clawbot ddb95f5411 DNS blocklists asked in the background, verdicts kept (closes #104) ...

Zones in SWWAF_DNSBL_ZONES are asked about each client (RFC 5782 names)
in the background, through the host's resolver or SWWAF_DNSBL_RESOLVER;
no request waits. Verdicts last SWWAF_REPUTATION_CACHE_TTL and are kept
in reputation.json, at most 100,000. After the blocklists,
SWWAF_REPUTATION_ACTION (limit:25) denies, limits or logs a listed
client; the log line names the zones, each raises reputation_hit, with
metrics by zone. A failed, timed-out or refused query gives no verdict,
raises source_failure, and pauses the zone a minute.

Judgement call: answers in 127.255.255.0/24 or outside 127.0.0.0/8 are failures.
Judgement call: the minute's pause after a failure; at most 1,000 queries at once.
Rule suppressed: paralleltest on the DNSBL tests (Go's resolver shares state across synctest bubbles), funlen on the test of every logged setting.

Model: opus-5-5

2026-10-07 18:00:50 +00:00

..

admin_test.go

Admin endpoints for bans and clients on the single listener (closes #27)

2026-10-07 01:13:16 +02:00

admin.go

Admin endpoints for bans and clients on the single listener (closes #27)

2026-10-07 01:13:16 +02:00

alerts_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

anomaly_internal_test.go

Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

2026-10-07 16:12:19 +02:00

anomaly_test.go

Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

2026-10-07 16:12:19 +02:00

bans_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

bans.go

Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

2026-10-07 16:12:19 +02:00

biased_test.go

Blocklists and an AS percentage file fetched by URL (closes #29)

2026-10-07 19:09:41 +02:00

biased.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

bodies.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

bytelimits_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

client_test.go

Log the rest of the request log's fields (closes #79)

2026-10-06 17:26:21 +02:00

client.go

Log the rest of the request log's fields (closes #79)

2026-10-06 17:26:21 +02:00

countries_test.go

AS number and country looked up for every client (closes #95)

2026-10-07 08:46:01 +02:00

countries.go

AS number and country looked up for every client (closes #95)

2026-10-07 08:46:01 +02:00

health_test.go

Log the rest of the request log's fields (closes #79)

2026-10-06 17:26:21 +02:00

history_test.go

AS number and country looked up for every client (closes #95)

2026-10-07 08:46:01 +02:00

limits_test.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00

lookup_test.go

Lower limits for listed AS numbers and countries (closes #21)

2026-10-07 14:22:01 +02:00

lookup.go

Lower limits for listed AS numbers and countries (closes #21)

2026-10-07 14:22:01 +02:00

metrics_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

observe_test.go

Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept (closes #86)

2026-10-06 23:09:52 +02:00

passthrough_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

proxy_test.go

Lower limits for listed AS numbers and countries (closes #21)

2026-10-07 14:22:01 +02:00

proxy.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

ratelimits_test.go

AS number and country looked up for every client (closes #95)

2026-10-07 08:46:01 +02:00

reputation_test.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

reputation.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

request.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

requestlog_test.go

Byte limits per client over a minute, an hour and a day (closes #20)

2026-10-07 13:13:06 +02:00

rulefiles_test.go

Instance name on process log lines and every metric (closes #91)

2026-10-07 06:48:09 +02:00

rules.go

Alerts to a JSON webhook, with a cooldown and an hourly summary (closes #26)

2026-10-07 04:21:24 +02:00

staticlists_test.go

Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

2026-10-06 05:29:03 +02:00

timeouts_test.go

Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

2026-10-06 11:40:27 +02:00