Byte limits per client over a minute, an hour and a day (closes #20)

SWWAF_BYTES_LIMIT_PER_MINUTE, _PER_HOUR and _PER_DAY (10G, 20G, 50G)
and SWWAF_BYTES_COUNT (both). A request's bytes are counted once its
answer has ended, for a request passed to the app that the rate limits
count; what a WebSocket carries each way, once it closes. Bytes over a
limit ban the client as a broken rate limit does, and cut nothing
short. clients.json keeps the byte buckets, the log line's counts carry
the byte totals, ban notes say what the limit is on, and the limit hits
metric is labelled by kind.

Judgement call: limit_hit names a byte window minute_bytes, hour_bytes
or day_bytes, as counts names the byte totals.
Judgement call: in observe mode, the bytes of a request enforce mode
would have refused are not counted.

Model: opus-5-5

internal/alerts/alerts.go

@@ -1,6 +1,5 @@
-// Package alerts sends alerts on bans, on traffic over an anomaly
+// Package alerts sends alerts on bans, on a source that fails and on a
-// threshold, on a source that fails and on a file with an error to each
+// file with an error to each destination set: to the webhook
-// destination set: to the webhook
 // SWWAF_ALERT_WEBHOOK_URL names, each as one JSON object, as the "Alert
 // webhook schema" section of SPEC.md describes, to the Slack incoming
 // webhook SWWAF_ALERT_SLACK_WEBHOOK_URL names, as a message, and to the
@@ -41,27 +40,20 @@ const (
 	// EventPermanentBan is a permanent ban smallwebwaf made, or a ban it
 	// made permanent.
 	EventPermanentBan = "permanent_ban"
-	// EventAnomaly is a count of requests or bytes over an anomaly
+	// EventWAFBlock, EventAnomaly and EventReputationHit come with the
-	// threshold.
+	// Core Rule Set, the anomaly thresholds and the reputation sources;
-	EventAnomaly = "anomaly"
+	// nothing raises them yet.
-	// EventWAFBlock comes with the Core Rule Set; nothing raises it yet.
+	EventWAFBlock      = "waf_block"
-	EventWAFBlock = "waf_block"
+	EventAnomaly       = "anomaly"
-	// EventReputationHit is a request whose client a blocklist or a DNSBL
-	// zone lists, or whose AbuseIPDB score is a hit.
 	EventReputationHit = "reputation_hit"
-	// EventSourceFailure is GeoJS failing or refusing smallwebwaf, a fetch
+	// EventSourceFailure is GeoJS failing or refusing smallwebwaf.
-	// of a list failing, a query to a DNSBL zone or a check with AbuseIPDB
-	// failing or refused, or the day's AbuseIPDB checks used up.
 	EventSourceFailure = "source_failure"
 	// EventFileError is a rule file or state file edited while smallwebwaf
 	// runs that does not parse, a replacement of the lookup database that
 	// cannot be read, or a state file that cannot be written.
 	EventFileError = "file_error"
-	// EventSummary is the summary sent as an hour ends: of the alerts held
+	// EventSummary is the summary of the alerts an hour held back past
-	// back in it past SWWAF_ALERT_MAX_PER_HOUR, and of the repeats held
+	// SWWAF_ALERT_MAX_PER_HOUR. SWWAF_ALERT_EVENTS does not name it.
-	// back by the cooldowns dropped as it ends, which no alert let through
-	// has given. It is sent with SWWAF_ALERT_MAX_PER_HOUR off too, for
-	// those repeats. SWWAF_ALERT_EVENTS does not name it.
 	EventSummary = "summary"
 )
 
@@ -161,22 +153,18 @@ type Alert struct {
 	ASName   string       `json:"as_name"`
 	Country  string       `json:"country"`
 	// Reason is a short sentence, and Detail what is particular to the
-	// event: for a file_error, its "file", for a source_failure, its
+	// event: for a file_error, its "file", and for a source_failure, its
-	// "source", and for an anomaly, its "scope", with the "asn" or the
+	// "source", which the cooldown tells repeats by.
-	// "name" of some scopes, which the cooldown tells repeats by.
 	Reason string         `json:"reason"`
 	Detail map[string]any `json:"detail"`
 	// SuppressedRepeats is how many repeats of the alert the cooldown
-	// held back since the last one let through. For a summary, it is how
+	// held back since the last one let through.
-	// many the cooldowns dropped as the hour ended had held back that no
-	// alert let through gave.
 	SuppressedRepeats int `json:"suppressed_repeats"`
 }
 
-// Cooldown is, for an event on a netblock, about a file or a source, or
+// Cooldown is, for an event on a netblock, or about a file or a source,
-// for an anomaly in a scope, when the last alert let through was raised,
+// when the last alert let through was raised, and how many repeats the
-// and how many repeats the cooldown has held back since, as alerts.json
+// cooldown has held back since, as alerts.json holds it.
-// holds it.
 //
 //nolint:tagliatelle // the state files use snake_case, as the request log does
 type Cooldown struct {
@@ -184,9 +172,6 @@ type Cooldown struct {
 	Netblock          netip.Prefix `json:"netblock"`
 	File              string       `json:"file,omitempty"`
 	Source            string       `json:"source,omitempty"`
-	Scope             string       `json:"scope,omitempty"`
-	ASN               string       `json:"asn,omitempty"`
-	Name              string       `json:"name,omitempty"`
 	Sent              time.Time    `json:"sent"`
 	SuppressedRepeats int          `json:"suppressed_repeats"`
 }
@@ -229,7 +214,7 @@ type Queue struct {
 
 	mu sync.Mutex
 	// cooldowns are the alerts last let through, by event and netblock,
-	// file, source or scope.
+	// file or source.
 	cooldowns map[cooldownKey]*Cooldown
 	hour      Hour
 
@@ -263,28 +248,21 @@ type destination struct {
 }
 
 // cooldownKey is what makes an alert a repeat of another: the same event
-// on the same netblock, and about the same file or source, or in the same
+// on the same netblock, and about the same file or source, as its detail
-// scope with the same AS number or name, as its detail names them. Each
+// names them. Each is empty for an alert without one.
-// is empty for an alert without one.
 type cooldownKey struct {
 	event    string
 	netblock netip.Prefix
 	file     string
 	source   string
-	scope    string
-	asn      string
-	name     string
 }
 
 // cooldownKeyOf returns what makes another alert a repeat of alert.
 func cooldownKeyOf(alert *Alert) cooldownKey {
 	file, _ := alert.Detail["file"].(string)
 	source, _ := alert.Detail["source"].(string)
-	scope, _ := alert.Detail["scope"].(string)
-	asn, _ := alert.Detail["asn"].(string)
-	name, _ := alert.Detail["name"].(string)
 
-	return cooldownKey{alert.Event, alert.Netblock, file, source, scope, asn, name}
+	return cooldownKey{alert.Event, alert.Netblock, file, source}
 }
 
 // New returns a Queue with no alert yet.
@@ -317,14 +295,14 @@ func New(params Params) *Queue {
 // unless no destination is set or SWWAF_ALERT_EVENTS leaves its event
 // out. It gives alert the instance and the time. An alert that repeats
 // the last one let through less than Cooldown before is held back and
-// counted. The next one let through gives that count, unless an hour of
+// counted, and the next one let through gives that count. Past MaxPerHour
-// the clock ends first after the cooldown has run out: the cooldown is
+// alerts let through in the hour under way, by the clock, an alert is
-// then dropped, and that hour's summary gives the count. Past MaxPerHour
+// held back for that hour's summary instead, which is sent once the hour
-// alerts let through in the hour under way, an alert is held back for
+// has ended; it starts no cooldown, and the repeats held back before it
-// that hour's summary instead, which is sent once the hour has ended; it
+// are given by the next alert let through. Raise never waits: an alert
-// starts no cooldown. Raise never waits: an alert let through joins the
+// let through joins the queue of each destination, from which Run sends
-// queue of each destination, from which Run sends it, and with queueSize
+// it, and with queueSize alerts waiting for a destination, the oldest is
-// alerts waiting for a destination, the oldest is dropped.
+// dropped.
 func (q *Queue) Raise(alert Alert) {
 	if len(q.destinations) == 0 || !slices.Contains(q.params.Events, alert.Event) {
 		return
@@ -447,8 +425,7 @@ func (q *Queue) Suppressed() int64 {
 }
 
 // Snapshot returns the queue's state, as alerts.json holds it, with the
-// cooldowns sorted by netblock, then by event, file, source, scope, AS
+// cooldowns sorted by netblock, then by event, file and source.
-// number and name.
 func (q *Queue) Snapshot() State {
 	q.mu.Lock()
 	defer q.mu.Unlock()
@@ -466,9 +443,7 @@ func (q *Queue) Snapshot() State {
 
 	slices.SortFunc(state.Cooldowns, func(a, b Cooldown) int {
 		return cmp.Or(a.Netblock.Compare(b.Netblock), cmp.Compare(a.Event, b.Event),
-			cmp.Compare(a.File, b.File), cmp.Compare(a.Source, b.Source),
+			cmp.Compare(a.File, b.File), cmp.Compare(a.Source, b.Source))
-			cmp.Compare(a.Scope, b.Scope), cmp.Compare(a.ASN, b.ASN),
-			cmp.Compare(a.Name, b.Name))
 	})
 
 	for _, d := range q.destinations {
@@ -491,10 +466,7 @@ func (q *Queue) Load(state State) {
 
 	for _, cooldown := range state.Cooldowns {
 		cooldown.Netblock = cooldown.Netblock.Masked()
-		key := cooldownKey{
+		key := cooldownKey{cooldown.Event, cooldown.Netblock, cooldown.File, cooldown.Source}
-			cooldown.Event, cooldown.Netblock, cooldown.File, cooldown.Source,
-			cooldown.Scope, cooldown.ASN, cooldown.Name,
-		}
 		q.cooldowns[key] = &cooldown
 	}
 
@@ -566,64 +538,46 @@ func (q *Queue) startCooldown(alert *Alert, now time.Time) {
 
 	q.cooldowns[key] = &Cooldown{
 		Event: alert.Event, Netblock: alert.Netblock, File: key.file, Source: key.source,
-		Scope: key.scope, ASN: key.asn, Name: key.name, Sent: now,
+		Sent: now,
 	}
 }
 
-// endHour ends the hour under way, if now is past it. It drops the
+// endHour ends the hour under way, if now is past it: it queues that
-// cooldowns that have run out, whatever repeats they held back, so that
+// hour's summary when alerts were held back in it past MaxPerHour, and
-// they do not pile up, and queues that hour's summary when alerts were
+// forgets the cooldowns that have run out with no repeat held back, which
-// held back in it past MaxPerHour, or when a cooldown dropped had held
+// no alert needs any more.
-// back repeats, which no alert let through has given: the summary gives
-// them.
 func (q *Queue) endHour(now time.Time) {
 	start := now.Truncate(time.Hour)
 	if !start.After(q.hour.Start) {
 		return
 	}
 
-	repeats := 0
-
-	for key, cooldown := range q.cooldowns {
-		if now.Sub(cooldown.Sent) >= q.params.Cooldown {
-			repeats += cooldown.SuppressedRepeats
-
-			delete(q.cooldowns, key)
-		}
-	}
-
 	heldBack := 0
 	for _, count := range q.hour.HeldBack {
 		heldBack += count
 	}
 
-	var reasons []string
-
 	if heldBack > 0 {
-		reasons = append(reasons, fmt.Sprintf("%d alerts held back in the hour from %s, "+
-			"past the %d an hour SWWAF_ALERT_MAX_PER_HOUR allows", heldBack,
-			q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour))
-	}
-
-	if repeats > 0 {
-		reasons = append(reasons, fmt.Sprintf("%d repeats held back by "+
-			"SWWAF_ALERT_COOLDOWN that no later alert gives", repeats))
-	}
-
-	if len(reasons) > 0 {
 		q.queue(&Alert{
 			Instance: q.params.Instance,
 			Time:     now,
 			Event:    EventSummary,
-			Reason:   strings.Join(reasons, "; "),
+			Reason: fmt.Sprintf("%d alerts held back in the hour from %s, past the %d "+
+				"an hour SWWAF_ALERT_MAX_PER_HOUR allows", heldBack,
+				q.hour.Start.Format(time.RFC3339), q.params.MaxPerHour),
 			Detail: map[string]any{
 				"hour": q.hour.Start, "count": heldBack, "events": q.hour.HeldBack,
 			},
-			SuppressedRepeats: repeats,
 		})
 	}
 
 	q.hour = Hour{Start: start, HeldBack: map[string]int{}}
+
+	for key, cooldown := range q.cooldowns {
+		if now.Sub(cooldown.Sent) >= q.params.Cooldown && cooldown.SuppressedRepeats == 0 {
+			delete(q.cooldowns, key)
+		}
+	}
 }
 
 // queue adds alert to the alerts waiting for each destination.

internal/alerts/alerts_test.go

@@ -381,7 +381,7 @@ func TestAlertsPastTheHourlyLimitAreRolledIntoOneSummary(t *testing.T) {
 	})
 }
 
-func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T) {
+func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheNextSent(t *testing.T) {
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
@@ -401,8 +401,8 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 		time.Sleep(cooldown)
 		raise()
 
-		// The summary gives the alert past the limit and the two repeats,
+		// The next hour's first alert gives the two repeats, and the summary
-		// and the next hour's first alert none.
+		// the alert past the limit.
 		time.Sleep(time.Hour - cooldown)
 		synctest.Wait()
 		raise()
@@ -413,14 +413,11 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 		got := webhook.received()
 		if len(got) == 3 {
 			detail, _ := got[1].alert["detail"].(map[string]any)
-			summaryRepeats := got[1].alert["suppressed_repeats"]
+			repeats := got[2].alert["suppressed_repeats"]
-			lastRepeats := got[2].alert["suppressed_repeats"]
 
-			if detail["count"] != float64(1) || summaryRepeats != float64(2) ||
+			if detail["count"] != float64(1) || repeats != float64(2) {
-				lastRepeats != float64(0) {
+				t.Errorf("the summary counts %v alerts, and the last alert gives %v "+
-				t.Errorf("the summary counts %v alerts and %v repeats, and the last "+
+					"repeats, want 1 and 2", detail["count"], repeats)
-					"alert gives %v repeats, want 1, 2 and 0", detail["count"],
-					summaryRepeats, lastRepeats)
 			}
 		}
 
@@ -428,70 +425,6 @@ func TestRepeatsBeforeAnAlertPastTheHourlyLimitAreGivenByTheSummary(t *testing.T
 	})
 }
 
-func TestCooldownsThatHaveRunOutAreDroppedAndTheirRepeatsSummedUp(t *testing.T) {
-	t.Parallel()
-
-	for name, maxPerHour := range map[string]int{"limit off": 0, "limit set": 60} {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			synctest.Test(t, func(t *testing.T) {
-				params := newParams()
-				params.MaxPerHour = maxPerHour
-				webhook, q := start(t, params)
-
-				// For four hours, a netblock of its own each minute is over an
-				// anomaly threshold twice: an alert, and a repeat the cooldown
-				// holds back.
-				netblocks := 0
-
-				for range 4 {
-					for range 60 {
-						anomaly := alerts.Alert{
-							Event: alerts.EventAnomaly, Netblock: netblock(netblocks),
-							Detail: map[string]any{"scope": "net"},
-						}
-						q.Raise(anomaly)
-						q.Raise(anomaly)
-
-						netblocks++
-
-						time.Sleep(time.Minute)
-					}
-
-					// As the hour ends, only the cooldowns started less than the
-					// cooldown before are kept, in memory and for alerts.json.
-					synctest.Wait()
-
-					kept := len(q.Snapshot().Cooldowns)
-					if kept > int(cooldown/time.Minute) {
-						t.Errorf("after %d netblocks, %d cooldowns are kept, want at most %d",
-							netblocks, kept, int(cooldown/time.Minute))
-					}
-				}
-
-				// An hour on, every cooldown has been dropped, and the summaries
-				// have given every repeat.
-				time.Sleep(time.Hour)
-				synctest.Wait()
-
-				repeats := 0.0
-
-				for _, request := range webhook.received() {
-					count, _ := request.alert["suppressed_repeats"].(float64)
-					repeats += count
-				}
-
-				kept := len(q.Snapshot().Cooldowns)
-				if kept != 0 || repeats != float64(netblocks) {
-					t.Errorf("%d cooldowns are kept and the webhook was given %v repeats, "+
-						"want 0 and %d", kept, repeats, netblocks)
-				}
-			})
-		})
-	}
-}
-
 func TestFailedRequestIsSentAgainWithBackoff(t *testing.T) {
 	t.Parallel()
 
@@ -702,8 +635,7 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 		after.Load(roundTrip(t, before.Snapshot()))
 
 		// The new queue sends the alert waiting, holds back the repeat as
-		// the cooldown still runs, and sends the summary of the hour, which
+		// the cooldown still runs, and sends the summary of the hour.
-		// gives both repeats, as the cooldown has run out.
 		after.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
 		synctest.Wait()
 		wantEvents(t, webhook, alerts.EventBan)
@@ -712,12 +644,18 @@ func TestStateLoadedIntoANewQueueCarriesOn(t *testing.T) {
 		synctest.Wait()
 		wantEvents(t, webhook, alerts.EventBan, alerts.EventSummary)
 
-		summary := webhook.received()[1].alert
+		detail, _ := webhook.received()[1].alert["detail"].(map[string]any)
-		detail, _ := summary["detail"].(map[string]any)
+		if detail["count"] != float64(1) {
+			t.Errorf("the summary counts %v alerts, want 1", detail["count"])
+		}
 
-		if detail["count"] != float64(1) || summary["suppressed_repeats"] != float64(2) {
+		// The cooldown has run out, and the next one gives both repeats.
-			t.Errorf("the summary counts %v alerts and %v repeats, want 1 and 2",
+		after.Raise(alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1)})
-				detail["count"], summary["suppressed_repeats"])
+		synctest.Wait()
+
+		got := webhook.received()
+		if repeats := got[len(got)-1].alert["suppressed_repeats"]; repeats != float64(2) {
+			t.Errorf("the last alert gives %v repeats, want 2", repeats)
 		}
 	})
 }
@@ -763,8 +701,8 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 		ban := alerts.Alert{Event: alerts.EventBan, Netblock: netblock(1), Reason: "a ban"}
 
