Lower limits for listed AS numbers and countries (closes #21)

SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT give the clients of the AS numbers and countries they list that percentage of every rate and byte limit, rounded down; SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take its place for the byte limits of those they list; SWWAF_UNKNOWN_LIMIT_PERCENT (100) covers clients without a country. The lowest applies. While one lowers a limit, a request waits for its client's lookup, and SWWAF_LOOKUP_SOURCE=off stops the start. Log lines give limit_percent and bytes_percent with their settings; ban notes, and so alerts, give the broken limit's. Judgement call: a client without a country is unknown, whatever its AS number. Judgement call: bytes_percent and its setting are log fields SPEC does not name. Rule suppressed: funlen on FromEnvironment, one line per setting. Model: opus-5-5
2026-10-07 14:22:01 +02:00
parent f35e3ddfe8
commit 2421cdc273
17 changed files with 1102 additions and 109 deletions
@@ -120,6 +120,22 @@ type Config struct {
 	// capitals, as GeoJS gives them.
 	DeniedCountries             []string
 	ExclusivelyAllowedCountries []string
+	// The biased thresholds. ASNLimitPercent and CountryLimitPercent give
+	// the clients of the AS numbers and the countries they list that
+	// percentage of every rate limit and byte limit
+	// (SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT).
+	// ASNBytesPercent and CountryBytesPercent give those they list a
+	// percentage of the byte limits in place of that one
+	// (SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT). Each holds
+	// percentages from 0 to 100, by AS number, written as AS64496, or by
+	// country, a two-letter code in capitals, as the lookup gives them.
+	// UnknownLimitPercent is the percentage of every limit a client without
+	// a country gets (SWWAF_UNKNOWN_LIMIT_PERCENT).
+	ASNLimitPercent     map[string]int64
+	CountryLimitPercent map[string]int64
+	ASNBytesPercent     map[string]int64
+	CountryBytesPercent map[string]int64
+	UnknownLimitPercent int64
 	// BanResponse is the status a refused client is answered with, 403
 	// or 429, or 0 to close the connection without an answer
 	// (SWWAF_BAN_RESPONSE). It answers a banned client, a request that
@@ -300,6 +316,11 @@ var (
 			"source_failure or file_error")
 	errNotNumberOrOff = errors.New("is not a whole number above zero, such as 60, or off")
 	errNotUTF8        = errors.New("is not valid UTF-8")
+	errNotASN         = errors.New("is not an AS number such as AS64496")
+	errNotPercentItem = errors.New(
+		"is not a code, : and a percentage, such as AS64496:50 or cn:25")
+	errNotPercent  = errors.New("is not a percentage, a whole number from 0 to 100")
+	errListedTwice = errors.New("is listed twice")
 )

 // FromEnvironment reads the settings with lookupEnv, normally
@@ -307,6 +328,8 @@ var (
 // named by the setting's name with _FILE added names the file, which is
 // read now (see lookup). A setting that is not set takes its default. A
 // setting that is set but invalid is an error that names it.
+//
+//nolint:funlen // one line for each setting, a list that grows with them
 func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	cfg := &Config{
@@ -342,6 +365,11 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
 			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
+		ASNLimitPercent:      env.percents("SWWAF_ASN_LIMIT_PERCENT", parseASN),
+		CountryLimitPercent:  env.percents("SWWAF_COUNTRY_LIMIT_PERCENT", parseCountry),
+		ASNBytesPercent:      env.percents("SWWAF_ASN_BYTES_PERCENT", parseASN),
+		CountryBytesPercent:  env.percents("SWWAF_COUNTRY_BYTES_PERCENT", parseCountry),
+		UnknownLimitPercent:  env.percent("SWWAF_UNKNOWN_LIMIT_PERCENT", "100"),
 		BanResponse:          env.banResponse("SWWAF_BAN_RESPONSE", "403"),
 		LimitBanDuration:     env.durationNotOff("SWWAF_LIMIT_BAN_DURATION", "1h"),
 		LimitBanRepeatWindow: env.durationNotOff("SWWAF_LIMIT_BAN_REPEAT_WINDOW", "24h"),
@@ -592,6 +620,25 @@ func (e *environment) countries(name, defaultValue string) []string {
 	return countries
 }

