SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

gitea's fixes (its parameters, its cookies and gitea.conf) now apply
only to a hostname SWW_APPS lists gitea for, or to every hostname while
it is unset. Each app's fixes are one .conf file, whose first rule skips
the rest unless Inspect sets tx.app_<name>, and one entry in apps.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

README.md

@@ -173,7 +173,7 @@ does.
   the request have `"action":"forward"`.
 - To see a refusal without banning yourself, run `discriminator` with
   `SWW_MODE=observe` and ask for `/.env`. The request reaches the app.
-  `discriminator`'s log lines have `"would_action":"temporarily_banned"` and
+  `discriminator`'s log lines have `"would_action":"banned"` and
   `"rule_ids":["env-file"]`. A ban you get in `enforce` mode is lifted as
   "Clients and bans" below describes.
 - With `SWW_METRICS_TOKEN` set, this answers with the metrics, from a host on
@@ -265,6 +265,7 @@ Every setting the code reads, with its default:
 | `SWW_TAG_LISTS`                          | empty                                                                          | Address lists that each add a tag to their clients' requests, as `name=URL` pairs, such as `torexit=https://example.com/tor.txt`.                                                                                                                               |
 | `SWW_TAG_DENY`                           | empty                                                                          | Tags whose requests are refused, such as `torexit,country=CN`.                                                                                                                                                                                                  |
 | `SWW_TAG_LIMIT_PERCENT`                  | empty                                                                          | Tags whose clients get a percentage, from 1 to 99, of every request and byte limit, such as `vpn:50,asn=14061:25`; the lowest applies.                                                                                                                          |
+| `SWW_ROUTEWATCH_URL`                     | unset                                                                          | The URL of a routewatch instance, which gives each client's `asn=` and `prefix=` tags. Unset, nothing asks routewatch.                                                                                                                                          |
 | `SWW_ASN_BYTES_PERCENT`                  | empty                                                                          | A percentage of the byte limits alone for the AS numbers listed, in place of their `asn=` tag's percentage.                                                                                                                                                     |
 | `SWW_COUNTRY_BYTES_PERCENT`              | empty                                                                          | A percentage of the byte limits alone for the countries listed, in place of their `country=` tag's percentage.                                                                                                                                                  |
 | `SWW_UNKNOWN_LIMIT_PERCENT`              | `100`                                                                          | The percentage of every limit a client without a country gets.                                                                                                                                                                                                  |
@@ -279,6 +280,7 @@ Every setting the code reads, with its default:
 | `SWW_WAF_EXEMPT_PATHS`                   | empty                                                                          | Path prefixes the Core Rule Set does not inspect.                                                                                                                                                                                                               |
 | `SWW_WAF_BODY_LIMIT`                     | `off`                                                                          | How much of a request body the Core Rule Set reads, a size up to `64K`; `off` reads none.                                                                                                                                                                       |
 | `SWW_CORE_RULE_SET_EXCLUSIONS_FILE`      | unset                                                                          | A file of Core Rule Set exclusions, as Coraza directives, that switch rules off for some fields or paths only.                                                                                                                                                  |
+| `SWW_APPS`                               | unset                                                                          | The apps each hostname serves, such as `git.example.com:gitea;cloud.example.com:gitea`; only those apps' fixes apply there. Unset, every app's fixes apply to every hostname.                                                                                   |
 | `SWW_BLOCKLIST_URLS`                     | empty                                                                          | Blocklists to fetch, text files of addresses and netblocks one to a line, such as `https://www.spamhaus.org/drop/drop.txt`.                                                                                                                                     |
 | `SWW_BLOCKLIST_REFRESH`                  | `24h`                                                                          | How long after a list was last tried it is fetched again, `1h` or more.                                                                                                                                                                                         |
 | `SWW_BLOCKLIST_ACTION`                   | `deny`                                                                         | What a client on a blocklist gets: `deny`, `limit:<percent>` of every limit, or `log`.                                                                                                                                                                          |
@@ -567,7 +569,9 @@ the `tags` field of its log line:
   or `vpn=mullvad`;
 - `crowdsec`, `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists
   the client;
-- `exploitsignature`, when a rule file or the Core Rule Set matched the request.
+- `exploitsignature`, when a rule file or the Core Rule Set matched the request;
+- `asn=<number>` and `prefix=<netblock>`, from a routewatch instance, while
+  `SWW_ROUTEWATCH_URL` is set.
 
 `SWW_TAG_DENY` refuses requests by tag, and `SWW_TAG_LIMIT_PERCENT` lowers a
 client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
@@ -578,11 +582,15 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in eight ways so that it lets ordinary
+- `smallwebwaf` changes the Core Rule Set in six ways so that it lets ordinary
   requests to a code forge through, such as git over HTTP and sign-in through
-  Git Credential Manager. On gitea's own paths, its searches, file names and
-  branch names get through too. No setting undoes the changes; "Attack
-  detection" in [`SPEC.md`](SPEC.md) lists them.
+  Git Credential Manager. No setting undoes the changes; "Attack detection" in
+  [`SPEC.md`](SPEC.md) lists them.
+- Each supported app also has its own fixes, which let its ordinary requests
+  through. gitea's let its searches, file names and branch names through.
+  `SWW_APPS` names the apps each hostname serves. A hostname gets only its own
+  apps' fixes, and a hostname it does not list gets none. Unset, every app's
+  fixes apply to every hostname.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again
@@ -630,8 +638,8 @@ is set aside as `<name>.bad`, and never stops the running process (see
 - `internal/discriminator`: `discriminator`'s server, which runs the checks and
   answers its own endpoints.
 - `internal/ratelimit`, `internal/bans`, `internal/rules`, `internal/waf`,
-  `internal/lookup`, `internal/reputation`, `internal/anomaly` and
-  `internal/alerts`: one check or source each.
+  `internal/lookup`, `internal/reputation`, `internal/routewatch`,
+  `internal/anomaly` and `internal/alerts`: one check or source each.
 - `internal/state`, `internal/requestlog`, `internal/remotelog` and
   `internal/metrics`: the state files, the log lines, the syslog sender and the
   metrics.

SPEC.md

@@ -81,12 +81,14 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/waf`: the Core Rule Set, with the eight changes listed under
-      "Attack detection", as Coraza directives.
+    - `internal/waf`: the Core Rule Set, with the six changes and the apps'
+      fixes listed under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
       AbuseIPDB in the background, and keeps their answers.
+    - `internal/routewatch`: asks a routewatch instance about clients in the
+      background, and keeps its answers.
     - `internal/anomaly`: the anomaly counters and their alerts.
     - `internal/alerts`: holds back repeats and alerts past the hourly limit,
       and sends the rest to the webhook, Slack and ntfy, each from a queue of
@@ -144,7 +146,9 @@ request log's `heuristic` field gives that name. `refusal_limit` and
       around its address, a /64 by default, since one abuser usually controls a
       whole /64. A client is therefore one IPv4 address or one IPv6 group.
 3. The tag lists (`tag_lists`; see "Request tags"). Each list that holds the
-   client adds its tag. A client in `SWW_ALLOW_NETS` gets no tag.
+   client adds its tag. Next, `routewatch_tags` adds the client's `asn=` and
+   `prefix=` tags while `SWW_ROUTEWATCH_URL` is set. A client in
+   `SWW_ALLOW_NETS` gets no tag.
 4. The static lists. A client in `SWW_ALLOW_NETS` skips steps 5 to 15, the byte
    limits and the error burst. A client in `SWW_DENY_NETS` is refused
    (`deny_nets`); a client in both lists is let through.
@@ -317,13 +321,6 @@ ban is dropped alike. A scanner whose ban was dropped that way is refused and
 banned again by its next probe. A ban whose cause is `admin` is never dropped
 and does not count toward `SWW_MAX_BANS`, so such bans can never fill the table.
 
-A request refused under a ban that runs out is logged with the action
-`temporarily_banned`. Under a permanent ban the action is `permanently_banned`.
-A request refused for a clear sign of attack or a CrowdSec decision takes the
-action for the ban it made. A request that makes a ban permanent is logged as
-`permanently_banned`. A request over a rate limit is logged as
-`client_is_rate_limited`, whichever ban it makes.
-
 ## Settings
 
 `docs/settings.md` lists every setting with its default and the values it takes,
@@ -561,6 +558,21 @@ Each tag and where it comes from:
 - `exploitsignature`, when a rule file or the Core Rule Set matched the request.
   For the Core Rule Set a match is a score at or over
   `SWW_WAF_ANOMALY_THRESHOLD`.
+- `asn=<number>` and `prefix=<netblock>` from a routewatch instance
+  (`routewatch_tags`), while `SWW_ROUTEWATCH_URL` is set:
+    - The tag `prefix=` holds the netblock the client's address is announced in,
+      such as `prefix=192.0.2.0/24`.
+    - An `asn=` tag has the same spelling as the lookup's. When routewatch and
+      the lookup give the same AS number, a request has one `asn=` tag. When
+      they differ, it has both.
+    - They are added before `deny_nets`, so the log line of a request it refused
+      has them.
+    - `discriminator` asks routewatch in the background and never waits for it.
+      An answer is kept for 1 hour, in memory only.
+    - After a query fails, routewatch is not asked for 1 minute.
+    - A request without these tags gives the reason in the log field
+      `routewatch_tags_missing` (see
+      [`docs/request-log.md`](docs/request-log.md)).
 
 A client in `SWW_ALLOW_NETS` skips the checks and gets no tag. Every tag is in
 lower case, except a country code, which is in capitals. `SWW_TAG_DENY` and
@@ -568,10 +580,9 @@ lower case, except a country code, which is in capitals. `SWW_TAG_DENY` and
 
 Two settings act on tags:
 
-- `SWW_TAG_DENY` lists tags whose requests are refused with the action
-  `client_denied` (`tag_deny`). The check runs twice: just before the rate
-  limits, and again after the Core Rule Set, so that `exploitsignature` can
-  refuse too.
+- `SWW_TAG_DENY` lists tags whose requests are refused with the action `denied`
+  (`tag_deny`). The check runs twice: just before the rate limits, and again
+  after the Core Rule Set, so that `exploitsignature` can refuse too.
 - `SWW_TAG_LIMIT_PERCENT` lists tags with a percentage from 1 to 99. Their
   clients get that percentage of every request and byte limit. The lowest
   percentage among a client's tags applies. `exploitsignature` cannot be listed,
@@ -579,7 +590,9 @@ Two settings act on tags:
 
 The tag settings are empty by default, for the same reason as the country list.
 The lookup waits for GeoJS when either names an `asn=` or `country=` tag. A
-setting that names one stops the start while `SWW_LOOKUP_SOURCE` is `off`.
+setting that names one stops the start while `SWW_LOOKUP_SOURCE` is `off`. The
+exception is an `asn=` tag while `SWW_ROUTEWATCH_URL` is set, since routewatch
+gives that tag.
 
 ### Biased thresholds
 
@@ -653,7 +666,7 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth change below holds gitea's.
+  holds an app's own exclusions; gitea's fixes below hold gitea's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -699,7 +712,7 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eight ways, since in front of
+`smallwebwaf` changes the Core Rule Set 4.25.0 in six ways, since in front of
 gitea it would otherwise refuse ordinary requests. The changes hold in front of
 every app, and no setting undoes them:
 
@@ -718,8 +731,52 @@ every app, and no setting undoes them:
    and tea, which gitea registers for OAuth sign-in, ask to be sent back to
    `http://127.0.0.1` on the user's own machine. The server never fetches that
    address.
-4. Ten query parameters are not checked against the Core Rule Set's lists of
-   system files (930120), shell paths (932160) and command names (932260):
+4. `Referer` is not checked for a Unix command given without arguments (932340),
+   for Java starting a process (944110) or for a Java class name (944130).
+   `Referer` names the page a request comes from, on everything that page loads
+   and on every link followed from it. The Core Rule Set takes some page
+   addresses for attacks:
+    - a search for `env`;
+    - OpenJDK's `Runtime.java`, whose path holds both `runtime` and `java.`;
+    - a file named `java.lang.String.md`.
+
+    Every request from such a page would be refused. `Referer` keeps the other
+    rules, except after some gitea searches (gitea's fixes). An app that passes
+    `Referer` to a shell must check it itself.
+
+5. Responses are not inspected. A raw file from a repository, such as a shell
+   script, looks to the response rules like source code leaking from the server.
+6. The `from` parameter of a container registry's upload path,
+   `/v2/<image>/blobs/uploads/`, is not checked for command names (932260). When
+   a push reuses a layer, `from` names the image the layer comes from. An image
+   such as `owner/python3-app` would have that push refused.
+
+Each supported app also has its own fixes, which let its ordinary requests
+through. An app's fixes hold for the hostnames `SWW_APPS` lists the app for:
+
+- `SWW_APPS` holds entries separated by semicolons. Each is a hostname, a colon,
+  then one or more apps separated by commas, for example
+  `git.example.com:gitea;code.example.com:gitea`.
+- The request's `Host` is matched by exact name, without its port and without
+  regard to case. There are no wildcards.
+- A hostname not listed gets no app's fixes, so every rule checks it in full.
+  Set empty, `SWW_APPS` lists no hostname.
+- Unset, every app's fixes hold for every hostname. An app's fixes then weaken
+  the check of any other app that serves the same paths or fields.
+- Any of these mistakes stops the start:
+    - an unknown app;
+    - a hostname that is not a DNS name, such as `*.example.com`;
+    - a hostname listed twice;
+    - an app listed twice for one hostname;
+    - an entry without a colon.
+
+`gitea` is the only app supported. Each app's fixes are in one file, such as
+`internal/waf/gitea.conf`, and one entry of `apps` in `internal/waf/waf.go`.
+gitea's fixes are:
+
+1. Ten query parameters are not checked against the Core Rule Set's lists of
+   system files (930120), shell paths (932160) and command names (932260), on
+   any path:
     - `path`, `files`, `skip-to` and `sub_path`;
     - `ref`, `sha`, `branch` and `workflow`;
     - `artifactName` and `redirect_to`.
@@ -732,41 +789,18 @@ every app, and no setting undoes them:
     catch reaches the app, such as the command `|cat /etc/passwd`. Path
     traversal, SQL and script injection, and PHP, Java and Node.js code are
     still refused there. Other parameters keep all three rules, except on the
-    gitea paths the eighth change names. An app that uses one of these
-    parameters as a file on the server, or passes it to a shell, must check the
-    value itself. A rule file can refuse it instead.
+    gitea paths the third fix names.
 
-5. Two cookies are left out, and `Referer` keeps fewer rules:
-    - The Core Rule Set reads the request without the `gitea_flash` and
+2. The Core Rule Set reads the request without the `gitea_flash` and
    `redirect_to` cookies. gitea puts a message naming what was just done into
-      `gitea_flash`. It puts into `redirect_to` the page to return to after
-      signing in. The Core Rule Set takes file names in them, such as
-      `package.json`, for attacks. A browser sends such a cookie with every
-      request until gitea replaces it. gitea cannot replace it while those
-      requests are refused, so one refusal would keep the browser out of the
-      whole site. gitea shows the message with any script removed and returns
-      only to its own pages. Every other cookie is read in full. An app that
-      reads a cookie of either name must check it itself.
-    - `Referer` is not checked for a Unix command given without arguments
-      (932340), for Java starting a process (944110) or for a Java class name
-      (944130). `Referer` names the page a request comes from, on everything
-      that page loads and on every link followed from it. The Core Rule Set
-      takes some page addresses for attacks:
-        - a search for `env`;
-        - OpenJDK's `Runtime.java`, whose path holds both `runtime` and `java.`;
-        - a file named `java.lang.String.md`.
-
-        Every request from such a page would be refused. `Referer` keeps the
-        other rules, except after some gitea searches (the eighth change). An
-        app that passes `Referer` to a shell must check it itself.
-
-6. Responses are not inspected. A raw file from a repository, such as a shell
-   script, looks to the response rules like source code leaking from the server.
-7. The `from` parameter of a container registry's upload path,
-   `/v2/<image>/blobs/uploads/`, is not checked for command names (932260). When
-   a push reuses a layer, `from` names the image the layer comes from. An image
-   such as `owner/python3-app` would have that push refused.
-8. On gitea's paths, some fields skip the rules that refused ordinary gitea
+   `gitea_flash`. It puts into `redirect_to` the page to return to after signing
+   in. The Core Rule Set takes file names in them, such as `package.json`, for
+   attacks. A browser sends such a cookie with every request until gitea
+   replaces it. gitea cannot replace it while those requests are refused, so one
+   refusal would keep the browser out of the whole site. gitea shows the message
+   with any script removed and returns only to its own pages. Every other cookie
+   is read in full.
+3. On gitea's paths, some fields skip the rules that refused ordinary gitea
    requests there. They are the fields where gitea sends a search, a file name
    or a branch name. `internal/waf/gitea.conf` lists each rule and the request
    it refused. The fields are:
@@ -784,8 +818,7 @@ every app, and no setting undoes them:
         - packages.
 
         A user's or an organisation's page is any path of one segment, so on
-        every such path, on any app, `q` skips these three rules, for example on
-        `/search`.
+        every such path `q` skips these three rules, for example on `/search`.
 
         Some of these searches also skip the rule for Java class names (944130),
         which refused `org.apache.commons.logging`.
@@ -823,11 +856,14 @@ every app, and no setting undoes them:
       `actions/upload-artifact@v3` (920450).
 
     Elsewhere these fields keep every rule. The paths are those of gitea at the
-    site root. An app other than gitea that serves one of them must check these
-    fields itself.
+    site root.
 
-The parameter and cookie names in these changes are matched without regard to
-case, as Coraza matches them.
+On a hostname that gets gitea's fixes, an app other than gitea must check these
+fields and cookies itself. Listing each hostname's own apps in `SWW_APPS` keeps
+the full check for the others.
+
+The parameter names in these changes and fixes are matched without regard to
+case, and the cookie names exactly.
 
 ### Ban lengths, response and scope
 
@@ -1325,9 +1361,9 @@ over either one:
   `Transfer-Encoding` do not count. `X-Request-ID` and `X-Forwarded-Proto` do.
 
 Real clients never reach these limits. The answer is `deny` with `431`, and the
-log line's action is `request_header_too_large`. The refusal makes no ban and is
-no offence. The rate limits count the request as usual, so a client that keeps
-sending such requests breaks a limit.
+log line's action is `too_large`. The refusal makes no ban and is no offence.
+The rate limits count the request as usual, so a client that keeps sending such
+requests breaks a limit.
 
