smallwebwaf

26 Commits 2 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	68f687cb0c	Run the GeoJS lookup tests on a clock the test controls (closes #73 ) check / check (push) Successful in 3m32s Details The tests that have GeoJS asked now run in a synctest bubble, so a wait lasts exactly as long as it should however slowly the test process runs: a new client's wait is checked to be exactly one second, and its next request exactly no wait. A request waiting on the network would stop the bubble's clock, so the stand-in for GeoJS now answers in place of the network, through a transport that a test-only file lets the tests set. The test of the failure log uses an abandoned request instead of a closed port. Model: opus-5-5	2026-10-06 09:12:50 +02:00
clawbot	df2c5042d2	Keep the bans, the clients and GeoJS's answers in state files (closes #17 ) check / check (push) Successful in 3m24s Details smallwebwaf now copies its state to bans.json, clients.json and lookups.json in SWWAF_STATE_DIR, as "Persistent state" in SPEC.md describes, and reads them back at start, so a restart lifts no ban and gives no client a fresh allowance. Each client gains a history, and a ban's notes count the netblock's requests. bans.json is written SWWAF_STATE_WRITE_DELAY after a ban, and every file every SWWAF_STATE_COUNTER_INTERVAL and at the stop. A ban read back is masked to its netblock and refuses every client in it. A file that does not parse, an unknown version, an entry without a field it needs, or an unwritable directory stops the start. Deviation: no AS number or name, and no ban cause, reason or lifting yet. Model: opus-5-5	2026-10-06 08:31:52 +02:00
clawbot	0750879e58	Country allow and deny lists, looked up through GeoJS (closes #44 ) check / check (push) Failing after 3s Details SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a request with 403 before its body is read or rate-limited, logged as country_denied. internal/lookup asks GeoJS only while a list is set, 200 clients per request, one at a time, keeping answers 7 days. Failures, a redirect or an answer leaving an address out included, are logged without addresses; GeoJS is then left alone a second, doubling to five minutes. Private, loopback and link-local clients are never sent. Deviation, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE. Deviation: GeoJS's country endpoint, not geo.json. Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait. Judgement call: config.go lists the ISO 3166-1 codes; no widely used library holds them. Model: opus-5-5	2026-10-04 08:29:41 +02:00

Author

SHA1

Message

Date

clawbot

68f687cb0c

Run the GeoJS lookup tests on a clock the test controls (closes #73 )

check / check (push) Successful in 3m32s

Details

The tests that have GeoJS asked now run in a synctest bubble, so a wait
lasts exactly as long as it should however slowly the test process runs:
a new client's wait is checked to be exactly one second, and its next
request exactly no wait. A request waiting on the network would stop the
bubble's clock, so the stand-in for GeoJS now answers in place of the
network, through a transport that a test-only file lets the tests set.
The test of the failure log uses an abandoned request instead of a
closed port.

Model: opus-5-5

2026-10-06 09:12:50 +02:00

clawbot

df2c5042d2

Keep the bans, the clients and GeoJS's answers in state files (closes #17 )

check / check (push) Successful in 3m24s

Details

smallwebwaf now copies its state to bans.json, clients.json and
lookups.json in SWWAF_STATE_DIR, as "Persistent state" in SPEC.md
describes, and reads them back at start, so a restart lifts no ban and
gives no client a fresh allowance. Each client gains a history, and a
ban's notes count the netblock's requests. bans.json is written
SWWAF_STATE_WRITE_DELAY after a ban, and every file every
SWWAF_STATE_COUNTER_INTERVAL and at the stop. A ban read back is masked
to its netblock and refuses every client in it. A file that does not
parse, an unknown version, an entry without a field it needs, or an
unwritable directory stops the start.

Deviation: no AS number or name, and no ban cause, reason or lifting yet.

Model: opus-5-5

2026-10-06 08:31:52 +02:00

clawbot

0750879e58

Country allow and deny lists, looked up through GeoJS (closes #44 )

check / check (push) Failing after 3s

Details

SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a
request with 403 before its body is read or rate-limited, logged as
country_denied. internal/lookup asks GeoJS only while a list is set, 200
clients per request, one at a time, keeping answers 7 days. Failures, a
redirect or an answer leaving an address out included, are logged without
addresses; GeoJS is then left alone a second, doubling to five minutes.
Private, loopback and link-local clients are never sent.

Deviation, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE.
Deviation: GeoJS's country endpoint, not geo.json.
Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait.
Judgement call: config.go lists the ISO 3166-1 codes; no widely used library holds them.

Model: opus-5-5

2026-10-04 08:29:41 +02:00