smallwebwaf

149 Commits 22 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	f5d55028fe	Answer-time tests check the answer, not wall-clock milliseconds (closes #316 ) check / check (push) Failing after 1m27s Details The waf test that asks a question while every outside source hangs now runs it in a synctest bubble and checks that the answer comes after exactly the GeoJS wait, within the time limit. GeoJS is the silent stand-in; the lists are fetched outside the bubble. A resolver stand-in holds the DNS blocklist's query until the checks are done, so a waf that waited for the query would answer only after it failed, which the test catches. The routewatch test for a hanging routewatch runs Route in a synctest bubble, against a stand-in on Go's default transport, and requires no_answer_yet after exactly zero time. Model: opus-5-5	2026-11-11 08:10:39 +00:00
clawbot	937d956d3a	waf: the header limits are the first check (closes #311 ) check / check (push) Failing after 2m8s Details The header limits (more than 50 cookies or 100 header fields, answered `431`) move from just before the Core Rule Set to the first check after `SWW_ALLOW_NETS`. A request over them causes no lookup, no query to RouteWatch, a DNS blocklist or AbuseIPDB, no rule file match and no Core Rule Set. Requests within the limits go through the same checks in the same order. For a request over the limits: the rate limits no longer count it; a banned client or one in `SWW_DENY_NETS` gets `431` instead of its refusal; it makes no ban, makes no ban permanent and is not counted in a ban's notes; in `observe` mode it is answered `allow` with no lookup. `SPEC.md` and `README.md` say so. Model: opus-5-5	2026-11-11 07:13:35 +01:00
clawbot	f7e3190654	Rename discriminator to waf everywhere (closes #312 ) check / check (push) Successful in 5m58s Details The command is now `sww waf`, and the package is `internal/waf`. Types, functions, files, tests, comments, docs, the Dockerfile, the runit script, `script/`, compose examples, the log field `waf_line` and the `X-From-Waf` test header follow. No behaviour changes, and no setting changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`. Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF, discriminator to waf) over the files `git grep -i discriminator` listed, as sneak allowed for this rename, then `git mv` for the package and files. By hand afterwards: the header's spelling, which the linter requires, and the padding after `waf` in `sww`'s usage text. Model: opus-5-5	2026-11-11 02:43:16 +01:00

Author

SHA1

Message

Date

sneak

f5d55028fe

Answer-time tests check the answer, not wall-clock milliseconds (closes #316 )

check / check (push) Failing after 1m27s

Details

The waf test that asks a question while every outside source hangs now
runs it in a synctest bubble and checks that the answer comes after
exactly the GeoJS wait, within the time limit. GeoJS is the silent
stand-in; the lists are fetched outside the bubble. A resolver stand-in
holds the DNS blocklist's query until the checks are done, so a waf that
waited for the query would answer only after it failed, which the test
catches.

The routewatch test for a hanging routewatch runs Route in a synctest
bubble, against a stand-in on Go's default transport, and requires
no_answer_yet after exactly zero time.

Model: opus-5-5

2026-11-11 08:10:39 +00:00

clawbot

937d956d3a

waf: the header limits are the first check (closes #311 )

check / check (push) Failing after 2m8s

Details

The header limits (more than 50 cookies or 100 header fields, answered `431`) move from just before the Core Rule Set to the first check after `SWW_ALLOW_NETS`. A request over them causes no lookup, no query to RouteWatch, a DNS blocklist or AbuseIPDB, no rule file match and no Core Rule Set. Requests within the limits go through the same checks in the same order.

For a request over the limits: the rate limits no longer count it; a banned client or one in `SWW_DENY_NETS` gets `431` instead of its refusal; it makes no ban, makes no ban permanent and is not counted in a ban's notes; in `observe` mode it is answered `allow` with no lookup. `SPEC.md` and `README.md` say so.

Model: opus-5-5

2026-11-11 07:13:35 +01:00

clawbot

f7e3190654

Rename discriminator to waf everywhere (closes #312 )

check / check (push) Successful in 5m58s

Details

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

2026-11-11 02:43:16 +01:00