 The limits apply on every path and in every `SWW_WAF_MODE`. A client in
 `SWW_ALLOW_NETS` skips them, as it skips the Core Rule Set. In `observe` mode

docs/request-log.md

@@ -96,15 +96,13 @@ Every one of these lines has:
 
 - `action`: what was done:
     - `forward`: answered `allow`, so that `rproxy` passes it to the app;
-    - `client_denied`: refused for `SWW_DENY_NETS`, for a reputation source with
-      the action `deny`, or for a tag in `SWW_TAG_DENY`;
-    - `temporarily_banned`: refused under a ban that runs out, or for a `ban`
-      rule, a trap path or a CrowdSec decision that made such a ban;
-    - `permanently_banned`: refused under a ban that never runs out, including a
-      ban this request made or made permanent;
-    - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
-      `waf_blocked`: refused by that check;
-    - `request_header_too_large`: over a header limit;
+    - `denied`: refused for `SWW_DENY_NETS`, for a reputation source with the
+      action `deny`, or for a tag in `SWW_TAG_DENY`;
+    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
+      CrowdSec decision, each of which bans the client;
+    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
+      refused by that check;
+    - `too_large`: over a header limit;
     - `admin`: answered at one of `discriminator`'s own endpoints, or `404` for
       a path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
@@ -175,6 +173,12 @@ Every one of these lines has:
     - `abuseipdb`.
 - `tags`: the request's tags, sorted, left out when it has none. Each tag and
   where it comes from is under "Request tags" in [`SPEC.md`](../SPEC.md).
+- `routewatch_tags_missing`: why the request got no tags from routewatch,
+  present only while `SWW_ROUTEWATCH_URL` is set:
+    - `no_answer_yet`: routewatch has not answered about this client yet;
+    - `request_failed`: a query to routewatch failed within the last minute, and
+      the process log says why;
+    - `no_route`: routewatch knows no live route for the address.
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
   refused under one: a time, or `permanent`.

docs/settings.md

@@ -145,8 +145,8 @@ cut off; the client is banned.
   the start while a setting that needs a lookup is set:
     - `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES`;
     - `SWW_ADD_LOOKUP_HEADERS`;
-    - `SWW_TAG_DENY` or `SWW_TAG_LIMIT_PERCENT` naming an `asn=` or `country=`
-      tag;
+    - `SWW_TAG_DENY` or `SWW_TAG_LIMIT_PERCENT` naming a `country=` tag, or an
+      `asn=` tag while `SWW_ROUTEWATCH_URL` is unset;
     - the two byte percentage lists and `SWW_ASN_LIMIT_PERCENT_URL`;
     - `SWW_UNKNOWN_LIMIT_PERCENT` below `100`;
     - an anomaly threshold per AS number.
@@ -186,11 +186,20 @@ Every request gets tags from what `discriminator` knows of its client. See
   `exploitsignature`: a request gets that tag after the rate limits have counted
   it.
 
+- `SWW_ROUTEWATCH_URL` (default unset): the `http` or `https` URL of a
+  routewatch instance. [routewatch](https://git.eeqj.de/sneak/routewatch) is a
+  service that gives an address's announced netblock and origin AS.
+  `discriminator` asks it about each client, in the background, and adds the
+  tags `asn=<number>` and `prefix=<netblock>` from its answer. While it is
+  unset, nothing asks routewatch and no request gets a `prefix=` tag.
+
 `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT` accept tags in either case. A tag
 that no request can get stops the start. A request can get only these:
 
 - a name in `SWW_TAG_LISTS`;
 - an `asn=` or `country=` tag;
+- a `prefix=` tag with a netblock, while `SWW_ROUTEWATCH_URL` is set. It matches
+  only that exact announced netblock, such as `prefix=192.0.2.0/24`;
 - a `dnsbl=` tag of a zone in `SWW_DNSBL_ZONES`, in lower case, with a key
   masked as the `reputation` field shows it;
 - `abuseipdb`, while `SWW_ABUSEIPDB_KEY` is set;
@@ -246,6 +255,24 @@ the request first.
   a range. So does a directive that removes or changes rules as the file loads,
   such as `SecRuleRemoveById`, since none of the Core Rule Set's rules is loaded
   yet. It has no `_FILE` form.
+- `SWW_APPS` (default unset): the apps each hostname serves. A request gets the
+  fixes of its hostname's apps only (see "Attack detection" in
+  [`SPEC.md`](../SPEC.md)).
+    - Entries are separated by semicolons. Each is a hostname, a colon, then one
+      or more apps separated by commas, for example
+      `git.example.com:gitea;code.example.com:gitea`.
+    - `gitea` is the only app supported.
+    - The request's `Host` is matched by exact name, without its port and
+      without regard to case. There are no wildcards.
+    - A hostname not listed gets no app's fixes, so every rule checks it in
+      full. Set empty, it lists no hostname.
+    - Unset, every app's fixes apply to every hostname.
+    - Any of these mistakes stops the start:
+        - an unknown app;
+        - a hostname that is not a DNS name, such as `*.example.com`;
+        - a hostname listed twice;
+        - an app listed twice for one hostname;
+        - an entry without a colon.
 - `SWW_ERROR_BURST_THRESHOLD` (default `30`): the most refusals a client may get
   in a minute from a rule file, a trap path or the Core Rule Set, a count or
   `off`. The next one bans the client (see "Attack detection" in `SPEC.md`).

docs/state-files.md

@@ -63,9 +63,8 @@ since it was first seen:
 - total requests, and how many were forwarded and how many refused;
 - body bytes of its requests, and of the responses it was sent;
 - responses by status class;
-- offences by kind: `limit`, `attack`, `blocked_by_block_rule` and
-  `waf_blocked`. A file may also hold `token_refused`, which is kept, and which
-  nothing adds to.
+- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
+  may also hold `token_refused`, which is kept, and which nothing adds to.
 
 ## `lookups.json`
 

internal/config/config.go

@@ -12,6 +12,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"math"
 	"net"
 	"net/http"
@@ -29,6 +30,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // Config is the settings of `sww discriminator`. A time or size limit of
@@ -106,6 +108,9 @@ type Config struct {
 	TagLists        []TagList
 	TagDeny         []string
 	TagLimitPercent map[string]int64
+	// RouteWatchURL is where the routewatch instance is that adds the asn=
+	// and prefix= tags, "" for none (SWW_ROUTEWATCH_URL).
+	RouteWatchURL string
 	// The biased thresholds. ASNBytesPercent and CountryBytesPercent give
 	// those they list a percentage of the byte limits in place of the one
 	// TagLimitPercent gives their asn= or country= tag
@@ -231,6 +236,11 @@ type Config struct {
 	WAFExemptPaths            []string
 	WAFBodyLimit              int64
 	CoreRuleSetExclusionsFile string
+	// Apps are the names of the apps each hostname serves, by hostname in
+	// lowercase (SWW_APPS): a request gets only its hostname's apps' fixes
+	// to the Core Rule Set. Apps is nil while SWW_APPS is unset, and every
+	// request gets every app's fixes.
+	Apps map[string][]string
 	// TrapPaths are the paths a request for which is a clear sign of
 	// attack (SWW_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
@@ -400,6 +410,11 @@ var (
 	errNotTrapPath = errors.New(
 		"is not a path starting with / and without a ?, such as /wp-login.php",
 	)
+	errNotAppsEntry = errors.New(
+		"is not a hostname, : and a list of apps, such as git.example.com:gitea",
+	)
+	errNotHostname      = errors.New("is not a DNS name such as git.example.com")
+	errNotApp           = errors.New("is not an app sww has fixes for; the apps are")
 	errNotWAFMode       = errors.New("is not off, detect or block")
 	errNotParanoiaLevel = errors.New("is not a paranoia level, from 1 to 4")
 	errNotRuleID        = errors.New(
@@ -462,6 +477,9 @@ var (
 	errNotLAPIURL = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
 			"such as http://172.17.0.1:8080")
+	errNotRouteWatchURL = errors.New(
+		"is not an http or https URL without a user or a fragment, " +
+			"such as https://routewatch.example")
 	errNeedsLAPIKey  = errors.New("the engine answers no request without it")
 	errLAPIKeyUnused = errors.New("it is sent only to the engine at that URL")
 	errAnotherList   = errors.New(
@@ -475,6 +493,8 @@ var (
 		"is not a tag, : and a percentage, such as vpn:50 or asn=14061:25")
 	errNotTagPercent = errors.New("is not a percentage from 1 to 99")
 	errNotASNTag     = errors.New("is not asn= and a number, such as asn=14061")
+	errNotPrefixTag  = errors.New(
+		"is not prefix= and a netblock, such as prefix=192.0.2.0/24")
 	errExploitTag = errors.New(
 		"cannot lower limits: the rate limits count a request before its " +
 			"rules are matched")
@@ -483,8 +503,9 @@ var (
 	errNoRequestGetsTag = errors.New(
 		"is a tag no request can get: it is not a name in SWW_TAG_LISTS, an " +
 			"asn= or country= tag, a dnsbl= tag of a zone in SWW_DNSBL_ZONES, " +
-			"abuseipdb with SWW_ABUSEIPDB_KEY set, or exploitsignature with " +
-			"rule files or the Core Rule Set on")
+			"a prefix= tag with SWW_ROUTEWATCH_URL set, abuseipdb with " +
+			"SWW_ABUSEIPDB_KEY set, or exploitsignature with rule files or the " +
+			"Core Rule Set on")
 )
 
 // FromEnvironment reads the settings with lookupEnv, normally
@@ -524,6 +545,7 @@ func FromEnvironment(
 		TagLists:             env.tagLists("SWW_TAG_LISTS"),
 		TagDeny:              env.tags("SWW_TAG_DENY"),
 		TagLimitPercent:      env.tagPercents("SWW_TAG_LIMIT_PERCENT"),
+		RouteWatchURL:        env.routeWatchURL("SWW_ROUTEWATCH_URL"),
 		ASNBytesPercent:      env.percents("SWW_ASN_BYTES_PERCENT", ParseASN),
 		CountryBytesPercent:  env.percents("SWW_COUNTRY_BYTES_PERCENT", parseCountry),
 		UnknownLimitPercent:  env.percent("SWW_UNKNOWN_LIMIT_PERCENT", "100"),
@@ -566,6 +588,7 @@ func FromEnvironment(
 		WAFBodyLimit:   env.wafBodyLimit("SWW_WAF_BODY_LIMIT", off),
 		CoreRuleSetExclusionsFile: env.filePath(
 			"SWW_CORE_RULE_SET_EXCLUSIONS_FILE"),
+		Apps:                 env.apps("SWW_APPS"),
 		TrapPaths:            env.trapPaths("SWW_TRAP_PATHS"),
 		ErrorBurstThreshold:  env.count("SWW_ERROR_BURST_THRESHOLD", "30"),
 		LogRemoteURL:         env.logRemoteURL("SWW_LOG_REMOTE_URL"),
@@ -821,6 +844,25 @@ func (e *environment) pathPrefixes(name, defaultValue string) []string {
 	return prefixes
 }
 
+// apps reads the setting that is the apps each hostname serves. It is nil
+// while the setting is unset, and logged as null, unlike a setting set
+// empty.
+func (e *environment) apps(name string) map[string][]string {
+	value, set := e.lookup(name)
+	if !set {
+		e.settings = append(e.settings, slog.Any(name, nil))
+
+		return nil
+	}
+
+	e.settings = append(e.settings, slog.String(name, value))
+
+	apps, err := parseApps(value)
+	e.check(name, err)
+
+	return apps
+}
+
 // trapPaths reads the setting that is the list of trap paths. It is empty
 // by default.
 func (e *environment) trapPaths(name string) []string {
@@ -1019,6 +1061,22 @@ func (e *environment) crowdSecDecisionsURL(name string) string {
 	return lapi.JoinPath("v1", "decisions").String()
 }
 
+// routeWatchURL reads the setting that is the URL of a routewatch instance,
+// "" while it is unset or empty.
+func (e *environment) routeWatchURL(name string) string {
+	value := e.value(name, "")
+	if value == "" {
+		return ""
+	}
+
+	instance, err := url.Parse(value)
+	if err != nil || !isHTTPURL(instance) {
+		e.check(name, fmt.Errorf("%q %w", value, errNotRouteWatchURL))
+	}
+
+	return value
+}
+
 // lookupSource reads the setting that is where clients are looked up:
 // geojs, file, or off.
 func (e *environment) lookupSource(name, defaultValue string) string {
@@ -1064,14 +1122,21 @@ func (e *environment) checkCountriesAndLookups(cfg *Config) {
 		return
 	}
 
+	// routewatch gives asn= tags too.
+	onlyLookupGives := func(tag string) bool {
+		return isLookupTag(tag) &&
+			(cfg.RouteWatchURL == "" || !strings.HasPrefix(tag, ASNTagPrefix))
+	}
+
 	for _, setting := range []struct {
 		name string
 		set  bool
 	}{
 		{"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
 		{"SWW_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
-		{"SWW_TAG_DENY", slices.ContainsFunc(cfg.TagDeny, isLookupTag)},
-		{"SWW_TAG_LIMIT_PERCENT", tagLimitNeedsLookups(cfg)},
+		{"SWW_TAG_DENY", slices.ContainsFunc(cfg.TagDeny, onlyLookupGives)},
+		{"SWW_TAG_LIMIT_PERCENT", slices.ContainsFunc(
+			slices.Collect(maps.Keys(cfg.TagLimitPercent)), onlyLookupGives)},
 		{"SWW_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
 		{"SWW_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
 		{"SWW_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
@@ -1171,6 +1236,10 @@ func requestCanGetTag(cfg *Config, tag string) bool {
 		return cfg.AbuseIPDBKey != ""
 	}
 
+	if strings.HasPrefix(tag, PrefixTagPrefix) {
+		return cfg.RouteWatchURL != ""
+	}
+
 	zone, isZoneTag := strings.CutPrefix(tag, DNSBLTagPrefix)
 
 	return isZoneTag && slices.ContainsFunc(cfg.DNSBLZones, func(each string) bool {
@@ -1179,7 +1248,7 @@ func requestCanGetTag(cfg *Config, tag string) bool {
 }
 
 // TagsNeedLookup reports whether SWW_TAG_DENY or SWW_TAG_LIMIT_PERCENT
-// names an asn= or country= tag, which only the lookup can give a request.
+// names an asn= or country= tag.
 func (c *Config) TagsNeedLookup() bool {
 	return slices.ContainsFunc(c.TagDeny, isLookupTag) || tagLimitNeedsLookups(c)
 }
@@ -1811,6 +1880,65 @@ func parseTrapPaths(value string) ([]string, error) {
 	return paths, nil
 }
 
+// parseApps reads the apps each hostname serves: entries separated by
+// semicolons, each a hostname, a colon, and a comma-separated list of the
+// names waf.AppNames returns, such as
+// git.example.com:gitea;cloud.example.com:nextcloud,wordpress. Each
+// hostname is a DNS name, without a wildcard. It returns them by hostname
+// in lowercase, since a hostname is matched without regard to case. An
+// empty value lists no hostname.
+func parseApps(value string) (map[string][]string, error) {
+	apps := map[string][]string{}
+
+	if strings.TrimSpace(value) == "" {
+		return apps, nil
+	}
+
+	for entry := range strings.SplitSeq(value, ";") {
+		hostname, list, found := strings.Cut(entry, ":")
+		if !found {
+			return nil, fmt.Errorf("%q %w", entry, errNotAppsEntry)
+		}
+
+		hostname = strings.ToLower(strings.TrimSpace(hostname))
+		if hostname == "" {
+			return nil, fmt.Errorf("%q %w", entry, errNotAppsEntry)
+		}
+
+		if !isZone(hostname) {
+			return nil, fmt.Errorf("%q %w", hostname, errNotHostname)
+		}
+
+		if _, listed := apps[hostname]; listed {
+			return nil, fmt.Errorf("%q %w", hostname, errListedTwice)
+		}
+
+		names, err := parseList(list)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(names) == 0 {
+			return nil, fmt.Errorf("%q %w", entry, errNotAppsEntry)
+		}
+
+		for i, name := range names {
+			if !slices.Contains(waf.AppNames(), name) {
+				return nil, fmt.Errorf("%q %w %s", name, errNotApp,
+					strings.Join(waf.AppNames(), ", "))
+			}
+
+			if slices.Contains(names[:i], name) {
+				return nil, fmt.Errorf("%q %w", name, errListedTwice)
+			}
+		}
+
+		apps[hostname] = names
+	}
+
+	return apps, nil
+}
+
 // parseRuleIDs reads a comma-separated list of the ids of Core Rule Set
 // rules, each a whole number above zero and outside firstSetupRuleID to
 // lastSetupRuleID.
@@ -1923,6 +2051,7 @@ const (
 	ASNTagPrefix     = "asn="
 	CountryTagPrefix = "country="
 	DNSBLTagPrefix   = "dnsbl="
+	PrefixTagPrefix  = "prefix="
 	AbuseIPDBTag     = "abuseipdb"
 	CrowdSecTag      = "crowdsec"
 	// ExploitSignatureTag is the tag of a request a rule file or the Core
@@ -1999,9 +2128,10 @@ func parseTags(value string) ([]string, error) {
 
 // parseTag reads a tag in either case, with spaces around it, and returns it
 // as a request carries it: in lower case, but for a country code, which is in
-// capitals, and an asn= tag's number without leading zeros. An asn= or
-// country= tag must name a number or a country, so that a mistyped one stops
-// the start instead of never matching.
+// capitals, an asn= tag's number without leading zeros, and a prefix= tag's
+// netblock as routewatch writes it. An asn=, country= or prefix= tag must name
+// a number, a country or a netblock, so that a mistyped one stops the start
+// instead of never matching.
 func parseTag(value string) (string, error) {
 	tag := strings.ToLower(strings.TrimSpace(value))
 
@@ -2023,6 +2153,15 @@ func parseTag(value string) (string, error) {
 		return CountryTagPrefix + country, nil
 	}
 
+	if text, isPrefix := strings.CutPrefix(tag, PrefixTagPrefix); isPrefix {
+		netblock, err := netip.ParsePrefix(text)
+		if err != nil || netblock != netblock.Masked() {
+			return "", fmt.Errorf("%q %w", value, errNotPrefixTag)
+		}
+
+		return PrefixTagPrefix + netblock.String(), nil
+	}
+
 	return tag, nil
 }
 
@@ -2406,7 +2545,8 @@ func MaskZoneKey(zone string) string {
 	return masked + "." + rest
 }
 
-// isZone reports whether each label of zone is as parseZones takes it.
+// isZone reports whether each label of zone is as parseZones takes it. It
+// also checks the hostnames of SWW_APPS, which are DNS names too.
 func isZone(zone string) bool {
 	for label := range strings.SplitSeq(zone, ".") {
 		badChar := strings.ContainsFunc(label, func(char rune) bool {

internal/config/config_test.go

@@ -61,6 +61,7 @@ const (
 	reputationAction     = "SWW_REPUTATION_ACTION"
 	reputationCacheTTL   = "SWW_REPUTATION_CACHE_TTL"
 	reputationTimeout    = "SWW_REPUTATION_TIMEOUT"
+	routeWatchURL        = "SWW_ROUTEWATCH_URL"
 	crowdSecURL          = "SWW_CROWDSEC_LAPI_URL"
 	crowdSecKey          = "SWW_CROWDSEC_LAPI_KEY"
 	banResponse          = "SWW_BAN_RESPONSE"
@@ -88,6 +89,7 @@ const (
 	wafExemptPaths       = "SWW_WAF_EXEMPT_PATHS"
 	wafBodyLimit         = "SWW_WAF_BODY_LIMIT"
 	exclusionsFile       = "SWW_CORE_RULE_SET_EXCLUSIONS_FILE"
+	apps                 = "SWW_APPS"
 	trapPaths            = "SWW_TRAP_PATHS"
 	errorBurstThreshold  = "SWW_ERROR_BURST_THRESHOLD"
 	logRemoteURL         = "SWW_LOG_REMOTE_URL"
@@ -581,6 +583,92 @@ func TestCoreRuleSetSettings(t *testing.T) {
 	}
 }
 
