clawbot
c66277b111
check / check (push) Failing after 5m8s
Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start. Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags. Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did. Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals. Model: opus-5-5
44 lines
1.3 KiB
Go
44 lines
1.3 KiB
Go
package discriminator
|
|
|
|
// The heuristic dnsbl. It reads SWW_REPUTATION_ACTION, and the DNSBL zones'
|
|
// verdicts through the DNSBL checker.
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/config"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// dnsbl notes the DNSBL zones whose verdict lists the client, as noteListed
|
|
// does, adds the tag dnsbl=<zone> for each, the zone's key masked, and refuses
|
|
// the request when SWW_REPUTATION_ACTION is deny. Being
|
|
// limit, it lowers the client's limits instead (see limitPercentages), and
|
|
// being log, it does nothing more. A zone without a verdict on the client is
|
|
// asked about it in the background, and the request does not wait for the
|
|
// answer. Its figure is the zones that list the client, their keys masked.
|
|
type dnsbl struct{}
|
|
|
|
func (dnsbl) name() string { return "dnsbl" }
|
|
|
|
func (dnsbl) check(ctx context.Context, rq *request, _ time.Time) *verdict {
|
|
listedBy := rq.h.dnsbl.ListedBy(ctx, rq.client)
|
|
rq.dnsblListed = len(listedBy) > 0
|
|
rq.noteListed(listedBy, "listed by a DNSBL zone")
|
|
|
|
for _, zone := range listedBy {
|
|
rq.addTag(config.DNSBLTagPrefix + strings.ToLower(zone))
|
|
}
|
|
|
|
if !rq.dnsblListed || rq.h.config.ReputationAction != deny {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionDenied,
|
|
figures: map[string]any{"zones": listedBy},
|
|
}
|
|
}
|