Rule files, and bans for a clear sign of attack (closes #24)

Every *.rules file in SWWAF_RULES_DIR is read at start and on each
change, and each request is checked against the rules after the rate
limits: log notes a match, block refuses with 403, ban refuses and bans
the netblock for SWWAF_ATTACK_BAN_DURATION, made permanent by its next
request or clear sign of attack. path, query and uri are matched as the
request line sent them. bans.json gains each ban's cause, and ban notes
count earlier bans by cause. The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

internal/bans/bans_test.go

@@ -24,8 +24,9 @@ func TestRepeatsTripleUntilPermanent(t *testing.T) {
 		ban := ledger.BanForLimit(netblock, now, bans.Notes{})
 
 		length := time.Duration(hours) * time.Hour
-		if !ban.Expires.Equal(now.Add(length)) || ban.Notes.EarlierBans != i {
-			t.Fatalf("ban %d lasts %s with %d earlier bans, want %d hours and %d",
+		if !ban.Expires.Equal(now.Add(length)) ||
+			ban.Notes.EarlierBans != (bans.EarlierBans{Limit: i}) {
+			t.Fatalf("ban %d lasts %s with earlier bans %+v, want %d hours and %d for a limit",
 				i+1, ban.Expires.Sub(now), ban.Notes.EarlierBans, hours, i)
 		}
 
@@ -66,8 +67,9 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 			first := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
 			second := ledger.BanForLimit(netblock, first.Expires.Add(tc.gap), bans.Notes{})
 
-			if second.Expires.Sub(second.Start) != tc.want || second.Notes.EarlierBans != 1 {
-				t.Errorf("second ban lasts %s with %d earlier bans, want %s and 1",
+			if second.Expires.Sub(second.Start) != tc.want ||
+				second.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
+				t.Errorf("second ban lasts %s with earlier bans %+v, want %s and 1 for a limit",
 					second.Expires.Sub(second.Start), second.Notes.EarlierBans, tc.want)
 			}
 		})
@@ -235,9 +237,102 @@ func TestFullLedgerDropsTheEarlierBanOfTheNetblockBannedAgain(t *testing.T) {
 	second := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
 
 	held := ledger.Bans(netblock)
-	if len(held) != 1 || held[0] != second || held[0].Notes.EarlierBans != 1 {
-		t.Errorf("the ledger holds %+v, want only the second ban, with 1 earlier ban",
-			held)
+	if len(held) != 1 || held[0] != second ||
+		held[0].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
+		t.Errorf("the ledger holds %+v, want only the second ban, "+
+			"with 1 earlier ban for a limit", held)
+	}
+}
+
+func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	notes := bans.Notes{RuleID: "env-file", Target: "path"}
+
+	ban := ledger.BanForAttack(netblock, midnight(), notes)
+	if !ban.Expires.Equal(midnight().Add(7*day)) || ban.Cause != bans.CauseAttack ||
+		ban.Notes.RuleID != "env-file" || ledger.Made(bans.CauseAttack) != 1 ||
+		ledger.Made(bans.CauseLimit) != 0 {
+		t.Fatalf("the ban is %+v, with %d made for an attack and %d for a limit, "+
+			"want one for an attack, of seven days", ban,
+			ledger.Made(bans.CauseAttack), ledger.Made(bans.CauseLimit))
+	}
+
+	wantChanged(t, ledger, true)
+
+	// In observe mode the ban refuses nothing, and stays as it is.
+	got, _ := ledger.Find(netblock.Addr(), midnight().Add(time.Hour))
+	if got.Permanent() {
+		t.Fatal("a request found under the ban made it permanent")
+	}
+
+	// A request it refuses makes it permanent, and bans.json due.
+	got, _ = ledger.Check(netblock.Addr(), midnight().Add(time.Hour))
+	if !got.Permanent() || !ledger.Bans(netblock)[0].Permanent() {
+		t.Fatalf("after a request during the ban, it is %+v, want it permanent", got)
+	}
+
+	wantChanged(t, ledger, true)
+
+	_, banned := ledger.Check(netblock.Addr(), midnight().Add(100*365*day))
+	if !banned {
+		t.Error("the permanent ban ended")
+	}
+}
+
+func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+
+	// A ban for a broken limit before does not count.
+	first := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+	second := ledger.BanForAttack(netblock, first.Expires, bans.Notes{})
+
+	if second.Expires.Sub(second.Start) != 7*day {
+		t.Fatalf("the first ban for an attack lasts %s, want 7 days",
+			second.Expires.Sub(second.Start))
+	}
+
+	// Once that has run out without a request, the netblock is served, and
+	// its next clear sign of attack bans it for good.
+	_, banned := ledger.Check(netblock.Addr(), second.Expires)
+	if banned {
+		t.Fatal("the ban did not end")
+	}
+
+	// Its notes show the earlier ban for an attack that makes it permanent,
+	// beside the one for a limit.
+	third := ledger.BanForAttack(netblock, second.Expires.Add(30*day), bans.Notes{})
+	if !third.Permanent() ||
+		third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Attack: 1}) {
+		t.Errorf("the next ban for an attack is %+v, want a permanent one, "+
+			"with 1 earlier ban for a limit and 1 for an attack", third)
+	}
+}
+
+func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+
+	// Three times the seven days would be permanent; a limit broken as the
+	// ban for an attack ends bans for an hour, as a first broken limit does.
+	attack := ledger.BanForAttack(netblock, midnight(), bans.Notes{})
+	limit := ledger.BanForLimit(netblock, attack.Expires, bans.Notes{})
+
+	if limit.Expires.Sub(limit.Start) != time.Hour || limit.Cause != bans.CauseLimit {
+		t.Errorf("the ban for a limit is %+v, want one of an hour", limit)
+	}
+
+	// And a request during the ban for a limit leaves it as it is.
+	got, _ := ledger.Check(netblock.Addr(), limit.Start)
+	if got.Permanent() {
+		t.Error("a request during a ban for a limit made it permanent")
 	}
 }
 
@@ -269,6 +364,7 @@ func defaultRules() bans.Rules {
 		LimitBanDuration:     time.Hour,
 		LimitBanRepeatWindow: day,
 		MaxBanDuration:       7 * day,
+		AttackBanDuration:    7 * day,
 		MaxBans:              5000,
 	}
 }