 		// The hour's one alert, a repeat of it the cooldown holds back, and
-		// an alert past the limit; once the hour has ended, its summary,
+		// an alert past the limit; once the hour has ended, its summary, and
-		// which gives the repeat, and the next alert, which gives none.
+		// the next alert, which gives the repeat.
 		q.Raise(ban)
 		q.Raise(ban)
 		q.Raise(alerts.Alert{Event: alerts.EventFileError, Reason: "a file error"})
@@ -782,14 +720,14 @@ func TestSlackAndNtfyAreSentTheSummaryAndTheRepeatsHeldBack(t *testing.T) {
 		}
 
 		const summary = "1 alerts held back in the hour from 2000-01-01T00:00:00Z, " +
-			"past the 1 an hour SWWAF_ALERT_MAX_PER_HOUR allows; 1 repeats held back " +
+			"past the 1 an hour SWWAF_ALERT_MAX_PER_HOUR allows"
-			"by SWWAF_ALERT_COOLDOWN that no later alert gives\nsuppressed repeats: 1"
 
 		wantSlackMessage(t, slack[1], "*"+instance+": summary*\n"+summary)
 		wantNtfyMessage(t, ntfy[1], instance+": summary", "default bar_chart", summary)
-		wantSlackMessage(t, slack[2], "*"+instance+": ban*\na ban\nnetblock: 203.0.113.1/32")
+		wantSlackMessage(t, slack[2],
+			"*"+instance+": ban*\na ban\nnetblock: 203.0.113.1/32\nsuppressed repeats: 1")
 		wantNtfyMessage(t, ntfy[2], instance+": ban", "default no_entry",
-			"a ban\nnetblock: 203.0.113.1/32")
+			"a ban\nnetblock: 203.0.113.1/32\nsuppressed repeats: 1")
 	})
 }
 

internal/anomaly/anomaly.go

@@ -1,406 +0,0 @@
-// Package anomaly counts requests and bytes over a minute and an hour, per
-// client, per surrounding netblock, per AS number, for the whole service
-// and per named netblock, and raises an anomaly alert for a count over its
-// threshold, as "Anomaly thresholds" under "Configuration surface" in
-// SPEC.md describes. It refuses and bans nothing. At most 20,000 counters
-// are kept, in memory, and written to alerts.json and read from it by the
-// state package.
-package anomaly
-
-import (
-	"cmp"
-	"fmt"
-	"net/netip"
-	"slices"
-	"sync"
-	"time"
-
-	"github.com/hashicorp/golang-lru/v2/simplelru"
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-)
-
-// maxCounters is how many counters are kept. Past it, the counter counted
-// least recently is dropped, and starts afresh if it is counted again.
-const maxCounters = 20000
-
-// The scopes, what a counter counts, as the settings, alerts.json and the
-// alerts name them.
-const (
-	// ScopeClient is one client: an IPv4 address, or an IPv6 /64.
-	ScopeClient = "client"
-	// ScopeNet is the netblock around a client, SWWAF_ANOMALY_NET_V4_PREFIX
-	// or SWWAF_ANOMALY_NET_V6_PREFIX long.
-	ScopeNet = "net"
-	// ScopeASN is an AS number.
-	ScopeASN = "asn"
-	// ScopeTotal is the whole service.
-	ScopeTotal = "total"
-	// ScopeWatch is a named netblock of SWWAF_WATCH_NETS.
-	ScopeWatch = "watch"
-)
-
-// Scopes returns every scope.
-func Scopes() []string {
-	return []string{ScopeClient, ScopeNet, ScopeASN, ScopeTotal, ScopeWatch}
-}
-
-// The windows a counter counts in, as the alerts name them.
-const (
-	minute = "minute"
-	hour   = "hour"
-)
-
-// Thresholds are the most requests and the most bytes a scope may have
-// counted in a minute and in an hour before an alert is raised. Zero is
-// off.
-type Thresholds struct {
-	RequestsPerMinute int64
-	RequestsPerHour   int64
-	BytesPerMinute    int64
-	BytesPerHour      int64
-}
-
-// NamedNetblock is a netblock SWWAF_WATCH_NETS names.
-type NamedNetblock struct {
-	Name     string
-	Netblock netip.Prefix
-}
-
-// Params are what New needs.
-type Params struct {
-	// The thresholds of each scope: SWWAF_ANOMALY_CLIENT_*,
-	// SWWAF_ANOMALY_NET_*, SWWAF_ANOMALY_ASN_*, SWWAF_ANOMALY_TOTAL_* and
-	// SWWAF_WATCH_*.
-	Client, Net, ASN, Total, Watch Thresholds
-	// NetV4Prefix and NetV6Prefix are the lengths of the netblock around a
-	// client (SWWAF_ANOMALY_NET_V4_PREFIX and SWWAF_ANOMALY_NET_V6_PREFIX).
-	NetV4Prefix, NetV6Prefix int
-	// NamedNetblocks are SWWAF_WATCH_NETS.
-	NamedNetblocks []NamedNetblock
-	// Alerts receive the anomaly alerts.
-	Alerts *alerts.Queue
-}
-
-// Counter is one scope's counts, as alerts.json holds them: the scope,
-// with the netblock, the AS number or the name that tells it from the
-// others in that scope, and its two buckets of requests and of bytes in
-// the minute and in the hour. A bucket whose threshold is off counts
-// nothing, and is left out.
-//
-//nolint:tagliatelle // the state files use snake_case, as the request log does
-type Counter struct {
-	Scope       string            `json:"scope"`
-	Netblock    netip.Prefix      `json:"netblock,omitzero"`
-	ASN         string            `json:"asn,omitempty"`
-	Name        string            `json:"name,omitempty"`
-	Minute      ratelimit.Buckets `json:"minute,omitzero"`
-	Hour        ratelimit.Buckets `json:"hour,omitzero"`
-	MinuteBytes ratelimit.Buckets `json:"minute_bytes,omitzero"`
-	HourBytes   ratelimit.Buckets `json:"hour_bytes,omitzero"`
-}
-
-// Request is a request that has ended, as the counters count it.
-type Request struct {
-	// Client is the client's address, and ClientGroup the client it is
-	// counted as: its IPv4 address, or its IPv6 /64.
-	Client      netip.Addr
-	ClientGroup netip.Prefix
-	// ASN, ASName and Country are the client's as looked up, each "" when
-	// unknown.
-	ASN, ASName, Country string
-	// Bytes are the request's bytes, as SWWAF_BYTES_COUNT counts them.
-	Bytes int64
-}
-
-// Counters counts each request in the scopes it is in. It is safe for
-// concurrent use.
-type Counters struct {
-	params Params
-
-	mu       sync.Mutex
-	counters *simplelru.LRU[key, *Counter]
-}
-
-// key is what tells a counter from the others: its scope, with its
-// netblock, AS number or name.
-type key struct {
-	scope    string
-	netblock netip.Prefix
-	asn      string
-	name     string
-}
-
-// New returns Counters for params, with nothing counted yet.
-func New(params Params) *Counters {
-	counters, err := simplelru.NewLRU[key, *Counter](maxCounters, nil)
-	if err != nil {
-		panic(err) // NewLRU fails only for a size below one
-	}
-
-	return &Counters{params: params, counters: counters}
-}
-
-// Count counts r, a request that has ended, at now, in each scope it is
-// in whose thresholds are not all off: its client, the netblock around
-// it, its AS number once known, the whole service, and each named
-// netblock it is in. Only the counts whose threshold is set are counted.
-// For each scope whose count is over a threshold, it raises an anomaly
-// alert, for the first such count in the order requests and bytes in the
-// minute, then in the hour; the alert queue's cooldown holds back the
-// repeats. Nothing is refused or banned.
-func (c *Counters) Count(now time.Time, r Request) {
-	var raised []alerts.Alert
-
-	c.mu.Lock()
-
-	for _, scope := range c.scopesOf(r) {
-		counter, found := c.counters.Get(scope.key)
-		if !found {
-			counter = scope.key.counter()
-			c.counters.Add(scope.key, counter)
-		}
-
-		over, passed := counter.add(now, r.Bytes, scope.thresholds)
-		if passed {
-			raised = append(raised, alertFor(r, scope.key, over))
-		}
-	}
-
-	c.mu.Unlock()
-
-	for _, alert := range raised {
-		c.params.Alerts.Raise(alert)
-	}
-}
-
-// Snapshot returns every counter, sorted by scope, then by netblock, AS
-// number and name, as alerts.json lists them.
-func (c *Counters) Snapshot() []Counter {
-	c.mu.Lock()
-
-	counters := make([]Counter, 0, c.counters.Len())
-	for _, counter := range c.counters.Values() {
-		counters = append(counters, *counter)
-	}
-
-	c.mu.Unlock()
-
-	slices.SortFunc(counters, func(a, b Counter) int {
-		return cmp.Or(cmp.Compare(a.Scope, b.Scope), a.Netblock.Compare(b.Netblock),
-			cmp.Compare(a.ASN, b.ASN), cmp.Compare(a.Name, b.Name))
-	})
-
-	return counters
-}
-
-// Load puts counters, read from alerts.json, in place of those held, in
-// the order they were last counted, as the starts of their buckets tell,
-// so that the one counted least recently is dropped first. Each netblock
-// is masked to its length, so that 203.0.113.9/24 is 203.0.113.0/24.
-// Buckets whose time has passed at now are emptied, and a counter left
-// with every bucket empty is dropped.
-func (c *Counters) Load(counters []Counter, now time.Time) {
-	counters = slices.Clone(counters)
-	slices.SortStableFunc(counters, func(a, b Counter) int {
-		return a.lastStart().Compare(b.lastStart())
-	})
-
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	c.counters.Purge()
-
-	for _, counter := range counters {
-		counter.Netblock = counter.Netblock.Masked()
-		empty := true
-
-		for _, count := range counter.counts() {
-			if count.buckets.Passed(now, count.length) {
-				*count.buckets = ratelimit.Buckets{}
-			}
-
-			empty = empty && *count.buckets == ratelimit.Buckets{}
-		}
-
-		if !empty {
-			c.counters.Add(counter.key(), &counter)
-		}
-	}
-}
-
-// scope is a scope a request is counted in, and its thresholds.
-type scope struct {
-	key        key
-	thresholds Thresholds
-}
-
-// scopesOf returns the scopes r is in whose thresholds are not all off.
-func (c *Counters) scopesOf(r Request) []scope {
-	p := c.params
-	client := r.Client.Unmap()
-
-	all := []scope{
-		{key{scope: ScopeClient, netblock: r.ClientGroup}, p.Client},
-		{key{scope: ScopeNet, netblock: c.netAround(client)}, p.Net},
-		{key{scope: ScopeTotal}, p.Total},
-	}
-
-	if r.ASN != "" {
-		all = append(all, scope{key{scope: ScopeASN, asn: r.ASN}, p.ASN})
-	}
-
-	for _, named := range p.NamedNetblocks {
-		if named.Netblock.Contains(client) {
-			all = append(all, scope{
-				key{scope: ScopeWatch, netblock: named.Netblock, name: named.Name}, p.Watch,
-			})
-		}
-	}
-
-	return slices.DeleteFunc(all, func(s scope) bool {
-		return s.thresholds == Thresholds{}
-	})
-}
-
-// netAround returns the netblock around client that ScopeNet counts it
-// in: NetV4Prefix or NetV6Prefix long.
-func (c *Counters) netAround(client netip.Addr) netip.Prefix {
-	length := c.params.NetV6Prefix
-	if client.Is4() {
-		length = c.params.NetV4Prefix
-	}
-
-	return netip.PrefixFrom(client, length).Masked()
-}
-
-// overThreshold is a count over its threshold: what it counts, requests or
-// bytes, its window, the count and the threshold.
-type overThreshold struct {
-	kind, window string
-	count        float64
-	threshold    int64
-}
-
-// add counts a request of bytes at now in each of c's counts whose
-// threshold, in thresholds, is set, and returns the first count over its
-// threshold, and whether there is one.
-func (c *Counter) add(
-	now time.Time, bytes int64, thresholds Thresholds,
-) (overThreshold, bool) {
-	// In the order of counts.
-	inOrder := [4]int64{
-		thresholds.RequestsPerMinute, thresholds.BytesPerMinute,
-		thresholds.RequestsPerHour, thresholds.BytesPerHour,
-	}
-
-	var (
-		first  overThreshold
-		passed bool
-	)
-
-	for i, count := range c.counts() {
-		threshold := inOrder[i]
-		if threshold == 0 {
-			continue
-		}
-
-		n := int64(1)
-		if count.kind == ratelimit.KindBytes {
-			n = bytes
-		}
-
-		counted := count.buckets.Add(now, count.length, n)
-		if !passed && counted > float64(threshold) {
-			first = overThreshold{count.kind, count.window, counted, threshold}
-			passed = true
-		}
-	}
-
-	return first, passed
-}
-
-// bucketCount is one of a counter's four counts: requests or bytes, in a
-// window of length, and the buckets they are counted in.
-type bucketCount struct {
-	kind, window string
-	length       time.Duration
-	buckets      *ratelimit.Buckets
-}
-
-// counts returns c's counts: requests and bytes in the minute, then in
-// the hour.
-func (c *Counter) counts() [4]bucketCount {
-	return [4]bucketCount{
-		{ratelimit.KindRequests, minute, time.Minute, &c.Minute},
-		{ratelimit.KindBytes, minute, time.Minute, &c.MinuteBytes},
-		{ratelimit.KindRequests, hour, time.Hour, &c.Hour},
-		{ratelimit.KindBytes, hour, time.Hour, &c.HourBytes},
-	}
-}
-
-// lastStart returns the start of c's latest bucket, which tells, to the
-// minute or to the hour, when c was last counted.
-func (c *Counter) lastStart() time.Time {
-	var latest time.Time
-
-	for _, count := range c.counts() {
-		if count.buckets.Start.After(latest) {
-			latest = count.buckets.Start
-		}
-	}
-
-	return latest
-}
-
-// key returns what tells c from the other counters.
-func (c *Counter) key() key {
-	return key{scope: c.Scope, netblock: c.Netblock, asn: c.ASN, name: c.Name}
-}
-
-// counter returns a counter for k, with nothing counted yet.
-func (k key) counter() *Counter {
-	return &Counter{Scope: k.scope, Netblock: k.netblock, ASN: k.asn, Name: k.name}
-}
-
-// alertFor returns the anomaly alert for o, a count over its threshold in
-// the scope k, which r took over it. It gives r's client, with its AS
-// number, AS name and country, and the netblock counted, of a client, the
-// netblock around it or a named netblock. Its detail gives the scope, the
-// AS number or the name of a scope that has one, the window, what is
-// counted, the count and the threshold.
-func alertFor(r Request, k key, o overThreshold) alerts.Alert {
-	detail := map[string]any{
-		"scope": k.scope, "window": o.window, "kind": o.kind, "count": o.count,
-		"threshold": o.threshold,
-	}
-
-	var counted string
-
-	switch k.scope {
-	case ScopeClient:
-		counted = "the client " + k.netblock.String()
-	case ScopeNet:
-		counted = "the netblock " + k.netblock.String()
-	case ScopeASN:
-		counted = k.asn
-		detail["asn"] = k.asn
-	case ScopeTotal:
-		counted = "the whole service"
-	default: // watch
-		counted = "the named netblock " + k.name + ", " + k.netblock.String()
-		detail["name"] = k.name
-	}
-
-	return alerts.Alert{
-		Event:    alerts.EventAnomaly,
-		Client:   r.Client,
-		Netblock: k.netblock,
-		ASN:      r.ASN,
-		ASName:   r.ASName,
-		Country:  r.Country,
-		Reason: fmt.Sprintf("%s per %s of %s over the threshold of %d", o.kind, o.window,
-			counted, o.threshold),
-		Detail: detail,
-	}
-}

internal/anomaly/anomaly_test.go

@@ -1,238 +0,0 @@
-package anomaly_test
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/netip"
-	"net/url"
-	"reflect"
-	"slices"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-)
-
-// maxCounters is how many counters are kept.
-const maxCounters = 20000
-
-func TestEachScopeHasACooldownOfItsOwn(t *testing.T) {
-	t.Parallel()
-
-	queue := newQueue()
-	office := netip.MustParsePrefix("203.0.113.0/24")
-	overAtTheSecond := anomaly.Thresholds{RequestsPerMinute: 1}
-	counters := anomaly.New(anomaly.Params{
-		Client: overAtTheSecond, Net: overAtTheSecond, ASN: overAtTheSecond,
-		Total: overAtTheSecond, Watch: overAtTheSecond,
-		// The netblock around a client is the client's own, and two names
-		// name one netblock.
-		NetV4Prefix: 32,
-		NamedNetblocks: []anomaly.NamedNetblock{
-			{Name: "office", Netblock: office}, {Name: "hq", Netblock: office},
-		},
-		Alerts: queue,
-	})
-
-	// The first client's second request is over the threshold in the six
-	// scopes it is in. The other client's two are both over it in the whole
-	// service and in each named netblock, three repeats each, and its
-	// second is over it in the scopes of its own, its client, its netblock
-	// and its AS number, which are no repeats.
-	for _, r := range []anomaly.Request{
-		{Client: netip.MustParseAddr("203.0.113.9"), ASN: "AS64496"},
-		{Client: netip.MustParseAddr("203.0.113.10"), ASN: "AS64511"},
-	} {
-		r.ClientGroup = netip.PrefixFrom(r.Client, 32)
-
-		for range 2 {
-			counters.Count(midnight(), r)
-		}
-	}
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 9 || queue.Suppressed() != 6 {
-		t.Fatalf("%d alerts wait and %d are held back, want 9 and 6: %+v",
-			len(waiting), queue.Suppressed(), waiting)
-	}
-
-	// alerts.json keeps each scope's cooldown: each alert raised again
-	// after a restart is a repeat.
-	data, err := json.Marshal(queue.Snapshot())
-	if err != nil {
-		t.Fatalf("encode: %v", err)
-	}
-
-	var read alerts.State
-
-	err = json.Unmarshal(data, &read)
-	if err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-
-	after := newQueue()
-	after.Load(read)
-
-	for _, alert := range read.Waiting[alerts.DestinationWebhook] {
-		after.Raise(alert)
-	}
-
-	if after.Suppressed() != 9 {
-		t.Errorf("after loading, %d alerts are held back, want 9", after.Suppressed())
-	}
-}
-
-func TestKeepsAtMost20000CountersDroppingTheLeastRecentlyCounted(t *testing.T) {
-	t.Parallel()
-
-	counters := newCounters(anomaly.Params{
-		Client: anomaly.Thresholds{RequestsPerMinute: 1000},
-	})
-
-	for i := range maxCounters {
-		counters.Count(midnight(), request(i))
-	}
-
-	// Counted again, the first client is the most recently counted, and
-	// the second is dropped for a new one.
-	counters.Count(midnight(), request(0))
-	counters.Count(midnight(), request(maxCounters))
-
-	got := counters.Snapshot()
-	if len(got) != maxCounters || !holds(got, 0) || holds(got, 1) ||
-		!holds(got, maxCounters) {
-		t.Errorf("%d counters, holding the first client %v, the second %v and the "+
-			"new one %v, want %d, the first and the new one", len(got), holds(got, 0),
-			holds(got, 1), holds(got, maxCounters), maxCounters)
-	}
-}
-
-func TestLoadEmptiesBucketsWhoseTimeHasPassedAndDropsEmptyCounters(t *testing.T) {
-	t.Parallel()
-
-	counters := newCounters(anomaly.Params{
-		Net:         anomaly.Thresholds{RequestsPerMinute: 1000, RequestsPerHour: 1000},
-		Total:       anomaly.Thresholds{RequestsPerMinute: 1000},
-		NetV4Prefix: 24,
-	})
-	halfAnHourOn := midnight().Add(30 * time.Minute)
-
-	// Half an hour on, the hour's buckets count still, and the minute's
-	// do not.
-	counters.Load([]anomaly.Counter{
-		{
-			Scope:    anomaly.ScopeNet,
-			Netblock: netip.MustParsePrefix("203.0.113.9/24"),
-			Minute:   ratelimit.Buckets{Start: midnight(), Current: 5},
-			Hour:     ratelimit.Buckets{Start: midnight(), Current: 7},
-		},
-		{
-			Scope:  anomaly.ScopeTotal,
-			Minute: ratelimit.Buckets{Start: midnight(), Current: 1},
-		},
-	}, halfAnHourOn)
-
-	// The whole service's counter, left empty, is dropped, and the
-	// netblock read is masked to its length.
-	netblock := anomaly.Counter{
-		Scope:    anomaly.ScopeNet,
-		Netblock: netip.MustParsePrefix("203.0.113.0/24"),
-		Hour:     ratelimit.Buckets{Start: midnight(), Current: 7},
-	}
-	if got, want := counters.Snapshot(), []anomaly.Counter{netblock}; !reflect.DeepEqual(
-		got, want) {
-		t.Errorf("counters read\n%+v\nwant\n%+v", got, want)
-	}
-
-	// A request from the netblock is counted with the requests read.
-	counters.Count(halfAnHourOn, anomaly.Request{
-		Client:      netip.MustParseAddr("203.0.113.9"),
-		ClientGroup: netip.MustParsePrefix("203.0.113.9/32"),
-	})
-
-	netblock.Minute = ratelimit.Buckets{Start: halfAnHourOn, Current: 1}
-	netblock.Hour.Current = 8
-	want := []anomaly.Counter{netblock, {
-		Scope:  anomaly.ScopeTotal,
-		Minute: ratelimit.Buckets{Start: halfAnHourOn, Current: 1},
-	}}
-
-	if got := counters.Snapshot(); !reflect.DeepEqual(got, want) {
-		t.Errorf("counters after a request\n%+v\nwant\n%+v", got, want)
-	}
-}
-
-func TestLoadDropsTheLeastRecentlyCountedFirst(t *testing.T) {
-	t.Parallel()
-
-	counters := newCounters(anomaly.Params{
-		Client: anomaly.Thresholds{RequestsPerMinute: 1000},
-	})
-	now := midnight().Add(time.Minute)
-
-	// The second half of the file was counted in the minute before the
-	// first half.
-	read := make([]anomaly.Counter, 0, maxCounters)
-	for i := range maxCounters {
-		start := now
-		if i >= maxCounters/2 {
-			start = midnight()
-		}
-
-		read = append(read, anomaly.Counter{
-			Scope: anomaly.ScopeClient, Netblock: request(i).ClientGroup,
-			Minute: ratelimit.Buckets{Start: start, Current: 1},
-		})
-	}
-
-	counters.Load(read, now)
-	counters.Count(now, request(maxCounters))
-
-	got := counters.Snapshot()
-	if !holds(got, 0) || holds(got, maxCounters/2) {
-		t.Errorf("holding the first client of the file %v, and the first counted in "+
-			"the minute before %v, want only the first", holds(got, 0),
-			holds(got, maxCounters/2))
-	}
-}
-
-// midnight is the time of the tests' requests.
-func midnight() time.Time {
-	return time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
-}
-
-// newCounters returns Counters for params, whose alerts go nowhere.
-func newCounters(params anomaly.Params) *anomaly.Counters {
-	params.Alerts = alerts.New(alerts.Params{})
-
-	return anomaly.New(params)
-}
-
-// newQueue returns a queue of alerts to a webhook, with the default
-// cooldown, which keeps them waiting, since it is never run.
-func newQueue() *alerts.Queue {
-	return alerts.New(alerts.Params{
-		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
-		Events:     alerts.Events(),
-		Cooldown:   15 * time.Minute,
-		MaxPerHour: 60,
-		Now:        midnight,
-	})
-}
-
-// request returns a request from client number i, an address in
-// 10.0.0.0/8.
-func request(i int) anomaly.Request {
-	client := netip.MustParseAddr(fmt.Sprintf("10.%d.%d.%d", i>>16, i>>8&255, i&255))
-
-	return anomaly.Request{Client: client, ClientGroup: netip.PrefixFrom(client, 32)}
-}
-
-// holds reports whether counters hold the counter of client number i.
-func holds(counters []anomaly.Counter, i int) bool {
-	return slices.ContainsFunc(counters, func(counter anomaly.Counter) bool {
-		return counter.Netblock == request(i).ClientGroup
-	})
-}

