sneak
d282a737a8
check / check (push) Successful in 4m46s
Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package discriminator
|
|
|
|
// The heuristic blocklists. It reads SWW_WAF_BLOCKLIST_ACTION, and the blocklists
|
|
// through the reputation lists.
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// blocklists notes the blocklists that list the client, as noteListed does,
|
|
// and refuses the request when SWW_WAF_BLOCKLIST_ACTION is deny. Being limit, it
|
|
// lowers the client's limits instead (see limitPercentages), and being log, it
|
|
// does nothing more. Its figure is the blocklists that list the client.
|
|
type blocklists struct{}
|
|
|
|
func (blocklists) name() string { return "blocklists" }
|
|
|
|
func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
listedBy := rq.h.lists.ListedBy(rq.client)
|
|
rq.blocklisted = len(listedBy) > 0
|
|
rq.noteListed(listedBy, "listed by a blocklist")
|
|
|
|
if !rq.refusedByBlocklists(listedBy) {
|
|
return nil
|
|
}
|
|
|
|
return &verdict{
|
|
action: requestlog.ActionClientDenied,
|
|
figures: map[string]any{"lists": listedBy},
|
|
}
|
|
}
|
|
|
|
// refusedByBlocklists reports whether the heuristic blocklists refuses a
|
|
// client, given listedBy, the blocklists that list it: it does when one lists
|
|
// it and SWW_WAF_BLOCKLIST_ACTION is deny.
|
|
func (rq *request) refusedByBlocklists(listedBy []string) bool {
|
|
return len(listedBy) > 0 && rq.h.config.BlocklistAction == deny
|
|
}
|