smallwebwaf

101 Commits 8 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	d282a737a8	Read every setting through viper and rename the settings (closes #211 ) check / check (push) Successful in 4m46s Details Every setting of discriminator and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed. Discriminator's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)	2026-11-09 06:20:26 +00:00
clawbot	aede434f6a	Name request log actions so they say what they mean (closes #229 ) check / check (push) Successful in 6m30s Details The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported. Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent. Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1. Model: opus-5-5	2026-11-09 06:48:26 +01:00
clawbot	2349b2a081	discriminator: each decision heuristic is its own module (closes #195 ) check / check (push) Failing after 1m53s Details Each discriminator check is now a type in its own file behind one small interface, listed in `heuristics.go`. Adding a heuristic is one file and one line. Behaviour does not change. Refusal and ban log lines gain `heuristic` and `heuristic_figures`. A ban after the answer, by `refusal_limit` or `byte_limits`, logs `after_answer_heuristic` and its figures, so one line can name both. Deviation: four lists, not the planned three, so `refusal_limit` still bans at the decision. Rule suppressed: `//nolint:lll` on one struct tag. Model: opus-5-5	2026-11-09 01:14:24 +01:00

Author

SHA1

Message

Date

sneak

d282a737a8

Read every setting through viper and rename the settings (closes #211 )

check / check (push) Successful in 4m46s

Details

Every setting of discriminator and rproxy is read through viper, in place
of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv
and AllowEmptyEnv on, so a setting that is set but empty reads as set. A
setting may also be given as a file, the _FILE form, which rproxy's
settings now have too; rproxy still writes nothing to disk.

The settings are renamed. Discriminator's take the prefix SWW_WAF_,
rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core
Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_.

Model: deepseek-v4-pro (first version); opus-5-5 (rework)

2026-11-09 06:20:26 +00:00

clawbot

aede434f6a

Name request log actions so they say what they mean (closes #229 )

check / check (push) Successful in 6m30s

Details

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

2026-11-09 06:48:26 +01:00

clawbot

2349b2a081

discriminator: each decision heuristic is its own module (closes #195 )

check / check (push) Failing after 1m53s

Details

Each discriminator check is now a type in its own file behind one small interface, listed in `heuristics.go`. Adding a heuristic is one file and one line. Behaviour does not change.

Refusal and ban log lines gain `heuristic` and `heuristic_figures`. A ban after the answer, by `refusal_limit` or `byte_limits`, logs `after_answer_heuristic` and its figures, so one line can name both.

Deviation: four lists, not the planned three, so `refusal_limit` still bans at the decision.
Rule suppressed: `//nolint:lll` on one struct tag.

Model: opus-5-5

2026-11-09 01:14:24 +01:00