rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.

Model: opus-5-5

internal/proxy/servewaf.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/netip"
 	"strconv"
@@ -13,8 +14,6 @@ import (
 	"time"
 	"unicode/utf8"
 
-	lru "github.com/hashicorp/golang-lru/v2"
-
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
@@ -105,45 +104,38 @@ type Report struct {
 }
 
 // NewServeWAF returns the server `smallwebwaf servewaf` runs. It answers
-// rproxy's questions with the checks New runs, takes rproxy's reports and
-// answers its own endpoints. It passes nothing to an app. rproxy applies
-// the size and time limits to the visitor, so their settings do not apply
-// here. Go's default limit on a request's line and headers, 1 MiB, stays:
-// it is far above rproxy's, and a question refused for its size would have
-// rproxy let the request through.
+// rproxy's questions, takes rproxy's reports and answers its own endpoints. It
+// passes nothing to an app. rproxy applies the size and time limits to the
+// visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it
+// is far above rproxy's, and a question refused for its size would have rproxy
+// let the request through.
 func NewServeWAF(params Params) *Server {
-	cfg := *params.Config
-	cfg.RequestMaxBytes = 0
-	cfg.ClientRequestTimeout = serveWAFTimeout
-	// The server's WriteTimeout does this. It sets a new deadline for each
-	// request, where a deadline a handler sets stays on a kept-open
-	// connection, and would run out under a later request's answer.
-	cfg.ClientResponseTimeout = 0
-	// A question's body of QuestionBodyMaxBytes may be cut short, and the
-	// Core Rule Set does not read a JSON or XML body over its limit.
-	cfg.WAFBodyLimit = min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1)
-	params.Config = &cfg
-
 	h := newHandler(params)
 
-	awaitingReport, err := lru.New[string, *decision](maxAwaitingReport)
-	if err != nil {
-		panic(err) // New fails only for a size below one
+	return &Server{
+		Server: &http.Server{
+			Addr:         params.Config.ListenAddr,
+			Handler:      h,
+			ErrorLog:     slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn),
+			ReadTimeout:  serveWAFTimeout,
+			WriteTimeout: serveWAFTimeout,
+			IdleTimeout:  serveWAFIdleTimeout,
+		},
+		Ledger:     h.ledger,
+		Limiter:    h.limiter,
+		GeoJS:      h.geojs,
+		Anomalies:  h.anomalies,
+		LookupFile: h.lookupFile,
+		Lists:      h.lists,
+		DNSBL:      h.dnsbl,
+		AbuseIPDB:  h.abuseIPDB,
+		Metrics:    h.metrics,
 	}
-
-	h.awaitingReport = awaitingReport
-
-	return h.server(&http.Server{
-		Handler:      http.HandlerFunc(h.serveWAF),
-		ReadTimeout:  serveWAFTimeout,
-		WriteTimeout: serveWAFTimeout,
-		IdleTimeout:  serveWAFIdleTimeout,
-	})
 }
 
-// serveWAF handles one request to servewaf: a request carrying
-// ClientHeader is rproxy's question, and any other is for servewaf itself.
-func (h *handler) serveWAF(w http.ResponseWriter, r *http.Request) {
+// ServeHTTP handles one request to servewaf: a request carrying ClientHeader is
+// rproxy's question, and any other is for servewaf itself.
+func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if len(r.Header.Values(ClientHeader)) > 0 {
 		h.answerQuestion(w, r)
 
@@ -153,12 +145,6 @@ func (h *handler) serveWAF(w http.ResponseWriter, r *http.Request) {
 	h.answerOwnEndpoint(w, r)
 }
 
-// answersQuestions reports whether h is servewaf, which alone holds requests
-// for their reports.
-func (h *handler) answersQuestions() bool {
-	return h.awaitingReport != nil
-}
-
 // refusedWhateverTheAnswer reports whether the request is one that does not wait
 // for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
 // its client: it is over the header limits, a blocklist lists its client while
@@ -188,10 +174,6 @@ func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 // characters, of which a header value can hold only tabs, so a part of Unicode
 // spaces is a cookie to it.
 func (rq *request) overHeaderLimits() bool {
-	if !rq.h.answersQuestions() {
-		return false
-	}
-
 	fields, cookies := 0, 0
 
 	for _, values := range rq.in.Header {
@@ -244,7 +226,8 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// The last deferred runs first, as in ServeHTTP.
+	// The last deferred runs first: countRefusal before addToHistory, so that a
+	// broken error burst is in the client's history.
 	defer rq.addToHistory()
 	defer rq.countAnomalies()
 	defer rq.countRefusal()
@@ -374,10 +357,11 @@ func (rq *request) holdForReport() {
 
 // deny answers a question with what the visitor is to get for r.
 func (rq *request) deny(r refusal) {
+	rq.refused = &r
+
 	if r.status == 0 {
 		// SWWAF_BAN_RESPONSE is close. Written past rq.out, since the log line's
 		// status stays 0: the visitor is sent nothing.
-		rq.refused.CompareAndSwap(nil, &r)
 		rq.out.Header().Set(DispositionHeader, DispositionClose)
 		rq.out.ResponseWriter.WriteHeader(http.StatusOK)
 
@@ -385,7 +369,7 @@ func (rq *request) deny(r refusal) {
 	}
 
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
-	rq.answer(r)
+	http.Error(rq.out, http.StatusText(r.status), r.status)
 }
 
 // answerOwnEndpoint answers a request to servewaf's own address. No check
@@ -425,7 +409,8 @@ func (h *handler) takeReport(w http.ResponseWriter, r *http.Request) {
 	}
 
 	held, found := h.awaitingReport.Peek(report.RequestID)
-	// Remove reports true to one report only, of several that name the id.
+	// Remove reports true to one report only, of several that name the id. A
+	// question still being handled is held as nil.
 	if found && held != nil && h.awaitingReport.Remove(report.RequestID) {
 		h.finishWith(held, report)
 	}
@@ -490,18 +475,17 @@ func (report *Report) checkRanges() error {
 
 // finishWith finishes a request with what its report says, and writes the
 // request's last log line, which holds its decision's fields and the report's.
-// For an allowed request it first takes the steps ServeHTTP takes once a
-// request passed to the app has ended, with the status and bytes of the report
-// in place of those it would have seen. A denied request's counting was
-// finished at its decision.
+// For an allowed request it first counts the request's bytes, and adds it to its
+// client's history, the anomaly counters and the metrics, with the status and
+// bytes the report gives. A denied request's counting was finished at its
+// decision.
 func (h *handler) finishWith(held *decision, report Report) {
 	rq := &request{
-		decision: *held,
-		h:        h,
-		out:      &responseWriter{status: report.Status, bytes: report.ResponseBytes},
-		body:     &requestBody{},
+		decision:     *held,
+		h:            h,
+		out:          &responseWriter{status: report.Status, bytes: report.ResponseBytes},
+		requestBytes: report.RequestBytes,
 	}
-	rq.body.bytes.Store(report.RequestBytes)
 
 	rq.line.ServeWAFLine = requestlog.ServeWAFLineReport
 	rq.line.Status = report.Status
@@ -511,8 +495,6 @@ func (h *handler) finishWith(held *decision, report Report) {
 
 	if rq.allowed {
 		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
-		// addToHistory goes by this for whether the request reached the app.
-		rq.upstreamStart = time.Now()
 
 		rq.countBytes()
 		rq.countAnomalies()