servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

README.md

@@ -17,11 +17,20 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
 ## What it protects against
 
 - Scrapers that fetch every page of a site, all day. Rate limiting gives each
-  client 6000 requests a minute, 100,000 an hour and 1,000,000 a day. Byte
-  limits give it 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over
-  a limit is refused and banned. The first ban lasts an hour. Each repeat within
-  a day makes the next ban three times as long. A ban that would last more than
-  seven days is permanent.
+  client 500 requests a minute, 20,000 an hour and 300,000 a day. That leaves
+  room for programmatic use of an API, such as an automation fleet on another
+  host. A fleet of about 20 agents makes about 120 requests a minute at its
+  busiest. A gitea page opened with an empty cache loads about 40 files, so a
+  few such first visits fit in the minute limit too. The minute limit catches,
+  within seconds, a client firing requests as fast as it can. The hour limit
+  catches a client that keeps up more than about 5.5 a second for an hour. The
+  day limit catches a client that keeps up 4 a second around the clock. Counting
+  cannot catch a client that stays under all three limits, such as one that
+  keeps up 3 a second; only the protections below can. Byte limits give each
+  client 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over a limit
+  is refused and banned. The first ban lasts an hour. Each repeat within a day
+  makes the next ban three times as long. A ban that would last more than seven
+  days is permanent.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client for seven days at its first probe. Its
   next request during the ban makes the ban permanent. The default rule file

SPEC.md

@@ -3,7 +3,7 @@
 `smallwebwaf` is a web application firewall and reverse proxy for one app. It
 runs inside the app's container, between traefik and the app. This document says
 what it must do and why, each requirement once. Everything in it is built,
-except the last section, "Planned, not built". `README.md` says how to run it.
+except what the last section lists. `README.md` says how to run it.
 `EVALUATION.md` says why no existing tool was adopted. The reference documents
 under `docs/` give the settings, the formats and the lists. This document links
 to them.
@@ -371,22 +371,38 @@ Conventions:
   owner's own networks. `SWWAF_RATE_LIMIT_EXEMPT_NETS` bypasses the request and
   byte limits only; the error burst, attack detection and bans still apply.
 - Many people can share one address, as in an office, on a mobile carrier or
-  through Tor. They are one client, and share its limits and its bans. The
-  default limits are sized for about 40 busy people on one address. A known
-  shared address busier than that belongs in `SWWAF_ALLOW_NETS` or
+  through Tor. They are one client, and share its limits and its bans. A known
+  shared address busier than the limits allow belongs in `SWWAF_ALLOW_NETS` or
   `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ### Request rate limits, per client
 
-Breaking one bans the client, so the defaults sit about twice above what 40
-people busy with heavy web apps make together on one address. Each such person
-makes about 75 requests in a busy minute, and 1,250 an hour for ten hours a day.
+Breaking one bans the client. The defaults suit programmatic use of an API, such
+as an automation fleet on another host, and still stop abusive bots. A fleet of
+20 agents, each making a request every 10 seconds at its busiest, makes 120
+requests a minute and 7,200 an hour. Working around the clock, it makes 172,800
+a day. It stays under all three limits.
 
-A client slower than those 40 people cannot be told from them by counting. Only
-the other checks can catch an abuser that slow. They include the trap paths, the
-rule files, the Core Rule Set and the blocklists. An abuser that trips none of
-them is not caught. A machine that talks to the app all day can still pass the
-day limit. Its address belongs in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+- Per minute: 500, about 8 requests a second. It leaves room for the fleet's 120
+  a minute and a few quick first visits with an empty cache. A gitea page opened
+  with an empty cache loads about 40 files. A client firing requests as fast as
+  it can passes the limit within seconds.
+- Per hour: 20,000, about 5.5 requests a second for a whole hour. A client that
+  keeps up 6 a second makes 21,600 in an hour, and passes it, at 360 a minute,
+  under the minute limit. The fleet's 7,200 an hour is about a third of it.
+- Per day: 300,000, about 3.5 requests a second around the clock. A scraper that
+  keeps up 4 a second makes 345,600 a day, and passes it. At 240 a minute and
+  14,400 an hour, it stays under the other two limits.
+
+Counting cannot catch a client that stays under all three limits, such as one
+that keeps up 3 requests a second. Only the other checks can catch an abuser
+that slow. They include the trap paths, the rule files, the Core Rule Set and
+the blocklists. An abuser that trips none of them is not caught. A machine that
+keeps up more than 500 requests a minute passes the minute limit. One that keeps
+up more than about 5.5 a second for an hour passes the hour limit. One that
+keeps up more than about 3.5 a second all day passes the day limit, as two busy
+Actions runners on one address do. Such a machine's address belongs in
+`SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 `SWWAF_RATE_LIMIT_EXEMPT_PATHS` takes path prefixes out of the count, such as
 static assets or health checks; their bytes are not counted either. A prefix is
@@ -399,12 +415,12 @@ matched the same way.
 
