Canithesis/checkpoint
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

logging: improve action

Browse Source
This commit is contained in:
Vaxry
2025-04-28 17:43:57 +01:00
parent fd9baeeab8
commit 467d19d8c3
7 changed files with 28 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/core/Challenge.cpp
View File

@@ -49,12 +49,7 @@ CChallenge::CChallenge(const std::string& jsonResponse) {
CChallenge::CChallenge(const Pistache::Http::Request& reqResponse) {
auto& q = reqResponse.query();
if (!q.has("solution")
|| !q.has("fingerprint")
|| !q.has("challenge")
|| !q.has("timestamp")
|| !q.has("sig")
|| !q.has("difficulty"))
if (!q.has("solution") || !q.has("fingerprint") || !q.has("challenge") || !q.has("timestamp") || !q.has("sig") || !q.has("difficulty"))
return;
m_challenge = q.get("challenge").value();

18
src/core/Handler.cpp
View File

@@ -167,14 +167,14 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
Debug::log(TRACE, "Request looks like it is coming from git (UA + GP). Accepting.");
proxyPass(req, response);
g_pTrafficLogger->logTraffic(req, IP_ACTION_ALLOW);
g_pTrafficLogger->logTraffic(req, "PASS (git)");
return;
} else if (userAgentHeader->agent().starts_with("git/")) {
Debug::log(LOG, " | Action: PASS (git)");
Debug::log(TRACE, "Request looks like it is coming from git (UA git). Accepting.");
proxyPass(req, response);
g_pTrafficLogger->logTraffic(req, IP_ACTION_ALLOW);
g_pTrafficLogger->logTraffic(req, "PASS (git)");
return;
}
}
@@ -190,12 +190,12 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
case IP_ACTION_DENY:
Debug::log(LOG, " | Action: DENY (rule)");
response.send(Pistache::Http::Code::Forbidden, "Blocked by checkpoint");
g_pTrafficLogger->logTraffic(req, IP_ACTION_DENY);
g_pTrafficLogger->logTraffic(req, "DENY (rule)");
return;
case IP_ACTION_ALLOW:
Debug::log(LOG, " | Action: PASS (rule)");
proxyPass(req, response);
g_pTrafficLogger->logTraffic(req, IP_ACTION_ALLOW);
g_pTrafficLogger->logTraffic(req, "PASS (rule)");
return;
case IP_ACTION_CHALLENGE:
Debug::log(LOG, " | Action: CHALLENGE (rule)");
@@ -218,7 +218,7 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
std::chrono::duration_cast<std::chrono::milliseconds>(TOKEN.issued().time_since_epoch()).count();
if (AGE <= TOKEN_MAX_AGE_MS && TOKEN.fingerprint() == NRequestUtils::fingerprintForRequest(req)) {
Debug::log(LOG, " | Action: PASS (token)");
g_pTrafficLogger->logTraffic(req, IP_ACTION_ALLOW);
g_pTrafficLogger->logTraffic(req, "PASS (token)");
proxyPass(req, response);
return;
} else { // token has been used from a different IP or is expired. Nuke it.
@@ -249,12 +249,14 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
if (ec) {
// bad resource
response.send(Pistache::Http::Code::Bad_Request, "Bad Request");
g_pTrafficLogger->logTraffic(req, "BAD_CHECKPOINT_RESOURCE");
return;
}
if (!PATH_ABSOLUTE.string().starts_with(HTML_ROOT)) {
// directory traversal
response.send(Pistache::Http::Code::Bad_Request, "Bad Request");
g_pTrafficLogger->logTraffic(req, "BAD_CHECKPOINT_RESOURCE");
return;
}
@@ -270,10 +272,11 @@ void CServerHandler::onRequest(const Pistache::Http::Request& req, Pistache::Htt
auto body = NFsUtils::readFileAsString(PATH_ABSOLUTE).value_or("");
response.send(body.empty() ? Pistache::Http::Code::Internal_Server_Error : Pistache::Http::Code::Ok, body);
g_pTrafficLogger->logTraffic(req, "PASS (Checkpoint resource)");
return;
}
g_pTrafficLogger->logTraffic(req, IP_ACTION_CHALLENGE);
g_pTrafficLogger->logTraffic(req, "CHALLENGE");
serveStop(req, response, challengeDifficulty);
}
@@ -294,6 +297,7 @@ void CServerHandler::challengeSubmitted(const Pistache::Http::Request& req, Pist
if (!CHALLENGE.valid()) {
response.send(Pistache::Http::Code::Bad_Request, "Bad request");
g_pTrafficLogger->logTraffic(req, "CHALLENGE_FAIL");
return;
}
@@ -322,6 +326,8 @@ void CServerHandler::challengeSubmitted(const Pistache::Http::Request& req, Pist
response.headers().add<Pistache::Http::Header::Location>("/");
response.send(Pistache::Http::Code::Moved_Permanently, "");
}
g_pTrafficLogger->logTraffic(req, "CHALLENGE_PASS");
}
void CServerHandler::serveStop(const Pistache::Http::Request& req, Pistache::Http::ResponseWriter& response, int difficulty) {

15
src/logging/TrafficLogger.cpp
View File

@@ -74,18 +74,7 @@ static std::string sanitize(const std::string& s) {
return cpy;
}
static const char* actionToString(eConfigIPAction a) {
switch (a) {
case IP_ACTION_CHALLENGE: return "CHALLENGE";
case IP_ACTION_ALLOW: return "ALLOW";
case IP_ACTION_DENY: return "DENY";
case IP_ACTION_NONE: return "NONE";
}
return "ERROR";
}
void CTrafficLogger::logTraffic(const Pistache::Http::Request& req, eConfigIPAction actionTaken) {
void CTrafficLogger::logTraffic(const Pistache::Http::Request& req, const char* actionTaken) {
if (!g_pConfig->m_config.logging.log_traffic)
return;
@@ -125,7 +114,7 @@ void CTrafficLogger::logTraffic(const Pistache::Http::Request& req, eConfigIPAct
}
case TRAFFIC_ACTION: {
ss << fmt::format("{},", actionToString(actionTaken));
ss << fmt::format("{},", actionTaken);
break;
}
}

2
src/logging/TrafficLogger.hpp
View File

@@ -14,7 +14,7 @@ class CTrafficLogger {
CTrafficLogger();
~CTrafficLogger();
void logTraffic(const Pistache::Http::Request& req, eConfigIPAction actionTaken);
void logTraffic(const Pistache::Http::Request& req, const char* actionTaken);
private:
enum eTrafficLoggerProps : uint8_t {