internal/bans/bans.go

@@ -108,12 +108,6 @@ type Notes struct {
 	Limit  int64   `json:"limit,omitempty"`
 	Window string  `json:"window,omitempty"`
 	Count  float64 `json:"count,omitempty"`
-	// LimitPercent and LimitPercentSetting are, for a ban for a limit a
-	// biased threshold lowered, the client's percentage of that kind of
-	// limit, of which Limit is the result, and the setting that gave it.
-	// Both are left out for a limit that was not lowered.
-	LimitPercent        *int64 `json:"limit_percent,omitempty"`
-	LimitPercentSetting string `json:"limit_percent_setting,omitempty"`
 	// RuleID and Target are, for a ban for a clear sign of attack, the id
 	// of the rule file rule that matched, and its target.
 	RuleID string `json:"rule_id,omitempty"`

internal/config/config.go

@@ -24,7 +24,6 @@ import (
 	"unicode/utf8"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
@@ -121,60 +120,6 @@ type Config struct {
 	// capitals, as GeoJS gives them.
 	DeniedCountries             []string
 	ExclusivelyAllowedCountries []string
-	// The biased thresholds. ASNLimitPercent and CountryLimitPercent give
-	// the clients of the AS numbers and the countries they list that
-	// percentage of every rate limit and byte limit
-	// (SWWAF_ASN_LIMIT_PERCENT and SWWAF_COUNTRY_LIMIT_PERCENT).
-	// ASNBytesPercent and CountryBytesPercent give those they list a
-	// percentage of the byte limits in place of that one
-	// (SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT). Each holds
-	// percentages from 0 to 100, by AS number, written as AS64496, or by
-	// country, a two-letter code in capitals, as the lookup gives them.
-	// UnknownLimitPercent is the percentage of every limit a client without
-	// a country gets (SWWAF_UNKNOWN_LIMIT_PERCENT). ASNLimitPercentURL is
-	// where a file of AS:percent lines is fetched from, whose percentages
-	// count as those of ASNLimitPercent do (SWWAF_ASN_LIMIT_PERCENT_URL), ""
-	// while it is unset.
-	ASNLimitPercent     map[string]int64
-	CountryLimitPercent map[string]int64
-	ASNBytesPercent     map[string]int64
-	CountryBytesPercent map[string]int64
-	UnknownLimitPercent int64
-	ASNLimitPercentURL  string
-	// BlocklistURLs are where the blocklists are fetched from
-	// (SWWAF_BLOCKLIST_URLS). Each list, and ASNLimitPercentURL's, is
-	// fetched again BlocklistRefresh after it was last fetched or tried
-	// (SWWAF_BLOCKLIST_REFRESH), which is never less than an hour.
-	// BlocklistAction is what is done with a client a blocklist lists
-	// (SWWAF_BLOCKLIST_ACTION): deny, limit or log; for limit,
-	// BlocklistLimitPercent is the percentage of every limit it gets.
-	BlocklistURLs         []string
-	BlocklistRefresh      time.Duration
-	BlocklistAction       string
-	BlocklistLimitPercent int64
-	// DNSBLZones are the DNSBL zones clients are asked about
-	// (SWWAF_DNSBL_ZONES), through DNSBLResolver (SWWAF_DNSBL_RESOLVER), or
-	// the host's resolver while that is the zero AddrPort.
-	// AbuseIPDBKey is the key of the AbuseIPDB account clients are checked
-	// with (SWWAF_ABUSEIPDB_KEY), "" while it is unset and none is. A score
-	// of AbuseIPDBMinScore or more is a hit (SWWAF_ABUSEIPDB_MIN_SCORE), and
-	// at most AbuseIPDBDailyBudget checks are made a day
-	// (SWWAF_ABUSEIPDB_DAILY_BUDGET).
-	// ReputationAction is what is done with a client a zone's verdict lists,
-	// or whose score is a hit (SWWAF_REPUTATION_ACTION): deny, limit or log;
-	// for limit, ReputationLimitPercent is the percentage of every limit it
-	// gets. A verdict or a score is used for ReputationCacheTTL after it was
-	// fetched (SWWAF_REPUTATION_CACHE_TTL), and a query or a check may take
-	// ReputationTimeout (SWWAF_REPUTATION_TIMEOUT). Neither can be off.
-	DNSBLZones             []string
-	DNSBLResolver          netip.AddrPort
-	AbuseIPDBKey           string
-	AbuseIPDBMinScore      int64
-	AbuseIPDBDailyBudget   int
-	ReputationAction       string
-	ReputationLimitPercent int64
-	ReputationCacheTTL     time.Duration
-	ReputationTimeout      time.Duration
 	// BanResponse is the status a refused client is answered with, 403
 	// or 429, or 0 to close the connection without an answer
 	// (SWWAF_BAN_RESPONSE). It answers a banned client, a request that
@@ -259,23 +204,6 @@ type Config struct {
 	AlertEvents          []string
 	AlertCooldown        time.Duration
 	AlertMaxPerHour      int
-	// The anomaly thresholds, which only raise alerts: the most requests
-	// and bytes a minute and an hour per client (SWWAF_ANOMALY_CLIENT_*),
-	// per netblock around a client (SWWAF_ANOMALY_NET_*), per AS number
-	// (SWWAF_ANOMALY_ASN_*), for the whole service (SWWAF_ANOMALY_TOTAL_*)
-	// and per named netblock (SWWAF_WATCH_*), each 0 while it is off.
-	// AnomalyNetV4Prefix and AnomalyNetV6Prefix are the lengths of the
-	// netblock around a client (SWWAF_ANOMALY_NET_V4_PREFIX and
-	// SWWAF_ANOMALY_NET_V6_PREFIX), and WatchNets the named netblocks
-	// (SWWAF_WATCH_NETS).
-	AnomalyClient      anomaly.Thresholds
-	AnomalyNet         anomaly.Thresholds
-	AnomalyASN         anomaly.Thresholds
-	AnomalyTotal       anomaly.Thresholds
-	AnomalyWatch       anomaly.Thresholds
-	AnomalyNetV4Prefix int
-	AnomalyNetV6Prefix int
-	WatchNets          []anomaly.NamedNetblock
 
 	// settings are the values read, as given or by default, and the
 	// files they were read from, for the log line at start.
@@ -296,7 +224,6 @@ const (
 	mebibyte = 1 << 20
 	gibibyte = 1 << 30
 	ipv4Bits = 32
-	ipv6Bits = 128
 	// minTokenLength is the fewest characters a token may have.
 	minTokenLength = 32
 	// masked is what the log shows for a token that is set, and in place of
@@ -344,10 +271,6 @@ var (
 	errNotBanResponse = errors.New("is not 403, 429 or close")
 	errNotV4Prefix    = errors.New(
 		"is not the length of an IPv4 netblock, from 0 to 32, such as 24")
-	errNotV6Prefix = errors.New(
-		"is not the length of an IPv6 netblock, from 0 to 128, such as 48")
-	errNotNamedNetblock = errors.New(
-		"is not a name, = and a netblock, such as office=203.0.113.0/24")
 	errNotAbsolutePath = errors.New(
 		"is not an absolute path, such as /var/lib/smallwebwaf")
 	errShortToken    = errors.New("is shorter than 32 characters")
@@ -377,23 +300,6 @@ var (
 			"source_failure or file_error")
 	errNotNumberOrOff = errors.New("is not a whole number above zero, such as 60, or off")
 	errNotUTF8        = errors.New("is not valid UTF-8")
-	errNotASN         = errors.New("is not an AS number such as AS64496")
-	errNotPercentItem = errors.New(
-		"is not a code, : and a percentage, such as AS64496:50 or cn:25")
-	errNotPercent  = errors.New("is not a percentage, a whole number from 0 to 100")
-	errListedTwice = errors.New("is listed twice")
-	errNotListURL  = errors.New(
-		"is not an http or https URL without a user or a fragment, " +
-			"such as https://www.spamhaus.org/drop/drop.txt")
-	errInBlocklistURLs = errors.New("is in SWWAF_BLOCKLIST_URLS too")
-	errNotAnHourOrMore = errors.New("is not a duration of 1h or more, such as 24h")
-	errNotAction       = errors.New(
-		"is not deny, limit:<percent> such as limit:25, or log")
-	errNotZone     = errors.New("is not a DNS zone such as dnsbl.dronebl.org")
-	errZoneTooLong = errors.New("is longer than 189 characters, too long for the " +
-		"names IPv6 clients are asked about by")
-	errNotResolver = errors.New("is not an IP address with an optional port, " +
-		"such as 192.0.2.53 or [2001:db8::53]:5353")
 )
 
 // FromEnvironment reads the settings with lookupEnv, normally
@@ -401,8 +307,6 @@ var (
 // named by the setting's name with _FILE added names the file, which is
 // read now (see lookup). A setting that is not set takes its default. A
 // setting that is set but invalid is an error that names it.
-//
-//nolint:funlen // one line for each setting, a list that grows with them
 func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	cfg := &Config{
@@ -438,21 +342,6 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
 			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
-		ASNLimitPercent:      env.percents("SWWAF_ASN_LIMIT_PERCENT", ParseASN),
-		CountryLimitPercent:  env.percents("SWWAF_COUNTRY_LIMIT_PERCENT", parseCountry),
-		ASNBytesPercent:      env.percents("SWWAF_ASN_BYTES_PERCENT", ParseASN),
-		CountryBytesPercent:  env.percents("SWWAF_COUNTRY_BYTES_PERCENT", parseCountry),
-		UnknownLimitPercent:  env.percent("SWWAF_UNKNOWN_LIMIT_PERCENT", "100"),
-		ASNLimitPercentURL:   env.listURL("SWWAF_ASN_LIMIT_PERCENT_URL"),
-		BlocklistURLs:        env.listURLs("SWWAF_BLOCKLIST_URLS"),
-		BlocklistRefresh:     env.refresh("SWWAF_BLOCKLIST_REFRESH", "24h"),
-		DNSBLZones:           env.zones("SWWAF_DNSBL_ZONES"),
-		DNSBLResolver:        env.resolver("SWWAF_DNSBL_RESOLVER"),
-		AbuseIPDBKey:         env.secret("SWWAF_ABUSEIPDB_KEY"),
-		AbuseIPDBMinScore:    env.percent("SWWAF_ABUSEIPDB_MIN_SCORE", "75"),
-		AbuseIPDBDailyBudget: env.numberNotOff("SWWAF_ABUSEIPDB_DAILY_BUDGET", "900"),
-		ReputationCacheTTL:   env.durationNotOff("SWWAF_REPUTATION_CACHE_TTL", "24h"),
-		ReputationTimeout:    env.durationNotOff("SWWAF_REPUTATION_TIMEOUT", "2s"),
 		BanResponse:          env.banResponse("SWWAF_BAN_RESPONSE", "403"),
 		LimitBanDuration:     env.durationNotOff("SWWAF_LIMIT_BAN_DURATION", "1h"),
 		LimitBanRepeatWindow: env.durationNotOff("SWWAF_LIMIT_BAN_REPEAT_WINDOW", "24h"),
@@ -481,29 +370,16 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		AlertNtfyToken:       env.secret("SWWAF_ALERT_NTFY_TOKEN"),
 		AlertEvents: env.alertEvents("SWWAF_ALERT_EVENTS",
 			strings.Join(alerts.Events(), ",")),
-		AlertCooldown:      env.duration("SWWAF_ALERT_COOLDOWN", "15m"),
+		AlertCooldown:   env.duration("SWWAF_ALERT_COOLDOWN", "15m"),
-		AlertMaxPerHour:    env.numberOrOff("SWWAF_ALERT_MAX_PER_HOUR", "60"),
+		AlertMaxPerHour: env.numberOrOff("SWWAF_ALERT_MAX_PER_HOUR", "60"),
-		AnomalyClient:      env.thresholds("SWWAF_ANOMALY_CLIENT_"),
-		AnomalyNet:         env.thresholds("SWWAF_ANOMALY_NET_"),
-		AnomalyASN:         env.thresholds("SWWAF_ANOMALY_ASN_"),
-		AnomalyTotal:       env.thresholds("SWWAF_ANOMALY_TOTAL_"),
-		AnomalyWatch:       env.thresholds("SWWAF_WATCH_"),
-		AnomalyNetV4Prefix: env.v4Prefix("SWWAF_ANOMALY_NET_V4_PREFIX", "24"),
-		AnomalyNetV6Prefix: env.v6Prefix("SWWAF_ANOMALY_NET_V6_PREFIX", "48"),
-		WatchNets:          env.namedNetblocks("SWWAF_WATCH_NETS"),
 	}
 
 	cfg.LogRemoteAppName = env.appName("SWWAF_LOG_REMOTE_APP_NAME",
 		cfg.InstanceName, cfg.LogRemoteURL != nil)
-	cfg.BlocklistAction, cfg.BlocklistLimitPercent = env.action(
-		"SWWAF_BLOCKLIST_ACTION", "deny")
-	cfg.ReputationAction, cfg.ReputationLimitPercent = env.action(
-		"SWWAF_REPUTATION_ACTION", "limit:25")
 
 	env.checkInstanceNameForNtfy(cfg.InstanceName, cfg.AlertNtfyURL != nil)
 	env.checkLookupDBPath(cfg)
 	env.checkCountriesAndLookups(cfg)
-	env.checkASNLimitPercentURL(cfg)
 
 	if env.err != nil {
 		return nil, env.err
@@ -716,106 +592,6 @@ func (e *environment) countries(name, defaultValue string) []string {
 	return countries
 }
 
-// percents reads a setting that is a list of AS numbers or countries,
-// which parseCode reads, each with a percentage. It is empty by default.
-func (e *environment) percents(
-	name string, parseCode func(string) (string, error),
-) map[string]int64 {
-	percents, err := parsePercents(e.value(name, ""), parseCode)
-	e.check(name, err)
-
-	return percents
-}
-
-// percent reads a setting that is a percentage, from 0 to 100.
-func (e *environment) percent(name, defaultValue string) int64 {
-	percent, err := ParsePercent(e.value(name, defaultValue))
-	e.check(name, err)
-
-	return percent
-}
-
-// listURL reads a setting that is the URL a list is fetched from, "" while
-// it is unset or empty.
-func (e *environment) listURL(name string) string {
-	value := e.value(name, "")
-	if value != "" && !isListURL(value) {
-		e.check(name, fmt.Errorf("%q %w", value, errNotListURL))
-	}
-
-	return value
-}
-
-// listURLs reads a setting that is a list of the URLs lists are fetched
-// from. It is empty by default.
-func (e *environment) listURLs(name string) []string {
-	urls, err := parseListURLs(e.value(name, ""))
-	e.check(name, err)
-
-	return urls
-}
-
-// refresh reads the setting that is how long after a list was last
-// fetched or tried it is fetched again: a duration of an hour or more,
-// since the Spamhaus lists may be fetched no more often, which cannot be
-// off.
-func (e *environment) refresh(name, defaultValue string) time.Duration {
-	value := e.value(name, defaultValue)
-
-	duration, err := parseDuration(value)
-	if err != nil || duration < time.Hour {
-		e.check(name, fmt.Errorf("%q %w", value, errNotAnHourOrMore))
-	}
-
-	return duration
-}
-
-// action reads a setting that is what is done with a client a blocklist
-// or a DNSBL zone lists: deny, log, or limit:<percent>, which it returns
-// as limit and the percentage.
-func (e *environment) action(name, defaultValue string) (string, int64) {
-	value := e.value(name, defaultValue)
-	if value == "deny" || value == "log" {
-		return value, 0
-	}
-
-	percentText, isLimit := strings.CutPrefix(value, "limit:")
-
-	percent, err := ParsePercent(percentText)
-	if !isLimit || err != nil {
-		e.check(name, fmt.Errorf("%q %w", value, errNotAction))
-	}
-
-	return "limit", percent
-}
-
-// zones reads the setting that is the list of DNSBL zones. It is empty by
-// default. The log shows each zone with its key masked, as MaskZoneKey
-// masks it.
-func (e *environment) zones(name string) []string {
-	value, _ := e.lookup(name)
-	zones, err := parseZones(value)
-	e.check(name, err)
-
-	logged := make([]string, len(zones))
-	for i, zone := range zones {
-		logged[i] = MaskZoneKey(zone)
-	}
-
-	e.settings = append(e.settings, slog.String(name, strings.Join(logged, ",")))
-
-	return zones
-}
-
-// resolver reads the setting that is the resolver the DNSBL zones are
-// asked through, the zero AddrPort while it is unset or empty.
-func (e *environment) resolver(name string) netip.AddrPort {
-	resolver, err := parseResolver(e.value(name, ""))
-	e.check(name, err)
-
-	return resolver
-}
-
 // lookupSource reads the setting that is where clients are looked up:
 // geojs, file, or off.
 func (e *environment) lookupSource(name, defaultValue string) string {
@@ -843,10 +619,7 @@ func (e *environment) checkLookupDBPath(cfg *Config) {
 
