clawbot
c66277b111
check / check (push) Failing after 5m8s
Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start. Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags. Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did. Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals. Model: opus-5-5
60 lines
1.8 KiB
Go
60 lines
1.8 KiB
Go
package discriminator
|
|
|
|
// The heuristic rule_files. It reads the rules of the rule files, which
|
|
// SWW_RULES_DIR and SWW_RULES_ENABLED name.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/config"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
"sneak.berlin/go/smallwebwaf/internal/rules"
|
|
)
|
|
|
|
// ruleFiles checks the request against the rules of the rule files at now,
|
|
// notes the ids of those it matches in the log line, adds the tag
|
|
// exploitsignature when it matches any, and refuses the request
|
|
// when the last rule it matches refuses it: with ActionRuleBlocked for a block
|
|
// rule, and ActionBanned for a ban rule. A ban rule bans the client's netblock
|
|
// for a clear sign of attack, or in observe mode raises the alert for the ban
|
|
// it would have made. Either rule's match is noted as an offence, for the
|
|
// client's history. Its figures are the rule's id and action.
|
|
type ruleFiles struct{}
|
|
|
|
func (ruleFiles) name() string { return "rule_files" }
|
|
|
|
func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
|
|
matched := rq.h.rules.Match(rq.in)
|
|
|
|
for _, rule := range matched {
|
|
rq.line.RuleIDs = append(rq.line.RuleIDs, rule.ID)
|
|
rq.h.metrics.RuleMatched(rule.ID, rule.Action)
|
|
}
|
|
|
|
if len(matched) == 0 {
|
|
return nil
|
|
}
|
|
|
|
rq.addTag(config.ExploitSignatureTag)
|
|
|
|
// Only the last rule matched can refuse the request.
|
|
last := matched[len(matched)-1]
|
|
figures := map[string]any{"rule_id": last.ID, "rule_action": last.Action}
|
|
|
|
switch last.Action {
|
|
case rules.ActionBlock:
|
|
rq.ruleBlocked = true
|
|
|
|
return &verdict{action: requestlog.ActionRuleBlocked, figures: figures}
|
|
case rules.ActionBan:
|
|
rq.attack = true
|
|
rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target})
|
|
|
|
return &verdict{action: requestlog.ActionBanned, figures: figures}
|
|
default:
|
|
return nil
|
|
}
|
|
}
|