+// percents reads a setting that is a list of AS numbers or countries,
+// which parseCode reads, each with a percentage. It is empty by default.
+func (e *environment) percents(
+	name string, parseCode func(string) (string, error),
+) map[string]int64 {
+	percents, err := parsePercents(e.value(name, ""), parseCode)
+	e.check(name, err)
+
+	return percents
+}
+
+// percent reads a setting that is a percentage, from 0 to 100.
+func (e *environment) percent(name, defaultValue string) int64 {
+	percent, err := parsePercent(e.value(name, defaultValue))
+	e.check(name, err)
+
+	return percent
+}
+
 // lookupSource reads the setting that is where clients are looked up:
 // geojs, file, or off.
 func (e *environment) lookupSource(name, defaultValue string) string {
@@ -619,7 +666,9 @@ func (e *environment) checkLookupDBPath(cfg *Config) {

 // checkCountriesAndLookups refuses a country on both country lists, and,
 // while SWWAF_LOOKUP_SOURCE is off, each setting that needs clients looked
-// up: the country lists and SWWAF_ADD_LOOKUP_HEADERS.
+// up: the country lists, SWWAF_ADD_LOOKUP_HEADERS, and the biased
+// thresholds, of which SWWAF_UNKNOWN_LIMIT_PERCENT needs them only below
+// 100, where it lowers a limit.
 func (e *environment) checkCountriesAndLookups(cfg *Config) {
 	for _, country := range cfg.ExclusivelyAllowedCountries {
 		if slices.Contains(cfg.DeniedCountries, country) {
@@ -639,6 +688,11 @@ func (e *environment) checkCountriesAndLookups(cfg *Config) {
 		{"SWWAF_DENIED_COUNTRIES", len(cfg.DeniedCountries) > 0},
 		{"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
 		{"SWWAF_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
+		{"SWWAF_ASN_LIMIT_PERCENT", len(cfg.ASNLimitPercent) > 0},
+		{"SWWAF_COUNTRY_LIMIT_PERCENT", len(cfg.CountryLimitPercent) > 0},
+		{"SWWAF_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
+		{"SWWAF_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
+		{"SWWAF_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
 	} {
 		if setting.set {
 			e.check(setting.name, fmt.Errorf("is set while SWWAF_LOOKUP_SOURCE is off; %w",
@@ -1148,13 +1202,12 @@ func parseCountries(value string) ([]string, error) {
 		return nil, err
 	}

-	known := strings.Fields(countryCodes)
 	countries := make([]string, 0, len(items))

 	for _, item := range items {
-		country := strings.ToUpper(item)
-		if !slices.Contains(known, country) {
-			return nil, fmt.Errorf("%q %w", item, errNotCountry)
+		country, err := parseCountry(item)
+		if err != nil {
+			return nil, err
 		}

 		countries = append(countries, country)
@@ -1163,6 +1216,81 @@ func parseCountries(value string) ([]string, error) {
 	return countries, nil
 }

