DNS blocklists asked in the background, verdicts kept (closes #104)

Zones in SWWAF_DNSBL_ZONES are asked about each client in the background,
through SWWAF_DNSBL_RESOLVER or the host's resolver; no request waits.
Verdicts last SWWAF_REPUTATION_CACHE_TTL, kept in reputation.json.
SWWAF_REPUTATION_ACTION (limit:25) denies, limits or logs a listed
client; each zone listing it raises reputation_hit. A failed query gives
no verdict, raises source_failure, and pauses the zone a minute. A
zone's key, its first label under dq.spamhaus.net, is masked everywhere
but reputation.json. Zones compare without regard to case.

Judgement call: answers in 127.255.255.0/24 or outside 127.0.0.0/8 are failures.
Judgement call: the minute's pause after a failure; at most 1,000 queries at once.
Judgement call: one zone given with two keys stops the start as listed twice.
Rule suppressed: paralleltest on the DNSBL tests (Go's resolver shares state across synctest bubbles), funlen on the test of every logged setting.

Model: opus-5-5

internal/reputation/dnsbl.go

@@ -0,0 +1,335 @@
+package reputation
+
+import (
+	"cmp"
+	"context"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"net/netip"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+const (
+	// maxVerdicts is how many verdicts are kept. Past it, the one fetched
+	// longest ago is dropped.
+	maxVerdicts = 100000
+	// maxQueries is how many queries may be under way at once. Past it, a
+	// zone is not asked about a client until the client's next request, so
+	// that a swarm of new addresses cannot fill the memory.
+	maxQueries = 1000
+	// failureDelay is how long a zone is not asked again after a query to
+	// it fails, so that a zone refusing queries is not asked on every
+	// request.
+	failureDelay = time.Minute
+)
+
+var (
+	errAsk        = errors.New("ask the zone")
+	errRefused    = errors.New("the zone refused the query")
+	errNotListing = errors.New("the answer is outside 127.0.0.0/8")
+)
+
+// Verdict is what a zone said about a client, as reputation.json holds
+// it: the zone, the client's address, whether the zone lists it, and when
+// the zone answered.
+type Verdict struct {
+	Zone    string     `json:"zone"`
+	Client  netip.Addr `json:"client"`
+	Listed  bool       `json:"listed"`
+	Fetched time.Time  `json:"fetched"`
+}
+
+// DNSBLParams are what NewDNSBL needs.
+type DNSBLParams struct {
+	// Zones are the DNSBL zones clients are asked about in
+	// (SWWAF_DNSBL_ZONES).
+	Zones []string
+	// Resolver is the resolver they are asked through
+	// (SWWAF_DNSBL_RESOLVER), or, while it is the zero AddrPort, the
+	// host's, as /etc/resolv.conf names it.
+	Resolver netip.AddrPort
+	// CacheTTL is how long a verdict is used after it was fetched
+	// (SWWAF_REPUTATION_CACHE_TTL), and Timeout how long a query may take
+	// (SWWAF_REPUTATION_TIMEOUT).
+	CacheTTL time.Duration
+	Timeout  time.Duration
+	// Now tells the time, normally time.Now in UTC.
+	Now func() time.Time
+	// ProcessLog receives each query that fails, and why.
+	ProcessLog *slog.Logger
+	// Alerts receive a source_failure alert for each query that fails.
+	Alerts *alerts.Queue
+}
+
+// DNSBL asks the DNSBL zones about clients, in the background, and keeps
+// their verdicts. It is safe for concurrent use.
+type DNSBL struct {
+	params   DNSBLParams
+	resolver *net.Resolver
+
+	mu sync.Mutex
+	// verdicts are by query. Each is added as it is fetched and never moved
+	// up, so that the one fetched longest ago is the first dropped.
+	verdicts *simplelru.LRU[query, Verdict]
+	// asking are the queries under way.
+	asking map[query]bool
+	// queries and failures count, by zone, the queries made and those that
+	// failed, and retryAt is when a zone whose last query failed may be
+	// asked again.
+	queries  map[string]int
+	failures map[string]int
+	retryAt  map[string]time.Time
+}
+
+// query is a client's address, to ask a zone about.
+type query struct {
+	zone   string
+	client netip.Addr
+}
+
+// NewDNSBL returns a DNSBL with no verdict yet.
+func NewDNSBL(params DNSBLParams) *DNSBL {
+	verdicts, err := simplelru.NewLRU[query, Verdict](maxVerdicts, nil)
+	if err != nil {
+		panic(err) // NewLRU fails only for a size below one
+	}
+
+	resolver := &net.Resolver{}
+	if params.Resolver.IsValid() {
+		// Dial is used by Go's own resolver alone.
