rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/metrics/metrics.go

@@ -28,16 +28,15 @@ type Metrics struct {
 	registry prometheus.Registerer
 	handler  http.Handler
 
-	inFlight             prometheus.Gauge
-	requests             *prometheus.CounterVec
-	requestBytes         *prometheus.CounterVec
-	responseBytes        *prometheus.CounterVec
-	requestDuration      prometheus.Histogram
-	upstreamDuration     prometheus.Histogram
-	rateLimitHits        *prometheus.CounterVec
-	sizeAndTimeLimitHits *prometheus.CounterVec
-	offences             *prometheus.CounterVec
-	wafMatches           *prometheus.CounterVec
+	inFlight         prometheus.Gauge
+	requests         *prometheus.CounterVec
+	requestBytes     *prometheus.CounterVec
+	responseBytes    *prometheus.CounterVec
+	requestDuration  prometheus.Histogram
+	upstreamDuration prometheus.Histogram
+	rateLimitHits    *prometheus.CounterVec
+	offences         *prometheus.CounterVec
+	wafMatches       *prometheus.CounterVec
 	// ruleMatches are made by AddRules, and reputationHits by
 	// AddReputation.
 	ruleMatches    *prometheus.CounterVec
@@ -100,9 +99,6 @@ func New(topN int, instanceName string) *Metrics {
 			"Requests that broke a rate limit, a byte limit or the error burst, by "+
 				"its window and its kind, requests, bytes or refusals.",
 			[]string{"window", "kind"}),
-		sizeAndTimeLimitHits: counterVec("smallwebwaf_size_and_time_limit_hits_total",
-			"Requests that passed a size or time limit, by its setting.",
-			[]string{"limit"}),
 		offences: counterVec("smallwebwaf_offences_total",
 			"Offences, by kind.", []string{"kind"}),
 		wafMatches: counterVec("smallwebwaf_waf_matches_total",
@@ -143,7 +139,7 @@ func New(topN int, instanceName string) *Metrics {
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
 		m.inFlight, m.requests, m.requestBytes, m.responseBytes,
 		m.requestDuration, m.upstreamDuration,
-		m.rateLimitHits, m.sizeAndTimeLimitHits, m.offences, m.wafMatches,
+		m.rateLimitHits, m.offences, m.wafMatches,
 		m.countries, m.asns,
 		m.GeoJSRequests, m.GeoJSFailures, m.GeoJSUnanswered,
 		m.stateFileWrites, m.stateFileWriteFailures,
@@ -395,15 +391,11 @@ func (m *Metrics) RequestStarted() {
 	m.inFlight.Inc()
 }
 
-// RequestEnded counts a request that has ended, from its log line. limit
-// is the setting whose size or time limit the request passed, "" if none.
-// duration is how long the request took, and upstreamDuration how long it
-// took from when it was passed to the app, zero if it was not.
-func (m *Metrics) RequestEnded(
-	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
-) {
+// RequestEnded counts a request that has ended without being passed to the app,
+// from its log line. duration is how long the request took.
+func (m *Metrics) RequestEnded(line *requestlog.Line, duration time.Duration) {
 	m.inFlight.Dec()
-	m.count(line, limit, duration, upstreamDuration)
+	m.count(line, duration, 0)
 }
 
 // RequestAllowed counts a question of rproxy's, answered allow, as no longer
@@ -412,12 +404,13 @@ func (m *Metrics) RequestAllowed() {
 	m.inFlight.Dec()
 }
 
-// RequestReported counts a request rproxy passed to the app, as RequestEnded
-// does, from what its report says, which line holds.
+// RequestReported counts a request rproxy passed to the app, from what its
+// report says, which line holds: duration is how long the request took, and
+// upstreamDuration how long it took from when it was passed to the app.
 func (m *Metrics) RequestReported(
 	line *requestlog.Line, duration, upstreamDuration time.Duration,
 ) {
-	m.count(line, "", duration, upstreamDuration)
+	m.count(line, duration, upstreamDuration)
 }
 
 // LimitHit counts a request that broke a rate limit, a byte limit or the
@@ -431,11 +424,10 @@ func (m *Metrics) LimitHit(hit ratelimit.Hit) {
 // them.
 func (m *Metrics) Offences(r ratelimit.Request) {
 	for kind, committed := range map[string]bool{
-		"limit":         r.BrokeLimit,
-		"attack":        r.Attack,
-		"rule_blocked":  r.RuleBlocked,
-		"waf_blocked":   r.WAFBlocked,
-		"token_refused": r.TokenRefused,
+		"limit":        r.BrokeLimit,
+		"attack":       r.Attack,
+		"rule_blocked": r.RuleBlocked,
+		"waf_blocked":  r.WAFBlocked,
 	} {
 		if committed {
 			m.offences.WithLabelValues(kind).Inc()
@@ -486,9 +478,10 @@ func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
 }
 
-// count counts a request that has ended, as RequestEnded describes.
+// count counts a request that has ended, as RequestEnded and RequestReported
+// describe.
 func (m *Metrics) count(
-	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
+	line *requestlog.Line, duration, upstreamDuration time.Duration,
 ) {
 	class := statusClass(line.Status)
 	m.requests.WithLabelValues(class, line.Action).Inc()
@@ -500,10 +493,6 @@ func (m *Metrics) count(
 		m.upstreamDuration.Observe(upstreamDuration.Seconds())
 	}
 
-	if limit != "" {
-		m.sizeAndTimeLimitHits.WithLabelValues(limit).Inc()
-	}
-
 	if line.Country != "" {
 		m.countries.add(line.Country, line)
 	}