clawbot
aede434f6a
check / check (push) Successful in 6m30s
The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported. Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent. Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1. Model: opus-5-5
72 lines
2.2 KiB
Go
72 lines
2.2 KiB
Go
package discriminator
|
|
|
|
// The heuristic header_limits. It reads no setting: its limits are fixed.
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// The header limits: the most cookies and header fields a request may have
|
|
// when the checks reach the Core Rule Set. Real clients never reach them.
|
|
const (
|
|
maxCookies = 50
|
|
maxHeaderFields = 100
|
|
)
|
|
|
|
// headerLimits refuses a request over the header limits, with 431. Its figures
|
|
// are the request's header fields and cookies, and the limit of each.
|
|
type headerLimits struct{}
|
|
|
|
func (headerLimits) name() string { return "header_limits" }
|
|
|
|
func (headerLimits) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
fields, cookies := rq.headerCounts()
|
|
if !overHeaderLimits(fields, cookies) {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionRequestHeaderTooLarge,
|
|
figures: map[string]any{
|
|
"fields": fields, "fields_limit": maxHeaderFields,
|
|
"cookies": cookies, "cookies_limit": maxCookies,
|
|
},
|
|
}
|
|
}
|
|
|
|
// overHeaderLimits reports whether a request with these counts of header fields
|
|
// and cookies, as headerCounts counts them, is over the header limits: it has
|
|
// more than maxHeaderFields fields or more than maxCookies cookies.
|
|
func overHeaderLimits(fields, cookies int) bool {
|
|
return fields > maxHeaderFields || cookies > maxCookies
|
|
}
|
|
|
|
// headerCounts returns the request's header fields, each value of a header sent
|
|
// twice being one, and its cookies, each part of a Cookie header between
|
|
// semicolons being one unless it is empty or only spaces and tabs. The Core
|
|
// Rule Set runs each of its rules on each cookie, so that thousands of small
|
|
// cookies keep it busy for over a second. It trims only spaces and control
|
|
// characters, of which a header value can hold only tabs, so a part of Unicode
|
|
// spaces is a cookie to it.
|
|
func (rq *request) headerCounts() (int, int) {
|
|
fields, cookies := 0, 0
|
|
|
|
for _, values := range rq.in.Header {
|
|
fields += len(values)
|
|
}
|
|
|
|
for _, value := range rq.in.Header.Values("Cookie") {
|
|
for part := range strings.SplitSeq(value, ";") {
|
|
if strings.Trim(part, " \t") != "" {
|
|
cookies++
|
|
}
|
|
}
|
|
}
|
|
|
|
return fields, cookies
|
|
}
|