4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	866b948ec0	Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198) ... The Gitea setup runs the Core Rule Set in block mode. Rules that refused ordinary Gitea requests are switched off only where they misfired: - deploy/gitea/crs-exclusions.conf, loaded through the new setting SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE before the Core Rule Set's rules, covers Gitea's search, file-name and branch-name fields, Referer, file paths, API attachment names and Actions artifact uploads; - smallwebwaf's defaults gain a seventh change: the registry upload path's from parameter skips 932260. A file that cannot be read, does not parse or names an id from 900000 to 900999 stops servewaf at start, in every mode. internal/waf's tests and script/gitea-setup send the recorded requests in internal/waf/testdata/gitea-requests.txt and three attacks. Model: opus-5-5	2026-11-06 20:17:07 +00:00
clawbot	344ce13c96	rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165) ... `smallwebwaf` with no command now prints the commands and exits with status 2. The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The passing-on code, its settings and its log fields and metric go. internal/proxy keeps the checks, answers, reports and own endpoints; its tests run through the real rproxy. The documents describe the pair. Judgement call: clients.json keeps token_refused, since state files refuse unknown fields. Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests. Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx. Model: opus-5-5	2026-11-05 13:15:05 +01:00
clawbot	f408f42b28	SPEC, README and docs rewritten from scratch (closes #154, closes #155, closes #156) ... SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)	2026-10-26 03:06:28 +01:00
clawbot	60c49a6740	script/gitea-requests, and the gitea refusals it confirms named in SPEC.md (closes #30) ... script/gitea-requests runs gitea 1.27.3 behind the image at its defaults, sends through it the requests that reading gitea's source found the Core Rule Set refuses, with a short sample of ordinary use, and prints each request with the rule ids that matched it. make gitea-requests runs it; make check does not. Every case still holds, and each fix would let through what SPEC.md says stays refused, so the notes specific to gitea now name them with how each refusal plays out: file names in query parameters that read as Java, script, PowerShell or SQL, such paths, and an image push that reuses a layer of an image named like a command. Model: opus-5-5	2026-10-20 13:39:05 +02:00