sneak
d282a737a8
check / check (push) Successful in 4m46s
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
59 lines
1.8 KiB
Go
59 lines
1.8 KiB
Go
package discriminator
|
|
|
|
// The heuristic abuseipdb. It reads SWW_WAF_ABUSEIPDB_KEY,
|
|
// SWW_WAF_ABUSEIPDB_MIN_SCORE and SWW_WAF_REPUTATION_ACTION.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/bans"
|
|
"sneak.berlin/go/smallwebwaf/internal/config"
|
|
"sneak.berlin/go/smallwebwaf/internal/ratelimit"
|
|
"sneak.berlin/go/smallwebwaf/internal/reputation"
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// abuseIPDB adds the tag abuseipdb and notes AbuseIPDB, as noteHit does, with
|
|
// the score, when its score of the client is a hit, and refuses the request
|
|
// when SWW_WAF_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
|
|
// SWW_WAF_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
|
|
// checked in the background, by the request's address, if its history counts
|
|
// an offence, and the request does not wait for the answer. The score is then
|
|
// used for each address of the client. Its figures are the score and
|
|
// SWW_WAF_ABUSEIPDB_MIN_SCORE.
|
|
type abuseIPDB struct{}
|
|
|
|
func (abuseIPDB) name() string { return "abuseipdb" }
|
|
|
|
func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
|
|
if rq.h.config.AbuseIPDBKey == "" {
|
|
return nil
|
|
}
|
|
|
|
client := rq.h.clientGroup(rq.client)
|
|
held, _ := rq.h.limiter.Client(client)
|
|
offender := held.History.Offences != ratelimit.Offences{}
|
|
|
|
score, hit := rq.h.abuseIPDB.Hit(ctx, client, rq.client, offender)
|
|
if !hit {
|
|
return nil
|
|
}
|
|
|
|
rq.abuseIPDBHit = true
|
|
rq.addTag(config.AbuseIPDBTag)
|
|
rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
|
|
"scored by AbuseIPDB at or over SWW_WAF_ABUSEIPDB_MIN_SCORE")
|
|
|
|
if rq.h.config.ReputationAction != deny {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionClientDenied,
|
|
figures: map[string]any{
|
|
figureScore: score, "min_score": rq.h.config.AbuseIPDBMinScore,
|
|
},
|
|
}
|
|
}
|