+		resolver.PreferGo = true
+		resolver.Dial = func(ctx context.Context, network, _ string) (net.Conn, error) {
+			var dialer net.Dialer
+
+			return dialer.DialContext(ctx, network, params.Resolver.String())
+		}
+	}
+
+	return &DNSBL{
+		params:   params,
+		resolver: resolver,
+		verdicts: verdicts,
+		asking:   map[query]bool{},
+		queries:  map[string]int{},
+		failures: map[string]int{},
+		retryAt:  map[string]time.Time{},
+	}
+}
+
+// Zones returns the zones, in the order SWWAF_DNSBL_ZONES names them.
+func (d *DNSBL) Zones() []string {
+	return slices.Clone(d.params.Zones)
+}
+
+// ListedBy returns the zones whose verdict on addr, a client's address,
+// lists it, in the order SWWAF_DNSBL_ZONES names them, each with its key
+// masked, as config.MaskZoneKey masks it, since they go to the request
+// log, the alerts and the metrics. A verdict is used until CacheTTL has
+// passed since it was fetched. Each zone without one is asked about addr
+// in the background, unless a query about addr to it is under way, the
+// zone is left alone after a failure, or maxQueries are under way;
+// ListedBy never waits for a query. ctx is the context of the client's
+// request, and a query goes on after the request ends.
+func (d *DNSBL) ListedBy(ctx context.Context, addr netip.Addr) []string {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	now := d.params.Now()
+
+	var listedBy []string
+
+	for _, zone := range d.params.Zones {
+		q := query{zone: zone, client: addr}
+
+		kept, found := d.verdicts.Peek(q)
+
+		switch {
+		case found && now.Sub(kept.Fetched) < d.params.CacheTTL:
+			if kept.Listed {
+				listedBy = append(listedBy, config.MaskZoneKey(zone))
+			}
+		case !d.asking[q] && !now.Before(d.retryAt[zone]) && len(d.asking) < maxQueries:
+			d.asking[q] = true
+			d.queries[zone]++
+
+			go d.ask(context.WithoutCancel(ctx), q)
+		}
+	}
+
+	return listedBy
+}
+
+// Queries returns how many queries were made to zone.
+func (d *DNSBL) Queries(zone string) int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	return d.queries[zone]
+}
+
+// Failures returns how many queries to zone failed.
+func (d *DNSBL) Failures(zone string) int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	return d.failures[zone]
+}
+
+// Snapshot returns every verdict still in use, sorted by client, then by
+// zone, as reputation.json lists them.
+func (d *DNSBL) Snapshot() []Verdict {
+	d.mu.Lock()
+
+	now := d.params.Now()
+	verdicts := make([]Verdict, 0, d.verdicts.Len())
+
+	for _, kept := range d.verdicts.Values() {
+		if now.Sub(kept.Fetched) < d.params.CacheTTL {
+			verdicts = append(verdicts, kept)
+		}
+	}
+
+	d.mu.Unlock()
+
+	slices.SortFunc(verdicts, func(a, b Verdict) int {
+		return cmp.Or(a.Client.Compare(b.Client), strings.Compare(a.Zone, b.Zone))
+	})
+
+	return verdicts
+}
+
+// Load keeps verdicts, read from reputation.json, in place of those it
+// keeps, but for those of a zone SWWAF_DNSBL_ZONES does not name, and,
+// past maxVerdicts, those fetched longest ago. One fetched CacheTTL ago or
+// more is neither used nor written, as for any verdict.
+func (d *DNSBL) Load(verdicts []Verdict) {
+	verdicts = slices.Clone(verdicts)
+	slices.SortStableFunc(verdicts, func(a, b Verdict) int {
+		return a.Fetched.Compare(b.Fetched)
+	})
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	d.verdicts.Purge()
+
+	for _, kept := range verdicts {
+		if slices.Contains(d.params.Zones, kept.Zone) {
+			d.verdicts.Add(query{zone: kept.Zone, client: kept.Client}, kept)
+		}
+	}
+}
+
+// ask asks q's zone about q's client, keeps the verdict, and notes the
+// query as no longer under way. A query that fails gives no verdict: it
+// is counted, logged and raised as a source_failure alert, which show the
+// zone with its key masked, and the zone is not asked again for
+// failureDelay.
+func (d *DNSBL) ask(ctx context.Context, q query) {
+	listed, err := d.lookUp(ctx, q)
+	now := d.params.Now()
+
+	d.mu.Lock()
+
+	delete(d.asking, q)
+
+	if err == nil {
+		d.verdicts.Add(q, Verdict{
+			Zone: q.zone, Client: q.client, Listed: listed, Fetched: now,
+		})
+	} else {
+		d.failures[q.zone]++
+		d.retryAt[q.zone] = now.Add(failureDelay)
+	}
+
+	d.mu.Unlock()
+
+	if err != nil {
+		const failed = "asking a DNSBL zone failed"
+
+		shown := config.MaskZoneKey(q.zone)
+
+		// Raised before it is logged, so that the alert is there once the
+		// log line is.
