Ban notes name the reputation sources that listed the client (closes #109)

A ban's notes, in bans.json and in its alert, gain `reputation`: each
blocklist, DNSBL zone or AbuseIPDB that listed the client when the ban
was made, as its `source`, named and ordered as in the request log's
`reputation`, with AbuseIPDB's `score`. It is left out when none did.
README.md shows it in a bans.json example.

Notes now hold a list, so bans can no longer be compared with ==: the
tests compare them with reflect.DeepEqual.

Judgement call: the score is a pointer, so a score of 0, a hit while
SWWAF_ABUSEIPDB_MIN_SCORE is 0, is still written.

Model: opus-5-5

internal/bans/admin_test.go

@@ -2,6 +2,7 @@ package bans_test
 
 import (
 	"net/netip"
+	"reflect"
 	"testing"
 	"time"
 
@@ -117,7 +118,7 @@ func TestLiftedBanForALimitRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 	}
 
 	held := ledger.Bans(netblock)
-	if len(held) != 2 || held[0] != lifted {
+	if len(held) != 2 || !reflect.DeepEqual(held[0], lifted) {
 		t.Errorf("the ledger holds %+v, want the lifted ban and the new one", held)
 	}
 }
@@ -212,7 +213,7 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 
 	got := ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.9/24"), now, time.Time{},
 		"probes for logins")
-	if got != want {
+	if !reflect.DeepEqual(got, want) {
 		t.Errorf("the admin's ban is\n%+v\nwant\n%+v", got, want)
 	}
 
@@ -224,7 +225,7 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 
 	// It refuses once the ban for the limit has ended.
 	ban, banned, _ := ledger.Find(netblock.Addr(), midnight().Add(2*time.Hour))
-	if !banned || ban != want {
+	if !banned || !reflect.DeepEqual(ban, want) {
 		t.Errorf("after the limit's ban the netblock is under %+v (%t), want %+v",
 			ban, banned, want)
 	}

internal/bans/bans.go

@@ -118,6 +118,10 @@ type Notes struct {
 	// of the rule file rule that matched, and its target.
 	RuleID string `json:"rule_id,omitempty"`
 	Target string `json:"target,omitempty"`
+	// Reputation is the reputation sources that listed the client when
+	// the request that caused the ban was made, in the order the request
+	// log's reputation names them. It is left out when none did.
+	Reputation []ReputationHit `json:"reputation,omitempty"`
 	// Request is the request that broke the limit, or whose bytes broke
 	// it, or that was the clear sign of attack.
 	Request Request `json:"request"`
@@ -131,6 +135,15 @@ type Notes struct {
 	EarlierBans EarlierBans `json:"earlier_bans"`
 }
 
+// ReputationHit is a reputation source that listed a client, as a
+// reputation_hit alert's detail gives it: Source is the blocklist's URL,
+// the DNSBL zone with its key masked, or "abuseipdb", and Score, for
+// AbuseIPDB alone, its score of the client.
+type ReputationHit struct {
+	Source string `json:"source"`
+	Score  *int64 `json:"score,omitempty"`
+}
+
 // EarlierBans counts a netblock's bans before a ban, by cause.
 type EarlierBans struct {
 	Limit  int `json:"limit"`

internal/bans/bans_test.go

@@ -2,6 +2,7 @@ package bans_test
 
 import (
 	"net/netip"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -130,13 +131,13 @@ func TestBrokenLimitDuringABanMakesNoOther(t *testing.T) {
 
 	again, made := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
 
-	if made || again != first || len(ledger.Bans(netblock)) != 1 {
+	if made || !reflect.DeepEqual(again, first) || len(ledger.Bans(netblock)) != 1 {
 		t.Errorf("a limit broken during a ban gave %+v, made %t, and %d bans, "+
 			"want %+v, not made, and 1", again, made, len(ledger.Bans(netblock)), first)
 	}
 
 	again, made = ledger.BanForAttack(netblock, midnight().Add(time.Minute), bans.Notes{})
-	if made || again != first {
+	if made || !reflect.DeepEqual(again, first) {
 		t.Errorf("an attack during a ban gave %+v, made %t, want %+v, not made",
 			again, made, first)
 	}
@@ -182,7 +183,7 @@ func TestFindCountsNothing(t *testing.T) {
 	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
 
 	got, banned, _ := ledger.Find(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
-	if !banned || got != ban {
+	if !banned || !reflect.DeepEqual(got, ban) {
 		t.Errorf("find during the ban gives %+v and %t, want %+v", got, banned, ban)
 	}
 
@@ -191,7 +192,7 @@ func TestFindCountsNothing(t *testing.T) {
 		t.Error("the ban did not end")
 	}
 
-	if notes := ledger.Bans(netblock)[0].Notes; notes != ban.Notes {
+	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(notes, ban.Notes) {
 		t.Errorf("the notes are %+v, want them unchanged, %+v", notes, ban.Notes)
 	}
 }
@@ -247,7 +248,7 @@ func TestFullLedgerDropsTheEarlierBanOfTheNetblockBannedAgain(t *testing.T) {
 	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
 
 	held := ledger.Bans(netblock)
-	if len(held) != 1 || held[0] != second ||
+	if len(held) != 1 || !reflect.DeepEqual(held[0], second) ||
 		held[0].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
 		t.Errorf("the ledger holds %+v, want only the second ban, "+
 			"with 1 earlier ban for a limit", held)
@@ -342,7 +343,7 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 
 	// While the first ban lasts, none would be made.
 	during, would := ledger.WouldBanForAttack(netblock, midnight(), bans.Notes{})
-	if would || during != first {
+	if would || !reflect.DeepEqual(during, first) {
 		t.Errorf("during the first ban, would ban %t with %+v, want false with %+v",
 			would, during, first)
 	}
@@ -371,7 +372,7 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 
 	// The ban made is the one that would have been.
 	made, _ := ledger.BanForLimit(netblock, first.Expires, limitNotes)
-	if made != limit {
+	if !reflect.DeepEqual(made, limit) {
 		t.Errorf("the ban made is %+v, want %+v", made, limit)
 	}
 }

internal/bans/snapshot_test.go

@@ -2,6 +2,7 @@ package bans_test
 
 import (
 	"net/netip"
+	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -224,7 +225,7 @@ func TestLoadKeepsAtMostMaxBansDroppingTheEarliest(t *testing.T) {
 	ledger.Load([]bans.Ban{later, earlier})
 
 	held := ledger.Snapshot()
-	if len(held) != 1 || held[0] != later {
+	if len(held) != 1 || !reflect.DeepEqual(held[0], later) {
 		t.Errorf("the ledger holds %+v, want only the ban that began later", held)
 	}
 }
@@ -267,7 +268,7 @@ func TestLoadReplacesTheBansHeld(t *testing.T) {
 		bans.Notes{})
 
 	want := []bans.Ban{first, second, kept}
-	if got := ledger.Snapshot(); !slices.Equal(got, want) {
+	if got := ledger.Snapshot(); !reflect.DeepEqual(got, want) {
 		t.Errorf("the ledger holds %+v, want %+v", got, want)
 	}
 }