servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal now logs heuristic, the name of the heuristic that made
it, and heuristic_figures, the figures it acted on. A ban by
refusal_limit or byte_limits after the answer logs after_answer_heuristic
and after_answer_heuristic_figures instead, so a line can name both. All
four are in docs/request-log.md, and SPEC.md names each heuristic at its
step.

Model: opus-5-5

internal/servewaf/request.go

@@ -160,16 +160,20 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 }
 
 // check is the one place where a request can be refused. It returns nil to let
-// the request through. The checks of checkClient decide: a request they refuse
-// is answered with SWWAF_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
-// or 431 for the header limits. In observe mode nothing is refused, and the log
-// line names what enforce mode would have done. ctx is the request's own context.
+// the request through. The heuristics of checkClient decide: a request they
+// refuse is answered with SWWAF_BAN_RESPONSE, 403 for a block rule or the Core
+// Rule Set, or 431 for the header limits. In observe mode nothing is refused,
+// and the log line names what enforce mode would have done. ctx is the
+// request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
-	action := rq.checkClient(ctx)
+	v := rq.checkClient(ctx)
+	if v == nil {
+		return nil
+	}
+
+	action := v.action
 
 	switch {
-	case action == "":
-		return nil
 	case rq.h.config.Observe:
 		rq.line.WouldAction = action
 
@@ -183,35 +187,21 @@ func (rq *request) check(ctx context.Context) *refusal {
 	}
 }
 
-// checkClient runs the checks on the request's client, and returns the
-// action of the first that refuses the request, or "" when none does. A
-// client in SWWAF_ALLOW_NETS skips them, and is not looked up. For any
-// other client, SWWAF_DENY_NETS comes first, then a ban on its netblock,
-// so that a client either refuses is not looked up, then the lookup of
-// its AS number and country, then the country lists, then the blocklists,
-// then the CrowdSec decision list, which bans the client it lists, then
-// the DNSBL zones' verdicts, and then AbuseIPDB's score; a request any of
-// them refuses is not counted for the rate limits. Then come the
-// rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
-// request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
-// every other request is counted, each of them by the client's limit
-// percentages, then SWWAF_TRAP_PATHS, then the rule files, then the header
-// limits, and last the Core Rule Set. A request exempt from the rate limits
-// is exempt from the byte limits too. ctx is the request's own context.
-func (rq *request) checkClient(ctx context.Context) string {
-	cfg := rq.h.config
-	if isInside(rq.client, cfg.AllowNets) {
-		return ""
+// checkClient runs the heuristics of beforeLookup on the request, then looks
+// up the client's AS number and country, then runs those of afterLookup. It
+// returns the first verdict, or nil when none gives one. A client in
+// SWWAF_ALLOW_NETS skips them all, and is not looked up. ctx is the request's
+// own context.
+func (rq *request) checkClient(ctx context.Context) *verdict {
+	if isInside(rq.client, rq.h.config.AllowNets) {
+		return nil
 	}
 
 	now := rq.h.now()
 
-	if isInside(rq.client, cfg.DenyNets) {
-		return requestlog.ActionDenied
-	}
-
-	if rq.banned(now) {
-		return requestlog.ActionBanned
+	v := rq.runHeuristics(ctx, beforeLookup(), now)
+	if v != nil {
+		return v
 	}
 
 	rq.lookUp(ctx, now)
@@ -220,59 +210,7 @@ func (rq *request) checkClient(ctx context.Context) string {
 	// again: a request counted at the time it arrived could be counted
 	// after a later one of its client's, which the rate limits would take
 	// for the clock set back.
-	now = rq.h.now()
-
-	if rq.countryDenied() {
-		return requestlog.ActionCountryDenied
-	}
-
-	if rq.blocklistDenied() {
-		return requestlog.ActionDenied
-	}
-
-	if rq.crowdSecBanned(now) {
-		return requestlog.ActionBanned
-	}
-
-	if rq.dnsblDenied(ctx) || rq.abuseIPDBDenied(ctx) {
-		return requestlog.ActionDenied
-	}
-
-	rq.counted = rq.countedByRateLimits()
-	if rq.counted {
-		rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
-		rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
-		rq.line.BytesPercent, rq.line.BytesPercentSetting = rq.bytesPercent.logged()
-	}
-
-	if rq.counted && rq.limitBroken(now) {
-		return requestlog.ActionRateLimited
-	}
-
-	if rq.trapPath(now) {
-		return requestlog.ActionBanned
-	}
-
-	action := rq.checkRules(now)
-	if action != "" {
-		return action
-	}
-
-	if rq.overHeaderLimits() {
-		return requestlog.ActionTooLarge
-	}
-
-	return rq.checkCoreRuleSet()
-}
-
-// countedByRateLimits reports whether the rate limits count the request: its
-// client is not in SWWAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
-// under SWWAF_RATE_LIMIT_EXEMPT_PATHS.
-func (rq *request) countedByRateLimits() bool {
-	cfg := rq.h.config
-
-	return !isInside(rq.client, cfg.RateLimitExemptNets) &&
-		!pathExempt(rq.in, cfg.RateLimitExemptPaths)
+	return rq.runHeuristics(ctx, afterLookup(), rq.h.now())
 }
 
 // pathExempt reports whether r is exempt under prefixes,