Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/proxy/bans.go

@@ -0,0 +1,82 @@
+package proxy
+
+import (
+	"net/netip"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
+// with action.
+func (rq *request) banResponse(action string) *refusal {
+	return &refusal{status: rq.h.config.BanResponse, action: action}
+}
+
+// banned reports whether a ban on the client's netblock refuses the
+// request at now, and notes for the log line when that ban ends.
+func (rq *request) banned(now time.Time) bool {
+	ban, banned := rq.h.ledger.Check(rq.netblock(), now)
+	if banned {
+		rq.line.BanExpires = banExpires(ban)
+	}
+
+	return banned
+}
+
+// limitBroken counts the request for the rate limits at now, and reports
+// whether it takes the client over one. Such a request bans the client's
+// netblock, and sets the client's counters back to zero.
+func (rq *request) limitBroken(now time.Time) bool {
+	group := clientGroup(rq.client)
+
+	hit, over := rq.h.limiter.Count(group, now)
+	if !over {
+		return false
+	}
+
+	ban := rq.h.ledger.BanForLimit(rq.netblock(), now, bans.Notes{
+		Country: rq.line.Country,
+		Limit:   hit.Limit,
+		Window:  hit.Window,
+		Count:   hit.Requests,
+		Request: bans.Request{
+			Time:      now,
+			Method:    rq.in.Method,
+			Host:      rq.in.Host,
+			Path:      rq.in.URL.RequestURI(),
+			Status:    rq.h.config.BanResponse,
+			UserAgent: rq.in.UserAgent(),
+		},
+	})
+	rq.h.limiter.Reset(group)
+
+	rq.line.LimitHit = hit.Window
+	rq.line.Offence = requestlog.OffenceLimit
+	rq.line.BanExpires = banExpires(ban)
+
+	return true
+}
+
+// netblock is the netblock a ban on the client covers: its IPv4 address,
+// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
+// counts it in.
+func (rq *request) netblock() netip.Prefix {
+	addr := rq.client.Unmap()
+	if addr.Is4() {
+		return netip.PrefixFrom(addr, rq.h.config.BanScopeV4Prefix).Masked()
+	}
+
+	return clientGroup(addr)
+}
+
+// banExpires is when ban ends, as the log line gives it: a time, or
+// permanent.
+func banExpires(ban bans.Ban) string {
+	if ban.Permanent() {
+		return "permanent"
+	}
+
+	return requestlog.FormatTime(ban.Expires)
+}