DNS blocklists asked in the background, verdicts kept (closes #104)

Zones in SWWAF_DNSBL_ZONES are asked about each client in the background,
through SWWAF_DNSBL_RESOLVER or the host's resolver; no request waits.
Verdicts last SWWAF_REPUTATION_CACHE_TTL, kept in reputation.json.
SWWAF_REPUTATION_ACTION (limit:25) denies, limits or logs a listed
client; each zone listing it raises reputation_hit. A failed query gives
no verdict, raises source_failure, and pauses the zone a minute. A
zone's key, its first label under dq.spamhaus.net, is masked everywhere
but reputation.json. Zones compare without regard to case.

Judgement call: answers in 127.255.255.0/24 or outside 127.0.0.0/8 are failures.
Judgement call: the minute's pause after a failure; at most 1,000 queries at once.
Judgement call: one zone given with two keys stops the start as listed twice.
Rule suppressed: paralleltest on the DNSBL tests (Go's resolver shares state across synctest bubbles), funlen on the test of every logged setting.

Model: opus-5-5

internal/proxy/request.go

@@ -63,7 +63,10 @@ type request struct {
 	// limits and for the byte limits.
 	counted                    bool
 	limitPercent, bytesPercent percentage
-	start                      time.Time
+	// blocklisted is true once a blocklist is found to list the client,
+	// and dnsblListed once a DNSBL zone's verdict is.
+	blocklisted, dnsblListed bool
+	start                    time.Time
 	// checked is when the checks were done, and upstreamStart when the
 	// request was handed to the app.
 	checked       time.Time
@@ -213,14 +216,14 @@ func (rq *request) check(ctx context.Context) *refusal {
 // client in SWWAF_ALLOW_NETS skips them, and is not looked up. For any
 // other client, SWWAF_DENY_NETS comes first, then a ban on its netblock,
 // so that a client either refuses is not looked up, then the lookup of
-// its AS number and country, then the country lists, and then the
-// blocklists; a request any of them refuses is not counted for the rate
-// limits. Then come the rate limits, unless the client is in
-// SWWAF_RATE_LIMIT_EXEMPT_NETS or the request's path is exempt under
-// SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that every other request is counted,
-// each of them by the client's limit percentages, and last the rule
-// files. A request exempt from the rate limits is exempt from the byte
-// limits too. ctx is the request's own context.
+// its AS number and country, then the country lists, then the blocklists,
+// and then the DNSBL zones' verdicts; a request any of them refuses is not
+// counted for the rate limits. Then come the rate limits, unless the
+// client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the request's path is
+// exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that every other request
+// is counted, each of them by the client's limit percentages, and last the
+// rule files. A request exempt from the rate limits is exempt from the
+// byte limits too. ctx is the request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -247,6 +250,10 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionDenied
 	}
 
+	if rq.dnsblDenied(ctx) {
+		return requestlog.ActionDenied
+	}
+
 	rq.counted = !isInside(rq.client, cfg.RateLimitExemptNets) &&
 		!pathExempt(rq.in.URL, cfg.RateLimitExemptPaths)
 	if rq.counted {