roster-server 2.4.6 → 2.4.10

package/README.md

@@ -11,6 +11,7 @@ Welcome to **RosterServer**, the ultimate domain host router with automatic HTTP
 - **Static Sites**: No code? No problem. Drop a folder with `index.html` (and assets) and RosterServer serves it automatically—modular static handler with path-traversal protection and strict 404s.
 - **Virtual Hosting**: Serve multiple domains from a single server.
 - **Automatic Redirects**: Redirect `www` subdomains to the root domain.
+- **Optional Request Plugins**: Run synchronous filters before site handlers, including the bundled scanner blocker.
 - **Zero Configuration**: Well, almost zero. Just a tiny bit of setup.
 - **Bun compatible**: Works with both Node.js and [Bun](https://bun.sh).
 
@@ -114,6 +115,29 @@ const server = new Roster(options);
 server.start();
 ```
 
+### Blocking vulnerability scanners
+
+RosterServer includes an optional request plugin that rejects common PHP, WordPress, repository, and sensitive-file probes before they reach a site handler. Suspicious paths always receive a `404`; after the configured number of strikes, every request from that client is rejected until the ban expires.
+
+```javascript
+import Roster from 'roster-server';
+import { createScannerBlocker } from 'roster-server/plugins/scanner-blocker.js';
+
+const roster = new Roster(options);
+
+roster.use(createScannerBlocker({
+    onBlock(event) {
+        // Send event to the application's existing logger if desired.
+    }
+}));
+
+roster.start();
+```
+
+By default, the plugin uses a 60-second strike window, 3 strikes, a 15-minute ban, tracks up to 10,000 clients, and does not trust proxy headers. Pass only the values you need to override. Keep `trustProxy: false` when RosterServer receives traffic directly. Set it to `true` only when a trusted reverse proxy overwrites `X-Forwarded-For`; otherwise clients can spoof the address used for bans.
+
+The in-memory strike and ban state is bounded by `maxTrackedClients`, belongs to one RosterServer process, and is cleared on restart. Use the optional `onBlock(event)` callback to feed a shared firewall or Fail2ban when bans must persist or span multiple workers. Routes such as `/atom` and `/articles/config` are not classified as scanner probes.
+
 ### Your Site Handlers
 
 Each domain has its own folder under `www`. You can use:
@@ -426,6 +450,10 @@ Loads sites, generates SSL config (production), creates VirtualServers and initi
 
 Returns the Host-header dispatch function for a given port (defaults to `defaultPort`). Handles www→non-www redirects, wildcard matching, and VirtualServer dispatch.
 
+#### `roster.use(plugin)` → `Roster`
+
+Registers a synchronous request plugin and returns `this`. Plugins receive `(req, res, { host, domain })`; return `true` after sending a response to stop dispatch, or `false`/`undefined` to continue. Plugins run in registration order before redirects and site handlers.
+
 #### `roster.upgradeHandler(port?)` → `(req, socket, head) => void`
 
 Returns the WebSocket upgrade dispatcher for a given port. Routes upgrades to the correct VirtualServer.
@@ -493,4 +521,4 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ---
 
-Happy hosting! 🎈
+Happy hosting! 🎈

package/index.js

@@ -247,6 +247,7 @@ class Roster {
         this.local = options.local || false;
         this.domains = [];
         this.sites = {};
+        this.plugins = [];
         this.wildcardZones = new Set(); // Root domains that have a wildcard site (e.g. "example.com" for *.example.com)
         this.domainServers = {}; // Store separate servers for each domain
         this.portServers = {}; // Store servers by port
@@ -540,6 +541,11 @@ class Roster {
 
     handleRequest(req, res) {
         const host = req.headers.host || '';
+        const hostWithoutPort = host.split(':')[0];
+        const normalizedHost = hostWithoutPort.toLowerCase();
+        const domain = normalizedHost.startsWith('www.') ? normalizedHost.slice(4) : normalizedHost;
+
+        if (this._runRequestPlugins(req, res, { host: normalizedHost, domain })) return;
 
         if (host.startsWith('www.')) {
             const newHost = host.slice(4);
