Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/proxy/request.go

@@ -21,7 +21,8 @@ const flushAfterEachWrite time.Duration = -1
 
 // refusal is smallwebwaf refusing a request, or refusing to go on with it:
 // the status the client is answered if the response has not started yet,
-// and the action the log line names.
+// 0 to close the connection without an answer, and the action the log
+// line names.
 type refusal struct {
 	status int
 	action string
@@ -105,39 +106,33 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 // is known, before its body is read or anything reaches the app. It
 // returns nil to let the request through. A client in SWWAF_ALLOW_NETS
 // skips every check but the size limit. For any other client,
-// SWWAF_DENY_NETS comes first, so that a client it refuses is not looked
-// up, and then the country lists; a request either refuses is not counted
-// for the rate limits. Then come the rate limits, unless the client is in
+// SWWAF_DENY_NETS comes first, then a ban on its netblock, so that a
+// client either refuses is not looked up, and then the country lists; a
+// request any of them refuses is not counted for the rate limits. Then
+// come the rate limits, unless the client is in
 // SWWAF_RATE_LIMIT_EXEMPT_NETS, so that every other request is counted,
-// one refused for its size too. ctx is the request's own context.
+// one refused for its size too. Every refusal but the size limit's is
+// answered with SWWAF_BAN_RESPONSE. ctx is the request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
 	cfg := rq.h.config
 	allowed := isInside(rq.client, cfg.AllowNets)
+	exempt := isInside(rq.client, cfg.RateLimitExemptNets)
+	now := rq.h.now()
 
 	if !allowed && isInside(rq.client, cfg.DenyNets) {
-		return &refusal{
-			status: http.StatusForbidden,
-			action: requestlog.ActionDenied,
-		}
+		return rq.banResponse(requestlog.ActionDenied)
+	}
+
+	if !allowed && rq.banned(now) {
+		return rq.banResponse(requestlog.ActionBanned)
 	}
 
 	if !allowed && rq.countryDenied(ctx) {
-		return &refusal{
-			status: http.StatusForbidden,
-			action: requestlog.ActionCountryDenied,
-		}
+		return rq.banResponse(requestlog.ActionCountryDenied)
 	}
 
-	if !allowed && !isInside(rq.client, cfg.RateLimitExemptNets) {
-		limitHit := rq.h.limiter.Count(clientGroup(rq.client), rq.start)
-		if limitHit != "" {
-			rq.line.LimitHit = limitHit
-
-			return &refusal{
-				status: http.StatusTooManyRequests,
-				action: requestlog.ActionRateLimited,
-			}
-		}
+	if !allowed && !exempt && rq.limitBroken(now) {
+		return rq.banResponse(requestlog.ActionRateLimited)
 	}
 
 	maxBytes := cfg.RequestMaxBytes
@@ -250,6 +245,13 @@ func (rq *request) answer(r refusal) {
 		return // too late to answer: the connection can only be cut
 	}
 
+	if r.status == 0 {
+		// SWWAF_BAN_RESPONSE is close. This panic has Go's server close
+		// the connection without an answer, and log nothing; the log line
+		// is still written as the handler returns.
+		panic(http.ErrAbortHandler)
+	}
+
 	// A client found too slow is read no more; any other may go on
 	// sending until its time is up, so that Go's server can read the
 	// rest of the body and end the request cleanly.