+// parseCountry reads a country code in either case, and returns it in
+// capitals.
+func parseCountry(value string) (string, error) {
+	country := strings.ToUpper(value)
+	if !slices.Contains(strings.Fields(countryCodes), country) {
+		return "", fmt.Errorf("%q %w", value, errNotCountry)
+	}
+
+	return country, nil
+}
+
+// parseASN reads an AS number such as AS64496, in either case, and
+// returns it as the lookup gives it: AS and the number, in capitals and
+// without leading zeros.
+func parseASN(value string) (string, error) {
+	digits, hasAS := strings.CutPrefix(strings.ToUpper(value), "AS")
+
+	number, err := strconv.ParseUint(digits, 10, 32)
+	if !hasAS || err != nil {
+		return "", fmt.Errorf("%q %w", value, errNotASN)
+	}
+
+	return "AS" + strconv.FormatUint(number, 10), nil
+}
+
+// parsePercents reads a comma-separated list of items, each an AS number
+// or a country, which parseCode reads, then : and a percentage, such as
+// AS64496:50 or cn:25, and returns each one's percentage. An empty value
+// is an empty list. An AS number or country listed twice is an error.
+func parsePercents(
+	value string, parseCode func(string) (string, error),
+) (map[string]int64, error) {
+	items, err := parseList(value)
+	if err != nil {
+		return nil, err
+	}
+
+	percents := make(map[string]int64, len(items))
+
+	for _, item := range items {
+		codeText, percentText, found := strings.Cut(item, ":")
+		if !found {
+			return nil, fmt.Errorf("%q %w", item, errNotPercentItem)
+		}
+
+		code, err := parseCode(codeText)
+		if err != nil {
+			return nil, err
+		}
+
+		percent, err := parsePercent(percentText)
+		if err != nil {
+			return nil, err
+		}
+
+		if _, listed := percents[code]; listed {
+			return nil, fmt.Errorf("%q %w", codeText, errListedTwice)
+		}
+
+		percents[code] = percent
+	}
+
+	return percents, nil
+}
+
+// parsePercent reads a percentage, a whole number from 0 to 100.
+func parsePercent(value string) (int64, error) {
+	percent, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || percent < 0 || percent > 100 {
+		return 0, fmt.Errorf("%q %w", value, errNotPercent)
+	}
+
+	return percent, nil
+}
+
 // headerNameChars are the characters RFC 9110 allows in a header name:
 // letters, digits and these marks.
 const headerNameChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" +
@@ -50,6 +50,11 @@ const (
 	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
 	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
 	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	asnLimitPercent         = "SWWAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent     = "SWWAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent         = "SWWAF_ASN_BYTES_PERCENT"
+	countryBytesPercent     = "SWWAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent     = "SWWAF_UNKNOWN_LIMIT_PERCENT"
 	banResponse             = "SWWAF_BAN_RESPONSE"
 	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
 	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
@@ -892,9 +897,14 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 	t.Parallel()

 	for name, value := range map[string]string{
-		deniedCountries:  "kp",
-		allowedCountries: "de",
-		addLookupHeaders: enabled,
+		deniedCountries:     "kp",
+		allowedCountries:    "de",
+		addLookupHeaders:    enabled,
+		asnLimitPercent:     "AS64496:50",
+		countryLimitPercent: "cn:25",
+		asnBytesPercent:     "AS64496:50",
+		countryBytesPercent: "cn:25",
+		unknownLimitPercent: "99",
 	} {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
@@ -909,12 +919,94 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 		})
 	}

-	// Set empty, the country lists need nothing looked up.
+	// Set empty, the lists need nothing looked up, and nor does
+	// SWWAF_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit.
 	fromEnvironment(t, environment{
 		lookupSource: off, deniedCountries: "", allowedCountries: "",
+		asnLimitPercent: "", countryLimitPercent: "", asnBytesPercent: "",
+		countryBytesPercent: "", unknownLimitPercent: "100",
 	})
 }