 // checkCountriesAndLookups refuses a country on both country lists, and,
 // while SWWAF_LOOKUP_SOURCE is off, each setting that needs clients looked
-// up: the country lists, SWWAF_ADD_LOOKUP_HEADERS, the biased thresholds,
+// up: the country lists and SWWAF_ADD_LOOKUP_HEADERS.
-// SWWAF_ASN_LIMIT_PERCENT_URL among them, of which
-// SWWAF_UNKNOWN_LIMIT_PERCENT needs them only below 100, where it lowers a
-// limit, and the anomaly thresholds per AS number.
 func (e *environment) checkCountriesAndLookups(cfg *Config) {
 	for _, country := range cfg.ExclusivelyAllowedCountries {
 		if slices.Contains(cfg.DeniedCountries, country) {
@@ -866,16 +639,6 @@ func (e *environment) checkCountriesAndLookups(cfg *Config) {
 		{"SWWAF_DENIED_COUNTRIES", len(cfg.DeniedCountries) > 0},
 		{"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
 		{"SWWAF_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
-		{"SWWAF_ASN_LIMIT_PERCENT", len(cfg.ASNLimitPercent) > 0},
-		{"SWWAF_COUNTRY_LIMIT_PERCENT", len(cfg.CountryLimitPercent) > 0},
-		{"SWWAF_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
-		{"SWWAF_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
-		{"SWWAF_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
-		{"SWWAF_ASN_LIMIT_PERCENT_URL", cfg.ASNLimitPercentURL != ""},
-		{"SWWAF_ANOMALY_ASN_REQUESTS_PER_MINUTE", cfg.AnomalyASN.RequestsPerMinute > 0},
-		{"SWWAF_ANOMALY_ASN_REQUESTS_PER_HOUR", cfg.AnomalyASN.RequestsPerHour > 0},
-		{"SWWAF_ANOMALY_ASN_BYTES_PER_MINUTE", cfg.AnomalyASN.BytesPerMinute > 0},
-		{"SWWAF_ANOMALY_ASN_BYTES_PER_HOUR", cfg.AnomalyASN.BytesPerHour > 0},
 	} {
 		if setting.set {
 			e.check(setting.name, fmt.Errorf("is set while SWWAF_LOOKUP_SOURCE is off; %w",
@@ -884,15 +647,6 @@ func (e *environment) checkCountriesAndLookups(cfg *Config) {
 	}
 }
 
-// checkASNLimitPercentURL refuses SWWAF_ASN_LIMIT_PERCENT_URL naming a
-// blocklist too: the file at a URL is fetched as one list or the other.
-func (e *environment) checkASNLimitPercentURL(cfg *Config) {
-	if slices.Contains(cfg.BlocklistURLs, cfg.ASNLimitPercentURL) {
-		e.check("SWWAF_ASN_LIMIT_PERCENT_URL",
-			fmt.Errorf("%q %w", cfg.ASNLimitPercentURL, errInBlocklistURLs))
-	}
-}
-
 // headerNames reads a setting that is a list of header names, and
 // returns them in lower case.
 func (e *environment) headerNames(name, defaultValue string) []string {
@@ -936,35 +690,6 @@ func (e *environment) v4Prefix(name, defaultValue string) int {
 	return length
 }
 
-// v6Prefix reads a setting that is the length of an IPv6 netblock.
-func (e *environment) v6Prefix(name, defaultValue string) int {
-	length, err := parseV6Prefix(e.value(name, defaultValue))
-	e.check(name, err)
-
-	return length
-}
-
-// thresholds reads the four anomaly thresholds whose settings' names
-// start with prefix: requests and bytes per minute and per hour. Each is
-// off by default.
-func (e *environment) thresholds(prefix string) anomaly.Thresholds {
-	return anomaly.Thresholds{
-		RequestsPerMinute: e.count(prefix+"REQUESTS_PER_MINUTE", off),
-		RequestsPerHour:   e.count(prefix+"REQUESTS_PER_HOUR", off),
-		BytesPerMinute:    e.size(prefix+"BYTES_PER_MINUTE", off),
-		BytesPerHour:      e.size(prefix+"BYTES_PER_HOUR", off),
-	}
-}
-
-// namedNetblocks reads a setting that is a list of named netblocks. It is
-// empty by default.
-func (e *environment) namedNetblocks(name string) []anomaly.NamedNetblock {
-	named, err := parseNamedNetblocks(e.value(name, ""))
-	e.check(name, err)
-
-	return named
-}
-
 // absolutePath reads a setting that is an absolute path.
 func (e *environment) absolutePath(name, defaultValue string) string {
 	path := e.value(name, defaultValue)
@@ -1121,10 +846,10 @@ func (e *environment) webhookHeaders(name string) http.Header {
 }
 
 // secret reads a setting that is a secret another service gave, such as
-// an ntfy token or an AbuseIPDB key, "" while it is unset. It is sent in
+// an ntfy token, "" while it is unset. It is sent in a header, which
-// a header, which cannot hold a control character, so one in it is an
+// cannot hold a control character, so one in it is an error. The log
-// error. The log shows ******** in place of a value that is not empty, and
+// shows ******** in place of a value that is not empty, and an error
-// an error shows none of it.
+// shows none of it.
 func (e *environment) secret(name string) string {
 	value, _ := e.lookup(name)
 
@@ -1306,16 +1031,6 @@ func parseV4Prefix(value string) (int, error) {
 	return n, nil
 }
 
-// parseV6Prefix reads the length of an IPv6 netblock, from 0 to 128.
-func parseV6Prefix(value string) (int, error) {
-	n, err := strconv.Atoi(value)
-	if err != nil || n < 0 || n > ipv6Bits {
-		return 0, fmt.Errorf("%q %w", value, errNotV6Prefix)
-	}
-
-	return n, nil
-}
-
 // parseList splits a comma-separated list and trims the spaces around
 // each item. An empty value is an empty list.
 func parseList(value string) ([]string, error) {
@@ -1344,7 +1059,7 @@ func parseNetblocks(value string) ([]netip.Prefix, error) {
 	netblocks := make([]netip.Prefix, 0, len(items))
 
 	for _, item := range items {
-		netblock, err := ParseNetblock(item)
+		netblock, err := parseNetblock(item)
 		if err != nil {
 			return nil, err
 		}
@@ -1355,10 +1070,9 @@ func parseNetblocks(value string) ([]netip.Prefix, error) {
 	return netblocks, nil
 }
 
-// ParseNetblock reads a netblock in CIDR form, such as 10.0.0.0/8. A bare
+// parseNetblock reads a netblock in CIDR form, such as 10.0.0.0/8. A bare
-// address is a netblock of that address alone, a /32 or a /128. A
+// address is a netblock of that address alone, a /32 or a /128.
-// blocklist's lines are read with it too.
+func parseNetblock(value string) (netip.Prefix, error) {
-func ParseNetblock(value string) (netip.Prefix, error) {
 	if strings.Contains(value, "/") {
 		netblock, err := netip.ParsePrefix(value)
 		if err != nil {
@@ -1376,42 +1090,6 @@ func ParseNetblock(value string) (netip.Prefix, error) {
 	return netip.PrefixFrom(addr, addr.BitLen()), nil
 }
 
-// parseNamedNetblocks reads a comma-separated list of named netblocks,
-// each a name, = and a netblock, such as office=203.0.113.0/24. An empty
-// value is an empty list. A name listed twice is an error.
-func parseNamedNetblocks(value string) ([]anomaly.NamedNetblock, error) {
-	items, err := parseList(value)
-	if err != nil {
-		return nil, err
-	}
-
-	named := make([]anomaly.NamedNetblock, 0, len(items))
-
-	for _, item := range items {
-		name, netblockText, found := strings.Cut(item, "=")
-		name = strings.TrimSpace(name)
-
-		if !found || name == "" {
-			return nil, fmt.Errorf("%q %w", item, errNotNamedNetblock)
-		}
-
-		netblock, err := ParseNetblock(strings.TrimSpace(netblockText))
-		if err != nil {
-			return nil, err
-		}
-
-		if slices.ContainsFunc(named, func(n anomaly.NamedNetblock) bool {
-			return n.Name == name
-		}) {
-			return nil, fmt.Errorf("%q %w", name, errListedTwice)
-		}
-
-		named = append(named, anomaly.NamedNetblock{Name: name, Netblock: netblock})
-	}
-
-	return named, nil
-}
-
 // parsePathPrefixes reads a comma-separated list of path prefixes, each
 // starting with /.
 func parsePathPrefixes(value string) ([]string, error) {
@@ -1470,12 +1148,13 @@ func parseCountries(value string) ([]string, error) {
 		return nil, err
 	}
 
+	known := strings.Fields(countryCodes)
 	countries := make([]string, 0, len(items))
 
 	for _, item := range items {
-		country, err := parseCountry(item)
+		country := strings.ToUpper(item)
-		if err != nil {
+		if !slices.Contains(known, country) {
-			return nil, err
+			return nil, fmt.Errorf("%q %w", item, errNotCountry)
 		}
 
 		countries = append(countries, country)
@@ -1484,83 +1163,6 @@ func parseCountries(value string) ([]string, error) {
 	return countries, nil
 }
 
-// parseCountry reads a country code in either case, and returns it in
-// capitals.
-func parseCountry(value string) (string, error) {
-	country := strings.ToUpper(value)
-	if !slices.Contains(strings.Fields(countryCodes), country) {
-		return "", fmt.Errorf("%q %w", value, errNotCountry)
-	}
-
-	return country, nil
-}
-
-// ParseASN reads an AS number such as AS64496, in either case, and
-// returns it as the lookup gives it: AS and the number, in capitals and
-// without leading zeros. The file SWWAF_ASN_LIMIT_PERCENT_URL names is
-// read with it too.
-func ParseASN(value string) (string, error) {
-	digits, hasAS := strings.CutPrefix(strings.ToUpper(value), "AS")
-
-	number, err := strconv.ParseUint(digits, 10, 32)
-	if !hasAS || err != nil {
-		return "", fmt.Errorf("%q %w", value, errNotASN)
-	}
-
-	return "AS" + strconv.FormatUint(number, 10), nil
-}
-
-// parsePercents reads a comma-separated list of items, each an AS number
-// or a country, which parseCode reads, then : and a percentage, such as
-// AS64496:50 or cn:25, and returns each one's percentage. An empty value
-// is an empty list. An AS number or country listed twice is an error.
-func parsePercents(
-	value string, parseCode func(string) (string, error),
-) (map[string]int64, error) {
-	items, err := parseList(value)
-	if err != nil {
-		return nil, err
-	}
-
-	percents := make(map[string]int64, len(items))
-
-	for _, item := range items {
-		codeText, percentText, found := strings.Cut(item, ":")
-		if !found {
-			return nil, fmt.Errorf("%q %w", item, errNotPercentItem)
-		}
-
-		code, err := parseCode(codeText)
-		if err != nil {
-			return nil, err
-		}
-
-		percent, err := ParsePercent(percentText)
-		if err != nil {
-			return nil, err
-		}
-
-		if _, listed := percents[code]; listed {
-			return nil, fmt.Errorf("%q %w", codeText, errListedTwice)
-		}
-
-		percents[code] = percent
-	}
-
-	return percents, nil
-}
-
-// ParsePercent reads a percentage, a whole number from 0 to 100. The file
-// SWWAF_ASN_LIMIT_PERCENT_URL names is read with it too.
-func ParsePercent(value string) (int64, error) {
-	percent, err := strconv.ParseInt(value, 10, 64)
-	if err != nil || percent < 0 || percent > 100 {
-		return 0, fmt.Errorf("%q %w", value, errNotPercent)
-	}
-
-	return percent, nil
-}
-
 // headerNameChars are the characters RFC 9110 allows in a header name:
 // letters, digits and these marks.
 const headerNameChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" +
@@ -1708,7 +1310,16 @@ func parseWebhookURL(value string) (*url.URL, string, error) {
 	}
 
 	webhook, err := url.Parse(value)
-	if err != nil || !isHTTPURL(webhook) {
+	if err != nil {
+		return nil, "", errNotWebhookURL
+	}
+
+	port, err := strconv.ParseUint(webhook.Port(), 10, 16)
+
+	valid := (webhook.Scheme == "http" || webhook.Scheme == "https") &&
+		webhook.Hostname() != "" && (webhook.Port() == "" || (err == nil && port != 0)) &&
+		webhook.User == nil && webhook.Opaque == "" && webhook.Fragment == ""
+	if !valid {
 		return nil, "", errNotWebhookURL
 	}
 
@@ -1720,154 +1331,6 @@ func parseWebhookURL(value string) (*url.URL, string, error) {
 	return webhook, logged, nil
 }
 
-// isHTTPURL reports whether u is http or https, with a host, and an
-// optional port from 1 to 65535, path and query, without a user or a
-// fragment.
-func isHTTPURL(u *url.URL) bool {
-	port, err := strconv.ParseUint(u.Port(), 10, 16)
-
-	return (u.Scheme == "http" || u.Scheme == "https") && u.Hostname() != "" &&
-		(u.Port() == "" || (err == nil && port != 0)) &&
-		u.User == nil && u.Opaque == "" && u.Fragment == ""
-}
-
-// isListURL reports whether value is a URL a list can be fetched from, as
-// isHTTPURL says.
-func isListURL(value string) bool {
-	u, err := url.Parse(value)
-
-	return err == nil && isHTTPURL(u)
-}
-
-// parseListURLs reads a comma-separated list of the URLs lists are fetched
-// from. A URL listed twice is an error: it would be fetched twice as
-// often.
-func parseListURLs(value string) ([]string, error) {
-	urls, err := parseList(value)
-	if err != nil {
-		return nil, err
-	}
-
-	for i, listURL := range urls {
-		if !isListURL(listURL) {
-			return nil, fmt.Errorf("%q %w", listURL, errNotListURL)
-		}
-
-		if slices.Contains(urls[:i], listURL) {
-			return nil, fmt.Errorf("%q %w", listURL, errListedTwice)
-		}
-	}
-
-	return urls, nil
-}
-
-const (
-	// maxZoneLength is the most characters a DNSBL zone may have: 253, the
-	// most a DNS name may have, less the 64 that come before the zone in
-	// the name an IPv6 client is asked about by, its 32 hex digits each
-	// followed by a dot.
-	maxZoneLength = 189
-	// maxLabelLength is the most characters a label of a DNS name may have.
-	maxLabelLength = 63
-	// labelChars are the characters a label of a DNS zone may hold.
-	labelChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"
-	// dnsPort is the port a resolver is asked on when SWWAF_DNSBL_RESOLVER
-	// gives none.
-	dnsPort = 53
-)
-
-// parseZones reads a comma-separated list of DNSBL zones, each a DNS name
-// such as dnsbl.dronebl.org: labels separated by dots, each of 1 to 63
-// letters, digits and hyphens, neither starting nor ending with a hyphen,
-// and at most maxZoneLength characters in all. Go's resolver takes any
-// other name for one that does not exist, so that the zone would list no
-// client. A zone listed twice is an error, whatever the case of its
-// letters, which DNS names ignore, and whatever its key, since
-// MaskZoneKey shows two keys of one zone alike. An error shows a zone as
-// MaskZoneKey does.
-func parseZones(value string) ([]string, error) {
-	zones, err := parseList(value)
-	if err != nil {
-		// parseList's error, for an empty item, shows the whole value, keys
-		// included.
-		return nil, errEmptyItem
-	}
-
-	for i, zone := range zones {
-		shown := MaskZoneKey(zone)
-		listedBefore := slices.ContainsFunc(zones[:i], func(earlier string) bool {
-			return strings.EqualFold(MaskZoneKey(earlier), shown)
-		})
-
-		switch {
-		case len(zone) > maxZoneLength:
-			return nil, fmt.Errorf("%q %w", shown, errZoneTooLong)
-		case !isZone(zone):
-			return nil, fmt.Errorf("%q %w", shown, errNotZone)
-		case listedBefore:
-			return nil, fmt.Errorf("%q %w", shown, errListedTwice)
-		}
-	}
-
-	return zones, nil
-}
-
-// MaskZoneKey returns zone with ******** in place of its key, if it is a
-// zone of Spamhaus's keyed query service, a name under dq.spamhaus.net,
-// such as <key>.xbl.dq.spamhaus.net, whose first label is the key. Any
-// other zone it returns as it is. A zone is shown so wherever it leaves
-// the process: in the log, the alerts and the metrics.
-func MaskZoneKey(zone string) string {
-	// DNS names ignore case, and a name may be written with a dot at its
-	// end.
-	name := strings.TrimSuffix(strings.ToLower(zone), ".")
-	if !strings.HasSuffix(name, ".dq.spamhaus.net") {
-		return zone
-	}
-
-	_, rest, _ := strings.Cut(zone, ".")
-
-	return masked + "." + rest
-}
-
-// isZone reports whether each label of zone is as parseZones takes it.
-func isZone(zone string) bool {
-	for label := range strings.SplitSeq(zone, ".") {
-		badChar := strings.ContainsFunc(label, func(char rune) bool {
-			return !strings.ContainsRune(labelChars, char)
-		})
-
-		if label == "" || len(label) > maxLabelLength || badChar ||
-			strings.HasPrefix(label, "-") || strings.HasSuffix(label, "-") {
-			return false
-		}
-	}
-
-	return true
-}
-
-// parseResolver reads the resolver the DNSBL zones are asked through: an
-// IP address with a port from 1 to 65535, such as 192.0.2.53:5353 or
-// [2001:db8::53]:5353, or without one, such as 192.0.2.53 or 2001:db8::53,
-// for port 53. An empty value is none, the zero AddrPort.
-func parseResolver(value string) (netip.AddrPort, error) {
-	if value == "" {
-		return netip.AddrPort{}, nil
-	}
-
-	resolver, err := netip.ParseAddrPort(value)
-	if err == nil && resolver.Port() != 0 {
-		return resolver, nil
-	}
-
-	addr, err := netip.ParseAddr(value)
-	if err != nil {
-		return netip.AddrPort{}, fmt.Errorf("%q %w", value, errNotResolver)
-	}
-
-	return netip.AddrPortFrom(addr, dnsPort), nil
-}
-
 // parseWebhookHeaders reads a comma-separated list of headers, each its
 // name, :, and its value, and returns them, and how the log shows them,
 // with each value as ********. An error names the item by its place in

internal/config/config_test.go

@@ -12,12 +12,10 @@ import (
 	"path/filepath"
 	"reflect"
 	"slices"
-	"strconv"
 	"strings"
 	"testing"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 )
 
