||
@@ -48,9 +48,8 @@ const (
|
|||||||
// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD, refused in block mode, let through in
|
// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD, refused in block mode, let through in
|
||||||
// detect mode.
|
// detect mode.
|
||||||
EventCoreRuleSetMatch = "core_rule_set_match"
|
EventCoreRuleSetMatch = "core_rule_set_match"
|
||||||
// EventReputationHit is a request whose client a blocklist, the
|
// EventReputationHit is a request whose client a blocklist or a DNSBL
|
||||||
// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
|
// zone lists, or whose AbuseIPDB score is a hit.
|
||||||
// is a hit.
|
|
||||||
EventReputationHit = "reputation_hit"
|
EventReputationHit = "reputation_hit"
|
||||||
// EventSourceFailure is GeoJS failing or refusing sww, a fetch
|
// EventSourceFailure is GeoJS failing or refusing sww, a fetch
|
||||||
// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB
|
// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB
|
||||||
|
|||||||
+29
-102
@@ -1,10 +1,8 @@
|
|||||||
// Package bans is the ban ledger: the bans sww makes on the
|
// Package bans is the ban ledger: the bans sww makes on the
|
||||||
// netblocks of clients that break a rate limit, a byte limit or the refusal
|
// netblocks of clients that break a rate limit, a byte limit or the refusal
|
||||||
// limit, show a clear sign of attack or are listed by the CrowdSec
|
// limit or show a clear sign of attack, and those an admin makes, with their
|
||||||
// decision list, and
|
// notes, as the "Bans" section of SPEC.md describes. The bans are kept in
|
||||||
// those an admin makes, with their notes, as the "Bans" section of SPEC.md
|
// memory, and written to bans.json and read from it by the state package.
|
||||||
// describes. The bans are kept in memory, and written to bans.json and
|
|
||||||
// read from it by the state package.
|
|
||||||
package bans
|
package bans
|
||||||
|
|
||||||
import (
|
import (
|
||||||
@@ -28,9 +26,6 @@ const (
|
|||||||
// CauseAdmin is a ban an admin made, or one sww made that an
|
// CauseAdmin is a ban an admin made, or one sww made that an
|
||||||
// admin keeps. It is never dropped.
|
// admin keeps. It is never dropped.
|
||||||
CauseAdmin = "admin"
|
CauseAdmin = "admin"
|
||||||
// CauseCrowdSec is a ban sww made for a client the CrowdSec
|
|
||||||
// decision list lists. It ends when CrowdSec's decision does.
|
|
||||||
CauseCrowdSec = "crowdsec"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// repeatFactor is how many times as long as the netblock's last ban a ban
|
// repeatFactor is how many times as long as the netblock's last ban a ban
|
||||||
@@ -45,8 +40,8 @@ type Params struct {
|
|||||||
// LimitBanDuration is how long a first ban for a broken limit lasts.
|
// LimitBanDuration is how long a first ban for a broken limit lasts.
|
||||||
LimitBanDuration time.Duration
|
LimitBanDuration time.Duration
|
||||||
// LimitBanRepeatWindow is how soon after the end of the netblock's
|
// LimitBanRepeatWindow is how soon after the end of the netblock's
|
||||||
// ban that ended last, other than one for a clear sign of attack or for
|
// ban that ended last, other than one for a clear sign of attack, a
|
||||||
// CrowdSec's decision, a broken limit counts as a repeat, which bans for
|
// broken limit counts as a repeat, which bans for
|
||||||
// repeatFactor times as long as that ban.
|
// repeatFactor times as long as that ban.
|
||||||
LimitBanRepeatWindow time.Duration
|
LimitBanRepeatWindow time.Duration
|
||||||
// A ban for a broken limit that would be longer than
|
// A ban for a broken limit that would be longer than
|
||||||
@@ -68,11 +63,10 @@ type Ban struct {
|
|||||||
Start time.Time
|
Start time.Time
|
||||||
// Expires is when the ban ends, zero for a permanent ban.
|
// Expires is when the ban ends, zero for a permanent ban.
|
||||||
Expires time.Time
|
Expires time.Time
|
||||||
// Cause is CauseLimit, CauseAttack, CauseAdmin or CauseCrowdSec.
|
// Cause is CauseLimit, CauseAttack or CauseAdmin.
|
||||||
Cause string
|
Cause string
|
||||||
// Reason is a short text: for a ban sww made, the limit broken,
|
// Reason is a short text: for a ban sww made, the limit broken or
|
||||||
// the rule that matched or the scenario of CrowdSec's decision; for an
|
// the rule that matched; for an admin's, what the admin wrote.
|
||||||
// admin's, what the admin wrote.
|
|
||||||
Reason string
|
Reason string
|
||||||
// Lifted is when an admin lifted the ban, zero while no admin has. A
|
// Lifted is when an admin lifted the ban, zero while no admin has. A
|
||||||
// lifted ban refuses nothing, and does not make the netblock's next
|
// lifted ban refuses nothing, and does not make the netblock's next
|
||||||
@@ -133,8 +127,7 @@ type Notes struct {
|
|||||||
// log's reputation names them. It is left out when none did.
|
// log's reputation names them. It is left out when none did.
|
||||||
Reputation []ReputationHit `json:"reputation,omitempty"`
|
Reputation []ReputationHit `json:"reputation,omitempty"`
|
||||||
// Request is the request that broke the limit, or whose bytes broke
|
// Request is the request that broke the limit, or whose bytes broke
|
||||||
// it, that was the clear sign of attack, or that came from a client the
|
// it, or that was the clear sign of attack.
|
||||||
// CrowdSec decision list lists.
|
|
||||||
Request Request `json:"request"`
|
Request Request `json:"request"`
|
||||||
// Requests is how many requests the netblock has sent since it was
|
// Requests is how many requests the netblock has sent since it was
|
||||||
// first seen, and Refused how many of them the ban has refused so
|
// first seen, and Refused how many of them the ban has refused so
|
||||||
@@ -148,9 +141,8 @@ type Notes struct {
|
|||||||
|
|
||||||
// ReputationHit is a reputation source that listed a client, as a
|
// ReputationHit is a reputation source that listed a client, as a
|
||||||
// reputation_hit alert's detail gives it: Source is the URL of the
|
// reputation_hit alert's detail gives it: Source is the URL of the
|
||||||
// blocklist or of the CrowdSec decision list, the DNSBL zone with its key
|
// blocklist, the DNSBL zone with its key masked, or "abuseipdb", and Score,
|
||||||
// masked, or "abuseipdb", and Score, for AbuseIPDB alone, its score of the
|
// for AbuseIPDB alone, its score of the client.
|
||||||
// client.
|
|
||||||
type ReputationHit struct {
|
type ReputationHit struct {
|
||||||
Source string `json:"source"`
|
Source string `json:"source"`
|
||||||
Score *int64 `json:"score,omitempty"`
|
Score *int64 `json:"score,omitempty"`
|
||||||
@@ -161,7 +153,6 @@ type EarlierBans struct {
|
|||||||
Limit int `json:"limit"`
|
Limit int `json:"limit"`
|
||||||
Attack int `json:"attack"`
|
Attack int `json:"attack"`
|
||||||
Admin int `json:"admin"`
|
Admin int `json:"admin"`
|
||||||
CrowdSec int `json:"crowdsec"`
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Request is a request in a ban's notes. Each text is cut to 256 bytes.
|
// Request is a request in a ban's notes. Each text is cut to 256 bytes.
|
||||||
@@ -303,8 +294,7 @@ func activeBan(bans []Ban, now time.Time) *Ban {
|
|||||||
// BanForLimit bans netblock at now for a broken limit, with notes, and
|
// BanForLimit bans netblock at now for a broken limit, with notes, and
|
||||||
// returns the ban, and true. A first ban lasts LimitBanDuration. A ban
|
// returns the ban, and true. A first ban lasts LimitBanDuration. A ban
|
||||||
// made within LimitBanRepeatWindow after the netblock's ban that ended
|
// made within LimitBanRepeatWindow after the netblock's ban that ended
|
||||||
// last, other than one for a clear sign of attack or for CrowdSec's
|
// last, other than one for a clear sign of attack or a lifted one, lasts
|
||||||
// decision, or a lifted one, lasts
|
|
||||||
// repeatFactor times as long as that one. A ban that would be longer
|
// repeatFactor times as long as that one. A ban that would be longer
|
||||||
// than LimitBanPermanentAbove is permanent instead. If a ban on netblock is still
|
// than LimitBanPermanentAbove is permanent instead. If a ban on netblock is still
|
||||||
// active, as when two of its requests break a limit at once, that ban is
|
// active, as when two of its requests break a limit at once, that ban is
|
||||||
@@ -318,7 +308,6 @@ func (l *Ledger) BanForLimit(
|
|||||||
return l.ban(
|
return l.ban(
|
||||||
netblock,
|
netblock,
|
||||||
now,
|
now,
|
||||||
time.Time{},
|
|
||||||
CauseLimit,
|
CauseLimit,
|
||||||
limitReason(notes),
|
limitReason(notes),
|
||||||
notes,
|
notes,
|
||||||
@@ -334,7 +323,6 @@ func (l *Ledger) WouldBanForLimit(
|
|||||||
return l.ban(
|
return l.ban(
|
||||||
netblock,
|
netblock,
|
||||||
now,
|
now,
|
||||||
time.Time{},
|
|
||||||
CauseLimit,
|
CauseLimit,
|
||||||
limitReason(notes),
|
limitReason(notes),
|
||||||
notes,
|
notes,
|
||||||
@@ -353,7 +341,6 @@ func (l *Ledger) BanForAttack(
|
|||||||
return l.ban(
|
return l.ban(
|
||||||
netblock,
|
netblock,
|
||||||
now,
|
now,
|
||||||
time.Time{},
|
|
||||||
CauseAttack,
|
CauseAttack,
|
||||||
attackReason(notes),
|
attackReason(notes),
|
||||||
notes,
|
notes,
|
||||||
@@ -369,7 +356,6 @@ func (l *Ledger) WouldBanForAttack(
|
|||||||
return l.ban(
|
return l.ban(
|
||||||
netblock,
|
netblock,
|
||||||
now,
|
now,
|
||||||
time.Time{},
|
|
||||||
CauseAttack,
|
CauseAttack,
|
||||||
attackReason(notes),
|
attackReason(notes),
|
||||||
notes,
|
notes,
|
||||||
@@ -377,51 +363,9 @@ func (l *Ledger) WouldBanForAttack(
|
|||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
// BanForCrowdSec bans netblock at now until expires, when CrowdSec's
|
// WouldBePermanent reports whether a ban on netblock for cause, CauseLimit
|
||||||
// decision on the client ends, with notes, and returns the ban, and
|
// or CauseAttack, made at now would be permanent, as BanForLimit or
|
||||||
// whether it made it, as BanForLimit does. Its reason is "CrowdSec's
|
// BanForAttack would make it. It works out nothing else of the ban.
|
||||||
// decision for <scenario>", the scenario that made the decision.
|
|
||||||
func (l *Ledger) BanForCrowdSec(
|
|
||||||
netblock netip.Prefix,
|
|
||||||
now, expires time.Time,
|
|
||||||
scenario string,
|
|
||||||
notes Notes,
|
|
||||||
) (Ban, bool) {
|
|
||||||
return l.ban(
|
|
||||||
netblock,
|
|
||||||
now,
|
|
||||||
expires,
|
|
||||||
CauseCrowdSec,
|
|
||||||
crowdSecReason(scenario),
|
|
||||||
notes,
|
|
||||||
true,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
// WouldBanForCrowdSec returns what BanForCrowdSec would, without making
|
|
||||||
// the ban: what observe mode would have done.
|
|
||||||
func (l *Ledger) WouldBanForCrowdSec(
|
|
||||||
netblock netip.Prefix,
|
|
||||||
now, expires time.Time,
|
|
||||||
scenario string,
|
|
||||||
notes Notes,
|
|
||||||
) (Ban, bool) {
|
|
||||||
return l.ban(
|
|
||||||
netblock,
|
|
||||||
now,
|
|
||||||
expires,
|
|
||||||
CauseCrowdSec,
|
|
||||||
crowdSecReason(scenario),
|
|
||||||
notes,
|
|
||||||
false,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
// WouldBePermanent reports whether a ban on netblock for cause, CauseLimit,
|
|
||||||
// CauseAttack or CauseCrowdSec, made at now would be permanent, as
|
|
||||||
// BanForLimit, BanForAttack or BanForCrowdSec would make it. It works out
|
|
||||||
// nothing else of the ban. A ban for CrowdSec's decision is never
|
|
||||||
// permanent: it ends with the decision.
|
|
||||||
func (l *Ledger) WouldBePermanent(
|
func (l *Ledger) WouldBePermanent(
|
||||||
netblock netip.Prefix, now time.Time, cause string,
|
netblock netip.Prefix, now time.Time, cause string,
|
||||||
) bool {
|
) bool {
|
||||||
@@ -433,14 +377,11 @@ func (l *Ledger) WouldBePermanent(
|
|||||||
held = *bans
|
held = *bans
|
||||||
}
|
}
|
||||||
|
|
||||||
switch cause {
|
if cause == CauseAttack {
|
||||||
case CauseAttack:
|
|
||||||
return l.attackExpiry(held, now).IsZero()
|
return l.attackExpiry(held, now).IsZero()
|
||||||
case CauseLimit:
|
|
||||||
return l.limitExpiry(held, now).IsZero()
|
|
||||||
default: // CauseCrowdSec
|
|
||||||
return false
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
return l.limitExpiry(held, now).IsZero()
|
||||||
}
|
}
|
||||||
|
|
||||||
// limitReason is the reason of a ban for a broken limit, with notes.
|
// limitReason is the reason of a ban for a broken limit, with notes.
|
||||||
@@ -459,12 +400,6 @@ func attackReason(notes Notes) string {
|
|||||||
return "matched the rule " + notes.RuleID
|
return "matched the rule " + notes.RuleID
|
||||||
}
|
}
|
||||||
|
|
||||||
// crowdSecReason is the reason of a ban for CrowdSec's decision, which
|
|
||||||
// scenario made.
|
|
||||||
func crowdSecReason(scenario string) string {
|
|
||||||
return "CrowdSec's decision for " + scenario
|
|
||||||
}
|
|
||||||
|
|
||||||
// BanForAdmin bans netblock at now for an admin, with reason, until
|
// BanForAdmin bans netblock at now for an admin, with reason, until
|
||||||
// expires, or for good when expires is zero, and returns the ban, whose
|
// expires, or for good when expires is zero, and returns the ban, whose
|
||||||
// cause is CauseAdmin. Unlike BanForLimit and BanForAttack, it makes the
|
// cause is CauseAdmin. Unlike BanForLimit and BanForAttack, it makes the
|
||||||
@@ -704,15 +639,13 @@ func (l *Ledger) holds(netblock netip.Prefix, start time.Time) bool {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
// ban bans netblock at now for cause, with reason and notes, as
|
// ban bans netblock at now for cause, CauseLimit or CauseAttack, with
|
||||||
// BanForLimit, BanForAttack and BanForCrowdSec describe, and returns the
|
// reason and notes, as BanForLimit and BanForAttack describe, and returns
|
||||||
// ban, and whether it made it. expires is when a ban for CauseCrowdSec
|
// the ban, and whether it made it. Unless keep is true, the ban is not
|
||||||
// ends, and zero for the others, whose end the ledger works out. Unless
|
// made, only returned: it is the ban that would have been made.
|
||||||
// keep is true, the ban is not made, only returned: it is the ban that
|
|
||||||
// would have been made.
|
|
||||||
func (l *Ledger) ban(
|
func (l *Ledger) ban(
|
||||||
netblock netip.Prefix,
|
netblock netip.Prefix,
|
||||||
now, expires time.Time,
|
now time.Time,
|
||||||
cause, reason string,
|
cause, reason string,
|
||||||
notes Notes,
|
notes Notes,
|
||||||
keep bool,
|
keep bool,
|
||||||
@@ -743,13 +676,10 @@ func (l *Ledger) ban(
|
|||||||
Notes: notes,
|
Notes: notes,
|
||||||
}
|
}
|
||||||
|
|
||||||
switch cause {
|
if cause == CauseAttack {
|
||||||
case CauseAttack:
|
|
||||||
ban.Expires = l.attackExpiry(held, now)
|
ban.Expires = l.attackExpiry(held, now)
|
||||||
case CauseLimit:
|
} else {
|
||||||
ban.Expires = l.limitExpiry(held, now)
|
ban.Expires = l.limitExpiry(held, now)
|
||||||
default: // CauseCrowdSec
|
|
||||||
ban.Expires = expires
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if !keep {
|
if !keep {
|
||||||
@@ -784,8 +714,6 @@ func earlierBans(held []Ban) EarlierBans {
|
|||||||
fromHere.Attack++
|
fromHere.Attack++
|
||||||
case CauseAdmin:
|
case CauseAdmin:
|
||||||
fromHere.Admin++
|
fromHere.Admin++
|
||||||
case CauseCrowdSec:
|
|
||||||
fromHere.CrowdSec++
|
|
||||||
}
|
}
|
||||||
|
|
||||||
notes := ban.Notes.EarlierBans
|
notes := ban.Notes.EarlierBans
|
||||||
@@ -793,7 +721,6 @@ func earlierBans(held []Ban) EarlierBans {
|
|||||||
Limit: notes.Limit + fromHere.Limit,
|
Limit: notes.Limit + fromHere.Limit,
|
||||||
Attack: notes.Attack + fromHere.Attack,
|
Attack: notes.Attack + fromHere.Attack,
|
||||||
Admin: notes.Admin + fromHere.Admin,
|
Admin: notes.Admin + fromHere.Admin,
|
||||||
CrowdSec: notes.CrowdSec + fromHere.CrowdSec,
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Of counts that name as many bans, the earlier ban's is taken: it
|
// Of counts that name as many bans, the earlier ban's is taken: it
|
||||||
@@ -808,7 +735,7 @@ func earlierBans(held []Ban) EarlierBans {
|
|||||||
|
|
||||||
// total returns how many bans e counts, of all causes.
|
// total returns how many bans e counts, of all causes.
|
||||||
func (e EarlierBans) total() int {
|
func (e EarlierBans) total() int {
|
||||||
return e.Limit + e.Attack + e.Admin + e.CrowdSec
|
return e.Limit + e.Attack + e.Admin
|
||||||
}
|
}
|
||||||
|
|
||||||
// markChanged has Changed receive a value, unless one is waiting already.
|
// markChanged has Changed receive a value, unless one is waiting already.
|
||||||
@@ -913,9 +840,9 @@ func (l *Ledger) add(ban Ban) {
|
|||||||
// limitExpiry returns when a ban for a broken limit made at now ends, or
|
// limitExpiry returns when a ban for a broken limit made at now ends, or
|
||||||
// zero when it is permanent. held are the netblock's bans, none of them
|
// zero when it is permanent. held are the netblock's bans, none of them
|
||||||
// active, of which the one that ended last, other than a ban for a clear
|
// active, of which the one that ended last, other than a ban for a clear
|
||||||
// sign of attack or for CrowdSec's decision, or a lifted one, can make the
|
// sign of attack or a lifted one, can make the new ban longer. A ban an
|
||||||
// new ban longer. A ban an admin adds to bans.json can start after
|
// admin adds to bans.json can start after another and end before it, so
|
||||||
// another and end before it, so that one is looked for among them all.
|
// that one is looked for among them all.
|
||||||
func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
|
func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
|
||||||
length := l.params.LimitBanDuration
|
length := l.params.LimitBanDuration
|
||||||
|
|
||||||
|
|||||||
@@ -1,136 +0,0 @@
|
|||||||
package bans_test
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/netip"
|
|
||||||
"reflect"
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
||||||
)
|
|
||||||
|
|
||||||
// scenario is the scenario of the tests' CrowdSec decisions.
|
|
||||||
const scenario = "crowdsecurity/ssh-bf"
|
|
||||||
|
|
||||||
func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
ledger := bans.New(defaultParams())
|
|
||||||
netblock := netip.MustParsePrefix("203.0.113.9/32")
|
|
||||||
expires := midnight().Add(4 * time.Hour)
|
|
||||||
|
|
||||||
// The ban that would be made is not made.
|
|
||||||
would, wouldBan := ledger.WouldBanForCrowdSec(
|
|
||||||
netblock,
|
|
||||||
midnight(),
|
|
||||||
expires,
|
|
||||||
scenario,
|
|
||||||
bans.Notes{},
|
|
||||||
)
|
|
||||||
if !wouldBan || len(ledger.Bans(netblock)) != 0 {
|
|
||||||
t.Errorf(
|
|
||||||
"would ban %t, and the ledger holds %+v, want true and nothing",
|
|
||||||
wouldBan,
|
|
||||||
ledger.Bans(netblock),
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
const reason = "CrowdSec's decision for " + scenario
|
|
||||||
|
|
||||||
ban, made := ledger.BanForCrowdSec(
|
|
||||||
netblock,
|
|
||||||
midnight(),
|
|
||||||
expires,
|
|
||||||
scenario,
|
|
||||||
bans.Notes{},
|
|
||||||
)
|
|
||||||
if !made || !reflect.DeepEqual(ban, would) ||
|
|
||||||
ban.Cause != bans.CauseCrowdSec ||
|
|
||||||
!ban.Expires.Equal(expires) ||
|
|
||||||
ban.Reason != reason ||
|
|
||||||
ledger.Made(bans.CauseCrowdSec) != 1 {
|
|
||||||
t.Errorf(
|
|
||||||
"made %t the ban %+v, want the one that would be made, %+v, for "+
|
|
||||||
"crowdsec until %s",
|
|
||||||
made,
|
|
||||||
ban,
|
|
||||||
would,
|
|
||||||
expires,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
// A second decision on the netblock while the ban lasts makes no other.