 ### Byte limits, per client
 
-Each of the same 40 people moves about 256 MiB an hour, for ten hours a day. The
-hour and day limits sit about twice above what they move together. A response's
-bytes are counted when it ends (see step 15). So the minute limit holds two of
-the largest responses, with their requests, ending in the same minute. No single
-download then breaks a limit. An operator who raises `SWWAF_RESPONSE_MAX_BYTES`
-raises the byte limits with it.
+The hour and day limits sit about twice above what 40 people busy with heavy web
+apps move together on one address. Each moves about 256 MiB an hour, for ten
+hours a day. A response's bytes are counted when it ends (see step 15). So the
+minute limit holds two of the largest responses, with their requests, ending in
+the same minute. No single download then breaks a limit. An operator who raises
+`SWWAF_RESPONSE_MAX_BYTES` raises the byte limits with it.
 
 ### Size and time limits
 
@@ -1038,8 +1054,7 @@ request. It is the visitor's request as the visitor sent it:
 A body whose length the visitor did not announce comes chunked. Any other body
 comes with a `Content-Length` of the part it carries.
 
-`rproxy` removes these headers if the visitor sent them, then sets them. It adds
-no other header:
+`rproxy` sets these headers, replacing any the visitor sent, and adds no others:
 
 - `X-Smallwebwaf-Client`: the visitor's address, which `rproxy` has worked out.
   `servewaf` takes it as the client, and groups an IPv6 address as "What happens
@@ -1193,8 +1208,8 @@ Anything else gets `404`. No check runs on these requests, since their peers are
 `rproxy` and the admin's tools. The report needs no token, so anything on the
 private network can send one or ask a question.
 
-`servewaf` gives each request 60 seconds to arrive and its answer 60 seconds to
-leave, and closes a connection idle for 120 seconds. It takes a request line and
+A request and its answer have 60 seconds together, from the request's headers.
+`servewaf` closes a connection idle for 120 seconds. It takes a request line and
 headers up to 1 MiB, Go's default, so that it never refuses a question for the
 size of a visitor's headers.
 
@@ -1374,8 +1389,7 @@ and `script/gitea-requests` checks those notes.
 
 These points are specified as later work, and nothing in the code does them yet:
 
-- Planned: `smallwebwaf rproxy`, the reverse proxy in front of each app that
-  asks `servewaf` about each request (see "`servewaf`").
+- Planned: `smallwebwaf rproxy`, the reverse proxy in front of each app.
 - Planned: sharing bans between the instances of several apps, by running one
   CrowdSec engine per host that every instance reports its bans to. It is
   reconsidered once real ban volumes are known. Until then each instance keeps

docs/admin-endpoints.md

@@ -2,8 +2,7 @@
 
 The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
 "Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
-and how their tokens work. `smallwebwaf servewaf` answers them at its own
-address, without those checks (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).
+and how their tokens work.
 
