Lower limits for listed AS numbers and countries (closes #21)

SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT give the clients
of the AS numbers and countries they list that percentage of every rate
and byte limit, rounded down; SWWAF_ASN_BYTES_PERCENT and
SWWAF_COUNTRY_BYTES_PERCENT take its place for the byte limits of those
they list; SWWAF_UNKNOWN_LIMIT_PERCENT (100) covers clients without a
country. The lowest applies. While one lowers a limit, a request waits
for its client's lookup, and SWWAF_LOOKUP_SOURCE=off stops the start. Log
lines give limit_percent and bytes_percent with their settings; ban
notes, and so alerts, give the broken limit's.

Judgement call: a client without a country is unknown, whatever its AS number.
Judgement call: bytes_percent and its setting are log fields SPEC does not name.
Rule suppressed: funlen on FromEnvironment, one line per setting.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -174,7 +174,7 @@ type Hit struct {
 	Kind string
 	// Window is "minute", "hour" or "day".
 	Window string
-	// Limit is the window's limit.
+	// Limit is the window's limit, as the client's percentage of it.
 	Limit int64
 	// Count is the client's requests, or bytes, counted in the window,
 	// this request's included.
@@ -196,21 +196,24 @@ type Counts struct {
 
 // Count counts a request from client at now, in every window, whether or
 // not it is refused, and returns the client's counts in each window. It
-// reports whether the request takes the client over a rate limit, and the
-// hit: the window whose limit it goes over, the shortest if it is over
-// several.
-func (l *Limiter) Count(client netip.Prefix, now time.Time) (Counts, Hit, bool) {
-	return l.count(client, now, 1, 0)
+// reports whether the request takes the client over a rate limit, of
+// which the client gets the percentage percent, rounded down, and the hit:
+// the window whose limit it goes over, the shortest if it is over
+// several. A limit that is off stays off.
+func (l *Limiter) Count(
+	client netip.Prefix, now time.Time, percent int64,
+) (Counts, Hit, bool) {
+	return l.count(client, now, 1, 0, percent)
 }
 
 // CountBytes counts bytes, those of a request from client that has ended,
 // at now, in every window, and returns the client's counts in each window.
-// It reports whether the bytes take the client over a byte limit, and the
-// hit, as Count does.
+// It reports whether the bytes take the client over a byte limit, of which
+// the client gets the percentage percent, and the hit, as Count does.
 func (l *Limiter) CountBytes(
-	client netip.Prefix, now time.Time, bytes int64,
+	client netip.Prefix, now time.Time, bytes, percent int64,
 ) (Counts, Hit, bool) {
-	return l.count(client, now, 0, bytes)
+	return l.count(client, now, 0, bytes, percent)
 }
 
 // Reset sets client's counts of requests and of bytes in every window
@@ -373,9 +376,10 @@ func (l *Limiter) Load(clients []Client, now time.Time) {
 // count adds requests and bytes from client at now to its buckets in
 // every window, and returns its counts. A limit is broken only by what is
 // added to it, so that a request whose bytes are counted after another of
-// the client's requests broke a rate limit does not break it too.
+// the client's requests broke a rate limit does not break it too. The
+// client gets the percentage percent of each limit.
 func (l *Limiter) count(
-	client netip.Prefix, now time.Time, requests, bytes int64,
+	client netip.Prefix, now time.Time, requests, bytes, percent int64,
 ) (Counts, Hit, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -391,16 +395,17 @@ func (l *Limiter) count(
 	for i, w := range l.windows {
 		requestCounts[i] = requestBuckets[i].add(now, w.length, requests)
 		byteCounts[i] = byteBuckets[i].add(now, w.length, bytes)
+		limit, byteLimit := percentOf(w.limit, percent), percentOf(w.byteLimit, percent)
 