@@ -52,23 +50,6 @@ const (
 	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
 	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
 	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	asnLimitPercent         = "SWWAF_ASN_LIMIT_PERCENT"
-	countryLimitPercent     = "SWWAF_COUNTRY_LIMIT_PERCENT"
-	asnBytesPercent         = "SWWAF_ASN_BYTES_PERCENT"
-	countryBytesPercent     = "SWWAF_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent     = "SWWAF_UNKNOWN_LIMIT_PERCENT"
-	asnLimitPercentURL      = "SWWAF_ASN_LIMIT_PERCENT_URL"
-	blocklistURLs           = "SWWAF_BLOCKLIST_URLS"
-	blocklistRefresh        = "SWWAF_BLOCKLIST_REFRESH"
-	blocklistAction         = "SWWAF_BLOCKLIST_ACTION"
-	dnsblZones              = "SWWAF_DNSBL_ZONES"
-	dnsblResolver           = "SWWAF_DNSBL_RESOLVER"
-	abuseIPDBKey            = "SWWAF_ABUSEIPDB_KEY"
-	abuseIPDBMinScore       = "SWWAF_ABUSEIPDB_MIN_SCORE"
-	abuseIPDBDailyBudget    = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
-	reputationAction        = "SWWAF_REPUTATION_ACTION"
-	reputationCacheTTL      = "SWWAF_REPUTATION_CACHE_TTL"
-	reputationTimeout       = "SWWAF_REPUTATION_TIMEOUT"
 	banResponse             = "SWWAF_BAN_RESPONSE"
 	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
 	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
@@ -99,59 +80,8 @@ const (
 	alertEvents             = "SWWAF_ALERT_EVENTS"
 	alertCooldown           = "SWWAF_ALERT_COOLDOWN"
 	alertMaxPerHour         = "SWWAF_ALERT_MAX_PER_HOUR"
-	anomalyNetV4Prefix      = "SWWAF_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix      = "SWWAF_ANOMALY_NET_V6_PREFIX"
-	watchNets               = "SWWAF_WATCH_NETS"
 )
 
-// The anomaly thresholds: each of the prefixes below, which name a scope,
-// followed by each of the four ends.
-const (
-	anomalyClient = "SWWAF_ANOMALY_CLIENT_"
-	anomalyNet    = "SWWAF_ANOMALY_NET_"
-	anomalyASN    = "SWWAF_ANOMALY_ASN_"
-	anomalyTotal  = "SWWAF_ANOMALY_TOTAL_"
-	watch         = "SWWAF_WATCH_"
-
-	requestsPerMinute = "REQUESTS_PER_MINUTE"
-	requestsPerHour   = "REQUESTS_PER_HOUR"
-	bytesPerMinute    = "BYTES_PER_MINUTE"
-	bytesPerHour      = "BYTES_PER_HOUR"
-)
-
-// anomalyScopes returns the prefixes of the anomaly thresholds, one for
-// each scope.
-func anomalyScopes() []string {
-	return []string{anomalyClient, anomalyNet, anomalyASN, anomalyTotal, watch}
-}
-
-// anomalyThresholds returns the names of the twenty anomaly thresholds.
-func anomalyThresholds() []string {
-	ends := []string{requestsPerMinute, requestsPerHour, bytesPerMinute, bytesPerHour}
-	names := make([]string, 0, len(anomalyScopes())*len(ends))
-
-	for _, scope := range anomalyScopes() {
-		for _, end := range ends {
-			names = append(names, scope+end)
-		}
-	}
-
-	return names
-}
-
-// loggedAnomalyDefaults returns the anomaly settings as the settings
-// logged at start give them by default.
-func loggedAnomalyDefaults() map[string]string {
-	logged := map[string]string{
-		anomalyNetV4Prefix: "24", anomalyNetV6Prefix: "48", watchNets: "",
-	}
-	for _, name := range anomalyThresholds() {
-		logged[name] = off
-	}
-
-	return logged
-}
-
 // defaultAlertEvents is the default of SWWAF_ALERT_EVENTS, and
 // defaultAlertCooldown that of SWWAF_ALERT_COOLDOWN.
 const (
@@ -160,9 +90,6 @@ const (
 	defaultAlertCooldown = "15m"
 )
 
-// defaultReputationCacheTTL is the default of SWWAF_REPUTATION_CACHE_TTL.
-const defaultReputationCacheTTL = "24h"
-
 // defaultLogRequestHeaders is the default of SWWAF_LOG_REQUEST_HEADERS.
 const defaultLogRequestHeaders = "accept,accept-language,accept-encoding," +
 	"content-type,origin,range"
@@ -965,19 +892,9 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 	t.Parallel()
 
 	for name, value := range map[string]string{
-		deniedCountries:                "kp",
+		deniedCountries:  "kp",
-		allowedCountries:               "de",
+		allowedCountries: "de",
-		addLookupHeaders:               enabled,
+		addLookupHeaders: enabled,
-		asnLimitPercentURL:             asnURL,
-		asnLimitPercent:                "AS64496:50",
-		countryLimitPercent:            "cn:25",
-		asnBytesPercent:                "AS64496:50",
-		countryBytesPercent:            "cn:25",
-		unknownLimitPercent:            "99",
-		anomalyASN + requestsPerMinute: "1000",
-		anomalyASN + requestsPerHour:   "10000",
-		anomalyASN + bytesPerMinute:    "1G",
-		anomalyASN + bytesPerHour:      "10G",
 	} {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
@@ -992,611 +909,10 @@ func TestSettingNeedingLookupsStopsTheStartWhileTheyAreOff(t *testing.T) {
 		})
 	}
 
-	// Set empty, the lists need nothing looked up, and nor does
+	// Set empty, the country lists need nothing looked up.
-	// SWWAF_UNKNOWN_LIMIT_PERCENT at 100, which lowers no limit, an anomaly
+	fromEnvironment(t, environment{
-	// threshold per AS number that is off, any other anomaly threshold, or
-	// a blocklist.
-	env := environment{
 		lookupSource: off, deniedCountries: "", allowedCountries: "",
-		asnLimitPercent: "", countryLimitPercent: "", asnBytesPercent: "",
-		countryBytesPercent: "", unknownLimitPercent: "100", asnLimitPercentURL: "",
-		blocklistURLs: dropURL,
-	}
-	for _, name := range anomalyThresholds() {
-		env[name] = "1000"
-		if strings.HasPrefix(name, anomalyASN) {
-			env[name] = off
-		}
-	}
-
-	fromEnvironment(t, env)
-}
-
-func TestAnomalySettingsDefaults(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{})
-	wantAllOff(t, cfg)
-
-	if cfg.AnomalyNetV4Prefix != 24 || cfg.AnomalyNetV6Prefix != 48 ||
-		len(cfg.WatchNets) != 0 {
-		t.Errorf("%s, %s and %s gave %d, %d and %v, want 24, 48 and none",
-			anomalyNetV4Prefix, anomalyNetV6Prefix, watchNets, cfg.AnomalyNetV4Prefix,
-			cfg.AnomalyNetV6Prefix, cfg.WatchNets)
-	}
-}
-
-func TestAnomalySettingsAsSet(t *testing.T) {
-	t.Parallel()
-
-	// Each threshold of a scope its own value; bytes are sizes.
-	env := environment{
-		anomalyNetV4Prefix: "16",
-		anomalyNetV6Prefix: "56",
-		// Spaces around a name or a netblock, and a bare address.
-		watchNets: "office = 203.0.113.0/24, scraper-x=198.51.100.7,v6=2001:db8::/32",
-	}
-	want := map[string]anomaly.Thresholds{}
-
-	for i, scope := range anomalyScopes() {
-		n := int64(i + 1)
-		env[scope+requestsPerMinute] = strconv.FormatInt(n, 10)
-		env[scope+requestsPerHour] = strconv.FormatInt(10*n, 10)
-		env[scope+bytesPerMinute] = strconv.FormatInt(n, 10) + "K"
-		env[scope+bytesPerHour] = strconv.FormatInt(n, 10) + "G"
-		want[scope] = anomaly.Thresholds{
-			RequestsPerMinute: n, RequestsPerHour: 10 * n,
-			BytesPerMinute: n << 10, BytesPerHour: n << 30,
-		}
-	}
-
-	cfg := fromEnvironment(t, env)
-
-	if got := thresholdsByScope(cfg); !maps.Equal(got, want) {
-		t.Errorf("thresholds by scope\n%+v\nwant\n%+v", got, want)
-	}
-
-	wantNamed := []anomaly.NamedNetblock{
-		{Name: "office", Netblock: netip.MustParsePrefix("203.0.113.0/24")},
-		{Name: "scraper-x", Netblock: netip.MustParsePrefix("198.51.100.7/32")},
-		{Name: "v6", Netblock: netip.MustParsePrefix("2001:db8::/32")},
-	}
-	if cfg.AnomalyNetV4Prefix != 16 || cfg.AnomalyNetV6Prefix != 56 ||
-		!slices.Equal(cfg.WatchNets, wantNamed) {
-		t.Errorf("%s, %s and %s gave %d, %d and %v, want 16, 56 and %v",
-			anomalyNetV4Prefix, anomalyNetV6Prefix, watchNets, cfg.AnomalyNetV4Prefix,
-			cfg.AnomalyNetV6Prefix, cfg.WatchNets, wantNamed)
-	}
-
-	// off switches each threshold off.
-	for _, name := range anomalyThresholds() {
-		env[name] = off
-	}
-
-	wantAllOff(t, fromEnvironment(t, env))
-}
-
-// thresholdsByScope returns cfg's anomaly thresholds, each by the prefix
-// of its scope's settings.
-func thresholdsByScope(cfg *config.Config) map[string]anomaly.Thresholds {
-	return map[string]anomaly.Thresholds{
-		anomalyClient: cfg.AnomalyClient, anomalyNet: cfg.AnomalyNet,
-		anomalyASN: cfg.AnomalyASN, anomalyTotal: cfg.AnomalyTotal,
-		watch: cfg.AnomalyWatch,
-	}
-}
-
-// wantAllOff checks that every anomaly threshold of cfg is off.
-func wantAllOff(t *testing.T, cfg *config.Config) {
-	t.Helper()
-
-	for scope, thresholds := range thresholdsByScope(cfg) {
-		if thresholds != (anomaly.Thresholds{}) {
-			t.Errorf("%s* gave %+v, want every one off", scope, thresholds)
-		}
-	}
-}
-
-func TestInvalidAnomalySettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
-	t.Parallel()
-
-	const (
-		notCount        = " is not a whole number of requests such as 1000, or off"
-		notSize         = " is not a size such as 512K, 100M or 5G, or off"
-		notPositive     = " must be more than zero, or off"
-		notNamed        = " is not a name, = and a netblock, such as office=203.0.113.0/24"
-		notNetblock     = " is not a netblock such as 10.0.0.0/8, or an address"
-		notV4Prefix     = " is not the length of an IPv4 netblock, from 0 to 32, such as 24"
-		notV6Prefix     = " is not the length of an IPv6 netblock, from 0 to 128, such as 48"
-		officeNetblock  = "office=203.0.113.0/24"
-		scraperNetblock = "scraper=198.51.100.0/24"
-	)
-
-	for _, tc := range []struct{ name, value, want string }{
-		{anomalyClient + requestsPerMinute, "1K", `"1K"` + notCount},
-		{anomalyNet + requestsPerHour, "0", `"0"` + notPositive},
-		{anomalyTotal + bytesPerMinute, "1T", `"1T"` + notSize},
-		{watch + bytesPerHour, "-1G", `"-1G"` + notPositive},
-		{anomalyNetV4Prefix, "33", `"33"` + notV4Prefix},
-		{anomalyNetV4Prefix, off, `"off"` + notV4Prefix},
-		{anomalyNetV6Prefix, "129", `"129"` + notV6Prefix},
-		{anomalyNetV6Prefix, "/48", `"/48"` + notV6Prefix},
-		{watchNets, "office", `"office"` + notNamed},
-		{watchNets, "=203.0.113.0/24", `"=203.0.113.0/24"` + notNamed},
-		{watchNets, "office=203.0.113.300/24", `"203.0.113.300/24"` + notNetblock},
-		{watchNets, officeNetblock + ",", `"` + officeNetblock + `," has an empty item ` +
-			`in its list`},
-		{
-			watchNets, officeNetblock + "," + scraperNetblock + ",office=192.0.2.0/24",
-			`"office" is listed twice`,
-		},
-	} {
-		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
-
-			want := tc.name + ": " + tc.want
-			if err == nil || err.Error() != want {
-				t.Errorf("error %v, want %s", err, want)
-			}
-		})
-	}
-}
-
-func TestBiasedThresholdsAsSet(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{})
-	if len(cfg.ASNLimitPercent) != 0 || len(cfg.CountryLimitPercent) != 0 ||
-		len(cfg.ASNBytesPercent) != 0 || len(cfg.CountryBytesPercent) != 0 ||
-		cfg.UnknownLimitPercent != 100 {
-		t.Errorf("biased thresholds %v, %v, %v, %v and %d by default, "+
-			"want four empty lists and 100", cfg.ASNLimitPercent, cfg.CountryLimitPercent,
-			cfg.ASNBytesPercent, cfg.CountryBytesPercent, cfg.UnknownLimitPercent)
-	}
-
-	// AS numbers and countries in either case, an AS number with leading
-	// zeros, 0 and 100.
-	cfg = fromEnvironment(t, environment{
-		asnLimitPercent:     "AS14061:50, as16276:0,AS045102:100",
-		countryLimitPercent: "cn:25,RU:50",
-		asnBytesPercent:     "as16276:75",
-		countryBytesPercent: "ru:10",
-		unknownLimitPercent: "0",
 	})
-
-	for name, tc := range map[string]struct{ got, want map[string]int64 }{
-		asnLimitPercent: {
-			cfg.ASNLimitPercent,
-			map[string]int64{"AS14061": 50, "AS16276": 0, "AS45102": 100},
-		},
-		countryLimitPercent: {cfg.CountryLimitPercent, map[string]int64{"CN": 25, "RU": 50}},
-		asnBytesPercent:     {cfg.ASNBytesPercent, map[string]int64{"AS16276": 75}},
-		countryBytesPercent: {cfg.CountryBytesPercent, map[string]int64{"RU": 10}},
-	} {
-		if !maps.Equal(tc.got, tc.want) {
-			t.Errorf("%s gave %v, want %v", name, tc.got, tc.want)
-		}
-	}
-
-	if cfg.UnknownLimitPercent != 0 {
-		t.Errorf("%s gave %d, want 0", unknownLimitPercent, cfg.UnknownLimitPercent)
-	}
-}
-
-func TestInvalidBiasedThresholdStopsTheStartSayingWhatIsWrong(t *testing.T) {
-	t.Parallel()
-
-	const (
-		notASN     = " is not an AS number such as AS64496"
-		notItem    = " is not a code, : and a percentage, such as AS64496:50 or cn:25"
-		notPercent = " is not a percentage, a whole number from 0 to 100"
-	)
-
-	for _, tc := range []struct{ name, value, want string }{
-		{asnLimitPercent, "14061:50", `"14061"` + notASN},
-		{asnLimitPercent, "AS4294967296:50", `"AS4294967296"` + notASN},
-		{asnLimitPercent, "AS14061", `"AS14061"` + notItem},
-		{asnLimitPercent, "AS14061:101", `"101"` + notPercent},
-		{asnLimitPercent, "AS14061:50,as14061:25", `"as14061" is listed twice`},
-		{
-			countryLimitPercent, "nk:25",
-			`"nk" is not a two-letter country code such as de or kp`,
-		},
-		{countryLimitPercent, "cn:25,CN:50", `"CN" is listed twice`},
-		{asnBytesPercent, "AS14061:-1", `"-1"` + notPercent},
-		{countryBytesPercent, "cn:50%", `"50%"` + notPercent},
-		{unknownLimitPercent, "101", `"101"` + notPercent},
-		{unknownLimitPercent, off, `"off"` + notPercent},
-	} {
-		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
-
-			want := tc.name + ": " + tc.want
-			if err == nil || err.Error() != want {
-				t.Errorf("error %v, want %s", err, want)
-			}
-		})
-	}
-}
-
-// dropURL and torURL are blocklists, and asnURL a file of AS:percent
-// lines.
-const (
-	dropURL = "https://www.spamhaus.org/drop/drop.txt"
-	torURL  = "https://lists.example/tor-exits.txt"
-	asnURL  = "https://lists.example/asn.txt"
-)
-
-// The actions of SWWAF_BLOCKLIST_ACTION, as Config gives them.
-const (
-	actionDeny  = "deny"
-	actionLimit = "limit"
-	actionLog   = "log"
-)
-
-func TestReputationSettingsAsSet(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{})
-	if len(cfg.BlocklistURLs) != 0 || cfg.BlocklistRefresh != 24*time.Hour ||
-		cfg.BlocklistAction != actionDeny || cfg.ASNLimitPercentURL != "" {
-		t.Errorf("%s, %s, %s and %s gave %v, %s, %s and %q by default, "+
-			"want none, 24h, deny and none", blocklistURLs, blocklistRefresh,
-			blocklistAction, asnLimitPercentURL, cfg.BlocklistURLs, cfg.BlocklistRefresh,
-			cfg.BlocklistAction, cfg.ASNLimitPercentURL)
-	}
-
-	for _, tc := range []struct {
-		value, action string
-		percent       int64
-	}{
-		{actionDeny, actionDeny, 0},
-		{actionLog, actionLog, 0},
-		{"limit:25", actionLimit, 25},
-		{"limit:0", actionLimit, 0},
-	} {
-		// An hour, the shortest refresh allowed.
-		cfg := fromEnvironment(t, environment{
-			blocklistURLs: dropURL + ", " + torURL, blocklistRefresh: "1h",
-			blocklistAction: tc.value, asnLimitPercentURL: asnURL,
-		})
-
-		if !slices.Equal(cfg.BlocklistURLs, []string{dropURL, torURL}) ||
-			cfg.BlocklistRefresh != time.Hour || cfg.BlocklistAction != tc.action ||
-			cfg.BlocklistLimitPercent != tc.percent || cfg.ASNLimitPercentURL != asnURL {
-			t.Errorf("%s=%s gave %v, %s, %s, %d and %s", blocklistAction, tc.value,
-				cfg.BlocklistURLs, cfg.BlocklistRefresh, cfg.BlocklistAction,
-				cfg.BlocklistLimitPercent, cfg.ASNLimitPercentURL)
-		}
-	}
-}
-
-func TestInvalidReputationSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
-	t.Parallel()
-
-	const (
-		notURL = " is not an http or https URL without a user or a fragment, " +
-			"such as https://www.spamhaus.org/drop/drop.txt"
-		notAnHour = " is not a duration of 1h or more, such as 24h"
-		notAction = " is not deny, limit:<percent> such as limit:25, or log"
-	)
-
-	for _, tc := range []struct{ name, value, want string }{
-		{
-			blocklistURLs, "ftp://lists.example/drop.txt",
-			`"ftp://lists.example/drop.txt"` + notURL,
-		},
-		{blocklistURLs, "lists.example/drop.txt", `"lists.example/drop.txt"` + notURL},
-		{
-			blocklistURLs, "https://me:secret@lists.example/drop.txt",
-			`"https://me:secret@lists.example/drop.txt"` + notURL,
-		},
-		{
-			blocklistURLs, dropURL + "," + torURL + "," + dropURL,
-			`"` + dropURL + `" is listed twice`,
-		},
-		{asnLimitPercentURL, asnURL + "#top", `"` + asnURL + `#top"` + notURL},
-		{blocklistRefresh, "59m", `"59m"` + notAnHour},
-		{blocklistRefresh, off, `"off"` + notAnHour},
-		{blocklistRefresh, "a day", `"a day"` + notAnHour},
-		{blocklistAction, "block", `"block"` + notAction},
-		{blocklistAction, actionLimit, `"limit"` + notAction},
-		{blocklistAction, "limit:101", `"limit:101"` + notAction},
-	} {
-		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
-
-			want := tc.name + ": " + tc.want
-			if err == nil || err.Error() != want {
-				t.Errorf("error %v, want %s", err, want)
-			}
-		})
-	}
-}
-
-func TestASNLimitPercentURLThatIsABlocklistStopsTheStart(t *testing.T) {
-	t.Parallel()
-
-	_, err := config.FromEnvironment(environment{
-		blocklistURLs: dropURL + "," + asnURL, asnLimitPercentURL: asnURL,
-	}.lookupEnv)
-
-	want := asnLimitPercentURL + `: "` + asnURL + `" is in SWWAF_BLOCKLIST_URLS too`
-	if err == nil || err.Error() != want {
-		t.Errorf("error %v, want %s", err, want)
-	}
-}
-
-// dronebl is a DNSBL zone, and spamhaus one of Spamhaus's, a name
-// containing spamhausKey, the key of its keyed query service, which the
-// log shows as spamhausMasked.
-const (
-	dronebl        = "dnsbl.dronebl.org"
-	spamhausKey    = "abcdefghijklmnopqrstuvwxyz"
-	spamhaus       = spamhausKey + ".xbl.dq.spamhaus.net"
-	spamhausMasked = "********.xbl.dq.spamhaus.net"
-)
-
-func TestDNSBLSettingsAsSet(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{})
-	if len(cfg.DNSBLZones) != 0 || cfg.DNSBLResolver.IsValid() ||
-		cfg.ReputationAction != actionLimit || cfg.ReputationLimitPercent != 25 ||
-		cfg.ReputationCacheTTL != 24*time.Hour || cfg.ReputationTimeout != 2*time.Second {
-		t.Errorf("by default, the zones %v, the resolver %s, the action %s:%d, the TTL %s "+
-			"and the timeout %s, want no zone, no resolver, limit:25, 24h and 2s",
-			cfg.DNSBLZones,
-			cfg.DNSBLResolver, cfg.ReputationAction, cfg.ReputationLimitPercent,
-			cfg.ReputationCacheTTL, cfg.ReputationTimeout)
-	}
-
-	// The longest zone allowed, of 189 characters, with labels of 63, the
-	// longest allowed.
-	longest := strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." +
-		strings.Repeat("c", 61)
-
-	for _, tc := range []struct {
-		zones, resolver, action string
-		// want are the zones, resolver, action and percent Config gives.
-		want         []string
-		wantResolver string
-		wantAction   string
-		wantPercent  int64
-	}{
-		{
-			dronebl + ", " + spamhaus, "192.0.2.53", actionDeny,
-			[]string{dronebl, spamhaus}, "192.0.2.53:53", actionDeny, 0,
-		},
-		{
-			longest, "192.0.2.53:5353", actionLog,
-			[]string{longest}, "192.0.2.53:5353", actionLog, 0,
-		},
-		{
-			"Dnsbl-1.Example", "2001:db8::53", "limit:10",
-			[]string{"Dnsbl-1.Example"}, "[2001:db8::53]:53", actionLimit, 10,
-		},
-		{
-			dronebl, "[2001:db8::53]:5353", "limit:0",
-			[]string{dronebl}, "[2001:db8::53]:5353", actionLimit, 0,
-		},
-	} {
-		cfg := fromEnvironment(t, environment{
-			dnsblZones: tc.zones, dnsblResolver: tc.resolver, reputationAction: tc.action,
-			reputationCacheTTL: "12h", reputationTimeout: "3s",
-		})
-
-		if !slices.Equal(cfg.DNSBLZones, tc.want) ||
-			cfg.DNSBLResolver.String() != tc.wantResolver ||
-			cfg.ReputationAction != tc.wantAction ||
-			cfg.ReputationLimitPercent != tc.wantPercent ||
-			cfg.ReputationCacheTTL != 12*time.Hour ||
-			cfg.ReputationTimeout != 3*time.Second {
-			t.Errorf("%s=%s, %s=%s and %s=%s gave %v, %s, %s:%d, %s and %s", dnsblZones,
-				tc.zones, dnsblResolver, tc.resolver, reputationAction, tc.action,
-				cfg.DNSBLZones, cfg.DNSBLResolver, cfg.ReputationAction,
-				cfg.ReputationLimitPercent, cfg.ReputationCacheTTL, cfg.ReputationTimeout)
-		}
-	}
-}
-
-func TestInvalidDNSBLSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
-	t.Parallel()
-
-	const (
-		notZone     = " is not a DNS zone such as dnsbl.dronebl.org"
-		notResolver = " is not an IP address with an optional port, such as 192.0.2.53 " +
-			"or [2001:db8::53]:5353"
-		notAboveZero = " is not a duration above zero, such as 1h or 7d"
-	)
-
-	label64 := strings.Repeat("a", 64) + ".example"
-	tooLong := strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." +
-		strings.Repeat("c", 62)
-
-	for _, tc := range []struct{ name, value, want string }{
-		{dnsblZones, "dnsbl..example", `"dnsbl..example"` + notZone},
-		{dnsblZones, "dnsbl.example.", `"dnsbl.example."` + notZone},
-		{dnsblZones, "-dnsbl.example", `"-dnsbl.example"` + notZone},
-		{dnsblZones, "dnsbl-.example", `"dnsbl-.example"` + notZone},
-		{dnsblZones, "dns_bl.example", `"dns_bl.example"` + notZone},
-		{dnsblZones, label64, `"` + label64 + `"` + notZone},
-		{
-			dnsblZones, tooLong,
-			`"` + tooLong + `" is longer than 189 characters, too long for the names ` +
-				`IPv6 clients are asked about by`,
-		},
-		{
-			dnsblZones, dronebl + "," + spamhaus + "," + dronebl,
-			`"` + dronebl + `" is listed twice`,
-		},
-		// DNS names ignore case.
-		{dnsblZones, "dnsbl.example,DNSBL.example", `"DNSBL.example" is listed twice`},
-		{dnsblResolver, "resolver.example", `"resolver.example"` + notResolver},
-		{dnsblResolver, "192.0.2.53:0", `"192.0.2.53:0"` + notResolver},
-		{dnsblResolver, "192.0.2.53:65536", `"192.0.2.53:65536"` + notResolver},
-		{dnsblResolver, "[2001:db8::53]", `"[2001:db8::53]"` + notResolver},
-		{
-			reputationAction, "ban",
-			`"ban" is not deny, limit:<percent> such as limit:25, or log`,
-		},
-		{reputationCacheTTL, off, `"off"` + notAboveZero},
-		{reputationTimeout, "0s", `"0s"` + notAboveZero},
-	} {
-		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
-
-			want := tc.name + ": " + tc.want
-			if err == nil || err.Error() != want {
-				t.Errorf("error %v, want %s", err, want)
-			}
-		})
-	}
-}
-
-func TestMaskZoneKeyMasksTheFirstLabelOfAZoneUnderDqSpamhausNet(t *testing.T) {
-	t.Parallel()
-
-	for zone, want := range map[string]string{
-		spamhaus:                  spamhausMasked,
-		spamhaus + ".":            spamhausMasked + ".",
-		"KEY.ZEN.DQ.SPAMHAUS.NET": "********.ZEN.DQ.SPAMHAUS.NET",
-		dronebl:                   dronebl,
-		"dq.spamhaus.net":         "dq.spamhaus.net",
-		spamhaus + ".example":     spamhaus + ".example",
-	} {
-		if got := config.MaskZoneKey(zone); got != want {
-			t.Errorf("MaskZoneKey(%q) is %q, want %q", zone, got, want)
-		}
-	}
-}
-
-func TestDNSBLZoneKeyIsLoggedMaskedAndNeverShown(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{dnsblZones: dronebl + ", " + spamhaus})
-
-	var out bytes.Buffer
-
-	slog.New(slog.NewJSONHandler(&out, nil)).Info("starting", "settings", cfg)
-
-	logged := out.String()
-	if strings.Contains(logged, spamhausKey) ||
-		!strings.Contains(logged, `"`+dnsblZones+`":"`+dronebl+","+spamhausMasked+`"`) {
-		t.Errorf("the zones are not logged with the key masked: %s", logged)
-	}
-
-	// Nor does an error that stops the start show a key, in any case.
-	const (
-		notZone   = " is not a DNS zone such as dnsbl.dronebl.org"
-		otherKey  = "zyxwvutsrqponmlkjihgfedcba"
-		otherZone = otherKey + ".xbl.dq.spamhaus.net"
-	)
-
-	// 205 characters, 187 with the key masked.
-	labels := strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." +
-		strings.Repeat("c", 30) + ".xbl.dq.spamhaus.net"
-
-	for _, tc := range []struct{ value, want string }{
-		{spamhaus + ".", `"` + spamhausMasked + `."` + notZone},
-		{spamhausKey + "_.xbl.dq.spamhaus.net", `"` + spamhausMasked + `"` + notZone},
-		{
-			spamhausKey + "." + labels,
-			`"********.` + labels + `" is longer than 189 characters, too long ` +
-				`for the names IPv6 clients are asked about by`,
-		},
-		{
-			spamhaus + "," + strings.ToUpper(spamhaus),
-			`"********.XBL.DQ.SPAMHAUS.NET" is listed twice`,
-		},
-		{spamhaus + "," + otherZone, `"` + spamhausMasked + `" is listed twice`},
-		{spamhaus + ",,", "has an empty item in its list"},
-	} {
-		_, err := config.FromEnvironment(environment{dnsblZones: tc.value}.lookupEnv)
-
-		want := dnsblZones + ": " + tc.want
-		if err == nil || err.Error() != want {
-			t.Errorf("%s=%s gave the error %v, want %s", dnsblZones, tc.value, err, want)
-		}
-	}
-}
-
-func TestAbuseIPDBSettingsAsSet(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{})
-	if cfg.AbuseIPDBKey != "" || cfg.AbuseIPDBMinScore != 75 ||
-		cfg.AbuseIPDBDailyBudget != 900 {
-		t.Errorf("by default, the key %q, the minimum score %d and the daily budget %d, "+
-			"want none, 75 and 900", cfg.AbuseIPDBKey, cfg.AbuseIPDBMinScore,
-			cfg.AbuseIPDBDailyBudget)
-	}
-
-	cfg = fromEnvironment(t, environment{
-		abuseIPDBKey: token, abuseIPDBMinScore: "0", abuseIPDBDailyBudget: "1",
-	})
-	if cfg.AbuseIPDBKey != token || cfg.AbuseIPDBMinScore != 0 ||
-		cfg.AbuseIPDBDailyBudget != 1 {
-		t.Errorf("set, the key %q, the minimum score %d and the daily budget %d, "+
-			"want %s, 0 and 1", cfg.AbuseIPDBKey, cfg.AbuseIPDBMinScore,
-			cfg.AbuseIPDBDailyBudget, token)
-	}
-}
-
-func TestInvalidAbuseIPDBSettingStopsTheStartSayingWhatIsWrong(t *testing.T) {
-	t.Parallel()
-
-	const (
-		notScore  = " is not a percentage, a whole number from 0 to 100"
-		notBudget = " is not a whole number above zero, such as 5000"
-	)
-
-	for _, tc := range []struct{ name, value, want string }{
-		{abuseIPDBMinScore, "101", `"101"` + notScore},
-		{abuseIPDBMinScore, off, `"off"` + notScore},
-		{abuseIPDBDailyBudget, "0", `"0"` + notBudget},
-		{abuseIPDBDailyBudget, off, `"off"` + notBudget},
-		// The key itself is never shown.
-		{
-			abuseIPDBKey, token + "\r",
-			"holds a control character, such as the carriage return of a Windows line end",
-		},
-	} {
-		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := config.FromEnvironment(environment{tc.name: tc.value}.lookupEnv)
-
-			want := tc.name + ": " + tc.want
-			if err == nil || err.Error() != want {
-				t.Errorf("error %v, want %s", err, want)
-			}
-		})
-	}
-}
-
-func TestAbuseIPDBKeyIsLoggedMasked(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{abuseIPDBKey: token})
-
-	var out bytes.Buffer
-
-	slog.New(slog.NewJSONHandler(&out, nil)).Info("starting", "settings", cfg)
-
-	logged := out.String()
-	if strings.Contains(logged, token) ||
-		!strings.Contains(logged, `"`+abuseIPDBKey+`":"********"`) {
-		t.Errorf("the key is not logged masked: %s", logged)
-	}
 }
 