+		d.params.Alerts.Raise(alerts.Alert{
+			Event:  alerts.EventSourceFailure,
+			Reason: failed,
+			Detail: map[string]any{"source": shown, "error": err.Error()},
+		})
+		d.params.ProcessLog.Warn(failed, "zone", shown, "error", err.Error())
+	}
+}
+
+// lookUp asks q's zone about q's client through the resolver, and returns
+// whether the zone lists it, as readAnswer reads the answer. No such name
+// is a client the zone does not list. A query not answered within Timeout
+// fails.
+func (d *DNSBL) lookUp(ctx context.Context, q query) (bool, error) {
+	ctx, cancel := context.WithTimeout(ctx, d.params.Timeout)
+	defer cancel()
+
+	answer, err := d.resolver.LookupNetIP(ctx, "ip4", queryName(q.zone, q.client))
+
+	var dnsErr *net.DNSError
+
+	switch {
+	case err == nil:
+		return readAnswer(answer)
+	case errors.As(err, &dnsErr) && dnsErr.IsNotFound:
+		return false, nil
+	case errors.As(err, &dnsErr):
+		// The error names the name asked about, which holds the client's
+		// address, which is not to be logged: only what went wrong is kept.
+		return false, fmt.Errorf("%w: %s", errAsk, dnsErr.Err)
+	default:
+		return false, fmt.Errorf("%w: %w", errAsk, err)
+	}
+}
+
+// queryName returns the name a zone is asked about addr by, as RFC 5782
+// builds it: the four numbers of an IPv4 address, or the 32 hex digits of
+// an IPv6 address, in reverse order, each followed by a dot, then the zone
+// and a dot, which makes it a full name, to which the resolver adds no
+// search domain of /etc/resolv.conf.
+func queryName(zone string, addr netip.Addr) string {
+	parts := strings.Split(addr.String(), ".")
+	if addr.Is6() {
+		parts = strings.Split(hex.EncodeToString(addr.AsSlice()), "")
+	}
+
+	slices.Reverse(parts)
+
+	return strings.Join(parts, ".") + "." + zone + "."
+}
+
+// readAnswer reads the addresses a zone answered with. An address in
+// 127.0.0.0/8 lists the client, as RFC 5782 has zones answer, but one in
+// 127.255.255.0/24 is how Spamhaus refuses a query, such as one sent
+// through a public resolver or one past its limit, and is a failure. So is
+// an address outside 127.0.0.0/8, such as a resolver gives that answers
+// even for names that do not exist.
+func readAnswer(answer []netip.Addr) (bool, error) {
+	listing := netip.MustParsePrefix("127.0.0.0/8")
+	refusal := netip.MustParsePrefix("127.255.255.0/24")
+
+	for _, addr := range answer {
+		switch {
+		case refusal.Contains(addr):
+			return false, fmt.Errorf("%w: %s", errRefused, addr)
+		case !listing.Contains(addr):
+			return false, fmt.Errorf("%w: %s", errNotListing, addr)
+		}
+	}
+
+	return len(answer) > 0, nil
+}

internal/reputation/dnsbl_test.go

@@ -0,0 +1,737 @@
+package reputation_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"reflect"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/metrics"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+)
+
+// The tests of the DNSBL zones run in synctest bubbles, as those of the
+// lists do, and the resolver the zones are asked through is a stand-in
+// reached through an in-memory connection, net.Pipe's, for the same
+// reason. They run one at a time, none in parallel with another test of
+// this package: Go's resolver counts the queries under way in one
+// sync.WaitGroup for the whole process, and the process fails when
+// queries from two bubbles, or from a bubble and from outside one, are
+// under way at once. TestMain has the resolver make its configuration,
+// which it makes on its first query, outside every bubble, since the
+// configuration holds a channel, which the bubble it was made in would
+// keep to itself.
+
+const (
+	// zone and otherZone are the DNSBL zones the tests name.
+	zone      = "dnsbl.example"
+	otherZone = "other.example"
+	// cacheTTL is the tests' SWWAF_REPUTATION_CACHE_TTL, and timeout their
+	// SWWAF_REPUTATION_TIMEOUT: a second, the least time /etc/resolv.conf
+	// can have Go's resolver wait for one server, so that it is the
+	// DNSBL's own timeout that ends a query, whatever that file says.
