clawbot
c66277b111
check / check (push) Failing after 5m8s
Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start. Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags. Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did. Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals. Model: opus-5-5
52 lines
1.6 KiB
Go
52 lines
1.6 KiB
Go
package discriminator
|
|
|
|
// The heuristic crowdsec. It reads SWW_CROWDSEC_LAPI_URL, and the decisions
|
|
// through the reputation lists.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/config"
|
|
"sneak.berlin/go/smallwebwaf/internal/reputation"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// crowdSec refuses a request when a decision of the CrowdSec decision list on
|
|
// the client is in force at now. It then adds the tag crowdsec, notes the
|
|
// list, as noteHit does, and bans the client until that decision ends. Its
|
|
// figures are the decision's scenario and when it ends.
|
|
type crowdSec struct{}
|
|
|
|
func (crowdSec) name() string { return "crowdsec" }
|
|
|
|
func (crowdSec) check(_ context.Context, rq *request, now time.Time) *verdict {
|
|
decision, listed := rq.crowdSecDecisionInForce(now)
|
|
if !listed {
|
|
return nil
|
|
}
|
|
|
|
rq.addTag(config.CrowdSecTag)
|
|
rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
|
|
"listed by the CrowdSec decision list")
|
|
rq.banForCrowdSec(now, decision)
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionBanned,
|
|
figures: map[string]any{
|
|
"scenario": decision.Scenario,
|
|
"expires": requestlog.FormatTime(decision.Expires),
|
|
},
|
|
}
|
|
}
|
|
|
|
// crowdSecDecisionInForce returns the decision of the CrowdSec decision list on
|
|
// the client that is in force at now, and reports whether there is one, which
|
|
// the heuristic crowdsec refuses the request for.
|
|
func (rq *request) crowdSecDecisionInForce(
|
|
now time.Time,
|
|
) (reputation.Decision, bool) {
|
|
return rq.h.lists.CrowdSecDecision(rq.client, now)
|
|
}
|