clawbot c6070bf792 Network lists: always allowed, exempt from rate limits, always refused (closes #19) ...

Adds SWWAF_ALLOW_NETS, SWWAF_RATE_LIMIT_EXEMPT_NETS and SWWAF_DENY_NETS,
read like SWWAF_TRUSTED_PROXIES and empty by default, and checked against
the client's own address before its country is looked up. A client in
SWWAF_ALLOW_NETS skips the country lists and the rate limits and is not
looked up. One in SWWAF_DENY_NETS is refused with 403, logged as denied
and not counted. One in SWWAF_RATE_LIMIT_EXEMPT_NETS is neither counted
nor refused by the rate limits. SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES now
refuses a private, loopback or link-local client unless SWWAF_ALLOW_NETS
lists it.

Judgement call: an address in both SWWAF_ALLOW_NETS and SWWAF_DENY_NETS is let through.
Judgement call: the size and time limits still apply to SWWAF_ALLOW_NETS.

Model: opus-5-5

2026-10-05 23:36:03 +00:00

..

config

Network lists: always allowed, exempt from rate limits, always refused (closes #19)

2026-10-05 23:36:03 +00:00

lookup

Country allow and deny lists, looked up through GeoJS (closes #44)

2026-10-04 08:29:41 +02:00

proxy

Network lists: always allowed, exempt from rate limits, always refused (closes #19)

2026-10-05 23:36:03 +00:00

ratelimit

Per-client request rate limits over a minute, an hour and a day (closes #43)

2026-10-04 04:24:34 +02:00

requestlog

Network lists: always allowed, exempt from rate limits, always refused (closes #19)

2026-10-05 23:36:03 +00:00

smallwebwaf

Network lists: always allowed, exempt from rate limits, always refused (closes #19)

2026-10-05 23:36:03 +00:00