+	cacheTTL = 24 * time.Hour
+	timeout  = time.Second
+	// listed and unlisted are clients zone is asked about by the names
+	// listedName and unlistedName, and most tests have zone list the first
+	// alone, by answering with listing.
+	listed       = "192.0.2.99"
+	unlisted     = "192.0.2.100"
+	listedName   = "99.2.0.192." + zone + "."
+	unlistedName = "100.2.0.192." + zone + "."
+	listing      = "127.0.0.2"
+)
+
+// The DNS response codes the stand-in answers with, besides no error.
+const (
+	serverFailure = 2
+	noSuchName    = 3
+	refused       = 5
+)
+
+var errNoNetwork = errors.New("the test dials nothing")
+
+func TestMain(m *testing.M) {
+	// A query that fails at once, as nothing is dialled for it.
+	resolver := &net.Resolver{
+		PreferGo: true,
+		Dial: func(context.Context, string, string) (net.Conn, error) {
+			return nil, errNoNetwork
+		},
+	}
+	_, _ = resolver.LookupNetIP(context.Background(), "ip4", "warm-up.invalid.")
+
+	m.Run()
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestZonesListOrNotClientsByTheirIPv4AndIPv6Addresses(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		// The addresses of the examples of RFC 5782, and the names it
+		// gives for them.
+		const (
+			v4 = "192.0.2.99"
+			v6 = "2001:db8:1:2:3:4:567:89ab"
+			// v6Name is the hex digits of v6, in reverse order.
+			v6Name = "b.a.9.8.7.6.5.0.4.0.0.0.3.0.0.0.2.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2."
+		)
+
+		resolver := &resolverStandIn{answers: map[string]answer{
+			"99.2.0.192." + zone + ".":      {addrs: []string{listing}},
+			v6Name + otherZone + ".":        {addrs: []string{"127.0.0.4", "127.0.0.10"}},
+			"99.2.0.192." + otherZone + ".": {},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
+
+		// Neither client has a verdict yet, so neither is listed, and each
+		// zone is asked about each.
+		wantZones(t, dnsbl, v4)
+		wantZones(t, dnsbl, v6)
+		synctest.Wait()
+
+		wantZones(t, dnsbl, v4, zone)
+		wantZones(t, dnsbl, v6, otherZone)
+		wantAsked(t, resolver,
+			"99.2.0.192."+zone+".", "99.2.0.192."+otherZone+".",
+			v6Name+zone+".", v6Name+otherZone+".")
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestListedByNeverWaitsForAQuery(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, dnsblParams(zone))
+		began := time.Now()
+
+		// The second, while the first's query is under way, starts none.
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, listed)
+
+		if waited := time.Since(began); waited != 0 {
+			t.Errorf("waited %s for the query, want no wait", waited)
+		}
+
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1, 0)
+		waitForTheResolver()
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestVerdictUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		resolver := &resolverStandIn{answers: map[string]answer{
+			listedName: {addrs: []string{listing}},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone))
+
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+
+		// The zone lists the other client from now on, but the verdicts
+		// kept are used, and the zone is not asked again, until the TTL
+		// has passed.
+		resolver.set(listedName, answer{rcode: noSuchName})
+		resolver.set(unlistedName, answer{addrs: []string{listing}})
+		time.Sleep(cacheTTL - time.Nanosecond)
+
+		wantZones(t, dnsbl, listed, zone)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+		wantQueries(t, dnsbl, 2, 0)
+
+		// Then neither verdict is used, and both clients are asked about
+		// again.
+		time.Sleep(time.Nanosecond)
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+
+		wantQueries(t, dnsbl, 4, 0)
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted, zone)
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestQueryNotAnsweredWithinTheTimeoutFails(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		queue := newQueue()
+		p := dnsblParams(zone)
+		p.Alerts = queue
+		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, p)
+
+		wantZones(t, dnsbl, listed)
+		time.Sleep(timeout - time.Nanosecond)
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1, 0)
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1, 1)
+
+		if got := waiting(queue); len(got) != 1 ||
+			got[0].Detail["error"] != "ask the zone: i/o timeout" {
+			t.Errorf("alerts waiting %+v, want the timeout's", got)
+		}
+
+		if verdicts := dnsbl.Snapshot(); len(verdicts) != 0 {
+			t.Errorf("verdicts %+v, want none", verdicts)
+		}
+
+		waitForTheResolver()
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		answer answer
+		error  string
+	}{
+		{
+			"a server failure", answer{rcode: serverFailure},
+			"ask the zone: server misbehaving",
+		},
+		{"a refusal", answer{rcode: refused}, "ask the zone: server misbehaving"},
+		{
+			"an answer in 127.255.255.0/24, with which Spamhaus refuses a query",
+			answer{addrs: []string{"127.255.255.254"}},
+			"the zone refused the query: 127.255.255.254",
+		},
+		{
+			"an answer outside 127.0.0.0/8, as for a name that does not exist",
+			answer{addrs: []string{"192.0.2.1"}},
+			"the answer is outside 127.0.0.0/8: 192.0.2.1",
+		},
+	} {
+		//nolint:paralleltest // one at a time, as the comment at the top of this file says
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				var log bytes.Buffer
+
+				queue := newQueue()
+				p := dnsblParams(zone)
+				p.Alerts = queue
+				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+				dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
+					listedName: tc.answer,
+				}}, p)
+
+				// The failure gives no verdict, and the zone is not asked
+				// again within a minute of it.
