clawbot
5d6f6ffaf9
check / check (push) Waiting to run
SWWAF_ADMIN_TOKEN, or its _FILE form, opens GET and POST /_smallwebwaf/bans, DELETE /_smallwebwaf/bans/<client> and GET /_smallwebwaf/clients/<ip>. Unset, they answer 404; a missing or wrong token gets 401, in observe mode too. They go through every check, as the metrics do. POST takes a netblock, not IPv4-mapped and without a zone, or a client's address, a duration or permanent, and a reason, and makes an admin ban even while another lasts. DELETE lifts every active ban covering the address, kept and marked lifted. Bans come back as bans.json entries; a client as clients.json holds it, with its bans. Judgement call: answers leave out bans.json's version field. Judgement call: DELETE takes an address, not a netblock. Rule suppressed: gosec G304 on a test reading bans.json. Model: opus-5-5
126 lines
3.4 KiB
Go
126 lines
3.4 KiB
Go
package proxy
|
|
|
|
import (
|
|
"net/netip"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
"sneak.berlin/go/smallwebwaf/internal/rules"
|
|
)
|
|
|
|
// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
|
|
// with action.
|
|
func (rq *request) banResponse(action string) *refusal {
|
|
return &refusal{status: rq.h.config.BanResponse, action: action}
|
|
}
|
|
|
|
// banned reports whether a ban on a netblock the client is in covers the
|
|
// request at now, and notes for the log line when that ban ends.
|
|
func (rq *request) banned(now time.Time) bool {
|
|
check := rq.h.ledger.Check
|
|
if rq.h.config.Observe {
|
|
check = rq.h.ledger.Find // in observe mode the ban refuses nothing
|
|
}
|
|
|
|
ban, banned := check(rq.client, now)
|
|
if banned {
|
|
rq.line.BanExpires = banExpires(ban)
|
|
}
|
|
|
|
return banned
|
|
}
|
|
|
|
// limitBroken counts the request for the rate limits at now, notes the
|
|
// client's counts for the log line, and reports whether the request takes
|
|
// the client over a limit. In enforce mode such a request bans the
|
|
// client's netblock, and sets the client's counters back to zero; in
|
|
// observe mode it does neither.
|
|
func (rq *request) limitBroken(now time.Time) bool {
|
|
group := clientGroup(rq.client)
|
|
|
|
counts, hit, over := rq.h.limiter.Count(group, now)
|
|
rq.line.Counts = counts
|
|
|
|
if !over {
|
|
return false
|
|
}
|
|
|
|
rq.line.LimitHit = hit.Window
|
|
rq.line.Offence = requestlog.OffenceLimit
|
|
|
|
if rq.h.config.Observe {
|
|
return true
|
|
}
|
|
|
|
netblock := rq.h.netblock(rq.client)
|
|
ban := rq.h.ledger.BanForLimit(netblock, now, bans.Notes{
|
|
Country: rq.line.Country,
|
|
Limit: hit.Limit,
|
|
Window: hit.Window,
|
|
Count: hit.Requests,
|
|
Request: rq.noted(now),
|
|
Requests: rq.netblockRequests(netblock),
|
|
})
|
|
rq.h.limiter.Reset(group)
|
|
rq.line.BanExpires = banExpires(ban)
|
|
|
|
return true
|
|
}
|
|
|
|
// banForAttack bans the client's netblock at now for a clear sign of
|
|
// attack, the match of rule, a ban rule.
|
|
func (rq *request) banForAttack(now time.Time, rule rules.Rule) {
|
|
netblock := rq.h.netblock(rq.client)
|
|
ban := rq.h.ledger.BanForAttack(netblock, now, bans.Notes{
|
|
Country: rq.line.Country,
|
|
RuleID: rule.ID,
|
|
Target: rule.Target,
|
|
Request: rq.noted(now),
|
|
Requests: rq.netblockRequests(netblock),
|
|
})
|
|
rq.line.BanExpires = banExpires(ban)
|
|
}
|
|
|
|
// noted is the request, refused at now with SWWAF_BAN_RESPONSE, as the
|
|
// notes of the ban it makes keep it.
|
|
func (rq *request) noted(now time.Time) bans.Request {
|
|
return bans.Request{
|
|
Time: now,
|
|
Method: rq.in.Method,
|
|
Host: rq.in.Host,
|
|
Path: rq.in.URL.RequestURI(),
|
|
Status: rq.h.config.BanResponse,
|
|
UserAgent: rq.in.UserAgent(),
|
|
}
|
|
}
|
|
|
|
// netblockRequests is how many requests netblock has sent since it was
|
|
// first seen, this one included: the histories count it only once it has
|
|
// ended.
|
|
func (rq *request) netblockRequests(netblock netip.Prefix) int64 {
|
|
return rq.h.limiter.Requests(netblock) + 1
|
|
}
|
|
|
|
// netblock is the netblock a ban on client covers: its IPv4 address,
|
|
// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
|
|
// counts it in.
|
|
func (h *handler) netblock(client netip.Addr) netip.Prefix {
|
|
addr := client.Unmap()
|
|
if addr.Is4() {
|
|
return netip.PrefixFrom(addr, h.config.BanScopeV4Prefix).Masked()
|
|
}
|
|
|
|
return clientGroup(addr)
|
|
}
|
|
|
|
// banExpires is when ban ends, as the log line gives it: a time, or
|
|
// permanent.
|
|
func banExpires(ban bans.Ban) string {
|
|
if ban.Permanent() {
|
|
return permanent
|
|
}
|
|
|
|
return requestlog.FormatTime(ban.Expires)
|
|
}
|