Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

SWWAF_ANOMALY_CLIENT_*, _NET_*, _ASN_*, _TOTAL_* and SWWAF_WATCH_* with
SWWAF_WATCH_NETS: requests and bytes per minute and per hour, each off by
default. Every request but the health check is counted, allow-listed and
exempt ones included, in the buckets the rate limits use; a count over its
threshold raises an anomaly alert, with a cooldown per scope. At most
20,000 counters, kept in alerts.json. A per-AS-number threshold with
lookups off, or a malformed SWWAF_WATCH_NETS, stops the start.

Judgement call: refused requests are counted too.
Judgement call: per-client counters are kept in alerts.json, which SPEC.md does not list.
Judgement call: a request counts for an AS number only if the lookup answered before it ended.

Model: opus-5-5

internal/proxy/bans.go

@@ -56,44 +56,23 @@ func (rq *request) limitBroken(now time.Time) bool {
 	return over
 }
 
-// countBytes counts the request's bytes for the byte limits, once its
-// response has ended, and notes the client's byte totals for the log line;
-// its requests stay there as the rate limits counted them. The bytes are
-// the response's body bytes, the request's, or both, as SWWAF_BYTES_COUNT
-// says; for an upgraded connection, such as a WebSocket, which has closed
-// by then, what it carried from the app counts with the response's and
-// what it carried from the client with the request's. Only a request
-// passed to the app has them counted, and only one the rate limits
-// counted; in observe mode, not one that enforce mode would have refused.
-// Bytes that take the client over a byte limit, as its limit percentage
-// for the byte limits lowers it, break it; the response was passed on
-// whole.
+// countBytes counts the request's bytes, as countedBytes gives them, for
+// the byte limits, once its response has ended, and notes the client's
+// byte totals for the log line; its requests stay there as the rate limits
+// counted them. Only a request passed to the app has them counted, and
+// only one the rate limits counted; in observe mode, not one that enforce
+// mode would have refused. Bytes that take the client over a byte limit,
+// as its limit percentage for the byte limits lowers it, break it; the
+// response was passed on whole.
 func (rq *request) countBytes() {
 	if !rq.counted || rq.line.WouldAction != "" {
 		return
 	}
 
-	response, request := rq.out.bytes, rq.requestBytes()
-	if rq.upgraded != nil {
-		response += rq.upgraded.fromApp.Load()
-		request += rq.upgraded.toApp.Load()
-	}
-
-	var bytes int64
-
-	switch rq.h.config.BytesCount {
-	case "response":
-		bytes = response
-	case "request":
-		bytes = request
-	default: // both
-		bytes = response + request
-	}
-
 	now := rq.h.now()
 
-	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now, bytes,
-		rq.bytesPercent.percent)
+	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now,
+		rq.countedBytes(), rq.bytesPercent.percent)
 	rq.line.Counts.MinuteBytes = counts.MinuteBytes
 	rq.line.Counts.HourBytes = counts.HourBytes
 	rq.line.Counts.DayBytes = counts.DayBytes
@@ -103,6 +82,29 @@ func (rq *request) countBytes() {
 	}
 }
 
+// countedBytes returns the request's bytes, once it has ended, as the
+// byte limits and the anomaly thresholds count them: the response's body
+// bytes, the request's, or both, as SWWAF_BYTES_COUNT says. For an
+// upgraded connection, such as a WebSocket, which has closed by then, what
+// it carried from the app counts with the response's and what it carried
+// from the client with the request's.
+func (rq *request) countedBytes() int64 {
+	response, request := rq.out.bytes, rq.requestBytes()
+	if rq.upgraded != nil {
+		response += rq.upgraded.fromApp.Load()
+		request += rq.upgraded.toApp.Load()
+	}
+
+	switch rq.h.config.BytesCount {
+	case "response":
+		return response
+	case "request":
+		return request
+	default: // both
+		return response + request
+	}
+}
+
 // banForLimit bans the client's netblock at now for a broken limit, the
 // one hit names, and notes the offence for the log line. status is what
 // the client was sent, or is sent: SWWAF_BAN_RESPONSE for a request over