wafris 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f51807b65d4eeeb7350206f2d739304f2208cac95ed472d98472c50afc25c1a
-  data.tar.gz: e8a22ef9c9b710435c60367d46c2f72c162484bd0a10a139743f143fd7fa4252
+  metadata.gz: 919967ec8203e767f77202e17964dbcfd21f60422bb91bd61b806575886c5dbf
+  data.tar.gz: ffe9b975f6613e1742c90b6335e85f53769d439d32f014517487142a97edb37e
 SHA512:
-  metadata.gz: b22cc90428fe61f9777bcc3e7a5e482023f791e72efd7229d70ca4b1070ba7d03b9e7de7b93fb328bbdb465192ba26475c707c8e7e938c9a03de9c23d91dc41a
-  data.tar.gz: '0841925bb939e194c4c0a41a21be9f3300b590213a83b0ea71e66f5d752dbbb1e32eacba6b747b13417ceec46833ecf9a23e9594e592f1a9e4f6f88edd8e2495'
+  metadata.gz: 4efff1ae48ec5417bf9917c0a3b7f073064216ee718eed8246f0b993397454ab4296a2e27ac48a1289f31abe20ca277d32f4bc848978a7c4dd88d04ee08c4cdb
+  data.tar.gz: 274d14a646e0e706a940d16c53adb050045df1593056f012ba47666af402c37e38a055038fa2074a73e32e73cc49bcf5f5d943c16e7bff71bd3d79d47e8aaadc

data/lib/lua/dist/wafris_core.lua

@@ -1,5 +1,9 @@
-local use_timestamps_as_request_ids = false
+
+
+local USE_TIMESTAMPS_AS_REQUEST_IDS = false
 local EXPIRATION_IN_SECONDS = 86400
+local EXPIRATION_OFFSET_IN_SECONDS = 3600
+
 
 local function get_timebucket(timestamp_in_seconds)
   local startOfHourTimestamp = math.floor(timestamp_in_seconds / 3600) * 3600
@@ -7,6 +11,7 @@ local function get_timebucket(timestamp_in_seconds)
 end
 
 local function set_property_value_id_lookups(property_abbreviation, property_value)
+
   local value_key = property_abbreviation .. "V" .. property_value
   local property_id = redis.call("GET", value_key)
 
@@ -15,25 +20,29 @@ local function set_property_value_id_lookups(property_abbreviation, property_val
     redis.call("SET", value_key, property_id)
     redis.call("SET", property_abbreviation .. "I" .. property_id, property_value)
   else
-    redis.call("EXPIRE", value_key, EXPIRATION_IN_SECONDS)
-    redis.call("EXPIRE", property_abbreviation .. "I" .. property_id, EXPIRATION_IN_SECONDS)
+    redis.call("EXPIRE", value_key, EXPIRATION_IN_SECONDS + EXPIRATION_OFFSET_IN_SECONDS)
+    redis.call("EXPIRE", property_abbreviation .. "I" .. property_id, EXPIRATION_IN_SECONDS + EXPIRATION_OFFSET_IN_SECONDS)
   end
 
   return property_id
 end
 
 local function increment_leaderboard_for(property_abbreviation, property_id, timebucket)
+
   local key = property_abbreviation .. "L" .. timebucket
   redis.call("ZINCRBY", key, 1, property_id)
   redis.call("EXPIRE", key, EXPIRATION_IN_SECONDS)
 end
 
 local function set_property_to_requests_list(property_abbreviation, property_id, request_id, timebucket)
+
   local key = property_abbreviation .. "R" .. property_id .. "-" .. timebucket
   redis.call("LPUSH", key, request_id)
-  redis.call("EXPIRE", key, EXPIRATION_IN_SECONDS)
+
+  redis.call("EXPIRE", key, EXPIRATION_IN_SECONDS + EXPIRATION_OFFSET_IN_SECONDS)
 end
 
+
 local function ip_in_hash(hash_name, ip_address)
   local found_ip = redis.call('HEXISTS', hash_name, ip_address)
 
@@ -45,7 +54,9 @@ local function ip_in_hash(hash_name, ip_address)
 end
 
 local function ip_in_cidr_range(cidr_set, ip_decimal_lexical)
+
   local higher_value = redis.call('ZRANGEBYLEX', cidr_set, '['..ip_decimal_lexical, '+', 'LIMIT', 0, 1)[1]
+
   local lower_value = redis.call('ZREVRANGEBYLEX', cidr_set, '['..ip_decimal_lexical, '-', 'LIMIT', 0, 1)[1]
 
   if not (higher_value and lower_value) then
@@ -64,6 +75,7 @@ end
 
 local function match_by_pattern(property_abbreviation, property_value)
   local hash_name = "rules-blocked-" .. property_abbreviation
+
   local patterns = redis.call('HKEYS', hash_name)
 
