sneak
230db01127
check / check (push) Waiting to run
Each check servewaf runs on a request is a type in its own file behind one interface, heuristic, and is registered in one of four ordered lists in heuristics.go. Order and behaviour are unchanged. Every refusal now logs heuristic, the name of the heuristic that made it, and heuristic_figures, the figures it acted on. A ban by refusal_limit or byte_limits after the answer logs after_answer_heuristic and after_answer_heuristic_figures instead, so a line can name both. All four are in docs/request-log.md, and SPEC.md names each heuristic at its step. Model: opus-5-5
30 lines
658 B
Go
30 lines
658 B
Go
package servewaf
|
|
|
|
// The heuristic deny_nets. It reads SWWAF_DENY_NETS.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// denyNets refuses a client in SWWAF_DENY_NETS. Its figure is the netblock of
|
|
// the setting the client is in.
|
|
type denyNets struct{}
|
|
|
|
func (denyNets) name() string { return "deny_nets" }
|
|
|
|
func (denyNets) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
for _, netblock := range rq.h.config.DenyNets {
|
|
if netblock.Contains(rq.client) {
|
|
return &verdict{
|
|
action: requestlog.ActionDenied,
|
|
figures: map[string]any{figureNetblock: netblock.String()},
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|