+				wantZones(t, dnsbl, listed)
+				synctest.Wait()
+				time.Sleep(time.Minute - time.Nanosecond)
+				wantZones(t, dnsbl, listed)
+				synctest.Wait()
+				wantQueries(t, dnsbl, 1, 1)
+
+				time.Sleep(time.Nanosecond)
+				wantZones(t, dnsbl, listed)
+				synctest.Wait()
+				wantQueries(t, dnsbl, 2, 2)
+
+				if verdicts := dnsbl.Snapshot(); len(verdicts) != 0 {
+					t.Errorf("verdicts %+v, want none", verdicts)
+				}
+
+				// One alert for the first failure; the cooldown holds back
+				// the second.
+				wantAlert(t, queue, alerts.Alert{
+					Time:   time.Now().Add(-time.Minute),
+					Event:  alerts.EventSourceFailure,
+					Reason: "asking a DNSBL zone failed",
+					Detail: map[string]any{"source": zone, "error": tc.error},
+				})
+
+				if !strings.Contains(log.String(), `"msg":"asking a DNSBL zone failed",`+
+					`"zone":"`+zone+`","error":"`+tc.error) {
+					t.Errorf("logged\n%s\nwant the failures", log.String())
+				}
+			})
+		})
+	}
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestAtMost1000QueriesUnderWay(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, dnsblParams(zone))
+
+		client := netip.MustParseAddr("198.18.0.0")
+		for range 1001 {
+			dnsbl.ListedBy(t.Context(), client)
+			client = client.Next()
+		}
+
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1000, 0)
+		waitForTheResolver()
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestMetricsCountEachZonesQueriesAndThoseThatFailed(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		resolver := &resolverStandIn{answers: map[string]answer{
+			listedName:                      {addrs: []string{listing}},
+			"99.2.0.192." + otherZone + ".": {rcode: serverFailure},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
+		m := metrics.New(1, "app")
+		m.AddReputation(reputation.New(params()), dnsbl)
+
+		wantZones(t, dnsbl, listed)
+		synctest.Wait()
+
+		scraped := httptest.NewRecorder()
+		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+			"/", http.NoBody))
+
+		for series, want := range map[string]string{
+			"queries_total" + `{instance="app",source="` + zone + `"}`:       "1",
+			"failures_total" + `{instance="app",source="` + zone + `"}`:      "0",
+			"queries_total" + `{instance="app",source="` + otherZone + `"}`:  "1",
+			"failures_total" + `{instance="app",source="` + otherZone + `"}`: "1",
+		} {
+			line := "\nsmallwebwaf_reputation_" + series + " " + want + "\n"
+			if !strings.Contains(scraped.Body.String(), line) {
+				t.Errorf("metrics\n%s\nwant%s", scraped.Body.String(), line)
+			}
+		}
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestZoneKeyIsMaskedInTheVerdictsTheFailuresAndTheMetrics(t *testing.T) {
+	const (
+		key    = "abcdefghijklmnopqrstuvwxyz"
+		keyed  = key + ".xbl.dq.spamhaus.net"
+		masked = "********.xbl.dq.spamhaus.net"
+	)
+
+	synctest.Test(t, func(t *testing.T) {
+		var log bytes.Buffer
+
+		queue := newQueue()
+		p := dnsblParams(keyed)
+		p.Alerts = queue
+		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+		dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
+			"99.2.0.192." + keyed + ".":  {addrs: []string{listing}},
+			"100.2.0.192." + keyed + ".": {rcode: serverFailure},
+		}}, p)
+		m := metrics.New(1, "app")
+		m.AddReputation(reputation.New(params()), dnsbl)
+
+		// Both clients are asked about before either answer comes, so that
+		// the failure does not keep the zone from the other query.
