Byte limits per client over a minute, an hour and a day (closes #20)

SWWAF_BYTES_LIMIT_PER_MINUTE, _PER_HOUR and _PER_DAY (10G, 20G, 50G)
and SWWAF_BYTES_COUNT (both). A request's bytes are counted once its
answer has ended, for a request passed to the app that the rate limits
count; what a WebSocket carries each way, once it closes. Bytes over a
limit ban the client as a broken rate limit does, and cut nothing
short. clients.json keeps the byte buckets, the log line's counts carry
the byte totals, ban notes say what the limit is on, and the limit hits
metric is labelled by kind.

Judgement call: limit_hit names a byte window minute_bytes, hour_bytes
or day_bytes, as counts names the byte totals.
Judgement call: in observe mode, the bytes of a request enforce mode
would have refused are not counted.

Model: opus-5-5

internal/config/config.go

@@ -91,6 +91,15 @@ type Config struct {
 	// limits neither count nor refuse (SWWAF_RATE_LIMIT_EXEMPT_PATHS).
 	// Each starts with /.
 	RateLimitExemptPaths []string
+	// BytesLimitPerMinute, BytesLimitPerHour and BytesLimitPerDay are the
+	// most bytes a client's requests may carry in a minute, an hour and a
+	// day (SWWAF_BYTES_LIMIT_PER_MINUTE, SWWAF_BYTES_LIMIT_PER_HOUR and
+	// SWWAF_BYTES_LIMIT_PER_DAY). BytesCount is which body bytes count
+	// toward them (SWWAF_BYTES_COUNT): response, request or both.
+	BytesLimitPerMinute int64
+	BytesLimitPerHour   int64
+	BytesLimitPerDay    int64
+	BytesCount          string
 	// LookupSource is where each client's AS number and country are
 	// looked up (SWWAF_LOOKUP_SOURCE): geojs, file, or off for nowhere.
 	// LookupDBPath is the lookup database, the IPinfo Lite file looked up
@@ -266,6 +275,7 @@ var (
 		"is not an absolute path, such as /var/lib/smallwebwaf")
 	errShortToken    = errors.New("is shorter than 32 characters")
 	errNotMode       = errors.New("is not enforce or observe")
+	errNotBytesCount = errors.New("is not response, request or both")
 	errNotPathPrefix = errors.New(
 		"is not a path prefix starting with /, such as /assets/")
 	errNotBoolean      = errors.New("is not true or false")
@@ -321,6 +331,10 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "10000"),
 		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "50000"),
 		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
+		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "10G"),
+		BytesLimitPerHour:       env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
+		BytesLimitPerDay:        env.size("SWWAF_BYTES_LIMIT_PER_DAY", "50G"),
+		BytesCount:              env.bytesCount("SWWAF_BYTES_COUNT", "both"),
 		LookupSource:            env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
 		LookupDBPath:            env.value("SWWAF_LOOKUP_DB_PATH", ""),
 		LookupTimeout:           env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "1s"),
@@ -551,6 +565,17 @@ func (e *environment) count(name, defaultValue string) int64 {
 	return count
 }
 
+// bytesCount reads the setting that is which body bytes count toward the
+// byte limits: response, request or both.
+func (e *environment) bytesCount(name, defaultValue string) string {
+	value := e.value(name, defaultValue)
+	if value != "response" && value != "request" && value != "both" {
+		e.check(name, fmt.Errorf("%q %w", value, errNotBytesCount))
+	}
+
+	return value
+}
+
 // pathPrefixes reads a setting that is a list of path prefixes.
 func (e *environment) pathPrefixes(name, defaultValue string) []string {
 	prefixes, err := parsePathPrefixes(e.value(name, defaultValue))