Downloaded blocklists, DNS blocklists, AbuseIPDB and an optional CrowdSec decision feed, none on by default, as the "Reputation" settings in SPEC.md (#9) describe.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Downloaded blocklists, DNS blocklists, AbuseIPDB and an optional CrowdSec decision feed, none on by default, as the "Reputation" settings in `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describe.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts reputation in the fourth stage, after the anomaly thresholds (#101). This issue builds the downloaded blocklists; DNS blocklists, AbuseIPDB and the CrowdSec feed follow in their own issues, linked below once filed. One PR to next.
SWWAF_BLOCKLIST_URLS: text files of addresses and netblocks, one per line, anything after ; or # ignored, fetched at start and every SWWAF_BLOCKLIST_REFRESH (default 24h, never below one hour, as Spamhaus's terms require); the last good copy kept whole, comment lines included, and used on failure and across restarts. A failed fetch keeps the old copy, is logged and sends one source_failure alert per cooldown.
SWWAF_BLOCKLIST_ACTION (default deny): deny refuses a listed client, limit:<percent> takes part in the lowest-percentage rule of #21, log only logs. Checked where "Data flow for one request" puts reputation; clients in SWWAF_ALLOW_NETS are not checked.
SWWAF_ASN_LIMIT_PERCENT_URL, left out of #21: a text file of AS:percent lines fetched and kept the same way, merged with SWWAF_ASN_LIMIT_PERCENT (the lower wins).
The request log's reputation names the list; a reputation_hit alert; metrics as "Metrics endpoint" gives them; README.md credits The Spamhaus Project when DROP is used, as its terms ask, and shows the setting.
Definition of done: tests, against local stand-ins on a clock the test controls, show a listed address and netblock refused, limited and logged by each action, comments ignored, the refresh and its floor, the last good copy kept on failure and across a restart, the AS percentage file merged, and the alert and log fields; each test failing with its rule broken; make check green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts reputation in the fourth stage, after the anomaly thresholds (https://git.eeqj.de/sneak/smallwebwaf/issues/101). This issue builds the downloaded blocklists; DNS blocklists, AbuseIPDB and the CrowdSec feed follow in their own issues, linked below once filed. One PR to `next`.
- `SWWAF_BLOCKLIST_URLS`: text files of addresses and netblocks, one per line, anything after `;` or `#` ignored, fetched at start and every `SWWAF_BLOCKLIST_REFRESH` (default `24h`, never below one hour, as Spamhaus's terms require); the last good copy kept whole, comment lines included, and used on failure and across restarts. A failed fetch keeps the old copy, is logged and sends one `source_failure` alert per cooldown.
- `SWWAF_BLOCKLIST_ACTION` (default `deny`): `deny` refuses a listed client, `limit:<percent>` takes part in the lowest-percentage rule of https://git.eeqj.de/sneak/smallwebwaf/issues/21, `log` only logs. Checked where "Data flow for one request" puts reputation; clients in `SWWAF_ALLOW_NETS` are not checked.
- `SWWAF_ASN_LIMIT_PERCENT_URL`, left out of https://git.eeqj.de/sneak/smallwebwaf/issues/21: a text file of `AS:percent` lines fetched and kept the same way, merged with `SWWAF_ASN_LIMIT_PERCENT` (the lower wins).
- The request log's `reputation` names the list; a `reputation_hit` alert; metrics as "Metrics endpoint" gives them; `README.md` credits The Spamhaus Project when DROP is used, as its terms ask, and shows the setting.
Definition of done: tests, against local stand-ins on a clock the test controls, show a listed address and netblock refused, limited and logged by each action, comments ignored, the refresh and its floor, the last good copy kept on failure and across a restart, the AS percentage file merged, and the alert and log fields; each test failing with its rule broken; `make check` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
changed title from Reputation sources to Reputation: downloaded blocklists2026-10-07 14:22:51 +02:00
clawbot
self-assigned this 2026-10-07 14:22:51 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Downloaded blocklists, DNS blocklists, AbuseIPDB and an optional CrowdSec decision feed, none on by default, as the "Reputation" settings in
SPEC.md(#9) describe.Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs reputation in the fourth stage, after the anomaly thresholds (#101). This issue builds the downloaded blocklists; DNS blocklists, AbuseIPDB and the CrowdSec feed follow in their own issues, linked below once filed. One PR tonext.SWWAF_BLOCKLIST_URLS: text files of addresses and netblocks, one per line, anything after;or#ignored, fetched at start and everySWWAF_BLOCKLIST_REFRESH(default24h, never below one hour, as Spamhaus's terms require); the last good copy kept whole, comment lines included, and used on failure and across restarts. A failed fetch keeps the old copy, is logged and sends onesource_failurealert per cooldown.SWWAF_BLOCKLIST_ACTION(defaultdeny):denyrefuses a listed client,limit:<percent>takes part in the lowest-percentage rule of #21,logonly logs. Checked where "Data flow for one request" puts reputation; clients inSWWAF_ALLOW_NETSare not checked.SWWAF_ASN_LIMIT_PERCENT_URL, left out of #21: a text file ofAS:percentlines fetched and kept the same way, merged withSWWAF_ASN_LIMIT_PERCENT(the lower wins).reputationnames the list; areputation_hitalert; metrics as "Metrics endpoint" gives them;README.mdcredits The Spamhaus Project when DROP is used, as its terms ask, and shows the setting.Definition of done: tests, against local stand-ins on a clock the test controls, show a listed address and netblock refused, limited and logged by each action, comments ignored, the refresh and its floor, the last good copy kept on failure and across a restart, the AS percentage file merged, and the alert and log fields; each test failing with its rule broken;
make checkgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
Reputation sourcesto Reputation: downloaded blocklistsBuilt in #108.
Model: opus-5-5