rack-dedos 0.7.1 → 0.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9198afaa909fd5893e05e59d4e107303aedb6d9cba9a99fc26025d4785fb0f1
-  data.tar.gz: 573d19c93954eb75ad4f4db7b9ea92003162c1648e9b576a8e4279aa2efb6dbc
+  metadata.gz: 1876d028a80926559978d4afff1d011227355de81868bc6a2bf78377199ca7e3
+  data.tar.gz: 915be1922ba19ea3c4f64e4710994eee3e74a1a8ae383554dccd72ef4213775f
 SHA512:
-  metadata.gz: 95d555d680506742c46c9de899c2ec17a9e4cb4d5423326777cf3b0b4b8131e85798b2f9bccbb3c9e4c7f6be44e0e2a86442ace63aab11e02cf2f21cc76a3924
-  data.tar.gz: 2e633200a5563c497354bba636abc42a829f4d24297fd9d8174f767c2ca789edd1e7758e83ca1eaea4788c0acb084eb9378fe9ce85c3a82f4d34d880d3f3e9b3
+  metadata.gz: f7452453fd2b4a36a02398fc32563e386f4ab42e35a50e082db295b2584a947b7bf36e8216ac331f8ac54a9d0ac5fe9c7d4e2e59192237142a535357abfb344c
+  data.tar.gz: e8c5f2118f9eb86dba94ef777a1e6f6339367467051ace6740addb23152b4715b3d6ed59c624fe83ec4912d2fd6a80253b1112578ebc0d72ed85c76b193afd2b

data/CHANGELOG.md

@@ -2,107 +2,147 @@
 
 Nothing so far
 
-## 0.7.1
+# Changelog
 
-### Improvements
-* Enforce MFA for future gem releases
+All notable changes to this project will be documented in this file.
 
-## 0.7.0
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/2.0.0/),
+and this project adheres to [Break Versioning](https://www.taoensso.com/break-versioning).
 
-### Breaking changes
-* Change format of country code details in log
+## [Unreleased]
 
-### Fixes
-* Drop keyword arguments for Rack compatibility
-* Fix collision with Rack::Logger
+Nothing so far
+
+## [0.7.3] - 2026-06-26
+
+### Changed
+
+- Relaxed dependency on connection_pool for better legacy support
+
+## [0.7.2] - 2026-06-26
+
+### Added
+
+- Spamhaus filter
+
+## [0.7.1] - 2026-04-21
+
+### Added
+
+- Enforce MFA for future gem releases
+
+## [0.7.0] - 2026-03-11
+
+### Changed
+
+- **Breaking:** Changed format of country code details in log
+
+### Fixed
+
+- Dropped keyword arguments for Rack compatibility
+- Fixed collision with Rack::Logger
+
+## [0.6.0] - 2026-03-11
+
+### Changed
+
+- **Breaking:** Log to STDOUT (instead of STDERR) by default
+
+### Added
+
+- Suppport custom loggers
+- Optionally log request headers
+
+## [0.5.1] - 2026-01-08
+
+### Fixed
+
+- Fixed getcwd errors due to unlinked tmpdir
+
+## [0.5.0] - 2026-01-06
+
+### Changed
+
+- Updated to Ruby 4.0
+- Require Minitest >= 6
+
+## [0.4.2] - 2025-12-01
+
+### Changed
+
+- Adhere to [BreakVer](https://www.taoensso.com/break-versioning) from this point forward
 
-## 0.6.0 (yanked)
+### Added
 
-### Breaking changes
-* Log to STDOUT (instead of STDERR) by default
+- Include the requested URL in warnings
+- Added `only_paths` and `except_paths` options
 
-### Additions
-* Suppport custom loggers
-* Optionally log request headers
+## [0.4.1] - 2025-11-04
 
-## 0.5.1
+### Fixed
 
-### Fixes
-* Fix getcwd errors due to unlinked tmpdir
+- Correctly include details in warnings (i.e. country code)
 
-## 0.5.0
+## [0.4.0] - 2025-07-21
 
-### Changes
-* Update to Ruby 4.0
-* Require Minitest >= 6
+### Changed
 
-## 0.4.2
+- Dropped certs
+- Addded action for trusted release
 
-### Changes
-* Use [BreakVer](https://www.taoensso.com/break-versioning) from this point forward
+## [0.3.2] - 2025-01-16
 
