Look clients up in the IPinfo Lite file with SWWAF_LOOKUP_SOURCE=file (closes #22)

SWWAF_LOOKUP_SOURCE=file looks every client up in the file SWWAF_LOOKUP_DB_PATH names, without GeoJS. file without the path, the path with another source, or a file that cannot be read stops the start. The file is read whole into memory, so overwriting it in place cannot disturb a lookup, and read again 2 seconds after its last change; a replacement that cannot be read is logged, counted and sent as a file_error alert, and the old one stays in use. Metrics give when it was read and the failed reads. Tests write their databases through internal/lookup/lookuptest. Deviation: go.mod and go.sum written by hand; go runs only through make. Judgement call: the 2-second wait, as the rule files have. Model: opus-5-5
2026-10-07 10:04:10 +02:00
parent 26f4abef7f
commit c80753c56e
21 changed files with 1291 additions and 168 deletions
@@ -1,6 +1,7 @@
 // Package smallwebwaf runs the smallwebwaf process: it reads the settings,
-// the rule files and the state files, serves requests until it is told to
-// stop, and then stops in an orderly way, writing the state files.
+// the rule files, the lookup database and the state files, serves requests
+// until it is told to stop, and then stops in an orderly way, writing the
+// state files.
 package smallwebwaf

 import (
@@ -64,9 +65,9 @@ func Main(version string) int {
 	})
 }

-// Run reads the settings, the rule files and the state files, then serves
-// requests until ctx is done. It returns the process's exit status, 1
-// when smallwebwaf cannot start.
+// Run reads the settings, the rule files, the lookup database and the
+// state files, then serves requests until ctx is done. It returns the
+// process's exit status, 1 when smallwebwaf cannot start.
 func Run(ctx context.Context, params Params) int {
 	processLog := requestlog.NewProcessLogger(params.Stdout,
 		config.InstanceName(params.LookupEnv))
@@ -110,21 +111,17 @@ func Run(ctx context.Context, params Params) int {
 		return 1
 	}

-	server := proxy.New(proxy.Params{
-		Config:     cfg,
-		RequestLog: stdout,
-		ProcessLog: processLog,
-		GeoJSURL:   lookup.URL,
-		Now:        now,
-		Rules:      ruleFiles,
-		Alerts:     alertQueue,
-	})
+	server, err := newServer(cfg, stdout, processLog, now, ruleFiles, alertQueue)
+	if err != nil {
+		processLog.Error("cannot use the lookup database", "error", err.Error())
+
+		return 1
+	}
+
 	if remote != nil {
 		server.Metrics.AddRemoteLog(remote)
 	}

-	server.Metrics.AddAlerts(alertQueue)
-
 	files, err := loadStateFiles(cfg, server, alertQueue, now, processLog)
 	if err != nil {
 		processLog.Error("cannot use the state files", "error", err.Error())
@@ -145,7 +142,49 @@ func Run(ctx context.Context, params Params) int {
 		"address", listener.Addr().String(),
 		"settings", cfg)

-	return serve(ctx, server.Server, listener, files, ruleFiles, alertQueue, processLog)
+	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
+}
+
+// newServer returns the server smallwebwaf runs, with the metrics of the
+// alerts, after reading the lookup database while SWWAF_LOOKUP_SOURCE is
+// file. A lookup database that cannot be read is an error.
+func newServer(
+	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
+	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
+) (*proxy.Server, error) {
+	var lookupFile *lookup.File
+
+	if cfg.LookupSource == "file" {
+		var err error
+
+		lookupFile, err = lookup.OpenFile(lookup.FileParams{
+			Path:       cfg.LookupDBPath,
+			Now:        now,
+			ProcessLog: processLog,
+			Alerts:     alertQueue,
+		})
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	server := proxy.New(proxy.Params{
+		Config:     cfg,
+		RequestLog: stdout,
+		ProcessLog: processLog,
+		GeoJSURL:   lookup.URL,
+		LookupFile: lookupFile,
+		Now:        now,
+		Rules:      ruleFiles,
+		Alerts:     alertQueue,
+	})
+	server.Metrics.AddAlerts(alertQueue)
+
+	if lookupFile != nil {
+		server.Metrics.AddLookupFile(lookupFile.LastRead, lookupFile.ReadFailures)
+	}
+
+	return server, nil
 }