|
|
||||||
again, made := ledger.BanForCrowdSec(netblock, midnight().Add(time.Hour),
|
|
||||||
expires.Add(time.Hour), scenario, bans.Notes{})
|
|
||||||
if made || !again.Expires.Equal(expires) ||
|
|
||||||
ledger.Made(bans.CauseCrowdSec) != 1 {
|
|
||||||
t.Errorf(
|
|
||||||
"made %t the ban %+v while the first lasts, want none",
|
|
||||||
made,
|
|
||||||
again,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
ledger := bans.New(defaultParams())
|
|
||||||
netblock := netip.MustParsePrefix("203.0.113.9/32")
|
|
||||||
expires := midnight().Add(4 * time.Hour)
|
|
||||||
ledger.BanForCrowdSec(
|
|
||||||
netblock,
|
|
||||||
midnight(),
|
|
||||||
expires,
|
|
||||||
scenario,
|
|
||||||
bans.Notes{},
|
|
||||||
)
|
|
||||||
|
|
||||||
// A request as the ban ends is refused, and leaves it as it is.
|
|
||||||
last := expires.Add(-time.Nanosecond)
|
|
||||||
|
|
||||||
held, banned, madePermanent := ledger.Check(netblock.Addr(), last)
|
|
||||||
if !banned || madePermanent || !held.Expires.Equal(expires) ||
|
|
||||||
ledger.WouldBePermanent(netblock, last, bans.CauseCrowdSec) {
|
|
||||||
t.Errorf(
|
|
||||||
"as the ban ends, banned %t with %+v, made permanent %t, want "+
|
|
||||||
"refused under the ban as it was",
|
|
||||||
banned,
|
|
||||||
held,
|
|
||||||
madePermanent,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, banned, _ := ledger.Check(netblock.Addr(), expires); banned {
|
|
||||||
t.Error("the ban refuses a request once the decision has ended")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
ledger := bans.New(defaultParams())
|
|
||||||
netblock := netip.MustParsePrefix("203.0.113.9/32")
|
|
||||||
|
|
||||||
// Three times the three days would be permanent; a limit broken as the
|
|
||||||
// ban for CrowdSec's decision ends bans for an hour, as a first broken
|
|
||||||
// limit does.
|
|
||||||
crowdSec, _ := ledger.BanForCrowdSec(
|
|
||||||
netblock,
|
|
||||||
midnight(),
|
|
||||||
midnight().Add(3*day),
|
|
||||||
scenario,
|
|
||||||
bans.Notes{},
|
|
||||||
)
|
|
||||||
limit, _ := ledger.BanForLimit(netblock, crowdSec.Expires, bans.Notes{})
|
|
||||||
|
|
||||||
if limit.Expires.Sub(limit.Start) != time.Hour ||
|
|
||||||
limit.Notes.EarlierBans != (bans.EarlierBans{CrowdSec: 1}) {
|
|
||||||
t.Errorf(
|
|
||||||
"the ban for a limit is %+v, want one of an hour after one for crowdsec",
|
|
||||||
limit,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
+3
-79
@@ -157,13 +157,6 @@ type WAF struct {
|
|||||||
DNSBLAbuseIPDBLimitPercent int64
|
DNSBLAbuseIPDBLimitPercent int64
|
||||||
IPReputationCacheTTL time.Duration
|
IPReputationCacheTTL time.Duration
|
||||||
DNSBLAbuseIPDBTimeout time.Duration
|
DNSBLAbuseIPDBTimeout time.Duration
|
||||||
// CrowdSecDecisionsURL is where the decision list of the CrowdSec
|
|
||||||
// engine whose local API SWW_WAF_CROWDSEC_LAPI_URL names is fetched from:
|
|
||||||
// that URL with v1/decisions added to its path, "" while it is unset and
|
|
||||||
// none is. CrowdSecKey is the key the engine is asked with
|
|
||||||
// (SWW_WAF_CROWDSEC_LAPI_KEY).
|
|
||||||
CrowdSecDecisionsURL string
|
|
||||||
CrowdSecKey string
|
|
||||||
// BanResponse is the status a refused client is answered with, 403
|
// BanResponse is the status a refused client is answered with, 403
|
||||||
// or 429, or 0 to close the connection without an answer
|
// or 429, or 0 to close the connection without an answer
|
||||||
// (SWW_WAF_BAN_RESPONSE). It answers a banned client, a request that
|
// (SWW_WAF_BAN_RESPONSE). It answers a banned client, a request that
|
||||||
@@ -473,21 +466,12 @@ var (
|
|||||||
"is not an IP address with an optional port, " +
|
"is not an IP address with an optional port, " +
|
||||||
"such as 192.0.2.53 or [2001:db8::53]:5353",
|
"such as 192.0.2.53 or [2001:db8::53]:5353",
|
||||||
)
|
)
|
||||||
errNotLAPIURL = errors.New(
|
|
||||||
"is not an http or https URL without a user or a fragment, " +
|
|
||||||
"such as http://172.17.0.1:8080")
|
|
||||||
errNotRouteWatchURL = errors.New(
|
errNotRouteWatchURL = errors.New(
|
||||||
"is not an http or https URL without a user or a fragment, " +
|
"is not an http or https URL without a user or a fragment, " +
|
||||||
"such as https://routewatch.example")
|
"such as https://routewatch.example")
|
||||||
errNeedsLAPIKey = errors.New("the engine answers no request without it")
|
errFetchedOtherwise = errors.New(
|
||||||
errLAPIKeyUnused = errors.New(
|
|
||||||
"it is sent only to the engine at that URL",
|
|
||||||
)
|
|
||||||
errAnotherList = errors.New(
|
|
||||||
"is in SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too",
|
"is in SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too",
|
||||||
)
|
)
|
||||||
errFetchedOtherwise = errors.New("is in SWW_WAF_BLOCKLIST_URLS, is " +
|
|
||||||
"SWW_WAF_ASN_LIMIT_PERCENT_URL or is the CrowdSec decision list too")
|
|
||||||
errNotTagList = errors.New(
|
errNotTagList = errors.New(
|
||||||
"is not a name, = and an http or https URL, such as " +
|
"is not a name, = and an http or https URL, such as " +
|
||||||
"torexit=https://example.com/tor.txt")
|
"torexit=https://example.com/tor.txt")
|
||||||
@@ -502,8 +486,6 @@ var (
|
|||||||
errExploitTag = errors.New(
|
errExploitTag = errors.New(
|
||||||
"cannot lower limits: the rate limits count a request before its " +
|
"cannot lower limits: the rate limits count a request before its " +
|
||||||
"rules are matched")
|
"rules are matched")
|
||||||
errCrowdSecTag = errors.New(
|
|
||||||
"cannot be used: a CrowdSec decision refuses the request first")
|
|
||||||
errNoRequestGetsTag = errors.New(
|
errNoRequestGetsTag = errors.New(
|
||||||
"is a tag no request can get: it is not a name in SWW_WAF_TAG_LISTS, an " +
|
"is a tag no request can get: it is not a name in SWW_WAF_TAG_LISTS, an " +
|
||||||
"asn= or country= tag, a dnsbl= tag of a zone in SWW_WAF_DNSBL_ZONES, " +
|
"asn= or country= tag, a dnsbl= tag of a zone in SWW_WAF_DNSBL_ZONES, " +
|
||||||
@@ -605,10 +587,6 @@ func WAFFromEnvironment(v *viper.Viper) (*WAF, error) {
|
|||||||
"SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS",
|
"SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS",
|
||||||
"2000",
|
"2000",
|
||||||
),
|
),
|
||||||
CrowdSecDecisionsURL: env.crowdSecDecisionsURL(
|
|
||||||
"SWW_WAF_CROWDSEC_LAPI_URL",
|
|
||||||
),
|
|
||||||
CrowdSecKey: env.secret("SWW_WAF_CROWDSEC_LAPI_KEY"),
|
|
||||||
BanResponse: env.banResponse("SWW_WAF_BAN_RESPONSE", "403"),
|
BanResponse: env.banResponse("SWW_WAF_BAN_RESPONSE", "403"),
|
||||||
LimitBanDuration: env.durationNotOff(
|
LimitBanDuration: env.durationNotOff(
|
||||||
"SWW_WAF_LIMIT_BAN_DURATION",
|
"SWW_WAF_LIMIT_BAN_DURATION",
|
||||||
@@ -755,7 +733,6 @@ func WAFFromEnvironment(v *viper.Viper) (*WAF, error) {
|
|||||||
env.checkLookupDBPath(cfg)
|
env.checkLookupDBPath(cfg)
|
||||||
env.checkCountriesAndLookups(cfg)
|
env.checkCountriesAndLookups(cfg)
|
||||||
env.checkASNLimitPercentURL(cfg)
|
env.checkASNLimitPercentURL(cfg)
|
||||||
env.checkCrowdSec(cfg)
|
|
||||||
env.checkTagLists(cfg)
|
env.checkTagLists(cfg)
|
||||||
env.checkTags(cfg)
|
env.checkTags(cfg)
|
||||||
|
|
||||||
@@ -1061,26 +1038,6 @@ func (e *environment) resolver(name string) netip.AddrPort {
|
|||||||
return resolver
|
return resolver
|
||||||
}
|
}
|
||||||
|
|
||||||
// crowdSecDecisionsURL reads the setting that is the URL of the CrowdSec
|
|
||||||
// engine's local API, such as http://172.17.0.1:8080, and returns the URL
|
|
||||||
// its decision list is fetched from, that URL with v1/decisions added to
|
|
||||||
// its path, "" while it is unset or empty.
|
|
||||||
func (e *environment) crowdSecDecisionsURL(name string) string {
|
|
||||||
value := e.value(name, "")
|
|
||||||
if value == "" {
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
|
|
||||||
lapi, err := url.Parse(value)
|
|
||||||
if err != nil || !isHTTPURL(lapi) {
|
|
||||||
e.check(name, fmt.Errorf("%q %w", value, errNotLAPIURL))
|
|
||||||
|
|
||||||
return ""
|
|
||||||
}
|
|
||||||
|
|
||||||
return lapi.JoinPath("v1", "decisions").String()
|
|
||||||
}
|
|
||||||
|
|
||||||
// routeWatchURL reads the setting that is the URL of a routewatch instance,
|
// routeWatchURL reads the setting that is the URL of a routewatch instance,
|
||||||
// "" while it is unset or empty.
|
// "" while it is unset or empty.
|
||||||
func (e *environment) routeWatchURL(name string) string {
|
func (e *environment) routeWatchURL(name string) string {
|
||||||
@@ -1190,39 +1147,12 @@ func (e *environment) checkASNLimitPercentURL(cfg *WAF) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// checkCrowdSec refuses SWW_WAF_CROWDSEC_LAPI_URL without
|
|
||||||
// SWW_WAF_CROWDSEC_LAPI_KEY, the key without the URL, and a decision list
|
|
||||||
// that is fetched as another list too.
|
|
||||||
func (e *environment) checkCrowdSec(cfg *WAF) {
|
|
||||||
decisionsURL := cfg.CrowdSecDecisionsURL
|
|
||||||
|
|
||||||
switch {
|
|
||||||
case decisionsURL != "" && cfg.CrowdSecKey == "":
|
|
||||||
e.check("SWW_WAF_CROWDSEC_LAPI_URL", fmt.Errorf(
|
|
||||||
"is set while SWW_WAF_CROWDSEC_LAPI_KEY is unset; %w",
|
|
||||||
errNeedsLAPIKey,
|
|
||||||
))
|
|
||||||
case decisionsURL == "" && cfg.CrowdSecKey != "":
|
|
||||||
e.check("SWW_WAF_CROWDSEC_LAPI_KEY", fmt.Errorf(
|
|
||||||
"is set while SWW_WAF_CROWDSEC_LAPI_URL is unset; %w",
|
|
||||||
errLAPIKeyUnused,
|
|
||||||
))
|
|
||||||
case decisionsURL != "" && (slices.Contains(cfg.BlocklistURLs, decisionsURL) ||
|
|
||||||
decisionsURL == cfg.ASNLimitPercentURL):
|
|
||||||
e.check(
|
|
||||||
"SWW_WAF_CROWDSEC_LAPI_URL",
|
|
||||||
fmt.Errorf("gives the decision list %q, which %w",
|
|
||||||
decisionsURL, errAnotherList),
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// checkTagLists refuses a list of SWW_WAF_TAG_LISTS whose URL is fetched as
|
// checkTagLists refuses a list of SWW_WAF_TAG_LISTS whose URL is fetched as
|
||||||
// another list too: the file at a URL is read as one kind of list.
|
// another list too: the file at a URL is read as one kind of list.
|
||||||
func (e *environment) checkTagLists(cfg *WAF) {
|
func (e *environment) checkTagLists(cfg *WAF) {
|
||||||
for _, list := range cfg.TagLists {
|
for _, list := range cfg.TagLists {
|
||||||
if slices.Contains(cfg.BlocklistURLs, list.URL) ||
|
if slices.Contains(cfg.BlocklistURLs, list.URL) ||
|
||||||
list.URL == cfg.ASNLimitPercentURL || list.URL == cfg.CrowdSecDecisionsURL {
|
list.URL == cfg.ASNLimitPercentURL {
|
||||||
e.check(
|
e.check(
|
||||||
"SWW_WAF_TAG_LISTS",
|
"SWW_WAF_TAG_LISTS",
|
||||||
fmt.Errorf("%q %w", list.URL, errFetchedOtherwise),
|
fmt.Errorf("%q %w", list.URL, errFetchedOtherwise),
|
||||||
@@ -1232,8 +1162,7 @@ func (e *environment) checkTagLists(cfg *WAF) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// checkTags refuses a tag of SWW_WAF_TAG_DENY or SWW_WAF_TAG_LIMIT_PERCENT that would
|
// checkTags refuses a tag of SWW_WAF_TAG_DENY or SWW_WAF_TAG_LIMIT_PERCENT that would
|
||||||
// never apply: crowdsec, whose request is refused before tags are acted on, and
|
// never apply: any tag these settings cannot give a request.
|
||||||
// any tag these settings cannot give a request.
|
|
||||||
func (e *environment) checkTags(cfg *WAF) {
|
func (e *environment) checkTags(cfg *WAF) {
|
||||||
for _, tag := range cfg.TagDeny {
|
for _, tag := range cfg.TagDeny {
|
||||||
e.check("SWW_WAF_TAG_DENY", checkTag(cfg, tag))
|
e.check("SWW_WAF_TAG_DENY", checkTag(cfg, tag))
|
||||||
@@ -1246,10 +1175,6 @@ func (e *environment) checkTags(cfg *WAF) {
|
|||||||
|
|
||||||
// checkTag returns an error when tag would never apply, as checkTags says.
|
// checkTag returns an error when tag would never apply, as checkTags says.
|
||||||
func checkTag(cfg *WAF, tag string) error {
|
func checkTag(cfg *WAF, tag string) error {
|
||||||
if tag == CrowdSecTag {
|
|
||||||
return fmt.Errorf("%q %w", tag, errCrowdSecTag)
|
|
||||||
}
|
|
||||||
|
|
||||||
if !requestCanGetTag(cfg, tag) {
|
if !requestCanGetTag(cfg, tag) {
|
||||||
return fmt.Errorf("%q %w", MaskZoneKey(tag), errNoRequestGetsTag)
|
return fmt.Errorf("%q %w", MaskZoneKey(tag), errNoRequestGetsTag)
|
||||||
}
|
}
|
||||||
@@ -2010,7 +1935,6 @@ const (
|
|||||||
DNSBLTagPrefix = "dnsbl="
|
DNSBLTagPrefix = "dnsbl="
|
||||||
PrefixTagPrefix = "prefix="
|
PrefixTagPrefix = "prefix="
|
||||||
AbuseIPDBTag = "abuseipdb"
|
AbuseIPDBTag = "abuseipdb"
|
||||||
CrowdSecTag = "crowdsec"
|
|
||||||
// ExploitSignatureTag is the tag of a request a rule file or the Core
|
// ExploitSignatureTag is the tag of a request a rule file or the Core
|
||||||
// Rule Set matched.
|
// Rule Set matched.
|
||||||
ExploitSignatureTag = "exploitsignature"
|
ExploitSignatureTag = "exploitsignature"
|
||||||
|
|||||||
+4
-149
@@ -65,8 +65,6 @@ const (
|
|||||||
ipReputationCacheTTL = "SWW_WAF_IP_REPUTATION_CACHE_TTL"
|
ipReputationCacheTTL = "SWW_WAF_IP_REPUTATION_CACHE_TTL"
|
||||||
dnsblAbuseIPDBTimeout = "SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS"
|
dnsblAbuseIPDBTimeout = "SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS"
|
||||||
routeWatchURL = "SWW_WAF_ROUTEWATCH_URL"
|
routeWatchURL = "SWW_WAF_ROUTEWATCH_URL"
|
||||||
crowdSecURL = "SWW_WAF_CROWDSEC_LAPI_URL"
|
|
||||||
crowdSecKey = "SWW_WAF_CROWDSEC_LAPI_KEY"
|
|
||||||
banResponse = "SWW_WAF_BAN_RESPONSE"
|
banResponse = "SWW_WAF_BAN_RESPONSE"
|
||||||
limitBanDuration = "SWW_WAF_LIMIT_BAN_DURATION"
|
limitBanDuration = "SWW_WAF_LIMIT_BAN_DURATION"
|
||||||
limitBanRepeatWindow = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
|
limitBanRepeatWindow = "SWW_WAF_LIMIT_BAN_REPEAT_WINDOW"
|
||||||
@@ -1813,9 +1811,6 @@ func TestTagThatNoRequestCanGetIsToldApartFromOneItCan(t *testing.T) {
|
|||||||
"abuseipdb with a key",
|
"abuseipdb with a key",
|
||||||
environment{abuseIPDBKey: "k", tagLimitPercent: "abuseipdb:50"}, "",
|
environment{abuseIPDBKey: "k", tagLimitPercent: "abuseipdb:50"}, "",
|
||||||
},
|
},
|
||||||
{"crowdsec, though a list has its name", environment{
|
|
||||||
tagLists: "crowdsec=https://example.com/c.txt", tagDeny: "crowdsec",
|
|
||||||
}, `"crowdsec" cannot be used`},
|
|
||||||
{exploitTag, environment{tagDeny: exploitTag}, ""},
|
{exploitTag, environment{tagDeny: exploitTag}, ""},
|
||||||
{
|
{
|
||||||
exploitTag + " with rule files off",
|
exploitTag + " with rule files off",
|
||||||
@@ -1887,26 +1882,20 @@ func TestErrorOfATagSettingLeavesOutAZoneKey(t *testing.T) {
|
|||||||
func TestTagListURLFetchedAsAnotherListStopsTheStart(t *testing.T) {
|
func TestTagListURLFetchedAsAnotherListStopsTheStart(t *testing.T) {
|
||||||
t.Parallel()
|
t.Parallel()
|
||||||
|
|
||||||
const lapi = "http://172.17.0.1:8080"
|
|
||||||
|
|
||||||
for _, tc := range []struct {
|
for _, tc := range []struct {
|
||||||
name, listURL string
|
name, listURL string
|
||||||
env environment
|
env environment
|
||||||
}{
|
}{
|
||||||
{"a blocklist", dropURL, environment{blocklistURLs: dropURL}},
|
{"a blocklist", dropURL, environment{blocklistURLs: dropURL}},
|
||||||
{"the file of AS:percent lines", asnURL, environment{asnLimitPercentURL: asnURL}},
|
{"the file of AS:percent lines", asnURL, environment{asnLimitPercentURL: asnURL}},
|
||||||
{
|
|
||||||
"the CrowdSec decision list", lapi + "/v1/decisions",
|
|
||||||
environment{"SWW_WAF_CROWDSEC_LAPI_URL": lapi, "SWW_WAF_CROWDSEC_LAPI_KEY": "key"},
|
|
||||||
},
|
|
||||||
} {
|
} {
|
||||||
t.Run(tc.name, func(t *testing.T) {
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
t.Parallel()
|
t.Parallel()
|
||||||
|
|
||||||
tc.env[tagLists] = "dup=" + tc.listURL
|
tc.env[tagLists] = "dup=" + tc.listURL
|
||||||
|
|
||||||
want := tagLists + `: "` + tc.listURL + `" is in SWW_WAF_BLOCKLIST_URLS, is ` +
|
want := tagLists + `: "` + tc.listURL + `" is in SWW_WAF_BLOCKLIST_URLS ` +
|
||||||
"SWW_WAF_ASN_LIMIT_PERCENT_URL or is the CrowdSec decision list too"
|
"or is SWW_WAF_ASN_LIMIT_PERCENT_URL too"
|
||||||
|
|
||||||
_, err := config.WAFFromEnvironment(tc.env.viper())
|
_, err := config.WAFFromEnvironment(tc.env.viper())
|
||||||
if err == nil || err.Error() != want {
|
if err == nil || err.Error() != want {
|
||||||
@@ -2456,138 +2445,6 @@ func TestAbuseIPDBKeyIsLoggedMasked(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestCrowdSecSettingsGiveTheDecisionListAndTheKey(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
cfg := wafFromEnvironment(t, environment{})
|
|
||||||
if cfg.CrowdSecDecisionsURL != "" || cfg.CrowdSecKey != "" {
|
|
||||||
t.Errorf(
|
|
||||||
"by default, the decision list %q and the key %q, want neither",
|
|
||||||
cfg.CrowdSecDecisionsURL,
|
|
||||||
cfg.CrowdSecKey,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
for lapi, want := range map[string]string{
|
|
||||||
"http://172.17.0.1:8080": "http://172.17.0.1:8080/v1/decisions",
|
|
||||||
"http://172.17.0.1:8080/": "http://172.17.0.1:8080/v1/decisions",
|
|
||||||
"https://crowdsec.example/lapi/": "https://crowdsec.example/lapi/v1/decisions",
|
|
||||||
"https://crowdsec.example:8443/x": "https://crowdsec.example:8443/x/v1/decisions",
|
|
||||||
} {
|
|
||||||
cfg := wafFromEnvironment(
|
|
||||||
t,
|
|
||||||
environment{crowdSecURL: lapi, crowdSecKey: token},
|
|
||||||
)
|
|
||||||
if cfg.CrowdSecDecisionsURL != want || cfg.CrowdSecKey != token {
|
|
||||||
t.Errorf(
|
|
||||||
"%s=%s gave the decision list %q and the key %q, want %s and %s",
|
|
||||||
crowdSecURL,
|
|
||||||
lapi,
|
|
||||||
cfg.CrowdSecDecisionsURL,
|
|
||||||
cfg.CrowdSecKey,
|
|
||||||
want,
|
|
||||||
token,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestInvalidCrowdSecSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
const (
|
|
||||||
lapi = "http://172.17.0.1:8080"
|
|
||||||
notLAPIURL = " is not an http or https URL without a user or a fragment, " +
|
|
||||||
"such as http://172.17.0.1:8080"
|
|
||||||
anotherList = `gives the decision list "` + lapi + `/v1/decisions", which is in ` +
|
|
||||||
`SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too`
|
|
||||||
)
|
|
||||||
|
|
||||||
for _, tc := range []struct {
|
|
||||||
name string
|
|
||||||
env environment
|
|
||||||
want string
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
"a URL that is not http",
|
|
||||||
environment{crowdSecURL: "ftp://172.17.0.1", crowdSecKey: token},
|
|
||||||
crowdSecURL + `: "ftp://172.17.0.1"` + notLAPIURL,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"a URL with a user",
|
|
||||||
environment{crowdSecURL: "http://bouncer@172.17.0.1:8080", crowdSecKey: token},
|
|
||||||
crowdSecURL + `: "http://bouncer@172.17.0.1:8080"` + notLAPIURL,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"the URL without the key",
|
|
||||||
environment{crowdSecURL: lapi},
|
|
||||||
crowdSecURL + ": is set while " + crowdSecKey + " is unset; the engine " +
|
|
||||||
"answers no request without it",
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"the key without the URL",
|
|
||||||
environment{crowdSecKey: token},
|
|
||||||
crowdSecKey + ": is set while " + crowdSecURL + " is unset; it is sent only " +
|
|
||||||
"to the engine at that URL",
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"the decision list as a blocklist too",
|
|
||||||
environment{
|
|
||||||
crowdSecURL: lapi, crowdSecKey: token,
|
|
||||||
blocklistURLs: "https://lists.example/drop.txt," + lapi + "/v1/decisions",
|
|
||||||
},
|
|
||||||
crowdSecURL + ": " + anotherList,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"the decision list as the file of AS:percent lines too",
|
|
||||||
environment{
|
|
||||||
crowdSecURL: lapi + "/", crowdSecKey: token,
|
|
||||||
asnLimitPercentURL: lapi + "/v1/decisions",
|
|
||||||
},
|
|
||||||
crowdSecURL + ": " + anotherList,
|
|
||||||
},
|
|
||||||
// The key itself is never shown.
