4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	55d403aa89	Take in an admin's edits of the state files while running (closes #68) ... smallwebwaf watches SWWAF_STATE_DIR with fsnotify and takes in an edit of bans.json, clients.json or lookups.json as soon as it is saved, in place of what it held. It tells its own writes from an admin's by the SHA-256 of what it last read or wrote, and each write takes in an edit made since first. An edit that does not parse is renamed to <name>.bad at the file's next write, which writes the file again from memory and logs the file and where the error is. README.md says how to add and lift a ban. Judgement call: a broken edit is set aside at the file's next write, not when seen, since an editor's file can be read half written. Judgement call: a state file that cannot be read is not written over. Model: opus-5-5	2026-10-06 07:44:48 +00:00
clawbot	68f687cb0c	Run the GeoJS lookup tests on a clock the test controls (closes #73) ... The tests that have GeoJS asked now run in a synctest bubble, so a wait lasts exactly as long as it should however slowly the test process runs: a new client's wait is checked to be exactly one second, and its next request exactly no wait. A request waiting on the network would stop the bubble's clock, so the stand-in for GeoJS now answers in place of the network, through a transport that a test-only file lets the tests set. The test of the failure log uses an abandoned request instead of a closed port. Model: opus-5-5	2026-10-06 09:12:50 +02:00
clawbot	df2c5042d2	Keep the bans, the clients and GeoJS's answers in state files (closes #17) ... smallwebwaf now copies its state to bans.json, clients.json and lookups.json in SWWAF_STATE_DIR, as "Persistent state" in SPEC.md describes, and reads them back at start, so a restart lifts no ban and gives no client a fresh allowance. Each client gains a history, and a ban's notes count the netblock's requests. bans.json is written SWWAF_STATE_WRITE_DELAY after a ban, and every file every SWWAF_STATE_COUNTER_INTERVAL and at the stop. A ban read back is masked to its netblock and refuses every client in it. A file that does not parse, an unknown version, an entry without a field it needs, or an unwritable directory stops the start. Deviation: no AS number or name, and no ban cause, reason or lifting yet. Model: opus-5-5	2026-10-06 08:31:52 +02:00
clawbot	0750879e58	Country allow and deny lists, looked up through GeoJS (closes #44) ... SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a request with 403 before its body is read or rate-limited, logged as country_denied. internal/lookup asks GeoJS only while a list is set, 200 clients per request, one at a time, keeping answers 7 days. Failures, a redirect or an answer leaving an address out included, are logged without addresses; GeoJS is then left alone a second, doubling to five minutes. Private, loopback and link-local clients are never sent. Deviation, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE. Deviation: GeoJS's country endpoint, not geo.json. Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait. Judgement call: config.go lists the ISO 3166-1 codes; no widely used library holds them. Model: opus-5-5	2026-10-04 08:29:41 +02:00