chore: spelling

Signed-off-by: Xe Iaso <me@xeiaso.net>

.github/actions/spelling/allow.txt

@@ -39,5 +39,3 @@ wenet
 qwertiko
 setuplistener
 mba
-xfu
-xou

.github/workflows/smoke-tests.yml

@@ -27,7 +27,6 @@ jobs:
           - palemoon/amd64
           #- palemoon/i386
           - robots_txt
-          - traefik
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

docs/docs/CHANGELOG.md

@@ -14,7 +14,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 <!-- This changes the project to: -->
 
 - Patch [GHSA-6wcg-mqvh-fcvg](https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg) by containing subrequest logic to Anubis instances in subrequest mode.
-- Implement robot9001 style delays on the honeypot feature so that the first hit takes 1 millisecond, the second takes 2, etc.
 - Move metrics server configuration to [the policy file](./admin/policies.mdx#metrics-server).
 - Expose [pprof endpoints](https://pkg.go.dev/net/http/pprof) on the metrics listener to enable profiling Anubis in production.
 - fix: prevent nil pointer panic in challenge validation when threshold rules match during PassChallenge (#1463)
@@ -29,7 +28,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fix a bug in the dataset poisoning maze that could allow denial of service [#1580](https://github.com/TecharoHQ/anubis/issues/1580).
 - Add config option to add ASN to logs/metrics.
 - Log weight when issuing challenge
-- Fix `path_regex` and CEL `path` rules not matching when using Traefik `forwardAuth` middleware. Anubis now checks `X-Forwarded-Uri` (Traefik) in addition to `X-Original-URI` (nginx) when resolving the request path in subrequest mode ([#1628](https://github.com/TecharoHQ/anubis/issues/1628)).
 
 ## v1.25.0: Necron
 

go.mod

@@ -106,7 +106,7 @@ require (
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-git/go-git/v5 v5.16.2 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect

go.sum

@@ -189,8 +189,8 @@ github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMj
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
 github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
-github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
-github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
+github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

internal/honeypot/naive/naive.go

@@ -5,7 +5,6 @@ import (
 	_ "embed"
 	"fmt"
 	"log/slog"
-	"math"
 	"math/rand/v2"
 	"net/http"
 	"net/netip"
@@ -169,9 +168,6 @@ func (i *Impl) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	millisecondAmount := math.Pow(float64(networkCount), 2)
-	time.Sleep(time.Duration(millisecondAmount) * time.Millisecond)
-
 	spins := i.makeSpins()
 	affirmations := i.makeAffirmations()
 	title := i.makeTitle()

lib/policy/celchecker.go

@@ -15,10 +15,9 @@ import (
 type CELChecker struct {
 	program cel.Program
 	src     string
-	subRequestMode bool
 }
 
-func NewCELChecker(cfg *config.ExpressionOrList, dnsObj *dns.Dns, subRequestMode bool) (*CELChecker, error) {
+func NewCELChecker(cfg *config.ExpressionOrList, dnsObj *dns.Dns) (*CELChecker, error) {
 	env, err := expressions.BotEnvironment(dnsObj)
 	if err != nil {
 		return nil, err
@@ -32,7 +31,6 @@ func NewCELChecker(cfg *config.ExpressionOrList, dnsObj *dns.Dns, subRequestMode
 	return &CELChecker{
 		src:     cfg.String(),
 		program: program,
-		subRequestMode: subRequestMode,
 	}, nil
 }
 
@@ -41,7 +39,7 @@ func (cc *CELChecker) Hash() string {
 }
 
 func (cc *CELChecker) Check(r *http.Request) (bool, error) {
-	result, _, err := cc.program.ContextEval(r.Context(), &CELRequest{r, cc.subRequestMode})
+	result, _, err := cc.program.ContextEval(r.Context(), &CELRequest{r})
 
 	if err != nil {
 		return false, err
@@ -56,7 +54,6 @@ func (cc *CELChecker) Check(r *http.Request) (bool, error) {
 
 type CELRequest struct {
 	*http.Request
-	subRequestMode bool
 }
 
 func (cr *CELRequest) Parent() cel.Activation { return nil }
@@ -74,14 +71,6 @@ func (cr *CELRequest) ResolveName(name string) (any, bool) {
 	case "userAgent":
 		return cr.UserAgent(), true
 	case "path":
-		if cr.subRequestMode {
-			if xou := cr.Header.Get("X-Original-URI"); xou != "" {
-				return xou, true
-			}
-			if xfu := cr.Header.Get("X-Forwarded-Uri"); xfu != "" {
-				return xfu, true
-			}
-		}
 		return cr.URL.Path, true
 	case "query":
 		return expressions.URLValues{Values: cr.URL.Query()}, true

lib/policy/celchecker_test.go

@@ -23,7 +23,7 @@ func TestCELChecker_MapIterationWrappers(t *testing.T) {
 		Expression: `headers.exists(k, k == "Accept") && query.exists(k, k == "format")`,
 	}
 
