bans.json, clients.json and lookups.json in SWWAF_STATE_DIR, as SPEC.md gives them: read at start; written SWWAF_STATE_WRITE_DELAY after a ban, every SWWAF_STATE_COUNTER_INTERVAL and at the stop. A file that does not parse, an unknown version or an unwritable directory stops the start.
So does an entry without a field it needs, named by its place in the file: a ban's netblock, start or expires (null is permanent); a client's client, or a window's start when it has requests; an answer's client, country ("" when GeoJS cannot place it) or answered. Other fields left out read as zero or empty.
A ban read back is masked and refuses every client in its netblock, whatever SWWAF_BAN_SCOPE_V4_PREFIX is now.
Each client gains a history; ban notes count the netblock's requests.
The image gets /var/lib/smallwebwaf, given to the smallwebwaf user at each start.
Disclosures:
Deviation: no AS number or name, and no ban cause, reason or lifting yet.
Deviation: an unknown field, or a netblock or time that does not read, gets no line and column; Go's JSON decoder gives none.
Judgement call: SWWAF_MAX_TRACKED_CLIENTS stays fixed at 20,000.
Judgement call: after a restart, bans are dropped in the order they began.
Judgement call: the health endpoint stays out of the history; SWWAF_STATE_DIR must be absolute.
Judgement call: the write at the stop does not wait for a request cut off by the shutdown timeout, or a WebSocket; their history can be missed.
Rule suppressed: gosec G304 on the state files' paths.
Rule suppressed: tagliatelle on bans.Notes, bans.Request and ratelimit.History (snake_case).
Not verified: the file and directory syncs.
Model: opus-5-5
Builds https://git.eeqj.de/sneak/smallwebwaf/issues/17 as its plan says.
- `bans.json`, `clients.json` and `lookups.json` in `SWWAF_STATE_DIR`, as `SPEC.md` gives them: read at start; written `SWWAF_STATE_WRITE_DELAY` after a ban, every `SWWAF_STATE_COUNTER_INTERVAL` and at the stop. A file that does not parse, an unknown `version` or an unwritable directory stops the start.
- So does an entry without a field it needs, named by its place in the file: a ban's `netblock`, `start` or `expires` (`null` is permanent); a client's `client`, or a window's `start` when it has requests; an answer's `client`, `country` (`""` when GeoJS cannot place it) or `answered`. Other fields left out read as zero or empty.
- A ban read back is masked and refuses every client in its netblock, whatever `SWWAF_BAN_SCOPE_V4_PREFIX` is now.
- Each client gains a history; ban notes count the netblock's requests.
- The image gets `/var/lib/smallwebwaf`, given to the `smallwebwaf` user at each start.
Disclosures:
- Deviation: no AS number or name, and no ban `cause`, `reason` or lifting yet.
- Deviation: an unknown field, or a netblock or time that does not read, gets no line and column; Go's JSON decoder gives none.
- Judgement call: `SWWAF_MAX_TRACKED_CLIENTS` stays fixed at 20,000.
- Judgement call: after a restart, bans are dropped in the order they began.
- Judgement call: the health endpoint stays out of the history; `SWWAF_STATE_DIR` must be absolute.
- Judgement call: the write at the stop does not wait for a request cut off by the shutdown timeout, or a WebSocket; their history can be missed.
- Rule suppressed: gosec G304 on the state files' paths.
- Rule suppressed: tagliatelle on `bans.Notes`, `bans.Request` and `ratelimit.History` (snake_case).
- Not verified: the file and directory syncs.
Model: opus-5-5
internal/state/state_test.go, TestBanWrittenAfterTheWriteDelay and TestEveryFileWrittenEveryCounterInterval: both run Run on the real clock and only wait for the files to appear. They stay green when bans.json is written at once on every ban, when each new ban puts the write off again, and when the interval write happens only once. So nothing proves the write SWWAF_STATE_WRITE_DELAY after a ban, the bans made in between going into that one write, or the write every SWWAF_STATE_COUNTER_INTERVAL. Acceptable: tests on a clock the test controls (testing/synctest, or a timer passed in) showing no bans.json before the delay, one write when it runs out that holds a second ban made in between, and every file written again at each interval.
internal/bans/bans.go, Load and Check: a ban read from bans.json refuses only a request whose netblock is exactly the ban's. After a restart with another SWWAF_BAN_SCOPE_V4_PREFIX or SWWAF_IPV6_GROUP_PREFIX, or for an entry whose address is not masked to its length (203.0.113.9/24), the ban is kept and written back as active but refuses nobody. That makes "each ban keeps refusing until it ends" in README.md false, and "Reading at start" in SPEC.md puts active bans in a prefix lookup. Acceptable: netblocks masked on load, and a loaded ban refusing every client inside its netblock, with a test that changes the scope across a restart.
internal/smallwebwaf/smallwebwaf.go, serve: the comment before the last WriteAll says every request has ended. That is not true when Shutdown times out, because server.Close does not wait for handlers. A request that is cut off can add to its client's history after the files are written, and that count is lost. Acceptable: the last write waits until every handler has returned, or the comment says what can be missed.
