clawbot c58daa4c29 Rule files, and bans for a clear sign of attack (closes #24) ...

Every *.rules file in SWWAF_RULES_DIR is read at start and again when
one changes, and each request is checked against the rules after the
rate limits: log notes a match, block refuses with 403, ban refuses and
bans the netblock for SWWAF_ATTACK_BAN_DURATION, made permanent by its
next request or its next clear sign of attack. bans.json gains each
ban's cause, the request log rule_ids and rule_blocked, the metrics
rule matches and rules loaded. The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

2026-10-06 13:32:31 +00:00

..

admin.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00

bans_test.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

bans.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

bodies.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00

client_test.go

Re-vendor the canonical files from sneak/prompts at dd4027b (closes #65)

2026-10-06 04:13:35 +02:00

client.go

Per-client request rate limits over a minute, an hour and a day (closes #43)

2026-10-04 04:24:34 +02:00

countries_test.go

Network lists: always allowed, exempt from rate limits, always refused (closes #19)

2026-10-06 02:36:27 +02:00

countries.go

Network lists: always allowed, exempt from rate limits, always refused (closes #19)

2026-10-06 02:36:27 +02:00

health_test.go

The image apps build FROM, with its health check (closes #45)

2026-10-04 10:05:30 +02:00

history_test.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00

limits_test.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00

metrics_test.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00

observe_test.go

Observe mode: log what would be refused, refuse nothing (closes #78)

2026-10-06 13:04:43 +02:00

passthrough_test.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

proxy_test.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

proxy.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

ratelimits_test.go

Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

2026-10-06 05:29:03 +02:00

request.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

rulefiles_test.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

rules.go

Rule files, and bans for a clear sign of attack (closes #24)

2026-10-06 13:32:31 +00:00

staticlists_test.go

Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

2026-10-06 05:29:03 +02:00

timeouts_test.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00