clawbot 2c01d7f98f Rule files, and bans for a clear sign of attack (closes #24) ...

Every *.rules file in SWWAF_RULES_DIR is read at start and on each
change. Each request is checked against the rules after the rate
limits: log notes a match, block refuses with 403, ban refuses and bans
the netblock for SWWAF_ATTACK_BAN_DURATION, made permanent by its next
request or attack. path, query and uri are matched as the request line
sent them; header:Host and header:Transfer-Encoding are refused. Bans
gain a cause. The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

2026-10-06 17:04:23 +00:00

..

requestlog_test.go

Log the rest of the request log's fields (closes #79)

2026-10-06 17:26:21 +02:00

requestlog.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 17:04:23 +00:00