Rule files, and bans for a clear sign of attack (closes #24)

Every *.rules file in SWWAF_RULES_DIR is read at start and on each
change, and each request is checked against the rules after the rate
limits: log notes a match, block refuses with 403, ban refuses and bans
the netblock for SWWAF_ATTACK_BAN_DURATION, made permanent by its next
request or clear sign of attack. path, query and uri are matched as the
request line sent them. bans.json gains each ban's cause, and ban notes
count earlier bans by cause. The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

script/example-app

@@ -3,9 +3,10 @@
 # deploy/example-app, then run the app's container with a volume for the
 # state files and check that the health check passes, that a request is
 # served through smallwebwaf, that a second one in a minute bans the
-# client, that `sv stop` stops smallwebwaf in order, that `docker stop`
-# stops the container without having to kill it, and that a new
-# container on the same volume still refuses the banned client. The
+# client, that a probe for /.env bans another client, which its next
+# request bans for good, that `sv stop` stops smallwebwaf in order, that
+# `docker stop` stops the container without having to kill it, and that
+# a new container on the same volume still refuses the banned client. The
 # containers, the volume and both images are removed however the script
 # ends. Building the app needs network access, for nixpkgs' binary cache.
 # script/check does not run this.
@@ -77,6 +78,15 @@ refused() {
     [ "$code" = 403 ]
 }
 
+# refused_from <client> <path>: a request for path from client, as
+# X-Forwarded-For names it, gets 403. smallwebwaf believes the header
+# from docker's gateway, a private address.
+refused_from() {
+    code="$(curl --silent --output /dev/null --write-out '%{http_code}' \
+        --max-time 10 --header "X-Forwarded-For: $1" "http://$address$2")" || true
+    [ "$code" = 403 ]
+}
+
 main() {
     cd "$ROOT"
     trap cleanup EXIT
@@ -100,6 +110,14 @@ main() {
     wait_for "smallwebwaf logged no ban" logged '"action":"rate_limited"'
     echo "example-app: a second request in a minute bans the client"
 
+    refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
+    wait_for "smallwebwaf logged no ban for the probe" \
+        logged '"action":"banned","rule_ids":["env-file"]'
+    refused_from 203.0.113.9 / || fail "the client of the probe was let through"
+    wait_for "the client's next request did not make its ban permanent" \
+        logged '"ban_expires":"permanent"'
+    echo "example-app: a probe for /.env bans the client, its next request for good"
+
     docker exec "$CONTAINER" sv stop smallwebwaf >/dev/null ||
         fail "sv stop smallwebwaf failed"
     wait_for "smallwebwaf did not stop in order" logged '"msg":"stopped"'

script/run

@@ -1,7 +1,9 @@
 #!/bin/sh
 # script/run: build bin/smallwebwaf with script/build and run it, with
 # the settings in the environment. Unless SWWAF_STATE_DIR is set, the
-# state files go in bin/state, beside the binary.
+# state files go in bin/state, beside the binary, and unless
+# SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
+# which the image ships.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -14,6 +16,10 @@ main() {
         export SWWAF_STATE_DIR
         mkdir -p "$SWWAF_STATE_DIR"
     fi
+    if [ -z "${SWWAF_RULES_DIR+set}" ]; then
+        SWWAF_RULES_DIR="$ROOT/share/rules.d"
+        export SWWAF_RULES_DIR
+    fi
     exec "$ROOT/bin/smallwebwaf"
 }