AS number and country looked up for every client (closes #95)

GeoJS's geo.json is asked about every new visitor unless
SWWAF_LOOKUP_SOURCE is off. A request waits for its client's first
answer only while a country list or SWWAF_ADD_LOOKUP_HEADERS needs it;
otherwise the answer reaches the client's history and ban notes when it
comes. The AS number and name go beside the country in the request log,
history, ban notes, alerts and lookups.json, with metrics by AS number;
64512 counts as unknown. A client's own X-Client-ASN and
X-Client-Country never reach the app, whatever the setting says, and
make example-app sends no address to GeoJS.

Judgement call: AS numbers are written AS64496, as SPEC's settings write them.
Judgement call: SWWAF_LOOKUP_TIMEOUT is added, default 1s, and cannot be off.

Model: opus-5-5

internal/config/config.go

@@ -91,6 +91,15 @@ type Config struct {
 	// limits neither count nor refuse (SWWAF_RATE_LIMIT_EXEMPT_PATHS).
 	// Each starts with /.
 	RateLimitExemptPaths []string
+	// LookupSource is where each client's AS number and country are
+	// looked up (SWWAF_LOOKUP_SOURCE): geojs, or off for nowhere. A request
+	// waits up to LookupTimeout for its client's first answer while a
+	// setting needs it (SWWAF_LOOKUP_TIMEOUT), which cannot be off.
+	// AddLookupHeaders is true when the app is passed the client's AS
+	// number and country in headers (SWWAF_ADD_LOOKUP_HEADERS).
+	LookupSource     string
+	LookupTimeout    time.Duration
+	AddLookupHeaders bool
 	// DeniedCountries are the countries whose clients are refused
 	// (SWWAF_DENIED_COUNTRIES). ExclusivelyAllowedCountries, when not
 	// empty, are the only countries whose clients are let through
@@ -138,8 +147,8 @@ type Config struct {
 	AdminToken string
 	// MetricsToken is the bearer token a scraper sends for the metrics
 	// (SWWAF_METRICS_TOKEN), "" while it is unset and the metrics are off.
-	// MetricsTopN is how many countries get series of their own in the
-	// metrics (SWWAF_METRICS_TOP_N).
+	// MetricsTopN is how many AS numbers and how many countries get series
+	// of their own in the metrics (SWWAF_METRICS_TOP_N).
 	MetricsToken string
 	MetricsTopN  int
 	// RulesDir is the directory of the rule files (SWWAF_RULES_DIR), read
@@ -233,6 +242,8 @@ var (
 		"is taken out of every request by Go's HTTP server, so it can never " +
 			"be logged")
 	errOnBothLists          = errors.New("is in SWWAF_DENIED_COUNTRIES too")
+	errNotLookupSource      = errors.New("is not geojs or off")
+	errNeedsLookups         = errors.New("it needs each client looked up")
 	errNotOver4K            = errors.New("is not a size of more than 4K, such as 32K")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
@@ -300,6 +311,9 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "10000"),
 		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "50000"),
 		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
+		LookupSource:            env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
+		LookupTimeout:           env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "1s"),
+		AddLookupHeaders:        env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
 		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
 			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
@@ -339,13 +353,7 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		cfg.InstanceName, cfg.LogRemoteURL != nil)
 
 	env.checkInstanceNameForNtfy(cfg.InstanceName, cfg.AlertNtfyURL != nil)
-
-	for _, country := range cfg.ExclusivelyAllowedCountries {
-		if slices.Contains(cfg.DeniedCountries, country) {
-			env.check("SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES",
-				fmt.Errorf("%q %w", country, errOnBothLists))
-		}
-	}
+	env.checkCountriesAndLookups(cfg)
 
 	if env.err != nil {
 		return nil, env.err
@@ -547,6 +555,47 @@ func (e *environment) countries(name, defaultValue string) []string {
 	return countries
 }
 
+// lookupSource reads the setting that is where clients are looked up:
+// geojs, or off.
+func (e *environment) lookupSource(name, defaultValue string) string {
+	source := e.value(name, defaultValue)
+	if source != "geojs" && source != off {
+		e.check(name, fmt.Errorf("%q %w", source, errNotLookupSource))
+	}
+
+	return source
+}
+
+// checkCountriesAndLookups refuses a country on both country lists, and,
+// while SWWAF_LOOKUP_SOURCE is off, each setting that needs clients looked
+// up: the country lists and SWWAF_ADD_LOOKUP_HEADERS.
+func (e *environment) checkCountriesAndLookups(cfg *Config) {
+	for _, country := range cfg.ExclusivelyAllowedCountries {
+		if slices.Contains(cfg.DeniedCountries, country) {
+			e.check("SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES",
+				fmt.Errorf("%q %w", country, errOnBothLists))
+		}
+	}
+
+	if cfg.LookupSource != off {
+		return
+	}
+
+	for _, setting := range []struct {
+		name string
+		set  bool
+	}{
+		{"SWWAF_DENIED_COUNTRIES", len(cfg.DeniedCountries) > 0},
+		{"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
+		{"SWWAF_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
+	} {
+		if setting.set {
+			e.check(setting.name, fmt.Errorf("is set while SWWAF_LOOKUP_SOURCE is off; %w",
+				errNeedsLookups))
+		}
+	}
+}
+
 // headerNames reads a setting that is a list of header names, and
 // returns them in lower case.
 func (e *environment) headerNames(name, defaultValue string) []string {