-### Additions
-* Include the requested URL in warnings
-* Add `only_paths` and `except_paths` options
+### Changed
 
-## 0.4.1
+- Resolve all paths to prevent problems with relative paths
 
-### Fixes
-* Correctly include details in warnings (i.e. country code)
+## [0.3.1] - 2025-01-16
 
-## 0.4.0
+### Fixed
 
-### Changes
-* Drop certs
-* Add action for trusted release
+- Root `File` operations to prevent clashes with Rack
 
-## 0.3.2
+## [0.3.0] - 2025-01-16
 
-### Changes
-* Resolve all paths to prevent problems with relative paths
+### Changed
 
-## 0.3.1
+- Converted `geoipget` from Bash to Ruby
 
-### Changes
-* Root `File` operations to prevent clashes with Rack
+## [0.2.4] - 2025-01-15
 
-## 0.3.0
+### Changed
 
-### Changes
-* Convert `geoipget` from Bash to Ruby
+- Use Bash for `geoipget` to prevent problems with `/bin/sh` diversity
 
-## 0.2.4
+## [0.2.3] - 2025-01-15
 
-### Changes
-* Use Bash for `geoipget` to prevent problems with `/bin/sh` diversity
+### Added
 
-## 0.2.3
+- `geoipget` shell script
 
-### Additions
-* `geoipget` shell script
+## [0.2.2] - 2024-12-25
 
-## 0.2.2
+### Changed
 
-### Changes
-* Update to Ruby 3.4
+- Updated to Ruby 3.4
 
-## 0.2.1
+## [0.2.1] - 2024-11-20
 
-### Fixes
+### Fixed
 
-* Fix paths on conditional requires
-* Renew certificate
+- Fixed paths on conditional requires
+- Renewed certificate
 
-## 0.2.0
+## [0.2.0] - 2023-05-16
 
-### Changes
+### Changed
 
-* Determine real client IP
-* Drop autoload and put filters in proper namespace
+- Determine real client IP
+- Dropped autoload and put filters in proper namespace
 
-## 0.1.0
+## [0.1.0] - 2023-02-03
 
-### Initial implementation
+### Added
 
-* UserAgent filter
-* Country filter
+- UserAgent filter
+- Country filter

data/README.md

@@ -122,6 +122,18 @@ use Rack::Dedos,
   text: "Temporary Server Error"
 ```
 
+### Cache
+
+Some filters have to persist information to a key/value store. The default implementation uses a simple Ruby `Hash`, however, this is only suitable for development. If you chose to use such filters in production, you'll want to switch to Redis instead.
+
+To do so, install the [redis gem](https://rubygems.org/gems/redis) and add the following configuration:
+
+```ruby
+use Rack::Dedos,
+  cache_url: 'redis://redis.example.com:6379/12',   # db 12 on default port
+  cache_key_prefix: 'dedos',   # key prefix for shared caches (default: nil)
+```
+
 ### Log
 
 By default, blocked request are logged as info to `$stdout` such as:
@@ -162,22 +174,19 @@ To only apply one specific filter, use the corresponding class as shown below.
 
 ### User Agent Filter
 
+⚠️ This filter uses the cache!
+
 ```ruby
 use Rack::Dedos::Filters::UserAgent,
-  cache_url: 'redis://redis.example.com:6379/12',   # db 12 on default port
-  cache_key_prefix: 'dedos',   # key prefix for shared caches (default: nil)
   cache_period: 1800   # seconds (default: 900)
 ```
 
 Requests are blocked for `cache_period` seconds in case another request has been made within `cache_period` seconds from by same IP address but with a different user agent.
 
-The following cache backends are supported:
-
-* `redis://...` – ⚠️ The [redis gem](https://rubygems.org/gems/redis) has to be installed.
-* `hash` – Only for testing, don't use this in production.
-
 ### Country Filter
 
+⚠️ This filter requires the [maxmind-db gem](https://rubygems.org/gems/maxmind-db) to be installed!
+
 ```ruby
 use Rack::Dedos::Filters::Country,
   maxmind_db_file: '/var/db/maxmind/GeoLite2-Country.mmdb',
@@ -187,8 +196,6 @@ use Rack::Dedos::Filters::Country,
 
 Either allow or deny requests by probable country of origin. If both are set, the `denied_countries` option is ignored.
 
