4 Commits

Include renames

Author	SHA1	Message	Date
sneak	c3c546c65b	Caches of outside APIs live in /var/cache/sww (closes #314) ... The answers of GeoJS, the lists fetched by URL, the DNS blocklists, AbuseIPDB and routewatch each go in a cache file in SWW_CACHE_DIR (default /var/cache/sww): lookups.json, lists.json, dnsbl.json, abuseipdb-scores.json and routewatch.json. reputation.json is gone. The AbuseIPDB checks spent today are a count, not a cache, and stay in SWW_STATE_DIR as abuseipdb-checks-spent.json. A cache file never stops the start: one that does not parse is set aside as an edit is, one that cannot be read is written over, and its cache starts empty. An unwritable SWW_CACHE_DIR stops the start, as an unwritable SWW_STATE_DIR does. Each directory is watched on its own. The run script makes the cache directory and gives it to sww. Model: opus-5-5	2026-11-11 06:39:32 +00:00
clawbot	beb503b233	Rename the program to sww and its deciding daemon to discriminator (closes #218) (#221)	2026-11-07 06:51:06 +01:00
clawbot	5f3fb48809	CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106) ... SWWAF_CROWDSEC_LAPI_URL and SWWAF_CROWDSEC_LAPI_KEY name an engine whose decision list, <url>/v1/decisions, is fetched every minute with the key in X-Api-Key, following no redirect, and kept as a blocklist is: used while a fetch fails, and across restarts through reputation.json. Ban decisions on an Ip or a Range end at the fetch time plus their duration. A listed client's request is refused and bans its netblock with the cause crowdsec until the decision ends; bans.json, ban notes and metrics take the cause. Judgement call: fetched every minute, not a setting. Judgement call: a crowdsec ban never lengthens a limit ban. Judgement call: a lifted crowdsec ban is remade while its decision lasts. Model: opus-5-5	2026-10-08 05:15:06 +02:00
clawbot	2b8c98ba1f	Blocklists and an AS percentage file fetched by URL (closes #29) ... SWWAF_BLOCKLIST_URLS names lists of addresses and netblocks, fetched every SWWAF_BLOCKLIST_REFRESH (24h, never under 1h); an IPv4-mapped line stands for its IPv4 address or netblock. reputation.json keeps each list's last try, failed or not, even one cut off by a stop, which a restart waits on as a running instance does, and its last good copy, whole, used while a fetch fails. SWWAF_BLOCKLIST_ACTION denies, limits or only logs a listed client; the log line names the lists, each raises reputation_hit, and a failed fetch raises source_failure. SWWAF_ASN_LIMIT_PERCENT_URL is fetched the same way and counts as SWWAF_ASN_LIMIT_PERCENT does, the lower winning. Judgement call: a failed fetch is retried after the refresh, not sooner. Not done: ban notes do not name the lists yet. Model: opus-5-5	2026-10-07 19:09:41 +02:00