Caches of outside APIs live in /var/cache/sww (closes #314)

The answers of GeoJS, the lists fetched by URL, the DNS blocklists,
AbuseIPDB and routewatch each go in a cache file in SWW_CACHE_DIR
(default /var/cache/sww): lookups.json, lists.json, dnsbl.json,
abuseipdb-scores.json and routewatch.json. reputation.json is gone. The
AbuseIPDB checks spent today are a count, not a cache, and stay in
SWW_STATE_DIR as abuseipdb-checks-spent.json.

A cache file never stops the start: one that does not parse is set
aside as an edit is, one that cannot be read is written over, and its
cache starts empty. An unwritable SWW_CACHE_DIR stops the start, as an
unwritable SWW_STATE_DIR does. Each directory is watched on its own.
The run script makes the cache directory and gives it to sww.

Model: opus-5-5

internal/sww/sww.go

@@ -244,6 +244,7 @@ func loadStateFiles(
 ) (*state.Files, error) {
 	return state.Load(state.Params{
 		Dir:             cfg.StateDir,
+		CacheDir:        cfg.CacheDir,
 		WriteDelay:      cfg.StateWriteDelay,
 		CounterInterval: cfg.StateCounterInterval,
 		Ledger:          server.Ledger,
@@ -252,6 +253,7 @@ func loadStateFiles(
 		Lists:           server.Lists,
 		DNSBL:           server.DNSBL,
 		AbuseIPDB:       server.AbuseIPDB,
+		RouteWatch:      server.RouteWatch,
 		Alerts:          alertQueue,
 		Anomalies:       server.Anomalies,
 		Now:             now,

internal/sww/sww_test.go

@@ -38,6 +38,7 @@ const (
 	stateDir             = "SWW_STATE_DIR"
 	stateWriteDelay      = "SWW_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWW_STATE_COUNTER_INTERVAL"
+	cacheDir             = "SWW_CACHE_DIR"
 	rateLimitPerDay      = "SWW_RATE_LIMIT_PER_DAY"
 	rateLimitExemptNets  = "SWW_RATE_LIMIT_EXEMPT_NETS"
 	rulesDir             = "SWW_RULES_DIR"
@@ -160,6 +161,12 @@ func run(ctx context.Context, env map[string]string, out *output) int {
 				return "off", true
 			}
 
+			// The cache files go beside the state files unless the test
+			// says otherwise.
+			if !ok && name == cacheDir {
+				return env[stateDir], env[stateDir] != ""
+			}
+
 			return value, ok
 		},
 		Stdout: out,
@@ -699,7 +706,7 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 	}
 }
 
-func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T) {
+func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
 	t.Parallel()
 
 	const (
@@ -732,10 +739,11 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	t.Cleanup(server.Close)
 
 	torURL, dropURL := server.URL+torPath, server.URL+dropPath
-	dir := t.TempDir()
+	cache := t.TempDir()
 	env := map[string]string{
 		listenAddr:           localhost + ":0",
-		stateDir:             dir,
+		stateDir:             t.TempDir(),
+		cacheDir:             cache,
 		rulesDir:             t.TempDir(),
 		metricsToken:         token,
 		instanceName:         instance,
@@ -755,7 +763,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 
 	// Restarted with drop.txt named after it and the server answering, tor.txt
-	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in reputation.json,
+	// waits SWW_BLOCKLIST_REFRESH after its failed try, kept in lists.json,
 	// while drop.txt, never tried, is fetched at once. Lists are fetched in the
 	// order named, so once drop.txt refuses the client, tor.txt has had its turn.
 	failing.Store(false)
@@ -773,8 +781,8 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	}
 
 	// After another restart, with the server failing, the copy of drop.txt
-	// kept in reputation.json, its copyright line included, refuses the
-	// client from the first request.
+	// kept in lists.json, its copyright line included, refuses the client
+	// from the first request.
 	failing.Store(true)
 
 	out = runUntilStopped(t, env, func(url string) {
@@ -782,16 +790,16 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	})
 	wantDeniedByList(t, out.line(t, "type", "request"), dropURL)
 
