clawbot
aede434f6a
check / check (push) Successful in 6m30s
The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported. Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent. Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1. Model: opus-5-5
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package discriminator
|
|
|
|
// The heuristic blocklists. It reads SWW_BLOCKLIST_ACTION, and the blocklists
|
|
// through the reputation lists.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// blocklists notes the blocklists that list the client, as noteListed does,
|
|
// and refuses the request when SWW_BLOCKLIST_ACTION is deny. Being limit, it
|
|
// lowers the client's limits instead (see limitPercentages), and being log, it
|
|
// does nothing more. Its figure is the blocklists that list the client.
|
|
type blocklists struct{}
|
|
|
|
func (blocklists) name() string { return "blocklists" }
|
|
|
|
func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
listedBy := rq.h.lists.ListedBy(rq.client)
|
|
rq.blocklisted = len(listedBy) > 0
|
|
rq.noteListed(listedBy, "listed by a blocklist")
|
|
|
|
if !rq.refusedByBlocklists(listedBy) {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionClientDenied,
|
|
figures: map[string]any{"lists": listedBy},
|
|
}
|
|
}
|
|
|
|
// refusedByBlocklists reports whether the heuristic blocklists refuses a
|
|
// client, given listedBy, the blocklists that list it: it does when one lists
|
|
// it and SWW_BLOCKLIST_ACTION is deny.
|
|
func (rq *request) refusedByBlocklists(listedBy []string) bool {
|
|
return len(listedBy) > 0 && rq.h.config.BlocklistAction == deny
|
|
}
|