 		switch {
 		case hit.Window != "":
-		case requests > 0 && w.limit > 0 && requestCounts[i] > float64(w.limit):
+		case requests > 0 && w.limit > 0 && requestCounts[i] > float64(limit):
 			hit = Hit{
-				Kind: KindRequests, Window: w.name, Limit: w.limit, Count: requestCounts[i],
+				Kind: KindRequests, Window: w.name, Limit: limit, Count: requestCounts[i],
 			}
-		case bytes > 0 && w.byteLimit > 0 && byteCounts[i] > float64(w.byteLimit):
+		case bytes > 0 && w.byteLimit > 0 && byteCounts[i] > float64(byteLimit):
 			hit = Hit{
-				Kind: KindBytes, Window: w.name, Limit: w.byteLimit, Count: byteCounts[i],
+				Kind: KindBytes, Window: w.name, Limit: byteLimit, Count: byteCounts[i],
 			}
 		}
 	}
@@ -446,6 +451,15 @@ type window struct {
 	byteLimit int64
 }
 
+// percentOf returns the percentage percent of limit, rounded down. It is
+// written as limit's hundreds times percent, plus the rest's share, since
+// limit*percent can overflow for a byte limit.
+func percentOf(limit, percent int64) int64 {
+	const hundred = 100
+
+	return limit/hundred*percent + limit%hundred*percent/hundred
+}
+
 // add counts n requests, or n bytes, at now in a window of length, and
 // returns the client's count in the window that ends at now: what is in
 // the bucket under way, and what is in the bucket before it weighted by

internal/ratelimit/ratelimit_test.go

@@ -1,6 +1,7 @@
 package ratelimit_test
 
 import (
+	"math"
 	"net/netip"
 	"testing"
 	"time"
@@ -11,6 +12,10 @@ import (
 // limit is the limit the tests set.
 const limit = 3
 
+// whole is the percentage of each limit a client gets when nothing lowers
+// its limits.
+const whole = 100
+
 // The windows, as Count names them.
 const (
 	minute = "minute"
@@ -62,14 +67,14 @@ func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 	start := midnight()
 
 	for range limit {
-		_, _, over := limiter.Count(client, start)
+		_, _, over := limiter.Count(client, start, whole)
 		if over {
 			t.Fatal("a request within the limit is over it")
 		}
 	}
 
 	// Over both limits; the minute's is named, with the four requests.
-	_, hit, over := limiter.Count(client, start)
+	_, hit, over := limiter.Count(client, start, whole)
 
 	want := ratelimit.Hit{
 		Kind: ratelimit.KindRequests, Window: minute, Limit: limit, Count: limit + 1,
@@ -80,6 +85,61 @@ func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 	}
 }
 
+func TestClientGetsItsPercentageOfEachLimitRoundedDown(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 5, BytesPerDay: math.MaxInt64})
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	// Half of 5 requests is 2.5, rounded down to 2: the third is over.
+	for range 2 {
+		_, _, over := limiter.Count(client, start, 50)
+		if over {
+			t.Fatal("a request within half the limit is over it")
+		}
+	}
+
+	_, hit, over := limiter.Count(client, start, 50)
+
+	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: minute, Limit: 2, Count: 3}
+	if !over || hit != want {
+		t.Errorf("the third request gives %+v and %t, want %+v and true", hit, over, want)
+	}
+
+	// Half of the largest byte limit is still far above a TiB: working it
+	// out does not overflow.
+	_, hit, over = limiter.CountBytes(client, start, 1<<40, 50)
+	if over {
+		t.Errorf("a TiB is over half the largest byte limit: %+v", hit)
+	}
+}
+
+func TestZeroPercentIsAZeroAllowanceAndALimitOffStaysOff(t *testing.T) {
+	t.Parallel()
+
+	// Only the hour has limits: the minute's and the day's are off.
+	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit, BytesPerHour: 1000})
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	// At 0 percent, the first request and the first byte are over the
+	// hour's limits, which are 0; the minute's, which are off, stay off.
+	_, hit, _ := limiter.Count(client, start, 0)
+
+	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: hour, Limit: 0, Count: 1}
+	if hit != want {
+		t.Errorf("the first request gives %+v, want %+v", hit, want)
+	}
+
+	_, hit, _ = limiter.CountBytes(client, start, 1, 0)
+
+	want = ratelimit.Hit{Kind: ratelimit.KindBytes, Window: hour, Limit: 0, Count: 1}
+	if hit != want {
+		t.Errorf("the first byte gives %+v, want %+v", hit, want)
+	}
+}
+
 func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 	t.Parallel()
 