 - `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
 - `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see
@@ -47,3 +46,8 @@ curl -H "Authorization: Bearer $TOKEN" -X DELETE \
 curl -H "Authorization: Bearer $TOKEN" \
     https://app.example/_smallwebwaf/clients/203.0.113.9
 ```
+
+## `servewaf`
+
+`smallwebwaf servewaf` answers these endpoints at its own address. No check runs
+on those requests (see "`servewaf`" in [`SPEC.md`](../SPEC.md)).

docs/alerts.md

@@ -35,34 +35,34 @@ on one line:
 ```json
 {
     "instance": "fsn1app1/gitea",
-    "time": "2026-10-06T12:00:00.123461Z",
+    "time": "2026-10-06T12:00:50.123461Z",
     "event": "ban",
     "client": "203.0.113.9",
     "netblock": "203.0.113.9/32",
     "asn": "",
     "as_name": "",
     "country": "",
-    "reason": "requests per minute over the limit of 6000",
+    "reason": "requests per minute over the limit of 500",
     "detail": {
-        "ban_expires": "2026-10-06T13:00:00.123Z",
+        "ban_expires": "2026-10-06T13:00:50.123Z",
         "cause": "limit",
         "notes": {
             "asn": "",
             "as_name": "",
             "country": "",
             "kind": "requests",
-            "limit": 6000,
+            "limit": 500,
             "window": "minute",
-            "count": 6001,
+            "count": 501,
             "request": {
-                "time": "2026-10-06T12:00:00.123456789Z",
+                "time": "2026-10-06T12:00:50.123456789Z",
                 "method": "GET",
                 "host": "app.example",
-                "path": "/owner/repo/commits/branch/main?page=812",
+                "path": "/owner/repo/commits/branch/main?page=501",
                 "status": 403,
                 "user_agent": "scraper/1.0"
             },
-            "requests": 8210,
+            "requests": 501,
             "refused": 0,
             "earlier_bans": {
                 "limit": 0,
@@ -92,7 +92,7 @@ on one line:
 - `asn`, `as_name` and `country`: the client's, as known when the alert was
   raised. They are empty when GeoJS had not answered yet.
 - `reason`: a short sentence, such as
-  `requests per minute over the limit of 6000` or `listed by a blocklist`.
+  `requests per minute over the limit of 500` or `listed by a blocklist`.
 - `detail`: what is particular to the event:
     - for a ban, its `cause`, `ban_expires` and `notes` (the notes are listed
       under `bans.json` in [`state-files.md`](state-files.md));

docs/gitea.md

@@ -34,11 +34,13 @@ checked again when gitea or the Core Rule Set changes version.
   day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
   43,200 requests a day. While it runs a job, it reports the job's log and state
   every second instead, two requests a second. So one runner busy all day sends
-  172,800 requests, under the request limits. Six such runners on one address,
-  each busy all day, pass the day limit of 1,000,000 within two days; five stay
-  under it. Their address is then banned, their running jobs fail, and each
-  repeat within a day makes the ban longer. Newer runners ask for work less
-  often. Put the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+  120 requests a minute and 172,800 a day, under the request limits. Two such
+  runners on one address, each busy all day, make 345,600 and pass the day limit
+  of 300,000. Three busy at once make 21,600 an hour and pass the hour limit of
+  20,000. Five busy at once make 600 a minute and pass the minute limit of 500.
+  Their address is then banned, their running jobs fail, and each repeat within
+  a day makes the ban longer. Newer runners ask for work less often. Put the
+  runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ## What the Core Rule Set lets through
 

docs/metrics.md

@@ -4,15 +4,6 @@ What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
 [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
 label as `exported_instance` unless the scrape sets `honor_labels: true`.
 
-`smallwebwaf servewaf` counts a denied request at its decision. It counts an
-allowed request when its report comes, with the status, bytes and times the
-report gives. These are not counted:
-
-- a report itself;
-- an allowed request whose report never comes;
-- a question refused with `400`;
-- a question whose body stopped arriving.
-
 ## Traffic
 
 - `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and
@@ -88,3 +79,14 @@ By `file`:
   `smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
   `smallwebwaf_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.
+
+## `servewaf`
+
+`smallwebwaf servewaf` counts a denied request at its decision. It counts an
+allowed request when its report comes, with the status, bytes and times the
+report gives. These are not counted:
+
+- a report itself;
+- an allowed request whose report never comes;
+- a question refused with `400`;
+- a question whose body stopped arriving.

docs/settings.md

@@ -4,23 +4,6 @@ Every setting, its default and the values it takes, in the groups of "Settings"
 in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
 that take `off`, the `_FILE` form, and what each group does and why.
 
