sneak/smallwebwaf
1
0
Fork 0
Code Issues 47 Pull Requests 2 Actions 51 Packages Projects Releases Wiki Activity
47 Commits 3 Branches 0 Tags
0b7e157f2b3d5255ed16abb25abd7e369b7d0983
Commit Graph
3 Commits
Author SHA1 Message Date
clawbot 0b7e157f2b DNS blocklists asked in the background, verdicts kept (closes #104)
check / check (push) Waiting to run
Details 
Work in progress.

Model: opus-5-5
 2026-10-07 17:50:47 +00:00
clawbot 2b8c98ba1f Blocklists and an AS percentage file fetched by URL (closes #29)
check / check (push) Waiting to run
Details 
SWWAF_BLOCKLIST_URLS names lists of addresses and netblocks, fetched every
SWWAF_BLOCKLIST_REFRESH (24h, never under 1h); an IPv4-mapped line stands
for its IPv4 address or netblock. reputation.json keeps each list's last
try, failed or not, even one cut off by a stop, which a restart waits on
as a running instance does, and its last good copy, whole, used while a
fetch fails. SWWAF_BLOCKLIST_ACTION denies, limits or only logs a listed
client; the log line names the lists, each raises reputation_hit, and a
failed fetch raises source_failure. SWWAF_ASN_LIMIT_PERCENT_URL is fetched
the same way and counts as SWWAF_ASN_LIMIT_PERCENT does, the lower winning.

Judgement call: a failed fetch is retried after the refresh, not sooner.
Not done: ban notes do not name the lists yet.

Model: opus-5-5
 2026-10-07 19:09:41 +02:00
clawbot 2421cdc273 Lower limits for listed AS numbers and countries (closes #21)
check / check (push) Waiting to run
Details 
SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT give the clients
of the AS numbers and countries they list that percentage of every rate
and byte limit, rounded down; SWWAF_ASN_BYTES_PERCENT and
SWWAF_COUNTRY_BYTES_PERCENT take its place for the byte limits of those
they list; SWWAF_UNKNOWN_LIMIT_PERCENT (100) covers clients without a
country. The lowest applies. While one lowers a limit, a request waits
for its client's lookup, and SWWAF_LOOKUP_SOURCE=off stops the start. Log
lines give limit_percent and bytes_percent with their settings; ban
notes, and so alerts, give the broken limit's.

Judgement call: a client without a country is unknown, whatever its AS number.
Judgement call: bytes_percent and its setting are log fields SPEC does not name.
Rule suppressed: funlen on FromEnvironment, one line per setting.

Model: opus-5-5
 2026-10-07 14:22:01 +02:00