Lower limits for listed AS numbers and countries (closes #21)

SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT give the clients
of the AS numbers and countries they list that percentage of every rate
and byte limit, rounded down; SWWAF_ASN_BYTES_PERCENT and
SWWAF_COUNTRY_BYTES_PERCENT take its place for the byte limits of those
they list; SWWAF_UNKNOWN_LIMIT_PERCENT (100) covers clients without a
country. The lowest applies. While one lowers a limit, a request waits
for its client's lookup, and SWWAF_LOOKUP_SOURCE=off stops the start. Log
lines give limit_percent and bytes_percent with their settings; ban
notes, and so alerts, give the broken limit's.

Judgement call: a client without a country is unknown, whatever its AS number.
Judgement call: bytes_percent and its setting are log fields SPEC does not name.
Rule suppressed: funlen on FromEnvironment, one line per setting.

Model: opus-5-5

internal/proxy/bans.go

@@ -42,9 +42,11 @@ func (rq *request) banned(now time.Time) bool {
 
 // limitBroken counts the request for the rate limits at now, notes the
 // client's counts for the log line, and reports whether the request takes
-// the client over a rate limit, which breaks it.
+// the client over a rate limit, as its limit percentage lowers it, which
+// breaks it.
 func (rq *request) limitBroken(now time.Time) bool {
-	counts, hit, over := rq.h.limiter.Count(clientGroup(rq.client), now)
+	counts, hit, over := rq.h.limiter.Count(clientGroup(rq.client), now,
+		rq.limitPercent.percent)
 	rq.line.Counts = counts
 
 	if over {
@@ -63,8 +65,9 @@ func (rq *request) limitBroken(now time.Time) bool {
 // what it carried from the client with the request's. Only a request
 // passed to the app has them counted, and only one the rate limits
 // counted; in observe mode, not one that enforce mode would have refused.
-// Bytes that take the client over a byte limit break it; the response was
-// passed on whole.
+// Bytes that take the client over a byte limit, as its limit percentage
+// for the byte limits lowers it, break it; the response was passed on
+// whole.
 func (rq *request) countBytes() {
 	if !rq.counted || rq.line.WouldAction != "" {
 		return
@@ -89,7 +92,8 @@ func (rq *request) countBytes() {
 
 	now := rq.h.now()
 
-	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now, bytes)
+	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now, bytes,
+		rq.bytesPercent.percent)
 	rq.line.Counts.MinuteBytes = counts.MinuteBytes
 	rq.line.Counts.HourBytes = counts.HourBytes
 	rq.line.Counts.DayBytes = counts.DayBytes
@@ -103,9 +107,10 @@ func (rq *request) countBytes() {
 // one hit names, and notes the offence for the log line. status is what
 // the client was sent, or is sent: SWWAF_BAN_RESPONSE for a request over
 // a rate limit, the app's answer for one whose bytes broke a byte limit.
-// The ban sets the client's counters back to zero. In observe mode it
-// makes no ban and sets nothing back, and raises the alert for the ban it
-// would have made, if that alert would be sent.
+// The ban's notes give the client's limit percentage for that kind of
+// limit. The ban sets the client's counters back to zero. In observe mode
+// it makes no ban and sets nothing back, and raises the alert for the ban
+// it would have made, if that alert would be sent.
 func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	rq.line.LimitHit = hit.Window
 	if hit.Kind == ratelimit.KindBytes {
@@ -131,6 +136,13 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 		Requests: rq.netblockRequests(netblock),
 	}
 
+	percent := rq.limitPercent
+	if hit.Kind == ratelimit.KindBytes {
+		percent = rq.bytesPercent
+	}
+
+	notes.LimitPercent, notes.LimitPercentSetting = percent.logged()
+
 	if rq.h.config.Observe {
 		ban, wouldBan := rq.h.ledger.WouldBanForLimit(netblock, now, notes)
 		if wouldBan {

