smallwebwaf

26 Commits 2 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	0f85c9ae07	The header size and the idle time as settings (closes #70 ) check / check (push) Successful in 4m56s Details SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES (default 32K) and SWWAF_CLIENT_IDLE_TIMEOUT (default 120s) replace the two values the proxy fixed. The idle time is read like the other durations, and can be off. Go's server reads 4K past the header limit it is given before it refuses, so it is still given the setting less 4K. The header size must be more than 4K and cannot be off; any other value stops the start with a message that does not offer off. SPEC.md and README.md say so. README.md lists both settings, no longer calls them fixed, and names them as built. Model: opus-5-5	2026-10-06 05:05:31 +02:00
clawbot	6bd5f620f6	TestRequestTimeouts expects 504 when none of the body reached the app (closes #49 ) check / check (push) Successful in 2m18s Details In the cases where the app reads and the client stops sending halfway, smallwebwaf waits on the client only once it has passed the first bytes of the body to the app. A test process held up for the whole 300 ms timeout before then rightly gets 504, as SPEC.md asks, so the test was wrong to expect 408 every time. The app in those cases now records whether it received any of the body. Once the app has finished with the request, the case expects 408 and its log line if it did, and 504 and its log line if not. Model: opus-5-5	2026-10-04 06:09:22 +02:00
clawbot	d76715b0df	Pass-through proxy with timeouts, size limits and a request log (closes #13 ) check / check (push) Successful in 1m29s Details Milestone 1, the repo's first code. smallwebwaf passes each request to the app and the answer back unchanged, streaming bodies and WebSocket upgrades, within four timeouts (client and app, request and response) and two size limits, and writes one JSON line per request to stdout. Every setting has an SWWAF_ name and a default, and an invalid value stops the start. The repo gets the standard layout: script/ entrypoints, make targets that call them, a Dockerfile that runs the checks, and the Gitea workflow. Disclosure: SPEC.md changed. Go's server reads the request line and headers before smallwebwaf sees the request, so slow headers are closed without an answer, and neither slow nor oversized headers get a log line. Disclosure: standard library only. Model: opus-5-5	2026-10-03 17:24:34 +02:00

Author

SHA1

Message

Date

clawbot

0f85c9ae07

The header size and the idle time as settings (closes #70 )

check / check (push) Successful in 4m56s

Details

SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES (default 32K) and
SWWAF_CLIENT_IDLE_TIMEOUT (default 120s) replace the two values the
proxy fixed. The idle time is read like the other durations, and can
be off.

Go's server reads 4K past the header limit it is given before it
refuses, so it is still given the setting less 4K. The header size
must be more than 4K and cannot be off; any other value stops the
start with a message that does not offer off.

SPEC.md and README.md say so. README.md lists both settings, no longer
calls them fixed, and names them as built.

Model: opus-5-5

2026-10-06 05:05:31 +02:00

clawbot

6bd5f620f6

TestRequestTimeouts expects 504 when none of the body reached the app (closes #49 )

check / check (push) Successful in 2m18s

Details

In the cases where the app reads and the client stops sending halfway,
smallwebwaf waits on the client only once it has passed the first bytes
of the body to the app. A test process held up for the whole 300 ms
timeout before then rightly gets 504, as SPEC.md asks, so the test was
wrong to expect 408 every time.

The app in those cases now records whether it received any of the body.
Once the app has finished with the request, the case expects 408 and its
log line if it did, and 504 and its log line if not.

Model: opus-5-5

2026-10-04 06:09:22 +02:00

clawbot

d76715b0df

Pass-through proxy with timeouts, size limits and a request log (closes #13 )

check / check (push) Successful in 1m29s

Details

Milestone 1, the repo's first code. smallwebwaf passes each request to the app and the answer back unchanged, streaming bodies and WebSocket upgrades, within four timeouts (client and app, request and response) and two size limits, and writes one JSON line per request to stdout. Every setting has an SWWAF_ name and a default, and an invalid value stops the start. The repo gets the standard layout: script/ entrypoints, make targets that call them, a Dockerfile that runs the checks, and the Gitea workflow.

Disclosure: SPEC.md changed. Go's server reads the request line and headers before smallwebwaf sees the request, so slow headers are closed without an answer, and neither slow nor oversized headers get a log line.
Disclosure: standard library only.

Model: opus-5-5

2026-10-03 17:24:34 +02:00