ALLOW_NETS, RATE_LIMIT_EXEMPT_NETS and DENY_NETS, with the SWWAF_ prefix, as the "Static lists" settings in SPEC.md (#9) describe. Milestone 2 has none, which is why private addresses skip its country lists (#14).
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
`ALLOW_NETS`, `RATE_LIMIT_EXEMPT_NETS` and `DENY_NETS`, with the `SWWAF_` prefix, as the "Static lists" settings in `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describe. Milestone 2 has none, which is why private addresses skip its country lists (https://git.eeqj.de/sneak/smallwebwaf/issues/14).
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts the static lists first among the stages after milestone 2, so this is built now, as one PR to next, following "Data flow for one request" and "Configuration surface" (static lists):
SWWAF_ALLOW_NETS, SWWAF_RATE_LIMIT_EXEMPT_NETS and SWWAF_DENY_NETS: each a comma-separated list of netblocks or single addresses, in the same form and read by the same code as SWWAF_TRUSTED_PROXIES; empty by default; an entry that does not parse stops the start with a message naming the setting.
They are checked right after the client is identified, before the lookup, the country lists and the rate limits, against the client's own address.
SWWAF_ALLOW_NETS: the request skips every check, its address is not looked up, and it is forwarded (actionforward).
SWWAF_DENY_NETS: refused with 403 before the body is read, not counted by the rate limits, logged with actiondenied. 403 rather than SWWAF_BAN_RESPONSE, which comes with the bans, as for the country lists.
SWWAF_RATE_LIMIT_EXEMPT_NETS: the request rate limits neither count nor refuse the client; the country lists still apply.
From now on SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuses a client on a private, loopback or link-local address unless SWWAF_ALLOW_NETS lists it, as the build order says; SWWAF_DENIED_COUNTRIES still never refuses it, and such addresses are still never sent to GeoJS.
README.md documents the three settings, and its sentence that milestone 2's country lists skip private addresses says what happens now.
Definition of done: tests show each list doing the above, including a private client refused by the allow-only country list and let through once in SWWAF_ALLOW_NETS, no lookup for an allowed client, a denied request not counted, the defaults, and the start refused for an entry that does not parse; make check green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts the static lists first among the stages after milestone 2, so this is built now, as one PR to `next`, following "Data flow for one request" and "Configuration surface" (static lists):
- `SWWAF_ALLOW_NETS`, `SWWAF_RATE_LIMIT_EXEMPT_NETS` and `SWWAF_DENY_NETS`: each a comma-separated list of netblocks or single addresses, in the same form and read by the same code as `SWWAF_TRUSTED_PROXIES`; empty by default; an entry that does not parse stops the start with a message naming the setting.
- They are checked right after the client is identified, before the lookup, the country lists and the rate limits, against the client's own address.
- `SWWAF_ALLOW_NETS`: the request skips every check, its address is not looked up, and it is forwarded (`action` `forward`).
- `SWWAF_DENY_NETS`: refused with `403` before the body is read, not counted by the rate limits, logged with `action` `denied`. `403` rather than `SWWAF_BAN_RESPONSE`, which comes with the bans, as for the country lists.
- `SWWAF_RATE_LIMIT_EXEMPT_NETS`: the request rate limits neither count nor refuse the client; the country lists still apply.
- From now on `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` refuses a client on a private, loopback or link-local address unless `SWWAF_ALLOW_NETS` lists it, as the build order says; `SWWAF_DENIED_COUNTRIES` still never refuses it, and such addresses are still never sent to GeoJS.
- `README.md` documents the three settings, and its sentence that milestone 2's country lists skip private addresses says what happens now.
Definition of done: tests show each list doing the above, including a private client refused by the allow-only country list and let through once in `SWWAF_ALLOW_NETS`, no lookup for an allowed client, a denied request not counted, the defaults, and the start refused for an entry that does not parse; `make check` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
self-assigned this 2026-10-06 01:23:35 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
ALLOW_NETS,RATE_LIMIT_EXEMPT_NETSandDENY_NETS, with theSWWAF_prefix, as the "Static lists" settings inSPEC.md(#9) describe. Milestone 2 has none, which is why private addresses skip its country lists (#14).Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs the static lists first among the stages after milestone 2, so this is built now, as one PR tonext, following "Data flow for one request" and "Configuration surface" (static lists):SWWAF_ALLOW_NETS,SWWAF_RATE_LIMIT_EXEMPT_NETSandSWWAF_DENY_NETS: each a comma-separated list of netblocks or single addresses, in the same form and read by the same code asSWWAF_TRUSTED_PROXIES; empty by default; an entry that does not parse stops the start with a message naming the setting.SWWAF_ALLOW_NETS: the request skips every check, its address is not looked up, and it is forwarded (actionforward).SWWAF_DENY_NETS: refused with403before the body is read, not counted by the rate limits, logged withactiondenied.403rather thanSWWAF_BAN_RESPONSE, which comes with the bans, as for the country lists.SWWAF_RATE_LIMIT_EXEMPT_NETS: the request rate limits neither count nor refuse the client; the country lists still apply.SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIESrefuses a client on a private, loopback or link-local address unlessSWWAF_ALLOW_NETSlists it, as the build order says;SWWAF_DENIED_COUNTRIESstill never refuses it, and such addresses are still never sent to GeoJS.README.mddocuments the three settings, and its sentence that milestone 2's country lists skip private addresses says what happens now.Definition of done: tests show each list doing the above, including a private client refused by the allow-only country list and let through once in
SWWAF_ALLOW_NETS, no lookup for an allowed client, a denied request not counted, the defaults, and the start refused for an entry that does not parse;make checkgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
Built in #66, waiting for review.
Model: opus-5-5
clawbot referenced this issue2026-10-06 02:36:48 +02:00