|
|
||||||
{
|
|
||||||
"a key with a control character",
|
|
||||||
environment{crowdSecURL: lapi, crowdSecKey: token + "\r"},
|
|
||||||
crowdSecKey + ": holds a control character, such as the carriage return " +
|
|
||||||
"of a Windows line end",
|
|
||||||
},
|
|
||||||
} {
|
|
||||||
t.Run(tc.name, func(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
_, err := config.WAFFromEnvironment(tc.env.viper())
|
|
||||||
if err == nil || err.Error() != tc.want {
|
|
||||||
t.Errorf("error %v, want %s", err, tc.want)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecKeyIsLoggedMasked(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
cfg := wafFromEnvironment(t, environment{
|
|
||||||
crowdSecURL: "http://172.17.0.1:8080", crowdSecKey: token,
|
|
||||||
})
|
|
||||||
|
|
||||||
var out bytes.Buffer
|
|
||||||
|
|
||||||
slog.New(slog.NewJSONHandler(&out, nil)).
|
|
||||||
Info("starting", "settings", cfg)
|
|
||||||
|
|
||||||
logged := out.String()
|
|
||||||
if strings.Contains(logged, token) ||
|
|
||||||
!strings.Contains(logged, `"`+crowdSecKey+`":"********"`) ||
|
|
||||||
!strings.Contains(
|
|
||||||
logged,
|
|
||||||
`"`+crowdSecURL+`":"http://172.17.0.1:8080"`,
|
|
||||||
) {
|
|
||||||
t.Errorf("the key is not logged masked beside the URL: %s", logged)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestSizesAndOff(t *testing.T) {
|
func TestSizesAndOff(t *testing.T) {
|
||||||
t.Parallel()
|
t.Parallel()
|
||||||
|
|
||||||
@@ -2714,10 +2571,10 @@ func TestInvalidLookupTagOrLogValueStopsTheStart(t *testing.T) {
|
|||||||
{tagDeny, "a,,b"}, {tagDeny, "country=nk"}, {tagDeny, "asn=abc"},
|
{tagDeny, "a,,b"}, {tagDeny, "country=nk"}, {tagDeny, "asn=abc"},
|
||||||
{tagDeny, "asn="},
|
{tagDeny, "asn="},
|
||||||
{tagDeny, "torexit,TOREXIT"}, {tagDeny, "torexti"},
|
{tagDeny, "torexit,TOREXIT"}, {tagDeny, "torexti"},
|
||||||
{tagDeny, zenTag}, {tagDeny, "abuseipdb"}, {tagDeny, "crowdsec"},
|
{tagDeny, zenTag}, {tagDeny, "abuseipdb"},
|
||||||
{tagLimitPercent, "torexti:50"},
|
{tagLimitPercent, "torexti:50"},
|
||||||
{tagLimitPercent, "dnsbl=zen.example:50"},
|
{tagLimitPercent, "dnsbl=zen.example:50"},
|
||||||
{tagLimitPercent, "abuseipdb:50"}, {tagLimitPercent, "crowdsec:50"},
|
{tagLimitPercent, "abuseipdb:50"},
|
||||||
{tagLimitPercent, "vpn :50"},
|
{tagLimitPercent, "vpn :50"},
|
||||||
{tagLimitPercent, "vpn"}, {tagLimitPercent, ":50"},
|
{tagLimitPercent, "vpn"}, {tagLimitPercent, ":50"},
|
||||||
{tagLimitPercent, "vpn:"},
|
{tagLimitPercent, "vpn:"},
|
||||||
@@ -3091,8 +2948,6 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
|
|||||||
ipReputationCacheTTL: defaultIPReputationCacheTTL,
|
ipReputationCacheTTL: defaultIPReputationCacheTTL,
|
||||||
dnsblAbuseIPDBTimeout: "2000",
|
dnsblAbuseIPDBTimeout: "2000",
|
||||||
routeWatchURL: "",
|
routeWatchURL: "",
|
||||||
crowdSecURL: "",
|
|
||||||
crowdSecKey: "",
|
|
||||||
banResponse: "403",
|
banResponse: "403",
|
||||||
limitBanDuration: "1h",
|
limitBanDuration: "1h",
|
||||||
limitBanRepeatWindow: "24h",
|
limitBanRepeatWindow: "24h",
|
||||||
|
|||||||
@@ -172,11 +172,13 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/repos|user/search_candidates|\
|
|||||||
|
|
||||||
# A branch, tag or package name can hold a slash, as feat/docker-support and
|
# A branch, tag or package name can hold a slash, as feat/docker-support and
|
||||||
# npm's @scope/name do. So q on a repository's branches, tags and packages
|
# npm's @scope/name do. So q on a repository's branches, tags and packages
|
||||||
# pages, on an owner's packages page, on the admin page of packages and on the
|
# pages, on an owner's packages page, on the admin page of packages, on the
|
||||||
# API's search of packages also skips this rule:
|
# API's search of packages and on the Composer and Conan registries' searches
|
||||||
|
# also skips this rule:
|
||||||
# 932160: /bin/sh
|
# 932160: /bin/sh
|
||||||
SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
|
SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
|
||||||
admin/packages|api/v1/packages/[^/]+)$" \
|
admin/packages|api/v1/packages/[^/]+|\
|
||||||
|
api/packages/[^/]+/(?:composer/search\.json|conan/v[12]/conans/search))$" \
|
||||||
"id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
|
"id:900605,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932160;ARGS:q"
|
||||||
|
|
||||||
# gitea's other searches send a name or a few words in q too, which skips only
|
# gitea's other searches send a name or a few words in q too, which skips only
|
||||||
@@ -191,6 +193,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:[^/]+/[^/]+/(?:branches|tags|packages)|\
|
|||||||
# - the lists of users and organisations;
|
# - the lists of users and organisations;
|
||||||
# - the API's searches of users, of topics, of an organisation's teams and of
|
# - the API's searches of users, of topics, of an organisation's teams and of
|
||||||
# emails;
|
# emails;
|
||||||
|
# - the searches of the Cargo, Chef, Composer and Conan registries, and the
|
||||||
|
# NuGet registry's search service;
|
||||||
# - the list of repositories a user watches;
|
# - the list of repositories a user watches;
|
||||||
# - an organisation's milestones of one team, and its search for teams;
|
# - an organisation's milestones of one team, and its search for teams;
|
||||||
# - the milestones of a repository or an organisation, and the projects of a
|
# - the milestones of a repository or an organisation, and the projects of a
|
||||||
@@ -210,6 +214,8 @@ SecRule REQUEST_FILENAME "@rx ^/(?:repo/search|notifications/watching|\
|
|||||||
explore/(?:users|organizations)|\
|
explore/(?:users|organizations)|\
|
||||||
api/v1/(?:users/search|topics/search|orgs/[^/]+/teams/search|\
|
api/v1/(?:users/search|topics/search|orgs/[^/]+/teams/search|\
|
||||||
admin/emails/search)|\
|
admin/emails/search)|\
|
||||||
|
api/packages/[^/]+/(?:cargo/api/v1/crates|chef/api/v1/(?:search|cookbooks)|\
|
||||||
|
composer/search\.json|conan/v[12]/conans/search|nuget/query)|\
|
||||||
org/[^/]+/(?:milestones/[^/]+|teams/-/search)|\
|
org/[^/]+/(?:milestones/[^/]+|teams/-/search)|\
|
||||||
[^/]+/-/packages/[^/]+/.+/versions|\
|
[^/]+/-/packages/[^/]+/.+/versions|\
|
||||||
[^/]+/[^/]+/(?:(?:issues|pulls)/posters|issues/suggestions|milestones|\
|
[^/]+/[^/]+/(?:(?:issues|pulls)/posters|issues/suggestions|milestones|\
|
||||||
@@ -246,6 +252,76 @@ SecRule REQUEST_FILENAME "@rx ^/api/v1/repos/[^/]+/[^/]+/milestones$" \
|
|||||||
ctl:ruleRemoveTargetById=932250;ARGS:name,\
|
ctl:ruleRemoveTargetById=932250;ARGS:name,\
|
||||||
ctl:ruleRemoveTargetById=932260;ARGS:name"
|
ctl:ruleRemoveTargetById=932260;ARGS:name"
|
||||||
|
|
||||||
|
# The npm registry's search sends its words in text, which skips these rules
|
||||||
|
# there:
|
||||||
|
# 930120: .htaccess
|
||||||
|
# 932120: powershell
|
||||||
|
# 932160: /bin/sh, as an npm name such as @alice/tools-cli holds a slash
|
||||||
|
# 932250: ls -la
|
||||||
|
# 932260: python3
|
||||||
|
SecRule REQUEST_FILENAME "@rx ^/api/packages/[^/]+/npm/-/v1/search$" \
|
||||||
|
"id:900609,phase:1,pass,nolog,\
|
||||||
|
ctl:ruleRemoveTargetById=930120;ARGS:text,\
|
||||||
|
ctl:ruleRemoveTargetById=932120;ARGS:text,\
|
||||||
|
ctl:ruleRemoveTargetById=932160;ARGS:text,\
|
||||||
|
ctl:ruleRemoveTargetById=932250;ARGS:text,\
|
||||||
|
ctl:ruleRemoveTargetById=932260;ARGS:text"
|
||||||
|
|
||||||
|
# A Conan search takes a pattern such as zlib/*, which the rule for SQL
|
||||||
|
# injection (942100) refused in q. q skips that rule only when the request has
|
||||||
|
# one q, in the query string or the body, with the shape of a Conan reference.
|
||||||
|
# A reference is a name, then optionally / and a version, then optionally @
|
||||||
|
# and a user, then optionally / and a channel. Each part is made of letters,
|
||||||
|
# digits, _, ., - and *. A part holds no +, since 942100 reads + as a space.
|
||||||
|
# q must also hold no */, which ends an SQL comment, and no --, which starts
|
||||||
|
# one. Last, 942100 must find no SQL injection in q once each comment that /*
|
||||||
|
# starts, an unclosed one included, is replaced by a space. So zlib/* passes,
|
||||||
|
# and SQL injection such as these stays refused:
|
||||||
|
# 1' OR '1'='1
|
||||||
|
# 1/**/or/**/1
|
||||||
|
# 1/*@*/or-1
|
||||||
|
# 1+or+1--
|
||||||
|
# 1-or-1--
|
||||||
|
# x/1.or.1
|
||||||
|
# 1.having.1
|
||||||
|
# This rule is in phase 2, because a phase 1 rule runs before the body is read
|
||||||
|
# and cannot see a q there. It checks tx.app_gitea, since the skip above does
|
||||||
|
# not reach phase 2.
|
||||||
|
SecRule REQUEST_FILENAME "@rx ^/api/packages/[^/]+/conan/v[12]/conans/search$" \
|
||||||
|
"id:900611,phase:2,pass,nolog,chain"
|
||||||
|
SecRule &TX:app_gitea "@eq 1" "chain"
|
||||||
|
SecRule &ARGS:q "@eq 1" "chain"
|
||||||
|
SecRule ARGS:q "!@contains */" "chain"
|
||||||
|
SecRule ARGS:q "!@contains --" "chain"
|
||||||
|
SecRule ARGS:q "!@detectSQLi" "t:none,t:replaceComments,chain"
|
||||||
|
SecRule ARGS:q "@rx ^[\w.*-]+(?:/[\w.*-]+)?(?:@[\w.*-]+(?:/[\w.*-]+)?)?$" \
|
||||||
|
"ctl:ruleRemoveTargetById=942100;ARGS:q"
|
||||||
|
|
||||||
|
# The NuGet v2 API's searches, Search() and Packages(), send their words in
|
||||||
|
# searchTerm, or in $filter as an expression such as
|
||||||
|
# tolower(Id) eq 'python3'. Search()/$count and Packages()/$count count a
|
||||||
|
# search's results and read the same fields. searchTerm skips these rules:
|
||||||
|
# 930120: .htaccess
|
||||||
|
# 932120: powershell
|
||||||
|
# 932250: ls -la
|
||||||
|
# 932260: python3
|
||||||
|
# $filter skips these:
|
||||||
|
# 930120: .htaccess
|
||||||
|
# 932120: powershell
|
||||||
|
# The names $filter, $orderby and $top skip the rule for MongoDB operators
|
||||||
|
# (942290), which refused every such search.
|
||||||
|
SecRule REQUEST_FILENAME "@rx ^/api/packages/[^/]+/nuget/(?:Search|Packages)\(\)(?:/\$count)?$" \
|
||||||
|
"id:900612,phase:1,pass,nolog,\
|
||||||
|
ctl:ruleRemoveTargetById=930120;ARGS:searchTerm,\
|
||||||
|
ctl:ruleRemoveTargetById=932120;ARGS:searchTerm,\
|
||||||
|
ctl:ruleRemoveTargetById=932250;ARGS:searchTerm,\
|
||||||
|
ctl:ruleRemoveTargetById=932260;ARGS:searchTerm,\
|
||||||
|
ctl:ruleRemoveTargetById=930120;ARGS:$filter,\
|
||||||
|
ctl:ruleRemoveTargetById=932120;ARGS:$filter,\
|
||||||
|
ctl:ruleRemoveTargetById=942290;ARGS_NAMES:$filter,\
|
||||||
|
ctl:ruleRemoveTargetById=942290;ARGS_NAMES:$orderby,\
|
||||||
|
ctl:ruleRemoveTargetById=942290;ARGS_NAMES:$top"
|
||||||
|
|
||||||
# The repositories on a user's or an organisation's page are searched with q
|
# The repositories on a user's or an organisation's page are searched with q
|
||||||
# too. Their path has one segment, so q skips these rules on every path of one
|
# too. Their path has one segment, so q skips these rules on every path of one
|
||||||
# segment, other apps' pages such as /index.php included:
|
# segment, other apps' pages such as /index.php included:
|
||||||
|
|||||||
@@ -271,15 +271,28 @@ const giteaAPIPackageSearch = "/api/v1/packages/alice?q="
|
|||||||
func TestGiteaAttacksAreRefusedInItsAPISearches(t *testing.T) {
|
func TestGiteaAttacksAreRefusedInItsAPISearches(t *testing.T) {
|
||||||
t.Parallel()
|
t.Parallel()
|
||||||
|
|
||||||
const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
|
checkSearchesRefuseAttacks(
|
||||||
|
t,
|
||||||
defaults, bodies := atDefaults(t), readingBodies(t)
|
|
||||||
searches := slices.Concat(
|
|
||||||
giteaAPISearches,
|
giteaAPISearches,
|
||||||
[]string{giteaAPIPackageSearch},
|
[]string{giteaAPIPackageSearch},
|
||||||
)
|
)
|
||||||
|
}
|
||||||
|
|
||||||
for _, search := range searches {
|
// checkSearchesRefuseAttacks checks that SQL injection, a path traversal,
|
||||||
|
// script injection and a shell command stay refused in the field of each
|
||||||
|
// search, in the query string and in a form data body. Each search ends in
|
||||||
|
// its field. /bin/sh stays refused too in the field of each of
|
||||||
|
// refusingBinSh, but not of lettingBinSh.
|
||||||
|
func checkSearchesRefuseAttacks(
|
||||||
|
t *testing.T, refusingBinSh, lettingBinSh []string,
|
||||||
|
) {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
|
||||||
|
|
||||||
|
defaults, bodies := atDefaults(t), readingBodies(t)
|
||||||
|
|
||||||
|
for _, search := range slices.Concat(refusingBinSh, lettingBinSh) {
|
||||||
path, field, _ := strings.Cut(search, "?")
|
path, field, _ := strings.Cut(search, "?")
|
||||||
|
|
||||||
for _, attack := range []string{
|
for _, attack := range []string{
|
||||||
@@ -303,8 +316,7 @@ func TestGiteaAttacksAreRefusedInItsAPISearches(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// /bin/sh stays refused on the searches that are not of packages.
|
for _, search := range refusingBinSh {
|
||||||
for _, search := range giteaAPISearches {
|
|
||||||
if got := inspect(t, defaults, get(search+binSh)); got.Score < threshold {
|
if got := inspect(t, defaults, get(search+binSh)); got.Score < threshold {
|
||||||
t.Errorf("%s%s let through: %+v", search, binSh, got)
|
t.Errorf("%s%s let through: %+v", search, binSh, got)
|
||||||
}
|
}
|
||||||
@@ -314,14 +326,9 @@ func TestGiteaAttacksAreRefusedInItsAPISearches(t *testing.T) {
|
|||||||
func TestGiteaAPISearchExclusionsAreNarrow(t *testing.T) {
|
func TestGiteaAPISearchExclusionsAreNarrow(t *testing.T) {
|
||||||
t.Parallel()
|
t.Parallel()
|
||||||
|
|
||||||
const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
|
// Each search's field on paths near the searches, and another field on
|
||||||
|
// them.
|
||||||
crs := atDefaults(t)
|
checkValuesStayRefused(t, []string{
|
||||||
|
|
||||||
// /bin/sh, a shell command after a ";", a path traversal and the hard
|
|
||||||
// values stay refused in each search's field on paths near the
|
|
||||||
// searches, and in another field on them.
