smallwebwaf

114 Commits 7 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	9a8cf93029	Read every setting through viper and rename the settings (closes #211 ) check / check (push) Successful in 5m3s Details Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)	2026-11-10 00:30:09 +00:00
clawbot	9e7a7e60c7	Tests no longer connect to test servers they closed (closes #257 ) check / check (push) Failing after 2m5s Details Four tests closed a test server or stopped discriminator, and then connected to its port. Another test process could take that port in between and receive the connection. - TestUnreachableRouteWatchLetsTheRequestThroughAndSaysWhy and TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient, formerly TestRefusedConnection..., point routewatch at 224.0.0.1, a multicast address to which TCP cannot connect. - TestStalledRemoteLogEndpointHoldsUpNoRequest keeps its endpoint open and closes each connection it takes, instead of closing the endpoint. - TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain gives rproxy an address the test holds throughout. The test forwards each connection there to the running discriminator, and closes it while discriminator is stopped. No change to non-test code. Model: opus-5-5	2026-11-10 00:58:01 +01:00
clawbot	6850cb0e9f	Add asn= and prefix= tags from a routewatch instance (closes #204 ) check / check (push) Successful in 5m0s Details With `SWW_ROUTEWATCH_URL` set, a new heuristic, `routewatch_tags`, adds `asn=<number>` and `prefix=<netblock>` to a request from what a routewatch instance answers about the client. New package `internal/routewatch` asks in the background, never on a request's path, and keeps answers 1 hour in memory. The request log gains `routewatch_tags_missing`, saying why a request has none. `prefix=` works in `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT`. Trips a reader: a client's first request has no routewatch tags, so `prefix=` refuses from its next request after the answer comes. Judgement call: with `SWW_LOOKUP_SOURCE=off` and `SWW_ROUTEWATCH_URL` set, an `asn=` tag no longer stops the start. Model: opus-5-5	2026-11-09 05:47:34 +01:00

Author

SHA1

Message

Date

sneak

9a8cf93029

Read every setting through viper and rename the settings (closes #211 )

check / check (push) Successful in 5m3s

Details

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

2026-11-10 00:30:09 +00:00

clawbot

9e7a7e60c7

Tests no longer connect to test servers they closed (closes #257 )

check / check (push) Failing after 2m5s

Details

Four tests closed a test server or stopped discriminator, and then
connected to its port. Another test process could take that port in
between and receive the connection.

- TestUnreachableRouteWatchLetsTheRequestThroughAndSaysWhy and
  TestUnreachableRoutewatchFailsTheQueryAndTheLogOmitsTheClient, formerly
  TestRefusedConnection..., point routewatch at 224.0.0.1, a multicast
  address to which TCP cannot connect.
- TestStalledRemoteLogEndpointHoldsUpNoRequest keeps its endpoint open
  and closes each connection it takes, instead of closing the endpoint.
- TestTheSiteAnswersWhileDiscriminatorIsStoppedAndStartedAgain gives
  rproxy an address the test holds throughout. The test forwards each
  connection there to the running discriminator, and closes it while
  discriminator is stopped.

No change to non-test code.

Model: opus-5-5

2026-11-10 00:58:01 +01:00

clawbot

6850cb0e9f

Add asn= and prefix= tags from a routewatch instance (closes #204 )

check / check (push) Successful in 5m0s

Details

With `SWW_ROUTEWATCH_URL` set, a new heuristic, `routewatch_tags`, adds `asn=<number>` and `prefix=<netblock>` to a request from what a routewatch instance answers about the client. New package `internal/routewatch` asks in the background, never on a request's path, and keeps answers 1 hour in memory. The request log gains `routewatch_tags_missing`, saying why a request has none. `prefix=` works in `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT`.

Trips a reader: a client's first request has no routewatch tags, so `prefix=` refuses from its next request after the answer comes.
Judgement call: with `SWW_LOOKUP_SOURCE=off` and `SWW_ROUTEWATCH_URL` set, an `asn=` tag no longer stops the start.

Model: opus-5-5

2026-11-09 05:47:34 +01:00