+func TestApps(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		env  environment
+		want map[string][]string
+	}{
+		{environment{}, nil},
+		{environment{apps: ""}, map[string][]string{}},
+		{
+			environment{apps: "Git.Example.com:gitea; cloud.example.com : gitea "},
+			map[string][]string{
+				"git.example.com": {"gitea"}, "cloud.example.com": {"gitea"},
+			},
+		},
+	} {
+		cfg := fromEnvironment(t, tc.env)
+		if !reflect.DeepEqual(cfg.Apps, tc.want) {
+			t.Errorf("%v gave %#v, want %#v", tc.env, cfg.Apps, tc.want)
+		}
+	}
+}
+
+// Unset and set empty, SWW_APPS has opposite effects, so it logs differently.
+func TestUnsetAndEmptyAppsAreLoggedDifferently(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		env  environment
+		want string
+	}{
+		{environment{}, `"` + apps + `":null`},
+		{environment{apps: ""}, `"` + apps + `":""`},
+	} {
+		var out bytes.Buffer
+
+		slog.New(slog.NewJSONHandler(&out, nil)).
+			Info("starting", "settings", fromEnvironment(t, tc.env))
+
+		if !strings.Contains(out.String(), tc.want) {
+			t.Errorf("%v logged %s, want %s in it", tc.env, out.String(), tc.want)
+		}
+	}
+}
+
+func TestInvalidAppsStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	const (
+		notEntry = " is not a hostname, : and a list of apps, " +
+			"such as git.example.com:gitea"
+		notHostname = " is not a DNS name such as git.example.com"
+	)
+
+	for _, tc := range []struct{ value, want string }{
+		{"git.example.com:gitea;blog.example.com", `"blog.example.com"` + notEntry},
+		{"git.example.com:gitea;", `""` + notEntry},
+		{":gitea", `":gitea"` + notEntry},
+		{"git.example.com:", `"git.example.com:"` + notEntry},
+		{"*.example.com:gitea", `"*.example.com"` + notHostname},
+		{"git.example.com/:gitea", `"git.example.com/"` + notHostname},
+		{"git example.com:gitea", `"git example.com"` + notHostname},
+		{
+			"git.example.com:gitea,nextcloud",
+			`"nextcloud" is not an app sww has fixes for; the apps are gitea`,
+		},
+		{
+			"git.example.com:gitea;GIT.example.com:gitea",
+			`"git.example.com" is listed twice`,
+		},
+		{"git.example.com:gitea,gitea", `"gitea" is listed twice`},
+		{"git.example.com:gitea,", `"gitea," has an empty item in its list`},
+	} {
+		t.Run(tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := config.FromEnvironment(environment{apps: tc.value}.lookupEnv)
+
+			want := apps + ": " + tc.want
+			if err == nil || err.Error() != want {
+				t.Errorf("error %v, want %s", err, want)
+			}
+		})
+	}
+}
+
 func TestWAFBodyLimitOf64K(t *testing.T) {
 	t.Parallel()
 
@@ -1403,6 +1491,63 @@ func TestTagSettingsAsSet(t *testing.T) {
 	}
 }
 
+func TestRouteWatchURLAndPrefixTags(t *testing.T) {
+	t.Parallel()
+
+	const rw = "https://routewatch.example"
+
+	if cfg := fromEnvironment(t, environment{}); cfg.RouteWatchURL != "" {
+		t.Errorf("default %s is %q, want unset", routeWatchURL, cfg.RouteWatchURL)
+	}
+
+	cfg := fromEnvironment(t, environment{
+		routeWatchURL: rw, tagDeny: "prefix=2001:DB8::/32",
+		tagLimitPercent: "prefix=192.0.2.0/24:50",
+	})
+	wantDeny := []string{"prefix=2001:db8::/32"}
+
+	if cfg.RouteWatchURL != rw || !slices.Equal(cfg.TagDeny, wantDeny) ||
+		cfg.TagLimitPercent["prefix=192.0.2.0/24"] != 50 {
+		t.Errorf("gave %q, %v, %v", cfg.RouteWatchURL, cfg.TagDeny, cfg.TagLimitPercent)
+	}
+
+	// routewatch gives asn= tags too, so an asn= tag needs no lookups while it is set.
+	fromEnvironment(t, environment{
+		lookupSource: off, routeWatchURL: rw, tagDeny: "asn=64496",
+	})
+
+	for _, stopped := range []struct {
+		env  environment
+		name string
+	}{
+		{environment{routeWatchURL: "ftp://routewatch.example"}, routeWatchURL},
+		{environment{routeWatchURL: "routewatch.example"}, routeWatchURL},
+		{environment{tagDeny: "prefix=192.0.2.0/24"}, tagDeny},
+		{environment{routeWatchURL: rw, tagDeny: "prefix=nowhere"}, tagDeny},
+		{environment{routeWatchURL: rw, tagDeny: "prefix=192.0.2.5/24"}, tagDeny},
+		{
+			environment{routeWatchURL: rw, tagLimitPercent: "prefix=192.0.2.0/33:50"},
+			tagLimitPercent,
+		},
+		{environment{lookupSource: off, routeWatchURL: rw, tagDeny: "country=DE"}, tagDeny},
+		{environment{lookupSource: off, tagDeny: "asn=64496"}, tagDeny},
+	} {
+		_, err := config.FromEnvironment(stopped.env.lookupEnv)
+		if err == nil || !strings.HasPrefix(err.Error(), stopped.name+": ") {
+			t.Errorf("%v gave the error %v, want one naming %s", stopped.env, err, stopped.name)
+		}
+	}
+
+	badURL := environment{routeWatchURL: "ftp://routewatch.example"}
+	_, err := config.FromEnvironment(badURL.lookupEnv)
+
+	want := routeWatchURL + `: "ftp://routewatch.example" is not an http or https URL ` +
+		"without a user or a fragment, such as https://routewatch.example"
+	if err == nil || err.Error() != want {
+		t.Errorf("error %v, want %s", err, want)
+	}
+}
+
 func TestTagThatNoRequestCanGetIsToldApartFromOneItCan(t *testing.T) {
 	t.Parallel()
 
@@ -2503,6 +2648,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		reputationAction:     "limit:25",
 		reputationCacheTTL:   defaultReputationCacheTTL,
 		reputationTimeout:    "2s",
+		routeWatchURL:        "",
 		crowdSecURL:          "",
 		crowdSecKey:          "",
 		banResponse:          "403",
@@ -2530,6 +2676,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		wafExemptPaths:       "",
 		wafBodyLimit:         off,
 		exclusionsFile:       "",
+		apps:                 "", // logged as null, which decodes as ""
 		trapPaths:            "",
 		errorBurstThreshold:  "30",
 		logRemoteURL:         "",

internal/discriminator/abuseipdb.go

@@ -50,7 +50,7 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	return &verdict{
-		action: requestlog.ActionClientDenied,
+		action: requestlog.ActionDenied,
 		figures: map[string]any{
 			figureScore: score, "min_score": rq.h.config.AbuseIPDBMinScore,
 		},

internal/discriminator/admin_test.go

@@ -121,7 +121,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, banOtherClient,
 		http.StatusOK), want)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	if line.BanExpires != requestlog.FormatTime(expires) {
 		t.Errorf("the ban ends at %s, want %s", line.BanExpires, expires)
 	}
@@ -276,7 +276,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	// limit of two a minute, and bans it.
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionRateLimited)
 
 	// Asked about by its address in IPv6 form too.
 	for _, addr := range []string{otherClient, "::ffff:" + otherClient} {

internal/discriminator/alerts_test.go

@@ -31,14 +31,14 @@ func TestBanForABrokenLimitRaisesABanAlertWithItsNotes(t *testing.T) {
 	start := clk.Now()
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
 	ban := server.Ledger.Bans(netblock)[0]
 
 	// A request refused under the ban raises no other alert.
 	clk.advance(time.Minute)
-	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
 	wantAlerts(t, queue, banAlert(alerts.EventBan, start, client, bans.Ban{
 		Netblock: netblock, Cause: bans.CauseLimit,
@@ -62,24 +62,22 @@ func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
 
 	// The probe bans the client for seven days, and its next request makes
 	// the ban permanent. The request after that changes nothing.
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 
 	attackBan := server.Ledger.Bans(netblock)[0]
 
 	clk.advance(time.Minute)
-	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
 	permanentBan := server.Ledger.Bans(netblock)[0]
 
-	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
 	// Another client's probe after its first ban has run out without a
 	// request makes a permanent ban at once.
-	s.request(otherClient, "/.env", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
+	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 	clk.advance(7 * 24 * time.Hour)
-	s.request(otherClient, "/.env", http.StatusForbidden,
-		requestlog.ActionPermanentlyBanned)
+	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 
 	otherBans := server.Ledger.Bans(other)
 

internal/discriminator/anomaly_test.go

@@ -187,7 +187,7 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 		{allowed, "/", http.StatusOK, requestlog.ActionForward},
 		{exempt, "/", http.StatusOK, requestlog.ActionForward},
 		{client, "/static/app.js", http.StatusOK, requestlog.ActionForward},
-		{denied, "/", http.StatusForbidden, requestlog.ActionClientDenied},
+		{denied, "/", http.StatusForbidden, requestlog.ActionDenied},
 	} {
 		for range 3 {
 			s.request(sent.from, sent.path, sent.status, sent.action)

internal/discriminator/answertime_test.go

@@ -84,7 +84,7 @@ func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 	wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 
 	if line.DurationWAF != nil {
 		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
@@ -157,7 +157,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 
 			if tc.refused {
 				wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
-				wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
+				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 
 				return
 			}
@@ -219,10 +219,9 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 
 	line := s.out.requestLine(t)
-	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
-		line.DurationWAF != nil {
+	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
 		t.Errorf("would_action %q and duration_waf %v, want %q and none",
-			line.WouldAction, line.DurationWAF, requestlog.ActionRequestHeaderTooLarge)
+			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
 	}
 }
 
@@ -241,7 +240,7 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 	wantDisposition(t, ask(), http.StatusForbidden, discriminator.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
-	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
 }
 
 func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
@@ -250,8 +249,8 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 	for _, tc := range []struct {
 		name, path, action string
 	}{
-		{"a trap path", "/wp-login.php", requestlog.ActionTemporarilyBanned},
-		{"a block rule", "/blocked", requestlog.ActionBlockedByBlockRule},
+		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
+		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -281,7 +280,7 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
 
 	if line.LimitPercent != nil {
 		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
@@ -305,8 +304,7 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
 	wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
-	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
-		requestlog.ActionClientIsRateLimited)
+	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
 }
 
 func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
@@ -414,37 +412,33 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	}{
 		{
 			name: "SWW_DENY_NETS", env: map[string]string{denyNets: client},
-			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionClientDenied,
+			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
 		},
 		{
 			name:    "a ban",
-			prepare: banClient, status: forbidden, action: requestlog.ActionTemporarilyBanned,
+			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
 		},
 		{
 			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
-			prepare: countClient, status: forbidden,
-			action: requestlog.ActionClientIsRateLimited,
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
 		},
 		{
 			name:    "the rate limits, with a biased threshold",
 			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
-			prepare: countClient, status: forbidden,
-			action: requestlog.ActionClientIsRateLimited,
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
 		},
 		{
 			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
-			prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
+			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
 		},
 		{
 			name:    "the CrowdSec decision list",
 			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
-			prepare: decideOnClient, status: forbidden,
-			action: requestlog.ActionTemporarilyBanned,
+			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
 		},
 		{
 			name: "the header limits", cookie: cookies(cookieLimit + 1),
-			prepare: leaveAsItIs, status: tooLarge,
-			action: requestlog.ActionRequestHeaderTooLarge,
+			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {

internal/discriminator/bans.go

@@ -50,23 +50,13 @@ func (activeBan) check(_ context.Context, rq *request, now time.Time) *verdict {
 	}
 
 	return &verdict{
-		action: banAction(ban.Permanent()),
+		action: requestlog.ActionBanned,
 		figures: map[string]any{
 			figureNetblock: ban.Netblock.String(), "ban_expires": rq.line.BanExpires,
 		},
 	}
 }
 
-// banAction is the action of a request refused under a ban or for making one:
-// permanent says the ban never runs out.
-func banAction(permanent bool) string {
-	if permanent {
-		return requestlog.ActionPermanentlyBanned
-	}
-
-	return requestlog.ActionTemporarilyBanned
-}
-
 // limitFigures are the figures of a heuristic that broke hit, a limit: its
 // window, the count and the limit.
 func limitFigures(hit ratelimit.Hit) map[string]any {
@@ -161,11 +151,11 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 // attack, which notes name: the ban rule that matched, or the trap path
 // asked for. It fills in the rest of the notes. In observe mode it makes
 // no ban, and raises the alert for the ban it would have made, if that
-// alert would be sent. It returns the action for that ban.
-func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
+// alert would be sent.
+func (rq *request) banForAttack(now time.Time, notes bans.Notes) {
 	netblock := rq.h.netblock(rq.client)
 	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack))
+		return
 	}
 
 	notes.ASN = rq.line.ASN
@@ -181,7 +171,7 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 			rq.alertBan(ban)
 		}
 
-		return banAction(ban.Permanent())
+		return
 	}
 
 	ban, made := rq.h.ledger.BanForAttack(netblock, now, notes)
@@ -190,18 +180,16 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 	if made {
 		rq.alertBan(ban)
 	}
-
-	return banAction(ban.Permanent())
 }
 
 // banForCrowdSec bans the client's netblock at now until decision,
 // CrowdSec's decision on the client, ends. In observe mode it makes no
 // ban, and raises the alert for the ban it would have made, if that alert
-// would be sent. It returns the action for that ban.
-func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) string {
+// would be sent.
+func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) {
 	netblock := rq.h.netblock(rq.client)
 	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
-		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec))
+		return
 	}
 
 	notes := bans.Notes{
@@ -220,7 +208,7 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) s
 			rq.alertBan(ban)
 		}
 
-		return banAction(ban.Permanent())
+		return
 	}
 
 	ban, made := rq.h.ledger.BanForCrowdSec(netblock, now, decision.Expires,
@@ -230,8 +218,6 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) s
 	if made {
 		rq.alertBan(ban)
 	}
-
-	return banAction(ban.Permanent())
 }
 
 // wouldAlertBan reports whether the alert for a ban on netblock for cause

internal/discriminator/bans_test.go

@@ -40,7 +40,7 @@ func TestBrokenLimitBansTheClient(t *testing.T) {
 	// client for an hour, the default.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 	if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
 		line.BanExpires != expires {
 		t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
@@ -51,7 +51,7 @@ func TestBrokenLimitBansTheClient(t *testing.T) {
 	// Every request while the ban lasts is refused.
 	clk.advance(time.Hour - time.Second)
 
-	line = s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	if line.BanExpires != expires || line.Offence != "" || line.LimitHit != "" {
 		t.Errorf("log line has ban_expires %q, offence %q and limit_hit %q, "+
 			"want %s and neither of the others", line.BanExpires, line.Offence,
@@ -78,9 +78,7 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 	breakLimit := func() string {
 		s.get(client, http.StatusOK, requestlog.ActionForward)
 
-		line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-
-		return line.BanExpires
+		return s.get(client, http.StatusForbidden, requestlog.ActionRateLimited).BanExpires
 	}
 	wantExpires := func(got string, length time.Duration) {
 		t.Helper()
@@ -113,7 +111,7 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 	}
 
 	clk.advance(365 * 24 * time.Hour)
-	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
@@ -125,10 +123,10 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	// client for an hour.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 
 	for range 3 {
-		s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+		s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	}
 
 	// Later the same day the client has its whole allowance again: the
@@ -137,7 +135,7 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	clk.advance(time.Hour)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 
 	banned := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
 	if len(banned) != 2 || banned[0].Notes.Refused != 3 {
@@ -192,10 +190,10 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			s, _, _ := startWithClock(t, "", env)
 
 			s.get(tc.breaker, http.StatusOK, requestlog.ActionForward)
-			s.get(tc.breaker, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			s.get(tc.breaker, http.StatusForbidden, requestlog.ActionRateLimited)
 
 			for _, sent := range tc.refused {
-				s.get(sent, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+				s.get(sent, http.StatusForbidden, requestlog.ActionBanned)
 			}
 
 			for _, sent := range tc.let {
@@ -218,9 +216,9 @@ func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
 
 	// fromDE's ban covers otherClient, which is refused unasked about.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
 	if line.Country != "" {
 		t.Errorf("log line has country %q, want none", line.Country)
 	}
@@ -239,9 +237,9 @@ func TestRefusalUnderABanNamesItsHeuristicNetblockAndEnd(t *testing.T) {
 	expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
 	wantHeuristic(t, line, "active_ban",
 		`{"netblock": "`+clientsNet+`", "ban_expires": "`+expires+`"}`)
 }
@@ -277,11 +275,11 @@ func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 
 			s, _, _ := startWithClock(t, geojsURL, env)
 
-			s.get(denied, tc.status, requestlog.ActionClientDenied)
-			s.get(fromKP, tc.status, requestlog.ActionClientDenied)
+			s.get(denied, tc.status, requestlog.ActionDenied)
+			s.get(fromKP, tc.status, requestlog.ActionDenied)
 			s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-			s.get(fromDE, tc.status, requestlog.ActionClientIsRateLimited)
-			s.get(fromDE, tc.status, requestlog.ActionTemporarilyBanned)
+			s.get(fromDE, tc.status, requestlog.ActionRateLimited)
+			s.get(fromDE, tc.status, requestlog.ActionBanned)
 		})
 	}
 }
@@ -299,9 +297,9 @@ func TestBanNotes(t *testing.T) {
 
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.request(fromDE, "/repo/commits?page=2",
-		http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+		http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
 
 	netblock := netip.MustParsePrefix(fromDE + "/32")
 	want := bans.Ban{
@@ -344,7 +342,7 @@ func TestBanNotes(t *testing.T) {
 	// The next ban counts this one among the earlier.
 	clk.advance(time.Hour)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
 
 	got = ledger.Bans(netblock)
 	if len(got) != 2 || got[1].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
@@ -362,12 +360,12 @@ func TestMaxBansDropsTheBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 
 	// One ban is held, so otherClient's ban drops client's.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionRateLimited)
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
 }
 
 // clock is the time a test sets, by which sww counts requests and

internal/discriminator/biased_test.go

@@ -76,7 +76,7 @@ func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
 			}{
 				{http.StatusOK, requestlog.ActionForward},
 				{http.StatusOK, requestlog.ActionForward},
-				{http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+				{http.StatusForbidden, requestlog.ActionRateLimited},
 			} {
 				line := s.get(tc.from, sent.status, sent.action)
 				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
@@ -192,7 +192,7 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 
 	// The first request breaks the limit, and bans the client; the log line
 	// gives the 0.
-	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionRateLimited)
 	if line.fields["limit_percent"] != float64(0) ||
 		line.fields["limit_percent_setting"] != unknownLimitPercent {
 		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
@@ -200,7 +200,7 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 			unknownLimitPercent)
 	}
 
-	s.get(unplaced, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(unplaced, http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestLowestPercentageApplies(t *testing.T) {
@@ -250,7 +250,7 @@ func TestLowestPercentageApplies(t *testing.T) {
 			// A quarter of 4 requests a minute: the second breaks the limit.
 			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
 
-			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionRateLimited)
 			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
 				tc.want)
 		})
@@ -269,7 +269,7 @@ func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *test
 	for _, from := range []string{unplaced, "10.0.0.8"} {
 		s.get(from, http.StatusOK, requestlog.ActionForward)
 		s.get(from, http.StatusOK, requestlog.ActionForward)
-		s.get(from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+		s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
 	}
 
 	// One in a country has the whole limit.
@@ -293,7 +293,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 		serveFromDE(t, server, http.MethodGet, http.NoBody)
 
 		line := out.requestLine(t)
-		wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+		wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
 		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
 			"0 from "+unknownLimitPercent)
 	})
@@ -374,7 +374,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 			// A quarter of 12 requests a minute is 3: the fourth breaks it.
 			"a rate limit",
 			map[string]string{rateLimitPerMinute: "12", tagLimitPercent: asnTagDEQuarter},
-			3, http.StatusForbidden, requestlog.ActionClientIsRateLimited,
+			3, http.StatusForbidden, requestlog.ActionRateLimited,
 			"requests per minute over the limit of 3", "25 from " + tagLimitPercent,
 		},
 		{

internal/discriminator/blocklists.go

@@ -28,7 +28,7 @@ func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	return &verdict{
-		action:  requestlog.ActionClientDenied,
+		action:  requestlog.ActionDenied,
 		figures: map[string]any{"lists": listedBy},
 	}
 }

internal/discriminator/bytelimits.go

@@ -6,6 +6,8 @@ package discriminator
 import (
 	"context"
 	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
 // byteLimits counts the request's bytes, as countedBytes gives them, for the
@@ -37,5 +39,5 @@ func (byteLimits) check(_ context.Context, rq *request, now time.Time) *verdict
 
 	rq.banForLimit(now, hit, rq.out.status)
 
