Answer first, as a comment on #308, before any code: how long a request with 16,000 cookies takes to be refused at this host's usual load, without the race detector; where it is refused, in rproxy or the discriminator, and by what; and what work happens before that refusal (header parsing, the question rproxy sends, lookups, rule files). Plain words, measured with a throwaway program that is not committed.
Also in that comment, the checks the discriminator makes, in the order it makes them, marking which are cheap (counts and sizes of the request line, headers, cookies and body) and which cost more (lookups, rule files, the Core Rule Set).
Then one PR into next: every cheap check that today's settings already define runs before any costly step, and a request that fails one is answered at once, with no lookup and no Core Rule Set. A test asserts that order through what is called, not through wall time.
A cheap check that would need a new setting or a new limit is not added: list it in the comment with a recommendation, for sneak to decide.
No behaviour changes for a request that passes every cheap check.
If the rename of the discriminator to waf (#227) has landed by then, use the new names. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Push over SSH and post with tea, since GITEA_TOKEN is refused. Label the PR needs-review.
Model: opus-5-5
sneak, on https://git.eeqj.de/sneak/smallwebwaf/issues/308:
> why does it take so long? 16000 cookies should be instant fail, no?
> there need to be basic sanity tests in the discriminator very early in the chain
Reading: https://git.eeqj.de/sneak/smallwebwaf/issues/308#issuecomment-175994.
**Definition of done:**
1. **Answer first, as a comment on https://git.eeqj.de/sneak/smallwebwaf/issues/308**, before any code: how long a request with 16,000 cookies takes to be refused at this host's usual load, without the race detector; where it is refused, in `rproxy` or the discriminator, and by what; and what work happens before that refusal (header parsing, the question `rproxy` sends, lookups, rule files). Plain words, measured with a throwaway program that is not committed.
2. Also in that comment, the checks the discriminator makes, in the order it makes them, marking which are cheap (counts and sizes of the request line, headers, cookies and body) and which cost more (lookups, rule files, the Core Rule Set).
3. **Then one PR into `next`:** every cheap check that today's settings already define runs before any costly step, and a request that fails one is answered at once, with no lookup and no Core Rule Set. A test asserts that order through what is called, not through wall time.
4. A cheap check that would need a new setting or a new limit is not added: list it in the comment with a recommendation, for sneak to decide.
5. No behaviour changes for a request that passes every cheap check.
If the rename of the discriminator to `waf` (https://git.eeqj.de/sneak/smallwebwaf/issues/227) has landed by then, use the new names. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Push over SSH and post with `tea`, since `GITEA_TOKEN` is refused. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 00:57:22 +01:00
The measured answer is on #308 (comment). Built in #320: the header limits are now the first check, so a request over them causes no lookup, outside query, rule file match or Core Rule Set.
Model: opus-5-5
The measured answer is on https://git.eeqj.de/sneak/smallwebwaf/issues/308#issuecomment-176221. Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/320: the header limits are now the first check, so a request over them causes no lookup, outside query, rule file match or Core Rule Set.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak, on #308:
Reading: #308 (comment).
Definition of done:
rproxyor the discriminator, and by what; and what work happens before that refusal (header parsing, the questionrproxysends, lookups, rule files). Plain words, measured with a throwaway program that is not committed.next: every cheap check that today's settings already define runs before any costly step, and a request that fails one is answered at once, with no lookup and no Core Rule Set. A test asserts that order through what is called, not through wall time.If the rename of the discriminator to
waf(#227) has landed by then, use the new names. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Push over SSH and post withtea, sinceGITEA_TOKENis refused. Label the PRneeds-review.Model: opus-5-5
The measured answer is on #308 (comment). Built in #320: the header limits are now the first check, so a request over them causes no lookup, outside query, rule file match or Core Rule Set.
Model: opus-5-5