AS number and country looked up for every client (closes #95)

GeoJS's geo.json is asked about every new visitor unless
SWWAF_LOOKUP_SOURCE is off. A request waits for its client's first
answer only while a country list or SWWAF_ADD_LOOKUP_HEADERS needs it;
otherwise the answer reaches the client's history and ban notes when it
comes. The AS number and name go beside the country in the request log,
history, ban notes, alerts and lookups.json, with metrics by AS number;
64512 counts as unknown.

Judgement call: AS numbers are written AS64496, as SPEC's settings write them.
Judgement call: SWWAF_LOOKUP_TIMEOUT is added, default 1s, and cannot be off.
Judgement call: a client's own X-Client-* headers are removed only while SWWAF_ADD_LOOKUP_HEADERS is set.

Model: opus-5-5

internal/ratelimit/history_test.go

@@ -16,10 +16,10 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 	start := midnight()
 
 	for i, r := range []ratelimit.Request{
-		{Country: "DE", Forwarded: true, Status: 200, RequestBytes: 10, ResponseBytes: 100},
+		{Forwarded: true, Status: 200, RequestBytes: 10, ResponseBytes: 100},
 		{Forwarded: true, Status: 101},
 		{Forwarded: true, Status: 304, RequestBytes: 5},
-		{Country: "FR", Refused: true, Status: 403, ResponseBytes: 10, BrokeLimit: true},
+		{Refused: true, Status: 403, ResponseBytes: 10, BrokeLimit: true},
 		{Forwarded: true, Status: 502, ResponseBytes: 12},
 		// Closed without an answer: refused, and no response.
 		{Refused: true, Status: 0},
@@ -33,8 +33,6 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 	want := ratelimit.History{
 		FirstSeen:     start,
 		LastSeen:      start.Add(6 * time.Minute),
-		Country:       "FR",
-		LookedUp:      start.Add(3 * time.Minute),
 		Requests:      7,
 		Forwarded:     4,
 		Refused:       2,
@@ -52,6 +50,43 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 	}
 }
 
+func TestLookupReachesTheHistoryOfAClientInTheTable(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{})
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	other := netip.MustParsePrefix("198.51.100.7/32")
+	start := midnight()
+
+	limiter.AddToHistory(client, start, ratelimit.Request{Forwarded: true})
+	limiter.AddLookup(client, start, "AS64496", "Example Net", "DE")
+
+	// A later answer replaces it, and one for a client the table does not
+	// hold adds no client.
+	limiter.AddLookup(client, start.Add(time.Hour), "AS64497", "Other Net", "FR")
+	limiter.AddLookup(other, start, "AS64496", "Example Net", "DE")
+
+	want := ratelimit.History{
+		FirstSeen: start,
+		LastSeen:  start,
+		ASN:       "AS64497",
+		ASName:    "Other Net",
+		Country:   "FR",
+		LookedUp:  start.Add(time.Hour),
+		Requests:  1,
+		Forwarded: 1,
+	}
+
+	got := historyOf(t, limiter, client)
+	if got != want {
+		t.Errorf("history\n%+v\nwant\n%+v", got, want)
+	}
+
+	if clients := limiter.Snapshot(); len(clients) != 1 {
+		t.Errorf("the table holds %+v, want %s alone", clients, client)
+	}
+}
+
 func TestResetKeepsTheHistory(t *testing.T) {
 	t.Parallel()
 

internal/ratelimit/ratelimit.go

@@ -66,8 +66,12 @@ type Buckets struct {
 type History struct {
 	FirstSeen time.Time `json:"first_seen"`
 	LastSeen  time.Time `json:"last_seen"`
-	// Country is the client's country as it was last looked up, and
-	// LookedUp when that was; both are empty while it never was.
+	// ASN, ASName and Country are the client's AS number, AS name and
+	// country as last looked up, each empty when the lookup could not
+	// find it, and LookedUp is when GeoJS gave that answer; all are empty
+	// while the client never was looked up.
+	ASN      string    `json:"asn,omitempty"`
+	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
 	// Requests are all the client's requests: Forwarded those passed to
@@ -103,8 +107,6 @@ type Offences struct {
 
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Country is the client's country, when the request looked it up.
-	Country string
 	// Forwarded is true for a request passed to the app, Refused for one
 	// refused before anything reached it, a 401 at smallwebwaf's own
 	// endpoints included. Both are false for any other request smallwebwaf
@@ -209,11 +211,6 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 
 	h.LastSeen = now
 
-	if r.Country != "" {
-		h.Country = r.Country
-		h.LookedUp = now
-	}
-
 	h.Requests++
 	if r.Forwarded {
 		h.Forwarded++
@@ -232,6 +229,24 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 	}
 }
 
+// AddLookup gives client's history its AS number, AS name and country, as
+// GeoJS gave them at lookedUp, if the table of clients holds the client.
+// It does not make the client the most recently seen.
+func (l *Limiter) AddLookup(
+	client netip.Prefix, lookedUp time.Time, asn, asName, country string,
+) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	c, held := l.clients.Peek(client)
+	if !held {
+		return
+	}
+
+	h := &c.History
+	h.ASN, h.ASName, h.Country, h.LookedUp = asn, asName, country, lookedUp
+}
+
 // Requests returns how many requests the clients inside netblock have
 // sent, as their histories count them.
 func (l *Limiter) Requests(netblock netip.Prefix) int64 {