-⚠️ The [maxmind-db gem](https://rubygems.org/gems/maxmind-db) has to be installed.
-
 The MaxMind GeoLite2 database is free, however, you have to create an account on [maxmind.com](https://www.maxmind.com) and then download the country database.
 
 For automatic updates, create a `geoipupdate.conf` file and then use the [geoipupdate tool for your arch](https://github.com/maxmind/geoipupdate/releases) to fetch the latest country database.
@@ -200,9 +207,19 @@ geoipget --help
 geoipget --dir . --arch linux_amd64 /etc/geoipupdate.conf
 ```
 
+### Spamhaus Filter
+
+⚠️ This filter uses the cache!
+
+```ruby
+use Rack::Dedos::Filters::Spamhaus
+```
+
+Deny requests from IP addresses which are listed on the [Spamhaus ZEN Blocklist](https://www.spamhaus.org/blocklists/zen-blocklist/).
+
 ## Real Client IP
 
-A word on how the real client IP is determined. Both Rack 2 and Rack 3 (up to 3.0.7 at the time of writing) may populate the request `ip` incorrectly. Here's what a minimalistic Rack app deloyed to Render (behind Cloudflare) reports:
+A word on how the real client IP is determined: Both Rack 2 and Rack 3 (up to 3.0.7 at the time of writing) may populate the request `ip` incorrectly. Here's what a minimalistic Rack app deloyed to Render (behind Cloudflare) reports:
 
 > request.ip = 172.71.135.17<br>
 > request.forwarded_for = ["81.XXX.XXX.XXX", "172.71.135.17", "10.201.229.136"]

data/lib/rack/dedos/cache.rb

@@ -4,30 +4,27 @@ module Rack
   module Dedos
     class Cache
 
-      def initialize(url:, expires_in: nil, key_prefix: nil)
-        @url, @expires_in = url, expires_in
-        @key_prefix = ("#{key_prefix}:" if key_prefix).to_s
+      def initialize(url:, key_prefix: nil, expires_in: 86400)
+        @url, @key_prefix, @expires_in = url, key_prefix, expires_in
         type = url.split(':').first
         extend Object.const_get("Rack::Dedos::Cache::#{type.capitalize}")
+        connect
       rescue NameError
         raise(ArgumentError, "type of cache for `#{@url}' not supported")
       end
 
       module Hash
-        def store
-          @store ||= {}
-        end
-
-        def set(key, value)
-          store[key] = [value, timestamp]
+        def set(key, value, expires_in: @expires_in)
+          expires_at = now + expires_in if expires_in
+          @store[key] = [value, expires_at]
         end
 
         def get(key)
-          if (value, created_at = store[key])
-            if !@expires_in || @expires_in >= timestamp - created_at
+          if (value, expires_at = @store[key])
+            if !expires_at || expires_at > now
               value
             else
-              store.delete(key)
+              @store.delete(key)
               nil
             end
           end
@@ -35,7 +32,11 @@ module Rack
 
         private
 
-        def timestamp
+        def connect
+          @store = {}
+        end
+
+        def now
           Time.now.to_i
         end
       end
@@ -43,16 +44,24 @@ module Rack
       module Redis
         require 'redis'
 
-        def store
-          @store ||= ::Redis.new(url: @url)
+        def set(key, value, expires_in: @expires_in)
+          @store.with { _1.set(prefixed(key), value, ex: expires_in) }
         end
 
-        def set(key, value)
-          store.set(@key_prefix + key, value, ex: @expires_in)
+        def get(key)
+          @store.with { _1.get(prefixed(key)) }
         end
 
-        def get(key)
-          store.get(@key_prefix + key)
+        private
+
+        def connect
+          @store = ConnectionPool.new(size: 5, timeout: 1) do
+            ::Redis.new(url: @url)
+          end
+        end
+
+        def prefixed(key)
+          @key_prefix ? "#{@key_prefix}:#{key}" : key
         end
       end
 

data/lib/rack/dedos/filters/base.rb

@@ -9,6 +9,8 @@ module Rack
 
         DEFAULT_OPTIONS = {
           logger: nil,
+          cache_url: 'Hash',
+          cache_key_prefix: nil,
           only_paths: [],
           except_paths: [],
           status: 403,
@@ -16,13 +18,18 @@ module Rack
           headers: []
         }.freeze
 
-        attr_reader :app, :options, :details
+        attr_reader :app, :options, :cache, :logger, :details
 
         # @param app [#call]
