clawbot
937d956d3a
check / check (push) Waiting to run
The header limits (more than 50 cookies or 100 header fields, answered `431`) move from just before the Core Rule Set to the first check after `SWW_ALLOW_NETS`. A request over them causes no lookup, no query to RouteWatch, a DNS blocklist or AbuseIPDB, no rule file match and no Core Rule Set. Requests within the limits go through the same checks in the same order. For a request over the limits: the rate limits no longer count it; a banned client or one in `SWW_DENY_NETS` gets `431` instead of its refusal; it makes no ban, makes no ban permanent and is not counted in a ban's notes; in `observe` mode it is answered `allow` with no lookup. `SPEC.md` and `README.md` say so. Model: opus-5-5
66 lines
1.8 KiB
Go
66 lines
1.8 KiB
Go
package waf
|
|
|
|
// The heuristic header_limits. It reads no setting: its limits are fixed.
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// The header limits: the most cookies and header fields a request may have.
|
|
// Real clients never reach them.
|
|
const (
|
|
maxCookies = 50
|
|
maxHeaderFields = 100
|
|
)
|
|
|
|
// headerLimits refuses a request with more than maxHeaderFields header fields
|
|
// or more than maxCookies cookies, with 431. Its figures are the request's
|
|
// header fields and cookies, and the limit of each.
|
|
type headerLimits struct{}
|
|
|
|
func (headerLimits) name() string { return "header_limits" }
|
|
|
|
func (headerLimits) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
fields, cookies := rq.headerCounts()
|
|
if fields <= maxHeaderFields && cookies <= maxCookies {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionRequestHeaderTooLarge,
|
|
figures: map[string]any{
|
|
"fields": fields, "fields_limit": maxHeaderFields,
|
|
"cookies": cookies, "cookies_limit": maxCookies,
|
|
},
|
|
}
|
|
}
|
|
|
|
// headerCounts returns the request's header fields, each value of a header sent
|
|
// twice being one, and its cookies, each part of a Cookie header between
|
|
// semicolons being one unless it is empty or only spaces and tabs. The Core
|
|
// Rule Set runs each of its rules on each cookie, so that thousands of small
|
|
// cookies keep it busy for over a second. It trims only spaces and control
|
|
// characters, of which a header value can hold only tabs, so a part of Unicode
|
|
// spaces is a cookie to it.
|
|
func (rq *request) headerCounts() (int, int) {
|
|
fields, cookies := 0, 0
|
|
|
|
for _, values := range rq.in.Header {
|
|
fields += len(values)
|
|
}
|
|
|
|
for _, value := range rq.in.Header.Values("Cookie") {
|
|
for part := range strings.SplitSeq(value, ";") {
|
|
if strings.Trim(part, " \t") != "" {
|
|
cookies++
|
|
}
|
|
}
|
|
}
|
|
|
|
return fields, cookies
|
|
}
|