@@ -548,7 +554,6 @@ class Roster {
             return;
         }
 
-        const hostWithoutPort = host.split(':')[0];
         const siteApp = this.getHandlerForHost(hostWithoutPort);
         if (siteApp) {
             siteApp(req, res);
@@ -597,6 +602,25 @@ class Roster {
         return this;
     }
 
+    use(plugin) {
+        if (typeof plugin !== 'function') {
+            throw new Error('plugin must be a function');
+        }
+        this.plugins.push(plugin);
+        return this;
+    }
+
+    _runRequestPlugins(req, res, context) {
+        for (const plugin of this.plugins) {
+            const handled = plugin(req, res, context);
+            if (handled && typeof handled.then === 'function') {
+                throw new Error('Request plugins must be synchronous');
+            }
+            if (handled === true) return true;
+        }
+        return false;
+    }
+
     parseDomainWithPort(domainString) {
         const parts = domainString.split(':');
         if (parts.length === 2) {
@@ -737,6 +761,8 @@ class Roster {
             const hostWithoutPort = host.split(':')[0].toLowerCase();
             const domain = hostWithoutPort.startsWith('www.') ? hostWithoutPort.slice(4) : hostWithoutPort;
 
+            if (this._runRequestPlugins(req, res, { host: hostWithoutPort, domain })) return;
+
             if (hostWithoutPort.startsWith('www.')) {
                 const protocol = this.local ? 'http' : 'https';
                 res.writeHead(301, { Location: `${protocol}://${domain}${req.url}` });
@@ -1062,6 +1088,8 @@ class Roster {
                 const appHandler = portData.appHandlers[domain];
 
                 const dispatcher = (req, res) => {
+                    const host = (req.headers.host || '').split(':')[0].toLowerCase();
+                    if (this._runRequestPlugins(req, res, { host, domain })) return;
                     virtualServer.fallbackHandler = appHandler;
                     if (virtualServer.requestListeners.length > 0) {
                         virtualServer.processRequest(req, res);
@@ -1321,4 +1349,4 @@ module.exports.wildcardRoot = wildcardRoot;
 module.exports.hostMatchesWildcard = hostMatchesWildcard;
 module.exports.wildcardSubjectForHost = wildcardSubjectForHost;
 module.exports.buildCertLookupCandidates = buildCertLookupCandidates;
-module.exports.certCoversName = certCoversName;
+module.exports.certCoversName = certCoversName;

package/package.json

@@ -1,53 +1,53 @@
 {
-    "name": "roster-server",
-    "version": "2.4.6",
-    "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
-    "main": "index.js",
-    "scripts": {
-        "test": "node --test 'test/**/*.test.js'"
-    },
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/clasen/RosterServer.git"
-    },
-    "keywords": [
-        "greenlock",
-        "https",
-        "domain",
-        "multi-domain",
-        "letsencrypt",
-        "hosting",
-        "ssl",
-        "host",
-        "vhost",
-        "virtual-host",
-        "socket.io",
-        "websocket",
-        "express",
-        "greenlock-express",
-        "shotx",
-        "bun",
-        "clasen"
-    ],
-    "author": "Martin Clasen",
-    "license": "MIT",
-    "bugs": {
-        "url": "https://github.com/clasen/RosterServer/issues"
-    },
-    "homepage": "https://github.com/clasen/RosterServer#readme",
-    "dependencies": {
-        "@greenlock/manager": "^3.1.0",
-        "@root/acme": "^3.1.0",
-        "@root/csr": "^0.8.1",
-        "@root/keypairs": "^0.10.0",
-        "@root/mkdirp": "^1.0.0",
-        "@root/request": "^1.6.1",
-        "acme-dns-01-cli": "^3.0.7",
-        "acme-http-01-standalone": "^3.0.5",
-        "cert-info": "^1.5.1",
-        "greenlock-store-fs": "^3.2.2",
-        "lemonlog": "^1.2.0",
-        "redirect-https": "^1.3.1",
-        "safe-replace": "^1.1.0"
-    }
-}
+  "name": "roster-server",
+  "version": "2.4.10",
+  "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
+  "main": "index.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/clasen/RosterServer.git"
+  },
+  "keywords": [
+    "greenlock",
+    "https",
+    "domain",
+    "multi-domain",
+    "letsencrypt",
