clawbot 9c67b5b837 Country allow and deny lists, looked up through GeoJS (closes #44) ...

SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a
request with 403 before its body is read and before the rate limits count
it, logged as country_denied; every log line gains country. The new
internal/lookup asks GeoJS only while a list is set, one request at a
time carrying up to 200 waiting clients, keeps answers 7 days (at most
100,000), and after a failure waits a second, doubling to five minutes.
Private, loopback and link-local clients have no country and are never
sent. Codes are checked with golang.org/x/text/language.

Deviation from SPEC.md, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE.
Deviation: GeoJS's country endpoint, not geo.json, since only the country is needed.
Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

2026-10-04 05:08:54 +00:00

..

bodies.go

Pass-through proxy with timeouts, size limits and a request log (closes #13)

2026-10-03 17:24:34 +02:00

client_test.go

Pass-through proxy with timeouts, size limits and a request log (closes #13)

2026-10-03 17:24:34 +02:00

client.go

Per-client request rate limits over a minute, an hour and a day (closes #43)

2026-10-04 04:24:34 +02:00

countries_test.go

Country allow and deny lists, looked up through GeoJS (closes #44)

2026-10-04 05:08:54 +00:00

countries.go

Country allow and deny lists, looked up through GeoJS (closes #44)

2026-10-04 05:08:54 +00:00

limits_test.go

Pass-through proxy with timeouts, size limits and a request log (closes #13)

2026-10-03 17:24:34 +02:00

passthrough_test.go

Point the unreachable-app test at port 1 (closes #51)

2026-10-04 06:39:07 +02:00

proxy_test.go

Country allow and deny lists, looked up through GeoJS (closes #44)

2026-10-04 05:08:54 +00:00

proxy.go

Country allow and deny lists, looked up through GeoJS (closes #44)

2026-10-04 05:08:54 +00:00

ratelimits_test.go

Per-client request rate limits over a minute, an hour and a day (closes #43)

2026-10-04 04:24:34 +02:00

request.go

Country allow and deny lists, looked up through GeoJS (closes #44)

2026-10-04 05:08:54 +00:00

timeouts_test.go

TestRequestTimeouts expects 504 when none of the body reached the app (closes #49)

2026-10-04 06:09:22 +02:00