sneak
7f8a59de04
check / check (push) Waiting to run
script/fmt now runs golines -m 77 after gofmt, repeating golines until it changes nothing, since one pass can leave a line the next splits. script/fmt-check fails when either would change a file. script/bootstrap installs golines v0.13.0 with go install, pinned to its commit, and checks the installed version with go version -m. The tree is reformatted. The longer lines this makes are fixed by hand: nolint directives moved onto their own line above the statement, one string split, and 20 functions over funlen's 80 lines shortened or split, RunWAF and limitPercentages among them. Model: opus-5-5
46 lines
1.3 KiB
Go
46 lines
1.3 KiB
Go
package waf
|
|
|
|
// The heuristic blocklists. It reads SWW_BLOCKLIST_ACTION, and the blocklists
|
|
// through the reputation lists.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// blocklists notes the blocklists that list the client, as noteListed does,
|
|
// and refuses the request when SWW_BLOCKLIST_ACTION is deny. Being limit, it
|
|
// lowers the client's limits instead (see limitPercentages), and being log, it
|
|
// does nothing more. Its figure is the blocklists that list the client.
|
|
type blocklists struct{}
|
|
|
|
func (blocklists) name() string { return "blocklists" }
|
|
|
|
func (blocklists) check(
|
|
_ context.Context,
|
|
rq *request,
|
|
_ time.Time,
|
|
) *verdict {
|
|
listedBy := rq.h.lists.ListedBy(rq.client)
|
|
rq.blocklisted = len(listedBy) > 0
|
|
rq.noteListed(listedBy, "listed by a blocklist")
|
|
|
|
if !rq.refusedByBlocklists(listedBy) {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionClientDenied,
|
|
figures: map[string]any{"lists": listedBy},
|
|
}
|
|
}
|
|
|
|
// refusedByBlocklists reports whether the heuristic blocklists refuses a
|
|
// client, given listedBy, the blocklists that list it: it does when one lists
|
|
// it and SWW_BLOCKLIST_ACTION is deny.
|
|
func (rq *request) refusedByBlocklists(listedBy []string) bool {
|
|
return len(listedBy) > 0 && rq.h.config.BlocklistAction == deny
|
|
}
|