|
|
||||||
for _, target := range []string{
|
|
||||||
"/api/v1/topics/search/x?q=",
|
"/api/v1/topics/search/x?q=",
|
||||||
"/api/v1/orgs/acme/teams?q=",
|
"/api/v1/orgs/acme/teams?q=",
|
||||||
"/api/v1/orgs/acme/teams/search/x?q=",
|
"/api/v1/orgs/acme/teams/search/x?q=",
|
||||||
@@ -337,7 +344,19 @@ func TestGiteaAPISearchExclusionsAreNarrow(t *testing.T) {
|
|||||||
"/api/v1/admin/unadopted?q=",
|
"/api/v1/admin/unadopted?q=",
|
||||||
"/api/v1/repos/alice/tools/milestones?q=",
|
"/api/v1/repos/alice/tools/milestones?q=",
|
||||||
"/api/v1/packages/alice?other=",
|
"/api/v1/packages/alice?other=",
|
||||||
} {
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// checkValuesStayRefused checks that /bin/sh, a shell command after a ";", a
|
||||||
|
// path traversal and the hard values stay refused at the end of each target.
|
||||||
|
func checkValuesStayRefused(t *testing.T, targets []string) {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
|
||||||
|
|
||||||
|
crs := atDefaults(t)
|
||||||
|
|
||||||
|
for _, target := range targets {
|
||||||
for _, value := range slices.Concat(
|
for _, value := range slices.Concat(
|
||||||
[]string{binSh, commandInjection, pathTraversal},
|
[]string{binSh, commandInjection, pathTraversal},
|
||||||
hardValues,
|
hardValues,
|
||||||
@@ -348,3 +367,135 @@ func TestGiteaAPISearchExclusionsAreNarrow(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// giteaRegistrySearches are the package registries' searches whose field
|
||||||
|
// skips the lists of system files and command names. Each ends in the field
|
||||||
|
// it sends its words in.
|
||||||
|
//
|
||||||
|
//nolint:gochecknoglobals // a constant cannot be a list
|
||||||
|
var giteaRegistrySearches = []string{
|
||||||
|
"/api/packages/alice/cargo/api/v1/crates?q=",
|
||||||
|
"/api/packages/alice/chef/api/v1/search?q=",
|
||||||
|
"/api/packages/alice/chef/api/v1/cookbooks?q=",
|
||||||
|
"/api/packages/alice/nuget/query?q=",
|
||||||
|
"/api/packages/alice/nuget/Search()?searchTerm=",
|
||||||
|
"/api/packages/alice/nuget/Packages()?$filter=",
|
||||||
|
"/api/packages/alice/nuget/Search()/$count?searchTerm=",
|
||||||
|
"/api/packages/alice/nuget/Packages()/$count?$filter=",
|
||||||
|
}
|
||||||
|
|
||||||
|
// giteaRegistrySearchesLettingBinSh are the package registries' searches
|
||||||
|
// whose field also lets /bin/sh through, since a Composer, Conan or npm name
|
||||||
|
// can hold a slash.
|
||||||
|
//
|
||||||
|
//nolint:gochecknoglobals // a constant cannot be a list
|
||||||
|
var giteaRegistrySearchesLettingBinSh = []string{
|
||||||
|
"/api/packages/alice/composer/search.json?q=",
|
||||||
|
"/api/packages/alice/conan/v1/conans/search?q=",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=",
|
||||||
|
"/api/packages/alice/npm/-/v1/search?text=",
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGiteaAttacksAreRefusedInItsRegistrySearches(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
checkSearchesRefuseAttacks(
|
||||||
|
t,
|
||||||
|
giteaRegistrySearches,
|
||||||
|
giteaRegistrySearchesLettingBinSh,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGiteaRegistrySearchExclusionsAreNarrow(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
// Each search's field on paths near the searches, and another field on
|
||||||
|
// them.
|
||||||
|
checkValuesStayRefused(t, []string{
|
||||||
|
"/api/packages/alice/cargo/api/v1/crates/tools-cli?q=",
|
||||||
|
"/api/packages/alice/chef/api/v1/cookbooks/tools?q=",
|
||||||
|
"/api/packages/alice/composer/packages.json?q=",
|
||||||
|
"/api/packages/alice/conan/v1/conans/tools/1.0/alice/stable/search?q=",
|
||||||
|
"/api/packages/alice/nuget/query/x?q=",
|
||||||
|
"/api/packages/alice/nuget/FindPackagesById()?id=",
|
||||||
|
"/api/packages/alice/nuget/FindPackagesById()/$count?id=",
|
||||||
|
"/api/packages/alice/nuget/Search()/$count/x?searchTerm=",
|
||||||
|
"/api/packages/alice/npm/tools-cli?text=",
|
||||||
|
"/api/packages/alice/cargo/api/v1/crates?other=",
|
||||||
|
"/api/packages/alice/chef/api/v1/search?other=",
|
||||||
|
"/api/packages/alice/composer/search.json?type=",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?other=",
|
||||||
|
"/api/packages/alice/nuget/query?other=",
|
||||||
|
"/api/packages/alice/nuget/Search()?targetFramework=",
|
||||||
|
"/api/packages/alice/nuget/Packages()?$orderby=",
|
||||||
|
"/api/packages/alice/nuget/Search()/$count?targetFramework=",
|
||||||
|
"/api/packages/alice/nuget/Packages()/$count?$orderby=",
|
||||||
|
"/api/packages/alice/npm/-/v1/search?q=",
|
||||||
|
})
|
||||||
|
|
||||||
|
const threshold = 5 // SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD's default
|
||||||
|
|
||||||
|
crs := atDefaults(t)
|
||||||
|
|
||||||
|
// The rule for MongoDB operators (942290) still refuses the name of
|
||||||
|
// another operator on NuGet's searches, and $filter on NuGet's other
|
||||||
|
// paths. The rule for SQL injection (942100) still refuses tools/* in a
|
||||||
|
// field other than a Conan search's, SQL injection in a second q after a
|
||||||
|
// Conan pattern, SQL comments or dots that stand in for spaces, and SQL
|
||||||
|
// injection holding + or --.
|
||||||
|
for _, target := range []string{
|
||||||
|
"/api/packages/alice/nuget/Search()?$where=1",
|
||||||
|
"/api/packages/alice/nuget/Packages()?$ne=1",
|
||||||
|
"/api/packages/alice/nuget/Search()/$count?$where=1",
|
||||||
|
"/api/packages/alice/nuget/FindPackagesById()?$filter=IsLatestVersion",
|
||||||
|
"/api/packages/alice/nuget/FindPackagesById()/$count?$filter=IsLatestVersion",
|
||||||
|
"/api/packages/alice/composer/search.json?q=tools%2F%2A",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?other=tools%2F%2A",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=tools%2F%2A&q=" +
|
||||||
|
sqlInjection,
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=1%2F%2A%2A%2For%2F%2A%2A%2F1",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=1%2F%2A%40%2A%2For-1",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=1%2Bor%2B1--",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=1-or-1--",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=x%2F1.or.1",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=x%2F1.and.1",
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=1.having.1",
|
||||||
|
} {
|
||||||
|
if got := inspect(t, crs, get(target)); got.Score < threshold {
|
||||||
|
t.Errorf("%s let through: %+v", target, got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// SQL injection in a q in the body is refused, even after a Conan
|
||||||
|
// pattern in the query string.
|
||||||
|
search := request{
|
||||||
|
http.MethodPost,
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=zlib",
|
||||||
|
[]string{formData},
|
||||||
|
}
|
||||||
|
|
||||||
|
body := "q=" + sqlInjection
|
||||||
|
if got, _ := inspectBody(t, readingBodies(t), search, body); got.Score < threshold {
|
||||||
|
t.Errorf("POST %s %s let through: %+v", search.target, body, got)
|
||||||
|
}
|
||||||
|
|
||||||
|
// So is SQL injection with dots for spaces, in a q sent only in the body.
|
||||||
|
search.target = "/api/packages/alice/conan/v2/conans/search"
|
||||||
|
|
||||||
|
body = "q=x%2F1.or.1"
|
||||||
|
if got, _ := inspectBody(t, readingBodies(t), search, body); got.Score < threshold {
|
||||||
|
t.Errorf("POST %s %s let through: %+v", search.target, body, got)
|
||||||
|
}
|
||||||
|
|
||||||
|
// The rule that lets a Conan pattern through is in phase 2, where it
|
||||||
|
// checks tx.app_gitea itself: a hostname that does not serve gitea
|
||||||
|
// refuses the pattern.
|
||||||
|
pattern := get(
|
||||||
|
"/api/packages/alice/conan/v2/conans/search?q=tools%2F%2A",
|
||||||
|
)
|
||||||
|
apps := servingApps(t, map[string][]string{
|
||||||
|
giteaHost: {gitea}, otherHost: {wordpress},
|
||||||
|
})
|
||||||
|
wantResult(t, apps, withHost(pattern, giteaHost), coreruleset.Result{})
|
||||||
|
wantResult(t, apps, withHost(pattern, otherHost), matched(942100))
|
||||||
|
}
|
||||||
+100
@@ -1034,3 +1034,103 @@
|
|||||||
{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
|
{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=ls%20-la", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
|
||||||
{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
|
{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=.htaccess", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
|
||||||
{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=v1.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
|
{"method": "GET", "target": "/api/v1/repos/alice/tools/milestones?state=open&name=v1.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*", "Authorization: token 772deb2aefef4c9484e8c673197b82bc880fc7ca"], "body": ""}
|
||||||
|
# The package registries' searches, sent to Forgejo 17.0.1 by each registry's
|
||||||
|
# own client: npm, composer, conan 2 and 1, cargo, dotnet and knife. curl sent
|
||||||
|
# the requests no client sends: the Chef cookbook list with a search, and
|
||||||
|
# NuGet's Packages() with the search in $filter, as NuGet's client builds it for
|
||||||
|
# a feed without Search(). curl also sent each NuGet Search() and Packages()
|
||||||
|
# search to Search()/$count and Packages()/$count, which count its results. Each
|
||||||
|
# searches for words that name commands and files, such as python3 and
|
||||||
|
# .htaccess, and for plain words. A Composer, Conan or npm name can hold a
|
||||||
|
# slash, so those searches are also sent /bin/sh.
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=python3&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=powershell&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=ls+-la&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=.htaccess&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=%2Fbin%2Fsh&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=%40alice%2Ftools-cli&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=docker-compose.yml&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/npm/-/v1/search?text=tools&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5", "headers": ["user-agent: npm/10.9.9 node/v22.23.5 linux x64 workspaces/false", "npm-auth-type: web", "npm-command: search", "Accept: */*", "Accept-Encoding: gzip,deflate", "Host: example.com", "connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=python3&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=powershell&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=ls+-la&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=.htaccess&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=%2Fbin%2Fsh&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=alice%2Ftools-cli&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=docker-compose.yml&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/composer/search.json?q=tools&type=", "headers": ["Host: example.com", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "User-Agent: Composer/2.11.2 (Linux; 6.8.0-111-generic; PHP 8.5.12; cURL 8.23.0; cmd:search)", "Connection: keep-alive"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=python3", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=powershell", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=ls+-la", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=tools%2F%2A", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=tools%2F1.0%40alice%2Fstable", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v2/conans/search?q=tools", "headers": ["Host: example.com", "User-Agent: Conan/2.34.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=python3", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=powershell", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=ls+-la", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=.htaccess", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=%2Fbin%2Fsh", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=tools%2F%2A", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=docker-compose.yml", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/conan/v1/conans/search?q=tools", "headers": ["Host: example.com", "User-Agent: Conan/1.66.0 (Linux 6.8.0-111-generic; Python 3.13.18; x86_64)", "Accept-Encoding: gzip, deflate", "Accept: */*", "Connection: keep-alive", "X-Client-Anonymous-Id: afce410baeaee94a86997417d92f7788a91b00c5", "X-Client-Id: "], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=python3&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=powershell&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=ls%20%2Dla&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=%2Ehtaccess&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=docker%2Dcompose%2Eyml&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/cargo/api/v1/crates?q=tools&per_page=10", "headers": ["Host: example.com", "User-Agent: cargo/1.99.1 (5f94df478 2026-08-27)", "Accept-Encoding: deflate, gzip", "Upgrade: h2c", "HTTP2-Settings: AAMAAABkAAQAAQAAAAIAAAAA", "accept: application/json", "Connection: Upgrade, HTTP2-Settings"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/query?q=python3&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: bc433449-14e0-4cb0-907b-fcca1ead302b", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/query?q=powershell&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: e691cf8b-1859-45b1-aa67-e0987eb7474a", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/query?q=ls%20-la&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: 725a8ab1-a2c3-4924-84dd-a741bd6b8c07", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/query?q=.htaccess&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: 5b1d333f-6583-4f78-9c23-d776ebbde5cf", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/query?q=docker-compose.yml&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: 23a81a25-0828-4311-8d2d-66f0d5161b6b", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/query?q=tools&skip=0&take=20&prerelease=false&semVerLevel=2.0.0", "headers": ["Host: example.com", "X-NuGet-Session-Id: ebf39a79-969d-4ac5-b5a0-5119c2d43ccc", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: 825cbe04-63e7-414a-8394-2ecf74c68211", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: f61bfff6-1c26-4024-bc17-6b78dcef2edc", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: e894f984-8abf-4a23-960a-d1a09c94eaa3", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: 33e3aa1b-14cb-4854-821a-c3eb9e5be7ee", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: c478a564-7cf9-4282-9f00-bf5b7966607d", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "Accept: application/atom+xml, application/xml", "X-NuGet-Session-Id: 8dfa5583-4005-4134-9343-ddb4c68c125b", "User-Agent: NuGet Client V3/6.14.3 (LINUX)", "X-NuGet-Client-Version: 6.14.3", "Accept-Encoding: gzip, deflate"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=python3&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: e7210054-9f40-4a58-8228-beeab1e3bb05", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=powershell&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: 0f3b26a8-7ca2-4b52-a9bb-c23a25c4172c", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=ls%20-la&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: d0fa60d5-6948-4149-845f-e38d340cc09a", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=.htaccess&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: 8c22d5d2-1691-4488-89ca-a405dd7a15cc", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=docker-compose.yml&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: 0a1bd4b1-0009-4d1d-931d-d1c19b26dd8b", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/search?q=tools&items=9999999&start=0", "headers": ["Accept: application/json", "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3", "X-Remote-Request-Id: f858e4b5-10bc-4633-a517-f165a65ac4cb", "X-Chef-Version: 19.4.46", "Host: example.com", "User-Agent: Cinc Client Knife/19.4.46 (ruby-3.4.12-p148; ohai-19.1.40; x86_64-linux; +https://cinc.sh)", "Connection: close"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=python3&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=powershell&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=ls%20-la&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=.htaccess&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=docker-compose.yml&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/chef/api/v1/cookbooks?q=tools&items=9999999&start=0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/json"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'python3'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'powershell'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'tools'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.17.0", "Accept: application/atom+xml, application/xml"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'python3'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'powershell'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
|
{"method": "GET", "target": "/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'tools'&$top=30", "headers": ["Host: example.com", "User-Agent: curl/8.18.0", "Accept: */*"], "body": ""}
|
||||||
+100
@@ -442,6 +442,106 @@
|
|||||||
/api/v1/repos/alice/tools/milestones?state=open&name=.htaccess
|
/api/v1/repos/alice/tools/milestones?state=open&name=.htaccess
|
||||||
/api/v1/repos/alice/tools/milestones?state=open&name=v1.0
|
/api/v1/repos/alice/tools/milestones?state=open&name=v1.0
|
||||||
|
|
||||||
|
# The package registries' searches, sent to gitea 1.27.3 by each registry's own
|
||||||
|
# client: cargo, knife, composer, conan 1 and 2, dotnet and npm. curl sent the
|
||||||
|
# requests no client sends: the Chef cookbook list with a search, and NuGet's
|
||||||
|
# Packages() with the search in $filter, as NuGet's client builds it for a feed
|
||||||
|
# without Search(). curl also sent each NuGet Search() and Packages() search to
|
||||||
|
# Search()/$count and Packages()/$count, which count its results. Each searches
|
||||||
|
# for words that name commands and files, such as python3 and .htaccess, and
|
||||||
|
# for plain words. A Composer, Conan or npm name can hold a slash, so those
|
||||||
|
# searches are also sent /bin/sh.
|
||||||
|
/api/packages/alice/cargo/api/v1/crates?q=python3&per_page=10
|
||||||
|
/api/packages/alice/cargo/api/v1/crates?q=powershell&per_page=10
|
||||||
|
/api/packages/alice/cargo/api/v1/crates?q=ls%20%2Dla&per_page=10
|
||||||
|
/api/packages/alice/cargo/api/v1/crates?q=%2Ehtaccess&per_page=10
|
||||||
|
/api/packages/alice/cargo/api/v1/crates?q=docker%2Dcompose%2Eyml&per_page=10
|
||||||
|
/api/packages/alice/cargo/api/v1/crates?q=tools&per_page=10
|
||||||
|
/api/packages/alice/chef/api/v1/search?q=python3&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/search?q=powershell&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/search?q=ls%20-la&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/search?q=.htaccess&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/search?q=docker-compose.yml&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/search?q=tools&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/cookbooks?q=python3&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/cookbooks?q=powershell&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/cookbooks?q=ls%20-la&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/cookbooks?q=.htaccess&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/cookbooks?q=docker-compose.yml&items=9999999&start=0
|
||||||
|
/api/packages/alice/chef/api/v1/cookbooks?q=tools&items=9999999&start=0
|
||||||
|
/api/packages/alice/composer/search.json?q=python3&type=
|
||||||
|
/api/packages/alice/composer/search.json?q=powershell&type=
|
||||||
|
/api/packages/alice/composer/search.json?q=ls+-la&type=
|
||||||
|
/api/packages/alice/composer/search.json?q=.htaccess&type=
|
||||||
|
/api/packages/alice/composer/search.json?q=%2Fbin%2Fsh&type=
|
||||||
|
/api/packages/alice/composer/search.json?q=alice%2Ftools-cli&type=
|
||||||
|
/api/packages/alice/composer/search.json?q=docker-compose.yml&type=
|
||||||
|
/api/packages/alice/composer/search.json?q=tools&type=
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=python3
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=powershell
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=ls+-la
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=.htaccess
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=%2Fbin%2Fsh
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=tools%2F%2A
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=docker-compose.yml
|
||||||
|
/api/packages/alice/conan/v1/conans/search?q=tools
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=python3
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=powershell
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=ls+-la
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=.htaccess
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=%2Fbin%2Fsh
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=tools%2F1.0%40alice%2Fstable
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=docker-compose.yml
|
||||||
|
/api/packages/alice/conan/v2/conans/search?q=tools
|
||||||
|
/api/packages/alice/nuget/query?q=python3&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/query?q=powershell&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/query?q=ls%20-la&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/query?q=.htaccess&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/query?q=docker-compose.yml&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/query?q=tools&skip=0&take=20&prerelease=false&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'python3'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'powershell'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()?$filter=tolower(Id)%20eq%20'tools'&$top=30
|
||||||
|
/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='python3'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='powershell'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='ls%20-la'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='.htaccess'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='docker-compose.yml'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Search()/$count?$filter=IsLatestVersion&searchTerm='tools'&targetFramework=''&includePrerelease=false&$skip=0&$top=20&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('python3',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('python3',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20python3%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('powershell',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('powershell',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20powershell%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=(((((((Id%20ne%20null)%20and%20substringof('ls',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('ls',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20ls%20',tolower(Tags))))%20or%20((Id%20ne%20null)%20and%20substringof('-la',tolower(Id))))%20or%20((Description%20ne%20null)%20and%20substringof('-la',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20-la%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('.htaccess',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('.htaccess',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20.htaccess%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('docker-compose.yml',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20docker-compose.yml%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=((((Id%20ne%20null)%20and%20substringof('tools',tolower(Id)))%20or%20((Description%20ne%20null)%20and%20substringof('tools',tolower(Description))))%20or%20((Tags%20ne%20null)%20and%20substringof('%20tools%20',tolower(Tags))))%20and%20IsLatestVersion&$orderby=Id&$skip=0&$top=30&semVerLevel=2.0.0
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'python3'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'powershell'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'.htaccess'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'docker-compose.yml'&$top=30
|
||||||
|
/api/packages/alice/nuget/Packages()/$count?$filter=tolower(Id)%20eq%20'tools'&$top=30
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=python3&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=powershell&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=ls+-la&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=.htaccess&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=%2Fbin%2Fsh&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=%40alice%2Ftools-cli&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=docker-compose.yml&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
/api/packages/alice/npm/-/v1/search?text=tools&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5
|
||||||
|
|
||||||
# Pages, raw files and edit pages of files, and the API's call for their
|
# Pages, raw files and edit pages of files, and the API's call for their
|
||||||
# contents.
|
# contents.
|
||||||
/owner/repo/src/branch/main/package.json
|
/owner/repo/src/branch/main/package.json
|
||||||
|
|||||||
+11
-12
@@ -185,7 +185,7 @@ func (m *Metrics) AddBansAndClients(
|
|||||||
ledger *bans.Ledger, limiter *ratelimit.Limiter, now func() time.Time,
|
ledger *bans.Ledger, limiter *ratelimit.Limiter, now func() time.Time,
|
||||||
) {
|
) {
|
||||||
for _, cause := range []string{
|
for _, cause := range []string{
|
||||||
bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin, bans.CauseCrowdSec,
|
bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin,
|
||||||
} {
|
} {
|
||||||
m.registry.MustRegister(
|
m.registry.MustRegister(
|
||||||
prometheus.NewCounterFunc(prometheus.CounterOpts{
|
prometheus.NewCounterFunc(prometheus.CounterOpts{
|
||||||
@@ -302,20 +302,20 @@ const sourceLabel = "source"
|
|||||||
|
|
||||||
// AddReputation adds the metrics of the lists fetched from URLs and of the
|
// AddReputation adds the metrics of the lists fetched from URLs and of the
|
||||||
// DNSBL zones, by source, each list's URL or each zone, its key masked as
|
// DNSBL zones, by source, each list's URL or each zone, its key masked as
|
||||||
// config.MaskZoneKey masks it: the requests whose client a blocklist, the
|
// config.MaskZoneKey masks it: the requests whose client a blocklist, a
|
||||||
// CrowdSec decision list, a zone's verdict or AbuseIPDB's score lists,
|
// zone's verdict or AbuseIPDB's score lists, which ReputationHit counts,
|
||||||
// which ReputationHit counts, and, read from lists and dnsbl as the
|
// and, read from lists and dnsbl as the metrics are asked for, for a list,
|
||||||
// metrics are asked for, for a list, the fetches that failed and when the
|
// the fetches that failed and when the copy in use was fetched, and for a
|
||||||
// copy in use was fetched, and for a zone, the queries made and those that
|
// zone, the queries made and those that failed. It is called once, before
|
||||||
// failed. It is called once, before ReputationHit.