-	checker, err := NewCELChecker(cfg, newTestDNS(t), false)
+	checker, err := NewCELChecker(cfg, newTestDNS(t))
 	if err != nil {
 		t.Fatalf("creating CEL checker failed: %v", err)
 	}
@@ -42,77 +42,3 @@ func TestCELChecker_MapIterationWrappers(t *testing.T) {
 		t.Fatal("expected expression to evaluate true")
 	}
 }
-
-func TestCELChecker_PathWithForwardedUri(t *testing.T) {
-	tests := []struct {
-		name           string
-		expression     string
-		xForwardedUri  string
-		urlPath        string
-		subRequestMode bool
-		want           bool
-	}{
-		{
-			name:           "path matches X-Forwarded-Uri in subrequest mode",
-			expression:     `path.startsWith("/admin")`,
-			xForwardedUri:  "/admin/secret",
-			urlPath:        "/.within.website/x/cmd/anubis/api/check",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "path with query string",
-			expression:     `path.startsWith("/api/secret")`,
-			xForwardedUri:  "/api/secret?token=abc",
-			urlPath:        "/.within.website/x/cmd/anubis/api/check",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "path falls back to url path when no header",
-			expression:     `path == "/public/page"`,
-			urlPath:        "/public/page",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "non-subrequest mode ignores X-Forwarded-Uri",
-			expression:     `path.startsWith("/admin")`,
-			xForwardedUri:  "/admin/secret",
-			urlPath:        "/public/page",
-			subRequestMode: false,
-			want:           false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := &config.ExpressionOrList{
-				Expression: tt.expression,
-			}
-			checker, err := NewCELChecker(cfg, newTestDNS(t), tt.subRequestMode)
-			if err != nil {
-				t.Fatalf("NewCELChecker() error: %v", err)
-			}
-
-			req, err := http.NewRequest(http.MethodGet, "http://example.com"+tt.urlPath, nil)
-			if err != nil {
-				t.Fatalf("http.NewRequest: %v", err)
-			}
-
-			if tt.xForwardedUri != "" {
-				req.Header.Set("X-Forwarded-Uri", tt.xForwardedUri)
-			}
-
-			got, err := checker.Check(req)
-			if err != nil {
-				t.Fatalf("Check() error: %v", err)
-			}
-
-			if got != tt.want {
-				t.Errorf("Check() = %v, want %v (subRequestMode=%v, urlPath=%q, X-Forwarded-Uri=%q)",
-					got, tt.want, tt.subRequestMode, tt.urlPath, tt.xForwardedUri)
-			}
-		})
-	}
-}

lib/policy/checker.go

@@ -110,9 +110,6 @@ func NewPathChecker(rexStr string, subrequestMode bool) (checker.Impl, error) {
 func (pc *PathChecker) Check(r *http.Request) (bool, error) {
 	if pc.subRequestMode {
 		originalUrl := r.Header.Get("X-Original-URI")
-		if originalUrl == "" {
-			originalUrl = r.Header.Get("X-Forwarded-Uri")
-		}
 		if originalUrl != "" {
 			if pc.regexp.MatchString(originalUrl) {
 				return true, nil

