AS number and country looked up for every client (closes #95)

GeoJS's geo.json is asked about every new visitor unless
SWWAF_LOOKUP_SOURCE is off. A request waits for its client's first
answer only while a country list or SWWAF_ADD_LOOKUP_HEADERS needs it;
otherwise the answer reaches the client's history and ban notes when it
comes. The AS number and name go beside the country in the request log,
history, ban notes, alerts and lookups.json, with metrics by AS number;
64512 counts as unknown. A client's own X-Client-ASN and
X-Client-Country never reach the app, whatever the setting says, and
make example-app sends no address to GeoJS.

Judgement call: AS numbers are written AS64496, as SPEC's settings write them.
Judgement call: SWWAF_LOOKUP_TIMEOUT is added, default 1s, and cannot be off.

Model: opus-5-5

internal/proxy/countries_test.go

@@ -56,16 +56,21 @@ func TestCountryLists(t *testing.T) {
 			maps.Copy(env, tc.env)
 			addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, env)
 
-			for i, sent := range []struct{ client, country string }{
-				{fromDE, "DE"}, {fromKP, "KP"}, {unplaced, ""},
+			// The AS number GeoJS gives unplaced, 64512, counts as unknown.
+			for i, sent := range []struct{ client, asn, asName, country string }{
+				{fromDE, asnDE, asNameDE, "DE"}, {fromKP, asnKP, asNameKP, "KP"},
+				{unplaced, "", "", ""},
 			} {
 				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 				req.Header.Set(forwardedFor, sent.client)
 				got := do(t, req)
 
 				line := out.requestLines(t, i+1)[i]
-				if line.Country != sent.country {
-					t.Errorf("log line has country %q, want %q", line.Country, sent.country)
+				if line.ASN != sent.asn || line.ASName != sent.asName ||
+					line.Country != sent.country {
+					t.Errorf("log line has %q, %q and %q, want %q, %q and %q",
+						line.ASN, line.ASName, line.Country,
+						sent.asn, sent.asName, sent.country)
 				}
 
 				if slices.Contains(tc.refused, sent.client) {
@@ -130,7 +135,7 @@ func TestRequestRefusedByCountryIsNotCounted(t *testing.T) {
 				return
 			}
 
-			answer := []map[string]string{{"ip": r.URL.Query().Get("ip"), "country": "DE"}}
+			answer := []geojsAnswer{{IP: r.URL.Query().Get("ip"), CountryCode: "DE"}}
 
 			err := json.NewEncoder(w).Encode(answer)
 			if err != nil {
@@ -174,20 +179,15 @@ func TestRequestRefusedByCountryIsNotCounted(t *testing.T) {
 	wantStatus(t, got, http.StatusOK)
 }
 
-func TestCountryNotLookedUpWithoutAListOrForAPrivateAddress(t *testing.T) {
+func TestPrivateAddressIsNeverLookedUp(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
-		name    string
-		env     map[string]string
-		clients []string // "" sends no X-Forwarded-For: the client is 127.0.0.1
+		name string
+		env  map[string]string
 	}{
-		{"no country list is set", nil, []string{fromKP, fromDE}},
-		{
-			"private, loopback and link-local addresses",
-			map[string]string{deniedCountries: "kp"},
-			[]string{"10.0.0.5", "192.168.1.9", "fd00::5", "", "169.254.0.9", "fe80::9"},
-		},
+		{"no setting needs the lookup", nil},
+		{"a country list is set", map[string]string{deniedCountries: "kp"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -198,7 +198,10 @@ func TestCountryNotLookedUpWithoutAListOrForAPrivateAddress(t *testing.T) {
 			maps.Copy(env, tc.env)
 			addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, env)
 
-			for i, sent := range tc.clients {
+			// "" sends no X-Forwarded-For: the client is 127.0.0.1.
+			for i, sent := range []string{
+				"10.0.0.5", "192.168.1.9", "fd00::5", "", "169.254.0.9", "fe80::9",
+			} {
 				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 				if sent != "" {
 					req.Header.Set(forwardedFor, sent)
@@ -209,15 +212,26 @@ func TestCountryNotLookedUpWithoutAListOrForAPrivateAddress(t *testing.T) {
 				line := out.requestLines(t, i+1)[i]
 				wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
-				country, present := line.fields["country"]
-				if !present || country != "" {
-					t.Errorf("log line for %q has country %v, want an empty one",
-						line.ClientIP, country)
+				for _, field := range []string{"asn", "as_name", "country"} {
+					value, present := line.fields[field]
+					if !present || value != "" {
+						t.Errorf("log line for %q has %s %v, want an empty one",
+							line.ClientIP, field, value)
+					}
 				}
 			}
 
