AbuseIPDB scores for clients that broke a limit, within a daily budget (closes #105)

With SWWAF_ABUSEIPDB_KEY set, a client whose history counts an offence
is checked in the background, at most SWWAF_ABUSEIPDB_DAILY_BUDGET checks
a day, the count kept in reputation.json. A score at or over
SWWAF_ABUSEIPDB_MIN_SCORE is a hit for SWWAF_REPUTATION_ACTION, logged as
abuseipdb and alerted with its score. A failure or the used-up budget
gives no score and raises source_failure. The key goes only in the Key
header.

Judgement call: the budget's day is UTC; AbuseIPDB documents no reset time.
Judgement call: each check sent spends budget; a minute's pause after a failure.
Judgement call: offences are those the history counts, so far broken limits only.

Model: opus-5-5

internal/state/state.go

@@ -2,8 +2,8 @@
 // SWWAF_STATE_DIR, as the "Persistent state" section of SPEC.md describes:
 // bans.json holds the bans, clients.json each client's counters and
 // history, lookups.json GeoJS's answers, reputation.json the last try and
-// last good copy of each list fetched from a URL and the DNSBL zones'
-// verdicts, and alerts.json the
+// last good copy of each list fetched from a URL, the DNSBL zones'
+// verdicts, and AbuseIPDB's scores and checks spent, and alerts.json the
 // cooldowns, the hour under way, the alerts waiting for each destination
 // and the anomaly counters. Load
 // reads them at start, Watch takes in an admin's edit of one while
@@ -77,14 +77,15 @@ type Params struct {
 	// is (SWWAF_STATE_COUNTER_INTERVAL).
 	WriteDelay      time.Duration
 	CounterInterval time.Duration
-	// Ledger, Limiter, GeoJS, Lists, DNSBL, Alerts and Anomalies hold the
-	// state. Alerts also receive a file_error alert for an edit set aside,
-	// and for a write that fails while smallwebwaf runs.
+	// Ledger, Limiter, GeoJS, Lists, DNSBL, AbuseIPDB, Alerts and Anomalies
+	// hold the state. Alerts also receive a file_error alert for an edit set
+	// aside, and for a write that fails while smallwebwaf runs.
 	Ledger    *bans.Ledger
 	Limiter   *ratelimit.Limiter
 	GeoJS     *lookup.GeoJS
 	Lists     *reputation.Lists
 	DNSBL     *reputation.DNSBL
+	AbuseIPDB *reputation.AbuseIPDB
 	Alerts    *alerts.Queue
 	Anomalies *anomaly.Counters
 	// Now tells the time by which the counters' buckets run out, normally
@@ -147,9 +148,10 @@ type lookupsFile struct {
 // reputationFile is reputation.json, indented for an admin to read and
 // edit, so that each line of a list's copy is on a line of its own.
 type reputationFile struct {
-	Version  int                  `json:"version"`
-	Lists    []reputation.List    `json:"lists"`
-	Verdicts []reputation.Verdict `json:"verdicts"`
+	Version   int                  `json:"version"`
+	Lists     []reputation.List    `json:"lists"`
+	Verdicts  []reputation.Verdict `json:"verdicts"`
+	AbuseIPDB reputation.Checks    `json:"abuseipdb"`
 }
 
 // alertsFile is alerts.json, indented for an admin to read and edit.
@@ -436,6 +438,7 @@ func (f *Files) takeIn(name string, data []byte, edit bool) (int, error) {
 		}
 
 		f.params.DNSBL.Load(file.Verdicts)
+		f.params.AbuseIPDB.Load(file.AbuseIPDB)
 		entries = len(file.Lists)
 	case alertsJSON:
 		waiting, err := f.takeInAlerts(path, data)
@@ -571,7 +574,7 @@ func (f *Files) encode(name string) ([]byte, error) {
 	case reputationJSON:
 		return encodeIndented(reputationFile{
 			Version: version, Lists: f.params.Lists.Snapshot(),
-			Verdicts: f.params.DNSBL.Snapshot(),
+			Verdicts: f.params.DNSBL.Snapshot(), AbuseIPDB: f.params.AbuseIPDB.Snapshot(),
 		})
 	default: // alerts.json
 		held := f.params.Alerts.Snapshot()
@@ -736,9 +739,11 @@ func (f *lookupsFile) check(data []byte) error {
 // of it without the time it was fetched, or without its lines, which hold
 // the list. It refuses a verdict without its zone or its client, which
 // would be about no one, whether the zone lists the client, or the time
-// it was fetched, which would drop it. A verdict's listed is false for a
-// client the zone does not list, which Verdicts cannot tell from a
-// missing one, so each listed is read again as written.
+// it was fetched, which would drop it, and so an AbuseIPDB score without
+// its client, the score, or the time it was fetched. A verdict's listed is
+// false for a client the zone does not list, and a score can be 0, which
+// the structs cannot tell from a missing one, so each is read again as
+// written.
 func (f *reputationFile) check(data []byte) error {
 	for i, kept := range f.Lists {
 		switch {
@@ -777,6 +782,36 @@ func (f *reputationFile) check(data []byte) error {
 		}
 	}
 
+	return checkScores(f.AbuseIPDB.Scores, data)
+}
+
+// checkScores refuses an AbuseIPDB score, of scores, read from data, as
+// reputationFile's check describes.
+func checkScores(scores []reputation.Score, data []byte) error {
+	var written struct {
+		AbuseIPDB struct {
+			Scores []struct {
+				Score *int64 `json:"score"`
+			} `json:"scores"`
+		} `json:"abuseipdb"`
+	}
+
+	err := json.Unmarshal(data, &written)
+	if err != nil {
+		return err
+	}
+
+	for i, kept := range scores {
+		switch {
+		case !kept.Client.IsValid():
+			return fmt.Errorf("abuseipdb scores %w", missing(i, "client"))
+		case written.AbuseIPDB.Scores[i].Score == nil:
+			return fmt.Errorf("abuseipdb scores %w", missing(i, "score"))
+		case kept.Fetched.IsZero():
+			return fmt.Errorf("abuseipdb scores %w", missing(i, "fetched"))
+		}
+	}
+
 	return nil
 }