AbuseIPDB scores for clients that committed an offence, within a daily budget (closes #105)

With SWWAF_ABUSEIPDB_KEY set, a client whose history counts an offence
(a broken limit, a ban rule's match or a block rule's refusal, counted
by kind) is checked in the background, at most
SWWAF_ABUSEIPDB_DAILY_BUDGET checks a day, the count kept in
reputation.json. A client, an IPv4 address or an IPv6 /64, is checked by
the address it sent from, and its score serves all its addresses. A
score at or over SWWAF_ABUSEIPDB_MIN_SCORE is a hit for
SWWAF_REPUTATION_ACTION, logged as abuseipdb and alerted with its score.
A failure or the used-up budget gives no score and raises
source_failure. The key goes only in the Key header.

Judgement call: the budget's day is UTC; AbuseIPDB documents no reset time.
Judgement call: each check sent spends budget; a minute's pause after a failure.

Model: opus-5-5

internal/config/config.go

@@ -155,14 +155,22 @@ type Config struct {
 	// DNSBLZones are the DNSBL zones clients are asked about
 	// (SWWAF_DNSBL_ZONES), through DNSBLResolver (SWWAF_DNSBL_RESOLVER), or
 	// the host's resolver while that is the zero AddrPort.
-	// ReputationAction is what is done with a client a zone's verdict lists
-	// (SWWAF_REPUTATION_ACTION): deny, limit or log; for limit,
-	// ReputationLimitPercent is the percentage of every limit it gets. A
-	// verdict is used for ReputationCacheTTL after it was fetched
-	// (SWWAF_REPUTATION_CACHE_TTL), and a query may take ReputationTimeout
-	// (SWWAF_REPUTATION_TIMEOUT). Neither can be off.
+	// AbuseIPDBKey is the key of the AbuseIPDB account clients are checked
+	// with (SWWAF_ABUSEIPDB_KEY), "" while it is unset and none is. A score
+	// of AbuseIPDBMinScore or more is a hit (SWWAF_ABUSEIPDB_MIN_SCORE), and
+	// at most AbuseIPDBDailyBudget checks are made a day
+	// (SWWAF_ABUSEIPDB_DAILY_BUDGET).
+	// ReputationAction is what is done with a client a zone's verdict lists,
+	// or whose score is a hit (SWWAF_REPUTATION_ACTION): deny, limit or log;
+	// for limit, ReputationLimitPercent is the percentage of every limit it
+	// gets. A verdict or a score is used for ReputationCacheTTL after it was
+	// fetched (SWWAF_REPUTATION_CACHE_TTL), and a query or a check may take
+	// ReputationTimeout (SWWAF_REPUTATION_TIMEOUT). Neither can be off.
 	DNSBLZones             []string
 	DNSBLResolver          netip.AddrPort
+	AbuseIPDBKey           string
+	AbuseIPDBMinScore      int64
+	AbuseIPDBDailyBudget   int
 	ReputationAction       string
 	ReputationLimitPercent int64
 	ReputationCacheTTL     time.Duration
@@ -440,6 +448,9 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		BlocklistRefresh:     env.refresh("SWWAF_BLOCKLIST_REFRESH", "24h"),
 		DNSBLZones:           env.zones("SWWAF_DNSBL_ZONES"),
 		DNSBLResolver:        env.resolver("SWWAF_DNSBL_RESOLVER"),
+		AbuseIPDBKey:         env.secret("SWWAF_ABUSEIPDB_KEY"),
+		AbuseIPDBMinScore:    env.percent("SWWAF_ABUSEIPDB_MIN_SCORE", "75"),
+		AbuseIPDBDailyBudget: env.numberNotOff("SWWAF_ABUSEIPDB_DAILY_BUDGET", "900"),
 		ReputationCacheTTL:   env.durationNotOff("SWWAF_REPUTATION_CACHE_TTL", "24h"),
 		ReputationTimeout:    env.durationNotOff("SWWAF_REPUTATION_TIMEOUT", "2s"),
 		BanResponse:          env.banResponse("SWWAF_BAN_RESPONSE", "403"),
@@ -1110,10 +1121,10 @@ func (e *environment) webhookHeaders(name string) http.Header {
 }
 