-	return &verdict{figures: limitFigures(hit)}
+	return &verdict{action: requestlog.ActionBanned, figures: limitFigures(hit)}
 }

internal/discriminator/bytelimits_test.go

@@ -90,7 +90,7 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 					line.BanExpires, tc.window, expires)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
 			wantMetric(t, s.scrape(), `sww_rate_limit_hits_total{`+
 				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
@@ -125,7 +125,7 @@ func TestResponseOverAByteLimitByItselfIsPassedOnWhole(t *testing.T) {
 			len(got.body), got.err, line.LimitHit, answerBytes, minuteBytes)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
@@ -147,7 +147,7 @@ func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
 			answerBytes, minuteBytes, expires)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
@@ -176,7 +176,7 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 					line.LimitHit, line.Counts.MinuteBytes, minuteBytes, tc.counted)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 		})
 	}
 }
@@ -218,7 +218,7 @@ func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 				}
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 		})
 	}
 }
@@ -386,7 +386,7 @@ func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(t *testing.T)
 	// counted, and the byte limit is not broken. Its line gives the bytes
 	// counted before it.
 	line := s.upload()
-	wantWouldAction(t, line, requestlog.ActionClientIsRateLimited)
+	wantWouldAction(t, line, requestlog.ActionRateLimited)
 
 	if line.LimitHit != minute || line.Counts.MinuteBytes != bodyBytes+answerBytes {
 		t.Errorf("log line has limit_hit %q and minute_bytes %v, want minute and %d",

internal/discriminator/coreruleset_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
@@ -21,6 +22,7 @@ const (
 	wafDisabledRules    = "SWW_WAF_DISABLED_RULES"
 	wafExemptPaths      = "SWW_WAF_EXEMPT_PATHS"
 	wafBodyLimit        = "SWW_WAF_BODY_LIMIT"
+	apps                = "SWW_APPS"
 	block               = "block"
 	detect              = "detect"
 )
@@ -92,8 +94,7 @@ func TestDetectedAttackIsRefusedByTagDenyLast(t *testing.T) {
 		wafMode: detect, tagDeny: "exploitsignature",
 	})
 
-	line := s.request(client, sqlInjection, http.StatusForbidden,
-		requestlog.ActionClientDenied)
+	line := s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "exploitsignature"}`)
 }
 
@@ -196,7 +197,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 
 	// A request a rule file refuses is not inspected.
 	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
-		requestlog.ActionBlockedByBlockRule)
+		requestlog.ActionRuleBlocked)
 	wantWAF(t, line, nil)
 
 	// With SWW_WAF_MODE off, no request is.
@@ -283,6 +284,27 @@ func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
 	}
 }
 
+func TestGiteasFixesApplyOnlyToAHostnameThatServesGitea(t *testing.T) {
+	t.Parallel()
+
+	// Only gitea's fixes let a file name through in path, a parameter
+	// gitea sends file names in.
+	const fileName = "/?path=.gitignore"
+
+	s := startDiscriminator(t, "", map[string]string{
+		wafMode: block, apps: siteA + ":gitea",
+	})
+
+	wantDisposition(t, do(t, s.question(siteA, client, fileName)),
+		http.StatusOK, discriminator.DispositionAllow)
+	wantDisposition(t, do(t, s.question(siteB, client, fileName)),
+		http.StatusForbidden, discriminator.DispositionDeny)
+
+	lines := s.out.requestLines(t, 2)
+	wantLine(t, lines[0], http.StatusOK, requestlog.ActionForward)
+	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionWAFBlocked)
+}
+
 func TestAttackInAFormBodyIsRefusedOnlyWhileBodiesAreRead(t *testing.T) {
 	t.Parallel()
 
@@ -404,7 +426,7 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 			line.LimitHit, line.Offence)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
 	want := ratelimit.Offences{Limit: 1, WAFBlocked: 3}
 	if offences := historyOf(t, server, client).Offences; offences != want {

internal/discriminator/crowdsec.go

@@ -30,9 +30,10 @@ func (crowdSec) check(_ context.Context, rq *request, now time.Time) *verdict {
 	rq.addTag(config.CrowdSecTag)
 	rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
 		"listed by the CrowdSec decision list")
+	rq.banForCrowdSec(now, decision)
 
 	return &verdict{
-		action: rq.banForCrowdSec(now, decision),
+		action: requestlog.ActionBanned,
 		figures: map[string]any{
 			"scenario": decision.Scenario,
 			"expires":  requestlog.FormatTime(decision.Expires),

internal/discriminator/crowdsec_test.go

@@ -39,7 +39,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	expires := requestlog.FormatTime(fetched.Add(4 * time.Hour))
 
 	// Its first request is refused, and bans it until the decision ends.
-	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	wantReputation(t, line, decisionsURL)
 
 	if line.BanExpires != expires {
@@ -72,7 +72,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	// ban, and once it has ended the client is let through.
 	clk.advance(4*time.Hour - time.Second)
 
-	line = s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	wantReputation(t, line)
 
 	if line.BanExpires != expires {
@@ -105,7 +105,7 @@ func TestCrowdSecBanNamesItsHeuristicScenarioAndEnd(t *testing.T) {
 		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
 		`"value": "`+client+`"}]`)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 	wantHeuristic(t, line, "crowdsec", `{"scenario": "crowdsecurity/ssh-bf", `+
 		`"expires": "`+requestlog.FormatTime(clk.Now().Add(4*time.Hour))+`"}`)
 	wantTags(t, line, "crowdsec")
@@ -129,9 +129,9 @@ func TestEndedCrowdSecDecisionNoLongerBansThoughTheCopyStillHoldsIt(t *testing.T
 	// Just before its end, the decision bans a client in the netblock, and
 	// one on an IPv6 address bans the address's group, the /64.
 	clk.advance(time.Minute - time.Nanosecond)
-	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionBanned)
 
 	// Once it has ended, it bans no other client, and the bans it made end
 	// with it.
@@ -164,7 +164,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 		`"value": "`+client+`"}]`)
 
 	line := s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
+	wantWouldAction(t, line, requestlog.ActionBanned)
 	wantReputation(t, line, decisionsURL)
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {

internal/discriminator/denynets.go

@@ -19,7 +19,7 @@ func (denyNets) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	for _, netblock := range rq.h.config.DenyNets {
 		if netblock.Contains(rq.client) {
 			return &verdict{
-				action:  requestlog.ActionClientDenied,
+				action:  requestlog.ActionDenied,
 				figures: map[string]any{figureNetblock: netblock.String()},
 			}
 		}

internal/discriminator/discriminator.go

@@ -123,6 +123,7 @@ func New(params Params) *Server {
 		Lists:      h.lists,
 		DNSBL:      h.dnsbl,
 		AbuseIPDB:  h.abuseIPDB,
+		RouteWatch: h.routeWatch,
 		Metrics:    h.metrics,
 	}
 }

internal/discriminator/discriminator_test.go

@@ -639,7 +639,7 @@ func TestQuestionDeniedGetsTheBanResponse(t *testing.T) {
 			got := s.ask(client, "/")
 			wantDisposition(t, got, status, discriminator.DispositionDeny)
 			wantBody(t, got, http.StatusText(status)+"\n")
-			wantLine(t, s.out.requestLine(t), status, requestlog.ActionClientDenied)
+			wantLine(t, s.out.requestLine(t), status, requestlog.ActionDenied)
 		})
 	}
 }
@@ -655,8 +655,8 @@ func TestBanResponseCloseIsAnAnswerOfItsOwn(t *testing.T) {
 	wantDisposition(t, got, http.StatusOK, discriminator.DispositionClose)
 	wantBody(t, got, "")
 	// The visitor is sent nothing.
-	wantLine(t, s.out.requestLine(t), 0, requestlog.ActionClientDenied)
-	wantMetric(t, s.metrics(), `sww_requests_total{action="client_denied",instance="`+
+	wantLine(t, s.out.requestLine(t), 0, requestlog.ActionDenied)
+	wantMetric(t, s.metrics(), `sww_requests_total{action="denied",instance="`+
 		alertInstance+`",status_class="none"}`, 1)
 }
 
@@ -671,12 +671,12 @@ func TestBlockRuleIsDeniedWith403AndABanRuleWithTheBanResponse(t *testing.T) {
 	got := s.ask(client, "/blocked")
 	wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
-		requestlog.ActionBlockedByBlockRule)
+		requestlog.ActionRuleBlocked)
 
 	got = s.ask(client, "/.env")
 	wantDisposition(t, got, http.StatusTooManyRequests, discriminator.DispositionDeny)
 	wantLine(t, s.out.requestLines(t, 2)[1], http.StatusTooManyRequests,
-		requestlog.ActionTemporarilyBanned)
+		requestlog.ActionBanned)
 }
 
 func TestQuestionUnderTheOwnPrefixIsDeniedWith404AfterTheChecks(t *testing.T) {
@@ -709,7 +709,7 @@ func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionClientDenied)
+	wantWouldAction(t, line, requestlog.ActionDenied)
 }
 
 func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) {
@@ -894,7 +894,7 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) {
 		t.Errorf("history is %+v, want the refused request alone", history)
 	}
 
-	const series = `sww_requests_total{action="client_is_rate_limited",instance="` +
+	const series = `sww_requests_total{action="rate_limited",instance="` +
 		alertInstance + `",status_class="4xx"}`
 
 	wantMetric(t, s.metrics(), series, 1)
@@ -1298,11 +1298,11 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 	}{
 		{
 			"deny", map[string]string{denyNets: client}, "/", http.StatusForbidden,
-			requestlog.ActionClientDenied,
+			requestlog.ActionDenied,
 		},
 		{
 			"close", map[string]string{denyNets: client, banResponse: banResponseClose}, "/",
-			0, requestlog.ActionClientDenied,
+			0, requestlog.ActionDenied,
 		},
 		{"own prefix", nil, discriminator.HealthPath, http.StatusNotFound,
 			requestlog.ActionAdmin},

internal/discriminator/dnsbl.go

@@ -37,7 +37,7 @@ func (dnsbl) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	return &verdict{
-		action:  requestlog.ActionClientDenied,
+		action:  requestlog.ActionDenied,
 		figures: map[string]any{"zones": listedBy},
 	}
 }

internal/discriminator/headerlimits.go

@@ -30,7 +30,7 @@ func (headerLimits) check(_ context.Context, rq *request, _ time.Time) *verdict
 	}
 
 	return &verdict{
-		action: requestlog.ActionRequestHeaderTooLarge,
+		action: requestlog.ActionTooLarge,
 		figures: map[string]any{
 			"fields": fields, "fields_limit": maxHeaderFields,
 			"cookies": cookies, "cookies_limit": maxCookies,

internal/discriminator/heuristics.go

@@ -44,6 +44,7 @@ const (
 func beforeLookup() []heuristic {
 	return []heuristic{
 		tagLists{},
+		routeWatchTags{},
 		denyNets{},
 		activeBan{},
 	}

internal/discriminator/history_test.go

@@ -31,9 +31,9 @@ func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	clk.advance(time.Second)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
 	clk.advance(time.Second)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
 
 	want := ratelimit.History{
 		FirstSeen: start,

internal/discriminator/lookup_test.go

@@ -40,7 +40,7 @@ func TestEveryClientIsLookedUpWithoutWaitingWhileNoSettingNeedsIt(t *testing.T)
 	// comes too. None waits for GeoJS.
 	for _, line := range []logLine{
 		s.get(fromDE, http.StatusOK, requestlog.ActionForward),
-		s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited),
+		s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited),
 		s.get(fromKP, http.StatusOK, requestlog.ActionForward),
 	} {
 		got := asnAndCountry{line.ASN, line.ASName, line.Country}
@@ -179,7 +179,7 @@ func TestASNumberAndNameInTheLogLineTheHistoryTheBanNotesAndTheAlert(t *testing.
 
 	for _, line := range []logLine{
 		s.get(fromDE, http.StatusOK, requestlog.ActionForward),
-		s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited),
+		s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited),
 	} {
 		if got := (asnAndCountry{line.ASN, line.ASName, line.Country}); got != want {
 			t.Errorf("log line has %+v, want %+v", got, want)
@@ -264,7 +264,7 @@ func TestClientsAreLookedUpInTheLookupDatabaseAndGeoJSIsNotAsked(t *testing.T) {
 		want asnAndCountry
 	}{
 		{s.get(fromDE, http.StatusOK, requestlog.ActionForward), de},
-		{s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited), de},
+		{s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited), de},
 		{
 			s.get(fromKP, http.StatusForbidden, requestlog.ActionCountryDenied),
 			asnAndCountry{asnKP, asNameKP, "KP"},

internal/discriminator/metrics_test.go

@@ -125,15 +125,15 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	})
 
 	// SWW_BAN_RESPONSE=close sends no status at all.
-	s.get(denied, 0, requestlog.ActionClientDenied)
+	s.get(denied, 0, requestlog.ActionDenied)
 
 	// A first broken limit bans for an hour.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, 0, requestlog.ActionClientIsRateLimited)
+	s.get(client, 0, requestlog.ActionRateLimited)
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`sww_requests_total{action="client_denied",instance="app",status_class="none"}`, 1)
+		`sww_requests_total{action="denied",instance="app",status_class="none"}`, 1)
 	wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+
 		`kind="requests",window="minute"}`, 1)
 	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
@@ -147,7 +147,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	// A limit broken again right after would ban for three hours, longer
 	// than SWW_MAX_BAN_DURATION, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, 0, requestlog.ActionClientIsRateLimited)
+	s.get(client, 0, requestlog.ActionRateLimited)
 
 	metrics = s.scrape()
 	wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+

internal/discriminator/observe_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
@@ -15,93 +14,6 @@ import (
 // observe is the value of SWW_MODE for observe mode.
 const observe = "observe"
 
-func TestBanActionSaysWhetherTheBanRunsOut(t *testing.T) {
-	t.Parallel()
-
-	const trapPath = "/wp-login.php"
-
-	for _, tc := range []struct {
-		name  string
-		cause string
-		// endsIn is how long after the request the ban ends: negative for a
-		// ban that has ended, and zero for a permanent ban.
-		endsIn time.Duration
-		path   string
-		want   string
-	}{
-		{
-			"temporary ban", bans.CauseAdmin, time.Hour, "/",
-			requestlog.ActionTemporarilyBanned,
-		},
-		{"permanent ban", bans.CauseAdmin, 0, "/", requestlog.ActionPermanentlyBanned},
-		{
-			"request that makes a ban permanent", bans.CauseAttack, time.Hour, "/",
-			requestlog.ActionPermanentlyBanned,
-		},
-		{
-			"trap path after an attack ban ended", bans.CauseAttack, -time.Hour,
-			trapPath, requestlog.ActionPermanentlyBanned,
-		},
-		{
-			"first trap path after another ban ended", bans.CauseAdmin, -time.Hour,
-			trapPath, requestlog.ActionTemporarilyBanned,
-		},
-	} {
-		for _, modeValue := range []string{"enforce", observe} {
-			t.Run(tc.name+" in "+modeValue, func(t *testing.T) {
-				t.Parallel()
-
-				s, clk, server := startWithClock(t, "", map[string]string{
-					trapPaths: trapPathList, mode: modeValue,
-				})
-
-				ban := bans.Ban{
-					Netblock: netip.MustParsePrefix(client + "/32"),
-					Start:    clk.Now().Add(-2 * time.Hour),
-					Cause:    tc.cause,
-				}
-				if tc.endsIn != 0 {
-					ban.Expires = clk.Now().Add(tc.endsIn)
-				}
-
-				server.Ledger.Load([]bans.Ban{ban})
-
-				if modeValue == observe {
-					line := s.request(client, tc.path, http.StatusOK, requestlog.ActionForward)
-					wantWouldAction(t, line, tc.want)
-
-					return
-				}
-
-				s.request(client, tc.path, http.StatusForbidden, tc.want)
-			})
-		}
-	}
-}
-
-func TestObserveModeNamesAPermanentBanWhoseAlertWouldBeSent(t *testing.T) {
-	t.Parallel()
-
-	s, clk, server, queue := startWithAlerts(t, map[string]string{
-		trapPaths: trapPathList, mode: observe,
-	})
-
-	server.Ledger.Load([]bans.Ban{{
-		Netblock: netip.MustParsePrefix(client + "/32"),
-		Start:    clk.Now().Add(-2 * time.Hour),
-		Expires:  clk.Now().Add(-time.Hour),
-		Cause:    bans.CauseAttack,
-	}})
-
-	line := s.request(client, "/wp-login.php", http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionPermanentlyBanned)
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Event != alerts.EventPermanentBan {
-		t.Errorf("alerts waiting are %+v, want one %s", waiting, alerts.EventPermanentBan)
-	}
-}
-
 func TestObserveModeNamesTheHeuristicThatWouldHaveRefused(t *testing.T) {
 	t.Parallel()
 
@@ -110,7 +22,7 @@ func TestObserveModeNamesTheHeuristicThatWouldHaveRefused(t *testing.T) {
 	})
 
 	line := s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionClientDenied)
+	wantWouldAction(t, line, requestlog.ActionDenied)
 	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+client+`/32"}`)
 }
 
@@ -157,10 +69,10 @@ func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 			s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 
 			for _, sent := range []struct{ from, refusal string }{
-				{denied, requestlog.ActionClientDenied},
-				{banned, requestlog.ActionTemporarilyBanned},
-				{fromKP, requestlog.ActionClientDenied},
-				{fromDE, requestlog.ActionClientIsRateLimited},
+				{denied, requestlog.ActionDenied},
+				{banned, requestlog.ActionBanned},
+				{fromKP, requestlog.ActionDenied},
+				{fromDE, requestlog.ActionRateLimited},
 			} {
 				if !tc.observe {
 					line := s.get(sent.from, http.StatusForbidden, sent.refusal)
@@ -198,7 +110,7 @@ func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
 
 	for range 2 {
 		line := s.get(client, http.StatusOK, requestlog.ActionForward)
-		wantWouldAction(t, line, requestlog.ActionClientIsRateLimited)
+		wantWouldAction(t, line, requestlog.ActionRateLimited)
 
 		if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
 			line.BanExpires != "" {
@@ -211,7 +123,7 @@ func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
 	// The ban read from bans.json refuses nothing, and so counts no
 	// refusal in its notes, but is kept.
 	line := s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
+	wantWouldAction(t, line, requestlog.ActionBanned)
 
 	if line.BanExpires != requestlog.FormatTime(kept.Expires) {
 		t.Errorf("log line has ban_expires %q, want %s", line.BanExpires,

internal/discriminator/proxy.go

@@ -20,6 +20,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/routewatch"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
@@ -85,7 +86,8 @@ type Params struct {
 // Server is the server discriminator runs, with the parts whose state the state
 // files keep, the lookup database, nil unless SWW_LOOKUP_SOURCE is file, the
 // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
-// AbuseIPDB's scores and checks spent, and the metrics.
+// AbuseIPDB's scores and checks spent, and the metrics. RouteWatch, nil while
+// SWW_ROUTEWATCH_URL is unset, keeps its answers in memory only.
 type Server struct {
 	*http.Server
 
@@ -97,6 +99,7 @@ type Server struct {
 	Lists      *reputation.Lists
 	DNSBL      *reputation.DNSBL
 	AbuseIPDB  *reputation.AbuseIPDB
+	RouteWatch *routewatch.Client
 	Metrics    *metrics.Metrics
 }
 
