sneak
a8b24a843b
check / check (push) Waiting to run
script/fmt now runs golines -m 77 after gofmt, repeating golines until it changes nothing, since one pass can leave a line the next splits. script/fmt-check fails when either would change a file. script/bootstrap installs golines v0.13.0 with go install, pinned to its commit, and checks the installed version with go version -m. The tree is reformatted. The longer lines this makes are fixed by hand: nolint directives moved onto their own line above the statement, one string split, and 20 functions over funlen's 80 lines shortened or split, RunWAF and limitPercentages among them. Model: opus-5-5
40 lines
952 B
Go
40 lines
952 B
Go
package waf
|
|
|
|
// The heuristic countries. It reads SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
|
|
|
|
import (
|
|
"context"
|
|
"slices"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// countries refuses a request when SWW_EXCLUSIVELY_ALLOWED_COUNTRIES is set and
|
|
// does not hold the client's country as it was looked up. A client without a
|
|
// country, or whose country cannot be found, is refused. Its figures are the
|
|
// country and the setting that refused it.
|
|
type countries struct{}
|
|
|
|
func (countries) name() string { return "countries" }
|
|
|
|
func (countries) check(
|
|
_ context.Context,
|
|
rq *request,
|
|
_ time.Time,
|
|
) *verdict {
|
|
allowed := rq.h.config.ExclusivelyAllowedCountries
|
|
country := rq.line.Country
|
|
|
|
if len(allowed) == 0 || slices.Contains(allowed, country) {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionCountryDenied,
|
|
figures: map[string]any{
|
|
"country": country, "setting": "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES",
|
|
},
|
|
}
|
|
}
|