sneak
14e8ee7413
check / check (push) Waiting to run
Each check servewaf runs on a request is a type in its own file behind one interface, heuristic, and is registered in one of four ordered lists in heuristics.go. Order and behaviour are unchanged. Every refusal now logs heuristic, the name of the heuristic that made it, and heuristic_figures, the figures it acted on. A ban by refusal_limit or byte_limits after the answer logs report_heuristic and report_heuristic_figures instead, so a line can name both. All four are in docs/request-log.md, and SPEC.md names each heuristic at its step. Model: opus-5-5
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package servewaf
|
|
|
|
// The heuristic blocklists. It reads SWWAF_BLOCKLIST_ACTION, and the blocklists
|
|
// through the reputation lists.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// blocklists notes the blocklists that list the client, as noteListed does,
|
|
// and refuses the request when SWWAF_BLOCKLIST_ACTION is deny. Being limit, it
|
|
// lowers the client's limits instead (see limitPercentages), and being log, it
|
|
// does nothing more. Its figure is the blocklists that list the client.
|
|
type blocklists struct{}
|
|
|
|
func (blocklists) name() string { return "blocklists" }
|
|
|
|
func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
listedBy := rq.h.lists.ListedBy(rq.client)
|
|
rq.blocklisted = len(listedBy) > 0
|
|
rq.noteListed(listedBy, "listed by a blocklist")
|
|
|
|
if !rq.refusedByBlocklists(listedBy) {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionDenied,
|
|
figures: map[string]any{"lists": listedBy},
|
|
}
|
|
}
|
|
|
|
// refusedByBlocklists reports whether the heuristic blocklists refuses a
|
|
// client, given listedBy, the blocklists that list it: it does when one lists
|
|
// it and SWWAF_BLOCKLIST_ACTION is deny.
|
|
func (rq *request) refusedByBlocklists(listedBy []string) bool {
|
|
return len(listedBy) > 0 && rq.h.config.BlocklistAction == deny
|
|
}
|