@@ -152,6 +155,12 @@ func newHandler(params Params) *handler {
 		coreRuleSet: params.CoreRuleSet,
 		alerts:      params.Alerts,
 	}
+	if params.Config.RouteWatchURL != "" {
+		h.routeWatch = routewatch.New(routewatch.Params{
+			URL: params.Config.RouteWatchURL, Now: params.Now, ProcessLog: params.ProcessLog,
+		})
+	}
+
 	h.geojs = lookup.New(lookup.Params{
 		URL:     params.GeoJSURL,
 		Timeout: params.Config.LookupTimeout,
@@ -212,7 +221,8 @@ func newReputation(
 // NewCoreRuleSet returns the Core Rule Set at SWW_WAF_PARANOIA_LEVEL,
 // without the rules SWW_WAF_DISABLED_RULES switches off, reading bodies
 // up to SWW_WAF_BODY_LIMIT, with the exclusions in
-// SWW_CORE_RULE_SET_EXCLUSIONS_FILE, or nil while SWW_WAF_MODE is off. It
+// SWW_CORE_RULE_SET_EXCLUSIONS_FILE and the fixes of the apps in SWW_APPS,
+// or nil while SWW_WAF_MODE is off. It
 // reads at most QuestionBodyMaxBytes less one byte: a question's body of
 // QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
 // JSON or XML body over its limit. An exclusions file that waf.New refuses is
@@ -227,6 +237,7 @@ func NewCoreRuleSet(cfg *config.Config) (*waf.CoreRuleSet, error) {
 		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
 		BodyLimit:      min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
 		ExclusionsFile: cfg.CoreRuleSetExclusionsFile,
+		Apps:           cfg.Apps,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("SWW_CORE_RULE_SET_EXCLUSIONS_FILE: %w", err)
@@ -255,6 +266,7 @@ type handler struct {
 	lists       *reputation.Lists
 	dnsbl       *reputation.DNSBL
 	abuseIPDB   *reputation.AbuseIPDB
+	routeWatch  *routewatch.Client
 	rules       *rules.Files
 	coreRuleSet *waf.CoreRuleSet
 	alerts      *alerts.Queue

internal/discriminator/ratelimits.go

@@ -42,9 +42,7 @@ func (rateLimits) check(_ context.Context, rq *request, now time.Time) *verdict
 
 	rq.banForLimit(now, hit, rq.h.config.BanResponse)
 
-	return &verdict{
-		action: requestlog.ActionClientIsRateLimited, figures: limitFigures(hit),
-	}
+	return &verdict{action: requestlog.ActionRateLimited, figures: limitFigures(hit)}
 }
 
 // overAWholeRateLimit reports whether the heuristic rate_limits will refuse the

internal/discriminator/ratelimits_test.go

@@ -59,7 +59,7 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 		if sent.want == http.StatusOK {
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 		} else {
-			wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
 
 			if line.LimitHit != minute {
 				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
@@ -79,7 +79,7 @@ func TestRateLimitRefusalNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
 	wantHeuristic(t, line, "rate_limits", `{"window": "minute", "count": 2, "limit": 1}`)
 }
 
@@ -102,7 +102,7 @@ func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
 		status int
 		action string
 	}{
-		{rateLimitPerMinute, "1", http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{rateLimitPerMinute, "1", http.StatusForbidden, requestlog.ActionRateLimited},
 		{bytesLimitPerMinute, byteLimit, http.StatusOK, requestlog.ActionForward},
 	} {
 		t.Run(tc.setting, func(t *testing.T) {
@@ -160,17 +160,14 @@ func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 
 	// A path outside every prefix is counted: /assets is not under
 	// /assets/, and breaks the limit.
-	s.request(client, "/assets", http.StatusForbidden,
-		requestlog.ActionClientIsRateLimited)
+	s.request(client, "/assets", http.StatusForbidden, requestlog.ActionRateLimited)
 
 	// A ban, SWW_DENY_NETS and SWW_TAG_DENY still refuse a path under a
 	// prefix.
-	s.request(client, "/assets/app.js", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
-	s.request(denied, "/assets/app.js", http.StatusForbidden,
-		requestlog.ActionClientDenied)
+	s.request(client, "/assets/app.js", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(denied, "/assets/app.js", http.StatusForbidden, requestlog.ActionDenied)
 	s.request(fromKP, "/assets/app.js",
-		http.StatusForbidden, requestlog.ActionClientDenied)
+		http.StatusForbidden, requestlog.ActionDenied)
 }
 
 func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
@@ -214,7 +211,7 @@ func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
 			// Counted, the second request breaks the limit of one request
 			// a minute.
 			s.request(client, sent, http.StatusOK, requestlog.ActionForward)
-			s.request(client, sent, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			s.request(client, sent, http.StatusForbidden, requestlog.ActionRateLimited)
 		})
 	}
 }

internal/discriminator/refusallimit.go

@@ -28,7 +28,7 @@ func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdic
 		return nil
 	}
 
-	if !rq.attack && !rq.blockedByBlockRule && !rq.wafBlocked {
+	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked {
 		return nil
 	}
 
@@ -42,13 +42,13 @@ func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdic
 	status := rq.out.status
 
 	switch rq.line.WouldAction {
-	case requestlog.ActionBlockedByBlockRule, requestlog.ActionWAFBlocked:
+	case requestlog.ActionRuleBlocked, requestlog.ActionWAFBlocked:
 		status = http.StatusForbidden
-	case requestlog.ActionTemporarilyBanned, requestlog.ActionPermanentlyBanned:
+	case requestlog.ActionBanned:
 		status = cfg.BanResponse
 	}
 
 	rq.banForLimit(now, hit, status)
 
-	return &verdict{figures: limitFigures(hit)}
+	return &verdict{action: requestlog.ActionBanned, figures: limitFigures(hit)}
 }

internal/discriminator/refusallimit_test.go

@@ -37,10 +37,9 @@ func (r refused) send(s *sender, from string) logLine {
 	switch r {
 	case blockRule:
 		return s.request(from, blockedPath, http.StatusForbidden,
-			requestlog.ActionBlockedByBlockRule)
+			requestlog.ActionRuleBlocked)
 	case banRule:
-		return s.request(from, probePath, http.StatusForbidden,
-			requestlog.ActionTemporarilyBanned)
+		return s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
 	}
 
 	s.t.Fatalf("no request for the refusal %d", r)
@@ -72,20 +71,9 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 		name string
 		// refusals are four, one over the threshold of three.
 		refusals []refused
-		// nextAction is the action of the client's next request: the next
-		// request after a ban for a ban rule makes it permanent.
-		nextAction string
 	}{
-		{
-			"block rule",
-			[]refused{blockRule, blockRule, blockRule, blockRule},
-			requestlog.ActionTemporarilyBanned,
-		},
-		{
-			"a ban rule last",
-			[]refused{blockRule, blockRule, blockRule, banRule},
-			requestlog.ActionPermanentlyBanned,
-		},
+		{"block rule", []refused{blockRule, blockRule, blockRule, blockRule}},
+		{"a ban rule last", []refused{blockRule, blockRule, blockRule, banRule}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -113,7 +101,7 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 					"and limit", line.LimitHit, line.Offence)
 			}
 
-			s.get(client, http.StatusForbidden, tc.nextAction)
+			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 		})
 	}
 }
@@ -181,7 +169,7 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
 	}
 
-	wantOffences := ratelimit.Offences{Limit: 1, BlockedByBlockRule: 3}
+	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 3}
 	if offences := historyOf(t, server, client).Offences; offences != wantOffences {
 		t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
 	}
@@ -191,7 +179,7 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		`kind="refusals",window="minute"}`, 1)
 	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
 	wantMetric(t, metrics,
-		`sww_offences_total{instance="app",kind="blocked_by_block_rule"}`, 3)
+		`sww_offences_total{instance="app",kind="rule_blocked"}`, 3)
 	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 1)
 }
 
@@ -310,7 +298,7 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
 		t.Errorf("log line has limit_hit %q, want error_burst", line.LimitHit)
 	}
 
-	s.get(exempt, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(exempt, http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestErrorBurstBanSetsTheRefusalsBackToZero(t *testing.T) {
@@ -353,7 +341,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	for range 2 {
 		line := s.request(otherClient, blockedPath, http.StatusOK,
 			requestlog.ActionForward)
-		wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
+		wantWouldAction(t, line, requestlog.ActionBanned)
 
 		if line.LimitHit != "" {
 			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
@@ -365,7 +353,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
 
 	line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionBlockedByBlockRule)
+	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
 
 	if line.LimitHit != requestlog.LimitHitErrorBurst || line.BanExpires != "" {
 		t.Errorf("log line has limit_hit %q and ban_expires %q, want error_burst "+

internal/discriminator/reputation_test.go

@@ -49,7 +49,7 @@ const (
 func TestEachBlocklistActionForAListedAddressAndAListedNetblock(t *testing.T) {
 	t.Parallel()
 
-	forward, denied := requestlog.ActionForward, requestlog.ActionClientDenied
+	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
 
 	for _, tc := range []struct {
 		action string
@@ -66,7 +66,7 @@ func TestEachBlocklistActionForAListedAddressAndAListedNetblock(t *testing.T) {
 		{
 			// Half of 4 requests a minute: the third breaks the limit.
 			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionClientIsRateLimited},
+			[]string{forward, forward, requestlog.ActionRateLimited},
 			"50 from " + blocklistAction,
 		},
 		{
@@ -162,7 +162,7 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T)
 			s, server, _ := startWithLookups(t, tc.env)
 			tc.load(t, server)
 
-			line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
+			line := s.get(client, http.StatusForbidden, requestlog.ActionDenied)
 			wantHeuristic(t, line, tc.heuristic, tc.figures)
 		})
 	}
@@ -193,7 +193,7 @@ func TestObserveModeForwardsAClientABlocklistDeniesAndAlertsIt(t *testing.T) {
 	loadLists(t, server, map[string][]string{dropURL: {fromDE}})
 
 	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionClientDenied)
+	wantWouldAction(t, line, requestlog.ActionDenied)
 	wantReputation(t, line, dropURL)
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
@@ -380,7 +380,7 @@ const (
 func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 	t.Parallel()
 
-	forward, denied := requestlog.ActionForward, requestlog.ActionClientDenied
+	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
 
 	for _, tc := range []struct {
 		action string
@@ -397,7 +397,7 @@ func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 		{
 			// Half of 4 requests a minute: the third breaks the limit.
 			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionClientIsRateLimited},
+			[]string{forward, forward, requestlog.ActionRateLimited},
 			"50 from " + reputationAction,
 		},
 		{
@@ -468,7 +468,7 @@ func TestDNSBLZonesComeAfterTheBlocklistsAndSkipAllowNets(t *testing.T) {
 	// The blocklist refuses fromKP before its verdict is looked at, and
 	// fromDE, in SWW_ALLOW_NETS, is not checked at all: neither is noted
 	// for the zone, nor alerted, nor asked about.
-	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied),
+	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied),
 		dropURL)
 	wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward))
 
@@ -532,7 +532,7 @@ func TestObserveModeForwardsAClientADNSBLZoneDeniesAndAlertsIt(t *testing.T) {
 	loadVerdicts(server, map[string][]string{fromDE: {dnsblZone}})
 
 	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionClientDenied)
+	wantWouldAction(t, line, requestlog.ActionDenied)
 	wantReputation(t, line, dnsblZone)
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
@@ -741,8 +741,8 @@ func TestOnlyAClientThatHasCommittedAnOffenceIsCheckedWithAbuseIPDB(t *testing.T
 	s.get(fromDE, http.StatusOK, forward)
 	s.get(fromDE, http.StatusOK, forward)
 	s.get(fromKP, http.StatusOK, forward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
 	wantAbuseIPDBChecks(t, server, 0)
 
 	// Once the ban has ended, fromDE's first request has it checked in the
@@ -781,7 +781,7 @@ func TestIPv6ClientCostsOneAbuseIPDBCheckWhicheverOfItsAddressesSends(t *testing
 		s.get(addresses[0], http.StatusOK, forward)
 	}
 
-	s.get(addresses[0], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(addresses[0], http.StatusForbidden, requestlog.ActionRateLimited)
 	clk.advance(time.Hour)
 
 	// Once the ban has ended, which set its counters back to zero, a
@@ -814,20 +814,20 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 		want   ratelimit.Offences
 	}{
 		{
-			"a block rule", blockedPath, http.StatusForbidden,
-			requestlog.ActionBlockedByBlockRule, ratelimit.Offences{BlockedByBlockRule: 1},
+			"a block rule", blockedPath, http.StatusForbidden, requestlog.ActionRuleBlocked,
+			ratelimit.Offences{RuleBlocked: 1},
 		},
 		{
 			"the Core Rule Set", sqlInjection, http.StatusForbidden,
 			requestlog.ActionWAFBlocked, ratelimit.Offences{WAFBlocked: 1},
 		},
 		{
-			"a ban rule", probePath, http.StatusForbidden, requestlog.ActionTemporarilyBanned,
+			"a ban rule", probePath, http.StatusForbidden, requestlog.ActionBanned,
 			ratelimit.Offences{Attack: 1},
 		},
 		{
-			"a trap path", "/xmlrpc.php", http.StatusForbidden,
-			requestlog.ActionTemporarilyBanned, ratelimit.Offences{Attack: 1},
+			"a trap path", "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned,
+			ratelimit.Offences{Attack: 1},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -858,7 +858,7 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *testing.T) {
 	t.Parallel()
 
-	forward, denied := requestlog.ActionForward, requestlog.ActionClientDenied
+	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
 
 	for _, tc := range []struct {
 		action string
@@ -875,7 +875,7 @@ func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *test
 		{
 			// Half of 4 requests a minute: the third breaks the limit.
 			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionClientIsRateLimited},
+			[]string{forward, forward, requestlog.ActionRateLimited},
 			"50 from " + reputationAction,
 		},
 		{
@@ -972,7 +972,7 @@ func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
 	// fromDE's score is not used, and once it has committed an offence it
 	// is not checked either.
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
 	clk.advance(time.Hour)
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
 	wantAbuseIPDBChecks(t, server, 0)
@@ -996,10 +996,10 @@ func TestBanNotesNameEachReputationSourceThatListedTheClient(t *testing.T) {
 	}{
 		{"for a broken rate limit", func(s *sender, from string) {
 			s.get(from, http.StatusOK, requestlog.ActionForward)
-			s.get(from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+			s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
 		}},
 		{"for a clear sign of attack", func(s *sender, from string) {
-			s.request(from, probePath, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+			s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
 		}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {

internal/discriminator/request.go

@@ -54,10 +54,10 @@ type decision struct {
 	counted                    bool
 	limitPercent, bytesPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
-	// trap path, blockedByBlockRule for one a block rule refused, and
-	// wafBlocked for one the Core Rule Set refused, each an offence its
-	// client's history counts.
-	attack, blockedByBlockRule, wafBlocked bool
+	// trap path, ruleBlocked for one a block rule refused, and wafBlocked for
+	// one the Core Rule Set refused, each an offence its client's history
+	// counts.
+	attack, ruleBlocked, wafBlocked bool
 	// reputation is the reputation sources that list the client, for the
 	// notes of a ban the request makes.
 	reputation []bans.ReputationHit
@@ -187,10 +187,9 @@ func (rq *request) check(ctx context.Context) *refusal {
 		rq.line.WouldAction = action
 
 		return nil
-	case action == requestlog.ActionBlockedByBlockRule ||
-		action == requestlog.ActionWAFBlocked:
+	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
 		return &refusal{status: http.StatusForbidden, action: action}
-	case action == requestlog.ActionRequestHeaderTooLarge:
+	case action == requestlog.ActionTooLarge:
 		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
 	default:
 		return rq.banResponse(action)
@@ -311,7 +310,7 @@ func (rq *request) addToHistory() {
 		ResponseBytes: rq.out.bytes,
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
 		Attack:        rq.attack,
-		BlockedByBlockRule: rq.blockedByBlockRule,
+		RuleBlocked:   rq.ruleBlocked,
 		WAFBlocked:    rq.wafBlocked,
 	}
 

internal/discriminator/routewatchtags.go

@@ -0,0 +1,42 @@
+package discriminator
+
+// The heuristic routewatch_tags. It reads SWW_ROUTEWATCH_URL.
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+// routeWatchTags adds to the request the tags asn=<number> and prefix=<netblock>
+// from what routewatch answered about the client. It refuses nothing, and the
+// request does not wait for routewatch. A request that gets no tags from it has
+// the reason in the log line's routewatch_tags_missing. While SWW_ROUTEWATCH_URL
+// is unset it does nothing. Answers are kept by client and asked for by the
+// request's address, and a route without an origin AS gives only the prefix= tag.
+type routeWatchTags struct{}
+
+func (routeWatchTags) name() string { return "routewatch_tags" }
+
+func (routeWatchTags) check(ctx context.Context, rq *request, _ time.Time) *verdict {
+	if rq.h.routeWatch == nil {
+		return nil
+	}
+
+	route, missing := rq.h.routeWatch.Route(ctx, rq.h.clientGroup(rq.client), rq.client)
+	if missing != "" {
+		rq.line.RouteWatchTagsMissing = string(missing)
+
+		return nil
+	}
+
+	rq.addTag(config.PrefixTagPrefix + route.Netblock.String())
+
+	if route.ASN != 0 {
+		rq.addTag(config.ASNTagPrefix + strconv.FormatUint(uint64(route.ASN), 10))
+	}
+
+	return nil
+}

