4 Commits

Include renames

Author	SHA1	Message	Date
sneak	f519e2ca9e	discriminator: the header limits are the first check (closes #311) ... A request over 50 cookies or 100 header fields is now refused before any other check. It causes no lookup, no query to RouteWatch, a DNS blocklist or AbuseIPDB, no rule file match and no Core Rule Set. The rate limits no longer count it, and a banned or denied client gets 431 for it. In observe mode no lookup is made for it. Requests within the limits go through the same checks in the same order. Model: opus-5-5	2026-11-11 00:26:14 +00:00
clawbot	6850cb0e9f	Add asn= and prefix= tags from a routewatch instance (closes #204) ... With `SWW_ROUTEWATCH_URL` set, a new heuristic, `routewatch_tags`, adds `asn=<number>` and `prefix=<netblock>` to a request from what a routewatch instance answers about the client. New package `internal/routewatch` asks in the background, never on a request's path, and keeps answers 1 hour in memory. The request log gains `routewatch_tags_missing`, saying why a request has none. `prefix=` works in `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT`. Trips a reader: a client's first request has no routewatch tags, so `prefix=` refuses from its next request after the answer comes. Judgement call: with `SWW_LOOKUP_SOURCE=off` and `SWW_ROUTEWATCH_URL` set, an `asn=` tag no longer stops the start. Model: opus-5-5	2026-11-09 05:47:34 +01:00
clawbot	c66277b111	Request tags, with refusing and limits per tag (closes #175) ... Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start. Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags. Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did. Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals. Model: opus-5-5	2026-11-09 03:30:49 +01:00
clawbot	2349b2a081	discriminator: each decision heuristic is its own module (closes #195) ... Each discriminator check is now a type in its own file behind one small interface, listed in `heuristics.go`. Adding a heuristic is one file and one line. Behaviour does not change. Refusal and ban log lines gain `heuristic` and `heuristic_figures`. A ban after the answer, by `refusal_limit` or `byte_limits`, logs `after_answer_heuristic` and its figures, so one line can name both. Deviation: four lists, not the planned three, so `refusal_limit` still bans at the decision. Rule suppressed: `//nolint:lll` on one struct tag. Model: opus-5-5	2026-11-09 01:14:24 +01:00