Per-client request rate limits over a minute, an hour and a day (closes #43)

Each client, one IPv4 address or one IPv6 /64, is counted in two buckets
per window, the earlier weighted by how much of it the window covers; at
most 20,000 clients are kept, least recently seen dropped first. A
request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or _DAY (1000, 10000,
50000, or off) gets 429 before reaching the app. Refused requests count,
413s included. A clock set back over a second behind a bucket's start
restarts that window. The log line gains limit_hit and the action
rate_limited.

Deviation from SPEC.md, per the issue: the 20,000 bound and /64 are fixed.
Judgement call: golang-lru/v2 holds the table; httprate does not count refused requests.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/proxy/client.go

@@ -48,6 +48,21 @@ func clientAddress(
 	return client
 }
 
+// ipv6GroupPrefix is the length of the IPv6 netblock that is one client.
+const ipv6GroupPrefix = 64
+
+// clientGroup is the client a request is counted toward: its IPv4
+// address, or the /64 its IPv6 address is in, since one abuser usually
+// holds a whole /64. An IPv4 address in IPv6 form counts as IPv4.
+func clientGroup(addr netip.Addr) netip.Prefix {
+	addr = addr.Unmap()
+	if addr.Is6() {
+		return netip.PrefixFrom(addr, ipv6GroupPrefix).Masked()
+	}
+
+	return netip.PrefixFrom(addr, addr.BitLen())
+}
+
 // isInside reports whether addr is in one of the netblocks.
 func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 	return slices.ContainsFunc(netblocks, func(netblock netip.Prefix) bool {

internal/proxy/proxy.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
 // The request line and headers a client may send, and how long a
@@ -57,6 +58,11 @@ func New(params Params) *http.Server {
 			processLog: params.ProcessLog,
 			errorLog:   errorLog,
 			transport:  newTransport(),
+			limiter: ratelimit.New(ratelimit.Limits{
+				PerMinute: params.Config.RateLimitPerMinute,
+				PerHour:   params.Config.RateLimitPerHour,
+				PerDay:    params.Config.RateLimitPerDay,
+			}),
 		},
 		ReadHeaderTimeout: params.Config.ClientRequestTimeout,
 		IdleTimeout:       clientIdleTimeout,
@@ -73,6 +79,7 @@ type handler struct {
 	processLog *slog.Logger
 	errorLog   *log.Logger
 	transport  http.RoundTripper
+	limiter    *ratelimit.Limiter
 }
 
 // newTransport returns what carries requests to the app. It never goes

internal/proxy/proxy_test.go

@@ -44,6 +44,7 @@ const (
 	requestMaxBytes         = "SWWAF_REQUEST_MAX_BYTES"
 	responseMaxBytes        = "SWWAF_RESPONSE_MAX_BYTES"
 	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
+	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
 )
 
 // output collects what smallwebwaf writes on stdout.

internal/proxy/ratelimits_test.go

@@ -0,0 +1,67 @@
+package proxy_test
+
+import (
+	"net/http"
+	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		rateLimitPerMinute: "1",
+	})
+
+	const otherClient = "203.0.113.10"
+
+	// With a limit of one request a minute, a client's second request is
+	// refused. A client is one IPv4 address, or one IPv6 /64; an IPv4
+	// address in IPv6 form is that IPv4 address.
+	requests := []struct {
+		client string // as X-Forwarded-For names it
+		logged string // as the log line's client_ip names it
+		want   int
+	}{
+		{client, client, http.StatusOK},
+		{client, client, http.StatusTooManyRequests},
+		{otherClient, otherClient, http.StatusOK},
+		{"::ffff:" + otherClient, otherClient, http.StatusTooManyRequests},
+		{"2001:db8::1", "2001:db8::1", http.StatusOK},
+		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusTooManyRequests},
+		{"2001:db8:0:1::1", "2001:db8:0:1::1", http.StatusOK},
+	}
+
+	for i, sent := range requests {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, sent.client)
+		wantStatus(t, do(t, req), sent.want)
+
+		line := out.requestLines(t, i+1)[i]
+		if line.ClientIP != sent.logged {
+			t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.logged)
+		}
+
+		if sent.want == http.StatusOK {
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+		} else {
+			wantLine(t, line, http.StatusTooManyRequests, requestlog.ActionRateLimited)
+
+			if line.LimitHit != "minute" {
+				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
+			}
+		}
+	}
+
+	if calls.Load() != 4 {
+		t.Errorf("the app was called %d times, want 4", calls.Load())
+	}
+}

internal/proxy/request.go

@@ -38,6 +38,7 @@ type request struct {
 	body *requestBody // nil for a request without a body
 	line requestlog.Line
 
+	client      netip.Addr
 	peer        netip.Addr
 	peerTrusted bool
 	start       time.Time
@@ -75,6 +76,7 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 		in:          r,
 		rc:          http.NewResponseController(w),
 		out:         &responseWriter{ResponseWriter: w},
+		client:      client,
 		peer:        peer,
 		peerTrusted: isInside(peer, trusted),
 		start:       start,
@@ -100,10 +102,20 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 }
 
 // check is the one place where a request can be refused once its client
-// is known, before its body is read or anything reaches the app; the rate
-// limits and country lists of milestone 2 go here. It returns nil to let
-// the request through.
+// is known, before its body is read or anything reaches the app. It
+// returns nil to let the request through. The rate limits come first, so
+// that every request is counted, one refused for its size too.
 func (rq *request) check() *refusal {
+	limitHit := rq.h.limiter.Count(clientGroup(rq.client), rq.start)
+	if limitHit != "" {
+		rq.line.LimitHit = limitHit
+
+		return &refusal{
+			status: http.StatusTooManyRequests,
+			action: requestlog.ActionRateLimited,
+		}
+	}
+
 	maxBytes := rq.h.config.RequestMaxBytes
 	if maxBytes > 0 && rq.in.ContentLength > maxBytes {
 		return &refusal{