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+		wantZones(t, dnsbl, listed, masked)
+
+		if got := waiting(queue); len(got) != 1 || got[0].Detail["source"] != masked {
+			t.Errorf("alerts waiting %+v, want the failure's, from %s", got, masked)
+		}
+
+		scraped := httptest.NewRecorder()
+		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+			"/", http.NoBody))
+
+		for name, shown := range map[string]string{
+			"the log": log.String(), "the metrics": scraped.Body.String(),
+		} {
+			if strings.Contains(shown, key) || !strings.Contains(shown, masked) {
+				t.Errorf("%s shows the key, or does not name the zone:\n%s", name, shown)
+			}
+		}
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestVerdictsKeptAcrossARestart(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		resolver := &resolverStandIn{answers: map[string]answer{
+			listedName: {addrs: []string{listing}},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone))
+		fetched := time.Now()
+
+		wantZones(t, dnsbl, unlisted)
+		wantZones(t, dnsbl, listed)
+		synctest.Wait()
+
+		kept := dnsbl.Snapshot()
+
+		want := []reputation.Verdict{
+			{Zone: zone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: fetched},
+			{Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: fetched},
+		}
+		if !reflect.DeepEqual(kept, want) {
+			t.Errorf("verdicts %+v, want %+v", kept, want)
+		}
+
+		// Restarted an hour later with what reputation.json keeps, it uses
+		// the verdicts, and asks the zone nothing, until the TTL has passed
+		// since they were fetched.
+		time.Sleep(time.Hour)
+
+		restarted := &resolverStandIn{}
+		again := newDNSBL(restarted, dnsblParams(zone))
+		again.Load(kept)
+
+		wantZones(t, again, listed, zone)
+		wantZones(t, again, unlisted)
+		synctest.Wait()
+		wantAsked(t, restarted)
+
+		time.Sleep(cacheTTL - time.Hour)
+		wantZones(t, again, listed)
+		synctest.Wait()
+		wantAsked(t, restarted, listedName)
+	})
+}
+
+func TestNeitherAVerdictOfAZoneNotNamedNorOnePastItsTTLIsKept(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
+	p := dnsblParams(zone)
+	p.Now = func() time.Time { return now }
+	dnsbl := reputation.NewDNSBL(p)
+
+	// The last verdict still in use, one fetched a TTL ago, and one of a
+	// zone SWWAF_DNSBL_ZONES does not name.
+	inUse := reputation.Verdict{
+		Zone: zone, Client: netip.MustParseAddr(listed), Listed: true,
+		Fetched: now.Add(-cacheTTL + time.Nanosecond),
+	}
+	stale := reputation.Verdict{
+		Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: now.Add(-cacheTTL),
+	}
+	notNamed := reputation.Verdict{
+		Zone: otherZone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: now,
+	}
+
+	dnsbl.Load([]reputation.Verdict{notNamed, stale, inUse})
+
+	if got := dnsbl.Snapshot(); !reflect.DeepEqual(got, []reputation.Verdict{inUse}) {
+		t.Errorf("verdicts %+v, want only %+v", got, inUse)
+	}
+}
+
+func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
+	p := dnsblParams(zone)
+	p.Now = func() time.Time { return now }
+	dnsbl := reputation.NewDNSBL(p)
+
+	// 100,001 verdicts, listed by client, as reputation.json lists them,
+	// each fetched a millisecond before the one before it: the last is one
+	// too many.
+	const count = 100001
+
+	verdicts := make([]reputation.Verdict, 0, count)
+
+	client := netip.MustParseAddr("198.18.0.0")
+	for i := range count {
+		verdicts = append(verdicts, reputation.Verdict{
+			Zone: zone, Client: client, Fetched: now.Add(-time.Duration(i) * time.Millisecond),
+		})
+		client = client.Next()
+	}
+
+	dnsbl.Load(verdicts)
+
+	got := dnsbl.Snapshot()
+	if len(got) != count-1 || !slices.Contains(got, verdicts[0]) ||
+		slices.Contains(got, verdicts[count-1]) {
+		t.Errorf("%d verdicts kept, want all but the one fetched longest ago", len(got))
+	}
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestQueriesGoToTheResolverSWWAFDNSBLResolverNames(t *testing.T) {
+	resolver := &resolverStandIn{answers: map[string]answer{
+		listedName: {addrs: []string{listing}},
+	}}
+
+	conn, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	served := make(chan struct{})
+
+	go func() {
+		resolver.serveUDP(conn)
+		close(served)
+	}()
+
+	t.Cleanup(func() {
+		_ = conn.Close()
+
+		<-served
+	})
+
+	p := dnsblParams(zone)
+	p.Resolver = netip.MustParseAddrPort(conn.LocalAddr().String())
+	// On the real clock: the stand-in answers at once, so only a test
+	// process held up for a whole minute would see the query fail.