lib/policy/checker_test.go

@@ -410,119 +410,3 @@ func TestPathChecker_GHSA_6wcg_mqvh_fcvg(t *testing.T) {
 		})
 	}
 }
-
-func TestPathChecker_XForwardedUri(t *testing.T) {
-	tests := []struct {
-		name           string
-		regex          string
-		xForwardedUri  string
-		xOriginalURI   string
-		urlPath        string
-		subRequestMode bool
-		want           bool
-	}{
-		{
-			name:           "X-Forwarded-Uri matches regex in subrequest mode",
-			regex:          "^/admin/.*",
-			xForwardedUri:  "/admin/users",
-			urlPath:        "/.within.website/x/cmd/anubis/api/check",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "X-Forwarded-Uri with query string",
-			regex:          "^/admin/.*",
-			xForwardedUri:  "/admin/users?page=1",
-			urlPath:        "/.within.website/x/cmd/anubis/api/check",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "X-Original-URI takes priority over X-Forwarded-Uri",
-			regex:          "^/admin/.*",
-			xForwardedUri:  "/public/page",
-			xOriginalURI:   "/admin/users",
-			urlPath:        "/.within.website/x/cmd/anubis/api/check",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "falls back to X-Forwarded-Uri when no X-Original-URI",
-			regex:          "^/admin/.*",
-			xForwardedUri:  "/admin/dashboard",
-			urlPath:        "/.within.website/x/cmd/anubis/api/check",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "neither header matches, url path matches",
-			regex:          "^/public/.*",
-			xForwardedUri:  "/admin/users",
-			urlPath:        "/public/page",
-			subRequestMode: true,
-			want:           true,
-		},
-		{
-			name:           "nothing matches",
-			regex:          "^/admin/.*",
-			xForwardedUri:  "/public/page",
-			urlPath:        "/.within.website/x/cmd/anubis/api/check",
-			subRequestMode: true,
-			want:           false,
-		},
-		{
-			name:           "non-subrequest mode ignores X-Forwarded-Uri",
-			regex:          "^/admin/.*",
-			xForwardedUri:  "/admin/users",
-			urlPath:        "/public/page",
-			subRequestMode: false,
-			want:           false,
-		},
-		{
-			name:           "non-subrequest mode uses url path",
-			regex:          "^/admin/.*",
-			xForwardedUri:  "/public/page",
-			urlPath:        "/admin/secret",
-			subRequestMode: false,
-			want:           true,
-		},
-		{
-			name:           "empty X-Forwarded-Uri falls back to url path",
-			regex:          "^/check$",
-			urlPath:        "/check",
-			subRequestMode: true,
-			want:           true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			pc, err := NewPathChecker(tt.regex, tt.subRequestMode)
-			if err != nil {
-				t.Fatalf("NewPathChecker(%q, %v) returned error: %v", tt.regex, tt.subRequestMode, err)
-			}
-
-			req, err := http.NewRequest(http.MethodGet, "http://example.com"+tt.urlPath, nil)
-			if err != nil {
-				t.Fatalf("http.NewRequest: %v", err)
-			}
-
-			if tt.xForwardedUri != "" {
-				req.Header.Set("X-Forwarded-Uri", tt.xForwardedUri)
-			}
-			if tt.xOriginalURI != "" {
-				req.Header.Set("X-Original-URI", tt.xOriginalURI)
-			}
-
-			got, err := pc.Check(req)
-			if err != nil {
-				t.Fatalf("Check() unexpected error: %v", err)
-			}
-
-			if got != tt.want {
-				t.Errorf("Check() = %v, want %v (subRequestMode=%v, urlPath=%q, X-Forwarded-Uri=%q, X-Original-URI=%q)",
-					got, tt.want, tt.subRequestMode, tt.urlPath, tt.xForwardedUri, tt.xOriginalURI)
-			}
-		})
-	}
-}

lib/policy/policy.go

@@ -170,7 +170,7 @@ func ParseConfig(ctx context.Context, fin io.Reader, fname string, defaultDiffic
 		}
 
 		if b.Expression != nil {
-			c, err := NewCELChecker(b.Expression, result.Dns, subrequestMode)
+			c, err := NewCELChecker(b.Expression, result.Dns)
 			if err != nil {
 				validationErrs = append(validationErrs, fmt.Errorf("while processing rule %s expressions: %w", b.Name, err))
 			} else {

package.json

@@ -20,11 +20,11 @@
   "author": "",
   "license": "ISC",
   "devDependencies": {
-    "@commitlint/cli": "^20.5.3",
-    "@commitlint/config-conventional": "^20.5.3",
-    "baseline-browser-mapping": "^2.10.27",
-    "cssnano": "^7.1.8",
-    "cssnano-preset-advanced": "^7.0.16",
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
+    "baseline-browser-mapping": "^2.10.15",
+    "cssnano": "^7.1.4",
+    "cssnano-preset-advanced": "^7.0.12",
     "esbuild": "^0.28.0",
     "husky": "^9.1.7",
     "playwright": "^1.52.0",
@@ -32,7 +32,7 @@
     "postcss-import": "^16.1.1",
     "postcss-import-url": "^7.2.0",
     "postcss-url": "^10.1.3",
-    "prettier": "^3.8.3"
+    "prettier": "^3.8.1"
   },
   "dependencies": {
     "@aws-crypto/sha256-js": "^5.2.0",