internal/proxy/biased.go

@@ -0,0 +1,96 @@
+package proxy
+
+import (
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+// whole is the percentage of each limit a client gets when no biased
+// threshold lowers its limits.
+const whole = 100
+
+// percentage is a client's limit percentage for the rate limits or for
+// the byte limits, as the biased thresholds give it, and the setting that
+// gave it: "" with whole when none lowers that kind of limit.
+type percentage struct {
+	percent int64
+	setting string
+}
+
+// biasedThresholdsSet reports whether a biased threshold can lower a
+// client's limits: one of its lists is not empty, or
+// SWWAF_UNKNOWN_LIMIT_PERCENT is below 100. The client's lookup is then
+// needed before its request goes on.
+func biasedThresholdsSet(cfg *config.Config) bool {
+	return len(cfg.ASNLimitPercent) > 0 || len(cfg.CountryLimitPercent) > 0 ||
+		len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
+		cfg.UnknownLimitPercent < whole
+}
+
+// limitPercentages returns a client's limit percentages, for the rate
+// limits and for the byte limits, by its AS number and country as looked
+// up, each "" when unknown. Each is the lowest of those the settings give
+// it, the first of them in the order below when several are lowest: the
+// percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one
+// SWWAF_COUNTRY_LIMIT_PERCENT gives its country, and, for a client
+// without a country, SWWAF_UNKNOWN_LIMIT_PERCENT. For the byte limits,
+// SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take the place
+// of the first two for an AS number or a country they list.
+func limitPercentages(
+	cfg *config.Config, asn, country string,
+) (percentage, percentage) {
+	unknown := percentage{percent: whole}
+	if country == "" {
+		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
+	}
+
+	asnRequests := given(cfg.ASNLimitPercent, asn, "SWWAF_ASN_LIMIT_PERCENT")
+	countryRequests := given(cfg.CountryLimitPercent, country,
+		"SWWAF_COUNTRY_LIMIT_PERCENT")
+
+	asnBytes, countryBytes := asnRequests, countryRequests
+	if _, listed := cfg.ASNBytesPercent[asn]; listed {
+		asnBytes = given(cfg.ASNBytesPercent, asn, "SWWAF_ASN_BYTES_PERCENT")
+	}
+
+	if _, listed := cfg.CountryBytesPercent[country]; listed {
+		countryBytes = given(cfg.CountryBytesPercent, country, "SWWAF_COUNTRY_BYTES_PERCENT")
+	}
+
+	return lowest(asnRequests, countryRequests, unknown),
+		lowest(asnBytes, countryBytes, unknown)
+}
+
+// given returns the percentage percents, the setting named setting, gives
+// code, an AS number or a country, or whole when it does not list code.
+func given(percents map[string]int64, code, setting string) percentage {
+	percent, listed := percents[code]
+	if !listed {
+		return percentage{percent: whole}
+	}
+
+	return percentage{percent, setting}
+}
+
+// lowest returns the lowest of percentages below whole, the first of them
+// when several are lowest, or whole when none is below it.
+func lowest(percentages ...percentage) percentage {
+	low := percentage{percent: whole}
+
+	for _, p := range percentages {
+		if p.percent < low.percent {
+			low = p
+		}
+	}
+
+	return low
+}
+
+// logged returns p as the log line and the notes of a ban give it: its
+// percent and setting, or nil and "" for whole, which they leave out.
+func (p percentage) logged() (*int64, string) {
+	if p.percent == whole {
+		return nil, ""
+	}
+
+	return &p.percent, p.setting
+}

