Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

The IPv6 group that is one client, the size of the table of clients and the level of the process's own lines become settings. clientGroup reads the group length from them, so limits, bans, history, lookups, AbuseIPDB scores and per-client anomaly counters all follow it; ratelimit.New takes the table size; the process logger takes the level once the settings are read, and request lines, written apart from it, are never held back. Judgement call: SWWAF_IPV6_GROUP_PREFIX accepts 32 to 128, the issue's example range. Judgement call: the log level test picks a free port by listening and closing, since at warn no starting line gives the address. Model: opus-5-5
2026-10-07 21:22:16 +00:00
parent ca787985f8
commit 235ff0707f
26 changed files with 466 additions and 104 deletions
@@ -48,6 +48,12 @@ type Config struct {
 	// TrustedProxies are the netblocks whose X-Forwarded-For is
 	// believed (SWWAF_TRUSTED_PROXIES).
 	TrustedProxies []netip.Prefix
+	// IPv6GroupPrefix is the length of the IPv6 netblock that is one client
+	// (SWWAF_IPV6_GROUP_PREFIX), from 32 to 128.
+	IPv6GroupPrefix int
+	// MaxTrackedClients is the most clients the table of clients holds, in
+	// memory and in clients.json (SWWAF_MAX_TRACKED_CLIENTS).
+	MaxTrackedClients int
 	// ClientRequestTimeout bounds reading the whole request from the
 	// client (SWWAF_CLIENT_REQUEST_TIMEOUT).
 	ClientRequestTimeout time.Duration
@@ -209,6 +215,9 @@ type Config struct {
 	// LogRequestHeaders are the request headers whose values the request
 	// log gives, in lower case (SWWAF_LOG_REQUEST_HEADERS).
 	LogRequestHeaders []string
+	// LogLevel is the least severe of the process's own messages that are
+	// written (SWWAF_LOG_LEVEL). It holds back no request log line.
+	LogLevel slog.Level
 	// AdminToken is the bearer token an admin sends for the ban endpoints
 	// and /_smallwebwaf/clients/<ip> (SWWAF_ADMIN_TOKEN), "" while it is
 	// unset and they are off.
@@ -297,6 +306,10 @@ const (
 	gibibyte = 1 << 30
 	ipv4Bits = 32
 	ipv6Bits = 128
+	// minIPv6GroupPrefix is the shortest SWWAF_IPV6_GROUP_PREFIX, the
+	// netblock a provider is usually given: a shorter one would make one
+	// client of the customers of several providers.
+	minIPv6GroupPrefix = 32
 	// minTokenLength is the fewest characters a token may have.
 	minTokenLength = 32
 	// masked is what the log shows for a token that is set, and in place of
@@ -346,6 +359,9 @@ var (
 		"is not the length of an IPv4 netblock, from 0 to 32, such as 24")
 	errNotV6Prefix = errors.New(
 		"is not the length of an IPv6 netblock, from 0 to 128, such as 48")
+	errNotIPv6GroupPrefix = errors.New(
+		"is not the length of an IPv6 netblock, from 32 to 128, such as 64")
+	errNotLogLevel      = errors.New("is not debug, info, warn or error")
 	errNotNamedNetblock = errors.New(
 		"is not a name, = and a netblock, such as office=203.0.113.0/24")
 	errNotAbsolutePath = errors.New(
@@ -411,6 +427,8 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		InstanceName:         env.instanceName(),
 		Observe:              env.observe("SWWAF_MODE", "enforce"),
 		TrustedProxies:       env.netblocks("SWWAF_TRUSTED_PROXIES", privateRanges),
+		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWWAF_IPV6_GROUP_PREFIX", "64"),
+		MaxTrackedClients:    env.numberNotOff("SWWAF_MAX_TRACKED_CLIENTS", "20000"),
 		ClientRequestTimeout: env.duration("SWWAF_CLIENT_REQUEST_TIMEOUT", "60s"),
 		ClientRequestHeaderMaxBytes: env.headerSize(
 			"SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES", "32K"),
@@ -465,6 +483,7 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		StateCounterInterval: env.durationNotOff("SWWAF_STATE_COUNTER_INTERVAL", "15m"),
 		LogRequestHeaders: env.headerNames("SWWAF_LOG_REQUEST_HEADERS",
 			"accept,accept-language,accept-encoding,content-type,origin,range"),
+		LogLevel:             env.logLevel("SWWAF_LOG_LEVEL", "info"),
 		AdminToken:           env.token("SWWAF_ADMIN_TOKEN"),
 		MetricsToken:         env.token("SWWAF_METRICS_TOKEN"),
 		MetricsTopN:          env.numberNotOff("SWWAF_METRICS_TOP_N", "50"),
@@ -944,6 +963,37 @@ func (e *environment) v6Prefix(name, defaultValue string) int {
 	return length
 }