|
// ReputationHit.
|
||||||
func (m *Metrics) AddReputation(
|
func (m *Metrics) AddReputation(
|
||||||
lists *reputation.Lists,
|
lists *reputation.Lists,
|
||||||
dnsbl *reputation.DNSBL,
|
dnsbl *reputation.DNSBL,
|
||||||
) {
|
) {
|
||||||
m.reputationHits = counterVec(
|
m.reputationHits = counterVec(
|
||||||
"sww_reputation_hits_total",
|
"sww_reputation_hits_total",
|
||||||
"Requests whose client a blocklist, the CrowdSec decision list, a DNSBL "+
|
"Requests whose client a blocklist, a DNSBL zone or AbuseIPDB lists, "+
|
||||||
"zone or AbuseIPDB lists, by the list's URL, the zone, or abuseipdb.",
|
"by the list's URL, the zone, or abuseipdb.",
|
||||||
[]string{sourceLabel},
|
[]string{sourceLabel},
|
||||||
)
|
)
|
||||||
m.registry.MustRegister(m.reputationHits)
|
m.registry.MustRegister(m.reputationHits)
|
||||||
@@ -378,9 +378,8 @@ func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
|
|||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
// ReputationHit counts a request whose client source lists: a blocklist
|
// ReputationHit counts a request whose client source lists: a blocklist,
|
||||||
// or the CrowdSec decision list, by its URL, a DNSBL zone, its key masked,
|
// by its URL, a DNSBL zone, its key masked, or AbuseIPDB, abuseipdb.
|
||||||
// or AbuseIPDB, abuseipdb.
|
|
||||||
func (m *Metrics) ReputationHit(source string) {
|
func (m *Metrics) ReputationHit(source string) {
|
||||||
m.reputationHits.WithLabelValues(source).Inc()
|
m.reputationHits.WithLabelValues(source).Inc()
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,622 +0,0 @@
|
|||||||
package reputation_test
|
|
||||||
|
|
||||||
import (
|
|
||||||
"bytes"
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
"io"
|
|
||||||
"log/slog"
|
|
||||||
"net/http"
|
|
||||||
"net/netip"
|
|
||||||
"reflect"
|
|
||||||
"strings"
|
|
||||||
"sync"
|
|
||||||
"testing"
|
|
||||||
"testing/synctest"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/alerts"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/reputation"
|
|
||||||
)
|
|
||||||
|
|
||||||
// The tests run in a synctest bubble, as those of the blocklists do, and
|
|
||||||
// fetch the decision list from engine, a stand-in for a CrowdSec engine
|
|
||||||
// that answers without the network.
|
|
||||||
|
|
||||||
const (
|
|
||||||
// decisionsURL is the decision list of the tests' engine, and engineKey
|
|
||||||
// the key it answers.
|
|
||||||
decisionsURL = "http://crowdsec.example:8080/v1/decisions"
|
|
||||||
engineKey = "crowdsec-key-0123456789abcdef"
|
|
||||||
// sshBF and probing are scenarios of the engine's decisions.
|
|
||||||
sshBF = "crowdsecurity/ssh-bf"
|
|
||||||
probing = "crowdsecurity/http-probing"
|
|
||||||
// ban is the type of a decision to ban, and rangeScope the scope of a
|
|
||||||
// decision on a netblock, as CrowdSec names them.
|
|
||||||
ban = "ban"
|
|
||||||
rangeScope = "Range"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
synctest.Test(t, func(t *testing.T) {
|
|
||||||
began := time.Now()
|
|
||||||
manual := "manual 'ban' from 'localhost'"
|
|
||||||
e := &engine{key: engineKey, decisions: []decision{
|
|
||||||
{"Ip", suspect, ban, manual, began.Add(6 * time.Hour)},
|
|
||||||
// A shorter decision on the same address, which is not the one
|
|
||||||
// used.
|
|
||||||
{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
|
|
||||||
{
|
|
||||||
rangeScope,
|
|
||||||
"198.51.100.0/24",
|
|
||||||
ban,
|
|
||||||
probing,
|
|
||||||
began.Add(time.Hour),
|
|
||||||
},
|
|
||||||
{"Ip", "2001:db8::1", ban, sshBF, began.Add(2 * time.Hour)},
|
|
||||||
// Left out: a decision to show a captcha, and one on a country.
|
|
||||||
{"Ip", "192.0.2.50", "captcha", probing, began.Add(time.Hour)},
|
|
||||||
{"Country", "KP", ban, manual, began.Add(time.Hour)},
|
|
||||||
}}
|
|
||||||
lists := start(t, e, crowdSecParams())
|
|
||||||
|
|
||||||
for addr, want := range map[string]reputation.Decision{
|
|
||||||
suspect: {Expires: began.Add(6 * time.Hour), Scenario: manual},
|
|
||||||
"198.51.100.0": {Expires: began.Add(time.Hour), Scenario: probing},
|
|
||||||
"198.51.100.255": {Expires: began.Add(time.Hour), Scenario: probing},
|
|
||||||
"2001:db8::1": {Expires: began.Add(2 * time.Hour), Scenario: sshBF},
|
|
||||||
"203.0.113.10": {},
|
|
||||||
"198.51.101.0": {},
|
|
||||||
"2001:db8::2": {},
|
|
||||||
"192.0.2.50": {},
|
|
||||||
} {
|
|
||||||
wantDecision(t, lists, addr, want)
|
|
||||||
}
|
|
||||||
|
|
||||||
// With the engine down, the copy kept still holds the decision on
|
|
||||||
// 198.51.100.0/24, which no longer bans once it has ended.
|
|
||||||
e.set(func(e *engine) { e.failing = true })
|
|
||||||
time.Sleep(time.Hour - time.Nanosecond)
|
|
||||||
synctest.Wait()
|
|
||||||
wantDecision(
|
|
||||||
t,
|
|
||||||
lists,
|
|
||||||
"198.51.100.7",
|
|
||||||
reputation.Decision{
|
|
||||||
Expires: began.Add(time.Hour),
|
|
||||||
Scenario: probing,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
|
|
||||||
time.Sleep(time.Nanosecond)
|
|
||||||
synctest.Wait()
|
|
||||||
wantDecision(t, lists, "198.51.100.7", reputation.Decision{})
|
|
||||||
wantDecision(
|
|
||||||
t,
|
|
||||||
lists,
|
|
||||||
suspect,
|
|
||||||
reputation.Decision{
|
|
||||||
Expires: began.Add(6 * time.Hour),
|
|
||||||
Scenario: manual,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecDecisionListFetchedAgainEveryMinute(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
synctest.Test(t, func(t *testing.T) {
|
|
||||||
began := time.Now()
|
|
||||||
e := &engine{key: engineKey, decisions: []decision{
|
|
||||||
{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
|
|
||||||
}}
|
|
||||||
lists := start(t, e, crowdSecParams())
|
|
||||||
wantEngineFetches(t, e, 1)
|
|
||||||
|
|
||||||
added := reputation.Decision{
|
|
||||||
Expires: began.Add(2 * time.Hour),
|
|
||||||
Scenario: probing,
|
|
||||||
}
|
|
||||||
|
|
||||||
e.set(func(e *engine) {
|
|
||||||
e.decisions = append(e.decisions,
|
|
||||||
decision{"Ip", "203.0.113.10", ban, probing, added.Expires})
|
|
||||||
})
|
|
||||||
|
|
||||||
time.Sleep(time.Minute - time.Nanosecond)
|
|
||||||
wantEngineFetches(t, e, 1)
|
|
||||||
wantDecision(t, lists, "203.0.113.10", reputation.Decision{})
|
|
||||||
|
|
||||||
time.Sleep(time.Nanosecond)
|
|
||||||
wantEngineFetches(t, e, 2)
|
|
||||||
wantDecision(t, lists, "203.0.113.10", added)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecDecisionOnAClientIsTheOneThatEndsLast(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
synctest.Test(t, func(t *testing.T) {
|
|
||||||
began := time.Now()
|
|
||||||
e := &engine{key: engineKey, decisions: []decision{
|
|
||||||
// Two decisions on one address, the shorter listed first.
|
|
||||||
{"Ip", suspect, ban, sshBF, began.Add(2 * time.Hour)},
|
|
||||||
{"Ip", suspect, ban, probing, began.Add(4 * time.Hour)},
|
|
||||||
// 198.51.100.130 is held by a decision on its address that ends
|
|
||||||
// after the one on its netblock, and 192.0.2.20 by one that ends
|
|
||||||
// before.
|
|
||||||
{
|
|
||||||
rangeScope,
|
|
||||||
"198.51.100.128/25",
|
|
||||||
ban,
|
|
||||||
sshBF,
|
|
||||||
began.Add(time.Hour),
|
|
||||||
},
|
|
||||||
{"Ip", "198.51.100.130", ban, probing, began.Add(3 * time.Hour)},
|
|
||||||
{
|
|
||||||
rangeScope,
|
|
||||||
"192.0.2.0/24",
|
|
||||||
ban,
|
|
||||||
probing,
|
|
||||||
began.Add(5 * time.Hour),
|
|
||||||
},
|
|
||||||
{"Ip", "192.0.2.20", ban, sshBF, began.Add(2 * time.Hour)},
|
|
||||||
}}
|
|
||||||
lists := start(t, e, crowdSecParams())
|
|
||||||
|
|
||||||
wantDecision(
|
|
||||||
t,
|
|
||||||
lists,
|
|
||||||
suspect,
|
|
||||||
reputation.Decision{
|
|
||||||
Expires: began.Add(4 * time.Hour),
|
|
||||||
Scenario: probing,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
wantDecision(
|
|
||||||
t,
|
|
||||||
lists,
|
|
||||||
"198.51.100.130",
|
|
||||||
reputation.Decision{
|
|
||||||
Expires: began.Add(3 * time.Hour),
|
|
||||||
Scenario: probing,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
wantDecision(
|
|
||||||
t,
|
|
||||||
lists,
|
|
||||||
"192.0.2.20",
|
|
||||||
reputation.Decision{
|
|
||||||
Expires: began.Add(5 * time.Hour),
|
|
||||||
Scenario: probing,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecAnswerOfNoDecisionIsAGoodCopyThatListsNoClient(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
synctest.Test(t, func(t *testing.T) {
|
|
||||||
began := time.Now()
|
|
||||||
e := &engine{key: engineKey, decisions: []decision{
|
|
||||||
{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
|
|
||||||
}}
|
|
||||||
lists := start(t, e, crowdSecParams())
|
|
||||||
|
|
||||||
// With its decision deleted, the engine answers null.
|
|
||||||
e.set(func(e *engine) { e.decisions = nil })
|
|
||||||
time.Sleep(time.Minute)
|
|
||||||
wantEngineFetches(t, e, 2)
|
|
||||||
|
|
||||||
want := []reputation.List{{
|
|
||||||
URL: decisionsURL, Tried: time.Now(), Fetched: time.Now(), Lines: []string{"null"},
|
|
||||||
}}
|
|
||||||
if got := lists.Snapshot(); !reflect.DeepEqual(got, want) {
|
|
||||||
t.Errorf("lists %+v, want %+v", got, want)
|
|
||||||
}
|
|
||||||
|
|
||||||
if lists.Failures(decisionsURL) != 0 {
|
|
||||||
t.Errorf("%d failures, want 0", lists.Failures(decisionsURL))
|
|
||||||
}
|
|
||||||
|
|
||||||
wantDecision(t, lists, suspect, reputation.Decision{})
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecFailureKeepsTheLastGoodCopyAlertsOncePerCooldownAndHidesTheKey(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
for _, tc := range crowdSecFailures() {
|
|
||||||
t.Run(tc.name, func(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
synctest.Test(t, func(t *testing.T) {
|
|
||||||
var log bytes.Buffer
|
|
||||||
|
|
||||||
began := time.Now()
|
|
||||||
e := &engine{key: engineKey, decisions: []decision{
|
|
||||||
{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
|
|
||||||
}}
|
|
||||||
queue := newQueue()
|
|
||||||
p := crowdSecParams()
|
|
||||||
p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
|
|
||||||
p.Alerts = queue
|
|
||||||
lists := start(t, e, p)
|
|
||||||
kept := lists.Snapshot()
|
|
||||||
|
|
||||||
e.set(tc.fail)
|
|
||||||
|
|
||||||
// Each failure is tried again a minute after it.
|
|
||||||
for range 2 {
|
|
||||||
time.Sleep(time.Minute)
|
|
||||||
synctest.Wait()
|
|
||||||
}
|
|
||||||
|
|
||||||
wantEngineFetches(t, e, 3)
|
|
||||||
wantDecision(
|
|
||||||
t,
|
|
||||||
lists,
|
|
||||||
suspect,
|
|
||||||
reputation.Decision{
|
|
||||||
Expires: began.Add(4 * time.Hour),
|
|
||||||
Scenario: sshBF,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
|
|
||||||
want := kept[0]
|
|
||||||
want.Tried = time.Now()
|
|
||||||
|
|
||||||
got := lists.Snapshot()
|
|
||||||
if !reflect.DeepEqual(got, []reputation.List{want}) {
|
|
||||||
t.Errorf(
|
|
||||||
"lists %+v, want the first copy, last tried now, %+v",
|
|
||||||
got,
|
|
||||||
want,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
if n := lists.Failures(decisionsURL); n != 2 {
|
|
||||||
t.Errorf("%d failures, want 2", n)
|
|
||||||
}
|
|
||||||
|
|
||||||
// One alert for the first failure; the cooldown holds back the
|
|
||||||
// second.
|
|
||||||
failed := time.Now().Add(-time.Minute)
|
|
||||||
alert := fetchFailure(failed, decisionsURL, tc.error)
|
|
||||||
wantAlert(t, queue, alert)
|
|
||||||
|
|
||||||
if !strings.Contains(
|
|
||||||
log.String(),
|
|
||||||
`"msg":"fetching a list failed",`+
|
|
||||||
`"url":"`+decisionsURL+`","error":"`+tc.error,
|
|
||||||
) {
|
|
||||||
t.Errorf("logged\n%s\nwant the failures", log.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
wantKeyNotShown(t, e, log.String(), lists, queue)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// crowdSecFailure is a way for the engine to fail: fail has it answer the
|
|
||||||
// fetches after the first so that they fail with error.
|
|
||||||
type crowdSecFailure struct {
|
|
||||||
name string
|
|
||||||
fail func(e *engine)
|
|
||||||
error string
|
|
||||||
}
|
|
||||||
|
|
||||||
// crowdSecFailures returns the ways the engine can fail.
|
|
||||||
func crowdSecFailures() []crowdSecFailure {
|
|
||||||
const notDecision = " does not give an address or a netblock and a duration, " +
|
|
||||||
"such as 4h0m0s"
|
|
||||||
|
|
||||||
return []crowdSecFailure{
|
|
||||||
{
|
|
||||||
"an answer other than 200",
|
|
||||||
func(e *engine) { e.failing = true },
|
|
||||||
"the server answered 503 Service Unavailable",
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"a key the engine refuses",
|
|
||||||
func(e *engine) { e.key = "another-key-0123456789abcdef" },
|
|
||||||
"the server answered 403 Forbidden",
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"a redirect",
|
|
||||||
func(e *engine) { e.redirect = "http://elsewhere.example/v1/decisions" },
|
|
||||||
"the server answered 302 Found",
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"an answer that does not read",
|
|
||||||
func(e *engine) { e.answer = "<html>" },
|
|
||||||
"read the answer: invalid character '<' looking for beginning of value",
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"a decision to ban whose value does not read",
|
|
||||||
func(e *engine) {
|
|
||||||
e.answer = `[{"duration": "4h", "scenario": "` + sshBF + `", ` +
|
|
||||||
`"scope": "Ip", "type": "ban", "value": "203.0.113.300"}]`
|
|
||||||
},
|
|
||||||
"decision 1" + notDecision,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"a decision to ban whose duration does not read",
|
|
||||||
func(e *engine) {
|
|
||||||
e.answer = `[{"duration": "4h", "scope": "Country", "type": "ban", ` +
|
|
||||||
`"value": "KP"}, {"duration": "four hours", "scope": "Range", ` +
|
|
||||||
`"type": "ban", "value": "198.51.100.0/24"}]`
|
|
||||||
},
|
|
||||||
"decision 2" + notDecision,
|
|
||||||
},
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// wantKeyNotShown checks that no fetch carried the engine's key to a URL
|
|
||||||
// other than its decision list, such as the one a redirect names, and that
|
|
||||||
// the key is in none of what the fetches leave behind: log, the process
|
|
||||||
// log, the alerts waiting in queue, and the copies of lists, which
|
|
||||||
// lists.json keeps.
|
|
||||||
func wantKeyNotShown(
|
|
||||||
t *testing.T,
|
|
||||||
e *engine,
|
|
||||||
log string,
|
|
||||||
lists *reputation.Lists,
|
|
||||||
queue *alerts.Queue,
|
|
||||||
) {
|
|
||||||
t.Helper()
|
|
||||||
|
|
||||||
e.mu.Lock()
|
|
||||||
keySentTo := e.keySentTo
|
|
||||||
e.mu.Unlock()
|
|
||||||
|
|
||||||
if len(keySentTo) != 0 {
|
|
||||||
t.Errorf("the key was sent to %v", keySentTo)
|
|
||||||
}
|
|
||||||
|
|
||||||
shown, err := json.Marshal([]any{lists.Snapshot(), waiting(queue)})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("encode: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if strings.Contains(log+string(shown), engineKey) {
|
|
||||||
t.Errorf("the key is shown in\n%s\n%s", log, shown)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
synctest.Test(t, func(t *testing.T) {
|
|
||||||
began := time.Now()
|
|
||||||
e := &engine{key: engineKey, decisions: []decision{
|
|
||||||
{
|
|
||||||
rangeScope,
|
|
||||||
"198.51.100.0/24",
|
|
||||||
ban,
|
|
||||||
probing,
|
|
||||||
began.Add(time.Hour),
|
|
||||||
},
|
|
||||||
}}
|
|
||||||
lists := start(t, e, crowdSecParams())
|
|
||||||
kept := lists.Snapshot()
|
|
||||||
|
|
||||||
// Restarted half an hour later with what lists.json keeps, and
|
|
||||||
// the engine down, the decision still bans, until the end it had at
|
|
||||||
// the fetch, half an hour on.
|
|
||||||
time.Sleep(30 * time.Minute)
|
|
||||||
|
|
||||||
down := &engine{key: engineKey, failing: true}
|
|
||||||
again := reputation.New(crowdSecParams())
|
|
||||||
again.SetTransport(down)
|
|
||||||
|
|
||||||
err := again.Load(kept)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("load: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
run(t, again)
|
|
||||||
|
|
||||||
want := reputation.Decision{
|
|
||||||
Expires: began.Add(time.Hour),
|
|
||||||
Scenario: probing,
|
|
||||||
}
|
|
||||||
wantDecision(t, again, "198.51.100.7", want)
|
|
||||||
|
|
||||||
time.Sleep(30*time.Minute - time.Nanosecond)
|
|
||||||
synctest.Wait()
|
|
||||||
wantDecision(t, again, "198.51.100.7", want)
|
|
||||||
|
|
||||||
time.Sleep(time.Nanosecond)
|
|
||||||
synctest.Wait()
|
|
||||||
wantDecision(t, again, "198.51.100.7", reputation.Decision{})
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestLoadTakesACrowdSecListNeverFetchedAndRefusesACopyThatDoesNotRead(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
now := time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
|
|
||||||
lists := reputation.New(crowdSecParams())
|
|
||||||
|
|
||||||
// Tried, and never fetched: there is no copy to read.
