Rule files, and bans for a clear sign of attack (closes #24)

Every *.rules file in SWWAF_RULES_DIR not named with a leading dot is
read at start, and again 2 seconds after the directory's last change.
Each request is checked against the rules after the rate limits: log
notes a match, block refuses with 403, ban refuses and bans the netblock
for SWWAF_ATTACK_BAN_DURATION, made permanent by its next request or
attack. path, query and uri are matched as the request line sent them;
header:Host and header:Transfer-Encoding are refused. Bans gain a cause.
The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

internal/state/state.go

@@ -48,6 +48,7 @@ var (
 	errVersion = errors.New("unknown version")
 	// errMissing is for an entry without a field it needs.
 	errMissing = errors.New("has no")
+	errCause   = errors.New("is not limit or attack")
 )
 
 // Params are what Load needs.
@@ -95,11 +96,12 @@ type bansFile struct {
 }
 
 // banEntry is a ban as bans.json holds it: a permanent ban's expires is
-// null.
+// null, and a ban an admin added may have no cause.
 type banEntry struct {
 	Netblock netip.Prefix `json:"netblock"`
 	Start    time.Time    `json:"start"`
 	Expires  *time.Time   `json:"expires"`
+	Cause    string       `json:"cause,omitempty"`
 	Notes    bans.Notes   `json:"notes"`
 }
 
@@ -444,7 +446,9 @@ func (f *Files) encode(name string) ([]byte, error) {
 
 // newBanEntry returns ban as bans.json holds it.
 func newBanEntry(ban bans.Ban) banEntry {
-	entry := banEntry{Netblock: ban.Netblock, Start: ban.Start, Notes: ban.Notes}
+	entry := banEntry{
+		Netblock: ban.Netblock, Start: ban.Start, Cause: ban.Cause, Notes: ban.Notes,
+	}
 	if !ban.Permanent() {
 		entry.Expires = &ban.Expires
 	}
@@ -454,7 +458,7 @@ func newBanEntry(ban bans.Ban) banEntry {
 
 // ban returns the ban an entry of bans.json holds.
 func (e banEntry) ban() bans.Ban {
-	ban := bans.Ban{Netblock: e.Netblock, Start: e.Start, Notes: e.Notes}
+	ban := bans.Ban{Netblock: e.Netblock, Start: e.Start, Cause: e.Cause, Notes: e.Notes}
 	if e.Expires != nil {
 		ban.Expires = *e.Expires
 	}
@@ -466,7 +470,8 @@ func (e banEntry) ban() bans.Ban {
 // client, a start, from which the length of the netblock's next ban is
 // worked out, or an expires, which would make it permanent. A permanent
 // ban's expires is null, which Bans cannot tell from a missing one, so
-// each expires is read again as written.
+// each expires is read again as written. A cause other than limit or
+// attack, most likely misspelt, is refused too.
 func (f *bansFile) check(data []byte) error {
 	var written struct {
 		Bans []struct {
@@ -487,6 +492,9 @@ func (f *bansFile) check(data []byte) error {
 			return missing(i, "start")
 		case written.Bans[i].Expires == nil:
 			return missing(i, "expires")
+		case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
+			entry.Cause != bans.CauseAttack:
+			return fmt.Errorf("entry %d's cause %q %w", i+1, entry.Cause, errCause)
 		}
 	}
 

internal/state/state_test.go

@@ -63,7 +63,11 @@ const permanentBansJSON = `{
                 },
                 "requests": 1500,
                 "refused": 3,
-                "earlier_bans": 5
+                "earlier_bans": {
+                    "limit": 3,
+                    "attack": 1,
+                    "without_cause": 1
+                }
             }
         }
     ]
@@ -263,6 +267,17 @@ func TestEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 	}
 }
 
+func TestBanWithACauseSmallwebwafDoesNotGiveStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	wantRefused(t, bansJSON, `{"version": 1, "bans": [`+
+		`{"netblock": "203.0.113.9/32", "start": "2026-10-06T00:00:00Z", `+
+		`"expires": null, "cause": "attack"}, `+
+		`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
+		`"expires": null, "cause": "atack"}]}`,
+		`: entry 2's cause "atack" is not limit or attack`)
+}
+
 func TestUnknownVersionStopsTheStart(t *testing.T) {
 	t.Parallel()
 
@@ -881,6 +896,7 @@ func newParams(dir string) state.Params {
 			LimitBanDuration:     time.Hour,
 			LimitBanRepeatWindow: 24 * time.Hour,
 			MaxBanDuration:       7 * 24 * time.Hour,
+			AttackBanDuration:    7 * 24 * time.Hour,
 			MaxBans:              5000,
 		}),
 		Limiter: ratelimit.New(ratelimit.Limits{}),
@@ -893,14 +909,17 @@ func newParams(dir string) state.Params {
 	}
 }
 
-// fill puts a ban that ends and one that does not, clients with counts
-// and histories, and GeoJS answers into the parts of params.
+// fill puts a permanent ban without a cause, as an admin adds one, a ban
+// for a broken limit and one for a clear sign of attack, clients with
+// counts and histories, and GeoJS answers into the parts of params.
 func fill(params state.Params) {
 	now := midnight()
 	client := netip.MustParsePrefix("203.0.113.9/32")
 
 	params.Ledger.Load([]bans.Ban{permanentBan()})
 	params.Ledger.BanForLimit(client, now, bans.Notes{Country: "DE", Limit: 1})
+	params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
+		bans.Notes{RuleID: "env-file", Target: "path"})
 
 	for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
 		params.Limiter.Count(netip.MustParsePrefix(c), now)
@@ -939,7 +958,7 @@ func permanentBan() bans.Ban {
 			},
 			Requests:    1500,
 			Refused:     3,
-			EarlierBans: 5,
+			EarlierBans: bans.EarlierBans{Limit: 3, Attack: 1, WithoutCause: 1},
 		},
 	}
 }