test/traefik/anubis.yaml

@@ -1,16 +0,0 @@
-bots:
-  - name: block-admin-via-regex
-    path_regex: ^/admin(/.*)?$
-    action: DENY
-
-  - name: block-secret-via-cel
-    expression:
-      all:
-        - 'path.startsWith("/api/secret")'
-    action: DENY
-
-  - import: (data)/meta/default-config.yaml
-
-status_codes:
-  CHALLENGE: 200
-  DENY: 403

test/traefik/docker-compose.yaml

@@ -1,27 +0,0 @@
-services:
-  traefik:
-    image: traefik:v3.3
-    restart: always
-    ports:
-      - 8080:80
-    volumes:
-      - ./traefik.yml:/etc/traefik/traefik.yml:ro
-      - ./http.yaml:/config/http.yaml:ro
-
-  anubis:
-    image: ko.local/anubis
-    restart: always
-    environment:
-      BIND: ":8080"
-      TARGET: " "
-      POLICY_FNAME: /etc/techaro/anubis.yaml
-      PUBLIC_URL: http://localhost:8080/.within.website/x/cmd/anubis
-      COOKIE_DOMAIN: localhost
-      USE_REMOTE_ADDRESS: "true"
-    volumes:
-      - ./anubis.yaml:/etc/techaro/anubis.yaml
-
-  backend:
-    image: ghcr.io/xe/x/httpdebug
-    pull_policy: always
-    restart: always

test/traefik/http.yaml

@@ -1,30 +0,0 @@
-http:
-  middlewares:
-    anubis:
-      forwardAuth:
-        address: http://anubis:8080/.within.website/x/cmd/anubis/api/check
-        trustForwardHeader: true
-
-  routers:
-    anubis-assets:
-      rule: Host(`localhost`) && PathPrefix(`/.within.website/x/cmd/anubis`)
-      entryPoints:
-        - web
-      service: anubis
-    backend:
-      rule: Host(`localhost`)
-      entryPoints:
-        - web
-      service: backend
-      middlewares:
-        - anubis
-
-  services:
-    anubis:
-      loadBalancer:
-        servers:
-          - url: http://anubis:8080
-    backend:
-      loadBalancer:
-        servers:
-          - url: http://backend:3000

test/traefik/test.mjs

@@ -1,33 +0,0 @@
-// Smoke test for https://github.com/TecharoHQ/anubis/issues/1628
-//
-// Traefik's forwardAuth middleware calls Anubis at the literal path
-// /.within.website/x/cmd/anubis/api/check and conveys the original URL in the
-// X-Forwarded-Uri header. Path-targeting policy rules must match that header
-// (not r.URL.Path), otherwise every request looks like a request to /check.
-
-const BASE = "http://localhost:8080";
-const UA = "Mozilla/5.0 (compatible; AnubisTraefikSmoke/1.0)";
-
-const cases = [
-  { path: "/", expected: 307, why: "control: no DENY rule, default challenge redirect" },
-  { path: "/free", expected: 307, why: "control: no DENY rule, default challenge redirect" },
-  { path: "/admin", expected: 403, why: "path_regex must match X-Forwarded-Uri, not 307 or 200" },
-  { path: "/admin/users", expected: 403, why: "path_regex must match X-Forwarded-Uri, not 307 or 200" },
-  { path: "/api/secret", expected: 403, why: "CEL path must match X-Forwarded-Uri, not 307 or 200" },
-];
-
-let failed = false;
-
-for (const c of cases) {
-  const resp = await fetch(`${BASE}${c.path}`, {
-    headers: { "User-Agent": UA },
-    redirect: "manual",
-  });
-  const ok = resp.status === c.expected;
-  console.log(
-    `${ok ? "PASS" : "FAIL"}: GET ${c.path} → ${resp.status} (want ${c.expected}: ${c.why})`,
-  );
-  if (!ok) failed = true;
-}
-
-process.exit(failed ? 1 : 0);

test/traefik/test.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-set -eo pipefail
-
-export VERSION=${GITHUB_SHA:-devel}-test
-export KO_DOCKER_REPO=ko.local
-
-set -u
-
-source ../lib/lib.sh
-
-build_anubis_ko
-
-function cleanup() {
-	docker compose down -t 1 || :
-}
-
-trap cleanup EXIT SIGINT
-
-docker compose up -d
-
-backoff-retry --try-count 20 node ./test.mjs

test/traefik/traefik.yml

@@ -1,8 +0,0 @@
-entryPoints:
-  web:
-    address: ":80"
-
-providers:
-  file:
-    directory: /config
-    watch: false

test/traefik/var/.gitignore

@@ -1,2 +0,0 @@
-*
-!.gitignore