 // secret reads a setting that is a secret another service gave, such as
-// an ntfy token, "" while it is unset. It is sent in a header, which
-// cannot hold a control character, so one in it is an error. The log
-// shows ******** in place of a value that is not empty, and an error
-// shows none of it.
+// an ntfy token or an AbuseIPDB key, "" while it is unset. It is sent in
+// a header, which cannot hold a control character, so one in it is an
+// error. The log shows ******** in place of a value that is not empty, and
+// an error shows none of it.
 func (e *environment) secret(name string) string {
 	value, _ := e.lookup(name)
 

internal/config/config_test.go

@@ -63,6 +63,9 @@ const (
 	blocklistAction         = "SWWAF_BLOCKLIST_ACTION"
 	dnsblZones              = "SWWAF_DNSBL_ZONES"
 	dnsblResolver           = "SWWAF_DNSBL_RESOLVER"
+	abuseIPDBKey            = "SWWAF_ABUSEIPDB_KEY"
+	abuseIPDBMinScore       = "SWWAF_ABUSEIPDB_MIN_SCORE"
+	abuseIPDBDailyBudget    = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
 	reputationAction        = "SWWAF_REPUTATION_ACTION"
 	reputationCacheTTL      = "SWWAF_REPUTATION_CACHE_TTL"
 	reputationTimeout       = "SWWAF_REPUTATION_TIMEOUT"
@@ -1526,6 +1529,76 @@ func TestDNSBLZoneKeyIsLoggedMaskedAndNeverShown(t *testing.T) {
 	}
 }
 
+func TestAbuseIPDBSettingsAsSet(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{})
+	if cfg.AbuseIPDBKey != "" || cfg.AbuseIPDBMinScore != 75 ||
+		cfg.AbuseIPDBDailyBudget != 900 {
+		t.Errorf("by default, the key %q, the minimum score %d and the daily budget %d, "+
+			"want none, 75 and 900", cfg.AbuseIPDBKey, cfg.AbuseIPDBMinScore,
+			cfg.AbuseIPDBDailyBudget)
+	}
+
+	cfg = fromEnvironment(t, environment{
+		abuseIPDBKey: token, abuseIPDBMinScore: "0", abuseIPDBDailyBudget: "1",
+	})
+	if cfg.AbuseIPDBKey != token || cfg.AbuseIPDBMinScore != 0 ||
+		cfg.AbuseIPDBDailyBudget != 1 {
+		t.Errorf("set, the key %q, the minimum score %d and the daily budget %d, "+
+			"want %s, 0 and 1", cfg.AbuseIPDBKey, cfg.AbuseIPDBMinScore,
+			cfg.AbuseIPDBDailyBudget, token)
+	}
+}
+
+func TestInvalidAbuseIPDBSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
+	t.Parallel()
+
+	const (
+		notScore  = " is not a percentage, a whole number from 0 to 100"
+		notBudget = " is not a whole number above zero, such as 5000"
+	)
+
+	for _, tc := range []struct{ name, value, want string }{
+		{abuseIPDBMinScore, "101", `"101"` + notScore},
+		{abuseIPDBMinScore, off, `"off"` + notScore},
+		{abuseIPDBDailyBudget, "0", `"0"` + notBudget},
+		{abuseIPDBDailyBudget, off, `"off"` + notBudget},
+		// The key itself is never shown.
+		{
+			abuseIPDBKey, token + "\r",
+			"holds a control character, such as the carriage return of a Windows line end",
+		},
+	} {
+		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+
+			want := tc.name + ": " + tc.want
+			if err == nil || err.Error() != want {
+				t.Errorf("error %v, want %s", err, want)
+			}
+		})
+	}
+}
+
+func TestAbuseIPDBKeyIsLoggedMasked(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{abuseIPDBKey: token})
+
+	var out bytes.Buffer
+
+	slog.New(slog.NewJSONHandler(&out, nil)).Info("starting", "settings", cfg)
+
+	logged := out.String()
+	if strings.Contains(logged, token) ||
+		!strings.Contains(logged, `"`+abuseIPDBKey+`":"********"`) {
+		t.Errorf("the key is not logged masked: %s", logged)
+	}
+}
+
 func TestSizesAndOff(t *testing.T) {
 	t.Parallel()
 
@@ -1956,6 +2029,9 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		blocklistAction:         actionDeny,
 		dnsblZones:              "",
 		dnsblResolver:           "",
+		abuseIPDBKey:            "",
+		abuseIPDBMinScore:       "75",
+		abuseIPDBDailyBudget:    "900",
 		reputationAction:        "limit:25",
 		reputationCacheTTL:      defaultReputationCacheTTL,
 		reputationTimeout:       "2s",