WeebDataHoarder
0e62f80f9b
challenges: prevent unbounded growth of stored cookies by bundling all state onto a single JWT token
2025-05-03 17:30:39 +02:00
WeebDataHoarder
d412672ed4
state: explicitly free resources on Close()
2025-05-01 14:16:19 +02:00
WeebDataHoarder
d6c29846df
condition: generalize AST compilation, hot load network prefix blocks as needed, walk the AST and detect and preload networks
2025-05-01 02:40:43 +02:00
WeebDataHoarder
fccaa64fad
conditions: verify that AST condition result is bool
2025-05-01 01:58:08 +02:00
WeebDataHoarder
a9f03267b6
settings: allow transparent backends that don't set all values
2025-04-30 20:54:50 +02:00
WeebDataHoarder
a87023861a
state: fix errors when loading network lists
2025-04-29 13:45:30 +02:00
WeebDataHoarder
b8bf35d4de
utils: fix radb fetching lines too long for scanner buffer size, allow caching empty results
2025-04-27 22:04:21 +02:00
WeebDataHoarder
b285c13e4c
state: do not cache network prefixes if they have zero entries
2025-04-27 21:49:44 +02:00
WeebDataHoarder
3234c4e801
feature: Implement <meta> tag fetcher from backends with allow-listed entries to prevent unwanted keys to pass
2025-04-27 21:40:59 +02:00
WeebDataHoarder
a85aa95dbd
cmd: support changing path from well-known prefix, allow configuring full path
2025-04-25 22:16:09 +02:00
WeebDataHoarder
a1f97adde8
metrics: fix global state reset on policy reload
2025-04-25 22:11:08 +02:00
WeebDataHoarder
4d7436c51b
cel: use generic env from https://codeberg.org/gone/http-cel
2025-04-25 12:08:55 +02:00
WeebDataHoarder
47f9f6fee6
metrics: Added prometheus metrics for rules and challenges
2025-04-25 11:27:42 +02:00
WeebDataHoarder
9541c58eeb
settings: introduce settings YAML file to complement cmd arguments
2025-04-24 18:26:06 +02:00
WeebDataHoarder
57755112ea
ci: check example policy files
...
cmd: add check parameter
2025-04-23 20:35:20 +02:00
WeebDataHoarder
6bb7ca979d
Implement cache for networks
2025-04-23 20:35:20 +02:00
WeebDataHoarder
a0224cb21c
policy: allow fetching ASN directly via RADb WHOIS service
2025-04-23 20:35:20 +02:00
WeebDataHoarder
ead41055ca
Condition, rules, state and action refactor / rewrite
...
Add nested rules
Add backend action, allow wildcard in backends
Remove poison from tree, update README with action table
Allow defining pass/fail actions on challenge,
Remove redirect/referer parameters on backend pass
Set challenge cookie tied to host
Rewrite DNSBL condition into a challenge
Allow passing an arbitrary path for assets to js challenges
Optimize programs exhaustively on compilation
Activation instead of map for CEL context, faster map access, new network override
Return valid host on cookie setting in case Host is an IP address.
bug: does not work with IPv6, see https://github.com/golang/go/issues/65521
Apply TLS fingerprinter on GetConfigForClient instead of GetCertificate
Cleanup go-away cookies before passing to backend
Code action for specifically replying with an HTTP code
2025-04-23 20:35:20 +02:00
WeebDataHoarder
c84c67439e
Only error when target network list is not reachable
2025-04-15 19:23:04 +02:00
WeebDataHoarder
7829eece77
Added backend IP header support
2025-04-11 06:02:01 +02:00
WeebDataHoarder
ca4101df7c
Use self-redirect on cookie challenge
2025-04-10 05:27:44 +02:00
WeebDataHoarder
527f1342e8
Issue token then redirect to verify under cookie challenge
2025-04-10 05:15:48 +02:00
WeebDataHoarder
ce111f6ae9
Add DNSBL querying in conditions
2025-04-08 22:11:58 +02:00
WeebDataHoarder
186904e020
Mark challenge keys with whether client was ipv4 or ipv6, allow retrying IPv4 -> IPv6 happy eyeballs automatically
2025-04-08 14:07:24 +02:00
WeebDataHoarder
baf9df9f0a
Allow conditions on challenges, and early hint deadline
2025-04-08 11:40:16 +02:00
WeebDataHoarder
f272a5ae72
Load challenge as style
2025-04-08 02:38:53 +02:00
WeebDataHoarder
2ce9709667
New challenge for HTTP/2 clients, preload-link
2025-04-08 02:17:03 +02:00
WeebDataHoarder
b3f471bb30
Pass http challenge if we passed it previously on the request
2025-04-07 23:44:29 +02:00
WeebDataHoarder
1c2d1e008c
Added refresh button to challenges and deny pages where reasonable, ensure no open redirect or other
2025-04-07 19:24:22 +02:00
WeebDataHoarder
e08a5697f6
Minor cleanup of challenges code, bind session http cookies to issued tokens
2025-04-07 19:00:53 +02:00
WeebDataHoarder
0968e6feae
Move challenge structs to external state
2025-04-07 16:22:16 +02:00
WeebDataHoarder
02f3c1cb19
Rearranged wasm challenge utils
2025-04-06 12:51:27 +02:00
WeebDataHoarder
65561ab00e
Add wasm helper, wasm test utility
2025-04-06 11:44:06 +02:00
WeebDataHoarder
411f028f56
Move backends to cmd args, allow setting private key seed via parameter or ENV var
2025-04-06 03:08:19 +02:00
WeebDataHoarder
7d436cbdb4
Embed go exp package requirements to ensure we don't use arbitrary exp, move utilities to utils
2025-04-06 02:02:54 +02:00
WeebDataHoarder
617ec804bc
Closer file structure to desired
2025-04-06 01:46:18 +02:00
WeebDataHoarder
c23cea260c
Add must-revalidate cache-control header on challenge mjs
2025-04-04 13:13:46 +02:00
WeebDataHoarder
e9269338e7
Add response poisoning
2025-04-03 14:18:55 +02:00
WeebDataHoarder
01466e1686
Changed level for startup messages
2025-04-03 06:24:06 +02:00
WeebDataHoarder
c76889efa2
Add logging levels and timings
2025-04-03 06:16:44 +02:00
WeebDataHoarder
f9634cfc71
Revamp templates, allow loading external templates, support themes
2025-04-03 04:39:33 +02:00
WeebDataHoarder
150927e7ba
Allow multiple backends
2025-04-02 19:23:09 +02:00
WeebDataHoarder
8d9d5a8ab3
Allow sending resources on key challenge, send multiple challenges to specific browsers
2025-04-02 14:43:39 +02:00
WeebDataHoarder
dbff9342cb
Added method matching on rules
2025-04-02 14:08:18 +02:00
WeebDataHoarder
b6537eaf50
Add resource-load challenge
2025-04-02 11:41:29 +02:00
WeebDataHoarder
3cd880b169
Proper challenge/error pages
2025-04-01 22:12:15 +02:00
WeebDataHoarder
df5e125cf2
Move most code under lib
2025-04-01 21:22:19 +02:00
