Byte limits per client over a minute, an hour and a day (closes #20)

SWWAF_BYTES_LIMIT_PER_MINUTE, _PER_HOUR and _PER_DAY (10G, 20G, 50G)
and SWWAF_BYTES_COUNT (both). A request's bytes are counted once its
answer has ended, for a request passed to the app that the rate limits
count; what a WebSocket carries each way, once it closes. Bytes over a
limit ban the client as a broken rate limit does, and cut nothing
short. clients.json keeps the byte buckets, the log line's counts carry
the byte totals, ban notes say what the limit is on, and the limit hits
metric is labelled by kind.

Judgement call: limit_hit names a byte window minute_bytes, hour_bytes
or day_bytes, as counts names the byte totals.
Judgement call: in observe mode, the bytes of a request enforce mode
would have refused are not counted.

Model: opus-5-5

internal/bans/admin_test.go

@@ -66,12 +66,15 @@ func TestReasonOfTheBansSmallwebwafMakes(t *testing.T) {
 	ledger := bans.New(defaultRules())
 
 	limit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
-		bans.Notes{Limit: 1000, Window: "minute"})
+		bans.Notes{Kind: "requests", Limit: 1000, Window: "minute"})
+	byteLimit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.3/32"),
+		midnight(), bans.Notes{Kind: "bytes", Limit: 10 << 30, Window: "hour"})
 	attack, _ := ledger.BanForAttack(netip.MustParsePrefix("203.0.113.2/32"), midnight(),
 		bans.Notes{RuleID: "git-dir", Target: "path"})
 
 	for _, tc := range []struct{ got, want string }{
 		{limit.Reason, "requests per minute over the limit of 1000"},
+		{byteLimit.Reason, "bytes per hour over the limit of 10737418240"},
 		{attack.Reason, "matched the rule git-dir"},
 	} {
 		if tc.got != tc.want {

internal/bans/bans.go

@@ -1,8 +1,8 @@
 // Package bans is the ban ledger: the bans smallwebwaf makes on the
-// netblocks of clients that break a rate limit or show a clear sign of
-// attack, and those an admin makes, with their notes, as the "Bans"
-// section of SPEC.md describes. The bans are kept in memory, and written
-// to bans.json and read from it by the state package.
+// netblocks of clients that break a rate limit or a byte limit or show a
+// clear sign of attack, and those an admin makes, with their notes, as
+// the "Bans" section of SPEC.md describes. The bans are kept in memory,
+// and written to bans.json and read from it by the state package.
 package bans
 
 import (
@@ -97,11 +97,14 @@ type Notes struct {
 	ASN     string `json:"asn"`
 	ASName  string `json:"as_name"`
 	Country string `json:"country"`
-	// Limit, Window and Count are, for a ban for a broken limit, the limit
-	// that was broken, its window, "minute", "hour" or "day", and the
-	// count reached: the client's requests in the window, the one that
-	// broke the limit included. These are the requests that counted
-	// toward the ban, and the window is the time over which they came.
+	// Kind, Limit, Window and Count are, for a ban for a broken limit,
+	// what the limit was on, "requests" for a rate limit or "bytes" for a
+	// byte limit, the limit that was broken, its window, "minute", "hour"
+	// or "day", and the count reached: the client's requests, or bytes, in
+	// the window, those of the request that broke the limit included.
+	// These are what counted toward the ban, and the window is the time
+	// over which they came.
+	Kind   string  `json:"kind,omitempty"`
 	Limit  int64   `json:"limit,omitempty"`
 	Window string  `json:"window,omitempty"`
 	Count  float64 `json:"count,omitempty"`
@@ -109,8 +112,8 @@ type Notes struct {
 	// of the rule file rule that matched, and its target.
 	RuleID string `json:"rule_id,omitempty"`
 	Target string `json:"target,omitempty"`
-	// Request is the request that broke the limit, or that was the clear
-	// sign of attack.
+	// Request is the request that broke the limit, or whose bytes broke
+	// it, or that was the clear sign of attack.
 	Request Request `json:"request"`
 	// Requests is how many requests the netblock has sent since it was
 	// first seen, and Refused how many of them the ban has refused so
@@ -260,7 +263,8 @@ func activeBan(bans []Ban, now time.Time) *Ban {
 // active, as when two of its requests break a limit at once, that ban is
 // returned with false, and no other is made. The ledger fills in the
 // notes' Refused and EarlierBans itself, and gives the ban the reason
-// "requests per <Window> over the limit of <Limit>", from the notes.
+// "<Kind> per <Window> over the limit of <Limit>", from the notes, such
+// as "requests per minute over the limit of 1000".
 func (l *Ledger) BanForLimit(
 	netblock netip.Prefix, now time.Time, notes Notes,
 ) (Ban, bool) {
@@ -317,7 +321,8 @@ func (l *Ledger) WouldBePermanent(
 
 // limitReason is the reason of a ban for a broken limit, with notes.
 func limitReason(notes Notes) string {
-	return fmt.Sprintf("requests per %s over the limit of %d", notes.Window, notes.Limit)
+	return fmt.Sprintf("%s per %s over the limit of %d",
+		notes.Kind, notes.Window, notes.Limit)
 }
 
 // attackReason is the reason of a ban for a clear sign of attack, with

internal/bans/bans_test.go

@@ -349,7 +349,7 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 
 	// As it ends, a clear sign of attack would ban for seven days, and a
 	// limit broken again for three hours, but neither is made.
-	limitNotes := bans.Notes{Limit: 1, Window: "minute"}
+	limitNotes := bans.Notes{Kind: "requests", Limit: 1, Window: "minute"}
 	attack, wouldAttack := ledger.WouldBanForAttack(netblock, first.Expires,
 		bans.Notes{RuleID: "git-dir"})
 	limit, wouldLimit := ledger.WouldBanForLimit(netblock, first.Expires, limitNotes)