sneak
79a2a00722
check / check (push) Failing after 1m19s
Each check servewaf runs on a request is a type in its own file behind one interface, heuristic, and is registered in one of four ordered lists in heuristics.go. Order and behaviour are unchanged. Every refusal or ban now logs heuristic, the name of the heuristic that made it, and heuristic_figures, the figures it acted on. Both are in docs/request-log.md, and SPEC.md names each heuristic at its step. Model: opus-5-5
40 lines
1.1 KiB
Go
40 lines
1.1 KiB
Go
package servewaf
|
|
|
|
// The heuristic crowdsec. It reads SWWAF_CROWDSEC_LAPI_URL, and the decisions
|
|
// through the reputation lists.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// crowdSec refuses a request when a decision of the CrowdSec decision list on
|
|
// the client is in force at now. It then notes the list, as noteHit does, and
|
|
// bans the client until that decision ends. Its figures are the decision's
|
|
// scenario and when it ends.
|
|
type crowdSec struct{}
|
|
|
|
func (crowdSec) name() string { return "crowdsec" }
|
|
|
|
func (crowdSec) check(_ context.Context, rq *request, now time.Time) *verdict {
|
|
decision, listed := rq.h.lists.CrowdSecDecision(rq.client, now)
|
|
if !listed {
|
|
return nil
|
|
}
|
|
|
|
rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
|
|
"listed by the CrowdSec decision list")
|
|
rq.banForCrowdSec(now, decision)
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionBanned,
|
|
figures: map[string]any{
|
|
"scenario": decision.Scenario,
|
|
"expires": requestlog.FormatTime(decision.Expires),
|
|
},
|
|
}
|
|
}
|