internal/discriminator/routewatchtags_test.go

@@ -0,0 +1,245 @@
+package discriminator_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// routeWatchURL is SWW_ROUTEWATCH_URL, and tagsMissing the log line's field
+// that says why a request got no tags from routewatch.
+const (
+	routeWatchURL = "SWW_ROUTEWATCH_URL"
+	tagsMissing   = "routewatch_tags_missing"
+	fromV6        = "2001:db8:1::5"
+	prefixV6      = "2001:db8::/32"
+	prefixDE      = "203.0.113.0/24"
+	prefixKP      = "198.51.100.0/24"
+)
+
+// standInRoute is what the stand-in for routewatch answers about an address.
+type standInRoute struct {
+	Netblock string `json:"netblock"`
+	ASN      int    `json:"asn"`
+}
+
+// startRouteWatch starts a stand-in for routewatch's IP info API that knows the
+// routes given by address, and returns its URL.
+func startRouteWatch(t *testing.T, routes map[string]standInRoute) string {
+	t.Helper()
+
+	server := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			address := strings.TrimPrefix(r.URL.Path, "/api/v1/ip/")
+
+			result := map[string]any{"ip": address}
+			if route, known := routes[address]; known {
+				result["netblock"], result["asn"] = route.Netblock, route.ASN
+			}
+
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"status": "ok",
+				"data":   map[string]any{"results": []any{result}},
+			})
+		}))
+	t.Cleanup(server.Close)
+
+	return server.URL
+}
+
+// waitForRouteWatch waits until routewatch's answer about from, in the client
+// group of the given length, is kept, so that the next request gets its tags.
+func waitForRouteWatch(
+	t *testing.T, server *discriminator.Server, from string, bits int,
+) {
+	t.Helper()
+
+	addr := netip.MustParseAddr(from)
+	client := netip.PrefixFrom(addr, bits).Masked()
+	deadline := time.Now().Add(5 * time.Second)
+
+	for {
+		_, missing := server.RouteWatch.Route(context.Background(), client, addr)
+		if missing == "" {
+			return
+		}
+
+		if time.Now().After(deadline) {
+			t.Fatalf("routewatch's answer about %s not kept: %q", from, missing)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func wantTagsMissing(t *testing.T, line logLine, want string) {
+	t.Helper()
+
+	got, _ := line.fields[tagsMissing].(string)
+	if got != want {
+		t.Errorf("log line has %s %q, want %q", tagsMissing, got, want)
+	}
+}
+
+func TestRouteWatchTagsAreOnTheLogLineWithTheLookupsTags(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromDE: {prefixDE, 64496}})
+	s, server, _ := startWithLookups(t, map[string]string{routeWatchURL: url})
+
+	waitForRouteWatch(t, server, fromDE, 32)
+
+	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	wantTags(t, line, "asn=64496", "country=DE", "prefix="+prefixDE)
+	wantTagsMissing(t, line, "")
+}
+
+func TestRouteWatchTagsAreOnALineDenyNetsRefused(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromKP: {prefixKP, 64511}})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url, denyNets: fromKP,
+	})
+
+	waitForRouteWatch(t, server, fromKP, 32)
+
+	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied)
+	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+fromKP+`/32"}`)
+	wantTags(t, line, "asn=64511", "prefix="+prefixKP)
+}
+
+func TestRouteWithoutAnOriginASGivesOnlyThePrefixTag(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromDE: {prefixDE, 0}})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url,
+	})
+
+	waitForRouteWatch(t, server, fromDE, 32)
+
+	wantTags(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward),
+		"prefix="+prefixDE)
+}
+
+func TestUnsetRouteWatchChangesNothing(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{lookupSource: off})
+
+	if server.RouteWatch != nil {
+		t.Error("RouteWatch is set while SWW_ROUTEWATCH_URL is unset")
+	}
+
+	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	if _, present := line.fields[tagsMissing]; present {
+		t.Errorf("log line has %s", tagsMissing)
+	}
+
+	if _, present := line.fields["tags"]; present {
+		t.Errorf("log line has tags %v", line.fields["tags"])
+	}
+}
+
+func TestUnreachableRouteWatchLetsTheRequestThroughAndSaysWhy(t *testing.T) {
+	t.Parallel()
+
+	// A stand-in that is closed at once, so that the port refuses connections.
+	dead := httptest.NewServer(http.NotFoundHandler())
+	url := dead.URL
+
+	dead.Close()
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url,
+	})
+
+	wantTagsMissing(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward),
+		"no_answer_yet")
+
+	deadline := time.Now().Add(5 * time.Second)
+
+	for {
+		line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+
+		missing, _ := line.fields[tagsMissing].(string)
+		if missing == "request_failed" {
+			return
+		}
+
+		if time.Now().After(deadline) {
+			t.Fatalf("still %q, want request_failed", missing)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func TestAddressWithoutARouteHasNoTagsAndTheLineSaysSo(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: startRouteWatch(t, nil),
+	})
+
+	deadline := time.Now().Add(5 * time.Second)
+
+	for {
+		line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+
+		missing, _ := line.fields[tagsMissing].(string)
+		if missing == "no_route" {
+			return
+		}
+
+		if time.Now().After(deadline) {
+			t.Fatalf("still %q, want no_route", missing)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func TestTagDenyRefusesOnARouteWatchPrefix(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{
+		fromDE: {prefixDE, 64496}, fromKP: {prefixKP, 64511},
+	})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url, tagDeny: "prefix=" + prefixKP,
+	})
+
+	waitForRouteWatch(t, server, fromKP, 32)
+	waitForRouteWatch(t, server, fromDE, 32)
+
+	wantHeuristic(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied),
+		"tag_deny", `{"tag": "prefix=`+prefixKP+`"}`)
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+}
+
+func TestTagLimitPercentWorksWithAnIPv6Prefix(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromV6: {prefixV6, 64496}})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url, rateLimitPerMinute: "2",
+		tagLimitPercent: "prefix=" + prefixV6 + ":50",
+	})
+
+	waitForRouteWatch(t, server, fromV6, 64)
+
+	// Half of two is one: the second request breaks the limit.
+	line := s.get(fromV6, http.StatusOK, requestlog.ActionForward)
+	wantTags(t, line, "asn=64496", "prefix="+prefixV6)
+	s.get(fromV6, http.StatusForbidden, requestlog.ActionRateLimited)
+}

internal/discriminator/rulefiles.go

@@ -16,10 +16,9 @@ import (
 // ruleFiles checks the request against the rules of the rule files at now,
 // notes the ids of those it matches in the log line, adds the tag
 // exploitsignature when it matches any, and refuses the request
-// when the last rule it matches refuses it: with ActionBlockedByBlockRule for a
-// block rule, and for a ban rule with the action for the ban it makes. A ban
-// rule bans the client's netblock for a clear sign of attack, or in observe
-// mode raises the alert for the ban
+// when the last rule it matches refuses it: with ActionRuleBlocked for a block
+// rule, and ActionBanned for a ban rule. A ban rule bans the client's netblock
+// for a clear sign of attack, or in observe mode raises the alert for the ban
 // it would have made. Either rule's match is noted as an offence, for the
 // client's history. Its figures are the rule's id and action.
 type ruleFiles struct{}
@@ -46,16 +45,14 @@ func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
 
 	switch last.Action {
 	case rules.ActionBlock:
-		rq.blockedByBlockRule = true
+		rq.ruleBlocked = true
 
-		return &verdict{action: requestlog.ActionBlockedByBlockRule, figures: figures}
+		return &verdict{action: requestlog.ActionRuleBlocked, figures: figures}
 	case rules.ActionBan:
 		rq.attack = true
+		rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target})
 
-		return &verdict{
-			action:  rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target}),
-			figures: figures,
-		}
+		return &verdict{action: requestlog.ActionBanned, figures: figures}
 	default:
 		return nil
 	}

internal/discriminator/rulefiles_test.go

@@ -37,14 +37,13 @@ func TestEachRuleAction(t *testing.T) {
 	// A block rule refuses with 403, whatever SWW_BAN_RESPONSE is, and
 	// bans no one.
 	line = s.request(client, "/blocked", http.StatusForbidden,
-		requestlog.ActionBlockedByBlockRule)
+		requestlog.ActionRuleBlocked)
 	wantRuleIDs(t, line, "noted", "blocked")
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
 	// A ban rule refuses with SWW_BAN_RESPONSE, and bans the client for
 	// seven days, the default.
-	line = s.request(client, "/.env", http.StatusTooManyRequests,
-		requestlog.ActionTemporarilyBanned)
+	line = s.request(client, "/.env", http.StatusTooManyRequests, requestlog.ActionBanned)
 	wantRuleIDs(t, line, "noted", "probe")
 
 	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
@@ -83,7 +82,7 @@ func TestEachRuleAction(t *testing.T) {
 	// against the rules, and makes the ban permanent.
 	clk.advance(time.Hour)
 
-	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
+	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
 	wantRuleIDs(t, line)
 
 	if line.BanExpires != permanent {
@@ -91,7 +90,7 @@ func TestEachRuleAction(t *testing.T) {
 	}
 
 	clk.advance(365 * 24 * time.Hour)
-	s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
+	s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
 }
 
 func TestEachRuleActionAddsTheExploitSignatureTag(t *testing.T) {
@@ -104,7 +103,7 @@ func TestEachRuleActionAddsTheExploitSignatureTag(t *testing.T) {
 	wantTags(t, s.request(client, "/noted", http.StatusOK, requestlog.ActionForward),
 		"exploitsignature")
 	wantTags(t, s.request(client, "/blocked", http.StatusForbidden,
-		requestlog.ActionBlockedByBlockRule), "exploitsignature")
+		requestlog.ActionRuleBlocked), "exploitsignature")
 	wantTags(t, s.get(client, http.StatusOK, requestlog.ActionForward))
 }
 
@@ -116,11 +115,10 @@ func TestRuleRefusalNamesItsHeuristicAndTheRule(t *testing.T) {
 	})
 
 	line := s.request(client, "/blocked", http.StatusForbidden,
-		requestlog.ActionBlockedByBlockRule)
+		requestlog.ActionRuleBlocked)
 	wantHeuristic(t, line, "rule_files", `{"rule_id": "blocked", "rule_action": "block"}`)
 
-	line = s.request(client, "/.env", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
+	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 	wantHeuristic(t, line, "rule_files", `{"rule_id": "probe", "rule_action": "ban"}`)
 }
 
@@ -133,8 +131,7 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 	})
 
 	// The first probe bans for SWW_ATTACK_BAN_DURATION.
-	line := s.request(client, "/.env", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
+	line := s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 	if line.BanExpires != requestlog.FormatTime(clk.Now().Add(time.Hour)) {
 		t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
 	}
@@ -144,8 +141,7 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 	clk.advance(time.Hour)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line = s.request(client, "/.env", http.StatusForbidden,
-		requestlog.ActionPermanentlyBanned)
+	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 	if line.BanExpires != permanent {
 		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
 	}
@@ -173,8 +169,7 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 	// A probe over the rate limit breaks the limit before any rule sees
 	// it.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	line = s.request(client, "/.env", http.StatusForbidden,
-		requestlog.ActionClientIsRateLimited)
+	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionRateLimited)
 	wantRuleIDs(t, line)
 
 	limitBan := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
@@ -184,7 +179,7 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 
 	// A client the rate limits do not apply to is still checked.
 	s.get(exempt, http.StatusOK, requestlog.ActionForward)
-	s.request(exempt, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.request(exempt, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
@@ -196,11 +191,11 @@ func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
 	})
 
 	line := s.request(client, "/blocked", http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionBlockedByBlockRule)
+	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
 	wantRuleIDs(t, line, "blocked")
 
 	line = s.request(client, "/.env", http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
+	wantWouldAction(t, line, requestlog.ActionBanned)
 	wantRuleIDs(t, line, "probe")
 
 	if line.BanExpires != "" {
@@ -224,10 +219,9 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 		metricsToken: token,
 	})
 
-	s.request(client, "/blocked", http.StatusForbidden,
-		requestlog.ActionBlockedByBlockRule)
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
+	s.request(client, "/blocked", http.StatusForbidden, requestlog.ActionRuleBlocked)
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
@@ -235,10 +229,10 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 	wantMetric(t, metrics,
 		`sww_rule_matches_total{action="ban",instance="app",rule_id="probe"}`, 1)
 	wantMetric(t, metrics, `sww_rules_loaded{instance="app"}`, 2)
-	wantMetric(t, metrics, `sww_requests_total{action="blocked_by_block_rule",`+
+	wantMetric(t, metrics, `sww_requests_total{action="rule_blocked",`+
 		`instance="app",status_class="4xx"}`, 1)
 	wantMetric(t, metrics,
-		`sww_offences_total{instance="app",kind="blocked_by_block_rule"}`, 1)
+		`sww_offences_total{instance="app",kind="rule_blocked"}`, 1)
 	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="attack"}`, 1)
 	wantMetric(t, metrics, `sww_bans_made_total{cause="attack",instance="app"}`, 1)
 	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 0)

internal/discriminator/staticlists_test.go

@@ -68,7 +68,7 @@ func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
 	})
 }
 
@@ -92,7 +92,7 @@ func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 	wantStatus(t, do(t, req), http.StatusForbidden)
 
 	line := out.endedLine(t)
-	wantLine(t, line, http.StatusForbidden, requestlog.ActionClientDenied)
+	wantLine(t, line, http.StatusForbidden, requestlog.ActionDenied)
 
 	if len(asked()) != 0 {
 		t.Errorf("GeoJS was asked about %v, want nothing", asked())
@@ -108,7 +108,7 @@ func TestDenyNetsRefusalNamesItsHeuristicAndNetblock(t *testing.T) {
 
 	s, _, _ := startWithClock(t, "", map[string]string{denyNets: clientsNet})
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionDenied)
 	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+clientsNet+`"}`)
 }
 
@@ -125,10 +125,10 @@ func TestRequestRefusedByDenyNetsIsNotCounted(t *testing.T) {
 	// listedAddr's refused requests are not counted, so the first request
 	// from unlistedAddr is within the limit of one a minute.
 	wantAnswers(t, addr, out, []sentRequest{
-		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
-		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
 	})
 }
 
@@ -152,8 +152,8 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
-		{fromKP, http.StatusForbidden, requestlog.ActionClientDenied},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+		{fromKP, http.StatusForbidden, requestlog.ActionDenied},
 	})
 }
 

internal/discriminator/tagdeny.go

@@ -20,7 +20,7 @@ func (tagDeny) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	for _, tag := range rq.line.Tags {
 		if slices.Contains(rq.h.config.TagDeny, tag) {
 			return &verdict{
-				action:  requestlog.ActionClientDenied,
+				action:  requestlog.ActionDenied,
 				figures: map[string]any{"tag": tag},
 			}
 		}

internal/discriminator/tagdeny_test.go

@@ -14,7 +14,7 @@ func TestTagDenyRefusesALookupTagAndNamesTheTag(t *testing.T) {
 	// in capitals.
 	s, _, _ := startWithLookups(t, map[string]string{tagDeny: "Country=kp"})
 
-	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied)
+	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "country=KP"}`)
 	wantTags(t, line, "asn=64511", "country=KP")
 
@@ -26,7 +26,7 @@ func TestTagDenyRefusesAnASNTag(t *testing.T) {
 
 	s, _, _ := startWithLookups(t, map[string]string{tagDeny: "asn=64511"})
 
-	wantHeuristic(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied),
+	wantHeuristic(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied),
 		"tag_deny", `{"tag": "asn=64511"}`)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 }
@@ -41,7 +41,7 @@ func TestTagDenyRefusesAListTagBeforeTheRateLimitsCount(t *testing.T) {
 
 	// Each is refused for its tag: none is counted to break the limit of one.
 	for range 3 {
-		wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionClientDenied),
+		wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionDenied),
 			"tag_deny", `{"tag": "torexit"}`)
 	}
 }
@@ -58,7 +58,7 @@ func TestTagDenyRefusesAMixedCaseZoneByItsLowerCaseTag(t *testing.T) {
 	})
 	loadVerdicts(server, map[string][]string{fromDE: {mixedCaseZone}})
 
-	wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionClientDenied),
+	wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionDenied),
 		"tag_deny", `{"tag": "dnsbl=`+dnsblZone+`"}`)
 }
 
@@ -69,7 +69,7 @@ func TestTagDenyRefusesAnExploitSignatureOfARuleThatOnlyLogs(t *testing.T) {
 		rulesDir: writeRules(t, "noted path log ^/\n"), tagDeny: "exploitsignature",
 	})
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "exploitsignature"}`)
 	wantTags(t, line, "exploitsignature")
 }
@@ -87,7 +87,7 @@ func TestTagLimitPercentLowersALimitTheLowestWinning(t *testing.T) {
 	// A quarter of 4 requests a minute: the second breaks the limit.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
 	wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
 		"25 from "+tagLimitPercent)
 }

internal/discriminator/taglists_test.go

@@ -80,7 +80,7 @@ func TestTagListsTagARequestRefusedBeforeTheLookup(t *testing.T) {
 	})
 	loadLists(t, server, map[string][]string{vpnList: {fromDE, fromKP}})
 
-	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied)
+	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied)
 	if line.Heuristic != "deny_nets" {
 		t.Errorf("log line has heuristic %q, want deny_nets", line.Heuristic)
 	}
@@ -89,9 +89,9 @@ func TestTagListsTagARequestRefusedBeforeTheLookup(t *testing.T) {
 
 	// The second request breaks the limit of one a minute, which bans the client.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
 
-	line = s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	line = s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
 	if line.Heuristic != "active_ban" {
 		t.Errorf("log line has heuristic %q, want active_ban", line.Heuristic)
 	}

internal/discriminator/trappaths.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
@@ -29,9 +30,10 @@ func (trapPaths) check(_ context.Context, rq *request, now time.Time) *verdict {
 	}
 
 	rq.attack = true
+	rq.banForAttack(now, bans.Notes{TrapPath: path})
 
 	return &verdict{
-		action:  rq.banForAttack(now, bans.Notes{TrapPath: path}),
+		action:  requestlog.ActionBanned,
 		figures: map[string]any{"path": path},
 	}
 }

internal/discriminator/trappaths_test.go

@@ -43,7 +43,7 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 
 	// The query is not part of the path.
 	line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusTooManyRequests,
-		requestlog.ActionTemporarilyBanned)
+		requestlog.ActionBanned)
 	wantRuleIDs(t, line)
 
 	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
@@ -77,7 +77,7 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 	}
 
 	// The next request is refused under the ban, and makes it permanent.
-	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
+	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
 	if line.BanExpires != permanent {
 		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
 	}
@@ -89,7 +89,7 @@ func TestTrapPathRefusalNamesItsHeuristicAndPath(t *testing.T) {
 	s, _, _ := startWithClock(t, "", map[string]string{trapPaths: trapPathList})
 
 	line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
+		requestlog.ActionBanned)
 	wantHeuristic(t, line, "trap_paths", `{"path": "/wp-login.php"}`)
 }
 
@@ -100,8 +100,7 @@ func TestTrapPathMatchesThePathDecodedOnce(t *testing.T) {
 
 	// %2577 decodes once to %77, not to w.
 	s.request(otherClient, "/%2577p-login.php", http.StatusOK, requestlog.ActionForward)
-	s.request(client, "/%77p-login.php", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
+	s.request(client, "/%77p-login.php", http.StatusForbidden, requestlog.ActionBanned)
 
 	// The ban's notes give the path as the client sent it.
 	got := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
@@ -118,8 +117,7 @@ func TestTrapPathsNeedNoRuleFiles(t *testing.T) {
 		"SWW_RULES_ENABLED": "false",
 	})
 
-	s.request(client, "/xmlrpc.php", http.StatusForbidden,
-		requestlog.ActionTemporarilyBanned)
+	s.request(client, "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestObserveModeLogsWhatATrapPathWouldDo(t *testing.T) {
@@ -131,7 +129,7 @@ func TestObserveModeLogsWhatATrapPathWouldDo(t *testing.T) {
 	})
 
 	line := s.request(client, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
+	wantWouldAction(t, line, requestlog.ActionBanned)
 
 	// No ban was made.
 	s.get(client, http.StatusOK, requestlog.ActionForward)

internal/metrics/metrics.go

@@ -426,7 +426,7 @@ func (m *Metrics) Offences(r ratelimit.Request) {
 	for kind, committed := range map[string]bool{
 		"limit":        r.BrokeLimit,
 		"attack":       r.Attack,
-		"blocked_by_block_rule": r.BlockedByBlockRule,
+		"rule_blocked": r.RuleBlocked,
 		"waf_blocked":  r.WAFBlocked,
 	} {
 		if committed {

internal/ratelimit/ratelimit.go

@@ -122,11 +122,11 @@ type Responses struct {
 type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
-	// of a ban rule or a request for a trap path, BlockedByBlockRule those a
-	// block rule refused, and WAFBlocked those the Core Rule Set refused.
+	// of a ban rule or a request for a trap path, RuleBlocked those a block
+	// rule refused, and WAFBlocked those the Core Rule Set refused.
 	Limit       int64 `json:"limit"`
 	Attack      int64 `json:"attack"`
-	BlockedByBlockRule int64 `json:"blocked_by_block_rule"`
+	RuleBlocked int64 `json:"rule_blocked"`
 	WAFBlocked  int64 `json:"waf_blocked"`
 	// TokenRefused is what a clients.json written by an earlier version gives,
 	// which must still load. Nothing adds to it.
@@ -147,11 +147,11 @@ type Request struct {
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
-	// asked for a trap path, BlockedByBlockRule for one a block rule refused,
-	// and WAFBlocked for one the Core Rule Set refused.
+	// asked for a trap path, RuleBlocked for one a block rule refused, and
+	// WAFBlocked for one the Core Rule Set refused.
 	BrokeLimit  bool
 	Attack      bool
-	BlockedByBlockRule bool
+	RuleBlocked bool
 	WAFBlocked  bool
 }
 
@@ -323,8 +323,8 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 		h.Offences.Attack++
 	}
 
-	if r.BlockedByBlockRule {
-		h.Offences.BlockedByBlockRule++
+	if r.RuleBlocked {
+		h.Offences.RuleBlocked++
 	}
 
 	if r.WAFBlocked {

internal/requestlog/requestlog.go

@@ -20,37 +20,32 @@ const (
 	// the app.
 	ActionForward = "forward"
 
-	// ActionRequestHeaderTooLarge is a request over the header limits.
-	ActionRequestHeaderTooLarge = "request_header_too_large"
+	// ActionTooLarge is a request over the header limits.
+	ActionTooLarge = "too_large"
 
