clawbot
719691d1e8
check / check (push) Failing after 3m22s
The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234. Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`. Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`. Model: opus-5-5
42 lines
1.4 KiB
Go
42 lines
1.4 KiB
Go
package discriminator
|
|
|
|
// The heuristic byte_limits. It reads SWW_BYTES_COUNT, and the byte limits
|
|
// and biased thresholds through the limiter and limitPercentages.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
)
|
|
|
|
// byteLimits counts the request's bytes, as countedBytes gives them, for the
|
|
// byte limits, once its report has come, and notes the client's byte totals for
|
|
// the log line; its requests stay there as the rate limits counted them. Only
|
|
// an allowed request has them counted, and only one the rate limits counted; in
|
|
// observe mode, not one that enforce mode would have refused. Bytes that take
|
|
// the client over a byte limit, as its limit percentage for the byte limits
|
|
// lowers it, break it, which bans the client; the response was passed on whole.
|
|
// Its figures are the window, the count and the limit.
|
|
type byteLimits struct{}
|
|
|
|
func (byteLimits) name() string { return "byte_limits" }
|
|
|
|
func (byteLimits) check(_ context.Context, rq *request, now time.Time) *verdict {
|
|
if !rq.counted || rq.line.WouldAction != "" {
|
|
return nil
|
|
}
|
|
|
|
counts, hit, over := rq.h.limiter.CountBytes(rq.h.clientGroup(rq.client), now,
|
|
rq.countedBytes(), rq.bytesLimitPercent.percent)
|
|
rq.line.Counts.MinuteBytes = counts.MinuteBytes
|
|
rq.line.Counts.HourBytes = counts.HourBytes
|
|
rq.line.Counts.DayBytes = counts.DayBytes
|
|
|
|
if !over {
|
|
return nil
|
|
}
|
|
|
|
rq.banForLimit(now, hit, rq.out.status)
|
|
|
|
return &verdict{figures: limitFigures(hit)}
|
|
}
|