clawbot
27f0007b54
check / check (push) Waiting to run
A path rule matched only the path as the client sent it, so /%2eenv got past the default env-file rule while an app that decodes the path serves /.env. A path rule now matches the path as sent or decoded once, as a uri rule already did, and so does a path in SWWAF_TRAP_PATHS: /%77p-login.php matches /wp-login.php. The query is cut off before the path is decoded, and the path is decoded only once, so /%252eenv is not /.env. A ban's notes keep the path as sent. SPEC.md and README.md say so. Model: opus-5-5
131 lines
3.8 KiB
Go
131 lines
3.8 KiB
Go
package proxy_test
|
|
|
|
import (
|
|
"net/http"
|
|
"net/netip"
|
|
"reflect"
|
|
"testing"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// trapPaths is the setting's name, and trapPathList what the tests set it
|
|
// to.
|
|
const (
|
|
trapPaths = "SWWAF_TRAP_PATHS"
|
|
trapPathList = "/wp-login.php,/xmlrpc.php"
|
|
)
|
|
|
|
func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
|
|
|
|
// A block rule for the same path: the trap path comes first.
|
|
s, clk, server := startWithClock(t, "", map[string]string{
|
|
trapPaths: trapPathList,
|
|
rulesDir: writeRules(t, `wp path block ^/wp-login\.php$`),
|
|
allowNets: allowed,
|
|
banResponse: "429",
|
|
})
|
|
start := clk.Now()
|
|
|
|
// Only the path itself, the whole of it in the same case, is a trap
|
|
// path.
|
|
for _, path := range []string{"/wp-login.php/", "/WP-LOGIN.PHP", "/blog/xmlrpc.php"} {
|
|
s.request(otherClient, path, http.StatusOK, requestlog.ActionForward)
|
|
}
|
|
|
|
// A client in SWWAF_ALLOW_NETS is not checked.
|
|
s.request(allowed, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
|
|
|
|
// The query is not part of the path.
|
|
line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusTooManyRequests,
|
|
requestlog.ActionBanned)
|
|
wantRuleIDs(t, line)
|
|
|
|
if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
|
|
t.Errorf("log line has ban_expires %q, want seven days on", line.BanExpires)
|
|
}
|
|
|
|
netblock := netip.MustParsePrefix(client + "/32")
|
|
want := bans.Ban{
|
|
Netblock: netblock,
|
|
Start: start,
|
|
Expires: start.Add(7 * 24 * time.Hour),
|
|
Cause: bans.CauseAttack,
|
|
Reason: "asked for the trap path /wp-login.php",
|
|
Notes: bans.Notes{
|
|
TrapPath: "/wp-login.php",
|
|
Request: bans.Request{
|
|
Time: start,
|
|
Method: http.MethodGet,
|
|
Host: appHost,
|
|
Path: "/wp-login.php?redirect_to=x",
|
|
Status: http.StatusTooManyRequests,
|
|
UserAgent: userAgent,
|
|
},
|
|
Requests: 1,
|
|
},
|
|
}
|
|
|
|
got := server.Ledger.Bans(netblock)
|
|
if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
|
|
t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
|
|
}
|
|
|
|
// The next request is refused under the ban, and makes it permanent.
|
|
line = s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
|
|
if line.BanExpires != permanent {
|
|
t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
|
|
}
|
|
}
|
|
|
|
func TestTrapPathMatchesThePathDecodedOnce(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
s, _, server := startWithClock(t, "", map[string]string{trapPaths: trapPathList})
|
|
|
|
// %2577 decodes once to %77, not to w.
|
|
s.request(otherClient, "/%2577p-login.php", http.StatusOK, requestlog.ActionForward)
|
|
s.request(client, "/%77p-login.php", http.StatusForbidden, requestlog.ActionBanned)
|
|
|
|
// The ban's notes give the path as the client sent it.
|
|
got := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
|
|
if len(got) != 1 || got[0].Notes.TrapPath != "/%77p-login.php" {
|
|
t.Fatalf("bans %+v, want one whose notes give the trap path /%%77p-login.php", got)
|
|
}
|
|
}
|
|
|
|
func TestTrapPathsNeedNoRuleFiles(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
s, _, _ := startWithClock(t, "", map[string]string{
|
|
trapPaths: trapPathList,
|
|
"SWWAF_RULES_ENABLED": "false",
|
|
})
|
|
|
|
s.request(client, "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned)
|
|
}
|
|
|
|
func TestObserveModeLogsWhatATrapPathWouldDo(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
s, _, server := startWithClock(t, "", map[string]string{
|
|
trapPaths: trapPathList,
|
|
mode: observe,
|
|
})
|
|
|
|
line := s.request(client, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
|
|
wantWouldAction(t, line, requestlog.ActionBanned)
|
|
|
|
// No ban was made.
|
|
s.get(client, http.StatusOK, requestlog.ActionForward)
|
|
|
|
if got := server.Ledger.Snapshot(); len(got) != 0 {
|
|
t.Errorf("bans %+v, want none", got)
|
|
}
|
|
}
|