 func TestSizesAndOff(t *testing.T) {
@@ -1738,14 +1054,6 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{allowedCountries, "uk"},
 		{allowedCountries, "zz"},
 		{allowedCountries, "de,germany"},
-		{asnLimitPercent, "AS14061:50,,AS16276:50"}, {asnLimitPercent, "ASX:50"},
-		{asnLimitPercent, "AS14061:"}, {asnLimitPercent, "AS14061 :50"},
-		{asnLimitPercent, "AS14061:1.5"}, {asnLimitPercent, "AS-1:50"},
-		{countryLimitPercent, "cn"}, {countryLimitPercent, "cn:"},
-		{countryLimitPercent, "cn:25:50"}, {countryLimitPercent, "china:25"},
-		{asnBytesPercent, "AS14061:101"}, {countryBytesPercent, "su:50"},
-		{unknownLimitPercent, ""}, {unknownLimitPercent, "-1"},
-		{unknownLimitPercent, "50%"},
 		{metricsTopN, off}, {metricsTopN, "0"}, {metricsTopN, "-1"},
 		{logRequestHeaders, "accept,,origin"}, {logRequestHeaders, "accept;origin"},
 		{logRequestHeaders, "accept language"}, {logRequestHeaders, "x-foo:"},
@@ -1981,7 +1289,6 @@ func writeFile(t *testing.T, contents string) string {
 	return path
 }
 
-//nolint:funlen // one line for each setting, a list that grows with them
 func TestLogsEachSettingWithItsValue(t *testing.T) {
 	t.Parallel()
 
@@ -2018,23 +1325,6 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		addLookupHeaders:        "false",
 		deniedCountries:         "",
 		allowedCountries:        "",
-		asnLimitPercent:         "",
-		countryLimitPercent:     "",
-		asnBytesPercent:         "",
-		countryBytesPercent:     "",
-		unknownLimitPercent:     "100",
-		asnLimitPercentURL:      "",
-		blocklistURLs:           "",
-		blocklistRefresh:        "24h",
-		blocklistAction:         actionDeny,
-		dnsblZones:              "",
-		dnsblResolver:           "",
-		abuseIPDBKey:            "",
-		abuseIPDBMinScore:       "75",
-		abuseIPDBDailyBudget:    "900",
-		reputationAction:        "limit:25",
-		reputationCacheTTL:      defaultReputationCacheTTL,
-		reputationTimeout:       "2s",
 		banResponse:             "403",
 		limitBanDuration:        "1h",
 		limitBanRepeatWindow:    "24h",
@@ -2066,8 +1356,6 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		alertCooldown:           defaultAlertCooldown,
 		alertMaxPerHour:         "60",
 	}
-	maps.Copy(want, loggedAnomalyDefaults())
-
 	if got := loggedSettings(t, cfg); !maps.Equal(got, want) {
 		t.Errorf("logged settings\n%v\nwant\n%v", got, want)
 	}

internal/metrics/metrics.go

@@ -14,10 +14,8 @@ import (
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
@@ -37,12 +35,10 @@ type Metrics struct {
 	rateLimitHits        *prometheus.CounterVec
 	sizeAndTimeLimitHits *prometheus.CounterVec
 	offences             *prometheus.CounterVec
-	// ruleMatches are made by AddRules, and reputationHits by
+	// ruleMatches are made by AddRules.
-	// AddReputation.
+	ruleMatches *prometheus.CounterVec
-	ruleMatches    *prometheus.CounterVec
+	countries   *busiest
-	reputationHits *prometheus.CounterVec
+	asns        *busiest
-	countries      *busiest
-	asns           *busiest
 
 	// GeoJSRequests are the requests to GeoJS, and GeoJSFailures those
 	// that failed. GeoJSUnanswered are the requests that needed their
@@ -257,80 +253,6 @@ func (m *Metrics) AddLookupFile(lastRead func() time.Time, readFailures func() i
 	)
 }
 
-// sourceLabel is the label of the reputation metrics: a list's URL, a
-// DNSBL zone, its key masked, or abuseipdb.
-const sourceLabel = "source"
-
-// AddReputation adds the metrics of the lists fetched from URLs and of the
-// DNSBL zones, by source, each list's URL or each zone, its key masked as
-// config.MaskZoneKey masks it: the requests whose client a blocklist, a
-// zone's verdict or AbuseIPDB's score lists, which ReputationHit counts,
-// and, read from lists and dnsbl as the metrics are asked for, for a list,
-// the fetches that failed and when the copy in use was fetched, and for a
-// zone, the queries made and those that failed. It is called once, before
-// ReputationHit.
-func (m *Metrics) AddReputation(lists *reputation.Lists, dnsbl *reputation.DNSBL) {
-	m.reputationHits = counterVec("smallwebwaf_reputation_hits_total",
-		"Requests whose client a blocklist, a DNSBL zone or AbuseIPDB lists, by "+
-			"the blocklist's URL, the zone, or abuseipdb.",
-		[]string{sourceLabel})
-	m.registry.MustRegister(m.reputationHits)
-
-	for _, zone := range dnsbl.Zones() {
-		source := prometheus.Labels{sourceLabel: config.MaskZoneKey(zone)}
-
-		m.addReputationQueries(source, func() int { return dnsbl.Queries(zone) })
-		m.addReputationFailures(source, func() int { return dnsbl.Failures(zone) })
-	}
-
-	for _, listURL := range lists.URLs() {
-		source := prometheus.Labels{sourceLabel: listURL}
-
-		m.addReputationFailures(source, func() int { return lists.Failures(listURL) })
-		m.registry.MustRegister(
-			prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-				Name: "smallwebwaf_reputation_last_fetch_timestamp_seconds",
-				Help: "When the copy of the list in use was fetched, in seconds since " +
-					"1970, or 0 while there is none.",
-				ConstLabels: source,
-			}, func() float64 {
-				fetched := lists.Fetched(listURL)
-				if fetched.IsZero() {
-					return 0
-				}
-
-				return float64(fetched.Unix())
-			}),
-		)
-	}
-}
-
-// AddAbuseIPDB adds the metrics of AbuseIPDB, with the source abuseipdb,
-// read from abuseIPDB as the metrics are asked for: the checks made, those
-// that failed, and how many checks the day's budget has left. It is
-// called once, after AddReputation, while SWWAF_ABUSEIPDB_KEY is set.
-func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
-	source := prometheus.Labels{sourceLabel: reputation.AbuseIPDBSource}
-
-	m.addReputationQueries(source, abuseIPDB.Checked)
-	m.addReputationFailures(source, abuseIPDB.Failures)
-	m.registry.MustRegister(
-		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name:        "smallwebwaf_reputation_daily_budget_remaining",
-			Help:        "Checks of the day's SWWAF_ABUSEIPDB_DAILY_BUDGET not yet spent.",
-			ConstLabels: source,
-		}, func() float64 {
-			return float64(abuseIPDB.BudgetLeft())
-		}),
-	)
-}
-
-// ReputationHit counts a request whose client source lists: a blocklist,
-// by its URL, a DNSBL zone, its key masked, or AbuseIPDB, abuseipdb.
-func (m *Metrics) ReputationHit(source string) {
-	m.reputationHits.WithLabelValues(source).Inc()
-}
-
 // AddAlerts adds the metrics of the alerts sent to each destination set,
 // read from queue as the metrics are asked for, by destination: the
 // alerts sent, the requests to the destination that failed, the alerts
@@ -470,32 +392,6 @@ func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
 }
 
