Keep the bans, the clients and GeoJS's answers in state files (closes #17)

smallwebwaf now copies its state to bans.json, clients.json and
lookups.json in SWWAF_STATE_DIR, as "Persistent state" in SPEC.md
describes, and reads them back at start, so a restart lifts no ban and
gives no client a fresh allowance. Each client gains a history, and a
ban's notes count the netblock's requests. bans.json is written
SWWAF_STATE_WRITE_DELAY after a ban, and every file every
SWWAF_STATE_COUNTER_INTERVAL and at the stop. A ban read back is masked
to its netblock and refuses every client in it. A file that does not
parse, an unknown version, an entry without a field it needs, or an
unwritable directory stops the start.

Deviation: no AS number or name, and no ban cause, reason or lifting yet.

Model: opus-5-5

internal/smallwebwaf/smallwebwaf_test.go

@@ -8,6 +8,8 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
@@ -24,9 +26,13 @@ const (
 	// testVersion is the version the tests give smallwebwaf.
 	testVersion = "test"
 	// localhost is where the tests listen.
-	localhost   = "127.0.0.1"
-	listenAddr  = "SWWAF_LISTEN_ADDR"
-	upstreamURL = "SWWAF_UPSTREAM_URL"
+	localhost       = "127.0.0.1"
+	listenAddr      = "SWWAF_LISTEN_ADDR"
+	upstreamURL     = "SWWAF_UPSTREAM_URL"
+	stateDir        = "SWWAF_STATE_DIR"
+	rateLimitPerDay = "SWWAF_RATE_LIMIT_PER_DAY"
+	// greeting is what the tests' app answers.
+	greeting = "hello from the app"
 )
 
 // output collects what smallwebwaf writes on stdout.
@@ -69,11 +75,19 @@ func (o *output) line(t *testing.T, key, value string) map[string]any {
 		time.Sleep(pollInterval)
 	}
 
-	t.Fatalf("no line with %s %q in the output:\n%s", key, value, o.buf.String())
+	t.Fatalf("no line with %s %q in the output:\n%s", key, value, o.text())
 
 	return nil
 }
 
+// text returns everything written so far.
+func (o *output) text() string {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	return o.buf.String()
+}
+
 // run runs smallwebwaf with the settings in env until ctx is done, and
 // returns its exit status.
 func run(ctx context.Context, env map[string]string, out *output) int {
@@ -121,7 +135,10 @@ func TestAddressInUseStopsTheStart(t *testing.T) {
 
 	out := &output{}
 
-	status := run(t.Context(), map[string]string{listenAddr: taken.Addr().String()}, out)
+	status := run(t.Context(), map[string]string{
+		listenAddr: taken.Addr().String(),
+		stateDir:   t.TempDir(),
+	}, out)
 	if status != 1 {
 		t.Errorf("exit status %d, want 1", status)
 	}
@@ -132,11 +149,8 @@ func TestAddressInUseStopsTheStart(t *testing.T) {
 func TestServesUntilToldToStop(t *testing.T) {
 	t.Parallel()
 
-	app := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			_, _ = io.WriteString(w, "hello from the app")
-		}))
-	defer app.Close()
+	appURL := startApp(t)
+	dir := t.TempDir()
 
 	ctx, stop := context.WithCancel(t.Context())
 	out := &output{}
@@ -145,12 +159,13 @@ func TestServesUntilToldToStop(t *testing.T) {
 	go func() {
 		exited <- run(ctx, map[string]string{
 			listenAddr:  localhost + ":0",
-			upstreamURL: app.URL,
+			upstreamURL: appURL,
+			stateDir:    dir,
 		}, out)
 	}()
 
 	starting := out.line(t, "msg", "starting")
-	wantStartingLine(t, starting, app.URL)
+	wantStartingLine(t, starting, appURL, dir)
 
 	addr, _ := starting["address"].(string)
 	wantGreeting(t, "http://"+addr+"/")
@@ -170,15 +185,184 @@ func TestServesUntilToldToStop(t *testing.T) {
 	out.line(t, "msg", "stopped")
 }
 
