AbuseIPDB scores for clients that committed an offence, within a daily budget (closes #105)

With SWWAF_ABUSEIPDB_KEY set, a client whose history counts an offence
(a broken limit, a ban rule's match or a block rule's refusal, counted
by kind) is checked in the background, at most
SWWAF_ABUSEIPDB_DAILY_BUDGET checks a day, the count kept in
reputation.json. A client, an IPv4 address or an IPv6 /64, is checked by
the address it sent from, and its score serves all its addresses. A
score at or over SWWAF_ABUSEIPDB_MIN_SCORE is a hit for
SWWAF_REPUTATION_ACTION, logged as abuseipdb and alerted with its score.
A failure or the used-up budget gives no score and raises
source_failure. The key goes only in the Key header.

Judgement call: the budget's day is UTC; AbuseIPDB documents no reset time.
Judgement call: each check sent spends budget; a minute's pause after a failure.

Model: opus-5-5

internal/proxy/request.go

@@ -63,10 +63,15 @@ type request struct {
 	// limits and for the byte limits.
 	counted                    bool
 	limitPercent, bytesPercent percentage
+	// attack is true for a request that matched a ban rule, and
+	// ruleBlocked for one a block rule refused, each an offence its
+	// client's history counts.
+	attack, ruleBlocked bool
 	// blocklisted is true once a blocklist is found to list the client,
-	// and dnsblListed once a DNSBL zone's verdict is.
-	blocklisted, dnsblListed bool
-	start                    time.Time
+	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
+	// AbuseIPDB's score of it is a hit.
+	blocklisted, dnsblListed, abuseIPDBHit bool
+	start                                  time.Time
 	// checked is when the checks were done, and upstreamStart when the
 	// request was handed to the app.
 	checked       time.Time
@@ -217,13 +222,14 @@ func (rq *request) check(ctx context.Context) *refusal {
 // other client, SWWAF_DENY_NETS comes first, then a ban on its netblock,
 // so that a client either refuses is not looked up, then the lookup of
 // its AS number and country, then the country lists, then the blocklists,
-// and then the DNSBL zones' verdicts; a request any of them refuses is not
-// counted for the rate limits. Then come the rate limits, unless the
-// client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the request's path is
-// exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that every other request
-// is counted, each of them by the client's limit percentages, and last the
-// rule files. A request exempt from the rate limits is exempt from the
-// byte limits too. ctx is the request's own context.
+// then the DNSBL zones' verdicts, and then AbuseIPDB's score; a request
+// any of them refuses is not counted for the rate limits. Then come the
+// rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
+// request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
+// every other request is counted, each of them by the client's limit
+// percentages, and last the rule files. A request exempt from the rate
+// limits is exempt from the byte limits too. ctx is the request's own
+// context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -250,7 +256,7 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionDenied
 	}
 
-	if rq.dnsblDenied(ctx) {
+	if rq.dnsblDenied(ctx) || rq.abuseIPDBDenied(ctx) {
 		return requestlog.ActionDenied
 	}
 
@@ -540,6 +546,8 @@ func (rq *request) addToHistory() {
 		RequestBytes:  rq.requestBytes(),
 		ResponseBytes: rq.out.bytes,
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
+		Attack:        rq.attack,
+		RuleBlocked:   rq.ruleBlocked,
 	})
 
 	answer, found := rq.answerAtTheEnd()