-// addReputationQueries adds the counter of the queries to source, a DNSBL
-// zone, or of the checks of clients with AbuseIPDB, which count tells.
-func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {
-	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
-		Name:        "smallwebwaf_reputation_queries_total",
-		Help:        "Queries to the DNSBL zone, or checks of clients with AbuseIPDB.",
-		ConstLabels: source,
-	}, func() float64 {
-		return float64(count())
-	}))
-}
-
-// addReputationFailures adds the counter of the fetches of source, a
-// list, the queries to it, a DNSBL zone, or the checks with it, AbuseIPDB,
-// that failed, which count tells.
-func (m *Metrics) addReputationFailures(source prometheus.Labels, count func() int) {
-	m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
-		Name: "smallwebwaf_reputation_failures_total",
-		Help: "Fetches of the list, queries to the DNSBL zone, or checks with " +
-			"AbuseIPDB, that failed.",
-		ConstLabels: source,
-	}, func() float64 {
-		return float64(count())
-	}))
-}
-
 // statusClass returns the class of status, such as 2xx, or none when no
 // status was sent.
 func statusClass(status int) string {

internal/proxy/anomaly_internal_test.go

@@ -1,30 +0,0 @@
-package proxy
-
-import (
-	"net/netip"
-	"testing"
-
-	"sneak.berlin/go/smallwebwaf/internal/config"
-)
-
-func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
-	t.Parallel()
-
-	// A request from a client looked up through GeoJS, with every anomaly
-	// threshold off. Its handler has neither GeoJS's answers nor the
-	// anomaly counters, nor a clock, and the request no response: reading
-	// any of them to count the request panics.
-	rq := &request{
-		h:        &handler{config: &config.Config{LookupSource: "geojs"}},
-		client:   netip.MustParseAddr("203.0.113.9"),
-		lookedUp: true,
-	}
-
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("counting the request did work, with every threshold off: %v", r)
-		}
-	}()
-
-	rq.countAnomalies()
-}

internal/proxy/anomaly_test.go

@@ -1,377 +0,0 @@
-package proxy_test
-
-import (
-	"maps"
-	"net/http"
-	"net/netip"
-	"reflect"
-	"slices"
-	"strconv"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// The anomaly thresholds: the prefix of a scope followed by the end of a
-// count.
-const (
-	anomalyClient = "SWWAF_ANOMALY_CLIENT_"
-	anomalyNet    = "SWWAF_ANOMALY_NET_"
-	anomalyASN    = "SWWAF_ANOMALY_ASN_"
-	anomalyTotal  = "SWWAF_ANOMALY_TOTAL_"
-	anomalyWatch  = "SWWAF_WATCH_"
-
-	requestsPerMinute = "REQUESTS_PER_MINUTE"
-	requestsPerHour   = "REQUESTS_PER_HOUR"
-	bytesPerMinute    = "BYTES_PER_MINUTE"
-	bytesPerHour      = "BYTES_PER_HOUR"
-)
-
-// The other anomaly settings.
-const (
-	anomalyNetV4Prefix = "SWWAF_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix = "SWWAF_ANOMALY_NET_V6_PREFIX"
-	watchNets          = "SWWAF_WATCH_NETS"
-)
-
-const (
-	// clientsNet is the netblock around client at the default length, and
-	// office a named netblock of the same.
-	clientsNet = "203.0.113.0/24"
-	office     = "office=" + clientsNet
-	// aLot is a threshold no test reaches.
-	aLot = "1000"
-	// hour is the window an alert names for a threshold per hour.
-	hour = "hour"
-)
-
-func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
-	t.Parallel()
-
-	for _, scope := range []struct {
-		prefix, scope string
-		// netblock is the alert's, and counted what its reason names. extra
-		// is what its detail gives besides what every anomaly alert's does.
-		netblock netip.Prefix
-		counted  string
-		extra    map[string]any
-	}{
-		{
-			anomalyClient, anomaly.ScopeClient, netip.MustParsePrefix(client + "/32"),
-			"the client " + client + "/32", nil,
-		},
-		{
-			anomalyNet, anomaly.ScopeNet, netip.MustParsePrefix(clientsNet),
-			"the netblock " + clientsNet, nil,
-		},
-		{anomalyASN, anomaly.ScopeASN, netip.Prefix{}, asnDE, map[string]any{"asn": asnDE}},
-		{anomalyTotal, anomaly.ScopeTotal, netip.Prefix{}, "the whole service", nil},
-		{
-			anomalyWatch, anomaly.ScopeWatch, netip.MustParsePrefix(clientsNet),
-			"the named netblock office, " + clientsNet, map[string]any{"name": "office"},
-		},
-	} {
-		for _, threshold := range []struct {
-			end, kind, window string
-			// value is the threshold, which the third upload of 100 bytes
-			// takes the count over, to count.
-			value int64
-			count float64
-		}{
-			{requestsPerMinute, ratelimit.KindRequests, minute, 2, 3},
-			{requestsPerHour, ratelimit.KindRequests, hour, 2, 3},
-			{bytesPerMinute, ratelimit.KindBytes, minute, 250, 300},
-			{bytesPerHour, ratelimit.KindBytes, hour, 250, 300},
-		} {
-			setting := scope.prefix + threshold.end
-			value := strconv.FormatInt(threshold.value, 10)
-
-			t.Run(setting, func(t *testing.T) {
-				t.Parallel()
-
-				s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
-					setting: value, watchNets: office,
-				})
-				start := clk.Now()
-
-				// The third upload takes the count over the threshold, and the
-				// fourth, within the cooldown, is held back. Each is passed to
-				// the app.
-				for range 4 {
-					s.uploadFrom(client)
-				}
-
-				detail := map[string]any{
-					"scope": scope.scope, "window": threshold.window, "kind": threshold.kind,
-					"count": threshold.count, "threshold": threshold.value,
-				}
-				maps.Copy(detail, scope.extra)
-
-				wantAlerts(t, queue, alerts.Alert{
-					Instance: alertInstance,
-					Time:     start,
-					Event:    alerts.EventAnomaly,
-					Client:   netip.MustParseAddr(client),
-					Netblock: scope.netblock,
-					ASN:      asnDE,
-					ASName:   asNameDE,
-					Country:  "DE",
-					Reason: threshold.kind + " per " + threshold.window + " of " +
-						scope.counted + " over the threshold of " + value,
-					Detail: detail,
-				})
-
-				wantAlertedAgainOnceTheCooldownHasRunOut(t, s, clk, queue)
-
-				if held := server.Ledger.Snapshot(); len(held) != 0 {
-					t.Errorf("the ledger holds %+v, want no ban", held)
-				}
-			})
-		}
-	}
-}
-
-// wantAlertedAgainOnceTheCooldownHasRunOut checks that, once the cooldown
-// has run out after a first alert, which held back one repeat, the next
-// count over the threshold, at the latest three uploads from client on,
-// raises another alert, giving that repeat.
-func wantAlertedAgainOnceTheCooldownHasRunOut(
-	t *testing.T, s *sender, clk *clock, queue *alerts.Queue,
-) {
-	t.Helper()
-
-	clk.advance(15 * time.Minute)
-
-	for range 3 {
-		s.uploadFrom(client)
-	}
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 2 || !waiting[1].Time.Equal(clk.Now()) ||
-		waiting[1].SuppressedRepeats != 1 {
-		t.Errorf("alerts wait %+v, want the first and another, with 1 repeat", waiting)
-	}
-}
-
-func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
-	t.Parallel()
-
-	const (
-		allowed = "192.0.2.7"  // in SWWAF_ALLOW_NETS
-		exempt  = "192.0.2.10" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
-		denied  = "192.0.2.20" // in SWWAF_DENY_NETS
-	)
-
-	s, _, _, queue := startAppWithAlerts(t, readAndAnswer, map[string]string{
-		anomalyClient + requestsPerMinute: "2",
-		allowNets:                         allowed,
-		rateLimitExemptNets:               exempt,
-		rateLimitExemptPaths:              "/static/",
-		denyNets:                          denied,
-	})
-
-	// The third request of each takes its client's count over the threshold
-	// of 2.
-	for _, sent := range []struct {
-		from, path string
-		status     int
-		action     string
-	}{
-		{allowed, "/", http.StatusOK, requestlog.ActionForward},
-		{exempt, "/", http.StatusOK, requestlog.ActionForward},
-		{client, "/static/app.js", http.StatusOK, requestlog.ActionForward},
-		{denied, "/", http.StatusForbidden, requestlog.ActionDenied},
-	} {
-		for range 3 {
-			s.request(sent.from, sent.path, sent.status, sent.action)
-		}
-	}
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-
-	got := make([]string, 0, len(waiting))
-	for _, alert := range waiting {
-		got = append(got, alert.Client.String())
-	}
-
-	if want := []string{allowed, exempt, client, denied}; !slices.Equal(got, want) {
-		t.Errorf("alerts for the clients %v, want %v", got, want)
-	}
-}
-
-func TestThresholdsOffCountNothingAndAlertNothing(t *testing.T) {
-	t.Parallel()
-
-	// With every threshold off, nothing is counted.
-	s, server, queue := startWithLookups(t, map[string]string{watchNets: office})
-
-	for range 5 {
-		s.uploadFrom(client)
-	}
-
-	if counters := server.Anomalies.Snapshot(); len(counters) != 0 {
-		t.Errorf("counters %+v, want none", counters)
-	}
-
-	wantAlerts(t, queue)
-
-	// With one set, its count alone is counted, in its scope alone.
-	s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
-		anomalyNet + requestsPerMinute: aLot, watchNets: office,
-	})
-
-	for range 5 {
-		s.uploadFrom(client)
-	}
-
-	want := []anomaly.Counter{{
-		Scope:    anomaly.ScopeNet,
-		Netblock: netip.MustParsePrefix(clientsNet),
-		Minute:   ratelimit.Buckets{Start: clk.Now(), Current: 5},
-	}}
-	if got := server.Anomalies.Snapshot(); !reflect.DeepEqual(got, want) {
-		t.Errorf("counters\n%+v\nwant\n%+v", got, want)
-	}
-
-	wantAlerts(t, queue)
-}
-
-func TestNetblockAroundAClientIsAsLongAsTheSettingsSay(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		env  map[string]string
-		// Each client of sent sends one request, and want gives the
-		// netblocks they are counted in, each with its requests.
-		sent []string
-		want map[string]int64
-	}{
-		{
-			"by default", nil,
-			[]string{client, "203.0.113.200", "192.0.2.7", ipv6Client, "2001:db8:0:ffff::1"},
-			map[string]int64{clientsNet: 2, "192.0.2.0/24": 1, "2001:db8::/48": 2},
-		},
-		{
-			"as set", map[string]string{anomalyNetV4Prefix: "16", anomalyNetV6Prefix: "32"},
-			[]string{client, "203.0.200.1", ipv6Client, "2001:db8:ffff::1"},
-			map[string]int64{"203.0.0.0/16": 2, "2001:db8::/32": 2},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			env := map[string]string{anomalyNet + requestsPerMinute: aLot}
-			maps.Copy(env, tc.env)
-
-			s, _, server, _ := startAppWithAlerts(t, readAndAnswer, env)
-
-			for _, from := range tc.sent {
-				s.get(from, http.StatusOK, requestlog.ActionForward)
-			}
-
-			got := map[string]int64{}
-			for _, counter := range server.Anomalies.Snapshot() {
-				got[counter.Netblock.String()] = counter.Minute.Current
-			}
-
-			if !maps.Equal(got, tc.want) {
-				t.Errorf("requests by netblock %v, want %v", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestClientIsCountedForItsASNumberOnceTheLookupGivesOne(t *testing.T) {
-	t.Parallel()
-
-	s, server, _ := startWithLookups(t, map[string]string{
-		anomalyASN + requestsPerMinute: aLot,
-	})
-
-	// The lookup database does not hold unplaced.
-	for _, from := range []string{fromDE, fromDE, fromKP, noCountry, unplaced} {
-		s.uploadFrom(from)
-	}
-
-	got := map[string]int64{}
-	for _, counter := range server.Anomalies.Snapshot() {
-		got[counter.ASN] = counter.Minute.Current
-	}
-
-	if want := map[string]int64{asnDE: 2, asnKP: 1, "AS64500": 1}; !maps.Equal(got, want) {
-		t.Errorf("requests by AS number %v, want %v", got, want)
-	}
-}
-
-func TestRequestCountsForTheASNumberGeoJSGivesBeforeItEnds(t *testing.T) {
-	t.Parallel()
-
-	// The stand-in for GeoJS answers only once released, which the app
-	// does as it answers the request, and then waits until the answer is
-	// kept.
-	geojsURL, _, release := startHeldGeoJS(t)
-
-	var server atomic.Pointer[proxy.Server]
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		release()
-		waitUntil(func() bool {
-			_, kept := server.Load().GeoJS.Kept(netip.MustParsePrefix(fromDE + "/32"))
-
-			return kept
-		})
-	})
-	clk := &clock{now: time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)}
-	addr, out, started := startProxyWithClock(t, app.URL, geojsURL, clk.Now,
-		map[string]string{
-			trustedProxies:                 trustLocalhost,
-			lookupTimeout:                  "1h",
-			anomalyASN + requestsPerMinute: aLot,
-		})
-	server.Store(started)
-
-	// The request went on without the answer, and is counted for the AS
-	// number it gives.
-	s := &sender{t: t, addr: addr, out: out}
-	if line := s.get(fromDE, http.StatusOK, requestlog.ActionForward); line.ASN != "" {
-		t.Errorf("log line has AS number %q, want none: the request waited", line.ASN)
-	}
-
-	want := []anomaly.Counter{{
-		Scope: anomaly.ScopeASN, ASN: asnDE,
-		Minute: ratelimit.Buckets{Start: clk.Now(), Current: 1},
-	}}
-	if got := started.Anomalies.Snapshot(); !reflect.DeepEqual(got, want) {
-		t.Errorf("counters\n%+v\nwant\n%+v", got, want)
-	}
-}
-
-func TestEachNamedNetblockCountsTheClientsInIt(t *testing.T) {
-	t.Parallel()
-
-	s, _, server, _ := startAppWithAlerts(t, readAndAnswer, map[string]string{
-		anomalyWatch + requestsPerMinute: aLot,
-		watchNets:                        office + ",wide=203.0.0.0/16,other=198.51.100.0/25",
-	})
-
-	// client is in office and in wide.
-	for _, from := range []string{client, "203.0.200.1", "192.0.2.7"} {
-		s.get(from, http.StatusOK, requestlog.ActionForward)
-	}
-
-	got := map[string]int64{}
-	for _, counter := range server.Anomalies.Snapshot() {
-		got[counter.Name] = counter.Minute.Current
-	}
-
-	if want := map[string]int64{"office": 1, "wide": 2}; !maps.Equal(got, want) {
-		t.Errorf("requests by named netblock %v, want %v", got, want)
-	}
-}

internal/proxy/bans.go

@@ -42,11 +42,9 @@ func (rq *request) banned(now time.Time) bool {
 
 // limitBroken counts the request for the rate limits at now, notes the
 // client's counts for the log line, and reports whether the request takes
-// the client over a rate limit, as its limit percentage lowers it, which
+// the client over a rate limit, which breaks it.
-// breaks it.
 func (rq *request) limitBroken(now time.Time) bool {
-	counts, hit, over := rq.h.limiter.Count(clientGroup(rq.client), now,
+	counts, hit, over := rq.h.limiter.Count(clientGroup(rq.client), now)
-		rq.limitPercent.percent)
 	rq.line.Counts = counts
 
 	if over {
@@ -56,23 +54,42 @@ func (rq *request) limitBroken(now time.Time) bool {
 	return over
 }
 
-// countBytes counts the request's bytes, as countedBytes gives them, for
+// countBytes counts the request's bytes for the byte limits, once its
-// the byte limits, once its response has ended, and notes the client's
+// response has ended, and notes the client's byte totals for the log line;
-// byte totals for the log line; its requests stay there as the rate limits
+// its requests stay there as the rate limits counted them. The bytes are
-// counted them. Only a request passed to the app has them counted, and
+// the response's body bytes, the request's, or both, as SWWAF_BYTES_COUNT
-// only one the rate limits counted; in observe mode, not one that enforce
+// says; for an upgraded connection, such as a WebSocket, which has closed
-// mode would have refused. Bytes that take the client over a byte limit,
+// by then, what it carried from the app counts with the response's and
-// as its limit percentage for the byte limits lowers it, break it; the
+// what it carried from the client with the request's. Only a request
-// response was passed on whole.
+// passed to the app has them counted, and only one the rate limits
+// counted; in observe mode, not one that enforce mode would have refused.
+// Bytes that take the client over a byte limit break it; the response was
+// passed on whole.
 func (rq *request) countBytes() {
 	if !rq.counted || rq.line.WouldAction != "" {
 		return
 	}
 
+	response, request := rq.out.bytes, rq.requestBytes()
+	if rq.upgraded != nil {
+		response += rq.upgraded.fromApp.Load()
+		request += rq.upgraded.toApp.Load()
+	}
+
+	var bytes int64
+
+	switch rq.h.config.BytesCount {
+	case "response":
+		bytes = response
+	case "request":
+		bytes = request
+	default: // both
+		bytes = response + request
+	}
+
 	now := rq.h.now()
 
-	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now,
+	counts, hit, over := rq.h.limiter.CountBytes(clientGroup(rq.client), now, bytes)
-		rq.countedBytes(), rq.bytesPercent.percent)
 	rq.line.Counts.MinuteBytes = counts.MinuteBytes
 	rq.line.Counts.HourBytes = counts.HourBytes
 	rq.line.Counts.DayBytes = counts.DayBytes
@@ -82,37 +99,13 @@ func (rq *request) countBytes() {
 	}
 }
 
-// countedBytes returns the request's bytes, once it has ended, as the
-// byte limits and the anomaly thresholds count them: the response's body
-// bytes, the request's, or both, as SWWAF_BYTES_COUNT says. For an
-// upgraded connection, such as a WebSocket, which has closed by then, what
-// it carried from the app counts with the response's and what it carried
-// from the client with the request's.
-func (rq *request) countedBytes() int64 {
-	response, request := rq.out.bytes, rq.requestBytes()
-	if rq.upgraded != nil {
-		response += rq.upgraded.fromApp.Load()
-		request += rq.upgraded.toApp.Load()
-	}
-
-	switch rq.h.config.BytesCount {
-	case "response":
-		return response
-	case "request":
-		return request
-	default: // both
-		return response + request
-	}
-}
-
 // banForLimit bans the client's netblock at now for a broken limit, the
 // one hit names, and notes the offence for the log line. status is what
 // the client was sent, or is sent: SWWAF_BAN_RESPONSE for a request over
 // a rate limit, the app's answer for one whose bytes broke a byte limit.
-// The ban's notes give the client's limit percentage for that kind of
+// The ban sets the client's counters back to zero. In observe mode it
-// limit. The ban sets the client's counters back to zero. In observe mode
+// makes no ban and sets nothing back, and raises the alert for the ban it
-// it makes no ban and sets nothing back, and raises the alert for the ban
+// would have made, if that alert would be sent.
-// it would have made, if that alert would be sent.
 func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	rq.line.LimitHit = hit.Window
 	if hit.Kind == ratelimit.KindBytes {
@@ -138,13 +131,6 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 		Requests: rq.netblockRequests(netblock),
 	}
 
