// Block requests from IPs in blocked_nets. It is important to do this
// early but after recv_fe_ip_processing has been called, as the procedure
// takes care of writing X-Client-IP if it the request did not come
// through the TLS terminator
if (std.ip(req.http.X-Client-IP, "192.0.2.1") ~ blocked_nets) {
    return (synth(403, "Requests from your IP have been blocked, please contact noc@wikimedia.org"));
}

// provides the acl "blocked_nets", "text_abuse_nets", "bot_blocked_nets",
// and "public_cloud_nets".
// The file is made from the abuse_networks block in the private repo
// hieradata/common.yaml, but is actually generated by confd sourcing
// data from etcd to ensure faster response times.
// Must be included before analytics.inc.vcl.
include "blocked-nets.inc.vcl";

# deployment-prep still uses the old template.
$abuse_networks = network::parse_abuse_nets('varnish')
file { '/etc/varnish/blocked-nets.inc.vcl':
    ensure  => present,
    content => template('profile/cache/blocked-nets.inc.vcl.erb'),
    owner   => 'root',
    group   => 'root',
    mode    => '0444',
}

# SPDX-License-Identifier: Apache-2.0                                           
# @summary this function parses a Hash of Network::Abuse_net objects and
#          returns a list of networks appropriate for the context
# @param abuse_nets a list of abuse networks with meta data indicating
#                   where they should be used.
#                   Default: lookup('abuse_networks')
# @param context either ferm or varnish to indicate where the list will be used
function network::parse_abuse_nets(
     Network::Context                    $context,
     Hash[String[1], Network::Abuse_net] $abuse_nets = lookup('abuse_networks'),
) >> Hash[String[1], Network::Abuse_net] {
    $abuse_nets.filter |$key, $values| { $context in $values['context'] }
}

<%#- SPDX-License-Identifier: Apache-2.0 -%>
<%- @abuse_networks.each_pair do |net_name, config| -%>
<%- if config.has_key?('comment') -%>
  <%- config['comment'].split("\n").each do |line| -%>
// <%= line %>
  <%- end -%>
<%- end -%>
acl <%= net_name %> {
  <%- config['networks'].each do |net| -%>
        "<%= net %>";
  <%- end -%>
}
<%- end -%>

acl blocked_nets {
        "14.0.0.0/8";
        "37.0.0.0/8";
        "38.0.0.0/9";
        "38.128.0.0/10";
        "38.192.0.0/11";
        "38.224.0.0/12";
}

if (std.ip(req.http.X-Client-IP, "192.0.2.1") ~ blocked_nets && !(std.ip(req.http.X-Client-IP, "192.0.2.1") ~ allowed_nets)) {
    return (synth(403, "Requests from your IP have been blocked, please contact noc@wikimedia.org"));
}

[21:25:31] <bd808>	 Before I waste energy with a poor implementation, could some of you fine folks look at my idea for making it easier to poke holes in the blocked_nets setting we are using in Beta Cluster? https://phabricator.wikimedia.org/T393481#10802783
[21:25:56] <bd808>	 This would be changes to wikimedia-frontend.vcl.erb
[21:26:38] <bd808>	 feature flagged somehow of course
[22:38:26] <wikibugs>	 06Traffic, 06DC-Ops, 10ops-esams, 06SRE: lvs3009 NIC HW issue (Broadcom, eno8303) - https://phabricator.wikimedia.org/T393616#10806152 (10RobH) url provided by support so i've uploaded the support collection report for their review
[22:53:54] <wikibugs>	 06Traffic, 10Beta-Cluster-Infrastructure: Add allowlist to make poking holes in abuse_networks:blocked_nets:networks easier - https://phabricator.wikimedia.org/T393481#10806169 (10BCornwall)
[22:59:49] <brett>	 bd808: I'm not the authority on this stuff here but it seems like the reasonable way forward to me.
[23:00:33] <brett>	 From a procedure standpoint, though... who's going to be maintaining this list?
[23:11:05] <bd808>	 brett: me and others in the deployment-prep project. We use Horizon to inject hiera settings for the project.
[23:11:25] <brett>	 makes sense
[23:11:59] <bd808>	 https://wikitech.wikimedia.org/wiki/Nova_Resource:Deployment-prep#Blocking is the thing this would help with
[23:13:07] <bd808>	 bots crushed things such that I blocked ~12% of the IPv4 space and have been slowly poking holes for real people who ask. The CIDR math is tedious so we would like to add in an allow list basically.
[23:21:50] <brett>	 Yeah, seems reasonable to me. But I can't speak for v.gut or s.uk

[08:28:40] <vgutierrez>	 bd808: right now the easiest way would be adding a hiera hiera that injects the allowlisted CIDRs on the wikimedia_nets acl
[08:28:54] <vgutierrez>	 s/hiera hiera/hiera key/
[08:29:37] <vgutierrez>	 don't use wikimedia_trust cause those are allowed to set X-F-P

<%#- SPDX-License-Identifier: Apache-2.0 -%>
<%- @abuse_networks.each_pair do |net_name, config| -%>
<%- config['networks'].each do |net| -%>
<%= net %>      abuse=<%= net_name %>
<%- end -%>
<%- end -%>

<%- if @use_allowlist -%>
# T393481: check if the IP is in the allowed networks list
http-request set-var(req.provenance,ifnotexists,ifnotempty) src,map_ip(/etc/haproxy/ipblocks.d/allowed.map)
<%- end -%>
# check if the IP is included in one of our ipblocks
http-request set-var(req.provenance,ifnotexists,ifnotempty) src,map_ip(/etc/haproxy/ipblocks.d/all.map)

1.2.3.4/36 net=allowed
...