Repository navigation
feat: Add Bifrost log parser and brute force scenario - #1958
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Untrusted forwarded addresses and upstream-provider 401 responses can cause bans against unrelated or legitimate clients.
2 open issues
What changed in this PR
Adds Bifrost support to the Hub through a JSON request-log parser, per-IP brute-force detection, and an installable collection.
Changes:
- Extracts HTTP metadata and client addresses, classifying 401 responses as failed authentication.
- Adds a brute-force scenario and collection with acquisition and proxy guidance.
- Adds synthetic fixtures and generated assertions for parsing and scenario behavior.
| File | Description |
|---|---|
scenarios/sdwilsh/bifrost-bf.yaml |
Defines per-IP failed-authentication detection. |
scenarios/sdwilsh/bifrost-bf.md |
Documents thresholds and proxy requirements. |
parsers/s01-parse/sdwilsh/bifrost-logs.yaml |
Parses Bifrost JSON request metadata. |
parsers/s01-parse/sdwilsh/bifrost-logs.md |
Documents parsing and acquisition setup. |
collections/sdwilsh/bifrost.yml |
Bundles the parser and scenario. |
collections/sdwilsh/bifrost.md |
Provides collection setup guidance. |
.tests/bifrost-logs/parser.assert |
Records expected parser output. |
.tests/bifrost-logs/config.yaml |
Configures parser test dependencies. |
.tests/bifrost-logs/bifrost-logs.log |
Covers address fallback and log filtering. |
.tests/bifrost-bf/scenario.assert |
Verifies the expected six-event alert. |
.tests/bifrost-bf/config.yaml |
Configures scenario testing. |
.tests/bifrost-bf/bifrost-bf.log |
Exercises per-IP counting and status filtering. |
Review effort: Balanced
This adds a parser for Bifrost (maximhq/bifrost) JSON request logs, a scenario for repeated failed authentication per client IP, and a collection bundling both. A request counts as a failed authentication when it returns HTTP 401 within 10ms. Bifrost rejects bad virtual keys before contacting a provider, while a 401 passed through from a provider needs a network round trip. The source IP is the connecting peer, unless the peer is a private, loopback or CGNAT address (a reverse proxy). Only then is `http.forwarded_for` used, so a client reaching Bifrost directly cannot choose the address that gets banned. Tested with `cscli hubtest run bifrost-logs bifrost-bf`: both pass. Test fixtures are synthetic lines modeled on real Bifrost logs.
Bifrost logs the first X-Forwarded-For entry, so an appending proxy lets the client choose the banned IP. Show the overwrite form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This adds a parser for Bifrost (maximhq/bifrost) JSON request logs, a scenario for repeated failed authentication (HTTP 401) per client IP, and a collection bundling both. The source IP is the first valid IP in
http.forwarded_for, falling back tohttp.remote_addr.Tested with
cscli hubtest run bifrost-logs bifrost-bf: both pass. Test fixtures are synthetic lines modeled on real Bifrost logs from my own deployment.Checklist