sneak
47cab048a5
check / check (push) In progress
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
55 lines
1.6 KiB
Go
55 lines
1.6 KiB
Go
package discriminator
|
|
|
|
// The heuristic refusal_limit. It reads SWW_WAF_ERROR_BURST_THRESHOLD and
|
|
// SWW_WAF_BAN_RESPONSE.
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// refusalLimit counts the request once it has been answered, if discriminator
|
|
// refused it after a rule file match, a trap path or a Core Rule Set match, and
|
|
// in observe mode if enforce mode would have: more than
|
|
// SWW_WAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute break
|
|
// a limit, which bans the client. A client in SWW_WAF_ALLOW_NETS, which the
|
|
// heuristics skip, is not counted, and nothing is while the threshold is off.
|
|
// Its figures are the window, the count and the limit.
|
|
type refusalLimit struct{}
|
|
|
|
func (refusalLimit) name() string { return "refusal_limit" }
|
|
|
|
func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdict {
|
|
cfg := rq.h.config
|
|
if cfg.ErrorBurstThreshold == 0 {
|
|
return nil
|
|
}
|
|
|
|
if !rq.attack && !rq.blockedByBlockRule && !rq.blockedByCoreRuleSet {
|
|
return nil
|
|
}
|
|
|
|
hit, over := rq.h.limiter.CountRefusal(rq.h.clientGroup(rq.client), now,
|
|
cfg.ErrorBurstThreshold)
|
|
if !over {
|
|
return nil
|
|
}
|
|
|
|
// What the client was sent, or in observe mode would have been.
|
|
status := rq.out.status
|
|
|
|
switch rq.line.WouldAction {
|
|
case requestlog.ActionBlockedByBlockRule, requestlog.ActionBlockedByCoreRuleSet:
|
|
status = http.StatusForbidden
|
|
case requestlog.ActionTemporarilyBanned, requestlog.ActionPermanentlyBanned:
|
|
status = cfg.BanResponse
|
|
}
|
|
|
|
rq.banForLimit(now, hit, status)
|
|
|
|
return &verdict{figures: limitFigures(hit)}
|
|
}
|