Byte limits per client over a minute, an hour and a day (closes #20)

SWWAF_BYTES_LIMIT_PER_MINUTE, _PER_HOUR and _PER_DAY (10G, 20G, 50G)
and SWWAF_BYTES_COUNT (both). A request's bytes are counted once its
answer has ended, for a request passed to the app that the rate limits
count; what a WebSocket carries each way, once it closes. Bytes over a
limit ban the client as a broken rate limit does, and cut nothing
short. clients.json keeps the byte buckets, the log line's counts carry
the byte totals, ban notes say what the limit is on, and the limit hits
metric is labelled by kind.

Judgement call: limit_hit names a byte window minute_bytes, hour_bytes
or day_bytes, as counts names the byte totals.
Judgement call: in observe mode, the bytes of a request enforce mode
would have refused are not counted.

Model: opus-5-5

internal/proxy/bans.go

@@ -6,6 +6,7 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
@@ -41,36 +42,92 @@ func (rq *request) banned(now time.Time) bool {
 
 // limitBroken counts the request for the rate limits at now, notes the
 // client's counts for the log line, and reports whether the request takes
-// the client over a limit. In enforce mode such a request bans the
-// client's netblock, and sets the client's counters back to zero; in
-// observe mode it does neither, and raises the alert for the ban it would
-// have made, if that alert would be sent.
+// the client over a rate limit, which breaks it.
 func (rq *request) limitBroken(now time.Time) bool {
-	group := clientGroup(rq.client)
-
-	counts, hit, over := rq.h.limiter.Count(group, now)
+	counts, hit, over := rq.h.limiter.Count(clientGroup(rq.client), now)
 	rq.line.Counts = counts
 
-	if !over {
-		return false
+	if over {
+		rq.banForLimit(now, hit, rq.h.config.BanResponse)
 	}
 
+	return over
+}
+
+// countBytes counts the request's bytes for the byte limits, once its
+// response has ended, and notes the client's byte totals for the log line;
+// its requests stay there as the rate limits counted them. The bytes are
+// the response's body bytes, the request's, or both, as SWWAF_BYTES_COUNT
+// says; for an upgraded connection, such as a WebSocket, which has closed
+// by then, what it carried from the app counts with the response's and
+// what it carried from the client with the request's. Only a request
+// passed to the app has them counted, and only one the rate limits
+// counted; in observe mode, not one that enforce mode would have refused.
+// Bytes that take the client over a byte limit break it; the response was
+// passed on whole.
+func (rq *request) countBytes() {
+	if !rq.counted || rq.line.WouldAction != "" {
+		return
+	}
+
+	response, request := rq.out.bytes, rq.requestBytes()
+	if rq.upgraded != nil {
+		response += rq.upgraded.fromApp.Load()
+		request += rq.upgraded.toApp.Load()
+	}
+
+	var bytes int64
+
+	switch rq.h.config.BytesCount {
+	case "response":
+		bytes = response
+	case "request":
+		bytes = request
+	default: // both
+		bytes = response + request
+	}
+
+	now := rq.h.now()
+
+	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now, bytes)
+	rq.line.Counts.MinuteBytes = counts.MinuteBytes
+	rq.line.Counts.HourBytes = counts.HourBytes
+	rq.line.Counts.DayBytes = counts.DayBytes
+
+	if over {
+		rq.banForLimit(now, hit, rq.out.status)
+	}
+}
+
+// banForLimit bans the client's netblock at now for a broken limit, the
+// one hit names, and notes the offence for the log line. status is what
+// the client was sent, or is sent: SWWAF_BAN_RESPONSE for a request over
+// a rate limit, the app's answer for one whose bytes broke a byte limit.
+// The ban sets the client's counters back to zero. In observe mode it
+// makes no ban and sets nothing back, and raises the alert for the ban it
+// would have made, if that alert would be sent.
+func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	rq.line.LimitHit = hit.Window
+	if hit.Kind == ratelimit.KindBytes {
+		rq.line.LimitHit += "_bytes" // as counts names the byte totals
+	}
+
 	rq.line.Offence = requestlog.OffenceLimit
 
 	netblock := rq.h.netblock(rq.client)
 	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
-		return true
+		return
 	}
 
 	notes := bans.Notes{
 		ASN:      rq.line.ASN,
 		ASName:   rq.line.ASName,
 		Country:  rq.line.Country,
+		Kind:     hit.Kind,
 		Limit:    hit.Limit,
 		Window:   hit.Window,
-		Count:    hit.Requests,
-		Request:  rq.noted(now),
+		Count:    hit.Count,
+		Request:  rq.noted(now, status),
 		Requests: rq.netblockRequests(netblock),
 	}
 
@@ -80,18 +137,16 @@ func (rq *request) limitBroken(now time.Time) bool {
 			rq.alertBan(ban)
 		}
 
-		return true
+		return
 	}
 
 	ban, made := rq.h.ledger.BanForLimit(netblock, now, notes)
-	rq.h.limiter.Reset(group)
+	rq.h.limiter.Reset(clientGroup(rq.client))
 	rq.line.BanExpires = banExpires(ban)
 
 	if made {
 		rq.alertBan(ban)
 	}
-
-	return true
 }
 
 // banForAttack bans the client's netblock at now for a clear sign of
@@ -110,7 +165,7 @@ func (rq *request) banForAttack(now time.Time, rule rules.Rule) {
 		Country:  rq.line.Country,
 		RuleID:   rule.ID,
 		Target:   rule.Target,
-		Request:  rq.noted(now),
+		Request:  rq.noted(now, rq.h.config.BanResponse),
 		Requests: rq.netblockRequests(netblock),
 	}
 
@@ -177,16 +232,16 @@ func (rq *request) alertBan(ban bans.Ban) {
 	})
 }
 
-// noted is the request, refused at now with SWWAF_BAN_RESPONSE, or in
-// observe mode as it would have been, as the notes of the ban it makes
-// keep it.
-func (rq *request) noted(now time.Time) bans.Request {
+// noted is the request, at now, with status, what the client was sent, or
+// in observe mode would have been, as the notes of the ban it makes keep
+// it.
+func (rq *request) noted(now time.Time, status int) bans.Request {
 	return bans.Request{
 		Time:      now,
 		Method:    rq.in.Method,
 		Host:      rq.in.Host,
 		Path:      rq.in.URL.RequestURI(),
-		Status:    rq.h.config.BanResponse,
+		Status:    status,
 		UserAgent: rq.in.UserAgent(),
 	}
 }