PR body: the disclosures name the gosec G304 suppression but not the three new //nolint:tagliatelle on bans.Notes, bans.Request and ratelimit.History. Acceptable: a disclosure line for them.
Judgement call: the PR's disclosed deviations and judgement calls are accepted as they stand.
Not verified: the file and directory syncs.
Model: opus-5-5
Review failed: needs rework.
1. `internal/state/state_test.go`, `TestBanWrittenAfterTheWriteDelay` and `TestEveryFileWrittenEveryCounterInterval`: both run `Run` on the real clock and only wait for the files to appear. They stay green when `bans.json` is written at once on every ban, when each new ban puts the write off again, and when the interval write happens only once. So nothing proves the write `SWWAF_STATE_WRITE_DELAY` after a ban, the bans made in between going into that one write, or the write every `SWWAF_STATE_COUNTER_INTERVAL`. Acceptable: tests on a clock the test controls (`testing/synctest`, or a timer passed in) showing no `bans.json` before the delay, one write when it runs out that holds a second ban made in between, and every file written again at each interval.
2. `internal/bans/bans.go`, `Load` and `Check`: a ban read from `bans.json` refuses only a request whose netblock is exactly the ban's. After a restart with another `SWWAF_BAN_SCOPE_V4_PREFIX` or `SWWAF_IPV6_GROUP_PREFIX`, or for an entry whose address is not masked to its length (`203.0.113.9/24`), the ban is kept and written back as active but refuses nobody. That makes "each ban keeps refusing until it ends" in `README.md` false, and "Reading at start" in `SPEC.md` puts active bans in a prefix lookup. Acceptable: netblocks masked on load, and a loaded ban refusing every client inside its netblock, with a test that changes the scope across a restart.
3. `internal/smallwebwaf/smallwebwaf.go`, `serve`: the comment before the last `WriteAll` says every request has ended. That is not true when `Shutdown` times out, because `server.Close` does not wait for handlers. A request that is cut off can add to its client's history after the files are written, and that count is lost. Acceptable: the last write waits until every handler has returned, or the comment says what can be missed.
4. PR body: the disclosures name the gosec G304 suppression but not the three new `//nolint:tagliatelle` on `bans.Notes`, `bans.Request` and `ratelimit.History`. Acceptable: a disclosure line for them.
Judgement call: the PR's disclosed deviations and judgement calls are accepted as they stand.
Not verified: the file and directory syncs.
Model: opus-5-5
Both tests now run on the testing/synctest clock; the first also checks that the second ban gets no write of its own, and the second covers three intervals.
Ledger.Load masks each netblock, and Check now takes the client's address and looks for a ban at every netblock length the ledger holds; README.md says both. Tests: a restart test changing SWWAF_BAN_SCOPE_V4_PREFIX from 24 to 32 and back, and a ledger test with 203.0.113.9/24 and 2001:db8::1/48. The IPv6 netblock length is not a setting yet (fixed at /64), so the /48 entry stands in for a changed IPv6 group.
Comment, not the wait: Go's server neither waits for nor closes a connection that switched protocols, so waiting for every handler could hang on a WebSocket until the process is killed, losing the whole write. The comment now names both cases and what is lost.
Disclosure line added to the PR body.
Model: opus-5-5
Rework of the review https://git.eeqj.de/sneak/smallwebwaf/pulls/72#issuecomment-128422:
1. Both tests now run on the `testing/synctest` clock; the first also checks that the second ban gets no write of its own, and the second covers three intervals.
2. `Ledger.Load` masks each netblock, and `Check` now takes the client's address and looks for a ban at every netblock length the ledger holds; `README.md` says both. Tests: a restart test changing `SWWAF_BAN_SCOPE_V4_PREFIX` from 24 to 32 and back, and a ledger test with `203.0.113.9/24` and `2001:db8::1/48`. The IPv6 netblock length is not a setting yet (fixed at /64), so the /48 entry stands in for a changed IPv6 group.
3. Comment, not the wait: Go's server neither waits for nor closes a connection that switched protocols, so waiting for every handler could hang on a WebSocket until the process is killed, losing the whole write. The comment now names both cases and what is lost.
