5 Commits

Include renames

Author	SHA1	Message	Date
sneak	365e1a3e01	SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220) ... gitea's fixes (its parameters, its cookies and gitea.conf) now apply only to a hostname SWW_APPS lists gitea for, or to every hostname while it is unset. Each app's fixes are one .conf file, whose first rule skips the rest unless Inspect sets tx.app_<name>, and one entry in apps. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Model: opus-5-5	2026-11-07 13:14:29 +00:00
clawbot	beb503b233	Rename the program to sww and its deciding daemon to discriminator (closes #218) (#221)	2026-11-07 06:51:06 +01:00
clawbot	2e2f6f7175	Core Rule Set: gitea's ordinary requests pass by default (#208)	2026-11-07 05:21:22 +01:00
clawbot	6fcbda6ece	Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116) ... SWWAF_WAF_BODY_LIMIT (default off, at most 1G) has the Core Rule Set read form data and multipart up to the limit, the rest streaming on, and JSON and XML no larger than it, with text/json and the application and text types ending in +json or +xml. The part read is held for the app. A size or time limit met while reading ends the request. Content-Encoding is refused again on these kinds. A body Coraza cannot parse, or a multipart body failing its strict checks, adds 5, as does a multipart body the limit cuts in a part's headers before a colon or a line feed. Coraza is built with no_fs_access, so writes no file. Rule 900300 moves to phase 2. Judgement call: Content-Encoding is refused on a JSON or XML body too large to read, as SPEC.md allows. Model: opus-5-5	2026-10-08 12:59:13 +02:00
clawbot	80f4c2cc61	The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25) ... Coraza v3.8.1 runs the Core Rule Set 4.25.0 (coraza-coreruleset v4.25.0) after the rule files, with the six changes and the default SWWAF_WAF_DISABLED_RULES that SPEC.md gives; no body, no response. The parameter names in the third and fourth changes are matched in any case, as Coraza does. SWWAF_WAF_DISABLED_RULES refuses 900000 to 900999, smallwebwaf's own rules. A request with more than 1000 query parameters adds 5 (rule 900300). In block mode a match is refused with 403, an offence counted toward the error burst; in detect mode it is let through. Both log waf_rule_ids, waf_score and duration_waf, raise waf_block, and count smallwebwaf_waf_matches_total. Judgement call: waf_block is raised in block mode too. Deviation: no engine-error path; with no body read, Coraza cannot fail. Model: opus-5-5	2026-10-08 09:37:13 +02:00