sneak
c6ab946c86
check / check (push) Waiting to run
Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
36 lines
958 B
Go
36 lines
958 B
Go
package waf
|
|
|
|
// The heuristic countries. It reads SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
|
|
|
|
import (
|
|
"context"
|
|
"slices"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// countries refuses a request when SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES is set and
|
|
// does not hold the client's country as it was looked up. A client without a
|
|
// country, or whose country cannot be found, is refused. Its figures are the
|
|
// country and the setting that refused it.
|
|
type countries struct{}
|
|
|
|
func (countries) name() string { return "countries" }
|
|
|
|
func (countries) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
allowed := rq.h.config.ExclusivelyAllowedCountries
|
|
country := rq.line.Country
|
|
|
|
if len(allowed) == 0 || slices.Contains(allowed, country) {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionCountryDenied,
|
|
figures: map[string]any{
|
|
"country": country, "setting": "SWW_WAF_EXCLUSIVELY_ALLOWED_COUNTRIES",
|
|
},
|
|
}
|
|
}
|