+    "hosting",
+    "ssl",
+    "host",
+    "vhost",
+    "virtual-host",
+    "socket.io",
+    "websocket",
+    "express",
+    "greenlock-express",
+    "shotx",
+    "bun",
+    "clasen"
+  ],
+  "author": "Martin Clasen",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/clasen/RosterServer/issues"
+  },
+  "homepage": "https://github.com/clasen/RosterServer#readme",
+  "dependencies": {
+    "@greenlock/manager": "^3.1.0",
+    "@root/acme": "^3.1.0",
+    "@root/csr": "^0.8.1",
+    "@root/keypairs": "^0.10.0",
+    "@root/mkdirp": "^1.0.0",
+    "@root/request": "^1.6.1",
+    "acme-dns-01-cli": "^3.0.7",
+    "acme-http-01-standalone": "^3.0.5",
+    "cert-info": "^1.5.1",
+    "greenlock-store-fs": "^3.2.2",
+    "lemonlog": "^1.2.0",
+    "redirect-https": "^1.3.1",
+    "safe-replace": "^1.1.0"
+  },
+  "scripts": {
+    "test": "node --test 'test/**/*.test.js'"
+  }
+}

package/plugins/scanner-blocker.js

@@ -0,0 +1,169 @@
+'use strict';
+
+const PHP_PATH = /(?:^|\/)[^/]*\.php(?:$|\/)/i;
+const SCANNER_PATH = /(?:^|\/)(?:\.git|\.hg|\.svn|\.ssh|\.aws|cgi-bin|server-status|vendor\/phpunit|wp-admin|wp-content|wp-includes|wp-json)(?:\/|$)/i;
+const SCANNER_FILE = /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.htaccess|composer\.(?:json|lock)|web\.config)(?:\/|$)/i;
+
+function requirePositiveInteger(options, name) {
+    const value = options[name];
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${name} must be a positive integer`);
+    }
+    return value;
+}
+
+function normalizeRequestPath(url) {
+    let requestPath = String(url || '/').split(/[?#]/, 1)[0];
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            const decoded = decodeURIComponent(requestPath);
+            if (decoded === requestPath) break;
+            requestPath = decoded;
+        } catch {
+            break;
+        }
+    }
+    return requestPath.replace(/\\/g, '/').replace(/\/+/g, '/').toLowerCase();
+}
+
+function scannerReason(url) {
+    const requestPath = normalizeRequestPath(url);
+    if (PHP_PATH.test(requestPath)) return 'php-path';
+    if (SCANNER_PATH.test(requestPath)) return 'scanner-path';
+    if (SCANNER_FILE.test(requestPath)) return 'sensitive-file';
+    return null;
+}
+
+function normalizeIp(value) {
+    const ip = String(value || '').trim();
+    return ip.startsWith('::ffff:') ? ip.slice(7) : ip;
+}
+
+function clientIp(req, trustProxy) {
+    if (trustProxy) {
+        const forwardedFor = req.headers?.['x-forwarded-for'];
+        const firstForwardedIp = Array.isArray(forwardedFor)
+            ? forwardedFor[0]
+            : String(forwardedFor || '').split(',')[0];
+        const normalizedForwardedIp = normalizeIp(firstForwardedIp);
+        if (normalizedForwardedIp) return normalizedForwardedIp;
+    }
+    return normalizeIp(req.socket?.remoteAddress);
+}
+
+function rejectRequest(req, res) {
+    const body = 'Not Found';
+    res.writeHead(404, {
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Content-Length': Buffer.byteLength(body),
+        'Cache-Control': 'no-store'
+    });
+    res.end(req.method === 'HEAD' ? undefined : body);
+}
+
+function createScannerBlocker(options = {}) {
+    if (!options || typeof options !== 'object') {
+        throw new Error('scanner-blocker options must be an object');
+    }
+
+    const {
+        windowMs = 60_000,
+        strikeThreshold = 3,
+        banDurationMs = 15 * 60_000,
+        maxTrackedClients = 10_000,
+        trustProxy = false,
+        onBlock,
+        now
+    } = options;
+    const normalizedOptions = { windowMs, strikeThreshold, banDurationMs, maxTrackedClients };
+    requirePositiveInteger(normalizedOptions, 'windowMs');
+    requirePositiveInteger(normalizedOptions, 'strikeThreshold');
+    requirePositiveInteger(normalizedOptions, 'banDurationMs');
+    requirePositiveInteger(normalizedOptions, 'maxTrackedClients');
+    if (typeof trustProxy !== 'boolean') {
+        throw new Error('trustProxy must be a boolean');
+    }
+    if (onBlock !== undefined && typeof onBlock !== 'function') {
+        throw new Error('onBlock must be a function');
+    }
