Rule files, and bans for a clear sign of attack (closes #24)

Every *.rules file in SWWAF_RULES_DIR not named with a leading dot is
read at start, and again 2 seconds after the directory's last change.
Each request is checked against the rules after the rate limits: log
notes a match, block refuses with 403, ban refuses and bans the netblock
for SWWAF_ATTACK_BAN_DURATION, made permanent by its next request or
attack. path, query and uri are matched as the request line sent them;
header:Host and header:Transfer-Encoding are refused. Bans gain a cause.
The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

internal/config/config.go

@@ -34,8 +34,8 @@ type Config struct {
 	InstanceName string
 	// Observe is true in observe mode, when SWWAF_MODE is observe rather
 	// than enforce: a request that SWWAF_DENY_NETS, a ban, the country
-	// lists or a rate limit would refuse is passed to the app instead, and
-	// no ban is made.
+	// lists, a rate limit or a rule would refuse is passed to the app
+	// instead, and no ban is made.
 	Observe bool
 	// TrustedProxies are the netblocks whose X-Forwarded-For is
 	// believed (SWWAF_TRUSTED_PROXIES).
@@ -94,7 +94,8 @@ type Config struct {
 	// BanResponse is the status a refused client is answered with, 403
 	// or 429, or 0 to close the connection without an answer
 	// (SWWAF_BAN_RESPONSE). It answers a banned client, a request that
-	// breaks a rate limit, SWWAF_DENY_NETS and the country lists.
+	// breaks a rate limit or matches a ban rule, SWWAF_DENY_NETS and the
+	// country lists.
 	BanResponse int
 	// LimitBanDuration is the ban for a first broken rate limit
 	// (SWWAF_LIMIT_BAN_DURATION). A limit broken again within
@@ -105,6 +106,9 @@ type Config struct {
 	LimitBanDuration     time.Duration
 	LimitBanRepeatWindow time.Duration
 	MaxBanDuration       time.Duration
+	// AttackBanDuration is the ban for a first clear sign of attack
+	// (SWWAF_ATTACK_BAN_DURATION). It cannot be off.
+	AttackBanDuration time.Duration
 	// MaxBans is the most bans held (SWWAF_MAX_BANS).
 	MaxBans int
 	// BanScopeV4Prefix is the length of the netblock around an IPv4
@@ -127,6 +131,10 @@ type Config struct {
 	// metrics (SWWAF_METRICS_TOP_N).
 	MetricsToken string
 	MetricsTopN  int
+	// RulesDir is the directory of the rule files (SWWAF_RULES_DIR), read
+	// unless RulesEnabled is false (SWWAF_RULES_ENABLED).
+	RulesDir     string
+	RulesEnabled bool
 
 	// settings are the values read, as given or by default, for the
 	// log line at start.
@@ -187,6 +195,7 @@ var (
 	errNotMode       = errors.New("is not enforce or observe")
 	errNotPathPrefix = errors.New(
 		"is not a path prefix starting with /, such as /assets/")
+	errNotBoolean = errors.New("is not true or false")
 )
 
 // FromEnvironment reads the settings with lookupEnv, normally
@@ -224,6 +233,7 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		LimitBanDuration:     env.durationNotOff("SWWAF_LIMIT_BAN_DURATION", "1h"),
 		LimitBanRepeatWindow: env.durationNotOff("SWWAF_LIMIT_BAN_REPEAT_WINDOW", "24h"),
 		MaxBanDuration:       env.durationNotOff("SWWAF_MAX_BAN_DURATION", "7d"),
+		AttackBanDuration:    env.durationNotOff("SWWAF_ATTACK_BAN_DURATION", "7d"),
 		MaxBans:              env.numberNotOff("SWWAF_MAX_BANS", "5000"),
 		BanScopeV4Prefix:     env.v4Prefix("SWWAF_BAN_SCOPE_V4_PREFIX", "32"),
 		StateDir:             env.absolutePath("SWWAF_STATE_DIR", "/var/lib/smallwebwaf"),
@@ -233,6 +243,8 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 			"accept,accept-language,accept-encoding,content-type,origin,range"),
 		MetricsToken: env.token("SWWAF_METRICS_TOKEN"),
 		MetricsTopN:  env.numberNotOff("SWWAF_METRICS_TOP_N", "50"),
+		RulesDir:     env.value("SWWAF_RULES_DIR", "/etc/smallwebwaf/rules.d"),
+		RulesEnabled: env.boolean("SWWAF_RULES_ENABLED", "true"),
 	}
 
 	for _, country := range cfg.ExclusivelyAllowedCountries {
@@ -316,6 +328,16 @@ func (e *environment) observe(name, defaultValue string) bool {
 	return mode == "observe"
 }
 
+// boolean reads a setting that is true or false.
+func (e *environment) boolean(name, defaultValue string) bool {
+	value := e.value(name, defaultValue)
+	if value != "true" && value != "false" {
+		e.check(name, fmt.Errorf("%q %w", value, errNotBoolean))
+	}
+
+	return value == "true"
+}
+
 // netblocks reads a setting that is a list of netblocks.
 func (e *environment) netblocks(name, defaultValue string) []netip.Prefix {
 	netblocks, err := parseNetblocks(e.value(name, defaultValue))
@@ -730,6 +752,22 @@ func parseCountries(value string) ([]string, error) {
 const headerNameChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" +
 	"0123456789!#$%&'*+-.^_`|~"
 
+// IsHeaderName reports whether name can be a header name: one or more of
+// the characters RFC 9110 allows in one.
+func IsHeaderName(name string) bool {
+	if name == "" {
+		return false
+	}
+
+	for _, char := range name {
+		if !strings.ContainsRune(headerNameChars, char) {
+			return false
+		}
+	}
+
+	return true
+}
+
 // parseHeaderNames reads a comma-separated list of header names in either
 // case, and returns them in lower case. Host and Transfer-Encoding are
 // refused: Go's HTTP server takes them out of the request's headers.
@@ -742,10 +780,8 @@ func parseHeaderNames(value string) ([]string, error) {
 	headers := make([]string, 0, len(items))
 
 	for _, item := range items {
-		for _, char := range item {
-			if !strings.ContainsRune(headerNameChars, char) {
-				return nil, fmt.Errorf("%q %w", item, errNotHeaderName)
-			}
+		if !IsHeaderName(item) {
+			return nil, fmt.Errorf("%q %w", item, errNotHeaderName)
 		}
 
 		header := strings.ToLower(item)