clawbot
df2c5042d2
check / check (push) Successful in 3m24s
smallwebwaf now copies its state to bans.json, clients.json and lookups.json in SWWAF_STATE_DIR, as "Persistent state" in SPEC.md describes, and reads them back at start, so a restart lifts no ban and gives no client a fresh allowance. Each client gains a history, and a ban's notes count the netblock's requests. bans.json is written SWWAF_STATE_WRITE_DELAY after a ban, and every file every SWWAF_STATE_COUNTER_INTERVAL and at the stop. A ban read back is masked to its netblock and refuses every client in it. A file that does not parse, an unknown version, an entry without a field it needs, or an unwritable directory stops the start. Deviation: no AS number or name, and no ban cause, reason or lifting yet. Model: opus-5-5
86 lines
2.2 KiB
Go
86 lines
2.2 KiB
Go
package proxy
|
|
|
|
import (
|
|
"net/netip"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
|
|
// with action.
|
|
func (rq *request) banResponse(action string) *refusal {
|
|
return &refusal{status: rq.h.config.BanResponse, action: action}
|
|
}
|
|
|
|
// banned reports whether a ban on a netblock the client is in refuses
|
|
// the request at now, and notes for the log line when that ban ends.
|
|
func (rq *request) banned(now time.Time) bool {
|
|
ban, banned := rq.h.ledger.Check(rq.client, now)
|
|
if banned {
|
|
rq.line.BanExpires = banExpires(ban)
|
|
}
|
|
|
|
return banned
|
|
}
|
|
|
|
// limitBroken counts the request for the rate limits at now, and reports
|
|
// whether it takes the client over one. Such a request bans the client's
|
|
// netblock, and sets the client's counters back to zero.
|
|
func (rq *request) limitBroken(now time.Time) bool {
|
|
group := clientGroup(rq.client)
|
|
|
|
hit, over := rq.h.limiter.Count(group, now)
|
|
if !over {
|
|
return false
|
|
}
|
|
|
|
netblock := rq.netblock()
|
|
ban := rq.h.ledger.BanForLimit(netblock, now, bans.Notes{
|
|
Country: rq.line.Country,
|
|
Limit: hit.Limit,
|
|
Window: hit.Window,
|
|
Count: hit.Requests,
|
|
Request: bans.Request{
|
|
Time: now,
|
|
Method: rq.in.Method,
|
|
Host: rq.in.Host,
|
|
Path: rq.in.URL.RequestURI(),
|
|
Status: rq.h.config.BanResponse,
|
|
UserAgent: rq.in.UserAgent(),
|
|
},
|
|
// The histories count this request only once it has ended.
|
|
Requests: rq.h.limiter.Requests(netblock) + 1,
|
|
})
|
|
rq.h.limiter.Reset(group)
|
|
|
|
rq.line.LimitHit = hit.Window
|
|
rq.line.Offence = requestlog.OffenceLimit
|
|
rq.line.BanExpires = banExpires(ban)
|
|
|
|
return true
|
|
}
|
|
|
|
// netblock is the netblock a ban on the client covers: its IPv4 address,
|
|
// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
|
|
// counts it in.
|
|
func (rq *request) netblock() netip.Prefix {
|
|
addr := rq.client.Unmap()
|
|
if addr.Is4() {
|
|
return netip.PrefixFrom(addr, rq.h.config.BanScopeV4Prefix).Masked()
|
|
}
|
|
|
|
return clientGroup(addr)
|
|
}
|
|
|
|
// banExpires is when ban ends, as the log line gives it: a time, or
|
|
// permanent.
|
|
func banExpires(ban bans.Ban) string {
|
|
if ban.Permanent() {
|
|
return "permanent"
|
|
}
|
|
|
|
return requestlog.FormatTime(ban.Expires)
|
|
}
|