Rule files, and bans for a clear sign of attack (closes #24)

Every *.rules file in SWWAF_RULES_DIR not named with a leading dot is
read at start, and again 2 seconds after the directory's last change.
Each request is checked against the rules after the rate limits: log
notes a match, block refuses with 403, ban refuses and bans the netblock
for SWWAF_ATTACK_BAN_DURATION, made permanent by its next request or
attack. path, query and uri are matched as the request line sent them;
header:Host and header:Transfer-Encoding are refused. Bans gain a cause.
The image ships 00-default.rules.

Judgement call: a header sent twice is matched with its values joined
by ", ".
Judgement call: SWWAF_MAX_BAN_DURATION does not cap a ban for an attack.
Not in this unit: offences for rule matches, with the error burst.

Model: opus-5-5

internal/state/state.go

@@ -48,6 +48,7 @@ var (
 	errVersion = errors.New("unknown version")
 	// errMissing is for an entry without a field it needs.
 	errMissing = errors.New("has no")
+	errCause   = errors.New("is not limit or attack")
 )
 
 // Params are what Load needs.
@@ -95,11 +96,12 @@ type bansFile struct {
 }
 
 // banEntry is a ban as bans.json holds it: a permanent ban's expires is
-// null.
+// null, and a ban an admin added may have no cause.
 type banEntry struct {
 	Netblock netip.Prefix `json:"netblock"`
 	Start    time.Time    `json:"start"`
 	Expires  *time.Time   `json:"expires"`
+	Cause    string       `json:"cause,omitempty"`
 	Notes    bans.Notes   `json:"notes"`
 }
 
@@ -444,7 +446,9 @@ func (f *Files) encode(name string) ([]byte, error) {
 
 // newBanEntry returns ban as bans.json holds it.
 func newBanEntry(ban bans.Ban) banEntry {
-	entry := banEntry{Netblock: ban.Netblock, Start: ban.Start, Notes: ban.Notes}
+	entry := banEntry{
+		Netblock: ban.Netblock, Start: ban.Start, Cause: ban.Cause, Notes: ban.Notes,
+	}
 	if !ban.Permanent() {
 		entry.Expires = &ban.Expires
 	}
@@ -454,7 +458,7 @@ func newBanEntry(ban bans.Ban) banEntry {
 
 // ban returns the ban an entry of bans.json holds.
 func (e banEntry) ban() bans.Ban {
-	ban := bans.Ban{Netblock: e.Netblock, Start: e.Start, Notes: e.Notes}
+	ban := bans.Ban{Netblock: e.Netblock, Start: e.Start, Cause: e.Cause, Notes: e.Notes}
 	if e.Expires != nil {
 		ban.Expires = *e.Expires
 	}
@@ -466,7 +470,8 @@ func (e banEntry) ban() bans.Ban {
 // client, a start, from which the length of the netblock's next ban is
 // worked out, or an expires, which would make it permanent. A permanent
 // ban's expires is null, which Bans cannot tell from a missing one, so
-// each expires is read again as written.
+// each expires is read again as written. A cause other than limit or
+// attack, most likely misspelt, is refused too.
 func (f *bansFile) check(data []byte) error {
 	var written struct {
 		Bans []struct {
@@ -487,6 +492,9 @@ func (f *bansFile) check(data []byte) error {
 			return missing(i, "start")
 		case written.Bans[i].Expires == nil:
 			return missing(i, "expires")
+		case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
+			entry.Cause != bans.CauseAttack:
+			return fmt.Errorf("entry %d's cause %q %w", i+1, entry.Cause, errCause)
 		}
 	}