Trap paths, and the error burst banning a client refused too often (closes #115)

SWWAF_TRAP_PATHS: a request whose path, as a path rule sees it, is one
of them is a clear sign of attack, banned as a ban rule's match is; the
ban's notes give its trap_path. Checked after the rate limits, before the
rule files.

SWWAF_ERROR_BURST_THRESHOLD (default 30, or off): more refusals in a
minute after a block or ban rule or a trap path, or for a missing or
wrong token, ban the client as a broken limit does. Counted in
clients.json's minute_refusals; limit_hit error_burst, notes kind
refusals.

A token refusal is now the offence token_refused, and
smallwebwaf_offences_total counts every kind the history does.

Judgement call: the threshold is not lowered by a client's limit percentage.

Model: opus-5-5

internal/config/config_test.go

@@ -91,6 +91,8 @@ const (
 	logLevel                = "SWWAF_LOG_LEVEL"
 	rulesDir                = "SWWAF_RULES_DIR"
 	rulesEnabled            = "SWWAF_RULES_ENABLED"
+	trapPaths               = "SWWAF_TRAP_PATHS"
+	errorBurstThreshold     = "SWWAF_ERROR_BURST_THRESHOLD"
 	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
 	logRemoteTLSCAFile      = "SWWAF_LOG_REMOTE_TLS_CA_FILE"
 	logRemoteBuffer         = "SWWAF_LOG_REMOTE_BUFFER"
@@ -495,6 +497,62 @@ func TestPathPrefixNotStartingWithSlashStopsTheStart(t *testing.T) {
 	}
 }
 
+func TestTrapPathsAndErrorBurstThreshold(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		env       environment
+		paths     []string
+		threshold int64
+	}{
+		{environment{}, []string{}, 30},
+		{
+			environment{trapPaths: "/wp-login.php, /xmlrpc.php", errorBurstThreshold: "5"},
+			[]string{"/wp-login.php", "/xmlrpc.php"}, 5,
+		},
+		{environment{errorBurstThreshold: off}, []string{}, 0},
+	} {
+		cfg := fromEnvironment(t, tc.env)
+		if !slices.Equal(cfg.TrapPaths, tc.paths) ||
+			cfg.ErrorBurstThreshold != tc.threshold {
+			t.Errorf("%v gave %v and %d, want %v and %d", tc.env, cfg.TrapPaths,
+				cfg.ErrorBurstThreshold, tc.paths, tc.threshold)
+		}
+	}
+}
+
+func TestInvalidTrapPathOrErrorBurstThresholdStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	const notTrapPath = " is not a path starting with / and without a ?, " +
+		"such as /wp-login.php"
+
+	for _, tc := range []struct{ name, value, want string }{
+		{trapPaths, "/wp-login.php,xmlrpc.php", `"xmlrpc.php"` + notTrapPath},
+		{trapPaths, "/xmlrpc.php?rsd", `"/xmlrpc.php?rsd"` + notTrapPath},
+		{
+			trapPaths, "/wp-login.php,,/xmlrpc.php",
+			`"/wp-login.php,,/xmlrpc.php" has an empty item in its list`,
+		},
+		{errorBurstThreshold, "0", `"0" must be more than zero, or off`},
+		{
+			errorBurstThreshold, "30/min",
+			`"30/min" is not a whole number of requests such as 1000, or off`,
+		},
+	} {
+		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
+
+			want := tc.name + ": " + tc.want
+			if err == nil || err.Error() != want {
+				t.Errorf("error %v, want %s", err, want)
+			}
+		})
+	}
+}
+
 func TestInstanceNameAndLoggedHeadersAsSet(t *testing.T) {
 	t.Parallel()
 
@@ -2233,6 +2291,8 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		logLevel:                "info",
 		rulesDir:                "/etc/smallwebwaf/rules.d",
 		rulesEnabled:            "true",
+		trapPaths:               "",
+		errorBurstThreshold:     "30",
 		logRemoteURL:            "",
 		logRemoteTLSCAFile:      "",
 		logRemoteBuffer:         "10000",