-## `servewaf`
-
-`smallwebwaf servewaf` uses every setting here but these, which it ignores:
-
-- `SWWAF_UPSTREAM_URL` and `SWWAF_TRUSTED_PROXIES`;
-- the five timeouts under "Size and time limits";
-- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`, `SWWAF_REQUEST_MAX_BYTES` and
-  `SWWAF_RESPONSE_MAX_BYTES`.
-
-An invalid value of one of these still stops the start, and the line of settings
-at start still shows them.
-
-`SWWAF_ADD_LOOKUP_HEADERS` puts the headers on the answer to `rproxy`, not on a
-request to an app. `SWWAF_WAF_BODY_LIMIT` has an effect up to 64 KiB less one
-byte, whatever its value. A question carries no more of a body than 64 KiB (see
-"`servewaf`" in [`SPEC.md`](../SPEC.md)).
-
 ## Forms of values
 
 - A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`. Zero
@@ -116,9 +99,21 @@ byte, whatever its value. A question carries no more of a body than 64 KiB (see
 
 ## Request rate limits, per client
 
-- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `6000`), `SWWAF_RATE_LIMIT_PER_HOUR`
-  (default `100000`) and `SWWAF_RATE_LIMIT_PER_DAY` (default `1000000`): the
-  most requests a client may make in each window. A count or `off`.
+- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `500`, about 8 a second): the most
+  requests a client may make in a minute. A count or `off`. The default catches,
+  within seconds, a client firing requests as fast as it can. It leaves room for
+  a fleet of about 20 agents at its busiest, about 120 requests a minute. It
+  also leaves room for a few quick first visits to gitea with an empty cache,
+  about 40 files each.
+- `SWWAF_RATE_LIMIT_PER_HOUR` (default `20000`, about 5.5 a second): the most
+  requests a client may make in an hour. A count or `off`. The default leaves
+  room for an automation fleet at work. It catches a client that keeps up more
+  than about 5.5 a second for an hour.
+- `SWWAF_RATE_LIMIT_PER_DAY` (default `300000`, about 3.5 a second): the most
+  requests a client may make in a day. A count or `off`. The default catches a
+  scraper that keeps up 4 a second around the clock.
+- Counting cannot catch a client that stays under all three limits (see "Request
+  rate limits, per client" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
   rate limiting and the byte limits, such as `/assets/`.
 
@@ -346,3 +341,20 @@ A few limits are fixed rather than settings:
 - at most 20,000 anomaly counters are kept;
 - each alert destination's queue holds at most 1,000 alerts;
 - `servewaf` holds at most 10,000 answered requests awaiting their reports.
+
+## `servewaf`
+
+`smallwebwaf servewaf` uses every setting here but these, which it ignores:
+
+- `SWWAF_UPSTREAM_URL` and `SWWAF_TRUSTED_PROXIES`;
+- the five timeouts under "Size and time limits";
+- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES`, `SWWAF_REQUEST_MAX_BYTES` and
+  `SWWAF_RESPONSE_MAX_BYTES`.
+
+An invalid value of one of these still stops the start, and the line of settings
+at start still shows them.
+
+`SWWAF_ADD_LOOKUP_HEADERS` puts the headers on the answer to `rproxy`, not on a
+request to an app. `SWWAF_WAF_BODY_LIMIT` has an effect up to 64 KiB less one
+byte, whatever its value. A question carries no more of a body than 64 KiB (see
+"`servewaf`" in [`SPEC.md`](../SPEC.md)).

internal/config/config.go

@@ -506,9 +506,9 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		AllowNets:               env.netblocks("SWWAF_ALLOW_NETS", ""),
 		RateLimitExemptNets:     env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
 		DenyNets:                env.netblocks("SWWAF_DENY_NETS", ""),
-		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "6000"),
-		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "100000"),
-		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "1000000"),
+		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
+		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
+		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
 		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
 		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
 		BytesLimitPerHour:       env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),

internal/config/config_test.go

@@ -262,9 +262,9 @@ func TestDefaults(t *testing.T) {
 		UpstreamResponseTimeout:     30 * time.Minute,
 		RequestMaxBytes:             100 << 20,
 		ResponseMaxBytes:            1 << 30,
-		RateLimitPerMinute:          6000,
-		RateLimitPerHour:            100000,
-		RateLimitPerDay:             1000000,
+		RateLimitPerMinute:          500,
+		RateLimitPerHour:            20000,
+		RateLimitPerDay:             300000,
 		BanResponse:                 403,
 		LimitBanDuration:            time.Hour,
 		LimitBanRepeatWindow:        24 * time.Hour,
@@ -2375,9 +2375,9 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		allowNets:               "",
 		rateLimitExemptNets:     "",
 		denyNets:                "",
-		rateLimitPerMinute:      "6000",
-		rateLimitPerHour:        "100000",
-		rateLimitPerDay:         "1000000",
+		rateLimitPerMinute:      "500",
+		rateLimitPerHour:        "20000",
+		rateLimitPerDay:         "300000",
 		rateLimitExemptPaths:    "",
 		bytesLimitPerMinute:     "4G",
 		bytesLimitPerHour:       "20G",