   for _, pattern in ipairs(patterns) do
@@ -76,10 +88,13 @@ local function match_by_pattern(property_abbreviation, property_value)
 end
 
 local function blocked_by_rate_limit(request_properties)
+
   local rate_limiting_rules_values = redis.call('HKEYS', 'rules-blocked-rate-limits')
 
   for i, rule_name in ipairs(rate_limiting_rules_values) do
+
     local conditions_hash = redis.call('HGETALL', rule_name .. "-conditions")
+
     local all_conditions_match = true
 
     for j = 1, #conditions_hash, 2 do
@@ -93,9 +108,13 @@ local function blocked_by_rate_limit(request_properties)
     end
 
     if all_conditions_match then
+
       local rule_settings_key = rule_name .. "-settings"
+
       local limit, time_period, limited_by, rule_id = unpack(redis.call('HMGET', rule_settings_key, 'limit', 'time-period', 'limited-by', 'rule-id'))
+
       local throttle_key = rule_name .. ":" .. limit .. "V" .. request_properties.ip
+
       local new_value = redis.call('INCR', throttle_key)
 
       if new_value == 1 then
@@ -113,6 +132,7 @@ end
 
 local function check_rules(functions_to_check)
   for _, check in ipairs(functions_to_check) do
+
     local rule = check.func(unpack(check.args))
     local category = check.category
 
@@ -170,13 +190,17 @@ local request = {
   ["method_id"] = set_property_value_id_lookups("m", ARGV[8])
 }
 
-  local current_timebucket = get_timebucket(request.ts_in_seconds)
+
+
+local current_timebucket = get_timebucket(request.ts_in_seconds)
+
   local blocked_rule = false
   local blocked_category = nil
   local treatment = "p"
+
   local stream_id
 
-  if use_timestamps_as_request_ids == true then
+  if USE_TIMESTAMPS_AS_REQUEST_IDS == true then
       stream_id = request.ts_in_milliseconds
   else
       stream_id = "*"
@@ -209,6 +233,7 @@ local request = {
 
     table.insert(stream_args, "ar")
     table.insert(stream_args, allowed_rule)
+
   else
     blocked_rule, blocked_category = check_blocks(request)
   end

data/lib/wafris/configuration.rb

@@ -14,8 +14,10 @@ module Wafris
       )
       @redis_pool_size = 20
 
-      # TODO: update HUB with the REDIS_URL on startup
-      create_settings if ENV['REDIS_URL']
+      puts "[Wafris] attempting firewall connection via REDIS_URL."
+      create_settings
+    rescue Redis::CannotConnectError
+      puts "[Wafris] firewall disabled. Cannot connect to REDIS_URL. Will attempt Wafris.configure if it exists."
     end
 
     def connection_pool
@@ -23,24 +25,12 @@ module Wafris
         ConnectionPool.new(size: redis_pool_size) { redis }
     end
 
-    def enabled?
-      redis.ping
-
-      return true
-    rescue Redis::CannotConnectError
-      raise <<~CONNECTION_ERROR
-        Wafris cannot connect to Redis.
-
-        The current Redis instance points to a connection that
-        cannot be pinged.
-      CONNECTION_ERROR
-    end
-
     def create_settings
       redis.hset('waf-settings',
                  'version', Wafris::VERSION,
                  'client', 'ruby',
                  'redis-host', 'heroku')
+      puts "[Wafris] firewall enabled. Connected to Redis. Ready to process requests. Set rules at: https://wafris.org/hub"
     end
 
     def core_sha

data/lib/wafris/middleware.rb

@@ -26,12 +26,15 @@ module Wafris
 
       request = Rack::Request.new(env)
 
-      if Wafris.configuration.enabled? && Wafris.allow_request?(request)
+      if Wafris.allow_request?(request)
         @app.call(env)
       else
         puts 'blocked'
         [403, {}, ['Blocked']]
       end
+    rescue StandardError => e
+      puts "[Wafris] Redis connection error: #{e.message}. Request passed without rules check."
+      @app.call(env)
     end
   end
 end

data/lib/wafris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wafris
-  VERSION = "1.0.0"
+  VERSION = "1.1.0"
 end

data/lib/wafris.rb

@@ -13,7 +13,10 @@ module Wafris
   class << self
     def configure
       yield configuration
+      puts "[Wafris] attempting firewall connection via Wafris.configure initializer."
       configuration.create_settings
+    rescue Redis::CannotConnectError
+      puts "[Wafris] firewall disabled. Cannot connect via Wafris.configure. Please check your configuration settings."
     end
 
     def configuration

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wafris
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Micahel Buckbee
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-31 00:00:00.000000000 Z
+date: 2023-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: connection_pool