smallwebwaf

78 Commits 5 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	a959df50ad	servewaf always answers rproxy well within its time limit (closes #182 ) check / check (push) Successful in 6m23s Details A question waits on GeoJS at most 800ms, the new default of SWWAF_LOOKUP_TIMEOUT. It does not wait at all when the checks will refuse it whatever GeoJS answers. Just before the Core Rule Set, servewaf refuses more than 50 cookies or 100 header fields with 431. Shared default changed: SWWAF_LOOKUP_TIMEOUT also applies to smallwebwaf with no command. Judgement call: SWWAF_REPUTATION_TIMEOUT stays 2s, since no request waits on the DNS blocklists or AbuseIPDB. Model: opus-5-5	2026-11-05 03:15:00 +00:00
clawbot	2eeea136e8	servewaf answers rproxy's question about each request and takes its report (closes #170 ) check / check (push) Failing after 14m16s Details `smallwebwaf servewaf` runs today's checks on the visitor's request each question carries, answers rproxy, and passes nothing to an app. rproxy reports every request servewaf answered. A report counts an allowed request's bytes and writes servewaf's second log line. The table holds a copy of what a report needs, never the request, so a report cannot reach a request being handled. Judgement call: a question's body is read before any check; over 64 KiB gets 400. Judgement call: a report's bytes and durations have ceilings, so they cannot overflow. Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close. Model: opus-5-5	2026-11-05 00:32:08 +01:00
clawbot	f408f42b28	SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 ) check / check (push) Canceled after 0s Details SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)	2026-10-26 03:06:28 +01:00

Author

SHA1

Message

Date

sneak

a959df50ad

servewaf always answers rproxy well within its time limit (closes #182 )

check / check (push) Successful in 6m23s

Details

A question waits on GeoJS at most 800ms, the new default of
SWWAF_LOOKUP_TIMEOUT. It does not wait at all when the checks will refuse
it whatever GeoJS answers. Just before the Core Rule Set, servewaf refuses
more than 50 cookies or 100 header fields with 431.

Shared default changed: SWWAF_LOOKUP_TIMEOUT also applies to smallwebwaf
with no command.
Judgement call: SWWAF_REPUTATION_TIMEOUT stays 2s, since no request waits
on the DNS blocklists or AbuseIPDB.

Model: opus-5-5

2026-11-05 03:15:00 +00:00

clawbot

2eeea136e8

servewaf answers rproxy's question about each request and takes its report (closes #170 )

check / check (push) Failing after 14m16s

Details

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

2026-11-05 00:32:08 +01:00

clawbot

f408f42b28

SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 )

check / check (push) Canceled after 0s

Details

SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8.

Model: fable-5-1 (writing); opus-5-5 (review, merge)

2026-10-26 03:06:28 +01:00