servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

internal/proxy/proxy.go

@@ -1,6 +1,8 @@
-// Package proxy passes each request to the app and the app's answer back,
-// unchanged, within the size and time limits, and writes one request log
-// line for each request.
+// Package proxy runs the checks on each request and writes its request log
+// line. New passes each request it lets through to the app and the app's
+// answer back, unchanged, within the size and time limits. NewServeWAF instead
+// answers rproxy's question about each request, and takes rproxy's report once
+// the visitor's answer has ended, which writes the request a second log line.
 package proxy
 
 import (
@@ -11,6 +13,8 @@ import (
 	"strings"
 	"time"
 
+	lru "github.com/hashicorp/golang-lru/v2"
+
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
@@ -19,7 +23,6 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
@@ -53,7 +56,8 @@ const ClientsPath = "/_smallwebwaf/clients/"
 // Params are what New needs.
 type Params struct {
 	Config *config.Config
-	// RequestLog receives one JSON line per request.
+	// RequestLog receives one JSON line per request, and from servewaf a second
+	// when the request's report comes.
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
@@ -109,6 +113,23 @@ type Server struct {
 // SWWAF_CLIENT_REQUEST_TIMEOUT while the headers arrive; the proxy
 // applies the timeouts and size limits from then on.
 func New(params Params) *Server {
+	h := newHandler(params)
+
+	return h.server(&http.Server{
+		Handler:           h,
+		ReadHeaderTimeout: params.Config.ClientRequestTimeout,
+		// Off is an IdleTimeout of 0, which Go's server replaces with
+		// ReadTimeout: no limit, as long as ReadTimeout stays unset.
+		IdleTimeout: params.Config.ClientIdleTimeout,
+		// Go's server reads 4 KiB past MaxHeaderBytes before it
+		// refuses, so the limit a client meets is the setting.
+		MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
+	})
+}
+
+// newHandler returns the handler with what every request shares, as the
+// settings in params make it.
+func newHandler(params Params) *handler {
 	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
 	m := metrics.New(params.Config.MetricsTopN, params.Config.InstanceName)
 	lists, dnsbl, abuseIPDB := newReputation(params, m)
@@ -171,29 +192,7 @@ func New(params Params) *Server {
 	m.AddBansAndClients(h.ledger, h.limiter, params.Now)
 	m.AddRules(params.Rules)
 
-	return &Server{
-		Server: &http.Server{
-			Addr:              params.Config.ListenAddr,
-			Handler:           h,
-			ReadHeaderTimeout: params.Config.ClientRequestTimeout,
-			// Off is an IdleTimeout of 0, which Go's server replaces with
-			// ReadTimeout: no limit, as long as ReadTimeout stays unset.
-			IdleTimeout: params.Config.ClientIdleTimeout,
-			// Go's server reads 4 KiB past MaxHeaderBytes before it
-			// refuses, so the limit a client meets is the setting.
-			MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
-			ErrorLog:       errorLog,
-		},
-		Ledger:     h.ledger,
-		Limiter:    h.limiter,
-		GeoJS:      h.geojs,
-		Anomalies:  h.anomalies,
-		LookupFile: h.lookupFile,
-		Lists:      h.lists,
-		DNSBL:      h.dnsbl,
-		AbuseIPDB:  h.abuseIPDB,
-		Metrics:    m,
-	}
+	return h
 }
 
 // newReputation returns the lists fetched from URLs, the DNSBL zones'
@@ -274,6 +273,10 @@ type handler struct {
 	rules       *rules.Files
 	coreRuleSet *waf.CoreRuleSet
 	alerts      *alerts.Queue
+	// awaitingReport holds, in servewaf, the decision on each answered
+	// question by its id until its report comes, and nil for a question still
+	// being handled.
+	awaitingReport *lru.Cache[string, *decision]
 }
 
 // newTransport returns what carries requests to the app. It never goes
@@ -299,11 +302,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// The health endpoint is answered at once, before any check, so that
 	// a health checker is never refused. It does not ask the app.
 	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
-		rq.line.Action = requestlog.ActionAdmin
-		// Set here rather than left to Go's server, which would set it only
-		// after the log line has taken the response's headers.
-		rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
-		_, _ = io.WriteString(rq.out, "ok\n")
+		rq.answerHealth()
 
 		return
 	}
@@ -339,3 +338,23 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	rq.forward(r.Context())
 }
+
+// server returns the Server of h, which listens at SWWAF_LISTEN_ADDR and
+// logs through h, with what httpServer sets.
+func (h *handler) server(httpServer *http.Server) *Server {
+	httpServer.Addr = h.config.ListenAddr
+	httpServer.ErrorLog = h.errorLog
+
+	return &Server{
+		Server:     httpServer,
+		Ledger:     h.ledger,
+		Limiter:    h.limiter,
+		GeoJS:      h.geojs,
+		Anomalies:  h.anomalies,
+		LookupFile: h.lookupFile,
+		Lists:      h.lists,
+		DNSBL:      h.dnsbl,
+		AbuseIPDB:  h.abuseIPDB,
+		Metrics:    h.metrics,
+	}
+}