clawbot
189e56a7fc
check / check (push) Successful in 2m1s
SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a request with 403 before its body is read or rate-limited, logged as country_denied. internal/lookup asks GeoJS only while a list is set, 200 waiting clients per request, one at a time, keeping answers 7 days. A redirect, or an answer leaving an address out, is a failure; GeoJS is then left alone a second, doubling to five minutes. Private, loopback and link-local clients are never sent. Deviation, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE. Deviation: GeoJS's country endpoint, not geo.json. Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait. Judgement call: config.go lists the ISO 3166-1 codes; no widely used library holds them. Model: opus-5-5
42 lines
1.1 KiB
Go
42 lines
1.1 KiB
Go
package proxy
|
|
|
|
import (
|
|
"context"
|
|
"net/netip"
|
|
"slices"
|
|
)
|
|
|
|
// countryDenied reports whether the country lists refuse the request.
|
|
// The client's country is looked up only while a list is set, and never
|
|
// for a client on a private, loopback or link-local address, which has
|
|
// no country and which neither list checks. A client whose country
|
|
// cannot be found is refused only by SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
|
|
// ctx is the request's own context.
|
|
func (rq *request) countryDenied(ctx context.Context) bool {
|
|
denied := rq.h.config.DeniedCountries
|
|
allowed := rq.h.config.ExclusivelyAllowedCountries
|
|
|
|
if len(denied) == 0 && len(allowed) == 0 {
|
|
return false
|
|
}
|
|
|
|
if !hasCountry(rq.client) {
|
|
return false
|
|
}
|
|
|
|
country := rq.h.geojs.Country(ctx, clientGroup(rq.client))
|
|
rq.line.Country = country
|
|
|
|
if slices.Contains(denied, country) {
|
|
return true
|
|
}
|
|
|
|
return len(allowed) > 0 && !slices.Contains(allowed, country)
|
|
}
|
|
|
|
// hasCountry reports whether addr can be placed in a country: private,
|
|
// loopback and link-local addresses cannot.
|
|
func hasCountry(addr netip.Addr) bool {
|
|
return !addr.IsPrivate() && !addr.IsLoopback() && !addr.IsLinkLocalUnicast()
|
|
}
|