|
|
||||||
err := lists.Load([]reputation.List{{URL: decisionsURL, Tried: now}})
|
|
||||||
if err != nil {
|
|
||||||
t.Errorf("load the list never fetched: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
err = lists.Load([]reputation.List{{
|
|
||||||
URL: decisionsURL, Tried: now, Fetched: now, Lines: []string{
|
|
||||||
`[{"duration": "4h", "scope": "Range", "type": "ban", ` +
|
|
||||||
`"value": "198.51.100.0/33"}]`,
|
|
||||||
},
|
|
||||||
}})
|
|
||||||
|
|
||||||
const want = "the copy of " + decisionsURL + ": decision 1 does not give an " +
|
|
||||||
"address or a netblock and a duration, such as 4h0m0s"
|
|
||||||
if err == nil || err.Error() != want {
|
|
||||||
t.Errorf("error %v, want %s", err, want)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// engine is a stand-in for the local API of a CrowdSec engine. It answers
|
|
||||||
// a fetch of the decision list that carries its key in X-Api-Key with its
|
|
||||||
// decisions still in force, each with the time it has left as it answers,
|
|
||||||
// by the bubble's clock, as an engine does, or with answer while that is
|
|
||||||
// not "". It answers 403 to a fetch without its key, as an engine does,
|
|
||||||
// with a redirect to redirect while that is not "", and 503 while failing.
|
|
||||||
// It counts the fetches, and notes in keySentTo the URL of each fetch of
|
|
||||||
// another URL that carries a key, as one following a redirect would.
|
|
||||||
type engine struct {
|
|
||||||
mu sync.Mutex
|
|
||||||
key string
|
|
||||||
decisions []decision
|
|
||||||
answer string
|
|
||||||
redirect string
|
|
||||||
failing bool
|
|
||||||
fetches int
|
|
||||||
keySentTo []string
|
|
||||||
}
|
|
||||||
|
|
||||||
// decision is a decision of the engine, which ends at expires.
|
|
||||||
type decision struct {
|
|
||||||
scope, value, kind, scenario string
|
|
||||||
expires time.Time
|
|
||||||
}
|
|
||||||
|
|
||||||
// RoundTrip has the engine answer req, in place of the network.
|
|
||||||
func (e *engine) RoundTrip(req *http.Request) (*http.Response, error) {
|
|
||||||
e.mu.Lock()
|
|
||||||
defer e.mu.Unlock()
|
|
||||||
|
|
||||||
e.fetches++
|
|
||||||
|
|
||||||
if req.URL.String() != decisionsURL &&
|
|
||||||
req.Header.Get("X-Api-Key") != "" {
|
|
||||||
e.keySentTo = append(e.keySentTo, req.URL.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
status, header, body := http.StatusOK, http.Header{}, e.answer
|
|
||||||
|
|
||||||
switch {
|
|
||||||
case req.URL.String() != decisionsURL || req.Header.Get("X-Api-Key") != e.key:
|
|
||||||
status, body = http.StatusForbidden, `{"message":"access forbidden"}`
|
|
||||||
case e.redirect != "":
|
|
||||||
status, header = http.StatusFound, http.Header{
|
|
||||||
"Location": {e.redirect},
|
|
||||||
}
|
|
||||||
case e.failing:
|
|
||||||
status, body = http.StatusServiceUnavailable, ""
|
|
||||||
case body == "":
|
|
||||||
body = e.inForce(time.Now())
|
|
||||||
}
|
|
||||||
|
|
||||||
return &http.Response{
|
|
||||||
StatusCode: status,
|
|
||||||
Status: fmt.Sprintf("%d %s", status, http.StatusText(status)),
|
|
||||||
Header: header,
|
|
||||||
Body: io.NopCloser(strings.NewReader(body)),
|
|
||||||
Request: req,
|
|
||||||
}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// inForce returns the decisions in force at now, as the engine answers
|
|
||||||
// them: a JSON list, null for none.
|
|
||||||
func (e *engine) inForce(now time.Time) string {
|
|
||||||
var answer []map[string]string
|
|
||||||
|
|
||||||
for _, d := range e.decisions {
|
|
||||||
if now.Before(d.expires) {
|
|
||||||
answer = append(answer, map[string]string{
|
|
||||||
"duration": d.expires.Sub(now).
|
|
||||||
String(),
|
|
||||||
"origin": "crowdsec",
|
|
||||||
"scenario": d.scenario, "scope": d.scope, "type": d.kind, "value": d.value,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
body, err := json.Marshal(answer)
|
|
||||||
if err != nil {
|
|
||||||
panic(err) // a list of maps of strings always encodes
|
|
||||||
}
|
|
||||||
|
|
||||||
return string(body)
|
|
||||||
}
|
|
||||||
|
|
||||||
// set changes the engine with change.
|
|
||||||
func (e *engine) set(change func(e *engine)) {
|
|
||||||
e.mu.Lock()
|
|
||||||
defer e.mu.Unlock()
|
|
||||||
|
|
||||||
change(e)
|
|
||||||
}
|
|
||||||
|
|
||||||
// crowdSecParams returns the Params of the decision list of the tests'
|
|
||||||
// engine, fetched with its key, by the bubble's clock, with alerts to a
|
|
||||||
// queue that sends none.
|
|
||||||
func crowdSecParams() reputation.Params {
|
|
||||||
p := params()
|
|
||||||
p.CrowdSecDecisionsURL = decisionsURL
|
|
||||||
p.CrowdSecKey = engineKey
|
|
||||||
|
|
||||||
return p
|
|
||||||
}
|
|
||||||
|
|
||||||
// wantEngineFetches waits until Run has made the fetches due, and checks
|
|
||||||
// how many the engine has had.
|
|
||||||
func wantEngineFetches(t *testing.T, e *engine, want int) {
|
|
||||||
t.Helper()
|
|
||||||
|
|
||||||
synctest.Wait()
|
|
||||||
|
|
||||||
e.mu.Lock()
|
|
||||||
got := e.fetches
|
|
||||||
e.mu.Unlock()
|
|
||||||
|
|
||||||
if got != want {
|
|
||||||
t.Errorf("%d fetches, want %d", got, want)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// wantDecision checks the decision lists says is in force on addr now,
|
|
||||||
// the zero Decision for none.
|
|
||||||
func wantDecision(
|
|
||||||
t *testing.T,
|
|
||||||
lists *reputation.Lists,
|
|
||||||
addr string,
|
|
||||||
want reputation.Decision,
|
|
||||||
) {
|
|
||||||
t.Helper()
|
|
||||||
|
|
||||||
got, listed := lists.CrowdSecDecision(
|
|
||||||
netip.MustParseAddr(addr),
|
|
||||||
time.Now(),
|
|
||||||
)
|
|
||||||
if listed != !want.Expires.IsZero() ||
|
|
||||||
listed &&
|
|
||||||
(!got.Expires.Equal(want.Expires) || got.Scenario != want.Scenario) {
|
|
||||||
t.Errorf(
|
|
||||||
"%s has the decision %+v in force %t, want %+v",
|
|
||||||
addr,
|
|
||||||
got,
|
|
||||||
listed,
|
|
||||||
want,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -11,7 +11,6 @@ import (
|
|||||||
// network.
|
// network.
|
||||||
func (l *Lists) SetTransport(transport http.RoundTripper) {
|
func (l *Lists) SetTransport(transport http.RoundTripper) {
|
||||||
l.httpClient.Transport = transport
|
l.httpClient.Transport = transport
|
||||||
l.crowdSecClient.Transport = transport
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// SetTransport has a's checks go through transport instead of the
|
// SetTransport has a's checks go through transport instead of the
|
||||||
|
|||||||
@@ -1,8 +1,7 @@
|
|||||||
// Package reputation fetches the lists the settings name by URL: the
|
// Package reputation fetches the lists the settings name by URL: the
|
||||||
// blocklists of SWW_WAF_BLOCKLIST_URLS, the file of AS:percent lines
|
// blocklists of SWW_WAF_BLOCKLIST_URLS, the file of AS:percent lines
|
||||||
// SWW_WAF_ASN_LIMIT_PERCENT_URL names, the address lists of SWW_WAF_TAG_LISTS, and
|
// SWW_WAF_ASN_LIMIT_PERCENT_URL names, and the address lists of
|
||||||
// the decision list of the CrowdSec engine SWW_WAF_CROWDSEC_LAPI_URL names. It
|
// SWW_WAF_TAG_LISTS. It keeps the last good copy of
|
||||||
// keeps the last good copy of
|
|
||||||
// each, whole, comment lines included, which is used while a fetch fails,
|
// each, whole, comment lines included, which is used while a fetch fails,
|
||||||
// and when each was last tried. It also asks the DNSBL zones of
|
// and when each was last tried. It also asks the DNSBL zones of
|
||||||
// SWW_WAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
|
// SWW_WAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
|
||||||
@@ -13,7 +12,6 @@ package reputation
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
"encoding/json"
|
|
||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
"io"
|
"io"
|
||||||
@@ -35,10 +33,6 @@ const (
|
|||||||
maxListBytes = 16 << 20
|
maxListBytes = 16 << 20
|
||||||
// fetchTimeout bounds one fetch of a list.
|
// fetchTimeout bounds one fetch of a list.
|
||||||
fetchTimeout = time.Minute
|
fetchTimeout = time.Minute
|
||||||
// crowdSecRefresh is how long after the CrowdSec decision list was last
|
|
||||||
// fetched or tried it is fetched again: the engine is the operator's
|
|
||||||
// own, and makes and ends decisions all the time.
|
|
||||||
crowdSecRefresh = time.Minute
|
|
||||||
// mappedBits is the length of ::ffff:0.0.0.0/96, the netblock of every
|
// mappedBits is the length of ::ffff:0.0.0.0/96, the netblock of every
|
||||||
// IPv4-mapped address.
|
// IPv4-mapped address.
|
||||||
mappedBits = 96
|
mappedBits = 96
|
||||||
@@ -52,9 +46,6 @@ var (
|
|||||||
)
|
)
|
||||||
errNotASNPercent = errors.New(
|
errNotASNPercent = errors.New(
|
||||||
"is not an AS number, : and a percentage, such as AS64496:50")
|
"is not an AS number, : and a percentage, such as AS64496:50")
|
||||||
errNotDecision = errors.New(
|
|
||||||
"does not give an address or a netblock and a duration, such as 4h0m0s",
|
|
||||||
)
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// List is a list as lists.json holds it: the URL it is fetched from,
|
// List is a list as lists.json holds it: the URL it is fetched from,
|
||||||
@@ -77,14 +68,8 @@ type Params struct {
|
|||||||
ASNLimitPercentURL string
|
ASNLimitPercentURL string
|
||||||
// TagLists are the address lists that add a tag (SWW_WAF_TAG_LISTS).
|
// TagLists are the address lists that add a tag (SWW_WAF_TAG_LISTS).
|
||||||
TagLists []config.TagList
|
TagLists []config.TagList
|
||||||
// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
|
|
||||||
// SWW_WAF_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
|
|
||||||
// (SWW_WAF_CROWDSEC_LAPI_KEY).
|
|
||||||
CrowdSecDecisionsURL string
|
|
||||||
CrowdSecKey string
|
|
||||||
// Refresh is how long after a list was last fetched or tried it is
|
// Refresh is how long after a list was last fetched or tried it is
|
||||||
// fetched again (SWW_WAF_BLOCKLIST_REFRESH), but for the CrowdSec decision
|
// fetched again (SWW_WAF_BLOCKLIST_REFRESH).
|
||||||
// list, which is fetched again crowdSecRefresh after.
|
|
||||||
Refresh time.Duration
|
Refresh time.Duration
|
||||||
// Now tells the time, normally time.Now in UTC.
|
// Now tells the time, normally time.Now in UTC.
|
||||||
Now func() time.Time
|
Now func() time.Time
|
||||||
@@ -99,10 +84,6 @@ type Params struct {
|
|||||||
type Lists struct {
|
type Lists struct {
|
||||||
params Params
|
params Params
|
||||||
httpClient *http.Client
|
httpClient *http.Client
|
||||||
// crowdSecClient fetches the CrowdSec decision list. It follows no
|
|
||||||
// redirect, so that the key goes to the engine alone: a redirect is a
|
|
||||||
// failure.
|
|
||||||
crowdSecClient *http.Client
|
|
||||||
|
|
||||||
mu sync.Mutex
|
mu sync.Mutex
|
||||||
// lists are by URL, one for each URL Params names.
|
// lists are by URL, one for each URL Params names.
|
||||||
@@ -119,22 +100,12 @@ type list struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// entries are what the lines of a copy say: for a blocklist or a tag list, the
|
// entries are what the lines of a copy say: for a blocklist or a tag list, the
|
||||||
// netblocks it names, with the lengths among them, for the file of AS:percent
|
// netblocks it names, with the lengths among them, and for the file of
|
||||||
// lines, the percentage it gives each AS number, and for the CrowdSec decision
|
// AS:percent lines, the percentage it gives each AS number.
|
||||||
// list, the decision on each netblock that ends last, with the lengths among
|
|
||||||
// them.
|
|
||||||
type entries struct {
|
type entries struct {
|
||||||
netblocks map[netip.Prefix]bool
|
netblocks map[netip.Prefix]bool
|
||||||
lengths []int
|
lengths []int
|
||||||
percents map[string]int64
|
percents map[string]int64
|
||||||
decisions map[netip.Prefix]Decision
|
|
||||||
}
|
|
||||||
|
|
||||||
// Decision is a decision of the CrowdSec engine to ban a netblock: when
|
|
||||||
// it ends, and the scenario that made it, such as crowdsecurity/ssh-bf.
|
|
||||||
type Decision struct {
|
|
||||||
Expires time.Time
|
|
||||||
Scenario string
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// New returns the lists, without a copy of any yet.
|
// New returns the lists, without a copy of any yet.
|
||||||
@@ -142,11 +113,6 @@ func New(params Params) *Lists {
|
|||||||
l := &Lists{
|
l := &Lists{
|
||||||
params: params,
|
params: params,
|
||||||
httpClient: &http.Client{},
|
httpClient: &http.Client{},
|
||||||
crowdSecClient: &http.Client{
|
|
||||||
CheckRedirect: func(*http.Request, []*http.Request) error {
|
|
||||||
return http.ErrUseLastResponse
|
|
||||||
},
|
|
||||||
},
|
|
||||||
lists: map[string]*list{},
|
lists: map[string]*list{},
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -159,7 +125,7 @@ func New(params Params) *Lists {
|
|||||||
|
|
||||||
// URLs returns the URL of every list: the blocklists' in the order
|
// URLs returns the URL of every list: the blocklists' in the order
|
||||||
// SWW_WAF_BLOCKLIST_URLS names them, then SWW_WAF_ASN_LIMIT_PERCENT_URL, then the
|
// SWW_WAF_BLOCKLIST_URLS names them, then SWW_WAF_ASN_LIMIT_PERCENT_URL, then the
|
||||||
// tag lists', then the CrowdSec decision list's.
|
// tag lists'.
|
||||||
func (l *Lists) URLs() []string {
|
func (l *Lists) URLs() []string {
|
||||||
urls := slices.Clone(l.params.BlocklistURLs)
|
urls := slices.Clone(l.params.BlocklistURLs)
|
||||||
if l.params.ASNLimitPercentURL != "" {
|
if l.params.ASNLimitPercentURL != "" {
|
||||||
@@ -170,10 +136,6 @@ func (l *Lists) URLs() []string {
|
|||||||
urls = append(urls, list.URL)
|
urls = append(urls, list.URL)
|
||||||
}
|
}
|
||||||
|
|
||||||
if l.params.CrowdSecDecisionsURL != "" {
|
|
||||||
urls = append(urls, l.params.CrowdSecDecisionsURL)
|
|
||||||
}
|
|
||||||
|
|
||||||
return urls
|
return urls
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -225,40 +187,6 @@ func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
|
|||||||
return percent, listed
|
return percent, listed
|
||||||
}
|
}
|
||||||
|
|
||||||
// CrowdSecDecision returns the decision of the copy of the CrowdSec
|
|
||||||
// decision list on a netblock that holds addr and that ends last, and
|
|
||||||
// whether it is still in force at now. A decision that has ended no
|
|
||||||
// longer bans, even before the next fetch drops it.
|
|
||||||
func (l *Lists) CrowdSecDecision(
|
|
||||||
addr netip.Addr,
|
|
||||||
now time.Time,
|
|
||||||
) (Decision, bool) {
|
|
||||||
if l.params.CrowdSecDecisionsURL == "" {
|
|
||||||
return Decision{}, false
|
|
||||||
}
|
|
||||||
|
|
||||||
l.mu.Lock()
|
|
||||||
defer l.mu.Unlock()
|
|
||||||
|
|
||||||
kept := l.lists[l.params.CrowdSecDecisionsURL].entries
|
|
||||||
|
|
||||||
var last Decision
|
|
||||||
|
|
||||||
for _, length := range kept.lengths {
|
|
||||||
netblock, err := addr.Prefix(length)
|
|
||||||
if err != nil {
|
|
||||||
continue // an IPv6 netblock's length, past an IPv4 address's 32 bits
|
|
||||||
}
|
|
||||||
|
|
||||||
decision := kept.decisions[netblock]
|
|
||||||
if decision.Expires.After(last.Expires) {
|
|
||||||
last = decision
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return last, now.Before(last.Expires)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Fetched returns when the copy in use of the list at listURL was
|
// Fetched returns when the copy in use of the list at listURL was
|
||||||
// fetched, or zero while there is none.
|
// fetched, or zero while there is none.
|
||||||
func (l *Lists) Fetched(listURL string) time.Time {
|
func (l *Lists) Fetched(listURL string) time.Time {
|
||||||
@@ -331,7 +259,7 @@ func (l *Lists) Load(lists []List) error {
|
|||||||
continue // dropped, or a list tried but never fetched, without a copy
|
continue // dropped, or a list tried but never fetched, without a copy
|
||||||
}
|
}
|
||||||
|
|
||||||
read, err := l.parse(kept.URL, kept.Lines, kept.Fetched)
|
read, err := l.parse(kept.URL, kept.Lines)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("the copy of %s: %w", kept.URL, err)
|
return fmt.Errorf("the copy of %s: %w", kept.URL, err)
|
||||||
}
|
}
|
||||||
@@ -377,8 +305,7 @@ func (l *Lists) fetchDue(ctx context.Context) time.Time {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// due returns when the list at listURL is to be fetched: Refresh after it
|
// due returns when the list at listURL is to be fetched: Refresh after it
|
||||||
// was last fetched or tried, the later of the two, or crowdSecRefresh
|
// was last fetched or tried, the later of the two.
|
||||||
// after for the CrowdSec decision list.
|
|
||||||
func (l *Lists) due(listURL string) time.Time {
|
func (l *Lists) due(listURL string) time.Time {
|
||||||
l.mu.Lock()
|
l.mu.Lock()
|
||||||
defer l.mu.Unlock()
|
defer l.mu.Unlock()
|
||||||
@@ -390,10 +317,6 @@ func (l *Lists) due(listURL string) time.Time {
|
|||||||
last = held.kept.Tried
|
last = held.kept.Tried
|
||||||
}
|
}
|
||||||
|
|
||||||
if listURL == l.params.CrowdSecDecisionsURL {
|
|
||||||
return last.Add(crowdSecRefresh)
|
|
||||||
}
|
|
||||||
|
|
||||||
return last.Add(l.params.Refresh)
|
return last.Add(l.params.Refresh)
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -408,7 +331,7 @@ func (l *Lists) fetch(ctx context.Context, listURL string) {
|
|||||||
|
|
||||||
var found entries
|
var found entries
|
||||||
if err == nil {
|
if err == nil {
|
||||||
found, err = l.parse(listURL, lines, now)
|
found, err = l.parse(listURL, lines)
|
||||||
}
|
}
|
||||||
|
|
||||||
cutOff := err != nil && ctx.Err() != nil
|
cutOff := err != nil && ctx.Err() != nil
|
||||||
@@ -468,11 +391,8 @@ func raiseFailure(queue *alerts.Queue, reason, source string, err error) {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
// get fetches the list at listURL, and returns its lines. The CrowdSec
|
// get fetches the list at listURL, and returns its lines. An answer other
|
||||||
// decision list is fetched with CrowdSecKey in the header X-Api-Key, where
|
// than 200, or a list longer than maxListBytes, is a failure.
|
||||||
// the engine looks for it, by crowdSecClient, which follows no redirect.
|
|
||||||
// An answer other than 200, or a list longer than maxListBytes, is a
|
|
||||||
// failure.
|
|
||||||
func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
|
func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
|
||||||
ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
|
ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
|
||||||
defer cancel()
|
defer cancel()
|
||||||
@@ -487,14 +407,7 @@ func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
|
|||||||
return nil, fmt.Errorf("make the request: %w", err)
|
return nil, fmt.Errorf("make the request: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
client := l.httpClient
|
res, err := l.httpClient.Do(req)
|
||||||
|
|
||||||
if listURL == l.params.CrowdSecDecisionsURL {
|
|
||||||
req.Header.Set("X-Api-Key", l.params.CrowdSecKey)
|
|
||||||
client = l.crowdSecClient
|
|
||||||
}
|
|
||||||
|
|
||||||
res, err := client.Do(req)
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// Do's error names the URL, which the log line and the alert name
|
// Do's error names the URL, which the log line and the alert name
|
||||||
// already: only what went wrong is kept.
