Say which bytes the byte limits count, and what passing one does (closes #203)

Documents only. The byte limits and byte anomaly thresholds count body
bytes, as SWW_BYTES_COUNT chooses them, with WebSocket traffic each way,
once a response has ended; the request that passes a limit is not cut
off and the client is banned. README.md, SPEC.md and docs/ now say so,
and no longer call a response's bytes the request's. Also made plain:
rate limits, the refusal threshold, SWRP_MAX_REQUEST_TIME_MS,
SWW_LOOKUP_SOURCE, the metrics' byte series, and the SPEC.md claim about
answering within SWRP_TIMEOUT_MS. EVALUATION.md is audited too; its
survey facts and date are unchanged.

Model: fable-5-1 (first audit); opus-5-5 (rework)

EVALUATION.md

@@ -24,19 +24,14 @@ configured only by environment variables, that provides:
 
 ## Verdict
 
-Nothing existing is suitable. No surveyed tool meets R8, which asks for limits
+Nothing existing is suitable. No surveyed tool meets R8 (scaling limits by AS
-scaled by AS number or country. None meets R4's alerts on bytes transferred. The
+number or country) or R4's alerts on bytes transferred, and the tools that come
-tools that come closest on the rest fail R10: they need several containers, YAML
+closest on the rest fail R10: they need several containers, YAML or a web UI.
-or a web UI. The recommendation is to build a small single-binary sidecar;
+The recommendation is to build a small single-binary sidecar; `SPEC.md` in this
-`SPEC.md` in this directory begins that spec.
+directory begins that spec. The sidecar reuses the mature parts of the surveyed
-
+field as libraries and data sources (Coraza and the OWASP Core Rule Set for
-The sidecar reuses the mature parts of the surveyed field instead of
+attack detection, DNSBLs, AbuseIPDB, optionally a CrowdSec decision feed)
-reimplementing them. It takes these as libraries and data sources:
+instead of reimplementing them.
-
-- Coraza and the OWASP Core Rule Set, for attack detection
-- DNSBLs
-- AbuseIPDB
-- optionally, a CrowdSec decision feed
 
 Closest existing options, and why each still falls short:
 
@@ -50,16 +45,13 @@ Closest existing options, and why each still falls short:
       external blacklist URLs, optional CrowdSec), R7 partly (AS number used for
       blacklist and whitelist decisions), R9 (ModSecurity with the Core Rule
       Set, or Coraza plugin), env-var settings.
-    - Fails:
+    - Fails: R8 (AS number and country can only allow or deny, never scale a
-        - R8: AS number and country can only allow or deny, never scale a limit.
+      limit), R4 (no alerts on request-count or byte thresholds in the free
-        - R4: no alerts on request-count or byte thresholds in the free edition;
+      edition; reporting is a paid feature), R5 escalation, and R10's plain
-          reporting is a paid feature.
+      sidecar: since 1.6 it needs a `bunkerweb` container plus a `bw-scheduler`
-        - R5: no escalation for repeat offenders.
+      container and a database, or the all-in-one image that bundles nginx,
-        - R10: since 1.6 it is not one plain sidecar. It needs a `bunkerweb`
+      scheduler, UI and Redis in one container. It is designed as the proxy in
-          container, a `bw-scheduler` container and a database, or the
+      front of many sites, not as a sidecar for one app. AGPL-3.0.
-          all-in-one image that bundles nginx, the scheduler, the UI and Redis.
-    - It is designed as the proxy in front of many sites, not as a sidecar for
-      one app. AGPL-3.0.
     - Unverified: whether several rates (minute, hour, day) can be stacked on
       the same URL pattern; the documented design is one rate per URL pattern.
 - CrowdSec is the strongest detection and ban engine, but it is not a proxy.
@@ -74,13 +66,10 @@ Closest existing options, and why each still falls short:
       listed AS numbers is possible, but each is a hand-written YAML scenario,
       it reacts after the fact by banning, and it is not an inline limiter that
       answers 429.
-    - Fails:
+    - Fails: R10 (needs the security engine container with persistent state, log
-        - R10, because it needs:
+      acquisition from traefik, a bouncer such as the traefik plugin, and YAML
-            - the security engine container with persistent state
+      for acquisition, profiles, scenarios and notifications), R4's alerts on
-            - log acquisition from traefik
+      bytes.
-            - a bouncer such as the traefik plugin
-            - YAML for acquisition, profiles, scenarios and notifications
-        - R4's alerts on bytes.
 - CrowdSec plus traefik's own `rateLimit` middleware is the best combination
   with no new code. It gives inline limiting (one window per middleware, keyed
   by IP, with `sourceCriterion` exclusions), bans with escalation, alerts and