 // loadStateFiles reads the state files into the parts of server and into
@@ -227,11 +266,12 @@ func startSending(

 // serve serves requests on listener, writes the state files as they are
 // due, takes in an admin's edits of them, reads the rule files again as
-// they change, and sends the alerts, until ctx is done. Then it gives the
-// requests in progress shutdownTimeout to finish, and writes every state
-// file, alerts.json with the alerts still waiting.
+// they change, and the lookup database when it is replaced, and sends the
+// alerts, until ctx is done. Then it gives the requests in progress
+// shutdownTimeout to finish, and writes every state file, alerts.json with
+// the alerts still waiting.
 func serve(
-	ctx context.Context, server *http.Server, listener net.Listener,
+	ctx context.Context, server *proxy.Server, listener net.Listener,
 	files *state.Files, ruleFiles *rules.Files, alertQueue *alerts.Queue,
 	processLog *slog.Logger,
 ) int {
@@ -247,6 +287,11 @@ func serve(
 	written := inBackground(func() { files.Run(writing) })
 	watched := inBackground(func() { files.Watch(writing) })
 	rulesWatched := inBackground(func() { ruleFiles.Watch(writing) })
+	lookupFileWatched := inBackground(func() {
+		if server.LookupFile != nil {
+			server.LookupFile.Watch(writing)
+		}
+	})
 	alertsSent := inBackground(func() { alertQueue.Run(writing) })

 	select {
@@ -289,6 +334,7 @@ func serve(
 	<-written
 	<-watched
 	<-rulesWatched
+	<-lookupFileWatched
 	<-alertsSent

 	err = files.WriteAll()
@@ -18,6 +18,7 @@ import (
 	"testing"
 	"time"

+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )

@@ -38,6 +39,8 @@ const (
 	stateCounterInterval = "SWWAF_STATE_COUNTER_INTERVAL"
 	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
 	rulesDir             = "SWWAF_RULES_DIR"
+	lookupSource         = "SWWAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
 	instanceName         = "SWWAF_INSTANCE_NAME"
 	adminToken           = "SWWAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
 	metricsToken         = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
@@ -48,6 +51,8 @@ const (
 	instance = "fsn1app1/gitea"
 	// greeting is what the tests' app answers.
 	greeting = "hello from the app"
+	// placed is the client the tests' lookup databases place.
+	placed = "203.0.113.9"
 )

 // output collects what smallwebwaf writes on stdout.
@@ -495,6 +500,107 @@ func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
 		": no such file or directory")
 }