+// ipv6GroupPrefix reads the setting that is the length of the IPv6
+// netblock that is one client, from minIPv6GroupPrefix to 128.
+func (e *environment) ipv6GroupPrefix(name, defaultValue string) int {
+	value := e.value(name, defaultValue)
+
+	length, err := strconv.Atoi(value)
+	if err != nil || length < minIPv6GroupPrefix || length > ipv6Bits {
+		e.check(name, fmt.Errorf("%q %w", value, errNotIPv6GroupPrefix))
+	}
+
+	return length
+}
+
+// logLevel reads the setting that is the least severe of the process's
+// own messages that are written: debug, info, warn or error.
+func (e *environment) logLevel(name, defaultValue string) slog.Level {
+	value := e.value(name, defaultValue)
+
+	level, known := map[string]slog.Level{
+		"debug": slog.LevelDebug,
+		"info":  slog.LevelInfo,
+		"warn":  slog.LevelWarn,
+		"error": slog.LevelError,
+	}[value]
+	if !known {
+		e.check(name, fmt.Errorf("%q %w", value, errNotLogLevel))
+	}
+
+	return level
+}
+
 // thresholds reads the four anomaly thresholds whose settings' names
 // start with prefix: requests and bytes per minute and per hour. Each is
 // off by default.
@@ -27,6 +27,8 @@ const (
 	upstreamURL             = "SWWAF_UPSTREAM_URL"
 	mode                    = "SWWAF_MODE"
 	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
+	ipv6GroupPrefix         = "SWWAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients       = "SWWAF_MAX_TRACKED_CLIENTS"
 	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
 	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
 	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
@@ -84,6 +86,7 @@ const (
 	metricsTopN             = "SWWAF_METRICS_TOP_N"
 	instanceName            = "SWWAF_INSTANCE_NAME"
 	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
+	logLevel                = "SWWAF_LOG_LEVEL"
 	rulesDir                = "SWWAF_RULES_DIR"
 	rulesEnabled            = "SWWAF_RULES_ENABLED"
 	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
@@ -399,6 +402,57 @@ func TestValuesAsSet(t *testing.T) {
 	wantCountries(t, allowedCountries, cfg.ExclusivelyAllowedCountries, "DE")
 }

+func TestIPv6GroupPrefixMaxTrackedClientsAndLogLevel(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		env             environment
+		prefix, clients int
+		level           slog.Level
+	}{
+		{environment{}, 64, 20000, slog.LevelInfo},
+		{
+			environment{ipv6GroupPrefix: "48", maxTrackedClients: "500", logLevel: "warn"},
+			48, 500, slog.LevelWarn,
+		},
+	} {
+		cfg := fromEnvironment(t, tc.env)
+		if cfg.IPv6GroupPrefix != tc.prefix || cfg.MaxTrackedClients != tc.clients ||
+			cfg.LogLevel != tc.level {
+			t.Errorf("%v gave %d, %d and %v, want %d, %d and %v", tc.env,
+				cfg.IPv6GroupPrefix, cfg.MaxTrackedClients, cfg.LogLevel,
+				tc.prefix, tc.clients, tc.level)
+		}
+	}
+}
+
+func TestIPv6GroupPrefixFrom32To128(t *testing.T) {
+	t.Parallel()
+
+	for _, length := range []int{32, 128} {
+		cfg := fromEnvironment(t, environment{ipv6GroupPrefix: strconv.Itoa(length)})
+		if cfg.IPv6GroupPrefix != length {
+			t.Errorf("%s=%d gave %d", ipv6GroupPrefix, length, cfg.IPv6GroupPrefix)
+		}
+	}
+}
+
+func TestEachLogLevel(t *testing.T) {
+	t.Parallel()
+
+	for value, want := range map[string]slog.Level{
+		"debug": slog.LevelDebug,
+		"info":  slog.LevelInfo,
+		"warn":  slog.LevelWarn,
+		"error": slog.LevelError,
+	} {
+		cfg := fromEnvironment(t, environment{logLevel: value})
+		if cfg.LogLevel != want {
+			t.Errorf("%s=%s gave %v, want %v", logLevel, value, cfg.LogLevel, want)
+		}
+	}
+}
+
 func TestByteLimitSettingsAsSet(t *testing.T) {
 	t.Parallel()

@@ -1698,6 +1752,10 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{trustedProxies, "traefik"},
 		{trustedProxies, "10.0.0.0/8,,192.168.0.0/16"},
 		{trustedProxies, "fe80::1%eth0"},
+		{ipv6GroupPrefix, "31"}, {ipv6GroupPrefix, "129"}, {ipv6GroupPrefix, "/64"},
+		{ipv6GroupPrefix, off}, {ipv6GroupPrefix, ""},
+		{maxTrackedClients, "0"}, {maxTrackedClients, "-1"}, {maxTrackedClients, off},
+		{maxTrackedClients, "20K"},
 		{allowNets, "192.0.2.0/24,monitoring"},
 		{rateLimitExemptNets, "2001:db8::/129"},
 		{denyNets, "198.51.100.0/24,"},
@@ -1751,6 +1809,7 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{logRequestHeaders, "accept language"}, {logRequestHeaders, "x-foo:"},
 		{logRequestHeaders, "host"}, {logRequestHeaders, "accept,Host"},
 		{logRequestHeaders, "transfer-encoding"}, {logRequestHeaders, "TRANSFER-ENCODING"},
+		{logLevel, "INFO"}, {logLevel, "warning"}, {logLevel, "trace"}, {logLevel, ""},
 		{rulesEnabled, "yes"}, {rulesEnabled, "True"},
 	})
 }
@@ -1993,6 +2052,8 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		upstreamURL:             "http://127.0.0.1:8081",
 		mode:                    "enforce",
 		trustedProxies:          "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
+		ipv6GroupPrefix:         "64",
+		maxTrackedClients:       "20000",
 		clientRequestTimeout:    "45s",
 		clientHeaderMaxBytes:    "32K",
 		clientIdleTimeout:       "120s",
@@ -2050,6 +2111,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		metricsTopN:             "50",
 		instanceName:            hostname,
 		logRequestHeaders:       defaultLogRequestHeaders,
+		logLevel:                "info",
 		rulesDir:                "/etc/smallwebwaf/rules.d",
 		rulesEnabled:            "true",
 		logRemoteURL:            "",