AS number and country looked up for every client (closes #95)

GeoJS's geo.json is asked about every new visitor unless
SWWAF_LOOKUP_SOURCE is off. A request waits for its client's first
answer only while a country list or SWWAF_ADD_LOOKUP_HEADERS needs it;
otherwise the answer reaches the client's history and ban notes when it
comes. The AS number and name go beside the country in the request log,
history, ban notes, alerts and lookups.json, with metrics by AS number;
64512 counts as unknown. A client's own X-Client-ASN and
X-Client-Country never reach the app, whatever the setting says, and
make example-app sends no address to GeoJS.

Judgement call: AS numbers are written AS64496, as SPEC's settings write them.
Judgement call: SWWAF_LOOKUP_TIMEOUT is added, default 1s, and cannot be off.

Model: opus-5-5

internal/proxy/request.go

@@ -48,7 +48,10 @@ type request struct {
 	client      netip.Addr
 	peer        netip.Addr
 	peerTrusted bool
-	start       time.Time
+	// lookedUp is true once the client's AS number and country have been
+	// looked up, whether or not an answer was there.
+	lookedUp bool
+	start    time.Time
 	// checked is when the checks were done, and upstreamStart when the
 	// request was handed to the app.
 	checked       time.Time
@@ -192,14 +195,15 @@ func (rq *request) check(ctx context.Context) *refusal {
 
 // checkClient runs the checks on the request's client, and returns the
 // action of the first that refuses the request, or "" when none does. A
-// client in SWWAF_ALLOW_NETS skips them. For any other client,
-// SWWAF_DENY_NETS comes first, then a ban on its netblock, so that a
-// client either refuses is not looked up, and then the country lists; a
-// request any of them refuses is not counted for the rate limits. Then
-// come the rate limits, unless the client is in
-// SWWAF_RATE_LIMIT_EXEMPT_NETS or the request's path is exempt under
-// SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that every other request is counted,
-// and last the rule files. ctx is the request's own context.
+// client in SWWAF_ALLOW_NETS skips them, and is not looked up. For any
+// other client, SWWAF_DENY_NETS comes first, then a ban on its netblock,
+// so that a client either refuses is not looked up, then the lookup of
+// its AS number and country, and then the country lists; a request any of
+// them refuses is not counted for the rate limits. Then come the rate
+// limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
+// request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
+// every other request is counted, and last the rule files. ctx is the
+// request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -216,7 +220,9 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionBanned
 	}
 
-	if rq.countryDenied(ctx) {
+	rq.lookUp(ctx)
+
+	if rq.countryDenied() {
 		return requestlog.ActionCountryDenied
 	}
 
@@ -287,7 +293,9 @@ func (rq *request) forward(ctx context.Context) {
 
 // rewrite makes the request the app receives: the client's request,
 // unchanged, sent to SWWAF_UPSTREAM_URL, with the forwarded headers and
-// the request's id set.
+// the request's id set, without any X-Client-ASN or X-Client-Country the
+// client sent, whatever SWWAF_ADD_LOOKUP_HEADERS says, and, while it is
+// set, with the client's AS number and country in them.
 func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	upstream := rq.h.config.UpstreamURL
 	pr.Out.URL.Scheme = upstream.Scheme
@@ -297,6 +305,12 @@ func (rq *request) rewrite(pr *httputil.ProxyRequest) {
 	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
 	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
 	pr.Out.Header.Set(requestIDHeader, rq.line.RequestID)
+	pr.Out.Header.Del(asnHeader)
+	pr.Out.Header.Del(countryHeader)
+
+	if rq.h.config.AddLookupHeaders {
+		setLookupHeaders(pr.Out.Header, rq.line.ASN, rq.line.Country)
+	}
 }
 
 // modifyResponse looks at the app's answer before ReverseProxy passes it
@@ -474,7 +488,10 @@ func timing(start, end time.Time) *float64 {
 }
 
 // addToHistory adds the request, which has ended, to its client's
-// history.
+// history, and then, for a client that was looked up, the answer kept
+// about it to that history and to the notes of the bans on its netblock:
+// an answer that came during the request may have come before either was
+// there, and one that comes later is added when it comes.
 func (rq *request) addToHistory() {
 	var requestBytes int64
 	if rq.body != nil {
@@ -482,9 +499,9 @@ func (rq *request) addToHistory() {
 	}
 
 	forwarded := !rq.upstreamStart.IsZero()
+	group := clientGroup(rq.client)
 
-	rq.h.limiter.AddToHistory(clientGroup(rq.client), rq.h.now(), ratelimit.Request{
-		Country:       rq.line.Country,
+	rq.h.limiter.AddToHistory(group, rq.h.now(), ratelimit.Request{
 		Forwarded:     forwarded,
 		Refused:       !forwarded && rq.refused.Load() != nil,
 		Status:        rq.out.status,
@@ -492,6 +509,15 @@ func (rq *request) addToHistory() {
 		ResponseBytes: rq.out.bytes,
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
 	})
+
+	if !rq.lookedUp {
+		return
+	}
+
+	answer, kept := rq.h.geojs.Kept(group)
+	if kept {
+		rq.h.addLookup(answer)
+	}
 }
 
 // clientRequestDeadline is when the client must have sent its whole