rproxy: circuit breaker for asks to waf (closes #392)

Five asks that get no answer in time within five seconds open the
breaker. While open, a request takes
SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION without asking waf, except
one ask a second; the first answer closes it. Slow answers count as
failures. SPEC.md describes it.

The sww test that stops and restarts waf now waits for the breaker to
close before it expects the ban again.

Model: opus-5-5

internal/rproxy/waf.go

@@ -10,6 +10,7 @@ import (
 	"maps"
 	"net/http"
 	"strings"
+	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
@@ -67,7 +68,8 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 		rq.answer(http.StatusBadGateway)
 	default:
 		// waf cannot be connected to, does not answer at all, or does not answer
-		// within SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS. A request that keeps waf
+		// within SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS; or the circuit breaker
+		// kept the request from asking. A request that keeps waf
 		// busy past SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS, like any request while
 		// waf is overloaded, gets SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION
 		// here. deny closes this, at the cost of answering 503 whenever waf is
@@ -86,6 +88,31 @@ func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
 	}
 }
 
+// askUnlessBreakerOpen asks waf, unless the circuit breaker is open and it is
+// not yet time for a request to ask. It then tells the breaker whether waf
+// answered in time. An answer rproxy cannot pass on still came in time. A
+// visitor that goes away tells the breaker nothing. ctx is the request's own
+// context.
+func (rq *request) askUnlessBreakerOpen(
+	ctx context.Context,
+) (*wafAnswer, error) {
+	b := &rq.h.breaker
+	if !b.mayAsk(time.Now()) {
+		return nil, errBreakerOpen
+	}
+
+	answer, err := rq.ask(ctx)
+
+	switch {
+	case err == nil, errors.Is(err, errCannotPassOn):
+		b.noteAnswer()
+	case ctx.Err() == nil:
+		b.noteFailure(time.Now())
+	}
+
+	return answer, err
+}
+
 // ask sends waf the question, and returns its answer, which must have come
 // whole within SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS. It ends when ctx does, as
 // when the visitor goes away.