Rule files, and bans for a clear sign of attack (closes #24)

Every *.rules file in SWWAF_RULES_DIR is read at start and again when
one changes, and each request is checked against the rules after the
rate limits: log notes a match, block refuses with 403, ban refuses and
bans the netblock for SWWAF_ATTACK_BAN_DURATION, made permanent by its
next request or its next clear sign of attack. bans.json gains each
ban's cause, the request log rule_ids and rule_blocked, the metrics
rule matches and rules loaded. The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

internal/state/state_test.go

@@ -263,6 +263,17 @@ func TestEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 	}
 }
 
+func TestBanWithACauseSmallwebwafDoesNotGiveStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	wantRefused(t, bansJSON, `{"version": 1, "bans": [`+
+		`{"netblock": "203.0.113.9/32", "start": "2026-10-06T00:00:00Z", `+
+		`"expires": null, "cause": "attack"}, `+
+		`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
+		`"expires": null, "cause": "atack"}]}`,
+		`: entry 2's cause "atack" is not limit or attack`)
+}
+
 func TestUnknownVersionStopsTheStart(t *testing.T) {
 	t.Parallel()
 
@@ -881,6 +892,7 @@ func newParams(dir string) state.Params {
 			LimitBanDuration:     time.Hour,
 			LimitBanRepeatWindow: 24 * time.Hour,
 			MaxBanDuration:       7 * 24 * time.Hour,
+			AttackBanDuration:    7 * 24 * time.Hour,
 			MaxBans:              5000,
 		}),
 		Limiter: ratelimit.New(ratelimit.Limits{}),
@@ -893,14 +905,17 @@ func newParams(dir string) state.Params {
 	}
 }
 
-// fill puts a ban that ends and one that does not, clients with counts
-// and histories, and GeoJS answers into the parts of params.
+// fill puts a permanent ban without a cause, as an admin adds one, a ban
+// for a broken limit and one for a clear sign of attack, clients with
+// counts and histories, and GeoJS answers into the parts of params.
 func fill(params state.Params) {
 	now := midnight()
 	client := netip.MustParsePrefix("203.0.113.9/32")
 
 	params.Ledger.Load([]bans.Ban{permanentBan()})
 	params.Ledger.BanForLimit(client, now, bans.Notes{Country: "DE", Limit: 1})
+	params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
+		bans.Notes{RuleID: "env-file", Target: "path"})
 
 	for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
 		params.Limiter.Count(netip.MustParsePrefix(c), now)