clawbot f29ae55173 The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25) ...

Coraza v3.8.1 runs the Core Rule Set 4.25.0 (coraza-coreruleset v4.25.0)
after the rule files, with the six changes and the default
SWWAF_WAF_DISABLED_RULES that SPEC.md gives; no body, no response.
SWWAF_WAF_MODE, SWWAF_WAF_PARANOIA_LEVEL, SWWAF_WAF_ANOMALY_THRESHOLD and
SWWAF_WAF_EXEMPT_PATHS as specified; SWWAF_WAF_DISABLED_RULES refuses
900000 to 900999, smallwebwaf's own rules among them. A request with more
query parameters than Coraza reads, 1000, adds 5 (rule 900300). In block
mode a match is refused with 403, an offence counted toward the error
burst; in detect mode it is let through. Both log waf_rule_ids, waf_score
and duration_waf, raise waf_block, and count
smallwebwaf_waf_matches_total.

Judgement call: waf_block is raised in block mode too.
Deviation: no engine-error path; with no body read, Coraza cannot fail.

Model: opus-5-5

2026-10-08 06:59:51 +00:00

..

alerts

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 06:59:51 +00:00

anomaly

Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

2026-10-08 02:14:12 +02:00

bans

Trap paths, and the error burst banning a client refused too often (closes #115)

2026-10-08 06:44:55 +02:00

config

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 06:59:51 +00:00

lookup

Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

2026-10-08 02:14:12 +02:00

metrics

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 06:59:51 +00:00

proxy

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 06:59:51 +00:00

ratelimit

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 06:59:51 +00:00

remotelog

Send every log line to a syslog server as well (closes #28)

2026-10-06 22:02:36 +02:00

reputation

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

requestlog

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 06:59:51 +00:00

rules

Trap paths, and the error burst banning a client refused too often (closes #115)

2026-10-08 06:44:55 +02:00

smallwebwaf

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

state

Trap paths, and the error burst banning a client refused too often (closes #115)

2026-10-08 06:44:55 +02:00

waf

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 06:59:51 +00:00