internal/proxy/biased_test.go

@@ -0,0 +1,494 @@
+package proxy_test
+
+import (
+	"fmt"
+	"io"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The biased thresholds.
+const (
+	asnLimitPercent     = "SWWAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent = "SWWAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent     = "SWWAF_ASN_BYTES_PERCENT"
+	countryBytesPercent = "SWWAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent = "SWWAF_UNKNOWN_LIMIT_PERCENT"
+)
+
+const (
+	// asnDEHalf and countryDEHalf give fromDE's AS number and its country
+	// half of every limit, and asnDEQuarter gives its AS number a quarter.
+	asnDEHalf     = asnDE + ":50"
+	asnDEQuarter  = asnDE + ":25"
+	countryDEHalf = "de:50"
+	// noCountry is in an AS of its own, AS64500, and in no country.
+	noCountry = "192.0.2.80"
+	// fourAMinute is the rate limit these tests set: half of it is 2
+	// requests a minute, a quarter of it 1.
+	fourAMinute = "4"
+	// twoUploads is the byte limit these tests set: 199 bytes, which an
+	// upload, a request with a body and its answer, 100 bytes, is within,
+	// and half of which, 99 bytes, it is over.
+	twoUploads = "199"
+	// none is how percentText gives a percentage left out.
+	none = "none"
+)
+
+func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting, value, from string
+	}{
+		{asnLimitPercent, asnDEHalf, fromDE},
+		{countryLimitPercent, countryDEHalf, fromDE},
+		{unknownLimitPercent, "50", unplaced},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startWithLookups(t, map[string]string{
+				rateLimitPerMinute: fourAMinute, tc.setting: tc.value,
+			})
+
+			// Half of 4 requests a minute: the third breaks the limit.
+			for _, sent := range []struct {
+				status int
+				action string
+			}{
+				{http.StatusOK, requestlog.ActionForward},
+				{http.StatusOK, requestlog.ActionForward},
+				{http.StatusForbidden, requestlog.ActionRateLimited},
+			} {
+				line := s.get(tc.from, sent.status, sent.action)
+				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+					"50 from "+tc.setting)
+			}
+
+			// fromKP, which no setting lists, has the whole limit.
+			for range 3 {
+				line := s.get(fromKP, http.StatusOK, requestlog.ActionForward)
+				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+					none)
+			}
+		})
+	}
+}
+
+func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
+	t.Parallel()
+
+	// The AS numbers and countries are given in either case.
+	for _, tc := range []struct {
+		setting, value, from string
+	}{
+		{asnLimitPercent, asnDEHalf, fromDE},
+		{countryLimitPercent, "DE:50", fromDE},
+		{unknownLimitPercent, "50", unplaced},
+		{asnBytesPercent, "as64496:50", fromDE},
+		{countryBytesPercent, countryDEHalf, fromDE},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startWithLookups(t, map[string]string{
+				bytesLimitPerMinute: twoUploads, tc.setting: tc.value,
+			})
+
+			// The upload's 100 bytes are over half of 199, 99.
+			line := s.uploadFrom(tc.from)
+			if line.LimitHit != minuteBytes {
+				t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
+			}
+
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				"50 from "+tc.setting)
+
+			// fromKP, which no setting lists, has the whole limit.
+			line = s.uploadFrom(fromKP)
+			if line.LimitHit != "" {
+				t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
+			}
+
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting, none)
+		})
+	}
+}
+
+func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// limitPercent and bytesPercent are the log line's, as percentText
+		// gives them, and limitHit is its limit_hit.
+		limitPercent, bytesPercent, limitHit string
+	}{
+		{
+			"lowering the byte limits alone",
+			map[string]string{asnBytesPercent: asnDEHalf},
+			none, "50 from " + asnBytesPercent, minuteBytes,
+		},
+		{
+			"lowering the byte limits alone, by country",
+			map[string]string{countryBytesPercent: countryDEHalf},
+			none, "50 from " + countryBytesPercent, minuteBytes,
+		},
+		{
+			"raising the byte limits back",
+			map[string]string{asnLimitPercent: asnDEHalf, asnBytesPercent: asnDE + ":100"},
+			"50 from " + asnLimitPercent, none, "",
+		},
+		{
+			"raising the byte limits back, by country",
+			map[string]string{countryLimitPercent: countryDEHalf, countryBytesPercent: "de:100"},
+			"50 from " + countryLimitPercent, none, "",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{bytesLimitPerMinute: twoUploads}
+			maps.Copy(env, tc.env)
+			s, _, _ := startWithLookups(t, env)
+
+			// The upload's 100 bytes are over 99, half of 199, and within 199.
+			line := s.uploadFrom(fromDE)
+			if line.LimitHit != tc.limitHit {
+				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
+			}
+
+			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				tc.limitPercent)
