Lower limits for listed AS numbers and countries (closes #21)

SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT give the clients
of the AS numbers and countries they list that percentage of every rate
and byte limit, rounded down; SWWAF_ASN_BYTES_PERCENT and
SWWAF_COUNTRY_BYTES_PERCENT take its place for the byte limits of those
they list; SWWAF_UNKNOWN_LIMIT_PERCENT (100) covers clients without a
country. The lowest applies. While one lowers a limit, a request waits
for its client's lookup, and SWWAF_LOOKUP_SOURCE=off stops the start. Log
lines give limit_percent and bytes_percent with their settings; ban
notes, and so alerts, give the broken limit's.

Judgement call: a client without a country is unknown, whatever its AS number.
Judgement call: bytes_percent and its setting are log fields SPEC does not name.
Rule suppressed: funlen on FromEnvironment, one line per setting.

Model: opus-5-5

internal/proxy/bans.go

@@ -42,9 +42,11 @@ func (rq *request) banned(now time.Time) bool {
 
 // limitBroken counts the request for the rate limits at now, notes the
 // client's counts for the log line, and reports whether the request takes
-// the client over a rate limit, which breaks it.
+// the client over a rate limit, as its limit percentage lowers it, which
+// breaks it.
 func (rq *request) limitBroken(now time.Time) bool {
-	counts, hit, over := rq.h.limiter.Count(clientGroup(rq.client), now)
+	counts, hit, over := rq.h.limiter.Count(clientGroup(rq.client), now,
+		rq.limitPercent.percent)
 	rq.line.Counts = counts
 
 	if over {
@@ -63,8 +65,9 @@ func (rq *request) limitBroken(now time.Time) bool {
 // what it carried from the client with the request's. Only a request
 // passed to the app has them counted, and only one the rate limits
 // counted; in observe mode, not one that enforce mode would have refused.
-// Bytes that take the client over a byte limit break it; the response was
-// passed on whole.
+// Bytes that take the client over a byte limit, as its limit percentage
+// for the byte limits lowers it, break it; the response was passed on
+// whole.
 func (rq *request) countBytes() {
 	if !rq.counted || rq.line.WouldAction != "" {
 		return
@@ -89,7 +92,8 @@ func (rq *request) countBytes() {
 
 	now := rq.h.now()
 
-	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now, bytes)
+	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now, bytes,
+		rq.bytesPercent.percent)
 	rq.line.Counts.MinuteBytes = counts.MinuteBytes
 	rq.line.Counts.HourBytes = counts.HourBytes
 	rq.line.Counts.DayBytes = counts.DayBytes
@@ -103,9 +107,10 @@ func (rq *request) countBytes() {
 // one hit names, and notes the offence for the log line. status is what
 // the client was sent, or is sent: SWWAF_BAN_RESPONSE for a request over
 // a rate limit, the app's answer for one whose bytes broke a byte limit.
-// The ban sets the client's counters back to zero. In observe mode it
-// makes no ban and sets nothing back, and raises the alert for the ban it
-// would have made, if that alert would be sent.
+// The ban's notes give the client's limit percentage for that kind of
+// limit. The ban sets the client's counters back to zero. In observe mode
+// it makes no ban and sets nothing back, and raises the alert for the ban
+// it would have made, if that alert would be sent.
 func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	rq.line.LimitHit = hit.Window
 	if hit.Kind == ratelimit.KindBytes {
@@ -131,6 +136,13 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 		Requests: rq.netblockRequests(netblock),
 	}
 
+	percent := rq.limitPercent
+	if hit.Kind == ratelimit.KindBytes {
+		percent = rq.bytesPercent
+	}
+
+	notes.LimitPercent, notes.LimitPercentSetting = percent.logged()
+
 	if rq.h.config.Observe {
 		ban, wouldBan := rq.h.ledger.WouldBanForLimit(netblock, now, notes)
 		if wouldBan {