AbuseIPDB scores for clients that committed an offence, within a daily budget (closes #105)

With SWWAF_ABUSEIPDB_KEY set, a client whose history counts an offence
(a broken limit, a ban rule's match or a block rule's refusal, counted
by kind) is checked in the background, at most
SWWAF_ABUSEIPDB_DAILY_BUDGET checks a day, the count kept in
reputation.json. A client, an IPv4 address or an IPv6 /64, is checked by
the address it sent from, and its score serves all its addresses. A
score at or over SWWAF_ABUSEIPDB_MIN_SCORE is a hit for
SWWAF_REPUTATION_ACTION, logged as abuseipdb and alerted with its score.
A failure or the used-up budget gives no score and raises
source_failure. The key goes only in the Key header.

Judgement call: the budget's day is UTC; AbuseIPDB documents no reset time.
Judgement call: each check sent spends budget; a minute's pause after a failure.

Model: opus-5-5

internal/metrics/metrics.go

@@ -257,57 +257,37 @@ func (m *Metrics) AddLookupFile(lastRead func() time.Time, readFailures func() i
 	)
 }
 
+// sourceLabel is the label of the reputation metrics: a list's URL, a
+// DNSBL zone, its key masked, or abuseipdb.
+const sourceLabel = "source"
+
 // AddReputation adds the metrics of the lists fetched from URLs and of the
 // DNSBL zones, by source, each list's URL or each zone, its key masked as
-// config.MaskZoneKey masks it: the requests whose client a blocklist or a
-// zone's verdict lists, which ReputationHit counts, and, read from lists
-// and dnsbl as the metrics are asked for, for a list, the fetches that
-// failed and when the copy in use was fetched, and for a zone, the queries
-// made and those that failed. It is called once, before ReputationHit.
+// config.MaskZoneKey masks it: the requests whose client a blocklist, a
+// zone's verdict or AbuseIPDB's score lists, which ReputationHit counts,
+// and, read from lists and dnsbl as the metrics are asked for, for a list,
+// the fetches that failed and when the copy in use was fetched, and for a
+// zone, the queries made and those that failed. It is called once, before
+// ReputationHit.
 func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL) {
-	const (
-		sourceLabel  = "source"
-		failuresHelp = "Fetches of the list, or queries to the DNSBL zone, that failed."
-	)
-
 	m.reputationHits = counterVec("smallwebwaf_reputation_hits_total",
-		"Requests whose client a blocklist or a DNSBL zone lists, by the "+
-			"blocklist's URL or the zone.",
+		"Requests whose client a blocklist, a DNSBL zone or AbuseIPDB lists, by "+
+			"the blocklist's URL, the zone, or abuseipdb.",
 		[]string{sourceLabel})
 	m.registry.MustRegister(m.reputationHits)
 
 	for _, zone := range dnsbl.Zones() {
 		source := prometheus.Labels{sourceLabel: config.MaskZoneKey(zone)}
 
-		m.registry.MustRegister(
-			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name:        "smallwebwaf_reputation_queries_total",
-				Help:        "Queries to the DNSBL zone.",
-				ConstLabels: source,
-			}, func() float64 {
-				return float64(dnsbl.Queries(zone))
-			}),
-			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name:        "smallwebwaf_reputation_failures_total",
-				Help:        failuresHelp,
-				ConstLabels: source,
-			}, func() float64 {
-				return float64(dnsbl.Failures(zone))
-			}),
-		)
+		m.addReputationQueries(source, func() int { return dnsbl.Queries(zone) })
+		m.addReputationFailures(source, func() int { return dnsbl.Failures(zone) })
 	}
 
 	for _, listURL := range lists.URLs() {
 		source := prometheus.Labels{sourceLabel: listURL}
 
+		m.addReputationFailures(source, func() int { return lists.Failures(listURL) })
 		m.registry.MustRegister(
-			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name:        "smallwebwaf_reputation_failures_total",
-				Help:        failuresHelp,
-				ConstLabels: source,
-			}, func() float64 {
-				return float64(lists.Failures(listURL))
-			}),
 			prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 				Name: "smallwebwaf_reputation_last_fetch_timestamp_seconds",
 				Help: "When the copy of the list in use was fetched, in seconds since " +
@@ -325,8 +305,28 @@ func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL
 	}
 }
 
+// AddAbuseIPDB adds the metrics of AbuseIPDB, with the source abuseipdb,
+// read from abuseIPDB as the metrics are asked for: the checks made, those
+// that failed, and how many checks the day's budget has left. It is
+// called once, after AddReputation, while SWWAF_ABUSEIPDB_KEY is set.
+func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
+	source := prometheus.Labels{sourceLabel: reputation.AbuseIPDBSource}
+
+	m.addReputationQueries(source, abuseIPDB.Checked)
+	m.addReputationFailures(source, abuseIPDB.Failures)
+	m.registry.MustRegister(
+		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
+			Name:        "smallwebwaf_reputation_daily_budget_remaining",
+			Help:        "Checks of the day's SWWAF_ABUSEIPDB_DAILY_BUDGET not yet spent.",
+			ConstLabels: source,
+		}, func() float64 {
+			return float64(abuseIPDB.BudgetLeft())
+		}),
+	)
+}
+
 // ReputationHit counts a request whose client source lists: a blocklist,
-// by its URL, or a DNSBL zone, its key masked.
+// by its URL, a DNSBL zone, its key masked, or AbuseIPDB, abuseipdb.
 func (m *Metrics) ReputationHit(source string) {
 	m.reputationHits.WithLabelValues(source).Inc()
 }
@@ -470,6 +470,32 @@ func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
 }
 
+// addReputationQueries adds the counter of the queries to source, a DNSBL
+// zone, or of the checks of clients with AbuseIPDB, which count tells.
+func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {
+	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
+		Name:        "smallwebwaf_reputation_queries_total",
+		Help:        "Queries to the DNSBL zone, or checks of clients with AbuseIPDB.",
+		ConstLabels: source,
+	}, func() float64 {
+		return float64(count())
+	}))
+}
+
+// addReputationFailures adds the counter of the fetches of source, a
+// list, the queries to it, a DNSBL zone, or the checks with it, AbuseIPDB,
+// that failed, which count tells.
+func (m *Metrics) addReputationFailures(source prometheus.Labels, count func() int) {
+	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
+		Name: "smallwebwaf_reputation_failures_total",
+		Help: "Fetches of the list, queries to the DNSBL zone, or checks with " +
+			"AbuseIPDB, that failed.",
+		ConstLabels: source,
+	}, func() float64 {
+		return float64(count())
+	}))
+}
+
 // statusClass returns the class of status, such as 2xx, or none when no
 // status was sent.
 func statusClass(status int) string {