README.md

@@ -230,7 +230,7 @@ Every setting the code reads, with its default:
 | `SWRP_TIMEOUT_MS`                        | `2000`                                                                         | How long `rproxy` waits for `discriminator`'s answer to a question and to a report, in milliseconds.                                                                                                                                                            |
 | `SWRP_DEFAULT_DISPOSITION`               | `allow`                                                                        | What `rproxy` does with a request when `discriminator` cannot be reached or does not answer in time: `allow` passes it to the app, `deny` answers `503`.                                                                                                        |
 | `SWRP_MAX_REQUEST_SIZE`                  | `100M`                                                                         | The largest request body, a size or `off`; a larger one is answered `413`.                                                                                                                                                                                      |
-| `SWRP_MAX_RESPONSE_SIZE`                 | `1G`                                                                           | The largest response body, a size or `off`. The visitor gets `502` in place of a larger one, or it is cut off if it has already started.                                                                                                                        |
+| `SWRP_MAX_RESPONSE_SIZE`                 | `1G`                                                                           | The largest response body, a size or `off`; a larger one is answered `502`, or cut off once it has started.                                                                                                                                                     |
 | `SWRP_MAX_REQUEST_TIME_MS`               | `60000`                                                                        | Two time limits, each this long, in milliseconds or `off`: one for the visitor to send its request line and headers, then one for the whole request to reach the app.                                                                                           |
 | `SWRP_MAX_RESPONSE_TIME_MS`              | `1800000`                                                                      | How long the answer may take, from the end of the request to its last byte reaching the visitor, in milliseconds or `off`.                                                                                                                                      |
 | `SWW_LISTEN_ADDR`                        | `:8080`                                                                        | Where `discriminator` listens; leave the host part empty.                                                                                                                                                                                                       |
@@ -240,20 +240,20 @@ Every setting the code reads, with its default:
 | `SWW_MAX_TRACKED_CLIENTS`                | `20000`                                                                        | The most clients kept, in memory and in `clients.json`; the least recently seen is dropped first.                                                                                                                                                               |
 | `SWW_MAX_BANS`                           | `5000`                                                                         | The most bans `discriminator` keeps of its own; bans an admin made do not count.                                                                                                                                                                                |
 | `SWW_ALLOW_NETS`                         | empty                                                                          | Netblocks whose clients skip every check, such as your monitoring.                                                                                                                                                                                              |
-| `SWW_RATE_LIMIT_EXEMPT_NETS`             | empty                                                                          | Netblocks exempt from the request and byte limits: their clients are neither counted nor refused.                                                                                                                                                               |
+| `SWW_RATE_LIMIT_EXEMPT_NETS`             | empty                                                                          | Netblocks whose clients the request and byte limits neither count nor refuse.                                                                                                                                                                                   |
 | `SWW_DENY_NETS`                          | empty                                                                          | Netblocks whose clients are refused.                                                                                                                                                                                                                            |
 | `SWW_RATE_LIMIT_PER_MINUTE`              | `120`                                                                          | The most requests a client may make in a minute, a count or `off`; the next request is refused and bans the client.                                                                                                                                             |
 | `SWW_RATE_LIMIT_PER_HOUR`                | `1500`                                                                         | The most requests a client may make in an hour, a count or `off`; the next request is refused and bans the client.                                                                                                                                              |
 | `SWW_RATE_LIMIT_PER_DAY`                 | `6000`                                                                         | The most requests a client may make in a day, a count or `off`; the next request is refused and bans the client.                                                                                                                                                |
-| `SWW_RATE_LIMIT_EXEMPT_PATHS`            | empty                                                                          | Path prefixes exempt from the request and byte limits, such as `/assets/`: their requests are neither counted nor refused.                                                                                                                                      |
