clawbot
719691d1e8
check / check (push) Failing after 3m22s
The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234. Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`. Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`. Model: opus-5-5
70 lines
2.3 KiB
Go
70 lines
2.3 KiB
Go
package discriminator
|
|
|
|
// The heuristic rate_limits. It reads SWW_RATE_LIMIT_EXEMPT_NETS,
|
|
// SWW_RATE_LIMIT_EXEMPT_PATHS and SWW_BAN_RESPONSE, and the rate limits and
|
|
// biased thresholds through the limiter and limitPercentages.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// rateLimits counts the request for the rate limits, unless
|
|
// countedByRateLimits exempts it, by the client's limit percentages, which it
|
|
// notes for the log line with the client's counts. A request that takes the
|
|
// client over a rate limit, as its limit percentage lowers it, breaks it: it is
|
|
// refused, and bans the client. A request exempt from the rate limits is exempt
|
|
// from the byte limits too. Its figures are the window, the count and the
|
|
// limit.
|
|
type rateLimits struct{}
|
|
|
|
func (rateLimits) name() string { return "rate_limits" }
|
|
|
|
func (rateLimits) check(_ context.Context, rq *request, now time.Time) *verdict {
|
|
rq.counted = rq.countedByRateLimits()
|
|
if !rq.counted {
|
|
return nil
|
|
}
|
|
|
|
rq.rateLimitPercent, rq.bytesLimitPercent = rq.limitPercentages()
|
|
rq.line.RateLimitPercent, rq.line.RateLimitPercentSetting =
|
|
rq.rateLimitPercent.logged()
|
|
rq.line.BytesLimitPercent, rq.line.BytesLimitPercentSetting =
|
|
rq.bytesLimitPercent.logged()
|
|
|
|
counts, hit, over := rq.h.limiter.Count(rq.h.clientGroup(rq.client), now,
|
|
rq.rateLimitPercent.percent)
|
|
rq.line.Counts = counts
|
|
|
|
if !over {
|
|
return nil
|
|
}
|
|
|
|
rq.banForLimit(now, hit, rq.h.config.BanResponse)
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionClientIsRateLimited, figures: limitFigures(hit),
|
|
}
|
|
}
|
|
|
|
// overAWholeRateLimit reports whether the heuristic rate_limits will refuse the
|
|
// request at now, whatever its client's limit percentages: the rate limits
|
|
// count it, and one more request from its client takes it over a whole rate
|
|
// limit. It counts nothing.
|
|
func (rq *request) overAWholeRateLimit(now time.Time) bool {
|
|
return rq.countedByRateLimits() &&
|
|
rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now)
|
|
}
|
|
|
|
// countedByRateLimits reports whether the rate limits count the request: its
|
|
// client is not in SWW_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
|
|
// under SWW_RATE_LIMIT_EXEMPT_PATHS.
|
|
func (rq *request) countedByRateLimits() bool {
|
|
cfg := rq.h.config
|
|
|
|
return !isInside(rq.client, cfg.RateLimitExemptNets) &&
|
|
!pathExempt(rq.in, cfg.RateLimitExemptPaths)
|
|
}
|