4 Commits

Include renames

Author	SHA1	Message	Date
sneak	d8b8936f46	Point the unreachable-app test at port 1 (closes #51) ... TestAnswers502WhenTheAppCannotBeReached closed a listener and pointed smallwebwaf at its port, which another test running in parallel could open in between, so the test sometimes got that server's answer instead of a 502. It now uses 127.0.0.1:1: nothing listens there, and a test listening on port 0 is always given a port from 32768 up, so no test can take it. No other test reuses a closed listener's port. Model: opus-5-5	2026-10-04 04:13:50 +00:00
clawbot	6bd5f620f6	TestRequestTimeouts expects 504 when none of the body reached the app (closes #49) ... In the cases where the app reads and the client stops sending halfway, smallwebwaf waits on the client only once it has passed the first bytes of the body to the app. A test process held up for the whole 300 ms timeout before then rightly gets 504, as SPEC.md asks, so the test was wrong to expect 408 every time. The app in those cases now records whether it received any of the body. Once the app has finished with the request, the case expects 408 and its log line if it did, and 504 and its log line if not. Model: opus-5-5	2026-10-04 06:09:22 +02:00
clawbot	f51459fbfe	Per-client request rate limits over a minute, an hour and a day (closes #43) ... Each client, one IPv4 address or one IPv6 /64, is counted in two buckets per window, the earlier weighted by how much of it the window covers; at most 20,000 clients are kept, least recently seen dropped first. A request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or _DAY (1000, 10000, 50000, or off) gets 429 before reaching the app. Refused requests count, 413s included. A clock set back over a second behind a bucket's start restarts that window. The log line gains limit_hit and the action rate_limited. Deviation from SPEC.md, per the issue: the 20,000 bound and /64 are fixed. Judgement call: golang-lru/v2 holds the table; httprate does not count refused requests. Deviation: go.mod and go.sum hand-written; no make target tidies them. Model: opus-5-5	2026-10-04 04:24:34 +02:00
clawbot	d76715b0df	Pass-through proxy with timeouts, size limits and a request log (closes #13) ... Milestone 1, the repo's first code. smallwebwaf passes each request to the app and the answer back unchanged, streaming bodies and WebSocket upgrades, within four timeouts (client and app, request and response) and two size limits, and writes one JSON line per request to stdout. Every setting has an SWWAF_ name and a default, and an invalid value stops the start. The repo gets the standard layout: script/ entrypoints, make targets that call them, a Dockerfile that runs the checks, and the Gitea workflow. Disclosure: SPEC.md changed. Go's server reads the request line and headers before smallwebwaf sees the request, so slow headers are closed without an answer, and neither slow nor oversized headers get a log line. Disclosure: standard library only. Model: opus-5-5	2026-10-03 17:24:34 +02:00