+func TestStateKeptAcrossRestarts(t *testing.T) {
+	t.Parallel()
+
+	env := map[string]string{
+		listenAddr:      localhost + ":0",
+		upstreamURL:     startApp(t),
+		stateDir:        t.TempDir(),
+		rateLimitPerDay: "2",
+		// Neither comes due in the test: the files are written as
+		// smallwebwaf stops.
+		"SWWAF_STATE_WRITE_DELAY":      "1h",
+		"SWWAF_STATE_COUNTER_INTERVAL": "1h",
+	}
+
+	// The two requests a day allows, and a stop.
+	runUntilStopped(t, env, func(url string) {
+		wantGreeting(t, url)
+		wantGreeting(t, url)
+	})
+
+	// After a restart the client has no fresh allowance: its third
+	// request breaks the day limit, and bans it.
+	out := runUntilStopped(t, env, func(url string) {
+		wantRefused(t, url)
+	})
+	out.line(t, "action", "rate_limited")
+
+	// After another, the ban still refuses it.
+	out = runUntilStopped(t, env, func(url string) {
+		wantRefused(t, url)
+	})
+	out.line(t, "action", "banned")
+}
+
+func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
+	t.Parallel()
+
+	const scope = "SWWAF_BAN_SCOPE_V4_PREFIX"
+
+	env := map[string]string{
+		listenAddr:              localhost + ":0",
+		upstreamURL:             startApp(t),
+		stateDir:                t.TempDir(),
+		"SWWAF_TRUSTED_PROXIES": localhost + "/32",
+		rateLimitPerDay:         "1",
+		scope:                   "24",
+	}
+
+	// 203.0.113.9's second request breaks the day limit, and bans
+	// 203.0.113.0/24.
+	runUntilStopped(t, env, func(url string) {
+		wantStatus(t, url, "203.0.113.9", http.StatusOK)
+		wantStatus(t, url, "203.0.113.9", http.StatusForbidden)
+	})
+
+	// With each address a netblock of its own after a restart, that ban
+	// still refuses all of 203.0.113.0/24. 198.51.100.7 is banned alone.
+	env[scope] = "32"
+	runUntilStopped(t, env, func(url string) {
+		wantStatus(t, url, "203.0.113.200", http.StatusForbidden)
+		wantStatus(t, url, "203.0.114.1", http.StatusOK)
+		wantStatus(t, url, "198.51.100.7", http.StatusOK)
+		wantStatus(t, url, "198.51.100.7", http.StatusForbidden)
+	})
+
+	// With /24 netblocks again, that ban still refuses 198.51.100.7, and
+	// no other address.
+	env[scope] = "24"
+	runUntilStopped(t, env, func(url string) {
+		wantStatus(t, url, "198.51.100.7", http.StatusForbidden)
+		wantStatus(t, url, "198.51.100.8", http.StatusOK)
+	})
+}
+
+func TestStateFileThatDoesNotParseStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	err := os.WriteFile(filepath.Join(dir, "bans.json"), []byte("{\n"), 0o600)
+	if err != nil {
+		t.Fatalf("write bans.json: %v", err)
+	}
+
+	// The file ends at the newline that is the second byte of its first
+	// line.
+	wantStartRefused(t, dir, filepath.Join(dir, "bans.json")+", line 1, column 2: ")
+}
+
+func TestUnwritableStateDirStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	wantStartRefused(t, filepath.Join(t.TempDir(), "missing"),
+		"SWWAF_STATE_DIR cannot be written: ")
+}
+
+// wantStartRefused runs smallwebwaf with its state files in dir, and
+// checks that it stops at start, with an error that starts with want. If
+// it starts instead, it is stopped after waitLimit.
+func wantStartRefused(t *testing.T, dir, want string) {
+	t.Helper()
+
+	ctx, stop := context.WithTimeout(t.Context(), waitLimit)
+	defer stop()
+
+	out := &output{}
+
+	status := run(ctx, map[string]string{listenAddr: localhost + ":0", stateDir: dir}, out)
+	if status != 1 {
+		t.Fatalf("exit status %d, want 1", status)
+	}
+
+	line := out.line(t, "msg", "cannot use the state files")
+	message, _ := line["error"].(string)
+
+	if !strings.HasPrefix(message, want) {
+		t.Errorf("start refused with %q, want an error starting %q", message, want)
+	}
+}
+
+// startApp starts an app that answers every request with greeting, and
+// returns its URL.
+func startApp(t *testing.T) string {
+	t.Helper()
+
+	app := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			_, _ = io.WriteString(w, greeting)
+		}))
+	t.Cleanup(app.Close)
+
+	return app.URL
+}
+
+// runUntilStopped runs smallwebwaf with the settings in env, has use send
+// it requests at url, then stops it as SIGTERM does, checks that it
+// stopped in order, and returns its output.
+func runUntilStopped(
+	t *testing.T, env map[string]string, use func(url string),
+) *output {
+	t.Helper()
+
+	ctx, stop := context.WithCancel(t.Context())
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- run(ctx, env, out)
+	}()
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	use("http://" + addr + "/")
+	stop()
+
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+		}
+	case <-time.After(waitLimit):
+		t.Fatal("still running after being told to stop")
+	}
+
+	return out
+}
+
 // wantStartingLine checks that the line at start gives the version and
 // every setting's value.
-func wantStartingLine(t *testing.T, line map[string]any, appURL string) {
+func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
 	t.Helper()
 