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				tc.bytesPercent)
+		})
+	}
+}
+
+func TestZeroPercentIsAZeroAllowance(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithLookups(t, map[string]string{asnLimitPercent: asnDE + ":0"})
+
+	// The first request breaks the limit, and bans the client; the log line
+	// gives the 0.
+	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	if line.fields["limit_percent"] != float64(0) ||
+		line.fields["limit_percent_setting"] != asnLimitPercent {
+		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
+			line.fields["limit_percent"], line.fields["limit_percent_setting"],
+			asnLimitPercent)
+	}
+
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestLowestPercentageApplies(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		from string
+		// want is the log line's limit_percent, as percentText gives it.
+		want string
+	}{
+		{
+			"the country's",
+			map[string]string{asnLimitPercent: asnDEHalf, countryLimitPercent: "de:25"},
+			fromDE, "25 from " + countryLimitPercent,
+		},
+		{
+			"the AS number's",
+			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: countryDEHalf},
+			fromDE, "25 from " + asnLimitPercent,
+		},
+		{
+			"the AS number's, the first of two alike",
+			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: "de:25"},
+			fromDE, "25 from " + asnLimitPercent,
+		},
+		{
+			"that for a client without a country",
+			map[string]string{asnLimitPercent: "AS64500:50", unknownLimitPercent: "25"},
+			noCountry, "25 from " + unknownLimitPercent,
+		},
+		{
+			// SWWAF_UNKNOWN_LIMIT_PERCENT is left at its default, 100.
+			"the AS number's, for a client without a country",
+			map[string]string{asnLimitPercent: "AS64500:25"},
+			noCountry, "25 from " + asnLimitPercent,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{rateLimitPerMinute: fourAMinute}
+			maps.Copy(env, tc.env)
+			s, _, _ := startWithLookups(t, env)
+
+			// A quarter of 4 requests a minute: the second breaks the limit.
+			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
+
+			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionRateLimited)
+			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				tc.want)
+		})
+	}
+}
+
+func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithLookups(t, map[string]string{
+		rateLimitPerMinute: fourAMinute, unknownLimitPercent: "50",
+	})
+
+	// One the lookup database does not hold, and one on a private address,
+	// which is never looked up: the third request of each breaks half of 4.
+	for _, from := range []string{unplaced, "10.0.0.8"} {
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+		s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
+	}
+
+	// One in a country has the whole limit.
+	for range 3 {
+		s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	}
+}
+
+func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
+	t.Parallel()
+
+	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+	// says, with a GeoJS that never answers.
+	synctest.Test(t, func(t *testing.T) {
+		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
+			time.Now, map[string]string{unknownLimitPercent: "0"})
+
+		// Once the second the request waits for its answer is up, the client
+		// counts as without a country, and its zero allowance refuses the
+		// request before it reaches the app.
+		serveFromDE(t, server, http.MethodGet, http.NoBody)
+
+		line := out.requestLine(t)
+		wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			"0 from "+unknownLimitPercent)
+	})
+}
+
+func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
+	t.Parallel()
+
+	const timeout = 3 * time.Second
+
+	for _, tc := range []struct {
+		setting, value string
+		waits          bool
+	}{
+		{asnLimitPercent, asnDEHalf, true},
+		{countryLimitPercent, countryDEHalf, true},
+		{asnBytesPercent, asnDEHalf, true},
+		{countryBytesPercent, countryDEHalf, true},
+		{unknownLimitPercent, "99", true},
+		// At 100, its default, it lowers no limit.
+		{unknownLimitPercent, "100", false},
+	} {
+		t.Run(tc.setting+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+			// says, with a GeoJS that never answers.
+			synctest.Test(t, func(t *testing.T) {
+				// The request's body is over SWWAF_REQUEST_MAX_BYTES, so that it
+				// is refused after the checks, and never reaches the app.
+				server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
+					time.Now, map[string]string{
+						lookupTimeout: timeout.String(), requestMaxBytes: "1",
+						tc.setting: tc.value,
+					})
+				began := time.Now()
+
+				serveFromDE(t, server, http.MethodPost, strings.NewReader("ab"))
+
+				want := time.Duration(0)
+				if tc.waits {
+					want = timeout
+				}
+
+				if waited := time.Since(began); waited != want {
+					t.Errorf("the request waited %s for its answer, want %s", waited, want)
+				}
+
