Blocklists and an AS percentage file fetched by URL (closes #29)

SWWAF_BLOCKLIST_URLS names lists of addresses and netblocks, fetched every
SWWAF_BLOCKLIST_REFRESH (24h, never under 1h). The last good copy is kept
whole in reputation.json and used while a fetch fails and across restarts.
SWWAF_BLOCKLIST_ACTION denies, limits or only logs a listed client; the log
line names the lists, each raises reputation_hit, and a failed fetch raises
source_failure. SWWAF_ASN_LIMIT_PERCENT_URL is fetched the same way and
counts as SWWAF_ASN_LIMIT_PERCENT does, the lower winning.

Judgement call: a restart fetches only lists whose copy is due.
Judgement call: a failed fetch is retried after the refresh, not sooner.
Not done: ban notes do not name the lists yet.

Model: opus-5-5

internal/proxy/biased.go

@@ -17,33 +17,48 @@ type percentage struct {
 }
 
 // biasedThresholdsSet reports whether a biased threshold can lower a
-// client's limits: one of its lists is not empty, or
-// SWWAF_UNKNOWN_LIMIT_PERCENT is below 100. The client's lookup is then
-// needed before its request goes on.
+// client's limits: one of its lists is not empty,
+// SWWAF_UNKNOWN_LIMIT_PERCENT is below 100, or SWWAF_ASN_LIMIT_PERCENT_URL
+// is set. The client's lookup is then needed before its request goes on.
 func biasedThresholdsSet(cfg *config.Config) bool {
 	return len(cfg.ASNLimitPercent) > 0 || len(cfg.CountryLimitPercent) > 0 ||
 		len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
-		cfg.UnknownLimitPercent < whole
+		cfg.UnknownLimitPercent < whole || cfg.ASNLimitPercentURL != ""
 }
 
-// limitPercentages returns a client's limit percentages, for the rate
+// limitPercentages returns the client's limit percentages, for the rate
 // limits and for the byte limits, by its AS number and country as looked
-// up, each "" when unknown. Each is the lowest of those the settings give
-// it, the first of them in the order below when several are lowest: the
-// percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one
-// SWWAF_COUNTRY_LIMIT_PERCENT gives its country, and, for a client
-// without a country, SWWAF_UNKNOWN_LIMIT_PERCENT. For the byte limits,
-// SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take the place
-// of the first two for an AS number or a country they list.
-func limitPercentages(
-	cfg *config.Config, asn, country string,
-) (percentage, percentage) {
+// up, each "" when unknown, and the blocklists that list it. Each is the
+// lowest of those the settings give it, the first of them in the order
+// below when several are lowest: the percentage SWWAF_ASN_LIMIT_PERCENT
+// gives its AS number, the one the file SWWAF_ASN_LIMIT_PERCENT_URL names
+// gives it, the one SWWAF_COUNTRY_LIMIT_PERCENT gives its country, for a
+// client without a country, SWWAF_UNKNOWN_LIMIT_PERCENT, and for a client
+// a blocklist lists, the percentage of SWWAF_BLOCKLIST_ACTION while it is
+// limit. For the byte limits, SWWAF_ASN_BYTES_PERCENT and
+// SWWAF_COUNTRY_BYTES_PERCENT take the place of the first three for an AS
+// number or a country they list.
+func (rq *request) limitPercentages() (percentage, percentage) {
+	cfg := rq.h.config
+	asn, country := rq.line.ASN, rq.line.Country
+
 	unknown := percentage{percent: whole}
 	if country == "" {
 		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
 	}
 
-	asnRequests := given(cfg.ASNLimitPercent, asn, "SWWAF_ASN_LIMIT_PERCENT")
+	fetched := percentage{percent: whole}
+	if percent, listed := rq.h.lists.ASNLimitPercent(asn); listed {
+		fetched = percentage{percent, "SWWAF_ASN_LIMIT_PERCENT_URL"}
+	}
+
+	listed := percentage{percent: whole}
+	if len(rq.line.Reputation) > 0 && cfg.BlocklistAction == "limit" {
+		listed = percentage{cfg.BlocklistLimitPercent, "SWWAF_BLOCKLIST_ACTION"}
+	}
+
+	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWWAF_ASN_LIMIT_PERCENT"),
+		fetched)
 	countryRequests := given(cfg.CountryLimitPercent, country,
 		"SWWAF_COUNTRY_LIMIT_PERCENT")
 
@@ -56,8 +71,8 @@ func limitPercentages(
 		countryBytes = given(cfg.CountryBytesPercent, country, "SWWAF_COUNTRY_BYTES_PERCENT")
 	}
 
-	return lowest(asnRequests, countryRequests, unknown),
-		lowest(asnBytes, countryBytes, unknown)
+	return lowest(asnRequests, countryRequests, unknown, listed),
+		lowest(asnBytes, countryBytes, unknown, listed)
 }
 
 // given returns the percentage percents, the setting named setting, gives