+func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
+	t.Parallel()
+
+	const token = "0123456789abcdef0123456789abcdef"
+
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	writeLookupDatabase(t, path, "DE")
+
+	env := map[string]string{
+		listenAddr:               localhost + ":0",
+		upstreamURL:              startApp(t),
+		stateDir:                 t.TempDir(),
+		rulesDir:                 t.TempDir(),
+		trustedProxies:           localhost + "/32",
+		metricsToken:             token,
+		instanceName:             instance,
+		lookupSource:             "file",
+		lookupDBPath:             path,
+		"SWWAF_DENIED_COUNTRIES": "kp",
+		// The requests sent until a replacement takes effect, and those
+		// for the metrics, must not break a rate limit, whose ban would
+		// refuse them too.
+		"SWWAF_RATE_LIMIT_EXEMPT_NETS": placed + "," + localhost,
+	}
+	began := time.Now()
+	// Each replacement is written beside the file and renamed over it, as
+	// a refresh is.
+	replacement := path + ".new"
+
+	var lastRead float64
+
+	runUntilStopped(t, env, func(url string) {
+		wantStatus(t, url, placed, http.StatusOK)
+
+		// smallwebwaf reads the file again once it watches its directory,
+		// which may be after the first replacement. Once that has taken
+		// effect, only the watch can show the next. Each takes as long as
+		// it takes, so that a slow test process cannot fail the test.
+		writeLookupDatabase(t, replacement, "KP")
+		rename(t, replacement, path)
+
+		for statusFrom(t, url, placed) != http.StatusForbidden {
+			time.Sleep(pollInterval)
+		}
+
+		writeLookupDatabase(t, replacement, "DE")
+		rename(t, replacement, path)
+
+		for statusFrom(t, url, placed) != http.StatusOK {
+			time.Sleep(pollInterval)
+		}
+
+		// One that cannot be read leaves the file read before in use.
+		err := os.WriteFile(replacement, []byte("not a lookup database\n"), 0o600)
+		if err != nil {
+			t.Fatalf("write %s: %v", replacement, err)
+		}
+
+		rename(t, replacement, path)
+
+		metrics := metricsWith(t, url+"_smallwebwaf/metrics", token,
+			`smallwebwaf_lookup_database_read_failures_total{instance="fsn1app1/gitea"} 1`)
+		lastRead = seriesValue(t, metrics,
+			`smallwebwaf_lookup_database_last_read_timestamp_seconds{instance="fsn1app1/gitea"}`)
+
+		wantStatus(t, url, placed, http.StatusOK)
+	})
+
+	if lastRead < float64(began.Unix()) || lastRead > float64(time.Now().Unix()) {
+		t.Errorf("the lookup database was last read at %v, want a time in the test", lastRead)
+	}
+}
+
+func TestLookupDatabaseThatCannotBeReadStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+
+	// If it starts instead, it is stopped after waitLimit.
+	ctx, stop := context.WithTimeout(t.Context(), waitLimit)
+	defer stop()
+
+	out := &output{}
+
+	status := run(ctx, map[string]string{
+		listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
+		lookupSource: "file", lookupDBPath: path,
+	}, out)
+	if status != 1 {
+		t.Fatalf("exit status %d, want 1", status)
+	}
+
+	want := "SWWAF_LOOKUP_DB_PATH cannot be read: open " + path +
+		": no such file or directory"
+
+	line := out.line(t, "msg", "cannot use the lookup database")
+	if line["error"] != want {
+		t.Errorf("start refused with %v, want the error %q", line, want)
+	}
+}
+
 func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
 	t.Parallel()

@@ -1046,6 +1152,50 @@ func metricsWith(t *testing.T, url, token string, series ...string) string {
 	}
 }

+// seriesValue returns the value of series, such as
+// name{instance="app"}, in metrics.
+func seriesValue(t *testing.T, metrics, series string) float64 {
+	t.Helper()
+
+	for line := range strings.Lines(metrics) {
+		value, found := strings.CutPrefix(strings.TrimSpace(line), series+" ")
+		if !found {
+			continue
+		}
+
+		number, err := strconv.ParseFloat(value, 64)
+		if err != nil {
+			t.Fatalf("%s has the value %q: %v", series, value, err)
+		}
+
+		return number
+	}
+
+	t.Fatalf("no %s in the metrics:\n%s", series, metrics)
+
+	return 0
+}
+
+// rename renames the file at from to, replacing any file there.
+func rename(t *testing.T, from, to string) {
+	t.Helper()
+
+	err := os.Rename(from, to)
+	if err != nil {
+		t.Fatalf("rename %s to %s: %v", from, to, err)
+	}
+}
+
+// writeLookupDatabase writes a lookup database at path that places the
+// client placed in country, and no other address.
+func writeLookupDatabase(t *testing.T, path, country string) {
+	t.Helper()
+
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		placed + "/32": {ASN: "AS64496", ASName: "Example Net", Country: country},
+	})
+}
+
 // askAsAdmin sends a request with method to url, with body and
 // adminSecret, and checks that it is answered 200.
 func askAsAdmin(t *testing.T, method, url, body string) {