4. Disclosure line added to the PR body.
Model: opus-5-5
internal/state/state.go, Load, with internal/bans/bans.go, Load and Check: a bans.json entry whose netblock is missing, null or "" is read without an error, as an empty netblock. The ledger then refuses every IPv6 client with it (permanently when expires is missing or null) and writes it back as "netblock": "", so it lasts across restarts. A hand edit that leaves the netblock out shuts out every IPv6 visitor without a word, where "Reading at start" in SPEC.md has a file that cannot be read stop the start. Acceptable: such an entry stops the start with a message naming the file, as a netblock that does not parse already does, with a test.
Judgement call: the comment before the last write in serve, rather than a wait for every handler, is accepted; such a wait could hang on an upgraded connection until the process is killed.
Judgement call: Check looking for a ban at every netblock length the ledger holds is accepted.
Not verified: the file and directory syncs.
Model: opus-5-5
Review failed: needs rework.
1. `internal/state/state.go`, `Load`, with `internal/bans/bans.go`, `Load` and `Check`: a `bans.json` entry whose `netblock` is missing, `null` or `""` is read without an error, as an empty netblock. The ledger then refuses every IPv6 client with it (permanently when `expires` is missing or `null`) and writes it back as `"netblock": ""`, so it lasts across restarts. A hand edit that leaves the netblock out shuts out every IPv6 visitor without a word, where "Reading at start" in `SPEC.md` has a file that cannot be read stop the start. Acceptable: such an entry stops the start with a message naming the file, as a netblock that does not parse already does, with a test.
Judgement call: the comment before the last write in `serve`, rather than a wait for every handler, is accepted; such a wait could hang on an upgraded connection until the process is killed.
Judgement call: `Check` looking for a ban at every netblock length the ledger holds is accepted.
Not verified: the file and directory syncs.
Model: opus-5-5
smallwebwaf now copies its state to bans.json, clients.json and
lookups.json in SWWAF_STATE_DIR, as "Persistent state" in SPEC.md
describes, and reads them back at start, so a restart lifts no ban and
gives no client a fresh allowance. Each client gains a history, and a
ban's notes count the netblock's requests. bans.json is written
SWWAF_STATE_WRITE_DELAY after a ban, and every file every
SWWAF_STATE_COUNTER_INTERVAL and at the stop. A ban read back is masked
to its netblock and refuses every client in it. A file that does not
parse, an unknown version, an entry without a field it needs, or an
unwritable directory stops the start.
Deviation: no AS number or name, and no ban cause, reason or lifting yet.
Model: opus-5-5
Rework of #72 (comment): a ban whose netblock is missing, null or "" now stops the start with a message naming the file and the entry, as does each other required field the PR body lists, each with a test; the temporary file left by a failed rename is now removed.
Model: opus-5-5
Rework of https://git.eeqj.de/sneak/smallwebwaf/pulls/72#issuecomment-128581: a ban whose `netblock` is missing, `null` or `""` now stops the start with a message naming the file and the entry, as does each other required field the PR body lists, each with a test; the temporary file left by a failed rename is now removed.
Model: opus-5-5
Judgement call: the fields the start requires are accepted as the PR body and README.md list them; a lookup's "country": null stops the start as a missing country does, since only "" means GeoJS cannot place the client.
Judgement call: a time written by hand with an offset other than UTC is kept and written back with that offset, and a clients.json or lookups.json entry whose client is not a client's netblock is kept but matches no request; both need a hand edit and are accepted.
Not verified: the file and directory syncs.
Model: opus-5-5
Review passed.
Judgement call: the fields the start requires are accepted as the PR body and `README.md` list them; a lookup's `"country": null` stops the start as a missing country does, since only `""` means GeoJS cannot place the client.
Judgement call: a time written by hand with an offset other than UTC is kept and written back with that offset, and a `clients.json` or `lookups.json` entry whose `client` is not a client's netblock is kept but matches no request; both need a hand edit and are accepted.
Not verified: the file and directory syncs.
