Trap paths, and the error burst banning a client refused too often (closes #115)

SWWAF_TRAP_PATHS: a request whose path, as a path rule sees it, is one
of them is a clear sign of attack, banned as a ban rule's match is; the
ban's notes give its trap_path. Checked after the rate limits, before the
rule files.

SWWAF_ERROR_BURST_THRESHOLD (default 30, or off): more refusals in a
minute after a block or ban rule or a trap path, or for a missing or
wrong token, ban the client as a broken limit does. Counted in
clients.json's minute_refusals; limit_hit error_burst, notes kind
refusals.

A token refusal is now the offence token_refused, and
smallwebwaf_offences_total counts every kind the history does.

Judgement call: the threshold is not lowered by a client's limit percentage.

Model: opus-5-5

internal/proxy/request.go

@@ -64,10 +64,11 @@ type request struct {
 	// limits and for the byte limits.
 	counted                    bool
 	limitPercent, bytesPercent percentage
-	// attack is true for a request that matched a ban rule, and
-	// ruleBlocked for one a block rule refused, each an offence its
-	// client's history counts.
-	attack, ruleBlocked bool
+	// attack is true for a request that matched a ban rule or asked for a
+	// trap path, ruleBlocked for one a block rule refused, and
+	// tokenRefused for one refused for a missing or wrong token, each an
+	// offence its client's history counts.
+	attack, ruleBlocked, tokenRefused bool
 	// blocklisted is true once a blocklist is found to list the client,
 	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
 	// AbuseIPDB's score of it is a hit.
@@ -232,9 +233,9 @@ func (rq *request) check(ctx context.Context) *refusal {
 // rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
 // request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
 // every other request is counted, each of them by the client's limit
-// percentages, and last the rule files. A request exempt from the rate
-// limits is exempt from the byte limits too. ctx is the request's own
-// context.
+// percentages, then SWWAF_TRAP_PATHS, and last the rule files. A request
+// exempt from the rate limits is exempt from the byte limits too. ctx is
+// the request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -281,6 +282,10 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionRateLimited
 	}
 
+	if rq.trapPath(now) {
+		return requestlog.ActionBanned
+	}
+
 	return rq.checkRules(now)
 }
 
@@ -541,14 +546,14 @@ func timing(start, end time.Time) *float64 {
 }
 
 // addToHistory adds the request, which has ended, to its client's
-// history, and then the lookup's answer about the client, as
-// answerAtTheEnd gives it, to that history and to the notes of the bans
-// on its netblock: an answer may have come before either was there, and
-// one from GeoJS that comes later is added when it comes.
+// history, and counts its offences in the metrics, and then the lookup's
+// answer about the client, as answerAtTheEnd gives it, to that history and
+// to the notes of the bans on its netblock: an answer may have come
+// before either was there, and one from GeoJS that comes later is added
+// when it comes.
 func (rq *request) addToHistory() {
 	forwarded := !rq.upstreamStart.IsZero()
-
-	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), ratelimit.Request{
+	request := ratelimit.Request{
 		Forwarded:     forwarded,
 		Refused:       !forwarded && rq.refused.Load() != nil,
 		Status:        rq.out.status,
@@ -557,7 +562,11 @@ func (rq *request) addToHistory() {
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
 		Attack:        rq.attack,
 		RuleBlocked:   rq.ruleBlocked,
-	})
+		TokenRefused:  rq.tokenRefused,
+	}
+
+	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)
+	rq.h.metrics.Offences(request)
 
 	answer, found := rq.answerAtTheEnd()
 	if found {