+				wantLine(t, out.requestLine(t), http.StatusRequestEntityTooLarge,
+					requestlog.ActionTooLarge)
+
+				// The bubble's clock stops once this function returns, so the
+				// request to GeoJS, which a request that did not wait leaves
+				// under way, has to be abandoned before then.
+				time.Sleep(timeout)
+			})
+		})
+	}
+}
+
+func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// before is how many uploads come before the one that breaks a
+		// limit, which is answered with status and logged with action.
+		before int
+		status int
+		action string
+		// reason and want are the ban's reason, and its notes' limit
+		// percentage, as percentText gives it.
+		reason, want string
+	}{
+		{
+			// A quarter of 12 requests a minute is 3: the fourth breaks it.
+			"a rate limit",
+			map[string]string{rateLimitPerMinute: "12", asnLimitPercent: asnDEQuarter},
+			3, http.StatusForbidden, requestlog.ActionRateLimited,
+			"requests per minute over the limit of 3", "25 from " + asnLimitPercent,
+		},
+		{
+			// The byte limits' percentage, not the rate limits'.
+			"a byte limit",
+			map[string]string{
+				bytesLimitPerMinute: twoUploads, asnLimitPercent: asnDEQuarter,
+				asnBytesPercent: asnDEHalf,
+			},
+			0, http.StatusOK, requestlog.ActionForward,
+			"bytes per minute over the limit of 99", "50 from " + asnBytesPercent,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s, server, queue := startWithLookups(t, tc.env)
+
+			for range tc.before {
+				s.uploadFrom(fromDE)
+			}
+
+			s.requestWithBody(http.MethodPost, fromDE, "/", uploadHeader, uploadBody,
+				tc.status, tc.action)
+
+			held := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
+			if len(held) != 1 {
+				t.Fatalf("bans %+v, want one", held)
+			}
+
+			notes := held[0].Notes
+			if held[0].Reason != tc.reason {
+				t.Errorf("the ban's reason is %q, want %q", held[0].Reason, tc.reason)
+			}
+
+			wantPercent(t, "the notes' limit_percent", notes.LimitPercent,
+				notes.LimitPercentSetting, tc.want)
+
+			waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+			if len(waiting) != 1 {
+				t.Fatalf("%d alerts wait, want the ban's alone: %+v", len(waiting), waiting)
+			}
+
+			alerted, _ := waiting[0].Detail["notes"].(bans.Notes)
+			wantPercent(t, "the alert's notes' limit_percent", alerted.LimitPercent,
+				alerted.LimitPercentSetting, tc.want)
+		})
+	}
+}
+
+// startWithLookups is startAppWithAlerts in front of readAndAnswer, with
+// the settings in env on top of clients looked up in a lookup database,
+// which places fromDE and fromKP in the AS numbers and countries the
+// stand-in for GeoJS gives them, noCountry in AS64500 and no country, and
+// no other address. It returns the sender, the server and the queue of
+// the alerts.
+func startWithLookups(
+	t *testing.T, env map[string]string,
+) (*sender, *proxy.Server, *alerts.Queue) {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		fromDE + "/32":    {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+		fromKP + "/32":    {ASN: asnKP, ASName: asNameKP, Country: "KP"},
+		noCountry + "/32": {ASN: "AS64500", ASName: "Nowhere Net"},
+	})
+
+	settings := map[string]string{lookupSource: fileSource, lookupDBPath: path}
+	maps.Copy(settings, env)
+
+	s, _, server, queue := startAppWithAlerts(t, readAndAnswer, settings)
+
+	return s, server, queue
+}
+
+// uploadFrom is upload from the client at from.
+func (s *sender) uploadFrom(from string) logLine {
+	s.t.Helper()
+
+	line, _ := s.requestWithBody(http.MethodPost, from, "/", uploadHeader, uploadBody,
+		http.StatusOK, requestlog.ActionForward)
+
+	return line
+}
+
+// serveFromDE hands a request from fromDE with method and body straight to
+// server's handler, without the network, and returns once it is answered.
+func serveFromDE(t *testing.T, server *proxy.Server, method string, body io.Reader) {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
+	req.RemoteAddr = net.JoinHostPort(fromDE, "1234")
+
+	server.Handler.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+// wantPercent checks a limit percentage that a log line or a ban's notes
+// give, what, and the setting that gave it, against want, as percentText
+// gives them.
+func wantPercent(t *testing.T, what string, percent *int64, setting, want string) {
+	t.Helper()
+
+	if got := percentText(percent, setting); got != want {
+		t.Errorf("%s is %s, want %s", what, got, want)
+	}
+}
+
+// percentText gives a limit percentage and the setting that gave it as
+// text, such as "50 from SWWAF_ASN_LIMIT_PERCENT", or none when both are
+// left out.
+func percentText(percent *int64, setting string) string {
+	switch {
+	case percent == nil && setting == "":
+		return none
+	case percent == nil:
+		return "none from " + setting
+	default:
+		return fmt.Sprintf("%d from %s", *percent, setting)
+	}
+}

