wafris 0.5.4 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16f5664939e2ff16c9741e4da47113d28535869a2f143d21fceca33caec7dbb7
-  data.tar.gz: 54bc209bf0c7ee9d225d5623681a0d391599a51f2113343f5f9c5f3b57e044bd
+  metadata.gz: 283b178e632194aa6ff2e0aaaa5e3eca428cacb17a6383a8aa3b57d005c5a316
+  data.tar.gz: 9ce784b1e57629d072ccc9da4c9e8ec81916dbdcf03c3138e004777e498db4d4
 SHA512:
-  metadata.gz: e08b0d51693d3489cb5a225a50cb7241ab5f81571ef32f14c4c91cfabef861ed9fba3766477aac3d2baea81d46536c655b99d19715fb4cd496f608df43b15d85
-  data.tar.gz: d024cbdfc8923d23b0ebe81080a0238f6741f971b0f7488db376291b5cbe3d585bda06ab7a6ad3547224a95c80e2e182434c28c1c483ed47c70300f16b226289
+  metadata.gz: 32df667c3fa70c28fb2ea9b298c05ca2542f38d2c6ecee45208e1de6df518c33e6252cce179f2d9a65759fd60093c06909b3aef65068f926405daa07722d6ee8
+  data.tar.gz: 46722bd780d683360be5382f7b9729067cc1624e12d602caba624629ebb9b88e7e454e23e3231aef98a63087d2824fded586088cbf0d5a6ceff4203fbe0c0385

data/lib/lua/dist/wafris_core.lua

@@ -74,10 +74,9 @@ local client_ip = ARGV[1]
 local client_ip_to_decimal = ARGV[2]
 local unix_time_milliseconds = ARGV[3]
 local unix_time = ARGV[3] / 1000
-local proxy_ip = ARGV[4]
-local user_agent = ARGV[5]
-local request_path = ARGV[6]
-local host = ARGV[7]
+local user_agent = ARGV[4]
+local request_path = ARGV[5]
+local host = ARGV[6]
 
 -- Initialize local variables
 local request_id = get_request_id(nil, client_ip, max_requests)
@@ -89,16 +88,11 @@ add_to_HLL_request_count(current_timebucket, request_id)
 -- LEADERBOARD DATA COLLECTION
 -- TODO: breaking change will to switch to client_ip: prefix
 increment_timebucket_for(nil, current_timebucket, client_ip)
-if proxy_ip ~= nil and proxy_ip ~= "" then
-  increment_timebucket_for("proxy_ip:", current_timebucket, proxy_ip)
-end
 increment_timebucket_for("user_agent:", current_timebucket, user_agent)
 increment_timebucket_for("request_path:", current_timebucket, request_path)
 increment_timebucket_for("host:", current_timebucket, host)
 
-local foobar = redis.call("ZRANGEBYSCORE", "blocked_ranges", client_ip_to_decimal, client_ip_to_decimal, "LIMIT", 0, 1)
-
-redis.breakpoint()
+redis.call("ZRANGEBYSCORE", "blocked_ranges", client_ip_to_decimal, client_ip_to_decimal, "LIMIT", 0, 1)
 
 -- BLOCKING LOGIC
 -- TODO: ZRANGEBYSCORE is deprecated in Redis 6.2+. Replace with ZRANGE

data/lib/wafris/middleware.rb

@@ -7,6 +7,23 @@ module Wafris
     end
 
     def call(env)
+      user_defined_proxies = ENV['MY_PROXIES'].split(',') if ENV['MY_PROXIES']
+
+      valid_ipv4_octet = /\.(25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])/
+
+      trusted_proxies = Regexp.union(
+        /\A127#{valid_ipv4_octet}{3}\z/,                          # localhost IPv4 range 127.x.x.x, per RFC-3330
+        /\A::1\z/,                                                # localhost IPv6 ::1
+        /\Af[cd][0-9a-f]{2}(?::[0-9a-f]{0,4}){0,7}\z/i,           # private IPv6 range fc00 .. fdff
+        /\A10#{valid_ipv4_octet}{3}\z/,                           # private IPv4 range 10.x.x.x
+        /\A172\.(1[6-9]|2[0-9]|3[01])#{valid_ipv4_octet}{2}\z/,   # private IPv4 range 172.16.0.0 .. 172.31.255.255
+        /\A192\.168#{valid_ipv4_octet}{2}\z/,                     # private IPv4 range 192.168.x.x
+        /\Alocalhost\z|\Aunix(\z|:)/i,                            # localhost hostname, and unix domain sockets
+        *user_defined_proxies
+      )
+
+      Rack::Request.ip_filter = lambda { |ip| trusted_proxies.match?(ip) }
+
       request = Rack::Request.new(env)
 
       if Wafris.configuration.enabled? && Wafris.allow_request?(request)

data/lib/wafris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wafris
-  VERSION = "0.5.4"
+  VERSION = "0.6.0"
 end

data/lib/wafris.rb

@@ -33,15 +33,13 @@ module Wafris
       configuration.connection_pool.with do |conn|
         time = Time.now.to_f * 1000
         puts "WAF LOG: headers with http-x-forwarded-for key #{request.get_header(Rack::Request::HTTP_X_FORWARDED_FOR)}"
-        puts "WAF LOG: Client IP #{client_ip(request)}"
-        puts "WAF LOG: Proxy IP #{proxy_ip(request)}"
+        puts "WAF LOG: Client IP #{request.ip}"
         status = conn.evalsha(
           configuration.core_sha,
           argv: [
-            client_ip(request),
+            request.ip,
             IPAddr.new(request.ip).to_i,
             time.to_i,
-            proxy_ip(request),
             request.user_agent,
             request.path,
             request.host
@@ -55,19 +53,5 @@ module Wafris
         end
       end
     end
-
-    private
-
-    def client_ip(request)
-      return request.ip if request.get_header(Rack::Request::HTTP_X_FORWARDED_FOR).eql?(request.ip)
-
-      request.get_header(Rack::Request::HTTP_X_FORWARDED_FOR).split(',').first
-    end
-
-    def proxy_ip(request)
-      return nil if request.get_header(Rack::Request::HTTP_X_FORWARDED_FOR).eql?(request.ip)
-
-      request.get_header(Rack::Request::HTTP_X_FORWARDED_FOR).split(',').last
-    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wafris
 version: !ruby/object:Gem::Version
-  version: 0.5.4
+  version: 0.6.0
 platform: ruby
 authors:
 - Micahel Buckbee
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-06-05 00:00:00.000000000 Z
+date: 2023-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: connection_pool