clawbot
c66277b111
check / check (push) Failing after 5m8s
Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start. Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags. Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did. Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals. Model: opus-5-5
59 lines
1.8 KiB
Go
59 lines
1.8 KiB
Go
package discriminator
|
|
|
|
// The heuristic abuseipdb. It reads SWW_ABUSEIPDB_KEY,
|
|
// SWW_ABUSEIPDB_MIN_SCORE and SWW_REPUTATION_ACTION.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/config"
|
|
"sneak.berlin/go/smallwebwaf/internal/ratelimit"
|
|
"sneak.berlin/go/smallwebwaf/internal/reputation"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// abuseIPDB adds the tag abuseipdb and notes AbuseIPDB, as noteHit does, with
|
|
// the score, when its score of the client is a hit, and refuses the request
|
|
// when SWW_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
|
|
// SWW_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
|
|
// checked in the background, by the request's address, if its history counts
|
|
// an offence, and the request does not wait for the answer. The score is then
|
|
// used for each address of the client. Its figures are the score and
|
|
// SWW_ABUSEIPDB_MIN_SCORE.
|
|
type abuseIPDB struct{}
|
|
|
|
func (abuseIPDB) name() string { return "abuseipdb" }
|
|
|
|
func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
|
|
if rq.h.config.AbuseIPDBKey == "" {
|
|
return nil
|
|
}
|
|
|
|
client := rq.h.clientGroup(rq.client)
|
|
held, _ := rq.h.limiter.Client(client)
|
|
offender := held.History.Offences != ratelimit.Offences{}
|
|
|
|
score, hit := rq.h.abuseIPDB.Hit(ctx, client, rq.client, offender)
|
|
if !hit {
|
|
return nil
|
|
}
|
|
|
|
rq.abuseIPDBHit = true
|
|
rq.addTag(config.AbuseIPDBTag)
|
|
rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
|
|
"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE")
|
|
|
|
if rq.h.config.ReputationAction != deny {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionDenied,
|
|
figures: map[string]any{
|
|
figureScore: score, "min_score": rq.h.config.AbuseIPDBMinScore,
|
|
},
|
|
}
|
|
}
|