Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

docs/request-log.md

@@ -96,8 +96,8 @@ Every one of these lines has:
 
 - `action`: what was done:
     - `forward`: answered `allow`, so that `rproxy` passes it to the app;
-    - `denied`: refused for `SWW_DENY_NETS`, or for a reputation source with the
-      action `deny`;
+    - `denied`: refused for `SWW_DENY_NETS`, for a reputation source with the
+      action `deny`, or for a tag in `SWW_TAG_DENY`;
     - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
       CrowdSec decision, each of which bans the client;
     - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
@@ -115,6 +115,7 @@ Every one of these lines has:
     - `deny_nets`: `netblock`, the entry of `SWW_DENY_NETS` the client is in;
     - `active_ban`: `netblock`, the ban's netblock, and `ban_expires`;
     - `countries`: `country`, and `setting`, the country list that refused it;
+    - `tag_deny`: `tag`, the tag of `SWW_TAG_DENY` the request carries;
     - `blocklists`: `lists`, the blocklist URLs that list the client;
     - `crowdsec`: `scenario`, the decision's scenario, and `expires`, when the
       decision ends;
@@ -168,6 +169,8 @@ Every one of these lines has:
     - the CrowdSec decision list's URL;
     - DNS blocklist zones;
     - `abuseipdb`.
+- `tags`: the request's tags, sorted, left out when it has none. Each tag and
+  where it comes from is under "Request tags" in [`SPEC.md`](../SPEC.md).
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
   refused under one: a time, or `permanent`.

docs/settings.md

@@ -90,11 +90,11 @@ between the two (see "The image's command" below).
 ## Static lists
 
 - `SWW_ALLOW_NETS` (default empty): netblocks you trust, such as your monitoring
-  (see step 3 in [`SPEC.md`](../SPEC.md)).
+  (see step 4 in [`SPEC.md`](../SPEC.md)).
 - `SWW_RATE_LIMIT_EXEMPT_NETS` (default empty): netblocks whose clients are
   exempt from rate limiting and the byte limits.
 - `SWW_DENY_NETS` (default empty): netblocks whose clients are refused (see step
-  3 in [`SPEC.md`](../SPEC.md)).
+  4 in [`SPEC.md`](../SPEC.md)).
 
 ## Request rate limits, per client
 
@@ -130,9 +130,11 @@ between the two (see "The image's command" below).
 
 - `SWW_LOOKUP_SOURCE` (default `geojs`): `geojs`, `file` or `off`. `off` stops
   the start while a setting that needs a lookup is set:
-    - the two country lists;
+    - `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES`;
     - `SWW_ADD_LOOKUP_HEADERS`;
-    - the four biased threshold lists and `SWW_ASN_LIMIT_PERCENT_URL`;
+    - `SWW_TAG_DENY` or `SWW_TAG_LIMIT_PERCENT` naming an `asn=` or `country=`
+      tag;
+    - the two byte percentage lists and `SWW_ASN_LIMIT_PERCENT_URL`;
     - `SWW_UNKNOWN_LIMIT_PERCENT` below `100`;
     - an anomaly threshold per AS number.
 - `SWW_LOOKUP_DB_PATH` (default empty): the IPinfo Lite database file, in its
@@ -144,28 +146,61 @@ between the two (see "The image's command" below).
   the client's AS number in `X-Client-ASN` and its country in
   `X-Client-Country`.
 
-## Country lists
+## Country list
 
-- `SWW_DENIED_COUNTRIES` (default empty): countries whose clients are refused,
-  such as `cn,ru,kp`.
 - `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` (default empty): when set, the only
-  countries whose clients get through, such as `us,de`. A country on both lists
-  stops the start.
+  countries whose clients get through, such as `us,de`. A country whose
+  `country=` tag is in `SWW_TAG_DENY` stops the start.
+
+## Request tags
+
+Every request gets tags from what `discriminator` knows of its client. See
+"Request tags" in [`SPEC.md`](../SPEC.md).
+
+- `SWW_TAG_LISTS` (default empty): address lists that each add a tag, as
+  `name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the
+  tag, and may hold `=`, such as `vpn=mullvad`. Each list is an `http` or
+  `https` URL fetched like a blocklist. A name or URL listed twice is refused.
+  So is a URL that is also in `SWW_BLOCKLIST_URLS`, `SWW_ASN_LIMIT_PERCENT_URL`,
+  or the CrowdSec decision list.
+- `SWW_TAG_DENY` (default empty): tags whose requests are refused, such as
+  `torexit,country=CN`. A tag listed twice, an `asn=` tag without a number, or a
+  `country=` tag without a country, is refused.
+- `SWW_TAG_LIMIT_PERCENT` (default empty): tags that lower a client's limits, as
+  tag and percentage pairs, such as `vpn:50,asn=14061:25`. A percentage is from
+  `1` to `99`, of every rate limit and byte limit. The lowest percentage among a
+  client's tags applies. A tag listed twice is refused. So is
+  `exploitsignature`: a request gets that tag after the rate limits have counted
+  it.
+
+`SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT` accept tags in either case. A tag
+that no request can get stops the start. A request can get only these:
+
+- a name in `SWW_TAG_LISTS`;
+- an `asn=` or `country=` tag;
+- a `dnsbl=` tag of a zone in `SWW_DNSBL_ZONES`, in lower case, with a key
+  masked as the `reputation` field shows it;
+- `abuseipdb`, while `SWW_ABUSEIPDB_KEY` is set;
+- `exploitsignature`, in `SWW_TAG_DENY` only, while `SWW_RULES_ENABLED` is
+  `true`, or while neither `SWW_WAF_MODE` nor `SWW_WAF_ANOMALY_THRESHOLD` is
+  `off`.
+
+`crowdsec` stops the start in both settings, because a CrowdSec decision refuses
+the request first.
 
 ## Biased thresholds
 
-- `SWW_ASN_LIMIT_PERCENT` (default empty): a list of AS numbers, each with `:`
-  and a percentage, such as `AS14061:50,AS16276:50,AS45102:25`. An AS number
-  listed twice is refused.
-- `SWW_COUNTRY_LIMIT_PERCENT` (default empty): the same by country, such as
-  `cn:25,ru:50`.
-- `SWW_ASN_BYTES_PERCENT` and `SWW_COUNTRY_BYTES_PERCENT` (default empty): the
-  same, for the byte limits alone.
+- `SWW_ASN_BYTES_PERCENT` and `SWW_COUNTRY_BYTES_PERCENT` (default empty): a
+  percentage of the byte limits alone, for the AS numbers or countries listed,
+  such as `AS14061:50` or `cn:25`. It takes the place of the percentage
+  `SWW_TAG_LIMIT_PERCENT` gives their `asn=` or `country=` tag. An AS number or
+  country listed twice is refused.
 - `SWW_UNKNOWN_LIMIT_PERCENT` (default `100`): the percentage for a client the
   lookup cannot place.
 - `SWW_ASN_LIMIT_PERCENT_URL` (default unset): the `http` or `https` URL of a
   text file with one AS number and percentage on each line, such as
-  `AS64496:50`. A URL that is also in `SWW_BLOCKLIST_URLS` is refused.
+  `AS64496:50`. Each entry counts like an `asn=` tag in `SWW_TAG_LIMIT_PERCENT`.
+  A URL that is also in `SWW_BLOCKLIST_URLS` is refused.
 
 ## Attack detection