-	// ActionClientIsRateLimited is a request refused because it took its
-	// client over a rate limit, which bans the client.
-	ActionClientIsRateLimited = "client_is_rate_limited"
+	// ActionRateLimited is a request refused because it took its client
+	// over a rate limit, which bans the client.
+	ActionRateLimited = "rate_limited"
 
-	// ActionTemporarilyBanned is a request refused because a ban that runs
-	// out covers its client, or because it matched a ban rule, asked for a
-	// trap path or the CrowdSec decision list lists its client, and so made
-	// such a ban.
-	ActionTemporarilyBanned = "temporarily_banned"
+	// ActionBanned is a request refused because a ban covers its client,
+	// or because it matched a ban rule, asked for a trap path or the
+	// CrowdSec decision list lists its client, each of which bans the
+	// client.
+	ActionBanned = "banned"
 
-	// ActionPermanentlyBanned is a request refused because a ban that never
-	// runs out covers its client, or because the request made such a ban or
-	// made its client's ban permanent.
-	ActionPermanentlyBanned = "permanently_banned"
-
-	// ActionBlockedByBlockRule is a request refused because it matched a
-	// block rule.
-	ActionBlockedByBlockRule = "blocked_by_block_rule"
+	// ActionRuleBlocked is a request refused because it matched a block
+	// rule.
+	ActionRuleBlocked = "rule_blocked"
 
 	// ActionWAFBlocked is a request refused because the Core Rule Set
 	// scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
 	ActionWAFBlocked = "waf_blocked"
 
-	// ActionClientDenied is a request refused because its client is in
+	// ActionDenied is a request refused because its client is in
 	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
 	// SWW_REPUTATION_ACTION is deny, or that carries a tag in SWW_TAG_DENY.
-	ActionClientDenied = "client_denied"
+	ActionDenied = "denied"
 
 	// ActionCountryDenied is a request refused because its client's country
 	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
@@ -139,10 +134,10 @@ type Line struct {
 	// The decision.
 	Action string `json:"action"`
 	// WouldAction is, in observe mode, the action enforce mode would have
-	// taken with a request it would have refused: ActionClientDenied,
-	// ActionTemporarilyBanned, ActionPermanentlyBanned, ActionCountryDenied,
-	// ActionClientIsRateLimited, ActionBlockedByBlockRule, ActionWAFBlocked,
-	// or, in discriminator, ActionRequestHeaderTooLarge for the header limits.
+	// taken with a request it would have refused: ActionDenied,
+	// ActionBanned, ActionCountryDenied, ActionRateLimited,
+	// ActionRuleBlocked, ActionWAFBlocked, or, in discriminator, ActionTooLarge
+	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// Heuristic is the name of the heuristic that refused the request, in
 	// observe mode too, and HeuristicFigures are the figures it acted on, by
@@ -187,6 +182,10 @@ type Line struct {
 	Reputation []string `json:"reputation,omitempty"`
 	// Tags are the request's tags, sorted.
 	Tags []string `json:"tags,omitempty"`
+	// RouteWatchTagsMissing, while SWW_ROUTEWATCH_URL is set, says why the
+	// request got no tags from routewatch: no_answer_yet, request_failed or
+	// no_route.
+	RouteWatchTagsMissing string `json:"routewatch_tags_missing,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`
 	// BanExpires is when the ban the request made, or was refused under,

internal/routewatch/routewatch.go

@@ -0,0 +1,243 @@
+// Package routewatch asks a routewatch instance about client addresses, in the
+// background, and keeps its answers in memory. A routewatch instance knows, for
+// an address, the netblock it is announced in and the AS that originates it.
+package routewatch
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+)
+
+const (
+	// answerKept is how long an answer is used after it came.
+	answerKept = time.Hour
+	// failureKept is how long routewatch is not asked again after a query
+	// fails, so that a dead routewatch is not asked on every request.
+	failureKept = time.Minute
+	// queryTimeout is how long one query may take. routewatch answers only
+	// after a reverse DNS lookup it allows 2 seconds, so this is longer.
+	queryTimeout = 5 * time.Second
+	// maxAnswers is how many answers are kept. Past it, the one that came
+	// longest ago is dropped.
+	maxAnswers = 100000
+	// maxQueries is how many queries may be under way at once. Past it, a
+	// client is not asked about until its next request, so that a swarm of
+	// new addresses cannot fill the memory.
+	maxQueries = 100
+	// maxAnswerBytes is the most of an answer that is read.
+	maxAnswerBytes = 64 << 10
+)
+
+// Missing is why Route gives no route. The request log's field
+// routewatch_tags_missing gives these values.
+type Missing string
+
+const (
+	// NoAnswerYet is a client routewatch has not answered about yet.
+	NoAnswerYet Missing = "no_answer_yet"
+	// RequestFailed is no answer because a recent query failed.
+	RequestFailed Missing = "request_failed"
+	// NoRoute is routewatch knowing no live route for the address.
+	NoRoute Missing = "no_route"
+)
+
+var (
+	errStatus      = errors.New("routewatch answered")
+	errNoResult    = errors.New("the answer holds no result")
+	errNotNetblock = errors.New("the answer's netblock is not a netblock")
+)
+
+// Route is what routewatch knows of an address: the netblock it is announced
+// in, and the AS that originates it.
+type Route struct {
+	Netblock netip.Prefix
+	ASN      uint32
+}
+
+// Params are what New needs.
+type Params struct {
+	// URL is where routewatch is (SWW_ROUTEWATCH_URL).
+	URL string
+	// Now tells the time, normally time.Now in UTC.
+	Now func() time.Time
+	// ProcessLog receives the query that fails, and why.
+	ProcessLog *slog.Logger
+}
+
+// Client asks a routewatch instance about clients, in the background, and keeps
+// its answers. It is safe for concurrent use.
+type Client struct {
+	params     Params
+	httpClient *http.Client
+
+	mu sync.Mutex
+	// answers are by client. Each is added as it comes and never moved up,
+	// so that the one that came longest ago is the first dropped.
+	answers *simplelru.LRU[netip.Prefix, answer]
+	// asking are the clients whose query is under way.
+	asking map[netip.Prefix]bool
+	// retryAt is when routewatch may be asked again after a query failed.
+	retryAt time.Time
+}
+
+// answer is one kept answer: the route, or why there is none, and when it came.
+type answer struct {
+	route   Route
+	missing Missing
+	came    time.Time
+}
+
+// New returns a Client with no answer yet.
+func New(params Params) *Client {
+	answers, err := simplelru.NewLRU[netip.Prefix, answer](maxAnswers, nil)
+	if err != nil {
+		panic(err) // NewLRU fails only for a size below one
+	}
+
+	return &Client{
+		params:     params,
+		httpClient: &http.Client{},
+		answers:    answers,
+		asking:     map[netip.Prefix]bool{},
+	}
+}
+
+// Route returns what routewatch answered about client, an IPv4 address or an
+// IPv6 group, or why it has no route. It never waits for a query. A client
+// without an answer is asked about in the background, by addr, the address its
+// request came from, unless its query is under way, a query failed less than
+// failureKept ago, or maxQueries are under way. ctx is the context of the
+// client's request, and a query goes on after the request ends.
+func (c *Client) Route(
+	ctx context.Context, client netip.Prefix, addr netip.Addr,
+) (Route, Missing) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	now := c.params.Now()
+
+	kept, found := c.answers.Peek(client)
+	if found && now.Sub(kept.came) < answerKept {
+		return kept.route, kept.missing
+	}
+
+	if now.Before(c.retryAt) {
+		return Route{}, RequestFailed
+	}
+
+	if !c.asking[client] && len(c.asking) < maxQueries {
+		c.asking[client] = true
+
+		go c.ask(context.WithoutCancel(ctx), client, addr)
+	}
+
+	return Route{}, NoAnswerYet
+}
+
+// ask asks routewatch about addr, keeps the answer as client's, and notes the
+// query as no longer under way. A query that fails gives no answer, and
+// routewatch is not asked again for failureKept. Only the first failure of
+// those under way is logged.
+func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr) {
+	route, missing, err := c.query(ctx, addr)
+	now := c.params.Now()
+
+	c.mu.Lock()
+
+	delete(c.asking, client)
+
+	firstFailure := err != nil && !now.Before(c.retryAt)
+
+	if err == nil {
+		c.answers.Add(client, answer{route: route, missing: missing, came: now})
+	} else {
+		c.retryAt = now.Add(failureKept)
+	}
+
+	c.mu.Unlock()
+
+	if firstFailure {
+		c.params.ProcessLog.Warn("asking routewatch failed", "error", err.Error())
+	}
+}
+
+// query asks routewatch's IP info API about addr. An answer other than 200, one
+// that cannot be read, and none within queryTimeout, fail. A result with no
+// netblock is an address without a live route.
+func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, error) {
+	ctx, cancel := context.WithTimeout(ctx, queryTimeout)
+	defer cancel()
+
+	endpoint, err := url.JoinPath(c.params.URL, "api/v1/ip", addr.String())
+	if err != nil {
+		return Route{}, "", fmt.Errorf("make the URL: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	if err != nil {
+		return Route{}, "", fmt.Errorf("make the request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	res, err := c.httpClient.Do(req)
+	if err != nil {
+		// Do's error names the URL, which holds the client's address, which
+		// is not to be logged: only what went wrong is kept.
+		return Route{}, "", fmt.Errorf("ask routewatch: %w", errors.Unwrap(err))
+	}
+
+	defer func() {
+		_ = res.Body.Close()
+	}()
+
+	if res.StatusCode != http.StatusOK {
+		return Route{}, "", fmt.Errorf("%w %s", errStatus, res.Status)
+	}
+
+	return readAnswer(io.LimitReader(res.Body, maxAnswerBytes))
+}
+
+// readAnswer reads routewatch's answer about one address.
+func readAnswer(body io.Reader) (Route, Missing, error) {
+	var decoded struct {
+		Data struct {
+			Results []struct {
+				Netblock string `json:"netblock"`
+				ASN      uint32 `json:"asn"`
+			} `json:"results"`
+		} `json:"data"`
+	}
+
+	err := json.NewDecoder(body).Decode(&decoded)
+	if err != nil {
+		return Route{}, "", fmt.Errorf("read the answer: %w", err)
+	}
+
+	if len(decoded.Data.Results) == 0 {
+		return Route{}, "", errNoResult
+	}
+
+	result := decoded.Data.Results[0]
+	if result.Netblock == "" {
+		return Route{}, NoRoute, nil
+	}
+
+	netblock, err := netip.ParsePrefix(result.Netblock)
+	if err != nil {
+		return Route{}, "", fmt.Errorf("%w: %q", errNotNetblock, result.Netblock)
+	}
+
+	return Route{Netblock: netblock.Masked(), ASN: result.ASN}, "", nil
+}

internal/routewatch/routewatch_test.go

@@ -0,0 +1,333 @@
+package routewatch_test
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/routewatch"
+)
+
+const (
+	clientAddr   = "192.0.2.1"
+	routedAnswer = `{"status":"ok","data":{"results":[` +
+		`{"ip":"192.0.2.1","netblock":"192.0.2.0/24","asn":64496}]}}`
+	noRouteAnswer = `{"status":"ok","data":{"results":[{"ip":"192.0.2.1"}]}}`
+	// slowAnswer is longer than routewatch allows a reverse DNS lookup.
+	slowAnswer = 2500 * time.Millisecond
+	// waitLimit is longer than the Client allows a query.
+	waitLimit = 10 * time.Second
+)
+
+// clock is a time the tests move by hand.
+type clock struct {
+	mu  sync.Mutex
+	now time.Time
+}
+
+func (c *clock) Now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	return c.now
+}
+
+func (c *clock) advance(by time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.now = c.now.Add(by)
+}
+
+// fixture is a Client asking a stand-in for routewatch. queries counts what the
+// stand-in was asked, paths holds the last path it was asked for, and log holds
+// the process log.
+type fixture struct {
+	t       *testing.T
+	server  *httptest.Server
+	client  *routewatch.Client
+	clk     *clock
+	queries *atomic.Int32
+	path    *atomic.Value
+	log     *syncBuffer
+}
+
+// syncBuffer is a buffer the background queries can log to while a test reads it.
+type syncBuffer struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (b *syncBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.buf.Write(p)
+}
+
+func (b *syncBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.buf.String()
+}
+
+func newFixture(t *testing.T, standIn http.HandlerFunc) *fixture {
+	t.Helper()
+
+	f := &fixture{
+		t:       t,
+		clk:     &clock{now: time.Date(2026, 11, 9, 0, 0, 0, 0, time.UTC)},
+		queries: &atomic.Int32{},
+		path:    &atomic.Value{},
+		log:     &syncBuffer{},
+	}
+
+	f.server = httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			f.queries.Add(1)
+			f.path.Store(r.URL.Path)
+			standIn(w, r)
+		}))
+	t.Cleanup(f.server.Close)
+
+	f.client = routewatch.New(routewatch.Params{
+		URL: f.server.URL + "/", Now: f.clk.Now,
+		ProcessLog: slog.New(slog.NewTextHandler(f.log, nil)),
+	})
+
+	return f
+}
+
+func answering(body string) http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(body))
+	}
+}
+
+func (f *fixture) route() (routewatch.Route, routewatch.Missing) {
+	addr := netip.MustParseAddr(clientAddr)
+	client := netip.PrefixFrom(addr, addr.BitLen())
+
+	return f.client.Route(context.Background(), client, addr)
+}
+
+// waitFor asks until the answer is why, or, while why is "", until there is a
+// route, and returns the route.
+func (f *fixture) waitFor(why routewatch.Missing) routewatch.Route {
+	f.t.Helper()
+
+	deadline := time.Now().Add(waitLimit)
+
+	for {
+		route, missing := f.route()
+		if missing == why {
+			return route
+		}
+
+		if time.Now().After(deadline) {
+			f.t.Fatalf("still %q after %s, want %q", missing, waitLimit, why)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+// wantFailureLoggedWithoutTheClient waits for the process log to name a failed
+// query, and checks that it does not name the client.
+func (f *fixture) wantFailureLoggedWithoutTheClient() {
+	f.t.Helper()
+
+	// The failure is noted before it is logged.
+	deadline := time.Now().Add(waitLimit)
+	for !strings.Contains(f.log.String(), "asking routewatch failed") {
+		if time.Now().After(deadline) {
+			f.t.Fatalf("process log %q names no failure", f.log.String())
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+
+	if strings.Contains(f.log.String(), clientAddr) {
+		f.t.Errorf("process log %q names the client", f.log.String())
+	}
+}
+
+func TestRouteGivesRoutewatchsAnswerAndAsksByAddress(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+
+	if _, missing := f.route(); missing != routewatch.NoAnswerYet {
+		t.Errorf("before the answer: %q, want %q", missing, routewatch.NoAnswerYet)
+	}
+
+	route := f.waitFor("")
+
+	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	if route != want {
+		t.Errorf("route %+v, want %+v", route, want)
+	}
+
+	if got := f.path.Load(); got != "/api/v1/ip/"+clientAddr {
+		t.Errorf("asked for path %v", got)
+	}
+}
+
+func TestAnswerAfterASlowReverseDNSLookupIsKept(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
+		time.Sleep(slowAnswer)
+
+		_, _ = w.Write([]byte(routedAnswer))
+	})
+
+	f.route()
+
+	route := f.waitFor("")
+
+	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	if route != want {
+		t.Errorf("route %+v, want %+v", route, want)
+	}
+}
+
+func TestAddressWithoutARouteIsKeptAsNoRoute(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(noRouteAnswer))
+
+	f.route()
+	f.waitFor(routewatch.NoRoute)
+
+	if got := f.queries.Load(); got != 1 {
+		t.Errorf("%d queries, want 1", got)
+	}
+}
+
+func TestAnswerRoutewatchCannotBeTakenFromFails(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]http.HandlerFunc{
+		"500": func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+		},
+		"not JSON":   answering("no"),
+		"no results": answering(`{"status":"ok","data":{"results":[]}}`),
+		"bad netblock": answering(
+			`{"status":"ok","data":{"results":[{"netblock":"nowhere","asn":1}]}}`),
+	}
+	for name, standIn := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			f := newFixture(t, standIn)
+
+			f.route()
+			f.waitFor(routewatch.RequestFailed)
+			f.wantFailureLoggedWithoutTheClient()
+		})
+	}
+}
+
+func TestRefusedConnectionFailsTheQueryAndTheLogOmitsTheClient(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+
+	f.server.Close()
+
+	f.route()
+	f.waitFor(routewatch.RequestFailed)
+	f.wantFailureLoggedWithoutTheClient()
+}
+
+func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	})
+
+	f.route()
+	f.waitFor(routewatch.RequestFailed)
+	f.route()
+
+	if got := f.queries.Load(); got != 1 {
+		t.Errorf("%d queries while the failure is kept, want 1", got)
+	}
+
+	f.clk.advance(time.Minute)
+	f.route()
+
+	deadline := time.Now().Add(waitLimit)
+	for f.queries.Load() != 2 {
+		if time.Now().After(deadline) {
+			t.Fatalf("%d queries after the failure expired, want 2", f.queries.Load())
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func TestHangingRoutewatchNeverDelaysAndFailsTheQuery(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, func(_ http.ResponseWriter, r *http.Request) {
+		<-r.Context().Done()
+	})
+
+	start := time.Now()
+
+	f.route()
+
+	if elapsed := time.Since(start); elapsed > time.Second {
+		t.Errorf("Route took %s while routewatch hangs", elapsed)
+	}
+
+	f.waitFor(routewatch.RequestFailed)
+	f.wantFailureLoggedWithoutTheClient()
+}
+
+func TestRepeatedRequestsMakeOneQueryAndTheAnswerExpires(t *testing.T) {
+	t.Parallel()
+
+	release := make(chan struct{})
+	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
+		<-release
+
+		_, _ = w.Write([]byte(routedAnswer))
+	})
+
+	for range 50 {
+		f.route()
+	}
+
+	close(release)
+	f.waitFor("")
+
+	for range 50 {
+		f.route()
+	}
+
+	if got := f.queries.Load(); got != 1 {
+		t.Errorf("%d queries for repeated requests, want 1", got)
+	}
+
+	f.clk.advance(time.Hour)
+	f.waitFor(routewatch.NoAnswerYet)
+	f.waitFor("")
+
+	if got := f.queries.Load(); got != 2 {
+		t.Errorf("%d queries after the answer expired, want 2", got)
+	}
+}

internal/sww/sww_test.go

@@ -373,13 +373,13 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 	out := runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "client_is_rate_limited")
+	out.line(t, "action", "rate_limited")
 