+    if (now !== undefined && typeof now !== 'function') {
+        throw new Error('now must be a function');
+    }
+
+    const clock = now || Date.now;
+    const clients = new Map();
+
+    function removeExpiredClients(timestamp) {
+        for (const [ip, state] of clients) {
+            const banExpired = state.bannedUntil !== null && timestamp >= state.bannedUntil;
+            const windowExpired = state.bannedUntil === null && timestamp - state.windowStartedAt >= windowMs;
+            if (banExpired || windowExpired) clients.delete(ip);
+        }
+    }
+
+    function addClient(ip, state, timestamp) {
+        if (!clients.has(ip) && clients.size >= maxTrackedClients) {
+            removeExpiredClients(timestamp);
+        }
+        if (!clients.has(ip) && clients.size >= maxTrackedClients) {
+            clients.delete(clients.keys().next().value);
+        }
+        clients.delete(ip);
+        clients.set(ip, state);
+    }
+
+    function reportBlock(details) {
+        if (onBlock) onBlock(details);
+    }
+
+    return function scannerBlocker(req, res, context = {}) {
+        const timestamp = clock();
+        const ip = clientIp(req, trustProxy);
+        let state = ip ? clients.get(ip) : null;
+
+        if (state && state.bannedUntil !== null) {
+            if (timestamp < state.bannedUntil) {
+                rejectRequest(req, res);
+                reportBlock({
+                    type: 'banned-client',
+                    clientIp: ip,
+                    host: context.host || '',
+                    url: req.url || '/',
+                    bannedUntil: state.bannedUntil
+                });
+                return true;
+            }
+            clients.delete(ip);
+            state = null;
+        }
+
+        const reason = scannerReason(req.url);
+        if (!reason) return false;
+
+        let bannedUntil = null;
+        if (ip) {
+            if (!state || timestamp - state.windowStartedAt >= windowMs) {
+                state = { strikes: 0, windowStartedAt: timestamp, bannedUntil: null };
+            }
+            state.strikes += 1;
+            if (state.strikes >= strikeThreshold) {
+                state.bannedUntil = timestamp + banDurationMs;
+            }
+            bannedUntil = state.bannedUntil;
+            addClient(ip, state, timestamp);
+        }
+
+        rejectRequest(req, res);
+        reportBlock({
+            type: 'scanner-path',
+            reason,
+            clientIp: ip,
+            host: context.host || '',
+            url: req.url || '/',
+            bannedUntil
+        });
+        return true;
+    };
+}
+
+module.exports = { createScannerBlocker };

package/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+allowBuilds:
+  '@root/acme': true

package/skills/roster-server/SKILL.md

@@ -172,6 +172,18 @@ const httpsServer = await worker.createServingHttpsServer({ servername: 'example
 httpsServer.listen(4336);
 ```
 
+### Pattern 8: Optional Scanner Blocking
+```javascript
+const Roster = require('roster-server');
+const { createScannerBlocker } = require('roster-server/plugins/scanner-blocker.js');
+
+const roster = new Roster({ local: true, wwwPath: './www' });
+roster.use(createScannerBlocker());
+roster.start();
+```
+
+The plugin blocks common PHP, WordPress, repository, and sensitive-file probes before site handlers. Defaults are a 60-second window, 3 strikes, a 15-minute ban, 10,000 tracked clients, and `trustProxy: false`; pass only the values to override. Set `trustProxy: true` only behind a trusted reverse proxy that overwrites `X-Forwarded-For`. Ban state is per process and in memory; use `onBlock` to integrate a shared firewall or Fail2ban.
+
 ## Key Configuration Options
 
 ```javascript
@@ -234,6 +246,9 @@ Convenience: wires `requestHandler` + `upgradeHandler` onto an external `http.Se
 ### `roster.register(domain, handler)`
 Manually register a domain handler. Domain can include port: `'api.com:8443'`. For wildcards use `'*.example.com'` or `'*.example.com:8080'`.
 
+### `roster.use(plugin)`
+Registers a synchronous request plugin. It receives `(req, res, { host, domain })` and stops dispatch when it returns `true`.
