servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

internal/proxy/request.go

@@ -39,20 +39,20 @@ type refusal struct {
 	limit  string
 }
 
-// request is one request on its way through smallwebwaf, from the moment
-// its headers have been read to its log line.
-type request struct {
-	h  *handler
-	in *http.Request
-	// rc sets the deadlines of the connection to the client.
-	rc   *http.ResponseController
-	out  *responseWriter
-	body *requestBody // nil for a request without a body
-	line requestlog.Line
-
-	client      netip.Addr
-	peer        netip.Addr
-	peerTrusted bool
+// decision is what the checks note of a request: its log line, and what
+// counting the request needs once it has ended. servewaf keeps a copy of it
+// until the request's report comes. It holds no credentials, since the log line
+// never does, and neither the request's objects nor their bodies.
+type decision struct {
+	line   requestlog.Line
+	client netip.Addr
+	// requestURI is the path with the query, as a ban's notes keep it.
+	requestURI string
+	// site is, in servewaf, the host the visitor asked for, which the
+	// alerts name, since one servewaf serves many sites. It is "" otherwise.
+	site string
+	// allowed is true for a question answered with DispositionAllow.
+	allowed bool
 	// lookedUp is true once the client's AS number and country have been
 	// looked up, whether or not an answer was there, and lookupAnswer is
 	// what the lookup gave then, the zero Answer while GeoJS had given none.
@@ -65,18 +65,37 @@ type request struct {
 	counted                    bool
 	limitPercent, bytesPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
-	// trap path, ruleBlocked for one a block rule refused, wafBlocked for
-	// one the Core Rule Set refused, and tokenRefused for one refused for a
-	// missing or wrong token, each an offence its client's history counts.
-	attack, ruleBlocked, wafBlocked, tokenRefused bool
+	// trap path, ruleBlocked for one a block rule refused, and wafBlocked for
+	// one the Core Rule Set refused, each an offence its client's history
+	// counts.
+	attack, ruleBlocked, wafBlocked bool
+	// reputation is the reputation sources that list the client, for the
+	// notes of a ban the request makes.
+	reputation []bans.ReputationHit
+}
+
+// request is one request on its way through smallwebwaf, from the moment
+// its headers have been read to its log line.
+type request struct {
+	decision
+
+	h  *handler
+	in *http.Request
+	// rc sets the deadlines of the connection to the client.
+	rc   *http.ResponseController
+	out  *responseWriter
+	body *requestBody // nil for a request without a body
+
+	peer        netip.Addr
+	peerTrusted bool
+	// tokenRefused is true for a request refused for a missing or wrong
+	// token, an offence its client's history counts.
+	tokenRefused bool
 	// blocklisted is true once a blocklist is found to list the client,
 	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
 	// AbuseIPDB's score of it is a hit.
 	blocklisted, dnsblListed, abuseIPDBHit bool
-	// reputation is the reputation sources that list the client, for the
-	// notes of a ban the request makes.
-	reputation []bans.ReputationHit
-	start      time.Time
+	start                                  time.Time
 	// checked is when the checks were done, and upstreamStart when the
 	// request was handed to the app.
 	checked       time.Time
@@ -108,50 +127,62 @@ type request struct {
 	answerStarted time.Time
 }
 
-// newRequest starts handling r: it notes the time, counts the request as
-// under way, works out the client, and starts the log line with what is
-// known of the request.
+// newRequest starts handling r: it works out the client from the TCP peer
+// and X-Forwarded-For, and goes on as startRequest does.
 func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
+	peer := peerAddress(r)
+	trusted := h.config.TrustedProxies
+	client := clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted)
+
+	return h.startRequest(w, r, client, peer, isInside(peer, trusted))
+}
+
+// startRequest starts handling r from client, which came through peer: it
+// notes the time, counts the request as under way, and starts the log line
+// with what is known of the request. peerTrusted says whether to believe
+// the request's id and scheme, which r's headers give.
+func (h *handler) startRequest(
+	w http.ResponseWriter, r *http.Request, client, peer netip.Addr, peerTrusted bool,
+) *request {
 	h.metrics.RequestStarted()
 
