Country allow and deny lists, looked up through GeoJS (closes #44)

SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a
request with 403 before its body is read and before the rate limits count
it, logged as country_denied; every log line gains country. The new
internal/lookup asks GeoJS only while a list is set, one request at a
time carrying up to 200 waiting clients, keeps answers 7 days (at most
100,000), and after a failure waits a second, doubling to five minutes.
Private, loopback and link-local clients have no country and are never
sent. Codes are checked with golang.org/x/text/language.

Deviation from SPEC.md, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE.
Deviation: GeoJS's country endpoint, not geo.json, since only the country is needed.
Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/config/config.go

@@ -11,9 +11,12 @@ import (
 	"net"
 	"net/netip"
 	"net/url"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
+
+	"golang.org/x/text/language"
 )
 
 // Config is smallwebwaf's settings. A timeout, size or rate limit of zero
@@ -51,6 +54,13 @@ type Config struct {
 	RateLimitPerMinute int64
 	RateLimitPerHour   int64
 	RateLimitPerDay    int64
+	// DeniedCountries are the countries whose clients are refused
+	// (SWWAF_DENIED_COUNTRIES). ExclusivelyAllowedCountries, when not
+	// empty, are the only countries whose clients are let through
+	// (SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES). Both hold two-letter codes in
+	// capitals, as GeoJS gives them.
+	DeniedCountries             []string
+	ExclusivelyAllowedCountries []string
 
 	// settings are the values read, as given or by default, for the
 	// log line at start.
@@ -84,6 +94,9 @@ var (
 	errNotUpstreamURL = errors.New(
 		"is not a URL with only a scheme, a host and an optional port, " +
 			"such as http://127.0.0.1:8081")
+	errNotCountry = errors.New(
+		"is not a two-letter country code such as de or kp")
+	errOnBothLists = errors.New("is in SWWAF_DENIED_COUNTRIES too")
 )
 
 // FromEnvironment reads the settings with lookupEnv, normally
@@ -104,6 +117,16 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "1000"),
 		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "10000"),
 		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "50000"),
+		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
+		ExclusivelyAllowedCountries: env.countries(
+			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
+	}
+
+	for _, country := range cfg.ExclusivelyAllowedCountries {
+		if slices.Contains(cfg.DeniedCountries, country) {
+			env.check("SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES",
+				fmt.Errorf("%q %w", country, errOnBothLists))
+		}
 	}
 
 	if env.err != nil {
@@ -201,6 +224,14 @@ func (e *environment) count(name, defaultValue string) int64 {
 	return count
 }
 
+// countries reads a setting that is a list of countries.
+func (e *environment) countries(name, defaultValue string) []string {
+	countries, err := parseCountries(e.value(name, defaultValue))
+	e.check(name, err)
+
+	return countries
+}
+
 // parseDuration reads a duration in Go's syntax, such as 90s or 15m, a
 // whole number of days such as 7d, or off.
 func parseDuration(value string) (time.Duration, error) {
@@ -348,6 +379,32 @@ func parseNetblock(value string) (netip.Prefix, error) {
 	return netip.PrefixFrom(addr, addr.BitLen()), nil
 }
 
+// parseCountries reads a comma-separated list of two-letter ISO 3166-1
+// country codes in either case, and returns them in capitals.
+func parseCountries(value string) ([]string, error) {
+	items, err := parseList(value)
+	if err != nil {
+		return nil, err
+	}
+
+	countries := make([]string, 0, len(items))
+
+	for _, item := range items {
+		// ParseRegion also takes three-letter and numeric codes, groups of
+		// countries such as eu, and codes replaced by another, such as uk
+		// by gb, which GeoJS never gives.
+		region, err := language.ParseRegion(item)
+		if err != nil || len(item) != 2 || !region.IsCountry() ||
+			region.Canonicalize() != region {
+			return nil, fmt.Errorf("%q %w", item, errNotCountry)
+		}
+
+		countries = append(countries, region.String())
+	}
+
+	return countries, nil
+}
+
 // parseListenAddr checks an address to listen on: an optional host and a
 // port number.
 func parseListenAddr(value string) (string, error) {