Byte limits per client over a minute, an hour and a day (closes #20)

SWWAF_BYTES_LIMIT_PER_MINUTE, _PER_HOUR and _PER_DAY (10G, 20G, 50G)
and SWWAF_BYTES_COUNT (both). A request's bytes are counted once its
answer has ended, for a request passed to the app that the rate limits
count; what a WebSocket carries each way, once it closes. Bytes over a
limit ban the client as a broken rate limit does, and cut nothing
short. clients.json keeps the byte buckets, the log line's counts carry
the byte totals, ban notes say what the limit is on, and the limit hits
metric is labelled by kind.

Judgement call: limit_hit names a byte window minute_bytes, hour_bytes
or day_bytes, as counts names the byte totals.
Judgement call: in observe mode, the bytes of a request enforce mode
would have refused are not counted.

Model: opus-5-5

internal/state/state.go

@@ -615,8 +615,8 @@ func (f *bansFile) check(data []byte) error {
 }
 
 // check refuses a client without its address, which would count nobody's
-// requests, or with requests in a window but no start, which would drop
-// them and give the client a fresh allowance.
+// requests, or with requests or bytes in a window but no start, which
+// would drop them and give the client a fresh allowance.
 func (f *clientsFile) check([]byte) error {
 	for i, client := range f.Clients {
 		switch {
@@ -628,6 +628,12 @@ func (f *clientsFile) check([]byte) error {
 			return missing(i, "hour.start")
 		case countsWithoutStart(client.Day):
 			return missing(i, "day.start")
+		case countsWithoutStart(client.MinuteBytes):
+			return missing(i, "minute_bytes.start")
+		case countsWithoutStart(client.HourBytes):
+			return missing(i, "hour_bytes.start")
+		case countsWithoutStart(client.DayBytes):
+			return missing(i, "day_bytes.start")
 		}
 	}
 
@@ -697,8 +703,8 @@ func (f *alertsFile) check([]byte) error {
 	return nil
 }
 
-// countsWithoutStart reports whether b holds requests but no start, which
-// places them in time.
+// countsWithoutStart reports whether b holds requests, or bytes, but no
+// start, which places them in time.
 func countsWithoutStart(b ratelimit.Buckets) bool {
 	return b.Start.IsZero() && (b.Current != 0 || b.Previous != 0)
 }

internal/state/state_test.go

@@ -392,6 +392,12 @@ func TestEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 				`"hour": {"current": 3}}]}`,
 			`: entry 1 has no "hour.start"`,
 		},
+		{
+			"a client with bytes in a window without its start", clientsJSON,
+			`{"version": 1, "clients": [{"client": "203.0.113.9/32", ` +
+				`"minute_bytes": {"previous": 5120}}]}`,
+			`: entry 1 has no "minute_bytes.start"`,
+		},
 		{
 			"an answer without a client", lookupsJSON,
 			`{"version": 1, "lookups": [{"country": "DE", ` + answer + `}]}`,
@@ -1317,6 +1323,7 @@ func fill(params state.Params) {
 		params.Limiter.Count(netip.MustParsePrefix(c), now)
 	}
 
+	params.Limiter.CountBytes(client, now, 8)
 	params.Limiter.AddToHistory(client, now, ratelimit.Request{
 		Forwarded: true, Status: 200, RequestBytes: 3, ResponseBytes: 5,
 	})