internal/proxy/servewaf_test.go

@@ -36,6 +36,8 @@ const (
 	// reportedBytesLimit is the most bytes for each way SPEC.md lets a report
 	// give.
 	reportedBytesLimit = 1 << 50
+	// reportBodyLimit is the longest body SPEC.md lets a report have.
+	reportBodyLimit = 1 << 20
 	// anomalyClientPerMinute is the anomaly threshold these tests set.
 	anomalyClientPerMinute = "SWWAF_ANOMALY_CLIENT_REQUESTS_PER_MINUTE"
 )
@@ -739,6 +741,25 @@ func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) {
 	}
 }
 
+func TestDeniedQuestionCountsForTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{
+		rulesDir: writeRules(t, testRules), errorBurstThreshold: "1",
+	})
+
+	for range 2 {
+		got := s.ask(client, "/blocked")
+		wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
+	}
+
+	lines := s.out.requestLines(t, 2)
+	if lines[0].LimitHit != "" || lines[1].LimitHit != requestlog.LimitHitErrorBurst {
+		t.Errorf("log lines have limit_hit %q and %q, want none and %q",
+			lines[0].LimitHit, lines[1].LimitHit, requestlog.LimitHitErrorBurst)
+	}
+}
+
 func TestAllowCarriesTheLookupHeadersWhileTheSettingIsSet(t *testing.T) {
 	t.Parallel()
 
@@ -1011,13 +1032,12 @@ func TestReportThatIsNotOneObjectWithAllItsFieldsIsRefused(t *testing.T) {
 	id := s.allowed(client)
 	whole := encodedReport(t, id, nil)
 	fields := reportFields(id)
-	bodies := make([]string, 0, 10+3*len(fields))
+	bodies := make([]string, 0, 9+3*len(fields))
 	bodies = append(bodies,
 		"", "not JSON", "null", "[]", `"text"`, "{}",
 		whole+" {}",
 		whole+whole,
-		`{"request_id":"`+id+`"}`,
-		`{"request_id":"`+id+`","padding":"`+strings.Repeat("x", 1<<20)+`"}`)
+		`{"request_id":"`+id+`"}`)
 
 	for name := range fields {
 		bodies = append(bodies,
@@ -1040,6 +1060,32 @@ func TestReportThatIsNotOneObjectWithAllItsFieldsIsRefused(t *testing.T) {
 	}
 }
 
+func TestReportOver1MiBIsRefusedAndOneOfExactly1MiBIsTaken(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", nil)
+
+	id := s.allowed(client)
+	// The padding is a field of no meaning here, so only the size can refuse it.
+	padded := func(size int) string {
+		return encodedReport(t, id, map[string]any{"padding": strings.Repeat("x", size)})
+	}
+	paddingBytes := reportBodyLimit - len(padded(0))
+
+	wantStatus(t, s.reportBody(padded(paddingBytes+1)), http.StatusBadRequest)
+	wantProcessMessages(t, s, "a report is refused", 1)
+
+	if requests := s.history().Requests; requests != 0 {
+		t.Errorf("history holds %d requests, want the refused report not counted", requests)
+	}
+
+	wantStatus(t, s.reportBody(padded(paddingBytes)), http.StatusNoContent)
+
+	if requests := s.history().Requests; requests != 1 {
+		t.Errorf("history holds %d requests, want the report of 1 MiB counted", requests)
+	}
+}
+
 func TestReportWithAValueOutOfRangeIsRefused(t *testing.T) {
 	t.Parallel()
 
@@ -1436,14 +1482,58 @@ func TestSettingsOfTheLimitsAndTheProxiesAreIgnored(t *testing.T) {
 	}
 }
 
