sneak
d31a052aff
check / check (push) Failing after 2m11s
The command is now `sww waf`, and the package is `internal/waf`. Types, functions, files, tests, comments, docs, the Dockerfile, the runit script, `script/`, compose examples, the log field `waf_line` and the `X-From-Waf` test header follow. No behaviour changes, and no setting changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`. Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF, discriminator to waf) over the files `git grep -i discriminator` listed, as sneak allowed for this rename, then `git mv` for the package and files. By hand afterwards: the header's spelling, which the linter requires, and the padding after `waf` in `sww`'s usage text. Model: opus-5-5
31 lines
645 B
Go
31 lines
645 B
Go
package waf
|
|
|
|
// The heuristic tag_deny. It reads SWW_TAG_DENY.
|
|
|
|
import (
|
|
"context"
|
|
"slices"
|
|
"time"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// tagDeny refuses a request that carries a tag in SWW_TAG_DENY. Its figure is
|
|
// the first such tag, in sorted order.
|
|
type tagDeny struct{}
|
|
|
|
func (tagDeny) name() string { return "tag_deny" }
|
|
|
|
func (tagDeny) check(_ context.Context, rq *request, _ time.Time) *verdict {
|
|
for _, tag := range rq.line.Tags {
|
|
if slices.Contains(rq.h.config.TagDeny, tag) {
|
|
return &verdict{
|
|
action: requestlog.ActionClientDenied,
|
|
figures: map[string]any{"tag": tag},
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|