Plain-text rule files, one regex per line, read again whenever a file changes, as the "Rule files" section of SPEC.md (#9) describes.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plain-text rule files, one regex per line, read again whenever a file changes, as the "Rule files" section of `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describes.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts rule files first in the second stage after milestone 2, now that the first stage is on next, so they are built next, as "Rule files" describes, with the bans for a clear sign of attack that the ban action makes ("Bans"). One PR to next.
SWWAF_RULES_DIR and SWWAF_RULES_ENABLED as "Configuration surface" gives them; every *.rules file read in name order, rules in line order; the four fields, the targets (path, query, uri both as received and once percent-decoded, method, host, user_agent, referer, header:<Name>), the actions log, block (403, no ban) and ban, RE2 regexes. A bad line, a regex that does not compile or a duplicate id stops the start naming file and line; a directory that does not exist stops the start; an empty one is logged.
The directory is watched: an edited, added or removed file takes effect while running; a broken edit keeps the rules as they were, logged with file and line. (The file_error alert comes with alerting.)
Checked where "Data flow for one request" puts them, after the rate limits; matching stops at the first rule that refuses or bans. Clients in SWWAF_ALLOW_NETS are not checked; observe mode logs would_action.
ban: the clear-sign-of-attack rule of "Bans": SWWAF_ATTACK_BAN_DURATION (default 7d) for a first ban; any request during it, or a later clear sign of attack, makes it permanent. The ban's notes carry the rule id and target.
The request log gains rule_ids and the actions rule_blocked and, for a ban, banned; the metrics gain rule matches by rule id and action, and the number of rules loaded.
The image ships the default 00-default.rules from "Rule files" in /etc/smallwebwaf/rules.d, and README.md documents the format, the default file and how an app adds its own.
Not in this unit: the error burst that a block counts toward (next, as its own unit), trap paths, the Core Rule Set.
Definition of done: tests show each target and action, matching stopping at the first refusal, name and line order, every start error, an edit taken in and a broken edit keeping the old rules, the attack ban and its permanent step, the allow list and observe mode, the log fields and metrics, and the default file's rules against sample probes and against ordinary deeper paths such as /owner/repo/src/branch/main/.env.example; make example-app shows a probe banned; make check green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts rule files first in the second stage after milestone 2, now that the first stage is on `next`, so they are built next, as "Rule files" describes, with the bans for a clear sign of attack that the `ban` action makes ("Bans"). One PR to `next`.
- `SWWAF_RULES_DIR` and `SWWAF_RULES_ENABLED` as "Configuration surface" gives them; every `*.rules` file read in name order, rules in line order; the four fields, the targets (`path`, `query`, `uri` both as received and once percent-decoded, `method`, `host`, `user_agent`, `referer`, `header:<Name>`), the actions `log`, `block` (`403`, no ban) and `ban`, RE2 regexes. A bad line, a regex that does not compile or a duplicate id stops the start naming file and line; a directory that does not exist stops the start; an empty one is logged.
- The directory is watched: an edited, added or removed file takes effect while running; a broken edit keeps the rules as they were, logged with file and line. (The `file_error` alert comes with alerting.)
- Checked where "Data flow for one request" puts them, after the rate limits; matching stops at the first rule that refuses or bans. Clients in `SWWAF_ALLOW_NETS` are not checked; `observe` mode logs `would_action`.
- `ban`: the clear-sign-of-attack rule of "Bans": `SWWAF_ATTACK_BAN_DURATION` (default `7d`) for a first ban; any request during it, or a later clear sign of attack, makes it permanent. The ban's notes carry the rule id and target.
- The request log gains `rule_ids` and the actions `rule_blocked` and, for a ban, `banned`; the metrics gain rule matches by rule id and action, and the number of rules loaded.
- The image ships the default `00-default.rules` from "Rule files" in `/etc/smallwebwaf/rules.d`, and `README.md` documents the format, the default file and how an app adds its own.
Not in this unit: the error burst that a `block` counts toward (next, as its own unit), trap paths, the Core Rule Set.
Definition of done: tests show each target and action, matching stopping at the first refusal, name and line order, every start error, an edit taken in and a broken edit keeping the old rules, the attack ban and its permanent step, the allow list and `observe` mode, the log fields and metrics, and the default file's rules against sample probes and against ordinary deeper paths such as `/owner/repo/src/branch/main/.env.example`; `make example-app` shows a probe banned; `make check` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
self-assigned this 2026-10-06 14:18:55 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Plain-text rule files, one regex per line, read again whenever a file changes, as the "Rule files" section of
SPEC.md(#9) describes.Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs rule files first in the second stage after milestone 2, now that the first stage is onnext, so they are built next, as "Rule files" describes, with the bans for a clear sign of attack that thebanaction makes ("Bans"). One PR tonext.SWWAF_RULES_DIRandSWWAF_RULES_ENABLEDas "Configuration surface" gives them; every*.rulesfile read in name order, rules in line order; the four fields, the targets (path,query,uriboth as received and once percent-decoded,method,host,user_agent,referer,header:<Name>), the actionslog,block(403, no ban) andban, RE2 regexes. A bad line, a regex that does not compile or a duplicate id stops the start naming file and line; a directory that does not exist stops the start; an empty one is logged.file_erroralert comes with alerting.)SWWAF_ALLOW_NETSare not checked;observemode logswould_action.ban: the clear-sign-of-attack rule of "Bans":SWWAF_ATTACK_BAN_DURATION(default7d) for a first ban; any request during it, or a later clear sign of attack, makes it permanent. The ban's notes carry the rule id and target.rule_idsand the actionsrule_blockedand, for a ban,banned; the metrics gain rule matches by rule id and action, and the number of rules loaded.00-default.rulesfrom "Rule files" in/etc/smallwebwaf/rules.d, andREADME.mddocuments the format, the default file and how an app adds its own.Not in this unit: the error burst that a
blockcounts toward (next, as its own unit), trap paths, the Core Rule Set.Definition of done: tests show each target and action, matching stopping at the first refusal, name and line order, every start error, an edit taken in and a broken edit keeping the old rules, the attack ban and its permanent step, the allow list and
observemode, the log fields and metrics, and the default file's rules against sample probes and against ordinary deeper paths such as/owner/repo/src/branch/main/.env.example;make example-appshows a probe banned;make checkgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
clawbot referenced this issue2026-10-06 15:41:47 +02:00
Built in #83, waiting for review.
Model: opus-5-5
clawbot referenced this issue2026-10-06 20:38:53 +02:00