+
 ### `roster.getUrl(domain)`
 Get environment-aware URL:
 - Local mode: `http://localhost:{port}`

package/test/roster-server.test.js

@@ -7,6 +7,7 @@ const fs = require('fs');
 const http = require('http');
 const os = require('os');
 const Roster = require('../index.js');
+const { createScannerBlocker } = require('../plugins/scanner-blocker.js');
 const {
     wildcardRoot,
     hostMatchesWildcard,
@@ -432,6 +433,13 @@ describe('Roster local mode (local: true)', () => {
             hostname: 'localhost'
         });
         const body = 'local-mode-ok';
+        roster.use(createScannerBlocker({
+            windowMs: 60_000,
+            strikeThreshold: 2,
+            banDurationMs: 300_000,
+            maxTrackedClients: 100,
+            trustProxy: false
+        }));
         roster.register('testlocal.example', (server) => {
             return (req, res) => {
                 res.writeHead(200, { 'Content-Type': 'text/plain' });
@@ -446,6 +454,9 @@ describe('Roster local mode (local: true)', () => {
             const result = await httpGet('localhost', port, '/');
             assert.strictEqual(result.statusCode, 200);
             assert.strictEqual(result.body, body);
+            const probe = await httpGet('localhost', port, '/wp-login.php');
+            assert.strictEqual(probe.statusCode, 404);
+            assert.strictEqual(probe.body, 'Not Found');
         } finally {
             closePortServers(roster);
         }

package/test/scanner-blocker.test.js

@@ -0,0 +1,199 @@
+'use strict';
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const Roster = require('../index.js');
+const { createScannerBlocker } = require('../plugins/scanner-blocker.js');
+
+function invoke(plugin, { url = '/', ip = '192.0.2.10', headers = {}, method = 'GET' } = {}) {
+    let statusCode;
+    let responseHeaders;
+    let body;
+    const req = {
+        method,
+        url,
+        headers,
+        socket: { remoteAddress: ip }
+    };
+    const res = {
+        writeHead(code, nextHeaders) {
+            statusCode = code;
+            responseHeaders = nextHeaders;
+        },
+        end(nextBody) {
+            body = nextBody;
+        }
+    };
+    const handled = plugin(req, res, { host: 'example.com', domain: 'example.com' });
+    return { handled, statusCode, responseHeaders, body };
+}
+
+function blocker(overrides = {}) {
+    return createScannerBlocker({
+        windowMs: 60_000,
+        strikeThreshold: 2,
+        banDurationMs: 300_000,
+        maxTrackedClients: 100,
+        trustProxy: false,
+        ...overrides
+    });
+}
+
+describe('scanner-blocker plugin', () => {
+    it('uses documented defaults and permits individual overrides', () => {
+        const plugin = createScannerBlocker();
+        invoke(plugin, { url: '/wp-login.php' });
+        invoke(plugin, { url: '/xmlrpc.php' });
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, false);
+        invoke(plugin, { url: '/install.php' });
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, true);
+
+        const overriddenPlugin = createScannerBlocker({ strikeThreshold: 1 });
+        invoke(overriddenPlugin, { url: '/wp-login.php' });
+        assert.strictEqual(invoke(overriddenPlugin, { url: '/ordinary' }).handled, true);
+
+        assert.throws(() => createScannerBlocker(null), /options must be an object/);
+        assert.throws(() => blocker({ trustProxy: 'false' }), /trustProxy/);
+        assert.throws(() => blocker({ maxTrackedClients: 0 }), /maxTrackedClients/);
+    });
+
+    it('blocks PHP, WordPress, and sensitive-file probes', () => {
+        const urls = [
+            '/install.php',
+            '/user-new\\.php',
+            '/wp-json',
+            '/.git/config',
+            '/%252eenv'
+        ];
+
+        for (const [index, url] of urls.entries()) {
+            const result = invoke(blocker(), { url, ip: `192.0.2.${index + 1}` });
+            assert.strictEqual(result.handled, true, url);
+            assert.strictEqual(result.statusCode, 404, url);
+            assert.strictEqual(result.body, 'Not Found', url);
+            assert.strictEqual(result.responseHeaders['Cache-Control'], 'no-store');
+        }
+    });
+
+    it('does not classify ordinary article, atom, or config routes as scanner probes', () => {
+        const plugin = blocker();
+        assert.strictEqual(invoke(plugin, { url: '/en/an-article' }).handled, false);
+        assert.strictEqual(invoke(plugin, { url: '/atom' }).handled, false);
+        assert.strictEqual(invoke(plugin, { url: '/articles/config' }).handled, false);
+    });
+
+    it('bans a client after the configured number of probes', () => {
+        const timestamp = 1_000;
+        const events = [];
+        const plugin = blocker({
+            now: () => timestamp,