+| `SWW_RATE_LIMIT_EXEMPT_PATHS`            | empty                                                                          | Path prefixes whose requests the request and byte limits neither count nor refuse, such as `/assets/`.                                                                                                                                                          |
-| `SWW_BYTES_LIMIT_PER_MINUTE`             | `off`                                                                          | The most bytes counted for a client in a minute, a size or `off`. `SWW_BYTES_COUNT` says which bytes count: response bodies, request bodies or both. The request that passes the limit is not cut off, and the client is banned when its response ends.         |
+| `SWW_BYTES_LIMIT_PER_MINUTE`             | `off`                                                                          | The most bytes counted for a client in a minute, a size or `off`: response bodies, request bodies or both, as `SWW_BYTES_COUNT` says. The request that passes the limit is not cut off, and the client is banned when its response ends.                        |
-| `SWW_BYTES_LIMIT_PER_HOUR`               | `50G`                                                                          | The most bytes counted for a client in an hour, a size or `off`. `SWW_BYTES_COUNT` says which bytes count: response bodies, request bodies or both. The request that passes the limit is not cut off, and the client is banned when its response ends.          |
+| `SWW_BYTES_LIMIT_PER_HOUR`               | `50G`                                                                          | The most bytes counted for a client in an hour, a size or `off`: response bodies, request bodies or both, as `SWW_BYTES_COUNT` says. The request that passes the limit is not cut off, and the client is banned when its response ends.                         |
-| `SWW_BYTES_LIMIT_PER_DAY`                | `100G`                                                                         | The most bytes counted for a client in a day, a size or `off`. `SWW_BYTES_COUNT` says which bytes count: response bodies, request bodies or both. The request that passes the limit is not cut off, and the client is banned when its response ends.            |
+| `SWW_BYTES_LIMIT_PER_DAY`                | `100G`                                                                         | The most bytes counted for a client in a day, a size or `off`: response bodies, request bodies or both, as `SWW_BYTES_COUNT` says. The request that passes the limit is not cut off, and the client is banned when its response ends.                           |
 | `SWW_BYTES_COUNT`                        | `both`                                                                         | What the byte limits and the byte anomaly thresholds count: `response`, the app's response bodies; `request`, the visitors' request bodies; or `both`. What the visitor sent over a WebSocket counts as request bytes, and what the app sent as response bytes. |
 | `SWW_ERROR_BURST_THRESHOLD`              | `30`                                                                           | The most refusals a client may get in a minute from a rule file, a trap path or the Core Rule Set, a count or `off`. The next one bans the client.                                                                                                              |
 | `SWW_BAN_RESPONSE`                       | `403`                                                                          | How a refused client is answered: `403`, `429` or `close`, which drops the connection.                                                                                                                                                                          |
 | `SWW_LIMIT_BAN_DURATION`                 | `1h`                                                                           | The ban for a first broken limit.                                                                                                                                                                                                                               |
-| `SWW_LIMIT_BAN_REPEAT_WINDOW`            | `24h`                                                                          | A client that breaks a limit again within this time after its last such ban ended gets a ban three times as long.                                                                                                                                               |
+| `SWW_LIMIT_BAN_REPEAT_WINDOW`            | `24h`                                                                          | A limit broken again within this time after the last such ban ended gets a ban three times as long.                                                                                                                                                             |
 | `SWW_MAX_BAN_DURATION`                   | `7d`                                                                           | A ban for a broken limit that would be longer than this is permanent instead.                                                                                                                                                                                   |
 | `SWW_ATTACK_BAN_DURATION`                | `7d`                                                                           | The ban for a first clear sign of attack: a `ban` rule or a trap path.                                                                                                                                                                                          |
 | `SWW_BAN_SCOPE_V4_PREFIX`                | `32`                                                                           | The prefix length of the netblock a ban on an IPv4 client covers, from 0 to 32.                                                                                                                                                                                 |

docs/settings.md

@@ -130,10 +130,9 @@ cut off; the client is banned.
 
 - `SWW_BYTES_LIMIT_PER_MINUTE` (default `off`), `SWW_BYTES_LIMIT_PER_HOUR`
   (default `50G`) and `SWW_BYTES_LIMIT_PER_DAY` (default `100G`): the most bytes
-  counted for a client in each window, a size or `off`. `SWW_BYTES_COUNT` says
+  counted for a client in each window, a size or `off`: response bodies, request
-  which bytes count: response bodies, request bodies or both. The request that
+  bodies or both, as `SWW_BYTES_COUNT` says. The request that passes the limit
-  passes the limit is not cut off, and the client is banned when its response
+  is not cut off, and the client is banned when its response ends.
-  ends.
 - `SWW_BYTES_COUNT` (default `both`): what the byte limits and the byte anomaly
   thresholds count: `response`, the app's response bodies; `request`, the
   visitors' request bodies; or `both`. What the visitor sent over a WebSocket