+func TestShortClientResponseTimeoutIsIgnored(t *testing.T) {
+	t.Parallel()
+
+	// The setting would leave no time to send any answer.
+	s := startServeWAF(t, "", map[string]string{
+		clientResponseTimeout: time.Nanosecond.String(), denyNets: client,
+	})
+
+	wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, proxy.DispositionDeny)
+	wantStatus(t, get(t, s.addr, proxy.HealthPath), http.StatusOK)
+}
+
+func TestShortClientRequestTimeoutIsIgnored(t *testing.T) {
+	t.Parallel()
+
+	// The setting would have run out while the Core Rule Set read the body. Go's
+	// server would then take the connection for gone, and the line say aborted.
+	s := startServeWAF(t, "", map[string]string{
+		clientRequestTimeout: time.Nanosecond.String(), wafMode: block, wafBodyLimit: "1M",
+	})
+
+	req := s.questionWith(http.MethodPost, siteA, client, "/", strings.NewReader("a=1"))
+	req.Header.Set("Content-Type", formData)
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
+
+	if line := s.out.requestLine(t); line.Aborted {
+		t.Errorf("log line says aborted: %+v", line.Line)
+	}
+}
+
+func TestServerHasTheTimeLimitsSPECGives(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", nil)
+
+	if s.server.ReadTimeout != time.Minute || s.server.WriteTimeout != time.Minute ||
+		s.server.IdleTimeout != 2*time.Minute {
+		t.Errorf("the read, write and idle limits are %v, %v and %v, want 1m, 1m and 2m",
+			s.server.ReadTimeout, s.server.WriteTimeout, s.server.IdleTimeout)
+	}
+}
+
 func TestChecksSeeTheHeadersTheVisitorSent(t *testing.T) {
 	t.Parallel()
 
 	s := startServeWAF(t, "", map[string]string{
 		rulesDir: writeRules(t, `
-own-header  header:X-Smallwebwaf-Client  block  .
-announced   header:Content-Length        block  ^70000$
-carried     header:Content-Length        block  ^6$
+own-client  header:X-Smallwebwaf-Client          block  .
+own-peer    header:X-Smallwebwaf-Peer            block  .
+own-length  header:X-Smallwebwaf-Content-Length  block  .
+announced   header:Content-Length                block  ^70000$
+carried     header:Content-Length                block  ^6$
 `),
 	})
 
@@ -1494,6 +1584,36 @@ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) {
 	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
 }
 
+func TestCoreRuleSetAlertNamesTheSite(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{wafMode: block})
+
+	got := s.ask(client, sqlInjection)
+	wantDisposition(t, got, http.StatusForbidden, proxy.DispositionDeny)
+
+	waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 || waiting[0].Event != alerts.EventWAFBlock ||
+		waiting[0].Host != siteA {
+		t.Errorf("alerts waiting are %+v, want a waf_block naming %s", waiting, siteA)
+	}
+}
+
+func TestReputationHitAlertNamesTheSite(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{blocklistURLs: dropURL})
+	loadLists(t, s.server, map[string][]string{dropURL: {client}})
+
+	wantDisposition(t, s.ask(client, "/"), http.StatusForbidden, proxy.DispositionDeny)
+
+	waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit ||
+		waiting[0].Host != siteA {
+		t.Errorf("alerts waiting are %+v, want a reputation_hit naming %s", waiting, siteA)
+	}
+}
+
 func TestAnomalyAlertNamesTheSite(t *testing.T) {
 	t.Parallel()
 

internal/smallwebwaf/smallwebwaf_test.go

@@ -1252,9 +1252,9 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
 		"SWWAF_ALLOW_NETS":                      "",
 		rateLimitExemptNets:                     "",
 		"SWWAF_DENY_NETS":                       "",
-		"SWWAF_RATE_LIMIT_PER_MINUTE":           "6000",
-		"SWWAF_RATE_LIMIT_PER_HOUR":             "100000",
-		rateLimitPerDay:                         "1000000",
+		"SWWAF_RATE_LIMIT_PER_MINUTE":           "500",
+		"SWWAF_RATE_LIMIT_PER_HOUR":             "20000",
+		rateLimitPerDay:                         "300000",
 		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":         "",
 		"SWWAF_DENIED_COUNTRIES":                "",
 		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES":   "",