 	start := time.Now()
-	peer := peerAddress(r)
-	trusted := h.config.TrustedProxies
-	peerTrusted := isInside(peer, trusted)
 	forwardedFor := r.Header.Values("X-Forwarded-For")
-	client := clientAddress(peer, forwardedFor, trusted)
 
 	rq := &request{
+		decision: decision{
+			client:     client,
+			requestURI: r.URL.RequestURI(),
+			line: requestlog.Line{
+				Time:             requestlog.FormatTime(start),
+				Instance:         h.config.InstanceName,
+				ClientIP:         client.String(),
+				Method:           r.Method,
+				Scheme:           scheme(r, peerTrusted),
+				Host:             r.Host,
+				Path:             rules.Path(r),
+				Query:            r.URL.RawQuery,
+				Protocol:         r.Proto,
+				Referer:          r.Referer(),
+				UserAgent:        r.UserAgent(),
+				RequestID:        requestID(r, peerTrusted),
+				PeerIP:           peer.String(),
+				ForwardedFor:     strings.Join(forwardedFor, ", "),
+				ClientGroup:      h.clientGroup(client).String(),
+				ContentType:      r.Header.Get("Content-Type"),
+				RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
+				HasAuthorization: len(r.Header.Values("Authorization")) > 0,
+				HasCookie:        len(r.Header.Values("Cookie")) > 0,
+				Action:           requestlog.ActionForward,
+			},
+		},
 		h:           h,
 		in:          r,
 		rc:          http.NewResponseController(w),
 		out:         &responseWriter{ResponseWriter: w},
-		client:      client,
 		peer:        peer,
 		peerTrusted: peerTrusted,
 		start:       start,
-		line: requestlog.Line{
-			Time:             requestlog.FormatTime(start),
-			Instance:         h.config.InstanceName,
-			ClientIP:         client.String(),
-			Method:           r.Method,
-			Scheme:           scheme(r, peerTrusted),
-			Host:             r.Host,
-			Path:             rules.Path(r),
-			Query:            r.URL.RawQuery,
-			Protocol:         r.Proto,
-			Referer:          r.Referer(),
-			UserAgent:        r.UserAgent(),
-			RequestID:        requestID(r, peerTrusted),
-			PeerIP:           peer.String(),
-			ForwardedFor:     strings.Join(forwardedFor, ", "),
-			ClientGroup:      h.clientGroup(client).String(),
-			ContentType:      r.Header.Get("Content-Type"),
-			RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
-			HasAuthorization: len(r.Header.Values("Authorization")) > 0,
-			HasCookie:        len(r.Header.Values("Cookie")) > 0,
-			Action:           requestlog.ActionForward,
-		},
 	}
 
 	// A length of -1 is a body whose length was not announced.
@@ -569,10 +600,20 @@ func (rq *request) finish() {
 	}
 
 	// Counted before the log line is written, so that the metrics count
-	// every request whose line is out.
-	rq.h.metrics.RequestEnded(line, limit, duration, upstreamDuration)
+	// every request whose line is out. An allowed request is the exception:
+	// its report gives the status, bytes and times the metrics count.
+	if rq.allowed {
+		rq.h.metrics.RequestAllowed()
+	} else {
+		rq.h.metrics.RequestEnded(line, limit, duration, upstreamDuration)
+	}
 
-	err := requestlog.Write(rq.h.requestLog, line)
+	rq.writeLine()
+}
+
+// writeLine writes the request's log line.
+func (rq *request) writeLine() {
+	err := requestlog.Write(rq.h.requestLog, &rq.line)
 	if err != nil {
 		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
 	}
@@ -634,6 +675,7 @@ func (rq *request) countAnomalies() {
 	answer, _ := rq.answerAtTheEnd()
 
 	rq.h.anomalies.Count(rq.h.now(), anomaly.Request{
+		Host:        rq.site,
 		Client:      rq.client,
 		ClientGroup: rq.h.clientGroup(rq.client),
 		ASN:         answer.ASN,