-			if len(asked()) != 0 {
-				t.Errorf("GeoJS was asked about %v, want nothing", asked())
+			// GeoJS is asked about up to 200 waiting clients at once, so once it
+			// has been asked about fromDE, which comes last, it has been asked
+			// about every client before it that waited for an answer.
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header.Set(forwardedFor, fromDE)
+			wantStatus(t, do(t, req), http.StatusOK)
+
+			waitUntil(func() bool { return slices.Contains(asked(), fromDE) })
+
+			if got := asked(); !slices.Equal(got, []string{fromDE}) {
+				t.Errorf("GeoJS was asked about %v, want %s alone", got, fromDE)
 			}
 		})
 	}
@@ -264,18 +278,31 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 	}
 }
 
-// startGeoJS starts a stand-in for GeoJS, which places fromDE and fromKP
-// and no other address. It returns its URL, and what returns the
-// addresses it has been asked about.
+// startGeoJS starts a stand-in for GeoJS, which places fromDE and fromKP,
+// each in an AS of its own, and no other address. It returns its URL, and
+// what returns the addresses it has been asked about.
 func startGeoJS(t *testing.T) (string, func() []string) {
 	t.Helper()
 
-	places := map[string]string{fromDE: "DE", fromKP: "KP"}
+	geojsURL, asked, release := startHeldGeoJS(t)
+	release()
 
-	var asked struct {
-		mu    sync.Mutex
-		addrs []string
-	}
+	return geojsURL, asked
+}
+
+// startHeldGeoJS is startGeoJS for a stand-in that answers nothing until
+// release is called. Each request to it waits until then.
+func startHeldGeoJS(t *testing.T) (string, func() []string, func()) {
+	t.Helper()
+
+	var (
+		asked struct {
+			mu    sync.Mutex
+			addrs []string
+		}
+		released = make(chan struct{})
+		once     sync.Once
+	)
 
 	geojs := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
@@ -285,11 +312,11 @@ func startGeoJS(t *testing.T) (string, func() []string) {
 			asked.addrs = append(asked.addrs, addrs...)
 			asked.mu.Unlock()
 
-			answers := make([]map[string]string, 0, len(addrs))
+			<-released
+
+			answers := make([]geojsAnswer, 0, len(addrs))
 			for _, addr := range addrs {
-				answers = append(answers, map[string]string{
-					"ip": addr, "country": places[addr],
-				})
+				answers = append(answers, answerAbout(addr))
 			}
 
 			err := json.NewEncoder(w).Encode(answers)
@@ -299,10 +326,48 @@ func startGeoJS(t *testing.T) (string, func() []string) {
 		}))
 	t.Cleanup(geojs.Close)
 
+	release := func() { once.Do(func() { close(released) }) }
+	// Run before geojs.Close, which waits for every request to be answered.
+	t.Cleanup(release)
+
 	return geojs.URL, func() []string {
 		asked.mu.Lock()
 		defer asked.mu.Unlock()
 
 		return slices.Clone(asked.addrs)
+	}, release
+}
+
+// The AS numbers and names the stand-in for GeoJS gives fromDE and
+// fromKP, as they are logged.
+const (
+	asnDE    = "AS64496"
+	asNameDE = "Example Net"
+	asnKP    = "AS64511"
+	asNameKP = "Other Net"
+)
+
+// geojsAnswer is an answer of GeoJS about one address, with the fields
+// smallwebwaf reads.
+//
+//nolint:tagliatelle // GeoJS's own names
+type geojsAnswer struct {
+	IP          string `json:"ip"`
+	ASN         int    `json:"asn"`
+	ASName      string `json:"organization_name"`
+	CountryCode string `json:"country_code,omitempty"`
+}
+
+// answerAbout is what the stand-in for GeoJS answers about addr: for an
+// address it cannot place, the AS number 64512 and the AS name Unknown
+// with no country, as GeoJS does.
+func answerAbout(addr string) geojsAnswer {
+	switch addr {
+	case fromDE:
+		return geojsAnswer{IP: addr, ASN: 64496, ASName: asNameDE, CountryCode: "DE"}
+	case fromKP:
+		return geojsAnswer{IP: addr, ASN: 64511, ASName: asNameKP, CountryCode: "KP"}
 	}
+
+	return geojsAnswer{IP: addr, ASN: 64512, ASName: "Unknown"}
 }