+func TestBiasedThresholdsAsSet(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{})
+	if len(cfg.ASNLimitPercent) != 0 || len(cfg.CountryLimitPercent) != 0 ||
+		len(cfg.ASNBytesPercent) != 0 || len(cfg.CountryBytesPercent) != 0 ||
+		cfg.UnknownLimitPercent != 100 {
+		t.Errorf("biased thresholds %v, %v, %v, %v and %d by default, "+
+			"want four empty lists and 100", cfg.ASNLimitPercent, cfg.CountryLimitPercent,
+			cfg.ASNBytesPercent, cfg.CountryBytesPercent, cfg.UnknownLimitPercent)
+	}
+
+	// AS numbers and countries in either case, an AS number with leading
+	// zeros, 0 and 100.
+	cfg = fromEnvironment(t, environment{
+		asnLimitPercent:     "AS14061:50, as16276:0,AS045102:100",
+		countryLimitPercent: "cn:25,RU:50",
+		asnBytesPercent:     "as16276:75",
+		countryBytesPercent: "ru:10",
+		unknownLimitPercent: "0",
+	})
+
+	for name, tc := range map[string]struct{ got, want map[string]int64 }{
+		asnLimitPercent: {
+			cfg.ASNLimitPercent,
+			map[string]int64{"AS14061": 50, "AS16276": 0, "AS45102": 100},
+		},
+		countryLimitPercent: {cfg.CountryLimitPercent, map[string]int64{"CN": 25, "RU": 50}},
+		asnBytesPercent:     {cfg.ASNBytesPercent, map[string]int64{"AS16276": 75}},
+		countryBytesPercent: {cfg.CountryBytesPercent, map[string]int64{"RU": 10}},
+	} {
+		if !maps.Equal(tc.got, tc.want) {
+			t.Errorf("%s gave %v, want %v", name, tc.got, tc.want)
+		}
+	}
+
+	if cfg.UnknownLimitPercent != 0 {
+		t.Errorf("%s gave %d, want 0", unknownLimitPercent, cfg.UnknownLimitPercent)
+	}
+}
+
+func TestInvalidBiasedThresholdStopsTheStartSayingWhatIsWrong(t *testing.T) {
+	t.Parallel()
+
+	const (
+		notASN     = " is not an AS number such as AS64496"
+		notItem    = " is not a code, : and a percentage, such as AS64496:50 or cn:25"
+		notPercent = " is not a percentage, a whole number from 0 to 100"
+	)
+
+	for _, tc := range []struct{ name, value, want string }{
+		{asnLimitPercent, "14061:50", `"14061"` + notASN},
+		{asnLimitPercent, "AS4294967296:50", `"AS4294967296"` + notASN},
+		{asnLimitPercent, "AS14061", `"AS14061"` + notItem},
+		{asnLimitPercent, "AS14061:101", `"101"` + notPercent},
+		{asnLimitPercent, "AS14061:50,as14061:25", `"as14061" is listed twice`},
+		{
+			countryLimitPercent, "nk:25",
+			`"nk" is not a two-letter country code such as de or kp`,
+		},
+		{countryLimitPercent, "cn:25,CN:50", `"CN" is listed twice`},
+		{asnBytesPercent, "AS14061:-1", `"-1"` + notPercent},
+		{countryBytesPercent, "cn:50%", `"50%"` + notPercent},
+		{unknownLimitPercent, "101", `"101"` + notPercent},
+		{unknownLimitPercent, off, `"off"` + notPercent},
+	} {
+		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+
+			want := tc.name + ": " + tc.want
+			if err == nil || err.Error() != want {
+				t.Errorf("error %v, want %s", err, want)
+			}
+		})
+	}
+}
+
 func TestSizesAndOff(t *testing.T) {
 	t.Parallel()

@@ -1054,6 +1146,14 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{allowedCountries, "uk"},
 		{allowedCountries, "zz"},
 		{allowedCountries, "de,germany"},
+		{asnLimitPercent, "AS14061:50,,AS16276:50"}, {asnLimitPercent, "ASX:50"},
+		{asnLimitPercent, "AS14061:"}, {asnLimitPercent, "AS14061 :50"},
+		{asnLimitPercent, "AS14061:1.5"}, {asnLimitPercent, "AS-1:50"},
+		{countryLimitPercent, "cn"}, {countryLimitPercent, "cn:"},
+		{countryLimitPercent, "cn:25:50"}, {countryLimitPercent, "china:25"},
+		{asnBytesPercent, "AS14061:101"}, {countryBytesPercent, "su:50"},
+		{unknownLimitPercent, ""}, {unknownLimitPercent, "-1"},
+		{unknownLimitPercent, "50%"},
 		{metricsTopN, off}, {metricsTopN, "0"}, {metricsTopN, "-1"},
 		{logRequestHeaders, "accept,,origin"}, {logRequestHeaders, "accept;origin"},
 		{logRequestHeaders, "accept language"}, {logRequestHeaders, "x-foo:"},
@@ -1325,6 +1425,11 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		addLookupHeaders:        "false",
 		deniedCountries:         "",
 		allowedCountries:        "",
+		asnLimitPercent:         "",
+		countryLimitPercent:     "",
+		asnBytesPercent:         "",
+		countryBytesPercent:     "",
+		unknownLimitPercent:     "100",
 		banResponse:             "403",
 		limitBanDuration:        "1h",
 		limitBanRepeatWindow:    "24h",