For #175, request tags, which you asked for on 4 November: servewaf, the service that decides about each request to a site, gives each request tags, and the operator refuses or slows clients by tag.
Proposed design:
Each request's log line gets a tags field, from what servewaf already knows of the client:
country=US and asn=12345, from the address lookup;
one tag per named address list that holds the client. The operator names each list in a new setting, SWWAF_TAG_LISTS, as name=URL, so a published Tor exit list gives torexit and Mullvad's published ranges give vpn=mullvad. servewaf ships no lists of its own;
crowdsec, dnsbl=<zone> and abuseipdb when that reputation source lists the client;
exploitsignature when a rule file or the Core Rule Set matched the request;
ja4=<fingerprint> once traefik passes TLS fingerprints (#196).
Two new settings act on tags:
SWWAF_TAG_DENY: tags whose requests are refused, for example torexit,country=CN;
SWWAF_TAG_LIMIT_PERCENT: tag and percentage pairs that lower a client's request limits, for example vpn:50,asn=14061:25. The lowest percentage among a client's tags applies.
These replace the settings that do the same thing for one kind of tag: SWWAF_ASN_LIMIT_PERCENT, SWWAF_COUNTRY_LIMIT_PERCENT and SWWAF_DENIED_COUNTRIES. Before 1.0, nothing reads the old names.
Each tag source is one heuristic module (#195), so a new source is one more file.
Question: build request tags this way?
Yes, as proposed (recommended): one way to refuse or slow clients by country, AS number, list or reputation.
Yes, but keep the old settings beside the tag settings: nothing existing changes, but a country can then be slowed in two places that can disagree.
No, a different design: say what to change.
Model: opus-5-5
For https://git.eeqj.de/sneak/smallwebwaf/issues/175, request tags, which you asked for on 4 November: servewaf, the service that decides about each request to a site, gives each request tags, and the operator refuses or slows clients by tag.
**Proposed design:**
- Each request's log line gets a `tags` field, from what servewaf already knows of the client:
- `country=US` and `asn=12345`, from the address lookup;
- one tag per named address list that holds the client. The operator names each list in a new setting, `SWWAF_TAG_LISTS`, as `name=URL`, so a published Tor exit list gives `torexit` and Mullvad's published ranges give `vpn=mullvad`. servewaf ships no lists of its own;
- `crowdsec`, `dnsbl=<zone>` and `abuseipdb` when that reputation source lists the client;
- `exploitsignature` when a rule file or the Core Rule Set matched the request;
- `ja4=<fingerprint>` once traefik passes TLS fingerprints (https://git.eeqj.de/sneak/smallwebwaf/issues/196).
- Two new settings act on tags:
- `SWWAF_TAG_DENY`: tags whose requests are refused, for example `torexit,country=CN`;
- `SWWAF_TAG_LIMIT_PERCENT`: tag and percentage pairs that lower a client's request limits, for example `vpn:50,asn=14061:25`. The lowest percentage among a client's tags applies.
- These replace the settings that do the same thing for one kind of tag: `SWWAF_ASN_LIMIT_PERCENT`, `SWWAF_COUNTRY_LIMIT_PERCENT` and `SWWAF_DENIED_COUNTRIES`. Before 1.0, nothing reads the old names.
- Each tag source is one heuristic module (https://git.eeqj.de/sneak/smallwebwaf/issues/195), so a new source is one more file.
**Question:** build request tags this way?
- **Yes, as proposed** (recommended): one way to refuse or slow clients by country, AS number, list or reputation.
- **Yes, but keep the old settings beside the tag settings**: nothing existing changes, but a country can then be slowed in two places that can disagree.
- **No, a different design**: say what to change.
Model: opus-5-5
sneak
was assigned by clawbot2026-11-06 18:53:46 +01:00
Approved by sneak: build request tags as proposed (#197 (comment)). For smallwebwaf's manager: this is yours, after the modules (195). His routewatch plugin is filed as #204.
Model: opus-5-5
Approved by sneak: build request tags as proposed (https://git.eeqj.de/sneak/smallwebwaf/issues/197#issuecomment-169904). **For smallwebwaf's manager:** this is yours, after the modules (195). His routewatch plugin is filed as https://git.eeqj.de/sneak/smallwebwaf/issues/204.
Model: opus-5-5
sneak
was unassigned by clawbot2026-11-06 19:36:57 +01:00
clawbot
self-assigned this 2026-11-06 19:36:57 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
For #175, request tags, which you asked for on 4 November: servewaf, the service that decides about each request to a site, gives each request tags, and the operator refuses or slows clients by tag.
Proposed design:
tagsfield, from what servewaf already knows of the client:country=USandasn=12345, from the address lookup;SWWAF_TAG_LISTS, asname=URL, so a published Tor exit list givestorexitand Mullvad's published ranges givevpn=mullvad. servewaf ships no lists of its own;crowdsec,dnsbl=<zone>andabuseipdbwhen that reputation source lists the client;exploitsignaturewhen a rule file or the Core Rule Set matched the request;ja4=<fingerprint>once traefik passes TLS fingerprints (#196).SWWAF_TAG_DENY: tags whose requests are refused, for exampletorexit,country=CN;SWWAF_TAG_LIMIT_PERCENT: tag and percentage pairs that lower a client's request limits, for examplevpn:50,asn=14061:25. The lowest percentage among a client's tags applies.SWWAF_ASN_LIMIT_PERCENT,SWWAF_COUNTRY_LIMIT_PERCENTandSWWAF_DENIED_COUNTRIES. Before 1.0, nothing reads the old names.Question: build request tags this way?
Model: opus-5-5
we are going to support the routewatch ip info api via a plugin
yes, as proposed
Approved by sneak: build request tags as proposed (#197 (comment)). For smallwebwaf's manager: this is yours, after the modules (195). His routewatch plugin is filed as #204.
Model: opus-5-5