 	settings, _ := line["settings"].(map[string]any)
 	want := map[string]any{
 		listenAddr:                              localhost + ":0",
 		upstreamURL:                             appURL,
+		stateDir:                                dir,
+		"SWWAF_STATE_WRITE_DELAY":               "10s",
+		"SWWAF_STATE_COUNTER_INTERVAL":          "15m",
 		"SWWAF_TRUSTED_PROXIES":                 "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
 		"SWWAF_CLIENT_REQUEST_TIMEOUT":          "60s",
 		"SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES": "32K",
@@ -193,7 +377,7 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL string) {
 		"SWWAF_DENY_NETS":                       "",
 		"SWWAF_RATE_LIMIT_PER_MINUTE":           "1000",
 		"SWWAF_RATE_LIMIT_PER_HOUR":             "10000",
-		"SWWAF_RATE_LIMIT_PER_DAY":              "50000",
+		rateLimitPerDay:                         "50000",
 		"SWWAF_DENIED_COUNTRIES":                "",
 		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES":   "",
 		"SWWAF_BAN_RESPONSE":                    "403",
@@ -236,7 +420,61 @@ func wantGreeting(t *testing.T, url string) {
 	body, err := io.ReadAll(res.Body)
 	_ = res.Body.Close()
 
-	if err != nil || string(body) != "hello from the app" {
+	if err != nil || string(body) != greeting {
 		t.Errorf("got %q (%v), want the app's answer", body, err)
 	}
 }
+
+// wantRefused checks that a request to url is refused with 403, the
+// default SWWAF_BAN_RESPONSE.
+func wantRefused(t *testing.T, url string) {
+	t.Helper()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
+		http.NoBody)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+
+	res, err := (&http.Client{Transport: transport}).Do(req)
+	if err != nil {
+		t.Fatalf("request: %v", err)
+	}
+
+	_ = res.Body.Close()
+
+	if res.StatusCode != http.StatusForbidden {
+		t.Errorf("status %d, want %d", res.StatusCode, http.StatusForbidden)
+	}
+}
+
+// wantStatus checks that a request to url from the client at from, as
+// X-Forwarded-For names it, is answered with status.
+func wantStatus(t *testing.T, url, from string, status int) {
+	t.Helper()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
+		http.NoBody)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+
+	req.Header.Set("X-Forwarded-For", from)
+
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+
+	res, err := (&http.Client{Transport: transport}).Do(req)
+	if err != nil {
+		t.Fatalf("request: %v", err)
+	}
+
+	_ = res.Body.Close()
+
+	if res.StatusCode != status {
+		t.Errorf("request from %s: status %d, want %d", from, res.StatusCode, status)
+	}
+}