|
// already: only what went wrong is kept.
|
||||||
@@ -526,22 +439,16 @@ func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
|
|||||||
return lines, nil
|
return lines, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// parse reads the lines of the list at listURL, fetched at fetched: those
|
// parse reads the lines of the list at listURL: those of a blocklist or a
|
||||||
// of a blocklist or a tag list, of the file of AS:percent lines, or of the
|
// tag list, or of the file of AS:percent lines. Anything after a ; or a #
|
||||||
// CrowdSec decision list. In all but the decision list, anything after a ; or
|
// on a line is left out, and so is a line left blank. Any other line that
|
||||||
// a # on a line is left out, and so is a line left blank. Any other line that
|
|
||||||
// does not read is an error naming it by its number.
|
// does not read is an error naming it by its number.
|
||||||
func (l *Lists) parse(
|
func (l *Lists) parse(listURL string, lines []string) (entries, error) {
|
||||||
listURL string, lines []string, fetched time.Time,
|
if listURL == l.params.ASNLimitPercentURL {
|
||||||
) (entries, error) {
|
|
||||||
switch listURL {
|
|
||||||
case l.params.ASNLimitPercentURL:
|
|
||||||
return parsePercents(lines)
|
return parsePercents(lines)
|
||||||
case l.params.CrowdSecDecisionsURL:
|
|
||||||
return parseDecisions(lines, fetched)
|
|
||||||
default:
|
|
||||||
return parseNetblocks(lines)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
return parseNetblocks(lines)
|
||||||
}
|
}
|
||||||
|
|
||||||
// parseNetblocks reads the lines of a blocklist or a tag list, each an address
|
// parseNetblocks reads the lines of a blocklist or a tag list, each an address
|
||||||
@@ -628,64 +535,6 @@ func parsePercents(lines []string) (entries, error) {
|
|||||||
return found, nil
|
return found, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// parseDecisions reads the lines of the CrowdSec decision list fetched at
|
|
||||||
// fetched: the engine's answer, a JSON list of its decisions in force,
|
|
||||||
// null while it has none. A decision of the type ban whose scope is Ip or
|
|
||||||
// Range, as CrowdSec names them, bans its value, an address or a netblock
|
|
||||||
// as parseNetblock reads it, until its duration, the time it had left as
|
|
||||||
// the engine answered, has passed since fetched. Any other decision, such
|
|
||||||
// as one to show a captcha or one on a country, is left out. A decision
|
|
||||||
// to ban whose value or duration does not read is an error naming it by
|
|
||||||
// its number.
|
|
||||||
func parseDecisions(lines []string, fetched time.Time) (entries, error) {
|
|
||||||
var answer []struct {
|
|
||||||
Duration string `json:"duration"`
|
|
||||||
Scenario string `json:"scenario"`
|
|
||||||
Scope string `json:"scope"`
|
|
||||||
Type string `json:"type"`
|
|
||||||
Value string `json:"value"`
|
|
||||||
}
|
|
||||||
|
|
||||||
err := json.Unmarshal([]byte(strings.Join(lines, "\n")), &answer)
|
|
||||||
if err != nil {
|
|
||||||
return entries{}, fmt.Errorf("read the answer: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
found := entries{decisions: map[netip.Prefix]Decision{}}
|
|
||||||
|
|
||||||
for i, decision := range answer {
|
|
||||||
if decision.Type != "ban" ||
|
|
||||||
(decision.Scope != "Ip" && decision.Scope != "Range") {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
netblock, ok := parseNetblock(decision.Value)
|
|
||||||
|
|
||||||
duration, err := time.ParseDuration(decision.Duration)
|
|
||||||
if !ok || err != nil {
|
|
||||||
return entries{}, fmt.Errorf(
|
|
||||||
"decision %d %w",
|
|
||||||
i+1,
|
|
||||||
errNotDecision,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
expires := fetched.Add(duration)
|
|
||||||
if expires.After(found.decisions[netblock].Expires) {
|
|
||||||
found.decisions[netblock] = Decision{
|
|
||||||
Expires: expires,
|
|
||||||
Scenario: decision.Scenario,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if !slices.Contains(found.lengths, netblock.Bits()) {
|
|
||||||
found.lengths = append(found.lengths, netblock.Bits())
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return found, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// withoutComment returns line without anything after a ; or a #, and
|
// withoutComment returns line without anything after a ; or a #, and
|
||||||
// without the spaces around what is left.
|
// without the spaces around what is left.
|
||||||
func withoutComment(line string) string {
|
func withoutComment(line string) string {
|
||||||
|
|||||||
@@ -29,9 +29,8 @@ const (
|
|||||||
ActionClientIsRateLimited = "client_is_rate_limited"
|
ActionClientIsRateLimited = "client_is_rate_limited"
|
||||||
|
|
||||||
// ActionTemporarilyBanned is a request refused because a ban that runs
|
// ActionTemporarilyBanned is a request refused because a ban that runs
|
||||||
// out covers its client, or because it matched a ban rule, asked for a
|
// out covers its client, or because it matched a ban rule or asked for a
|
||||||
// trap path or the CrowdSec decision list lists its client, and so made
|
// trap path, and so made such a ban.
|
||||||
// such a ban.
|
|
||||||
ActionTemporarilyBanned = "temporarily_banned"
|
ActionTemporarilyBanned = "temporarily_banned"
|
||||||
|
|
||||||
// ActionPermanentlyBanned is a request refused because a ban that never
|
// ActionPermanentlyBanned is a request refused because a ban that never
|
||||||
@@ -184,8 +183,7 @@ type Line struct {
|
|||||||
// LimitHitMinuteRefusals for the refusal limit.
|
// LimitHitMinuteRefusals for the refusal limit.
|
||||||
LimitHit string `json:"limit_hit,omitempty"`
|
LimitHit string `json:"limit_hit,omitempty"`
|
||||||
// Reputation are the URLs of the blocklists that list the client, then
|
// Reputation are the URLs of the blocklists that list the client, then
|
||||||
// that of the CrowdSec decision list when it does, then the DNSBL zones
|
// the DNSBL zones whose verdict lists it, their keys masked, then abuseipdb when its
|
||||||
// whose verdict lists it, their keys masked, then abuseipdb when its
|
|
||||||
// score is a hit.
|
// score is a hit.
|
||||||
Reputation []string `json:"reputation,omitempty"`
|
Reputation []string `json:"reputation,omitempty"`
|
||||||
// Tags are the request's tags, sorted.
|
// Tags are the request's tags, sorted.
|
||||||
|
|||||||
@@ -104,7 +104,7 @@ var (
|
|||||||
errVersion = errors.New("unknown version")
|
errVersion = errors.New("unknown version")
|
||||||
// errMissing is for an entry without a field it needs.
|
// errMissing is for an entry without a field it needs.
|
||||||
errMissing = errors.New("has no")
|
errMissing = errors.New("has no")
|
||||||
errCause = errors.New("is not limit, attack, admin or crowdsec")
|
errCause = errors.New("is not limit, attack or admin")
|
||||||
errExpires = errors.New("is not after its start")
|
errExpires = errors.New("is not after its start")
|
||||||
errDestination = errors.New("is not webhook, slack or ntfy")
|
errDestination = errors.New("is not webhook, slack or ntfy")
|
||||||
errScope = errors.New(
|
errScope = errors.New(
|
||||||
@@ -967,7 +967,7 @@ func (e BanEntry) ban() bans.Ban {
|
|||||||
// each expires is read again as written. An expires not after the start
|
// each expires is read again as written. An expires not after the start
|
||||||
// is refused too, since the netblock's next ban for a broken limit, three
|
// is refused too, since the netblock's next ban for a broken limit, three
|
||||||
// times as long as this one, would then refuse nothing; and so is a cause
|
// times as long as this one, would then refuse nothing; and so is a cause
|
||||||
// other than limit, attack, admin or crowdsec, most likely misspelt.
|
// other than limit, attack or admin, most likely misspelt.
|
||||||
func (f *bansFile) check(data []byte) error {
|
func (f *bansFile) check(data []byte) error {
|
||||||
var written struct {
|
var written struct {
|
||||||
Bans []struct {
|
Bans []struct {
|
||||||
@@ -991,8 +991,7 @@ func (f *bansFile) check(data []byte) error {
|
|||||||
case entry.Expires != nil && !entry.Expires.After(entry.Start):
|
case entry.Expires != nil && !entry.Expires.After(entry.Start):
|
||||||
return fmt.Errorf("entry %d's expires %w", i+1, errExpires)
|
return fmt.Errorf("entry %d's expires %w", i+1, errExpires)
|
||||||
case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
|
case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
|
||||||
entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin &&
|
entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin:
|
||||||
entry.Cause != bans.CauseCrowdSec:
|
|
||||||
return fmt.Errorf(
|
return fmt.Errorf(
|
||||||
"entry %d's cause %q %w",
|
"entry %d's cause %q %w",
|
||||||
i+1,
|
i+1,
|
||||||
|
|||||||
@@ -114,8 +114,7 @@ const permanentBansJSON = `{
|
|||||||
"earlier_bans": {
|
"earlier_bans": {
|
||||||
"limit": 3,
|
"limit": 3,
|
||||||
"attack": 1,
|
"attack": 1,
|
||||||
"admin": 1,
|
"admin": 1
|
||||||
"crowdsec": 2
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -1188,10 +1187,10 @@ func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
|
|||||||
`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
|
`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
|
||||||
`"expires": null, "cause": "admin"}, `+
|
`"expires": null, "cause": "admin"}, `+
|
||||||
`{"netblock": "203.0.113.11/32", "start": "2026-10-06T00:00:00Z", `+
|
`{"netblock": "203.0.113.11/32", "start": "2026-10-06T00:00:00Z", `+
|
||||||
`"expires": "2026-10-06T04:00:00Z", "cause": "crowdsec"}, `+
|
`"expires": "2026-10-06T04:00:00Z", "cause": "limit"}, `+
|
||||||
`{"netblock": "203.0.113.12/32", "start": "2026-10-06T00:00:00Z", `+
|
`{"netblock": "203.0.113.12/32", "start": "2026-10-06T00:00:00Z", `+
|
||||||
`"expires": null, "cause": "atack"}]}`,
|
`"expires": null, "cause": "atack"}]}`,
|
||||||
`: entry 4's cause "atack" is not limit, attack, admin or crowdsec`)
|
`: entry 4's cause "atack" is not limit, attack or admin`)
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestBanThatDoesNotEndAfterItsStartStopsTheStart(t *testing.T) {
|
func TestBanThatDoesNotEndAfterItsStartStopsTheStart(t *testing.T) {
|
||||||
@@ -2466,9 +2465,8 @@ func office() netip.Prefix {
|
|||||||
return netip.MustParsePrefix("203.0.113.0/24")
|
return netip.MustParsePrefix("203.0.113.0/24")
|
||||||
}
|
}
|
||||||
|
|
||||||
// fill puts a permanent ban an admin made, a ban for a broken limit, one
|
// fill puts a permanent ban an admin made, a ban for a broken limit and one
|
||||||
// for a clear sign of attack and one for CrowdSec's decision, clients
|
// for a clear sign of attack, clients with counts and histories,
|
||||||
// with counts and histories,
|
|
||||||
// GeoJS answers, the blocklists' last tries and the copy of one, two
|
// GeoJS answers, the blocklists' last tries and the copy of one, two
|
||||||
// verdicts of a DNSBL zone, the AbuseIPDB checks spent today with two
|
// verdicts of a DNSBL zone, the AbuseIPDB checks spent today with two
|
||||||
// scores, and two answers of routewatch, as filledListsJSON,
|
// scores, and two answers of routewatch, as filledListsJSON,
|
||||||
@@ -2485,13 +2483,6 @@ func fill(params state.Params) {
|
|||||||
})
|
})
|
||||||
params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
|
params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
|
||||||
bans.Notes{RuleID: "env-file", Target: "path"})
|
bans.Notes{RuleID: "env-file", Target: "path"})
|
||||||
params.Ledger.BanForCrowdSec(
|
|
||||||
netip.MustParsePrefix("198.51.100.9/32"),
|
|
||||||
now,
|
|
||||||
now.Add(4*time.Hour),
|
|
||||||
"crowdsecurity/ssh-bf",
|
|
||||||
bans.Notes{},
|
|
||||||
)
|
|
||||||
|
|
||||||
for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
|
for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
|
||||||
params.Limiter.Count(netip.MustParsePrefix(c), now, whole)
|
params.Limiter.Count(netip.MustParsePrefix(c), now, whole)
|
||||||
@@ -2637,7 +2628,6 @@ func permanentBan() bans.Ban {
|
|||||||
Limit: 3,
|
Limit: 3,
|
||||||
Attack: 1,
|
Attack: 1,
|
||||||
Admin: 1,
|
Admin: 1,
|
||||||
CrowdSec: 2,
|
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -847,92 +847,6 @@ func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
const bouncerKey = "crowdsec-key-0123456789abcdef"
|
|
||||||
|
|
||||||
// A stand-in for the engine's local API, which bans 203.0.113.0/24 for
|
|
||||||
// four hours, and answers only a request with its key, while it is up.
|
|
||||||
down := new(atomic.Bool)
|
|
||||||
engine := httptest.NewServer(http.HandlerFunc(
|
|
||||||
func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
switch {
|
|
||||||
case r.URL.Path != "/v1/decisions" || r.Header.Get("X-Api-Key") != bouncerKey:
|
|
||||||
w.WriteHeader(http.StatusForbidden)
|
|
||||||
case down.Load():
|
|
||||||
w.WriteHeader(http.StatusServiceUnavailable)
|
|
||||||
default:
|
|
||||||
_, _ = io.WriteString(
|
|
||||||
w,
|
|
||||||
`[{"duration": "4h0m0s", "origin": "crowdsec", `+
|
|
||||||
`"scenario": "crowdsecurity/http-probing", "scope": "Range", `+
|
|
||||||
`"type": "ban", "value": "203.0.113.0/24"}]`,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}))
|
|
||||||
t.Cleanup(engine.Close)
|
|
||||||
|
|
||||||
dir, cache := t.TempDir(), t.TempDir()
|
|
||||||
env := map[string]string{
|
|
||||||
listenAddr: localhost + ":0",
|
|
||||||
stateDir: dir,
|
|
||||||
cacheDir: cache,
|
|
||||||
ruleFilesDir: t.TempDir(),
|
|
||||||
"SWW_WAF_CROWDSEC_LAPI_URL": engine.URL,
|
|
||||||
"SWW_WAF_CROWDSEC_LAPI_KEY": bouncerKey,
|
|
||||||
}
|
|
||||||
|
|
||||||
// Once the list is fetched, the client's request bans it.
|
|
||||||
first := runUntilStopped(t, env, func(url string) {
|
|
||||||
for statusFrom(t, url, placed) != http.StatusForbidden {
|
|
||||||
time.Sleep(pollInterval)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
ban := onlyBan(t, dir)
|
|
||||||
if ban["netblock"] != placed+"/32" || ban["cause"] != "crowdsec" ||
|
|
||||||
ban["reason"] != "CrowdSec's decision for crowdsecurity/http-probing" {
|
|
||||||
t.Errorf(
|
|
||||||
"bans.json holds %v, want the ban for crowdsec on %s",
|
|
||||||
ban,
|
|
||||||
placed,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Restarted with the engine down, the copy kept in lists.json bans
|
|
||||||
// another client in the netblock from its first request.
|
|
||||||
down.Store(true)
|
|
||||||
|
|
||||||
second := runUntilStopped(t, env, func(url string) {
|
|
||||||
wantStatus(t, url, "203.0.113.10", http.StatusForbidden)
|
|
||||||
})
|
|
||||||
|
|
||||||
// The key is in neither run's output, nor in a state or cache file.
|
|
||||||
files := []string{
|
|
||||||
filepath.Join(dir, "bans.json"), filepath.Join(dir, "clients.json"),
|
|
||||||
filepath.Join(cache, "lists.json"),
|
|
||||||
}
|
|
||||||
shown := make([]string, 0, len(files)+2)
|
|
||||||
shown = append(shown, first.text(), second.text())
|
|
||||||
|
|
||||||
for _, path := range files {
|
|
||||||
data, err := os.ReadFile(path) //nolint:gosec // the test's
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("read %s: %v", path, err)
|
|
||||||
}
|
|
||||||
|
|
||||||
shown = append(shown, string(data))
|
|
||||||
}
|
|
||||||
|
|
||||||
if all := strings.Join(shown, "\n"); strings.Contains(all, bouncerKey) {
|
|
||||||
t.Errorf(
|
|
||||||
"the key is shown in the output or the state and cache files:\n%s",
|
|
||||||
all,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// wantDeniedByList checks that the request log line is of a request the
|
// wantDeniedByList checks that the request log line is of a request the
|
||||||
// blocklist at listURL refused.
|
// blocklist at listURL refused.
|
||||||
func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
|
func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
|
||||||
|
|||||||
@@ -48,9 +48,6 @@ const (
|
|||||||
silentAbuseIPDBURL = "silent://abuseipdb/api/v2/check"
|
silentAbuseIPDBURL = "silent://abuseipdb/api/v2/check"
|
||||||
// wholeLimit is the percentage of a rate limit that lowers it not at all.
|
// wholeLimit is the percentage of a rate limit that lowers it not at all.
|
||||||
wholeLimit = 100
|
wholeLimit = 100
|
||||||
// clientsDecision is the CrowdSec decision list holding client alone.
|
|
||||||
clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
|
|
||||||
`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// cookies returns a Cookie header's value with count cookies.
|
// cookies returns a Cookie header's value with count cookies.
|
||||||
@@ -296,10 +293,6 @@ func TestTheHeaderLimitsComeBeforeEveryCheckThatRefuses(t *testing.T) {
|
|||||||
"/", leaveAsItIs,
|
"/", leaveAsItIs,
|
||||||
},
|
},
|
||||||
{"a blocklist", map[string]string{blocklistURLs: dropURL}, "/", listClient},
|
{"a blocklist", map[string]string{blocklistURLs: dropURL}, "/", listClient},
|
||||||
{
|
|
||||||
"the CrowdSec decision list",
|
|
||||||
map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey}, "/", decideOnClient,
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"a DNS blocklist", map[string]string{
|
"a DNS blocklist", map[string]string{
|
||||||
dnsblZones: dnsblZone, dnsblResolver: noResolver, dnsblAbuseIPDBAction: actionDeny,
|
dnsblZones: dnsblZone, dnsblResolver: noResolver, dnsblAbuseIPDBAction: actionDeny,
|
||||||
@@ -592,12 +585,6 @@ func listClient(t *testing.T, server *waf.Server, now time.Time) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// decideOnClient puts client on the CrowdSec decision list.
|
|
||||||
func decideOnClient(t *testing.T, server *waf.Server, now time.Time) {
|
|
||||||
t.Helper()
|
|
||||||
loadDecisions(t, server, now, clientsDecision)
|
|
||||||
}
|
|
||||||
|
|
||||||
// leaveAsItIs prepares nothing.
|
// leaveAsItIs prepares nothing.
|
||||||
func leaveAsItIs(*testing.T, *waf.Server, time.Time) {}
|
func leaveAsItIs(*testing.T, *waf.Server, time.Time) {}
|
||||||
|
|
||||||
@@ -641,12 +628,6 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
|
|||||||
name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
|
name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
|
||||||
prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
|
prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
|
||||||
},
|
},
|
||||||
{
|
|
||||||
name: "the CrowdSec decision list",
|
|
||||||
env: map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
|
|
||||||
prepare: decideOnClient, status: forbidden,
|
|
||||||
action: requestlog.ActionTemporarilyBanned,
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
name: "the header limits", cookie: cookies(cookieLimit + 1),
|
name: "the header limits", cookie: cookies(cookieLimit + 1),
|
||||||
prepare: leaveAsItIs, status: tooLarge,
|
prepare: leaveAsItIs, status: tooLarge,
|
||||||
@@ -774,7 +755,6 @@ func TestWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(
|
|||||||
dnsblZones: dnsblZone, dnsblResolver: resolver,
|
dnsblZones: dnsblZone, dnsblResolver: resolver,
|
||||||
abuseIPDBKey: accountKey,
|
abuseIPDBKey: accountKey,
|
||||||
blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
|
blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
|
||||||
crowdSecURL: held, crowdSecKey: bouncerKey,
|
|
||||||
})
|
})
|
||||||
|
|
||||||
// The lists are fetched outside the synctest bubble below: a wait on the
|
// The lists are fetched outside the synctest bubble below: a wait on the
|
||||||
|
|||||||
@@ -11,7 +11,6 @@ import (
|
|||||||
"sneak.berlin/go/smallwebwaf/internal/alerts"
|
"sneak.berlin/go/smallwebwaf/internal/alerts"
|
||||||
"sneak.berlin/go/smallwebwaf/internal/bans"
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
||||||
"sneak.berlin/go/smallwebwaf/internal/ratelimit"
|
"sneak.berlin/go/smallwebwaf/internal/ratelimit"
|
||||||
"sneak.berlin/go/smallwebwaf/internal/reputation"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
||||||
)
|
)
|
||||||
|
|
||||||
@@ -206,57 +205,6 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
|
|||||||
return banAction(ban.Permanent())
|
return banAction(ban.Permanent())
|
||||||
}
|
}
|
||||||
|
|
||||||
// banForCrowdSec bans the client's netblock at now until decision,
|
|
||||||
// CrowdSec's decision on the client, ends. In observe mode it makes no
|
|
||||||
// ban, and raises the alert for the ban it would have made, if that alert
|
|
||||||
// would be sent. It returns the action for that ban.
