sneak
14e8ee7413
check / check (push) Waiting to run
Each check servewaf runs on a request is a type in its own file behind one interface, heuristic, and is registered in one of four ordered lists in heuristics.go. Order and behaviour are unchanged. Every refusal now logs heuristic, the name of the heuristic that made it, and heuristic_figures, the figures it acted on. A ban by refusal_limit or byte_limits after the answer logs report_heuristic and report_heuristic_figures instead, so a line can name both. All four are in docs/request-log.md, and SPEC.md names each heuristic at its step. Model: opus-5-5
66 lines
2.3 KiB
Go
66 lines
2.3 KiB
Go
package servewaf
|
|
|
|
// The heuristic rate_limits. It reads SWWAF_RATE_LIMIT_EXEMPT_NETS,
|
|
// SWWAF_RATE_LIMIT_EXEMPT_PATHS and SWWAF_BAN_RESPONSE, and the rate limits and
|
|
// biased thresholds through the limiter and limitPercentages.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// rateLimits counts the request for the rate limits, unless
|
|
// countedByRateLimits exempts it, by the client's limit percentages, which it
|
|
// notes for the log line with the client's counts. A request that takes the
|
|
// client over a rate limit, as its limit percentage lowers it, breaks it: it is
|
|
// refused, and bans the client. A request exempt from the rate limits is exempt
|
|
// from the byte limits too. Its figures are the window, the count and the
|
|
// limit.
|
|
type rateLimits struct{}
|
|
|
|
func (rateLimits) name() string { return "rate_limits" }
|
|
|
|
func (rateLimits) check(_ context.Context, rq *request, now time.Time) *verdict {
|
|
rq.counted = rq.countedByRateLimits()
|
|
if !rq.counted {
|
|
return nil
|
|
}
|
|
|
|
rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
|
|
rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
|
|
rq.line.BytesPercent, rq.line.BytesPercentSetting = rq.bytesPercent.logged()
|
|
|
|
counts, hit, over := rq.h.limiter.Count(rq.h.clientGroup(rq.client), now,
|
|
rq.limitPercent.percent)
|
|
rq.line.Counts = counts
|
|
|
|
if !over {
|
|
return nil
|
|
}
|
|
|
|
rq.banForLimit(now, hit, rq.h.config.BanResponse)
|
|
|
|
return &verdict{action: requestlog.ActionRateLimited, figures: limitFigures(hit)}
|
|
}
|
|
|
|
// overAWholeRateLimit reports whether the heuristic rate_limits will refuse the
|
|
// request at now, whatever its client's limit percentages: the rate limits
|
|
// count it, and one more request from its client takes it over a whole rate
|
|
// limit. It counts nothing.
|
|
func (rq *request) overAWholeRateLimit(now time.Time) bool {
|
|
return rq.countedByRateLimits() &&
|
|
rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now)
|
|
}
|
|
|
|
// countedByRateLimits reports whether the rate limits count the request: its
|
|
// client is not in SWWAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
|
|
// under SWWAF_RATE_LIMIT_EXEMPT_PATHS.
|
|
func (rq *request) countedByRateLimits() bool {
|
|
cfg := rq.h.config
|
|
|
|
return !isInside(rq.client, cfg.RateLimitExemptNets) &&
|
|
!pathExempt(rq.in, cfg.RateLimitExemptPaths)
|
|
}
|