wafris 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9ad06b7e5b23c313860cbdd76ee405cda36958112889cc591b3733270e31312
-  data.tar.gz: 98239b5926e3d57f732c37638ec4166ffb170d1f1f79cc1c36779f803f0c07e4
+  metadata.gz: 2da3a1b92fba96e01f65433a9388d7dbeb8f24225b352e1958f392cd82fc8522
+  data.tar.gz: c8a72dcb1459454890d11d5ba0190f2b4a7f0d13cc63ce9d7038e87cb8ca7af7
 SHA512:
-  metadata.gz: 1db5393514faa4b605923e039d7270f9eaddcc4d62e5b6f8897372a7b7c4c3a297e8d0900bf18acb53ebf2bb32b43c8ddf6c2ae0a2b1eca67df4ba547446d4b6
-  data.tar.gz: fcb42f4ba9a8d1a07f55ebdda5e76dd3e9651675b96f3d7a5ae7024978ac4e81bf35ae9d8fc1c71a67fc10f2f79e0baa8b781bf3a36eeac202fb44b7c386f040
+  metadata.gz: ef4e1b43b6ae8f9060e8ba936ebffed084288e3a0df798c487141dd608f9f136e4cde74babc9ed9ab9c908f96a558fd674dcc9b579f94cc0bc95da581a973a20
+  data.tar.gz: a252ddc02c510c14c011c23d3127a5f17d7dc97dc6b44a46e889b85b4130e9897c4d9623fb6ad144e6cc32f21524ad5d58f008d9d1b6376c47884c2f42c94008

data/lib/lua/dist/wafris_core.lua

@@ -60,28 +60,42 @@ local function add_to_HLL_request_count(timebucket, request_id)
 end
 
 -- For: Leaderboard of IPs with Request count as score
-local function increment_timebucket_for_ip(timebucket, ip)
-  redis.call("ZINCRBY", "ip-leader-sset:" .. timebucket, 1, ip)
+local function increment_timebucket_for(type, timebucket, property)
+  -- TODO: breaking change will to switch to client_ip: prefix
+  type = type or "ip-"
+  redis.call("ZINCRBY", type .. "leader-sset:" .. timebucket, 1, property)
 end
 
 -- Configuration
 local max_requests = 100000
 local max_requests_per_ip = 10000
 
-local ip = ARGV[1]
+local client_ip = ARGV[1]
 local ip_to_decimal = ARGV[2]
 local unix_time_milliseconds = ARGV[3]
 local unix_time = ARGV[3] / 1000
+local proxy_ip = ARGV[4]
+local user_agent = ARGV[5]
+local request_path = ARGV[6]
+local host = ARGV[7]
 
 -- Initialize local variables
-local request_id = get_request_id(nil, ip, max_requests)
+local request_id = get_request_id(nil, client_ip, max_requests)
 local current_timebucket = get_time_bucket_from_timestamp(unix_time_milliseconds)
 
 -- GRAPH DATA COLLECTION
 add_to_HLL_request_count(current_timebucket, request_id)
 
 -- LEADERBOARD DATA COLLECTION
-increment_timebucket_for_ip(current_timebucket, ip)
+-- TODO: breaking change will to switch to client_ip: prefix
+increment_timebucket_for(nil, current_timebucket, client_ip)
+if proxy_ip ~= nil then
+  increment_timebucket_for(nil, current_timebucket, proxy_ip)
+end
+increment_timebucket_for("proxy_ip:", current_timebucket, proxy_ip)
+increment_timebucket_for("user_agent:", current_timebucket, user_agent)
+increment_timebucket_for("request_path:", current_timebucket, request_path)
+increment_timebucket_for("host:", current_timebucket, host)
 
 -- BLOCKING LOGIC
 -- Safelist Range Check

data/lib/wafris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wafris
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/wafris.rb

@@ -32,12 +32,18 @@ module Wafris
     def allow_request?(request)
       configuration.connection_pool.with do |conn|
         time = Time.now.to_f * 1000
+        puts "WAF LOG: Client IP #{client_ip(request)}"
+        puts "WAF LOG: Proxy IP #{proxy_ip(request)}"
         status = conn.evalsha(
           configuration.core_sha,
           argv: [
-            request.ip,
+            client_ip(request),
             IPAddr.new(request.ip).to_i,
-            time.to_i
+            time.to_i,
+            proxy_ip(request),
+            request.user_agent,
+            request.path,
+            request.host
           ]
         )
 
@@ -48,5 +54,19 @@ module Wafris
         end
       end
     end
+
+    private
+
+    def client_ip(request)
+      return request.ip if request.headers['x-forwarded-for'].nil?
+
+      request.headers['x-forwarded-for'].split(',').first
+    end
+
+    def proxy_ip(request)
+      return nil if request.headers['x-forwarded-for'].nil?
+
+      request.headers['x-forwarded-for'].split(',').last
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wafris
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Micahel Buckbee
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-05-17 00:00:00.000000000 Z
+date: 2023-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: connection_pool