clawbot ddb95f5411 DNS blocklists asked in the background, verdicts kept (closes #104) ...

Zones in SWWAF_DNSBL_ZONES are asked about each client (RFC 5782 names)
in the background, through the host's resolver or SWWAF_DNSBL_RESOLVER;
no request waits. Verdicts last SWWAF_REPUTATION_CACHE_TTL and are kept
in reputation.json, at most 100,000. After the blocklists,
SWWAF_REPUTATION_ACTION (limit:25) denies, limits or logs a listed
client; the log line names the zones, each raises reputation_hit, with
metrics by zone. A failed, timed-out or refused query gives no verdict,
raises source_failure, and pauses the zone a minute.

Judgement call: answers in 127.255.255.0/24 or outside 127.0.0.0/8 are failures.
Judgement call: the minute's pause after a failure; at most 1,000 queries at once.
Rule suppressed: paralleltest on the DNSBL tests (Go's resolver shares state across synctest bubbles), funlen on the test of every logged setting.

Model: opus-5-5

2026-10-07 18:00:50 +00:00

..

dnsbl_test.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

dnsbl.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

export_test.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00

reputation_test.go

Blocklists and an AS percentage file fetched by URL (closes #29)

2026-10-07 19:09:41 +02:00

reputation.go

DNS blocklists asked in the background, verdicts kept (closes #104)

2026-10-07 18:00:50 +00:00