 	// After another, the ban still refuses it.
 	out = runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "temporarily_banned")
+	out.line(t, "action", "banned")
 }
 
 func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
@@ -526,7 +526,7 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 			time.Sleep(pollInterval)
 		}
 	})
-	out.line(t, "action", "blocked_by_block_rule")
+	out.line(t, "action", "rule_blocked")
 }
 
 func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
@@ -740,7 +740,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 			time.Sleep(pollInterval)
 		}
 	})
-	wantDeniedByList(t, out.line(t, "action", "client_denied"), dropURL)
+	wantDeniedByList(t, out.line(t, "action", "denied"), dropURL)
 
 	if fetches := torFetches.Load(); fetches != 1 {
 		t.Errorf("tor.txt fetched %d times, want once, before the restart", fetches)
@@ -843,8 +843,7 @@ func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
 	t.Helper()
 
 	reputation, _ := line["reputation"].([]any)
-	if line["action"] != "client_denied" || len(reputation) != 1 ||
-		reputation[0] != listURL {
+	if line["action"] != "denied" || len(reputation) != 1 || reputation[0] != listURL {
 		t.Errorf("request log line %v, want one denied for %s", line, listURL)
 	}
 }

internal/waf/gitea.conf

@@ -1,8 +1,51 @@
-# The eighth change: on gitea's paths, some fields skip the rules that refused
-# ordinary gitea requests there. They are the fields where gitea sends a search,
-# a file name or a branch name. Each exclusion runs with the request, before the
-# rules it switches off, those of phase 1 included, so this file is loaded before
-# the Core Rule Set's rules. Each comment names a request the rule refused.
+# gitea's fixes: some fields skip the rules that refused ordinary gitea requests.
+# They are the fields where gitea sends a search, a file name or a branch name.
+# Each exclusion runs with the request, before the rules it switches off, those
+# of phase 1 included, so this file is loaded before the Core Rule Set's rules.
+# Each comment names a request the rule refused.
+
+# A request whose hostname SWW_APPS does not list gitea for skips every rule
+# below. Inspect sets tx.app_gitea on the others.
+SecRule &TX:app_gitea "@eq 0" \
+    "id:900590,phase:1,pass,nolog,skipAfter:END_GITEA"
+
+# The query parameters in which gitea sends names within a repository or its
+# own records, or a page of its own site, are not checked against the lists of
+# system files, shell paths and command names, on any path:
+#   930120: .gitignore
+#   932160: bin/docker-entrypoint
+#   932260: docker-build
+SecAction "id:900591,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:path,\
+    ctl:ruleRemoveTargetById=930120;ARGS:files,\
+    ctl:ruleRemoveTargetById=930120;ARGS:skip-to,\
+    ctl:ruleRemoveTargetById=930120;ARGS:sub_path,\
+    ctl:ruleRemoveTargetById=930120;ARGS:ref,\
+    ctl:ruleRemoveTargetById=930120;ARGS:sha,\
+    ctl:ruleRemoveTargetById=930120;ARGS:branch,\
+    ctl:ruleRemoveTargetById=930120;ARGS:workflow,\
+    ctl:ruleRemoveTargetById=930120;ARGS:artifactName,\
+    ctl:ruleRemoveTargetById=930120;ARGS:redirect_to,\
+    ctl:ruleRemoveTargetById=932160;ARGS:path,\
+    ctl:ruleRemoveTargetById=932160;ARGS:files,\
+    ctl:ruleRemoveTargetById=932160;ARGS:skip-to,\
+    ctl:ruleRemoveTargetById=932160;ARGS:sub_path,\
+    ctl:ruleRemoveTargetById=932160;ARGS:ref,\
+    ctl:ruleRemoveTargetById=932160;ARGS:sha,\
+    ctl:ruleRemoveTargetById=932160;ARGS:branch,\
+    ctl:ruleRemoveTargetById=932160;ARGS:workflow,\
+    ctl:ruleRemoveTargetById=932160;ARGS:artifactName,\
+    ctl:ruleRemoveTargetById=932160;ARGS:redirect_to,\
+    ctl:ruleRemoveTargetById=932260;ARGS:path,\
+    ctl:ruleRemoveTargetById=932260;ARGS:files,\
+    ctl:ruleRemoveTargetById=932260;ARGS:skip-to,\
+    ctl:ruleRemoveTargetById=932260;ARGS:sub_path,\
+    ctl:ruleRemoveTargetById=932260;ARGS:ref,\
+    ctl:ruleRemoveTargetById=932260;ARGS:sha,\
+    ctl:ruleRemoveTargetById=932260;ARGS:branch,\
+    ctl:ruleRemoveTargetById=932260;ARGS:workflow,\
+    ctl:ruleRemoveTargetById=932260;ARGS:artifactName,\
+    ctl:ruleRemoveTargetById=932260;ARGS:redirect_to"
 
 # gitea's searches of code, of issues and pull requests, and of commits send the
 # text searched for in q, which skips these rules there:
@@ -155,8 +198,8 @@ SecRule REQUEST_FILENAME \
 #   942140: information_schema.sql
 #   944110: java/lang/Runtime.java
 #   944130: java.lang.String.md
-# Each request skips the rules that refused it. The fourth change already has
-# path and redirect_to skip 930120, 932160 and 932260 on every path.
+# Each request skips the rules that refused it. Rule 900591 already has path and
+# redirect_to skip 930120, 932160 and 932260 on every path.
 
 # A file's commit graph, in file.
 SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/graph$" \
@@ -281,3 +324,5 @@ SecRule REQUEST_FILENAME \
     "@rx ^/api/actions_pipeline/_apis/pipelines/workflows/[0-9]+/artifacts/[^/]+/upload$" \
     "id:900640,phase:1,pass,nolog,\
     ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:Content-Range"
+
+SecMarker END_GITEA

internal/waf/waf.go

@@ -1,9 +1,9 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the eight changes sww
-// makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
-// "Attack detection" under "Settings" in SPEC.md describes them. It reads no
-// response.
+// body while SWW_WAF_BODY_LIMIT is set, with the six changes sww
+// makes to it, the fixes for the apps SWW_APPS names, and the exclusions in
+// SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as "Attack detection" under "Settings"
+// in SPEC.md describes them. It reads no response.
 //
 // sww writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
@@ -16,6 +16,8 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
+	"net"
 	"net/http"
 	"net/netip"
 	"os"
@@ -32,8 +34,8 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second, and
-// giteaExclusions for the third.
+// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second, and the
+// directives of every app in apps for the third.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -81,44 +83,28 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # before the rules of phase 1 too.
 %s
 
-# The eighth change comes before the rules for the same reason.
+# The apps' fixes come before the rules for the same reason.
 %s
 
-# The sixth: only the rules for requests are loaded, and no response is
+# The fifth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
 
 # The third: redirect_uri is not checked for a URL naming an IP address or
-# localhost. Coraza matches a parameter name here, and in the fourth,
-# without regard to case. ARGS holds the fields of a form data or multipart
-# body Coraza reads as well as the query parameters, so a field of one of
-# these names is left out too.
+# localhost. Coraza matches a parameter name here without regard to case.
+# ARGS holds the fields of a form data or multipart body Coraza reads as
+# well as the query parameters, so a field of this name is left out too.
 SecRuleUpdateTargetById 931100 "!ARGS:redirect_uri"
 SecRuleUpdateTargetById 934110 "!ARGS:redirect_uri"
 
-# The fourth: the query parameters in which gitea sends names within a
-# repository or its own records, or a page of its own site, are not
-# checked against the lists of system files, shell paths and command
-# names. Coraza takes one rule id per directive.
-SecRuleUpdateTargetById 930120 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
-    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
-    !ARGS:artifactName|!ARGS:redirect_to"
-SecRuleUpdateTargetById 932160 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
-    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
-    !ARGS:artifactName|!ARGS:redirect_to"
-SecRuleUpdateTargetById 932260 "!ARGS:path|!ARGS:files|!ARGS:skip-to|\
-    !ARGS:sub_path|!ARGS:ref|!ARGS:sha|!ARGS:branch|!ARGS:workflow|\
-    !ARGS:artifactName|!ARGS:redirect_to"
-
-# The fifth, for Referer: it is not checked for a Unix command without
-# arguments, for Java starting a process, or for a Java class name. 944130
-# refused every page opened from the page of java.lang.String.md. The
-# cookies are left out in Inspect.
+# The fourth: Referer is not checked for a Unix command without arguments,
+# for Java starting a process, or for a Java class name. 944130 refused
+# every page opened from the page of java.lang.String.md.
 SecRuleUpdateTargetById 932340 "!REQUEST_HEADERS:Referer"
 SecRuleUpdateTargetById 944110 "!REQUEST_HEADERS:Referer"
 SecRuleUpdateTargetById 944130 "!REQUEST_HEADERS:Referer"
 
-# The seventh: a container image push that reuses a layer names the image
+# The sixth: a container image push that reuses a layer names the image
 # it takes the layer from in the query parameter from, which is not
 # checked for command names. 932260 refused the push of a layer from
 # owner/python3-app.
@@ -168,18 +154,36 @@ SecRule MULTIPART_STRICT_ERROR "!@eq 0" "id:900450,phase:2,pass,\
     severity:'CRITICAL',setvar:'tx.inbound_anomaly_score_pl1=+5'"
 `
 
-// giteaExclusions are the eighth change: the fields of gitea's own
-// requests that skip the rules that refused them there, as Coraza
-// directives.
-//
-//go:embed gitea.conf
-var giteaExclusions string
+// app is an app whose ordinary requests the Core Rule Set would refuse,
+// with the fixes that let them pass.
+type app struct {
+	// directives are Coraza exclusions, loaded before the Core Rule Set's
+	// rules. Their first rule skips the rest unless Inspect sets the
+	// transaction variable app_ and the app's name, and they end with the
+	// marker it skips to.
+	directives string
+	// cookies are the cookies the Core Rule Set reads a request without.
+	cookies []string
+}
 
-// cookiesNotRead are the cookies the Core Rule Set reads a request
-// without, the rest of the fifth change.
+//go:embed gitea.conf
+var giteaDirectives string
+
+// apps are the apps whose fixes sww has, by the name SWW_APPS gives each.
 //
-//nolint:gochecknoglobals // a constant cannot be a list
-var cookiesNotRead = []string{"gitea_flash", "redirect_to"}
+//nolint:gochecknoglobals // a constant cannot be a map
+var apps = map[string]app{
+	"gitea": {
+		directives: giteaDirectives,
+		cookies:    []string{"gitea_flash", "redirect_to"},
+	},
+}
+
+// AppNames returns the names of the apps whose fixes sww has, in
+// alphabetical order.
+func AppNames() []string {
+	return slices.Sorted(maps.Keys(apps))
+}
 
 // Params are what New needs.
 type Params struct {
@@ -195,6 +199,10 @@ type Params struct {
 	// Core Rule Set's rules (SWW_CORE_RULE_SET_EXCLUSIONS_FILE), "" while
 	// there is none.
 	ExclusionsFile string
+	// Apps are the names of the apps each hostname serves, by hostname in
+	// lowercase (SWW_APPS). A request gets the fixes of its hostname's
+	// apps only, or of every app while Apps is nil.
+	Apps map[string][]string
 }
 
 // The ids of sww's own rules, which an exclusions file may not
@@ -286,13 +294,15 @@ func checkExclusions(exclusions string) error {
 type CoreRuleSet struct {
 	waf       coraza.WAF
 	bodyLimit int64
+	apps      map[string][]string
 }
 
-// New returns the Core Rule Set with the eight changes, at params'
-// paranoia level, without the rules it switches off, reading request
-// bodies up to params' limit, and with params' exclusions file loaded
-// before the Core Rule Set's rules. An exclusions file is an error if it
-// cannot be read or does not parse, or if checkExclusions refuses it.
+// New returns the Core Rule Set with the six changes and the apps' fixes,
+// at params' paranoia level, without the rules it switches off, reading
+// request bodies up to params' limit, and with params' exclusions file
+// loaded before the Core Rule Set's rules. An exclusions file is an error
+// if it cannot be read or does not parse, or if checkExclusions refuses
+// it.
 func New(params Params) (*CoreRuleSet, error) {
 	body := ""
 	if params.BodyLimit > 0 {
@@ -315,8 +325,13 @@ func New(params Params) (*CoreRuleSet, error) {
 		}
 	}
 
+	var fixes strings.Builder
+	for _, name := range AppNames() {
+		fixes.WriteString(apps[name].directives + "\n")
+	}
+
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
-		giteaExclusions)
+		fixes.String())
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))
@@ -334,7 +349,7 @@ func New(params Params) (*CoreRuleSet, error) {
 		return nil, fmt.Errorf("load the Core Rule Set: %w", err)
 	}
 
-	return &CoreRuleSet{waf: waf, bodyLimit: params.BodyLimit}, nil
+	return &CoreRuleSet{waf: waf, bodyLimit: params.BodyLimit, apps: params.Apps}, nil
 }
 
 // Result is what the Core Rule Set found in a request.
@@ -346,11 +361,12 @@ type Result struct {
 	Score int
 }
 
-// Inspect runs the Core Rule Set on r, a request from client: on its
-// method, its URL with the query, and its headers, the Cookie header
-// without the cookies in cookiesNotRead, and on body, r's body as the
-// caller has it, as readBody reads it. It returns what it found, what it
-// read of body, and the error that ended the reading early, if one did.
+// Inspect runs the Core Rule Set on r, a request from client, with the
+// fixes of the apps appsFor names for r's hostname: on its method, its URL
+// with the query, and its headers, the Cookie header without those apps'
+// cookies, and on body, r's body as the caller has it, as readBody reads
+// it. It returns what it found, what it read of body, and the error that
+// ended the reading early, if one did.
 func (c *CoreRuleSet) Inspect(
 	r *http.Request, client netip.Addr, body io.Reader,
 ) (Result, []byte, error) {
@@ -358,13 +374,24 @@ func (c *CoreRuleSet) Inspect(
 	// Closing would remove the files Coraza wrote, and it writes none.
 	defer func() { _ = tx.Close() }()
 
+	// The transaction's variables are set only through Coraza's interface
+	// for plugins.
+	state := tx.(plugintypes.TransactionState) //nolint:forcetypeassert // every one is
+
+	var cookiesNotRead []string
+
+	for _, name := range c.appsFor(r.Host) {
+		state.Variables().TX().Set("app_"+name, []string{"1"})
+		cookiesNotRead = append(cookiesNotRead, apps[name].cookies...)
+	}
+
 	tx.ProcessConnection(client.String(), 0, "", 0)
 	tx.ProcessURI(r.URL.String(), r.Method, r.Proto)
 
 	for name, values := range r.Header {
 		for _, value := range values {
 			if name == "Cookie" {
-				value = withoutCookiesNotRead(value)
+				value = withoutCookies(value, cookiesNotRead)
 				if value == "" {
 					continue // it held those cookies alone
 				}
@@ -457,9 +484,26 @@ func score(tx types.Transaction) int {
 	return n
 }
 
-// withoutCookiesNotRead returns value, a Cookie header's, without the
-// cookies in cookiesNotRead.
-func withoutCookiesNotRead(value string) string {
+// appsFor returns the names of the apps whose fixes a request for host,
+// its Host header, gets: every app while SWW_APPS is unset, and otherwise
+// those SWW_APPS lists for host's name, without the port and in
+// lowercase.
+func (c *CoreRuleSet) appsFor(host string) []string {
+	if c.apps == nil {
+		return AppNames()
+	}
+
+	hostname, _, err := net.SplitHostPort(host)
+	if err != nil {
+		hostname = host // it has no port
+	}
+
+	return c.apps[strings.ToLower(hostname)]
+}
+
+// withoutCookies returns value, a Cookie header's, without the cookies
+// named in cookiesNotRead.
+func withoutCookies(value string, cookiesNotRead []string) string {
 	var kept []string
 
 	for cookie := range strings.SplitSeq(value, ";") {

internal/waf/waf_test.go

@@ -120,8 +120,8 @@ func atDefaults(t *testing.T) *waf.CoreRuleSet {
 }
 
 // wantChange checks that crs lets through passes, a gitea request one of
-// the eight changes is for, and still finds result in refused, a request
-// like it that the change is not for.
+// the six changes or gitea's fixes are for, and still finds result in
+// refused, a request like it that they are not for.
 func wantChange(
 	t *testing.T, crs *waf.CoreRuleSet, passes, refused request, result waf.Result,
 ) {
@@ -381,6 +381,96 @@ func TestImagePushThatReusesALayerIsNotCheckedForCommandNames(t *testing.T) {
 		matched(930120, 932160))
 }
 
+// giteaFixed are gitea requests that only gitea's fixes let through, one
+// for each kind of fix, each with what the Core Rule Set finds in it
+// without them.
+//
+//nolint:gochecknoglobals // a constant cannot be a list
+var giteaFixed = []struct {
+	request request
+	result  waf.Result
+}{
+	// A search of code, on the path of gitea's search.
+	{get("/explore/code?q=SELECT%20*%20FROM%20users%20WHERE"), matched(942100)},
+	// A file name, in a parameter gitea sends names in, on any path.
+	{get("/?path=.gitignore"), matched(930120)},
+	// A file name, in a cookie of gitea's.
+	{
+		get("/owner/repo", "Cookie: gitea_flash=success%3DFile%2Bpackage.json%2Bdeleted"),
+		matched(930120),
+	},
+}
+
+// The hostnames of the tests of SWW_APPS: the one that serves gitea, and
+// one that serves another app.
+const (
+	giteaHost = "git.example"
+	otherHost = "blog.example"
+)
+
+// withHost returns r sent to host.
+func withHost(r request, host string) request {
+	return request{r.method, r.target, append([]string{"Host: " + host}, r.headers...)}
+}
+
+// servingApps returns the Core Rule Set at the defaults, with SWW_APPS
+// giving apps.
+func servingApps(t *testing.T, apps map[string][]string) *waf.CoreRuleSet {
+	t.Helper()
+
+	crs, err := waf.New(waf.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, Apps: apps,
+	})
+	if err != nil {
+		t.Fatalf("load the Core Rule Set: %v", err)
+	}
+
+	return crs
+}
+
+func TestAppsUnsetGivesEveryHostnameEveryAppsFixes(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, nil)
+
+	for _, fixed := range giteaFixed {
+		for _, host := range []string{giteaHost, otherHost} {
+			wantResult(t, crs, withHost(fixed.request, host), waf.Result{})
+		}
+	}
+}
+
+func TestListedHostnameGetsItsAppsFixes(t *testing.T) {
+	t.Parallel()
+
+	crs := servingApps(t, map[string][]string{giteaHost: {"gitea"}})
+
+	// The hostname is matched without the port and without regard to case.
+	for _, host := range []string{giteaHost, "GIT.Example:8443"} {
+		for _, fixed := range giteaFixed {
+			wantResult(t, crs, withHost(fixed.request, host), waf.Result{})
+		}
+	}
+}
+
+func TestUnlistedHostnameGetsTheFullCheck(t *testing.T) {
+	t.Parallel()
+
+	for _, apps := range []map[string][]string{
+		{giteaHost: {"gitea"}},
+		// SWW_APPS set empty lists no hostname.
+		{},
+	} {
+		crs := servingApps(t, apps)
+
+		for _, host := range []string{otherHost, otherHost + ":8443", "git.example.org"} {
+			for _, fixed := range giteaFixed {
+				wantResult(t, crs, withHost(fixed.request, host), fixed.result)
+			}
+		}
+	}
+}
+
 // withExclusions returns the Core Rule Set at the defaults, with the
 // exclusions file at path.
 func withExclusions(path string) (*waf.CoreRuleSet, error) {

script/example-app

@@ -187,16 +187,15 @@ main() {
     echo "example-app: rproxy passes a request to the app and its answer back"
 
     refused || fail "a second request in a minute was not refused"
-    wait_for "discriminator logged no ban" \
-        logged "$DISCRIMINATOR" '"action":"client_is_rate_limited"'
+    wait_for "discriminator logged no ban" logged "$DISCRIMINATOR" '"action":"rate_limited"'
     echo "example-app: a second request in a minute bans the client"
 
     refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
     wait_for "discriminator logged no ban for the probe" \
-        logged "$DISCRIMINATOR" '"action":"temporarily_banned"' '"rule_ids":["env-file"]'
+        logged "$DISCRIMINATOR" '"action":"banned"' '"rule_ids":["env-file"]'
     refused_from 203.0.113.9 / || fail "the client of the probe was let through"
     wait_for "the client's next request did not make its ban permanent" \
-        logged "$DISCRIMINATOR" '"action":"permanently_banned"' '"ban_expires":"permanent"'
+        logged "$DISCRIMINATOR" '"ban_expires":"permanent"'
     echo "example-app: a probe for /.env bans the client, its next request for good"
 
     docker exec "$DISCRIMINATOR" sv stop sww >/dev/null ||
@@ -233,7 +232,7 @@ main() {
     start_app
     refused || fail "the new discriminator container let the banned client through"
     wait_for "discriminator logged no request refused under the ban" \
-        logged "$DISCRIMINATOR" '"action":"temporarily_banned"'
+        logged "$DISCRIMINATOR" '"action":"banned"'
     echo "example-app: a new discriminator container on the same volume keeps the ban"
 
     docker rm --force "$DISCRIMINATOR" >/dev/null