Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -54,11 +54,22 @@ func New(limits Limits) *Limiter {
 	}
 }
 
+// Hit is a request that takes a client over a rate limit.
+type Hit struct {
+	// Window is "minute", "hour" or "day".
+	Window string
+	// Limit is the window's limit.
+	Limit int64
+	// Requests is the client's requests counted in the window, this one
+	// included.
+	Requests float64
+}
+
 // Count counts a request from client at now, in every window, whether or
-// not it is refused. It returns the window whose limit the request takes
-// the client over, "minute", "hour" or "day", the shortest if it is over
-// several, or "" if it is within every limit.
-func (l *Limiter) Count(client netip.Prefix, now time.Time) string {
+// not it is refused. It reports whether the request takes the client over
+// a limit, and the window whose limit it goes over, the shortest if it is
+// over several.
+func (l *Limiter) Count(client netip.Prefix, now time.Time) (Hit, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -68,16 +79,24 @@ func (l *Limiter) Count(client netip.Prefix, now time.Time) string {
 		l.clients.Add(client, counts)
 	}
 
-	limitHit := ""
+	var hit Hit
 
 	for i, w := range l.windows {
 		requests := counts[i].add(now, w.length)
-		if limitHit == "" && w.limit > 0 && requests > float64(w.limit) {
-			limitHit = w.name
+		if hit.Window == "" && w.limit > 0 && requests > float64(w.limit) {
+			hit = Hit{Window: w.name, Limit: w.limit, Requests: requests}
 		}
 	}
 
-	return limitHit
+	return hit, hit.Window != ""
+}
+
+// Reset sets client's counts in every window back to zero.
+func (l *Limiter) Reset(client netip.Prefix) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	l.clients.Remove(client)
 }
 
 // window is a length of time over which requests are counted, and the

internal/ratelimit/ratelimit_test.go

@@ -54,6 +54,52 @@ func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 	}
 }
 
+func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: limit})
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	for range limit {
+		_, over := limiter.Count(client, start)
+		if over {
+			t.Fatal("a request within the limit is over it")
+		}
+	}
+
+	// Over both limits; the minute's is named, with the four requests.
+	hit, over := limiter.Count(client, start)
+
+	want := ratelimit.Hit{Window: minute, Limit: limit, Requests: limit + 1}
+	if !over || hit != want {
+		t.Errorf("request over the limit gives %+v and %t, want %+v and true",
+			hit, over, want)
+	}
+}
+
+func TestResetSetsTheCountsBackToZero(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit})
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	for range limit {
+		wantCount(t, limiter, client, start, "")
+	}
+
+	wantCount(t, limiter, client, start, minute)
+	limiter.Reset(client)
+
+	// At the same moment, the client has its whole allowance again.
+	for range limit {
+		wantCount(t, limiter, client, start, "")
+	}
+
+	wantCount(t, limiter, client, start, minute)
+}
+
 func TestClientBackAfterAWholeBucketIsWithinTheLimitAtOnce(t *testing.T) {
 	t.Parallel()
 
@@ -192,9 +238,9 @@ func wantCount(
 ) {
 	t.Helper()
 
-	got := limiter.Count(client, now)
-	if got != want {
+	hit, _ := limiter.Count(client, now)
+	if hit.Window != want {
 		t.Errorf("request from %s at %s is over %q, want %q",
-			client, now.Format(time.RFC3339), got, want)
+			client, now.Format(time.RFC3339), hit.Window, want)
 	}
 }