clawbot
ddb95f5411
check / check (push) Waiting to run
Zones in SWWAF_DNSBL_ZONES are asked about each client (RFC 5782 names) in the background, through the host's resolver or SWWAF_DNSBL_RESOLVER; no request waits. Verdicts last SWWAF_REPUTATION_CACHE_TTL and are kept in reputation.json, at most 100,000. After the blocklists, SWWAF_REPUTATION_ACTION (limit:25) denies, limits or logs a listed client; the log line names the zones, each raises reputation_hit, with metrics by zone. A failed, timed-out or refused query gives no verdict, raises source_failure, and pauses the zone a minute. Judgement call: answers in 127.255.255.0/24 or outside 127.0.0.0/8 are failures. Judgement call: the minute's pause after a failure; at most 1,000 queries at once. Rule suppressed: paralleltest on the DNSBL tests (Go's resolver shares state across synctest bubbles), funlen on the test of every logged setting. Model: opus-5-5
28 lines
743 B
Go
28 lines
743 B
Go
package reputation
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"net/http"
|
|
"net/netip"
|
|
)
|
|
|
|
// SetTransport has l's fetches go through transport instead of the
|
|
// network.
|
|
func (l *Lists) SetTransport(transport http.RoundTripper) {
|
|
l.httpClient.Transport = transport
|
|
}
|
|
|
|
// SetDial has d's queries go through dial instead of the network.
|
|
func (d *DNSBL) SetDial(
|
|
dial func(ctx context.Context, network, address string) (net.Conn, error),
|
|
) {
|
|
d.resolver = &net.Resolver{PreferGo: true, Dial: dial}
|
|
}
|
|
|
|
// LookUp asks zone about addr at once, as a query in the background does,
|
|
// and returns whether zone lists addr.
|
|
func (d *DNSBL) LookUp(zone string, addr netip.Addr) (bool, error) {
|
|
return d.lookUp(context.Background(), query{zone: zone, client: addr})
|
|
}
|