         # @param options [Hash{Symbol => Object}]
         def initialize(app, options={})
           @app = app
           @options = DEFAULT_OPTIONS.merge(options)
+          @cache = Cache.new(
+            url: @options[:cache_url],
+            key_prefix: @options[:cache_key_prefix]
+          )
+          @logger ||= options[:logger] || ::Logger.new($stdout, progname: 'rack-dedos')
           @details = {}
         end
 
@@ -46,10 +53,6 @@ module Rack
           Rack::Dedos.config
         end
 
-        def logger
-          @logger ||= options[:logger] || ::Logger.new($stdout, progname: 'rack-dedos')
-        end
-
         def apply?(request)
           return false if @options[:except_paths].any? { request.path.match? _1 }
           return true if @options[:only_paths].none?

data/lib/rack/dedos/filters/spamhaus.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'resolv'
+
+module Rack
+  module Dedos
+    module Filters
+      class Spamhaus < Base
+
+        QUERY_DOMAIN = 'zen.spamhaus.org'.freeze
+
+        def name
+          :spamhaus
+        end
+
+        def initialize(...)
+          super
+          @resolver = ConnectionPool.new(size: 5, timeout: 1) do
+            Resolv::DNS.new.tap { _1.timeouts = [1, 2] }
+          end
+        end
+
+        def allowed?(request, ip)
+          @resolver.with do |resolver|
+            resolver.getresources(domain_for(ip), Resolv::DNS::Resource::IN::A).empty?
+          end
+        rescue => error
+          logger.error("request from #{ip} allowed due to error: #{error.message}")
+          true
+        end
+
+        private
+
+        def domain_for(ip)
+          ip.split('.').reverse.join('.').concat('.', QUERY_DOMAIN)
+        end
+
+      end
+    end
+  end
+end

data/lib/rack/dedos/filters/user_agent.rb

@@ -9,28 +9,24 @@ module Rack
           :user_agent
         end
 
-        # @option options [String] :cache_url URL of the cache backend
         # @option options [Integer] :cache_period how long to retain cached IP
         #   addresses in seconds (default: 900)
         def initialize(...)
           super
-          @cache_url = options[:cache_url] or fail "cache URL not set"
           @cache_period = options[:cache_period] || 900
-          @cache_key_prefix = options[:cache_key_prefix]
-          cache   # hit once to fail on errors at boot
         end
 
         def allowed?(request, ip)
           case cache.get(ip)
           when nil              # first contact
-            cache.set(ip, request.user_agent)
+            cache.set(ip, request.user_agent, expires_in: @cache_period)
             true
           when 'BLOCKED'        # already blocked
             false
           when request.user_agent   # user agent hasn't changed
             true
-          else                  # user agent has changed
-            cache.set(ip, 'BLOCKED')
+          else   # user agent has changed
+            cache.set(ip, 'BLOCKED', expires_in: @cache_period)
             false
           end
         rescue => error
@@ -38,16 +34,6 @@ module Rack
           true
         end
 
-        private
-
-        def cache
-          config[:cache] ||= Cache.new(
-            url: @cache_url,
-            expires_in: @cache_period,
-            key_prefix: @cache_key_prefix
-          )
-        end
-
       end
     end
   end

data/lib/rack/dedos/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   module Dedos
-    VERSION = "0.7.1"
+    VERSION = "0.7.3"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-dedos
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.7.3
 platform: ruby
 authors:
 - Sven Schwyn
@@ -37,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: connection_pool
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.5.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -135,6 +149,7 @@ files:
 - lib/rack/dedos/executables/geoipget.rb
 - lib/rack/dedos/filters/base.rb
 - lib/rack/dedos/filters/country.rb
+- lib/rack/dedos/filters/spamhaus.rb
 - lib/rack/dedos/filters/user_agent.rb
 - lib/rack/dedos/version.rb
 homepage: https://github.com/svoop/rack-dedos
@@ -168,7 +183,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Radical filters to block denial-of-service (DoS) requests.
 test_files: []