smallwebwaf

78 Commits 5 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	33b8d81be1	rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171 ) check / check (push) Successful in 4m26s Details `smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over HTTP/1.1, and passes what servewaf allows to the app within its own limits. Any other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION decides only when servewaf cannot be connected to, does not answer at all, or does not answer within SWRP_TIMEOUT_MS. Only the methods SPEC.md lists pass on; any other gets 405. Duplication: internal/rproxy copies passing-on code from internal/proxy until #172 removes the originals. Rule suppressed: gosec G704 and G705; paralleltest on one test. Judgement call: an answer over 1 MiB, or with a status below 100, gets 502. Judgement call: every target not starting with one / gets 400. Model: opus-5-5	2026-11-05 03:07:45 +00:00
clawbot	2eeea136e8	servewaf answers rproxy's question about each request and takes its report (closes #170 ) check / check (push) Failing after 14m16s Details `smallwebwaf servewaf` runs today's checks on the visitor's request each question carries, answers rproxy, and passes nothing to an app. rproxy reports every request servewaf answered. A report counts an allowed request's bytes and writes servewaf's second log line. The table holds a copy of what a report needs, never the request, so a report cannot reach a request being handled. Judgement call: a question's body is read before any check; over 64 KiB gets 400. Judgement call: a report's bytes and durations have ceilings, so they cannot overflow. Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close. Model: opus-5-5	2026-11-05 00:32:08 +01:00
clawbot	f408f42b28	SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 ) check / check (push) Canceled after 0s Details SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)	2026-10-26 03:06:28 +01:00

Author

SHA1

Message

Date

sneak

33b8d81be1

rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171 )

check / check (push) Successful in 4m26s

Details

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over
HTTP/1.1, and passes what servewaf allows to the app within its own limits. Any
other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
decides only when servewaf cannot be connected to, does not answer at all, or
does not answer within SWRP_TIMEOUT_MS. Only the methods SPEC.md lists pass on;
any other gets 405.

Duplication: internal/rproxy copies passing-on code from internal/proxy until
#172 removes the originals.
Rule suppressed: gosec G704 and G705; paralleltest on one test.
Judgement call: an answer over 1 MiB, or with a status below 100, gets 502.
Judgement call: every target not starting with one / gets 400.

Model: opus-5-5

2026-11-05 03:07:45 +00:00

clawbot

2eeea136e8

servewaf answers rproxy's question about each request and takes its report (closes #170 )

check / check (push) Failing after 14m16s

Details

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

2026-11-05 00:32:08 +01:00

clawbot

f408f42b28

SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 )

check / check (push) Canceled after 0s

Details

SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8.

Model: fable-5-1 (writing); opus-5-5 (review, merge)

2026-10-26 03:06:28 +01:00