+            onBlock: event => events.push(event)
+        });
+
+        assert.strictEqual(invoke(plugin, { url: '/wp-login.php' }).handled, true);
+        assert.strictEqual(invoke(plugin, { url: '/xmlrpc.php' }).handled, true);
+        assert.strictEqual(invoke(plugin, { url: '/legitimate-page' }).handled, true);
+        assert.strictEqual(events[1].bannedUntil, 301_000);
+        assert.strictEqual(events[2].type, 'banned-client');
+
+        assert.strictEqual(invoke(plugin, { url: '/legitimate-page', ip: '192.0.2.11' }).handled, false);
+    });
+
+    it('expires bans without extending them on blocked requests', () => {
+        let timestamp = 1_000;
+        const events = [];
+        const plugin = blocker({
+            strikeThreshold: 1,
+            banDurationMs: 5_000,
+            now: () => timestamp,
+            onBlock: event => events.push(event)
+        });
+
+        invoke(plugin, { url: '/wp-login.php' });
+        assert.strictEqual(events[0].bannedUntil, 6_000);
+        timestamp = 5_999;
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, true);
+        timestamp = 6_000;
+        assert.strictEqual(invoke(plugin, { url: '/ordinary' }).handled, false);
+    });
+
+    it('trusts X-Forwarded-For only when explicitly configured', () => {
+        const headers = { 'x-forwarded-for': '198.51.100.1, 198.51.100.2' };
+        const directPlugin = blocker({ strikeThreshold: 1, trustProxy: false });
+        invoke(directPlugin, { url: '/install.php', headers, ip: '192.0.2.20' });
+        assert.strictEqual(invoke(directPlugin, { url: '/', headers, ip: '192.0.2.20' }).handled, true);
+        assert.strictEqual(invoke(directPlugin, { url: '/', headers, ip: '192.0.2.21' }).handled, false);
+
+        const proxyPlugin = blocker({ strikeThreshold: 1, trustProxy: true });
+        invoke(proxyPlugin, { url: '/install.php', headers, ip: '192.0.2.20' });
+        assert.strictEqual(invoke(proxyPlugin, { url: '/', headers, ip: '192.0.2.21' }).handled, true);
+    });
+
+    it('keeps tracked client state within the configured bound', () => {
+        const plugin = blocker({ maxTrackedClients: 1 });
+        invoke(plugin, { url: '/install.php', ip: '192.0.2.30' });
+        invoke(plugin, { url: '/install.php', ip: '192.0.2.31' });
+        invoke(plugin, { url: '/xmlrpc.php', ip: '192.0.2.30' });
+        assert.strictEqual(invoke(plugin, { url: '/ordinary', ip: '192.0.2.30' }).handled, false);
+    });
+
+    it('does not send a response body for HEAD probes', () => {
+        const result = invoke(blocker(), { method: 'HEAD', url: '/wp-login.php' });
+        assert.strictEqual(result.handled, true);
+        assert.strictEqual(result.body, undefined);
+    });
+});
+
+describe('Roster request plugins', () => {
+    it('runs plugins before dispatching to the site handler', async () => {
+        let siteRequests = 0;
+        const roster = new Roster({ local: true });
+        roster.use(createScannerBlocker({
+            windowMs: 60_000,
+            strikeThreshold: 2,
+            banDurationMs: 300_000,
+            maxTrackedClients: 100,
+            trustProxy: false
+        }));
+        roster.register('example.com', () => (req, res) => {
+            siteRequests += 1;
+            res.writeHead(200);
+            res.end('site');
+        });
+        await roster.init();
+
+        const handler = roster.requestHandler();
+        const probe = invoke(handler, {
+            url: '/wp-login.php',
+            headers: { host: 'example.com' }
+        });
+        assert.strictEqual(probe.statusCode, 404);
+        assert.strictEqual(siteRequests, 0);
+
+        const ordinary = invoke(handler, {
+            url: '/ordinary',
+            ip: '192.0.2.11',
+            headers: { host: 'example.com' }
+        });
+        assert.strictEqual(ordinary.statusCode, 200);
+        assert.strictEqual(ordinary.body, 'site');
+        assert.strictEqual(siteRequests, 1);
+    });
+
+    it('validates plugins and rejects asynchronous request plugins', async () => {
+        const roster = new Roster({ local: true });
+        assert.throws(() => roster.use({}), /plugin must be a function/);
+        assert.strictEqual(roster.use(() => false), roster);
+
+        const asyncRoster = new Roster({ local: true });
+        asyncRoster.use(async () => false);
+        asyncRoster.register('example.com', () => () => {});
+        await asyncRoster.init();
+        assert.throws(() => {
+            asyncRoster.requestHandler()(
+                { headers: { host: 'example.com' }, url: '/', socket: {} },
+                { writeHead() {}, end() {} }
+            );
+        }, /must be synchronous/);
+    });
+});

package/.greenlockrc

@@ -1 +0,0 @@
-{"configDir":"/Users/martinclasen/Stuff/greenlock.d"}