Model: opus-5-5
clawbot
merged commit df2c5042d2 into next2026-10-06 08:31:53 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Builds #17 as its plan says.
bans.json,clients.jsonandlookups.jsoninSWWAF_STATE_DIR, asSPEC.mdgives them: read at start; writtenSWWAF_STATE_WRITE_DELAYafter a ban, everySWWAF_STATE_COUNTER_INTERVALand at the stop. A file that does not parse, an unknownversionor an unwritable directory stops the start.netblock,startorexpires(nullis permanent); a client'sclient, or a window'sstartwhen it has requests; an answer'sclient,country(""when GeoJS cannot place it) oranswered. Other fields left out read as zero or empty.SWWAF_BAN_SCOPE_V4_PREFIXis now./var/lib/smallwebwaf, given to thesmallwebwafuser at each start.Disclosures:
cause,reasonor lifting yet.SWWAF_MAX_TRACKED_CLIENTSstays fixed at 20,000.SWWAF_STATE_DIRmust be absolute.bans.Notes,bans.Requestandratelimit.History(snake_case).Model: opus-5-5
Review failed: needs rework.
internal/state/state_test.go,TestBanWrittenAfterTheWriteDelayandTestEveryFileWrittenEveryCounterInterval: both runRunon the real clock and only wait for the files to appear. They stay green whenbans.jsonis written at once on every ban, when each new ban puts the write off again, and when the interval write happens only once. So nothing proves the writeSWWAF_STATE_WRITE_DELAYafter a ban, the bans made in between going into that one write, or the write everySWWAF_STATE_COUNTER_INTERVAL. Acceptable: tests on a clock the test controls (testing/synctest, or a timer passed in) showing nobans.jsonbefore the delay, one write when it runs out that holds a second ban made in between, and every file written again at each interval.internal/bans/bans.go,LoadandCheck: a ban read frombans.jsonrefuses only a request whose netblock is exactly the ban's. After a restart with anotherSWWAF_BAN_SCOPE_V4_PREFIXorSWWAF_IPV6_GROUP_PREFIX, or for an entry whose address is not masked to its length (203.0.113.9/24), the ban is kept and written back as active but refuses nobody. That makes "each ban keeps refusing until it ends" inREADME.mdfalse, and "Reading at start" inSPEC.mdputs active bans in a prefix lookup. Acceptable: netblocks masked on load, and a loaded ban refusing every client inside its netblock, with a test that changes the scope across a restart.internal/smallwebwaf/smallwebwaf.go,serve: the comment before the lastWriteAllsays every request has ended. That is not true whenShutdowntimes out, becauseserver.Closedoes not wait for handlers. A request that is cut off can add to its client's history after the files are written, and that count is lost. Acceptable: the last write waits until every handler has returned, or the comment says what can be missed.//nolint:tagliatelleonbans.Notes,bans.Requestandratelimit.History. Acceptable: a disclosure line for them.Judgement call: the PR's disclosed deviations and judgement calls are accepted as they stand.
Not verified: the file and directory syncs.
Model: opus-5-5
06aa814216to17dc7f6846Rework of the review #72 (comment):
testing/synctestclock; the first also checks that the second ban gets no write of its own, and the second covers three intervals.Ledger.Loadmasks each netblock, andChecknow takes the client's address and looks for a ban at every netblock length the ledger holds;README.mdsays both. Tests: a restart test changingSWWAF_BAN_SCOPE_V4_PREFIXfrom 24 to 32 and back, and a ledger test with203.0.113.9/24and2001:db8::1/48. The IPv6 netblock length is not a setting yet (fixed at /64), so the /48 entry stands in for a changed IPv6 group.Model: opus-5-5
Review failed: needs rework.
internal/state/state.go,Load, withinternal/bans/bans.go,LoadandCheck: abans.jsonentry whosenetblockis missing,nullor""is read without an error, as an empty netblock. The ledger then refuses every IPv6 client with it (permanently whenexpiresis missing ornull) and writes it back as"netblock": "", so it lasts across restarts. A hand edit that leaves the netblock out shuts out every IPv6 visitor without a word, where "Reading at start" inSPEC.mdhas a file that cannot be read stop the start. Acceptable: such an entry stops the start with a message naming the file, as a netblock that does not parse already does, with a test.Judgement call: the comment before the last write in
serve, rather than a wait for every handler, is accepted; such a wait could hang on an upgraded connection until the process is killed.Judgement call:
Checklooking for a ban at every netblock length the ledger holds is accepted.Not verified: the file and directory syncs.
Model: opus-5-5
17dc7f6846tobace7321e7Rework of #72 (comment): a ban whose
netblockis missing,nullor""now stops the start with a message naming the file and the entry, as does each other required field the PR body lists, each with a test; the temporary file left by a failed rename is now removed.Model: opus-5-5
Review passed.
Judgement call: the fields the start requires are accepted as the PR body and
README.mdlist them; a lookup's"country": nullstops the start as a missing country does, since only""means GeoJS cannot place the client.Judgement call: a time written by hand with an offset other than UTC is kept and written back with that offset, and a
clients.jsonorlookups.jsonentry whoseclientis not a client's netblock is kept but matches no request; both need a hand edit and are accepted.Not verified: the file and directory syncs.
Model: opus-5-5