internal/proxy/lookup.go

@@ -22,8 +22,9 @@ const (
 // database or through GeoJS, and notes them for the log line, unless
 // SWWAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
 // link-local address, which no lookup can place. The lookup database
-// answers at once. With GeoJS, while a setting needs the answer, a new
-// client's request waits for it. ctx is the request's own context.
+// answers at once. With GeoJS, while a setting needs the answer, such as a
+// country list or a biased threshold, a new client's request waits for it.
+// ctx is the request's own context.
 func (rq *request) lookUp(ctx context.Context) {
 	if rq.h.config.LookupSource == "off" || !canBePlaced(rq.client) {
 		return

internal/proxy/lookup_test.go

@@ -22,6 +22,10 @@ import (
 // and country.
 type asnAndCountry struct{ asn, asName, country string }
 
+// fileSource is the SWWAF_LOOKUP_SOURCE that looks clients up in the
+// lookup database.
+const fileSource = "file"
+
 func TestEveryClientIsLookedUpWithoutWaitingWhileNoSettingNeedsIt(t *testing.T) {
 	t.Parallel()
 
@@ -178,7 +182,7 @@ func TestClientsAreLookedUpInTheLookupDatabaseAndGeoJSIsNotAsked(t *testing.T) {
 		fromKP + "/32": {ASN: asnKP, ASName: asNameKP, Country: "KP"},
 	})
 	s, clk, server := startWithClock(t, geojsURL, map[string]string{
-		lookupSource:       "file",
+		lookupSource:       fileSource,
 		lookupDBPath:       path,
 		allowedCountries:   "DE",
 		rateLimitPerMinute: "1",

internal/proxy/proxy.go

@@ -124,11 +124,11 @@ func New(params Params) *Server {
 	h.geojs = lookup.New(lookup.Params{
 		URL:     params.GeoJSURL,
 		Timeout: params.Config.LookupTimeout,
-		// The country lists and the headers act on the answer before the
-		// request goes on.
+		// The country lists, the headers and the biased thresholds act on
+		// the answer before the request goes on.
 		Wait: len(params.Config.DeniedCountries) > 0 ||
 			len(params.Config.ExclusivelyAllowedCountries) > 0 ||
-			params.Config.AddLookupHeaders,
+			params.Config.AddLookupHeaders || biasedThresholdsSet(params.Config),
 		Answered:   h.addLookup,
 		Now:        params.Now,
 		ProcessLog: params.ProcessLog,

internal/proxy/proxy_test.go

@@ -315,7 +315,7 @@ func newProxy(
 
 	var lookupFile *lookup.File
 
-	if cfg.LookupSource == "file" {
+	if cfg.LookupSource == fileSource {
 		lookupFile, err = lookup.OpenFile(lookup.FileParams{
 			Path: cfg.LookupDBPath, Now: now, ProcessLog: processLog, Alerts: alertQueue,
 		})

internal/proxy/request.go

@@ -56,9 +56,12 @@ type request struct {
 	lookedUp     bool
 	lookupAnswer lookup.Answer
 	// counted is true for a request the rate limits counted, whose bytes
-	// the byte limits count once it has ended.
-	counted bool
-	start   time.Time
+	// the byte limits count once it has ended. limitPercent and
+	// bytesPercent are then its client's limit percentages for the rate
+	// limits and for the byte limits.
+	counted                    bool
+	limitPercent, bytesPercent percentage
+	start                      time.Time
 	// checked is when the checks were done, and upstreamStart when the
 	// request was handed to the app.
 	checked       time.Time
@@ -212,9 +215,10 @@ func (rq *request) check(ctx context.Context) *refusal {
 // them refuses is not counted for the rate limits. Then come the rate
 // limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
 // request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
-// every other request is counted, and last the rule files. A request
-// exempt from the rate limits is exempt from the byte limits too. ctx is
-// the request's own context.
+// every other request is counted, each of them by the client's limit
+// percentages, and last the rule files. A request exempt from the rate
+// limits is exempt from the byte limits too. ctx is the request's own
+// context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -239,6 +243,12 @@ func (rq *request) checkClient(ctx context.Context) string {
 
 	rq.counted = !isInside(rq.client, cfg.RateLimitExemptNets) &&
 		!pathExempt(rq.in.URL, cfg.RateLimitExemptPaths)
+	if rq.counted {
+		rq.limitPercent, rq.bytesPercent = limitPercentages(cfg, rq.line.ASN, rq.line.Country)
+		rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
+		rq.line.BytesPercent, rq.line.BytesPercentSetting = rq.bytesPercent.logged()
+	}
+
 	if rq.counted && rq.limitBroken(now) {
 		return requestlog.ActionRateLimited
 	}