sneak
47cab048a5
check / check (push) In progress
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
30 lines
673 B
Go
30 lines
673 B
Go
package discriminator
|
|
|
|
// The heuristic deny_nets. It reads SWW_WAF_DENY_NETS.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// denyNets refuses a client in SWW_WAF_DENY_NETS. Its figure is the netblock of
|
|
// the setting the client is in.
|
|
type denyNets struct{}
|
|
|
|
func (denyNets) name() string { return "deny_nets" }
|
|
|
|
func (denyNets) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
for _, netblock := range rq.h.config.DenyNets {
|
|
if netblock.Contains(rq.client) {
|
|
return &verdict{
|
|
action: requestlog.ActionClientDenied,
|
|
figures: map[string]any{figureNetblock: netblock.String()},
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|