@@ -100,12 +160,12 @@ func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 			client := netip.MustParsePrefix("203.0.113.9/32")
 
 			// 600 bytes are within the limit, 600 more over it.
-			_, _, over := limiter.CountBytes(client, midnight(), 600)
+			_, _, over := limiter.CountBytes(client, midnight(), 600, whole)
 			if over {
 				t.Fatal("600 bytes are over the limit of 1000")
 			}
 
-			_, hit, over := limiter.CountBytes(client, midnight(), 600)
+			_, hit, over := limiter.CountBytes(client, midnight(), 600, whole)
 
 			want := ratelimit.Hit{
 				Kind: ratelimit.KindBytes, Window: tc.window, Limit: byteLimit, Count: 1200,
@@ -148,16 +208,16 @@ func TestCountGivesTheBytesInEachWindow(t *testing.T) {
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
-	limiter.CountBytes(client, start, 300)
+	limiter.CountBytes(client, start, 300, whole)
 
 	// A quarter into the next hour, the minute has only these 100 bytes.
 	// The hour still covers three quarters of the bucket before, whose 300
 	// bytes count 225, and these: 325. The day covers all 400.
 	later := start.Add(time.Hour + time.Hour/4)
-	limiter.CountBytes(client, later, 100)
+	limiter.CountBytes(client, later, 100, whole)
 
 	// A request's counts give the bytes counted so far too.
-	counts, _, _ := limiter.Count(client, later)
+	counts, _, _ := limiter.Count(client, later, whole)
 
 	want := ratelimit.Counts{
 		Minute: 1, Hour: 1, Day: 1, MinuteBytes: 100, HourBytes: 325, DayBytes: 400,
@@ -189,14 +249,14 @@ func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 	start := midnight()
 
 	for range 3 {
-		limiter.Count(client, start)
+		limiter.Count(client, start, whole)
 	}
 
 	// A quarter into the next hour, the minute has only this request. The
 	// hour still covers three quarters of the bucket before, with its three
 	// requests, which count 2.25, and this one: 3.25. The day covers all
 	// four.
-	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4))
+	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4), whole)
 
 	want := ratelimit.Counts{Minute: 1, Hour: 3.25, Day: 4}
 	if counts != want {
@@ -364,7 +424,7 @@ func wantCount(
 ) {
 	t.Helper()
 
-	_, hit, _ := limiter.Count(client, now)
+	_, hit, _ := limiter.Count(client, now, whole)
 	if hit.Window != want {
 		t.Errorf("request from %s at %s is over %q, want %q",
 			client, now.Format(time.RFC3339), hit.Window, want)
@@ -379,7 +439,7 @@ func wantBytesCount(
 ) {
 	t.Helper()
 
-	_, hit, _ := limiter.CountBytes(client, now, bytes)
+	_, hit, _ := limiter.CountBytes(client, now, bytes, whole)
 	if hit.Kind != want {
 		t.Errorf("%d bytes from %s at %s break a limit on %q, want %q",
 			bytes, client, now.Format(time.RFC3339), hit.Kind, want)

internal/ratelimit/snapshot_test.go

@@ -16,7 +16,7 @@ func TestSnapshotListsTheClientsByAddress(t *testing.T) {
 
 	limiter := ratelimit.New(ratelimit.Limits{})
 	for _, i := range []int{2, 3, 0, 1} {
-		limiter.Count(netip.MustParsePrefix(want[i]), midnight())
+		limiter.Count(netip.MustParsePrefix(want[i]), midnight(), whole)
 	}
 
 	snapshot := limiter.Snapshot()
@@ -63,8 +63,8 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassed(t *testing.T) {
 	start := midnight()
 
 	limiter := ratelimit.New(ratelimit.Limits{})
-	limiter.Count(client, start)
-	limiter.CountBytes(client, start, 5)
+	limiter.Count(client, start, whole)
+	limiter.CountBytes(client, start, 5, whole)
 	limiter.AddToHistory(client, start, ratelimit.Request{Forwarded: true})
 
 	loaded := func(now time.Time) ratelimit.Client {