4 Commits

Include renames

Author	SHA1	Message	Date
sneak	ad593c7573	Read every setting through viper and rename the settings (closes #211) ... Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)	2026-11-11 06:37:26 +00:00
clawbot	f64752e3b7	rproxy: answer a visitor that stops sending its body after the app has answered (closes #298) ... When the app answered before the visitor's body had arrived whole, Go's server read up to 256 KiB of the rest before it sent the answer. A visitor that stopped sending got nothing until SWRP_MAX_REQUEST_TIME_MS ran out, and no bytes at all once that was past the 10 seconds the status has to be sent. Such an answer now carries Connection: close, which Go sends at once. finish first ends the transport's read of the body: once the handler returns, Go's server reads the rest with no deadline while another read of it waits. requestBody.Close does nothing, so that ReverseProxy's close does not wait on the visitor. Model: opus-5-5	2026-11-10 22:43:13 +01:00
clawbot	aeaa9d1c77	rproxy: leave no visitor without an answer as the response time runs out (closes #295) ... A visitor could get a closed connection and no answer when SWRP_MAX_RESPONSE_TIME_MS ran out about when the answer started: the write deadline passed before the first byte was written. - An answer rproxy gives itself has at least 10 seconds to be sent. - An app's answer that arrives once the time has run out is answered 504. - Otherwise the app's status and headers are sent at once, before the body is read, with at least 10 seconds. The exact limit applies to the rest. Model: opus-5-5	2026-11-10 20:09:19 +01:00
clawbot	17c5dd2438	rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171) ... `smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf over HTTP/1.1, and passes what servewaf allows to the app within its limits. Any other answer goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION decides only when servewaf cannot be connected to, does not answer at all, or does not answer within SWRP_TIMEOUT_MS. A method SPEC.md does not list gets 405. Duplication: internal/rproxy copies passing-on code from internal/proxy until #172 removes the originals. Rule suppressed: gosec G704 and G705; gosec at internal/smallwebwaf/rproxy_test.go:431; tagliatelle at internal/requestlog/requestlog.go:203; paralleltest on one test. Judgement call: an answer over 1 MiB, or with a status below 200, gets 502. Judgement call: every target not starting with one / gets 400. Model: opus-5-5	2026-11-05 06:32:08 +01:00