|
|
||||||
func (rq *request) banForCrowdSec(
|
|
||||||
now time.Time,
|
|
||||||
decision reputation.Decision,
|
|
||||||
) string {
|
|
||||||
netblock := rq.h.netblock(rq.client)
|
|
||||||
if rq.h.config.Observe &&
|
|
||||||
!rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
|
|
||||||
return banAction(
|
|
||||||
rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec),
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
notes := bans.Notes{
|
|
||||||
ASN: rq.line.ASN,
|
|
||||||
ASName: rq.line.ASName,
|
|
||||||
Country: rq.line.Country,
|
|
||||||
Reputation: rq.reputation,
|
|
||||||
Request: rq.noted(now, rq.h.config.BanResponse),
|
|
||||||
Requests: rq.netblockRequests(netblock),
|
|
||||||
}
|
|
||||||
|
|
||||||
if rq.h.config.Observe {
|
|
||||||
ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(
|
|
||||||
netblock,
|
|
||||||
now,
|
|
||||||
decision.Expires,
|
|
||||||
decision.Scenario,
|
|
||||||
notes,
|
|
||||||
)
|
|
||||||
if wouldBan {
|
|
||||||
rq.alertBan(ban)
|
|
||||||
}
|
|
||||||
|
|
||||||
return banAction(ban.Permanent())
|
|
||||||
}
|
|
||||||
|
|
||||||
ban, made := rq.h.ledger.BanForCrowdSec(netblock, now, decision.Expires,
|
|
||||||
decision.Scenario, notes)
|
|
||||||
rq.line.BanExpires = banExpires(ban)
|
|
||||||
|
|
||||||
if made {
|
|
||||||
rq.alertBan(ban)
|
|
||||||
}
|
|
||||||
|
|
||||||
return banAction(ban.Permanent())
|
|
||||||
}
|
|
||||||
|
|
||||||
// wouldAlertBan reports whether the alert for a ban on netblock for cause
|
// wouldAlertBan reports whether the alert for a ban on netblock for cause
|
||||||
// made at now would be sent. In observe mode the ban the request would
|
// made at now would be sent. In observe mode the ban the request would
|
||||||
// have made is worked out only then, at most once per
|
// have made is worked out only then, at most once per
|
||||||
|
|||||||
@@ -1,54 +0,0 @@
|
|||||||
package waf
|
|
||||||
|
|
||||||
// The heuristic crowdsec. It reads SWW_WAF_CROWDSEC_LAPI_URL, and the decisions
|
|
||||||
// through the reputation lists.
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/config"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/reputation"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
||||||
)
|
|
||||||
|
|
||||||
// crowdSec refuses a request when a decision of the CrowdSec decision list on
|
|
||||||
// the client is in force at now. It then adds the tag crowdsec, notes the
|
|
||||||
// list, as noteHit does, and bans the client until that decision ends. Its
|
|
||||||
// figures are the decision's scenario and when it ends.
|
|
||||||
type crowdSec struct{}
|
|
||||||
|
|
||||||
func (crowdSec) name() string { return "crowdsec" }
|
|
||||||
|
|
||||||
func (crowdSec) check(
|
|
||||||
_ context.Context,
|
|
||||||
rq *request,
|
|
||||||
now time.Time,
|
|
||||||
) *verdict {
|
|
||||||
decision, listed := rq.crowdSecDecisionInForce(now)
|
|
||||||
if !listed {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
rq.addTag(config.CrowdSecTag)
|
|
||||||
rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
|
|
||||||
"listed by the CrowdSec decision list")
|
|
||||||
|
|
||||||
return &verdict{
|
|
||||||
action: rq.banForCrowdSec(now, decision),
|
|
||||||
figures: map[string]any{
|
|
||||||
"scenario": decision.Scenario,
|
|
||||||
"expires": requestlog.FormatTime(decision.Expires),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// crowdSecDecisionInForce returns the decision of the CrowdSec decision list on
|
|
||||||
// the client that is in force at now, and reports whether there is one, which
|
|
||||||
// the heuristic crowdsec refuses the request for.
|
|
||||||
func (rq *request) crowdSecDecisionInForce(
|
|
||||||
now time.Time,
|
|
||||||
) (reputation.Decision, bool) {
|
|
||||||
return rq.h.lists.CrowdSecDecision(rq.client, now)
|
|
||||||
}
|
|
||||||
@@ -1,249 +0,0 @@
|
|||||||
package waf_test
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net/http"
|
|
||||||
"net/netip"
|
|
||||||
"reflect"
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/alerts"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/reputation"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
||||||
"sneak.berlin/go/smallwebwaf/internal/waf"
|
|
||||||
)
|
|
||||||
|
|
||||||
// The CrowdSec settings, and the tests' engine, which is never asked: each
|
|
||||||
// test puts in the copy of its decision list, at decisionsURL, that it
|
|
||||||
// needs, as lists.json would at start.
|
|
||||||
const (
|
|
||||||
crowdSecURL = "SWW_WAF_CROWDSEC_LAPI_URL"
|
|
||||||
crowdSecKey = "SWW_WAF_CROWDSEC_LAPI_KEY"
|
|
||||||
lapi = "http://crowdsec.example:8080"
|
|
||||||
decisionsURL = lapi + "/v1/decisions"
|
|
||||||
bouncerKey = "crowdsec-key-0123456789abcdef"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
s, clk, server, queue := startWithAlerts(t, map[string]string{
|
|
||||||
crowdSecURL: lapi, crowdSecKey: bouncerKey, metricsToken: token,
|
|
||||||
})
|
|
||||||
// client had four hours left on its decision as the engine answered.
|
|
||||||
fetched := clk.Now()
|
|
||||||
loadDecisions(t, server, fetched, `[{"duration": "4h0m0s", `+
|
|
||||||
`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
|
|
||||||
`"value": "`+client+`"}]`)
|
|
||||||
expires := requestlog.FormatTime(fetched.Add(4 * time.Hour))
|
|
||||||
|
|
||||||
// Its first request is refused, and bans it until the decision ends.
|
|
||||||
banned := requestlog.ActionTemporarilyBanned
|
|
||||||
line := s.get(client, http.StatusForbidden, banned)
|
|
||||||
wantReputation(t, line, decisionsURL)
|
|
||||||
|
|
||||||
if line.BanExpires != expires {
|
|
||||||
t.Errorf("log line has ban_expires %q, want %s",
|
|
||||||
line.BanExpires, expires)
|
|
||||||
}
|
|
||||||
|
|
||||||
listed := []bans.ReputationHit{{Source: decisionsURL}}
|
|
||||||
|
|
||||||
held := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
|
|
||||||
if len(held) != 1 || held[0].Cause != bans.CauseCrowdSec ||
|
|
||||||
!held[0].Start.Equal(fetched) ||
|
|
||||||
!held[0].Expires.Equal(fetched.Add(4*time.Hour)) ||
|
|
||||||
held[0].Reason != "CrowdSec's decision for crowdsecurity/ssh-bf" ||
|
|
||||||
!reflect.DeepEqual(held[0].Notes.Reputation, listed) ||
|
|
||||||
held[0].Notes.Request.Path != "/" || held[0].Notes.Requests != 1 {
|
|
||||||
t.Fatalf(
|
|
||||||
"bans %+v, want one for crowdsec of four hours, with the list and "+
|
|
||||||
"the request in its notes",
|
|
||||||
held,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
// The listing raises a reputation_hit alert, and the ban its own.
|
|
||||||
waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
|
|
||||||
if len(waiting) != 2 || waiting[0].Event != alerts.EventReputationHit ||
|
|
||||||
waiting[0].Reason != "listed by the CrowdSec decision list" ||
|
|
||||||
!reflect.DeepEqual(
|
|
||||||
waiting[1],
|
|
||||||
banAlert(alerts.EventBan, fetched, client, held[0],
|
|
||||||
expires),
|
|
||||||
) {
|
|
||||||
t.Errorf(
|
|
||||||
"alerts waiting %+v, want a reputation_hit alert, then the ban's",
|
|
||||||
waiting,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Each request while the ban lasts is refused under it, as under any
|
|
||||||
// ban, and once it has ended the client is let through.
|
|
||||||
clk.advance(4*time.Hour - time.Second)
|
|
||||||
|
|
||||||
line = s.get(client, http.StatusForbidden, banned)
|
|
||||||
wantReputation(t, line)
|
|
||||||
|
|
||||||
if line.BanExpires != expires {
|
|
||||||
t.Errorf("log line has ban_expires %q, want %s",
|
|
||||||
line.BanExpires, expires)
|
|
||||||
}
|
|
||||||
|
|
||||||
clk.advance(time.Second)
|
|
||||||
s.get(client, http.StatusOK, requestlog.ActionForward)
|
|
||||||
|
|
||||||
// The ban and the hit are counted, and the list has the metrics of any
|
|
||||||
// list fetched from a URL.
|
|
||||||
metrics := s.scrape()
|
|
||||||
labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
|
|
||||||
|
|
||||||
wantMetric(t, metrics, `sww_bans_made_total{cause="crowdsec",`+
|
|
||||||
`instance="`+alertInstance+`"}`, 1)
|
|
||||||
wantMetric(t, metrics, "sww_reputation_hits_total"+labels, 1)
|
|
||||||
wantMetric(t, metrics, "sww_reputation_failures_total"+labels, 0)
|
|
||||||
wantMetric(
|
|
||||||
t,
|
|
||||||
metrics,
|
|
||||||
"sww_reputation_last_fetch_timestamp_seconds"+labels,
|
|
||||||
float64(fetched.Unix()),
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCrowdSecBanNamesItsHeuristicScenarioAndEnd(t *testing.T) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
s, clk, server, _ := startWithAlerts(t, map[string]string{
|
|
||||||
crowdSecURL: lapi, crowdSecKey: bouncerKey,
|
|
||||||
})
|
|
||||||
loadDecisions(t, server, clk.Now(), `[{"duration": "4h0m0s", `+
|
|
||||||
`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
|
|
||||||
`"value": "`+client+`"}]`)
|
|
||||||
|
|
||||||
line := s.get(
|
|
||||||
client,
|
|
||||||
http.StatusForbidden,
|
|
||||||
requestlog.ActionTemporarilyBanned,
|
|
||||||
)
|
|
||||||
wantHeuristic(
|
|
||||||
t,
|
|
||||||
line,
|
|
||||||
"crowdsec",
|
|
||||||
`{"scenario": "crowdsecurity/ssh-bf", `+
|
|
||||||
`"expires": "`+requestlog.FormatTime(clk.Now().Add(4*time.Hour))+`"}`,
|
|
||||||
)
|
|
||||||
wantTags(t, line, "crowdsec")
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestEndedCrowdSecDecisionNoLongerBansThoughTheCopyStillHoldsIt(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
s, clk, server := startWithClock(t, "", map[string]string{
|
|
||||||
crowdSecURL: lapi, crowdSecKey: bouncerKey,
|
|
||||||
})
|
|
||||||
// 198.51.100.0/24 and 2001:db8::9 had a minute left as the engine
|
|
||||||
// answered.
|
|
||||||
fetched := clk.Now()
|
|
||||||
loadDecisions(t, server, fetched, `[{"duration": "1m0s", `+
|
|
||||||
`"scenario": "crowdsecurity/http-probing", "scope": "Range", "type": "ban", `+
|
|
||||||
`"value": "198.51.100.0/24"}, {"duration": "1m0s", `+
|
|
||||||
`"scenario": "crowdsecurity/http-probing", "scope": "Ip", "type": "ban", `+
|
|
||||||
`"value": "2001:db8::9"}]`)
|
|
||||||
|
|
||||||
// Just before its end, the decision bans a client in the netblock, and
|
|
||||||
// one on an IPv6 address bans the address's group, the /64.
|
|
||||||
clk.advance(time.Minute - time.Nanosecond)
|
|
||||||
s.get(
|
|
||||||
"198.51.100.7",
|
|
||||||
http.StatusForbidden,
|
|
||||||
requestlog.ActionTemporarilyBanned,
|
|
||||||
)
|
|
||||||
s.get(
|
|
||||||
"2001:db8::9",
|
|
||||||
http.StatusForbidden,
|
|
||||||
requestlog.ActionTemporarilyBanned,
|
|
||||||
)
|
|
||||||
s.get(
|
|
||||||
"2001:db8::5",
|
|
||||||
http.StatusForbidden,
|
|
||||||
requestlog.ActionTemporarilyBanned,
|
|
||||||
)
|
|
||||||
|
|
||||||
// Once it has ended, it bans no other client, and the bans it made end
|
|
||||||
// with it.
|
|
||||||
clk.advance(time.Nanosecond)
|
|
||||||
|
|
||||||
for _, from := range []string{"198.51.100.8", "198.51.100.7", "2001:db8::5"} {
|
|
||||||
wantReputation(
|
|
||||||
t,
|
|
||||||
s.get(from, http.StatusOK, requestlog.ActionForward),
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
if made := server.Ledger.Made(bans.CauseCrowdSec); made != 2 {
|
|
||||||
t.Errorf(
|
|
||||||
"%d bans made for crowdsec, want 2, on 198.51.100.7/32 and "+
|
|
||||||
"2001:db8::/64",
|
|
||||||
made,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
if held := server.Ledger.Bans(netip.MustParsePrefix("2001:db8::/64")); len(
|
|
||||||
held,
|
|
||||||
) != 1 {
|
|
||||||
t.Errorf("bans of 2001:db8::/64 %+v, want one", held)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
|
|
||||||
t *testing.T,
|
|
||||||
) {
|
|
||||||
t.Parallel()
|
|
||||||
|
|
||||||
s, clk, server, queue := startWithAlerts(t, map[string]string{
|
|
||||||
crowdSecURL: lapi, crowdSecKey: bouncerKey, mode: observe,
|
|
||||||
})
|
|
||||||
loadDecisions(t, server, clk.Now(), `[{"duration": "4h0m0s", `+
|
|
||||||
`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
|
|
||||||
`"value": "`+client+`"}]`)
|
|
||||||
|
|
||||||
line := s.get(client, http.StatusOK, requestlog.ActionForward)
|
|
||||||
wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
|
|
||||||
wantReputation(t, line, decisionsURL)
|
|
||||||
|
|
||||||
if held := server.Ledger.Snapshot(); len(held) != 0 {
|
|
||||||
t.Errorf("bans %+v, want none", held)
|
|
||||||
}
|
|
||||||
|
|
||||||
waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
|
|
||||||
if len(waiting) != 2 || waiting[1].Event != alerts.EventBan ||
|
|
||||||
waiting[1].Detail["cause"] != bans.CauseCrowdSec ||
|
|
||||||
waiting[1].Detail["mode"] != observe {
|
|
||||||
t.Errorf(
|
|
||||||
"alerts waiting %+v, want a reputation_hit alert, then the ban alert "+
|
|
||||||
"marked observe",
|
|
||||||
waiting,
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// loadDecisions puts into server's lists the copy of the decision list at
|
|
||||||
// decisionsURL, answer, the engine's answer, fetched at fetched, as
|
|
||||||
// lists.json would at start.
|
|
||||||
func loadDecisions(
|
|
||||||
t *testing.T, server *waf.Server, fetched time.Time, answer string,
|
|
||||||
) {
|
|
||||||
t.Helper()
|
|
||||||
|
|
||||||
err := server.Lists.Load([]reputation.List{{
|
|
||||||
URL: decisionsURL, Tried: fetched, Fetched: fetched, Lines: []string{answer},
|
|
||||||
}})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("load the decision list: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -60,7 +60,6 @@ func afterLookup() []heuristic {
|
|||||||
return []heuristic{
|
return []heuristic{
|
||||||
countries{},
|
countries{},
|
||||||
blocklists{},
|
blocklists{},
|
||||||
crowdSec{},
|
|
||||||
dnsbl{},
|
dnsbl{},
|
||||||
abuseIPDB{},
|
abuseIPDB{},
|
||||||
tagDeny{},
|
tagDeny{},
|
||||||
|
|||||||
@@ -75,8 +75,8 @@ type Params struct {
|
|||||||
Rules *rules.Files
|
Rules *rules.Files
|
||||||
// Alerts receive the alert for each ban waf makes or makes
|
// Alerts receive the alert for each ban waf makes or makes
|
||||||
// permanent, for each count over an anomaly threshold, for each request
|
// permanent, for each count over an anomaly threshold, for each request
|
||||||
// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
|
// whose client a blocklist, a DNSBL zone or AbuseIPDB lists, for each
|
||||||
// AbuseIPDB lists, for each request the Core Rule Set scores at or over
|
// request the Core Rule Set scores at or over
|
||||||
// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD, and for GeoJS failing, a fetch of a list
|
// SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD, and for GeoJS failing, a fetch of a list
|
||||||
// failing, a query to a DNSBL zone or a check with AbuseIPDB failing,
|
// failing, a query to a DNSBL zone or a check with AbuseIPDB failing,
|
||||||
// or the day's AbuseIPDB checks used up.
|
// or the day's AbuseIPDB checks used up.
|
||||||
@@ -194,11 +194,13 @@ func newReputation(
|
|||||||
) (*reputation.Lists, *reputation.DNSBL, *reputation.AbuseIPDB) {
|
) (*reputation.Lists, *reputation.DNSBL, *reputation.AbuseIPDB) {
|
||||||
cfg := params.Config
|
cfg := params.Config
|
||||||
lists := reputation.New(reputation.Params{
|
lists := reputation.New(reputation.Params{
|
||||||
BlocklistURLs: cfg.BlocklistURLs, Refresh: cfg.BlocklistRefresh,
|
BlocklistURLs: cfg.BlocklistURLs,
|
||||||
|
Refresh: cfg.BlocklistRefresh,
|
||||||
ASNLimitPercentURL: cfg.ASNLimitPercentURL,
|
ASNLimitPercentURL: cfg.ASNLimitPercentURL,
|
||||||
TagLists: cfg.TagLists,
|
TagLists: cfg.TagLists,
|
||||||
CrowdSecDecisionsURL: cfg.CrowdSecDecisionsURL, CrowdSecKey: cfg.CrowdSecKey,
|
Now: params.Now,
|
||||||
Now: params.Now, ProcessLog: params.ProcessLog, Alerts: params.Alerts,
|
ProcessLog: params.ProcessLog,
|
||||||
|
Alerts: params.Alerts,
|
||||||
})
|
})
|
||||||
dnsbl := reputation.NewDNSBL(reputation.DNSBLParams{
|
dnsbl := reputation.NewDNSBL(reputation.DNSBLParams{
|
||||||
Zones: cfg.DNSBLZones, Resolver: cfg.DNSBLResolver,
|
Zones: cfg.DNSBLZones, Resolver: cfg.DNSBLResolver,
|
||||||
|
|||||||
@@ -1,7 +1,6 @@
|
|||||||
package waf
|
package waf
|
||||||
|
|
||||||
// What the reputation heuristics share: blocklists, crowdsec, dnsbl and
|
// What the reputation heuristics share: blocklists, dnsbl and abuseipdb.
|
||||||
// abuseipdb.
|
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"sneak.berlin/go/smallwebwaf/internal/alerts"
|
"sneak.berlin/go/smallwebwaf/internal/alerts"
|
||||||
|
|||||||
+3
-6
@@ -146,18 +146,15 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|||||||
|
|
||||||
// refusedWhateverTheAnswer reports whether the request is one that does not wait
|
// refusedWhateverTheAnswer reports whether the request is one that does not wait
|
||||||
// for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
|
// for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
|
||||||
// its client: the heuristic crowdsec, blocklists or rate_limits will refuse it,
|
// its client: the heuristic blocklists or rate_limits will refuse it, as a
|
||||||
// as a function in that heuristic's file says. In observe mode, which refuses
|
// function in that heuristic's file says. In observe mode, which refuses
|
||||||
// nothing, none is. rproxy lets a request through when waf answers too late.
|
// nothing, none is. rproxy lets a request through when waf answers too late.
|
||||||
func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
|
func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
|
||||||
if rq.h.config.Observe {
|
if rq.h.config.Observe {
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
_, decided := rq.crowdSecDecisionInForce(now)
|
return rq.refusedByBlocklists(rq.h.lists.ListedBy(rq.client)) ||
|
||||||
|
|
||||||
return decided ||
|
|
||||||
rq.refusedByBlocklists(rq.h.lists.ListedBy(rq.client)) ||
|
|
||||||
rq.overAWholeRateLimit(now)
|
rq.overAWholeRateLimit(now)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Reference in new issue
Block a user