-	path := filepath.Join(dir, "reputation.json")
+	path := filepath.Join(cache, "lists.json")
 
 	kept, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
 	if err != nil || !strings.Contains(string(kept), `"`+copyright+`"`) {
-		t.Errorf("reputation.json holds\n%s\nwant the copy with %q (%v)", kept, copyright,
+		t.Errorf("lists.json holds\n%s\nwant the copy with %q (%v)", kept, copyright,
 			err)
 	}
 }
 
-func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
+func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
 	t.Parallel()
 
 	const bouncerKey = "crowdsec-key-0123456789abcdef"
@@ -814,10 +822,11 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		}))
 	t.Cleanup(engine.Close)
 
-	dir := t.TempDir()
+	dir, cache := t.TempDir(), t.TempDir()
 	env := map[string]string{
 		listenAddr:              localhost + ":0",
 		stateDir:                dir,
+		cacheDir:                cache,
 		rulesDir:                t.TempDir(),
 		"SWW_CROWDSEC_LAPI_URL": engine.URL,
 		"SWW_CROWDSEC_LAPI_KEY": bouncerKey,
@@ -836,7 +845,7 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		t.Errorf("bans.json holds %v, want the ban for crowdsec on %s", ban, placed)
 	}
 
-	// Restarted with the engine down, the copy kept in reputation.json bans
+	// Restarted with the engine down, the copy kept in lists.json bans
 	// another client in the netblock from its first request.
 	down.Store(true)
 
@@ -844,22 +853,25 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 		wantStatus(t, url, "203.0.113.10", http.StatusForbidden)
 	})
 
-	// The key is in neither run's output, nor in a state file.
-	files := []string{"bans.json", "reputation.json", "clients.json"}
+	// The key is in neither run's output, nor in a state or cache file.
+	files := []string{
+		filepath.Join(dir, "bans.json"), filepath.Join(dir, "clients.json"),
+		filepath.Join(cache, "lists.json"),
+	}
 	shown := make([]string, 0, len(files)+2)
 	shown = append(shown, first.text(), second.text())
 
-	for _, name := range files {
-		data, err := os.ReadFile(filepath.Join(dir, name)) //nolint:gosec // the test's
+	for _, path := range files {
+		data, err := os.ReadFile(path) //nolint:gosec // the test's
 		if err != nil {
-			t.Fatalf("read %s: %v", name, err)
+			t.Fatalf("read %s: %v", path, err)
 		}
 
 		shown = append(shown, string(data))
 	}
 
 	if all := strings.Join(shown, "\n"); strings.Contains(all, bouncerKey) {
-		t.Errorf("the key is shown in the output or the state files:\n%s", all)
+		t.Errorf("the key is shown in the output or the state and cache files:\n%s", all)
 	}
 }
 
@@ -1207,6 +1219,29 @@ func TestUnwritableStateDirStopsTheStart(t *testing.T) {
 		"SWW_STATE_DIR cannot be written: ")
 }
 
+func TestUnwritableCacheDirStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	ctx, stop := context.WithTimeout(t.Context(), waitLimit)
+	defer stop()
+
+	out := &output{}
+
+	status := run(ctx, map[string]string{
+		listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
+		cacheDir: filepath.Join(t.TempDir(), "missing"),
+	}, out)
+	if status != 1 {
+		t.Fatalf("exit status %d, want 1", status)
+	}
+
+	line := out.line(t, "msg", "cannot use the state files")
+	if message, _ := line["error"].(string); !strings.HasPrefix(message,
+		"SWW_CACHE_DIR cannot be written: ") {
+		t.Errorf("start refused with %q, want SWW_CACHE_DIR named", message)
+	}
+}
+
 // wantStartRefused runs sww with its state files in dir, and
 // checks that it stops at start, with an error that starts with want. If
 // it starts instead, it is stopped after waitLimit.

internal/sww/waf_test.go

@@ -67,6 +67,7 @@ func TestMainRunsWAF(t *testing.T) {
 		commandForMain+"="+wafCommand,
 		listenAddr+"="+localhost+":0",
 		stateDir+"="+dir,
+		cacheDir+"="+dir,
 		rulesDir+"="+t.TempDir(),
 		lookupSource+"=off")