smallwebwaf/internal/proxy/bans.go

package proxy

import (
	"net/netip"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/alerts"
	"sneak.berlin/go/smallwebwaf/internal/bans"
	"sneak.berlin/go/smallwebwaf/internal/requestlog"
	"sneak.berlin/go/smallwebwaf/internal/rules"
)

// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
// with action.
func (rq *request) banResponse(action string) *refusal {
	return &refusal{status: rq.h.config.BanResponse, action: action}
}

// banned reports whether a ban on a netblock the client is in covers the
// request at now, and notes for the log line when that ban ends. A
// request that makes the ban permanent, or in observe mode would have,
// raises the alert for it.
func (rq *request) banned(now time.Time) bool {
	check := rq.h.ledger.Check
	if rq.h.config.Observe {
		check = rq.h.ledger.Find // the ban refuses nothing, and stays as it is
	}

	ban, banned, madePermanent := check(rq.client, now)
	if banned {
		rq.line.BanExpires = banExpires(ban)
	}

	if madePermanent {
		ban.Expires = time.Time{} // the ban made permanent, which Find leaves as it is
		rq.alertBan(ban)
	}

	return banned
}

// limitBroken counts the request for the rate limits at now, notes the
// client's counts for the log line, and reports whether the request takes
// the client over a limit. In enforce mode such a request bans the
// client's netblock, and sets the client's counters back to zero; in
// observe mode it does neither, and raises the alert for the ban it would
// have made, if that alert would be sent.
func (rq *request) limitBroken(now time.Time) bool {
	group := clientGroup(rq.client)

	counts, hit, over := rq.h.limiter.Count(group, now)
	rq.line.Counts = counts

	if !over {
		return false
	}

	rq.line.LimitHit = hit.Window
	rq.line.Offence = requestlog.OffenceLimit

	netblock := rq.h.netblock(rq.client)
	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
		return true
	}

	notes := bans.Notes{
		ASN:      rq.line.ASN,
		ASName:   rq.line.ASName,
		Country:  rq.line.Country,
		Limit:    hit.Limit,
		Window:   hit.Window,
		Count:    hit.Requests,
		Request:  rq.noted(now),
		Requests: rq.netblockRequests(netblock),
	}

	if rq.h.config.Observe {
		ban, wouldBan := rq.h.ledger.WouldBanForLimit(netblock, now, notes)
		if wouldBan {
			rq.alertBan(ban)
		}

		return true
	}

	ban, made := rq.h.ledger.BanForLimit(netblock, now, notes)
	rq.h.limiter.Reset(group)
	rq.line.BanExpires = banExpires(ban)

	if made {
		rq.alertBan(ban)
	}

	return true
}

// banForAttack bans the client's netblock at now for a clear sign of
// attack, the match of rule, a ban rule. In observe mode it makes no ban,
// and raises the alert for the ban it would have made, if that alert
// would be sent.
func (rq *request) banForAttack(now time.Time, rule rules.Rule) {
	netblock := rq.h.netblock(rq.client)
	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
		return
	}

	notes := bans.Notes{
		ASN:      rq.line.ASN,
		ASName:   rq.line.ASName,
		Country:  rq.line.Country,
		RuleID:   rule.ID,
		Target:   rule.Target,
		Request:  rq.noted(now),
		Requests: rq.netblockRequests(netblock),
	}

	if rq.h.config.Observe {
		ban, wouldBan := rq.h.ledger.WouldBanForAttack(netblock, now, notes)
		if wouldBan {
			rq.alertBan(ban)
		}

		return
	}

	ban, made := rq.h.ledger.BanForAttack(netblock, now, notes)
	rq.line.BanExpires = banExpires(ban)

	if made {
		rq.alertBan(ban)
	}
}

// wouldAlertBan reports whether the alert for a ban on netblock for cause
// made at now would be sent. In observe mode the ban the request would
// have made is worked out only then, at most once per
// SWWAF_ALERT_COOLDOWN and never with no webhook set: its notes count the
// netblock's requests, which can mean going through every client.
func (rq *request) wouldAlertBan(
	netblock netip.Prefix, now time.Time, cause string,
) bool {
	event := alerts.EventBan
	if rq.h.ledger.WouldBePermanent(netblock, now, cause) {
		event = alerts.EventPermanentBan
	}

	return rq.h.alerts.WouldSend(event, netblock)
}

// alertBan raises the alert for ban, which the request made, or made
// permanent: permanent_ban for a permanent ban, ban for another. Its
// detail gives the ban's cause, when it ends, and its notes, and in
// observe mode, where ban is the ban that would have been made, or made
// permanent, mode, observe.
func (rq *request) alertBan(ban bans.Ban) {
	event := alerts.EventBan
	if ban.Permanent() {
		event = alerts.EventPermanentBan
	}

	detail := map[string]any{
		"cause": ban.Cause, "ban_expires": banExpires(ban), "notes": ban.Notes,
	}
	if rq.h.config.Observe {
		detail["mode"] = "observe"
	}

	rq.h.alerts.Raise(alerts.Alert{
		Event:    event,
		Client:   rq.client,
		Netblock: ban.Netblock,
		ASN:      ban.Notes.ASN,
		ASName:   ban.Notes.ASName,
		Country:  ban.Notes.Country,
		Reason:   ban.Reason,
		Detail:   detail,
	})
}

// noted is the request, refused at now with SWWAF_BAN_RESPONSE, or in
// observe mode as it would have been, as the notes of the ban it makes
// keep it.
func (rq *request) noted(now time.Time) bans.Request {
	return bans.Request{
		Time:      now,
		Method:    rq.in.Method,
		Host:      rq.in.Host,
		Path:      rq.in.URL.RequestURI(),
		Status:    rq.h.config.BanResponse,
		UserAgent: rq.in.UserAgent(),
	}
}

// netblockRequests is how many requests netblock has sent since it was
// first seen, this one included: the histories count it only once it has
// ended.
func (rq *request) netblockRequests(netblock netip.Prefix) int64 {
	return rq.h.limiter.Requests(netblock) + 1
}

// netblock is the netblock a ban on client covers: its IPv4 address,
// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
// counts it in.
func (h *handler) netblock(client netip.Addr) netip.Prefix {
	addr := client.Unmap()
	if addr.Is4() {
		return netip.PrefixFrom(addr, h.config.BanScopeV4Prefix).Masked()
	}

	return clientGroup(addr)
}

// banExpires is when ban ends, as the log line gives it: a time, or
// permanent.
func banExpires(ban bans.Ban) string {
	if ban.Permanent() {
		return permanent
	}

	return requestlog.FormatTime(ban.Expires)
}