Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/config/config_test.go

@@ -35,6 +35,12 @@ const (
 	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
 	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
 	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	banResponse             = "SWWAF_BAN_RESPONSE"
+	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
+	maxBans                 = "SWWAF_MAX_BANS"
+	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
 )
 
 // off switches a timeout, a size limit or a rate limit off.
@@ -80,6 +86,12 @@ func TestDefaults(t *testing.T) {
 		RateLimitPerMinute:          1000,
 		RateLimitPerHour:            10000,
 		RateLimitPerDay:             50000,
+		BanResponse:                 403,
+		LimitBanDuration:            time.Hour,
+		LimitBanRepeatWindow:        24 * time.Hour,
+		MaxBanDuration:              7 * 24 * time.Hour,
+		MaxBans:                     5000,
+		BanScopeV4Prefix:            32,
 	})
 
 	if cfg.UpstreamURL.String() != "http://127.0.0.1:8081" {
@@ -118,6 +130,12 @@ func TestValuesAsSet(t *testing.T) {
 		rateLimitPerDay:         "6000",
 		deniedCountries:         "cn, RU,kp,Xk",
 		allowedCountries:        "de",
+		banResponse:             "429",
+		limitBanDuration:        "15m",
+		limitBanRepeatWindow:    "2d",
+		maxBanDuration:          "30d",
+		maxBans:                 "100",
+		banScopeV4Prefix:        "24",
 	})
 
 	wantSettings(t, cfg, config.Config{
@@ -133,6 +151,12 @@ func TestValuesAsSet(t *testing.T) {
 		RateLimitPerMinute:          60,
 		RateLimitPerHour:            600,
 		RateLimitPerDay:             6000,
+		BanResponse:                 429,
+		LimitBanDuration:            15 * time.Minute,
+		LimitBanRepeatWindow:        48 * time.Hour,
+		MaxBanDuration:              30 * 24 * time.Hour,
+		MaxBans:                     100,
+		BanScopeV4Prefix:            24,
 	})
 
 	if cfg.UpstreamURL.String() != "https://app.internal:8443/" {
@@ -226,6 +250,15 @@ func TestRateLimitsOff(t *testing.T) {
 	}
 }
 
+func TestBanResponseCloseIsZero(t *testing.T) {
+	t.Parallel()
+
+	cfg := fromEnvironment(t, environment{banResponse: "close"})
+	if cfg.BanResponse != 0 {
+		t.Errorf("close read as %d, want 0", cfg.BanResponse)
+	}
+}
+
 func TestTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
 	t.Parallel()
 
@@ -290,6 +323,12 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{allowedCountries, "uk"},
 		{allowedCountries, "zz"},
 		{allowedCountries, "de,germany"},
+		{banResponse, "404"}, {banResponse, "drop"}, {banResponse, ""},
+		{limitBanDuration, off}, {limitBanDuration, "0s"}, {limitBanDuration, "1"},
+		{limitBanRepeatWindow, off}, {limitBanRepeatWindow, "-1h"},
+		{maxBanDuration, off}, {maxBanDuration, "1w"},
+		{maxBans, off}, {maxBans, "0"}, {maxBans, "5K"},
+		{banScopeV4Prefix, "33"}, {banScopeV4Prefix, "-1"}, {banScopeV4Prefix, "/24"},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
@@ -344,6 +383,12 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		rateLimitPerDay:         "50000",
 		deniedCountries:         "",
 		allowedCountries:        "",
+		banResponse:             "403",
+		limitBanDuration:        "1h",
+		limitBanRepeatWindow:    "24h",
+		maxBanDuration:          "7d",
+		maxBans:                 "5000",
+		banScopeV4Prefix:        "32",
 	}
 	if !maps.Equal(line.Settings, want) {
 		t.Errorf("logged settings\n%v\nwant\n%v", line.Settings, want)
@@ -368,6 +413,22 @@ func wantSettings(t *testing.T, got *config.Config, want config.Config) {
 		got.RateLimitPerDay != want.RateLimitPerDay {
 		t.Errorf("settings\n%+v\nwant\n%+v", got, want)
 	}
+
+	wantBanSettings(t, got, want)
+}
+
+// wantBanSettings checks the settings for bans.
+func wantBanSettings(t *testing.T, got *config.Config, want config.Config) {
+	t.Helper()
+
+	if got.BanResponse != want.BanResponse ||
+		got.LimitBanDuration != want.LimitBanDuration ||
+		got.LimitBanRepeatWindow != want.LimitBanRepeatWindow ||
+		got.MaxBanDuration != want.MaxBanDuration ||
+		got.MaxBans != want.MaxBans ||
+		got.BanScopeV4Prefix != want.BanScopeV4Prefix {
+		t.Errorf("ban settings\n%+v\nwant\n%+v", got, want)
+	}
 }
 
 // wantNetblocks checks a list of netblocks.