+	p.Timeout = time.Minute
+
+	isListed, err := reputation.NewDNSBL(p).LookUp(zone, netip.MustParseAddr(listed))
+	if err != nil || !isListed {
+		t.Errorf("listed %t (%v), want true", isListed, err)
+	}
+
+	wantAsked(t, resolver, listedName)
+}
+
+// resolverStandIn is a stand-in for the resolver the zones are asked
+// through. It answers each query by the name asked about, as answers
+// gives, with no such name for a name answers does not give, and not at
+// all while hanging. It notes each name asked about.
+type resolverStandIn struct {
+	mu      sync.Mutex
+	answers map[string]answer
+	hanging bool
+	names   []string
+}
+
+// answer is how the stand-in answers a name: with an A record of each of
+// addrs, or with the response code rcode, unless it is 0, for no error.
+type answer struct {
+	addrs []string
+	rcode uint16
+}
+
+// What the stand-in reads of a query, and writes in its reply.
+const (
+	// headerLength is the length of a DNS message's header, which the
+	// question follows: its id, its flags, and how many questions,
+	// answers and other records it holds, two bytes each.
+	headerLength = 12
+	// typeAndClass is the length of the type and the class that end a
+	// question, after its name.
+	typeAndClass = 4
+	// replyFlags mark a reply to a query that asked for recursion, which
+	// is available, with no error. The response code goes in their last
+	// four bits.
+	replyFlags = 0x8180
+	// maxMessage is the longest query read over UDP.
+	maxMessage = 1232
+)
+
+// set has the stand-in answer name with given.
+func (s *resolverStandIn) set(name string, given answer) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.answers[name] = given
+}
+
+// dial connects Go's resolver to the stand-in through an in-memory
+// connection, on which it sends each query, and reads each reply, after
+// its length, as over TCP.
+func (s *resolverStandIn) dial(context.Context, string, string) (net.Conn, error) {
+	client, server := net.Pipe()
+
+	go s.serve(server)
+
+	return client, nil
+}
+
+// serve answers the queries that come on conn until the resolver closes
+// it.
+func (s *resolverStandIn) serve(conn net.Conn) {
+	defer func() {
+		_ = conn.Close()
+	}()
+
+	for {
+		var length [2]byte
+
+		_, err := io.ReadFull(conn, length[:])
+		if err != nil {
+			return
+		}
+
+		message := make([]byte, binary.BigEndian.Uint16(length[:]))
+
+		_, err = io.ReadFull(conn, message)
+		if err != nil {
+			return
+		}
+
+		reply, answered := s.reply(message)
+		if !answered {
+			continue // the resolver gives up, and closes conn
+		}
+
+		//nolint:gosec // a reply of a few dozen bytes
+		_, err = conn.Write(append(binary.BigEndian.AppendUint16(nil, uint16(len(reply))),
+			reply...))
+		if err != nil {
+			return
+		}
+	}
+}
+
+// serveUDP answers the queries that come on conn, each in a datagram, as
+// a resolver does, until conn is closed.
+func (s *resolverStandIn) serveUDP(conn net.PacketConn) {
+	message := make([]byte, maxMessage)
+
+	for {
+		n, from, err := conn.ReadFrom(message)
+		if err != nil {
+			return
+		}
+
+		reply, answered := s.reply(message[:n])
+		if answered {
+			_, _ = conn.WriteTo(reply, from)
+		}
+	}
+}
+
+// reply returns the stand-in's reply to message, a query, and false for
+// none, while it hangs. It notes the name asked about.
+func (s *resolverStandIn) reply(message []byte) ([]byte, bool) {
+	// The name is labels, each after its length, ended by a length of 0.
+	var labels []string
+
+	end := headerLength
+	for message[end] != 0 {
+		length := int(message[end])
+		labels = append(labels, string(message[end+1:end+1+length]))
+		end += 1 + length
+	}
+
+	end += 1 + typeAndClass
+	name := strings.Join(labels, ".") + "."
+
+	s.mu.Lock()
+	s.names = append(s.names, name)
+	given, found := s.answers[name]
+	hanging := s.hanging
+	s.mu.Unlock()
+
+	if hanging {
+		return nil, false
+	}
+
+	if !found {
+		given = answer{rcode: noSuchName}
+	}
+
+	// The query's id, the flags, one question, the answers, and no other
+	// records, then the question, as asked.
+	reply := slices.Clone(message[:2])
+	reply = binary.BigEndian.AppendUint16(reply, replyFlags|given.rcode)
+	reply = binary.BigEndian.AppendUint16(reply, 1)
+	//nolint:gosec // a handful of answers
+	reply = binary.BigEndian.AppendUint16(reply, uint16(len(given.addrs)))
+	reply = append(reply, 0, 0, 0, 0)
+	reply = append(reply, message[headerLength:end]...)
