AS number and country looked up for every client (closes #95)

GeoJS's geo.json is asked about every new visitor unless
SWWAF_LOOKUP_SOURCE is off. A request waits for its client's first
answer only while a country list or SWWAF_ADD_LOOKUP_HEADERS needs it;
otherwise the answer reaches the client's history and ban notes when it
comes. The AS number and name go beside the country in the request log,
history, ban notes, alerts and lookups.json, with metrics by AS number;
64512 counts as unknown. A client's own X-Client-ASN and
X-Client-Country never reach the app, whatever the setting says, and
make example-app sends no address to GeoJS.

Judgement call: AS numbers are written AS64496, as SPEC's settings write them.
Judgement call: SWWAF_LOOKUP_TIMEOUT is added, default 1s, and cannot be off.

Model: opus-5-5

internal/config/config_test.go

@@ -40,6 +40,9 @@ const (
 	rateLimitPerHour        = "SWWAF_RATE_LIMIT_PER_HOUR"
 	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
 	rateLimitExemptPaths    = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
+	lookupSource            = "SWWAF_LOOKUP_SOURCE"
+	lookupTimeout           = "SWWAF_LOOKUP_TIMEOUT"
+	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
 	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
 	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
 	banResponse             = "SWWAF_BAN_RESPONSE"
@@ -117,6 +120,12 @@ const (
 // off switches a timeout, a size limit or a rate limit off.
 const off = "off"
 
+// enabled is true, as a setting's value.
+const enabled = "true"
+
+// defaultLookupSource is the default of SWWAF_LOOKUP_SOURCE.
+const defaultLookupSource = "geojs"
+
 // environment is a set of environment variables, for FromEnvironment.
 type environment map[string]string
 
@@ -173,6 +182,9 @@ func TestDefaults(t *testing.T) {
 		RulesDir:                    "/etc/smallwebwaf/rules.d",
 		RulesEnabled:                true,
 	})
+	wantLookupSettings(t, cfg, config.Config{
+		LookupSource: defaultLookupSource, LookupTimeout: time.Second,
+	})
 
 	if cfg.UpstreamURL.String() != "http://127.0.0.1:8081" {
 		t.Errorf("%s is %s", upstreamURL, cfg.UpstreamURL)
@@ -773,6 +785,50 @@ func TestCodeOnBothCountryListsStopsTheStart(t *testing.T) {
 	}
 }
 
+func TestLookupSettingsAsSet(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{
+		lookupTimeout: "500ms", addLookupHeaders: enabled,
+	})
+	wantLookupSettings(t, cfg, config.Config{
+		LookupSource: defaultLookupSource, LookupTimeout: 500 * time.Millisecond,
+		AddLookupHeaders: true,
+	})
+
+	cfg = fromEnvironment(t, environment{lookupSource: off})
+	wantLookupSettings(t, cfg, config.Config{
+		LookupSource: off, LookupTimeout: time.Second,
+	})
+}
+
+func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
+	t.Parallel()
+
+	for name, value := range map[string]string{
+		deniedCountries:  "kp",
+		allowedCountries: "de",
+		addLookupHeaders: enabled,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.FromEnvironment(environment{
+				lookupSource: off, name: value,
+			}.lookupEnv)
+			if err == nil || !strings.HasPrefix(err.Error(), name+": ") ||
+				!strings.Contains(err.Error(), lookupSource+" is off") {
+				t.Errorf("error %v, want one naming %s and %s", err, name, lookupSource)
+			}
+		})
+	}
+
+	// Set empty, the country lists need nothing looked up.
+	fromEnvironment(t, environment{
+		lookupSource: off, deniedCountries: "", allowedCountries: "",
+	})
+}
+
 func TestSizesAndOff(t *testing.T) {
 	t.Parallel()
 
@@ -894,6 +950,9 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{rateLimitPerHour, "1.5"},
 		{rateLimitPerDay, "-1"}, {rateLimitPerDay, "lots"},
 		{rateLimitExemptPaths, "/assets/,,/static/"},
+		{lookupSource, "file"}, {lookupSource, "GeoJS"}, {lookupSource, ""},
+		{lookupTimeout, off}, {lookupTimeout, "0s"}, {lookupTimeout, "1"},
+		{addLookupHeaders, "yes"},
 		{deniedCountries, "nk"},
 		{deniedCountries, "kp,,ir"},
 		{deniedCountries, "prk"},
@@ -1181,6 +1240,9 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		rateLimitPerHour:        "10000",
 		rateLimitPerDay:         "50000",
 		rateLimitExemptPaths:    "",
+		lookupSource:            defaultLookupSource,
+		lookupTimeout:           "1s",
+		addLookupHeaders:        "false",
 		deniedCountries:         "",
 		allowedCountries:        "",
 		banResponse:             "403",
@@ -1242,6 +1304,18 @@ func wantSettings(t *testing.T, got *config.Config, want config.Config) {
 	wantBanSettings(t, got, want)
 }
 
+// wantLookupSettings checks the settings for lookups.
+func wantLookupSettings(t *testing.T, got *config.Config, want config.Config) {
+	t.Helper()
+
+	if got.LookupSource != want.LookupSource || got.LookupTimeout != want.LookupTimeout ||
+		got.AddLookupHeaders != want.AddLookupHeaders {
+		t.Errorf("lookups from %q, waited for %s, headers %t; want %q, %s, %t",
+			got.LookupSource, got.LookupTimeout, got.AddLookupHeaders,
+			want.LookupSource, want.LookupTimeout, want.AddLookupHeaders)
+	}
+}
+
 // wantBanSettings checks the settings for bans, the state files, the
 // metrics and the rule files.
 func wantBanSettings(t *testing.T, got *config.Config, want config.Config) {