Rule files, and bans for a clear sign of attack (closes #24)

Every *.rules file in SWWAF_RULES_DIR is read at start and again when
one changes, and each request is checked against the rules after the
rate limits: log notes a match, block refuses with 403, ban refuses and
bans the netblock for SWWAF_ATTACK_BAN_DURATION, made permanent by its
next request or its next clear sign of attack. bans.json gains each
ban's cause, the request log rule_ids and rule_blocked, the metrics
rule matches and rules loaded. The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

internal/proxy/bans.go

@@ -6,6 +6,7 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
 // banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
@@ -51,20 +52,12 @@ func (rq *request) limitBroken(now time.Time) bool {
 
 	netblock := rq.netblock()
 	ban := rq.h.ledger.BanForLimit(netblock, now, bans.Notes{
-		Country: rq.line.Country,
-		Limit:   hit.Limit,
-		Window:  hit.Window,
-		Count:   hit.Requests,
-		Request: bans.Request{
-			Time:      now,
-			Method:    rq.in.Method,
-			Host:      rq.in.Host,
-			Path:      rq.in.URL.RequestURI(),
-			Status:    rq.h.config.BanResponse,
-			UserAgent: rq.in.UserAgent(),
-		},
-		// The histories count this request only once it has ended.
-		Requests: rq.h.limiter.Requests(netblock) + 1,
+		Country:  rq.line.Country,
+		Limit:    hit.Limit,
+		Window:   hit.Window,
+		Count:    hit.Requests,
+		Request:  rq.noted(now),
+		Requests: rq.netblockRequests(netblock),
 	})
 	rq.h.limiter.Reset(group)
 	rq.line.BanExpires = banExpires(ban)
@@ -72,6 +65,40 @@ func (rq *request) limitBroken(now time.Time) bool {
 	return true
 }
 
+// banForAttack bans the client's netblock at now for a clear sign of
+// attack, the match of rule, a ban rule.
+func (rq *request) banForAttack(now time.Time, rule rules.Rule) {
+	netblock := rq.netblock()
+	ban := rq.h.ledger.BanForAttack(netblock, now, bans.Notes{
+		Country:  rq.line.Country,
+		RuleID:   rule.ID,
+		Target:   rule.Target,
+		Request:  rq.noted(now),
+		Requests: rq.netblockRequests(netblock),
+	})
+	rq.line.BanExpires = banExpires(ban)
+}
+
+// noted is the request, refused at now with SWWAF_BAN_RESPONSE, as the
+// notes of the ban it makes keep it.
+func (rq *request) noted(now time.Time) bans.Request {
+	return bans.Request{
+		Time:      now,
+		Method:    rq.in.Method,
+		Host:      rq.in.Host,
+		Path:      rq.in.URL.RequestURI(),
+		Status:    rq.h.config.BanResponse,
+		UserAgent: rq.in.UserAgent(),
+	}
+}
+
+// netblockRequests is how many requests netblock has sent since it was
+// first seen, this one included: the histories count it only once it has
+// ended.
+func (rq *request) netblockRequests(netblock netip.Prefix) int64 {
+	return rq.h.limiter.Requests(netblock) + 1
+}
+
 // netblock is the netblock a ban on the client covers: its IPv4 address,
 // widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
 // counts it in.