+
+	// An A record starts with the name asked about, by a pointer to it in
+	// the question, then its type, A, its class, IN, how long it may be
+	// kept, 60 seconds, and the length of its address, 4 bytes.
+	record := []byte{0xc0, headerLength, 0, 1, 0, 1, 0, 0, 0, 60, 0, 4}
+
+	for _, addr := range given.addrs {
+		reply = append(reply, record...)
+		reply = append(reply, netip.MustParseAddr(addr).AsSlice()...)
+	}
+
+	return reply, true
+}
+
+// dnsblParams returns the DNSBLParams of zones, with the tests' cache TTL
+// and timeout, by the bubble's clock, with alerts to a queue that sends
+// none.
+func dnsblParams(zones ...string) reputation.DNSBLParams {
+	return reputation.DNSBLParams{
+		Zones:      zones,
+		CacheTTL:   cacheTTL,
+		Timeout:    timeout,
+		Now:        time.Now,
+		ProcessLog: slog.New(slog.DiscardHandler),
+		Alerts:     newQueue(),
+	}
+}
+
+// waitForTheResolver waits, on the bubble's clock, an hour, until Go's
+// resolver has given up on every stand-in that does not answer: it waits
+// for a server as long as /etc/resolv.conf has it wait, a few seconds,
+// even after the query was given up, and a bubble cannot end before it.
+func waitForTheResolver() {
+	time.Sleep(time.Hour)
+}
+
+// newDNSBL returns the DNSBL of p, asking resolver.
+func newDNSBL(resolver *resolverStandIn, p reputation.DNSBLParams) *reputation.DNSBL {
+	dnsbl := reputation.NewDNSBL(p)
+	dnsbl.SetDial(resolver.dial)
+
+	return dnsbl
+}
+
+// wantZones checks the zones whose verdict dnsbl says lists client, as a
+// request from client finds them.
+func wantZones(t *testing.T, dnsbl *reputation.DNSBL, client string, want ...string) {
+	t.Helper()
+
+	got := dnsbl.ListedBy(t.Context(), netip.MustParseAddr(client))
+	if !slices.Equal(got, want) {
+		t.Errorf("%s is listed by %v, want %v", client, got, want)
+	}
+}
+
+// wantQueries checks how many queries dnsbl made to zone, and how many of
+// them failed.
+func wantQueries(t *testing.T, dnsbl *reputation.DNSBL, queries, failures int) {
+	t.Helper()
+
+	if dnsbl.Queries(zone) != queries || dnsbl.Failures(zone) != failures {
+		t.Errorf("%d queries and %d failures, want %d and %d", dnsbl.Queries(zone),
+			dnsbl.Failures(zone), queries, failures)
+	}
+}
+
+// wantAsked checks the names the stand-in was asked about, in any order.
+func wantAsked(t *testing.T, resolver *resolverStandIn, want ...string) {
+	t.Helper()
+
+	resolver.mu.Lock()
+	got := slices.Sorted(slices.Values(resolver.names))
+	resolver.mu.Unlock()
+
+	slices.Sort(want)
+
+	if !slices.Equal(got, want) {
+		t.Errorf("asked about %v, want %v", got, want)
+	}
+}

internal/reputation/export_test.go

@@ -1,9 +1,27 @@
 package reputation
 
-import "net/http"
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/netip"
+)
 
 // SetTransport has l's fetches go through transport instead of the
 // network.
 func (l *Lists) SetTransport(transport http.RoundTripper) {
 	l.httpClient.Transport = transport
 }
+
+// SetDial has d's queries go through dial instead of the network.
+func (d *DNSBL) SetDial(
+	dial func(ctx context.Context, network, address string) (net.Conn, error),
+) {
+	d.resolver = &net.Resolver{PreferGo: true, Dial: dial}
+}
+
+// LookUp asks zone about addr at once, as a query in the background does,
+// and returns whether zone lists addr.
+func (d *DNSBL) LookUp(zone string, addr netip.Addr) (bool, error) {
+	return d.lookUp(context.Background(), query{zone: zone, client: addr})
+}

internal/reputation/reputation.go

@@ -2,8 +2,10 @@
 // blocklists of SWWAF_BLOCKLIST_URLS, and the file of AS:percent lines
 // SWWAF_ASN_LIMIT_PERCENT_URL names. It keeps the last good copy of each,
 // whole, comment lines included, which is used while a fetch fails, and
-// when each was last tried, which the state package writes to
-// reputation.json and reads from it, so that a restart keeps them too.
+// when each was last tried. It also asks the DNSBL zones of
+// SWWAF_DNSBL_ZONES about clients, and keeps their verdicts. The state
+// package writes all of these to reputation.json and reads them from it,
+// so that a restart keeps them too.
 package reputation
 
 import (