-	percent := rq.limitPercent
-	if hit.Kind == ratelimit.KindBytes {
-		percent = rq.bytesPercent
-	}
-
-	notes.LimitPercent, notes.LimitPercentSetting = percent.logged()
-
 	if rq.h.config.Observe {
 		ban, wouldBan := rq.h.ledger.WouldBanForLimit(netblock, now, notes)
 		if wouldBan {

internal/proxy/biased.go

@@ -1,119 +0,0 @@
-package proxy
-
-import (
-	"sneak.berlin/go/smallwebwaf/internal/config"
-)
-
-// whole is the percentage of each limit a client gets when no biased
-// threshold lowers its limits.
-const whole = 100
-
-// percentage is a client's limit percentage for the rate limits or for
-// the byte limits, as the biased thresholds give it, and the setting that
-// gave it: "" with whole when none lowers that kind of limit.
-type percentage struct {
-	percent int64
-	setting string
-}
-
-// biasedThresholdsSet reports whether a biased threshold can lower a
-// client's limits: one of its lists is not empty,
-// SWWAF_UNKNOWN_LIMIT_PERCENT is below 100, or SWWAF_ASN_LIMIT_PERCENT_URL
-// is set. The client's lookup is then needed before its request goes on.
-func biasedThresholdsSet(cfg *config.Config) bool {
-	return len(cfg.ASNLimitPercent) > 0 || len(cfg.CountryLimitPercent) > 0 ||
-		len(cfg.ASNBytesPercent) > 0 || len(cfg.CountryBytesPercent) > 0 ||
-		cfg.UnknownLimitPercent < whole || cfg.ASNLimitPercentURL != ""
-}
-
-// limitPercentages returns the client's limit percentages, for the rate
-// limits and for the byte limits, by its AS number and country as looked
-// up, each "" when unknown, and the blocklists, DNSBL zones and AbuseIPDB
-// that list it. Each is the lowest of those the settings give it, the
-// first of them in the order below when several are lowest: the
-// percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
-// SWWAF_ASN_LIMIT_PERCENT_URL names gives it, the one
-// SWWAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
-// country, SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists,
-// the percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a
-// client a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit,
-// the percentage of SWWAF_REPUTATION_ACTION while it is limit. For the
-// byte limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT
-// take the place of the first three for an AS number or a country they
-// list.
-func (rq *request) limitPercentages() (percentage, percentage) {
-	cfg := rq.h.config
-	asn, country := rq.line.ASN, rq.line.Country
-
-	unknown := percentage{percent: whole}
-	if country == "" {
-		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
-	}
-
-	fetched := percentage{percent: whole}
-	if percent, listed := rq.h.lists.ASNLimitPercent(asn); listed {
-		fetched = percentage{percent, "SWWAF_ASN_LIMIT_PERCENT_URL"}
-	}
-
-	blocklisted := percentage{percent: whole}
-	if rq.blocklisted && cfg.BlocklistAction == "limit" {
-		blocklisted = percentage{cfg.BlocklistLimitPercent, "SWWAF_BLOCKLIST_ACTION"}
-	}
-
-	reputationListed := percentage{percent: whole}
-	if (rq.dnsblListed || rq.abuseIPDBHit) && cfg.ReputationAction == "limit" {
-		reputationListed = percentage{cfg.ReputationLimitPercent, "SWWAF_REPUTATION_ACTION"}
-	}
-
-	asnRequests := lowest(given(cfg.ASNLimitPercent, asn, "SWWAF_ASN_LIMIT_PERCENT"),
-		fetched)
-	countryRequests := given(cfg.CountryLimitPercent, country,
-		"SWWAF_COUNTRY_LIMIT_PERCENT")
-
-	asnBytes, countryBytes := asnRequests, countryRequests
-	if _, listed := cfg.ASNBytesPercent[asn]; listed {
-		asnBytes = given(cfg.ASNBytesPercent, asn, "SWWAF_ASN_BYTES_PERCENT")
-	}
-
-	if _, listed := cfg.CountryBytesPercent[country]; listed {
-		countryBytes = given(cfg.CountryBytesPercent, country, "SWWAF_COUNTRY_BYTES_PERCENT")
-	}
-
-	return lowest(asnRequests, countryRequests, unknown, blocklisted, reputationListed),
-		lowest(asnBytes, countryBytes, unknown, blocklisted, reputationListed)
-}
-
-// given returns the percentage percents, the setting named setting, gives
-// code, an AS number or a country, or whole when it does not list code.
-func given(percents map[string]int64, code, setting string) percentage {
-	percent, listed := percents[code]
-	if !listed {
-		return percentage{percent: whole}
-	}
-
-	return percentage{percent, setting}
-}
-
-// lowest returns the lowest of percentages below whole, the first of them
-// when several are lowest, or whole when none is below it.
-func lowest(percentages ...percentage) percentage {
-	low := percentage{percent: whole}
-
-	for _, p := range percentages {
-		if p.percent < low.percent {
-			low = p
-		}
-	}
-
-	return low
-}
-
-// logged returns p as the log line and the notes of a ban give it: its
-// percent and setting, or nil and "" for whole, which they leave out.
-func (p percentage) logged() (*int64, string) {
-	if p.percent == whole {
-		return nil, ""
-	}
-
-	return &p.percent, p.setting
-}

internal/proxy/biased_test.go

@@ -1,504 +0,0 @@
-package proxy_test
-
-import (
-	"fmt"
-	"io"
-	"maps"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"path/filepath"
-	"strings"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// The biased thresholds.
-const (
-	asnLimitPercent     = "SWWAF_ASN_LIMIT_PERCENT"
-	countryLimitPercent = "SWWAF_COUNTRY_LIMIT_PERCENT"
-	asnBytesPercent     = "SWWAF_ASN_BYTES_PERCENT"
-	countryBytesPercent = "SWWAF_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent = "SWWAF_UNKNOWN_LIMIT_PERCENT"
-)
-
-const (
-	// asnDEHalf and countryDEHalf give fromDE's AS number and its country
-	// half of every limit, and asnDEQuarter gives its AS number a quarter.
-	asnDEHalf     = asnDE + ":50"
-	asnDEQuarter  = asnDE + ":25"
-	countryDEHalf = "de:50"
-	// noCountry is in an AS of its own, AS64500, and in no country.
-	noCountry = "192.0.2.80"
-	// fourAMinute is the rate limit these tests set: half of it is 2
-	// requests a minute, a quarter of it 1.
-	fourAMinute = "4"
-	// twoUploads is the byte limit these tests set: 199 bytes, which an
-	// upload, a request with a body and its answer, 100 bytes, is within,
-	// and half of which, 99 bytes, it is over.
-	twoUploads = "199"
-	// none is how percentText gives a percentage left out.
-	none = "none"
-)
-
-func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		setting, value, from string
-	}{
-		{asnLimitPercent, asnDEHalf, fromDE},
-		{countryLimitPercent, countryDEHalf, fromDE},
-		{unknownLimitPercent, "50", unplaced},
-	} {
-		t.Run(tc.setting, func(t *testing.T) {
-			t.Parallel()
-
-			s, _, _ := startWithLookups(t, map[string]string{
-				rateLimitPerMinute: fourAMinute, tc.setting: tc.value,
-			})
-
-			// Half of 4 requests a minute: the third breaks the limit.
-			for _, sent := range []struct {
-				status int
-				action string
-			}{
-				{http.StatusOK, requestlog.ActionForward},
-				{http.StatusOK, requestlog.ActionForward},
-				{http.StatusForbidden, requestlog.ActionRateLimited},
-			} {
-				line := s.get(tc.from, sent.status, sent.action)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-					"50 from "+tc.setting)
-			}
-
-			// fromKP, which no setting lists, has the whole limit.
-			for range 3 {
-				line := s.get(fromKP, http.StatusOK, requestlog.ActionForward)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-					none)
-			}
-		})
-	}
-}
-
-func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
-	t.Parallel()
-
-	// The AS numbers and countries are given in either case.
-	for _, tc := range []struct {
-		setting, value, from string
-	}{
-		{asnLimitPercent, asnDEHalf, fromDE},
-		{countryLimitPercent, "DE:50", fromDE},
-		{unknownLimitPercent, "50", unplaced},
-		{asnBytesPercent, "as64496:50", fromDE},
-		{countryBytesPercent, countryDEHalf, fromDE},
-	} {
-		t.Run(tc.setting, func(t *testing.T) {
-			t.Parallel()
-
-			s, _, _ := startWithLookups(t, map[string]string{
-				bytesLimitPerMinute: twoUploads, tc.setting: tc.value,
-			})
-
-			// The upload's 100 bytes are over half of 199, 99.
-			line := s.uploadFrom(tc.from)
-			if line.LimitHit != minuteBytes {
-				t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
-			}
-
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
-				"50 from "+tc.setting)
-
-			// fromKP, which no setting lists, has the whole limit.
-			line = s.uploadFrom(fromKP)
-			if line.LimitHit != "" {
-				t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
-			}
-
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting, none)
-		})
-	}
-}
-
-func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		env  map[string]string
-		// limitPercent and bytesPercent are the log line's, as percentText
-		// gives them, and limitHit is its limit_hit.
-		limitPercent, bytesPercent, limitHit string
-	}{
-		{
-			"lowering the byte limits alone",
-			map[string]string{asnBytesPercent: asnDEHalf},
-			none, "50 from " + asnBytesPercent, minuteBytes,
-		},
-		{
-			"lowering the byte limits alone, by country",
-			map[string]string{countryBytesPercent: countryDEHalf},
-			none, "50 from " + countryBytesPercent, minuteBytes,
-		},
-		{
-			"raising the byte limits back",
-			map[string]string{asnLimitPercent: asnDEHalf, asnBytesPercent: asnDE + ":100"},
-			"50 from " + asnLimitPercent, none, "",
-		},
-		{
-			"raising the byte limits back, by country",
-			map[string]string{countryLimitPercent: countryDEHalf, countryBytesPercent: "de:100"},
-			"50 from " + countryLimitPercent, none, "",
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			env := map[string]string{bytesLimitPerMinute: twoUploads}
-			maps.Copy(env, tc.env)
-			s, _, _ := startWithLookups(t, env)
-
-			// The upload's 100 bytes are over 99, half of 199, and within 199.
-			line := s.uploadFrom(fromDE)
-			if line.LimitHit != tc.limitHit {
-				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
-			}
-
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-				tc.limitPercent)
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
-				tc.bytesPercent)
-		})
-	}
-}
-
-func TestZeroPercentIsAZeroAllowance(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithLookups(t, map[string]string{asnLimitPercent: asnDE + ":0"})
-
-	// The first request breaks the limit, and bans the client; the log line
-	// gives the 0.
-	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
-	if line.fields["limit_percent"] != float64(0) ||
-		line.fields["limit_percent_setting"] != asnLimitPercent {
-		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
-			line.fields["limit_percent"], line.fields["limit_percent_setting"],
-			asnLimitPercent)
-	}
-
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
-}
-
-func TestLowestPercentageApplies(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		env  map[string]string
-		from string
-		// want is the log line's limit_percent, as percentText gives it.
-		want string
-	}{
-		{
-			"the country's",
-			map[string]string{asnLimitPercent: asnDEHalf, countryLimitPercent: "de:25"},
-			fromDE, "25 from " + countryLimitPercent,
-		},
-		{
-			"the AS number's",
-			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: countryDEHalf},
-			fromDE, "25 from " + asnLimitPercent,
-		},
-		{
-			"the AS number's, the first of two alike",
-			map[string]string{asnLimitPercent: asnDEQuarter, countryLimitPercent: "de:25"},
-			fromDE, "25 from " + asnLimitPercent,
-		},
-		{
-			"that for a client without a country",
-			map[string]string{asnLimitPercent: "AS64500:50", unknownLimitPercent: "25"},
-			noCountry, "25 from " + unknownLimitPercent,
-		},
-		{
-			// SWWAF_UNKNOWN_LIMIT_PERCENT is left at its default, 100.
-			"the AS number's, for a client without a country",
-			map[string]string{asnLimitPercent: "AS64500:25"},
-			noCountry, "25 from " + asnLimitPercent,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			env := map[string]string{rateLimitPerMinute: fourAMinute}
-			maps.Copy(env, tc.env)
-			s, _, _ := startWithLookups(t, env)
-
-			// A quarter of 4 requests a minute: the second breaks the limit.
-			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
-
-			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionRateLimited)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-				tc.want)
-		})
-	}
-}
-
-func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithLookups(t, map[string]string{
-		rateLimitPerMinute: fourAMinute, unknownLimitPercent: "50",
-	})
-
-	// One the lookup database does not hold, and one on a private address,
-	// which is never looked up: the third request of each breaks half of 4.
-	for _, from := range []string{unplaced, "10.0.0.8"} {
-		s.get(from, http.StatusOK, requestlog.ActionForward)
-		s.get(from, http.StatusOK, requestlog.ActionForward)
-		s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
-	}
-
-	// One in a country has the whole limit.
-	for range 3 {
-		s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	}
-}
-
-func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
-	t.Parallel()
-
-	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
-	// says, with a GeoJS that never answers.
-	synctest.Test(t, func(t *testing.T) {
-		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
-			time.Now, map[string]string{unknownLimitPercent: "0"})
-
-		// Once the second the request waits for its answer is up, the client
-		// counts as without a country, and its zero allowance refuses the
-		// request before it reaches the app.
-		serveFromDE(t, server, http.MethodGet, http.NoBody)
-
-		line := out.requestLine(t)
-		wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
-		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-			"0 from "+unknownLimitPercent)
-	})
-}
-
-func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
-	t.Parallel()
-
-	const timeout = 3 * time.Second
-
-	for _, tc := range []struct {
-		setting, value string
-		waits          bool
-	}{
-		{asnLimitPercent, asnDEHalf, true},
-		{countryLimitPercent, countryDEHalf, true},
-		{asnBytesPercent, asnDEHalf, true},
-		{countryBytesPercent, countryDEHalf, true},
-		{unknownLimitPercent, "99", true},
-		{asnLimitPercentURL, asnURL, true},
-		// At 100, its default, it lowers no limit.
-		{unknownLimitPercent, "100", false},
-	} {
-		t.Run(tc.setting+"="+tc.value, func(t *testing.T) {
-			t.Parallel()
-
-			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
-			// says, with a GeoJS that never answers.
-			synctest.Test(t, func(t *testing.T) {
-				// The request's body is over SWWAF_REQUEST_MAX_BYTES, so that it
-				// is refused after the checks, and never reaches the app.
-				server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
-					time.Now, map[string]string{
-						lookupTimeout: timeout.String(), requestMaxBytes: "1",
-						tc.setting: tc.value,
-					})
-				began := time.Now()
-
-				serveFromDE(t, server, http.MethodPost, strings.NewReader("ab"))
-
-				want := time.Duration(0)
-				if tc.waits {
-					want = timeout
-				}
-
-				if waited := time.Since(began); waited != want {
-					t.Errorf("the request waited %s for its answer, want %s", waited, want)
-				}
-
-				wantLine(t, out.requestLine(t), http.StatusRequestEntityTooLarge,
-					requestlog.ActionTooLarge)
-
-				// The bubble's clock stops once this function returns, so the
-				// request to GeoJS, which a request that did not wait leaves
-				// under way, has to be abandoned before then.
-				time.Sleep(timeout)
-			})
-		})
-	}
-}
-
-func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		env  map[string]string
-		// before is how many uploads come before the one that breaks a
-		// limit, which is answered with status and logged with action.
-		before int
-		status int
-		action string
-		// reason and want are the ban's reason, and its notes' limit
-		// percentage, as percentText gives it.
-		reason, want string
-	}{
-		{
-			// A quarter of 12 requests a minute is 3: the fourth breaks it.
-			"a rate limit",
-			map[string]string{rateLimitPerMinute: "12", asnLimitPercent: asnDEQuarter},
-			3, http.StatusForbidden, requestlog.ActionRateLimited,
-			"requests per minute over the limit of 3", "25 from " + asnLimitPercent,
-		},
-		{
-			// The byte limits' percentage, not the rate limits'.
-			"a byte limit",
-			map[string]string{
-				bytesLimitPerMinute: twoUploads, asnLimitPercent: asnDEQuarter,
-				asnBytesPercent: asnDEHalf,
-			},
-			0, http.StatusOK, requestlog.ActionForward,
-			"bytes per minute over the limit of 99", "50 from " + asnBytesPercent,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			s, server, queue := startWithLookups(t, tc.env)
-
-			for range tc.before {
-				s.uploadFrom(fromDE)
-			}
-
-			s.requestWithBody(http.MethodPost, fromDE, "/", uploadHeader, uploadBody,
-				tc.status, tc.action)
-
-			held := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
-			if len(held) != 1 {
-				t.Fatalf("bans %+v, want one", held)
-			}
-
-			notes := held[0].Notes
-			if held[0].Reason != tc.reason {
-				t.Errorf("the ban's reason is %q, want %q", held[0].Reason, tc.reason)
-			}
-
-			wantPercent(t, "the notes' limit_percent", notes.LimitPercent,
-				notes.LimitPercentSetting, tc.want)
-
-			waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-			if len(waiting) != 1 {
-				t.Fatalf("%d alerts wait, want the ban's alone: %+v", len(waiting), waiting)
-			}
-
-			alerted, _ := waiting[0].Detail["notes"].(bans.Notes)
-			wantPercent(t, "the alert's notes' limit_percent", alerted.LimitPercent,
-				alerted.LimitPercentSetting, tc.want)
-		})
-	}
-}
-
-// startWithLookups is startWithLookupsAndClock for a test that needs no
-// clock.
-func startWithLookups(
-	t *testing.T, env map[string]string,
-) (*sender, *proxy.Server, *alerts.Queue) {
-	t.Helper()
-
-	s, _, server, queue := startWithLookupsAndClock(t, env)
-
-	return s, server, queue
-}
-
-// startWithLookupsAndClock is startAppWithAlerts in front of
-// readAndAnswer, with the settings in env on top of clients looked up in a
-// lookup database, which places fromDE and fromKP in the AS numbers and
-// countries the stand-in for GeoJS gives them, noCountry in AS64500 and no
-// country, and no other address.
-func startWithLookupsAndClock(
-	t *testing.T, env map[string]string,
-) (*sender, *clock, *proxy.Server, *alerts.Queue) {
-	t.Helper()
-
-	path := filepath.Join(t.TempDir(), "ipinfo_lite.mmdb")
-	lookuptest.Write(t, path, map[string]lookuptest.Network{
-		fromDE + "/32":    {ASN: asnDE, ASName: asNameDE, Country: "DE"},
-		fromKP + "/32":    {ASN: asnKP, ASName: asNameKP, Country: "KP"},
-		noCountry + "/32": {ASN: "AS64500", ASName: "Nowhere Net"},
-	})
-
-	settings := map[string]string{lookupSource: fileSource, lookupDBPath: path}
-	maps.Copy(settings, env)
-
-	return startAppWithAlerts(t, readAndAnswer, settings)
-}
-
-// uploadFrom is upload from the client at from.
-func (s *sender) uploadFrom(from string) logLine {
-	s.t.Helper()
-
-	line, _ := s.requestWithBody(http.MethodPost, from, "/", uploadHeader, uploadBody,
-		http.StatusOK, requestlog.ActionForward)
-
-	return line
-}
-
-// serveFromDE hands a request from fromDE with method and body straight to
-// server's handler, without the network, and returns once it is answered.
-func serveFromDE(t *testing.T, server *proxy.Server, method string, body io.Reader) {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
-	req.RemoteAddr = net.JoinHostPort(fromDE, "1234")
-
-	server.Handler.ServeHTTP(httptest.NewRecorder(), req)
-}
-
-// wantPercent checks a limit percentage that a log line or a ban's notes
-// give, what, and the setting that gave it, against want, as percentText
-// gives them.
-func wantPercent(t *testing.T, what string, percent *int64, setting, want string) {
-	t.Helper()
-
-	if got := percentText(percent, setting); got != want {
-		t.Errorf("%s is %s, want %s", what, got, want)
-	}
-}
-
-// percentText gives a limit percentage and the setting that gave it as
-// text, such as "50 from SWWAF_ASN_LIMIT_PERCENT", or none when both are
-// left out.
-func percentText(percent *int64, setting string) string {
-	switch {
-	case percent == nil && setting == "":
-		return none
-	case percent == nil:
-		return "none from " + setting
-	default:
-		return fmt.Sprintf("%d from %s", *percent, setting)
-	}
-}

internal/proxy/bytelimits_test.go

@@ -3,7 +3,6 @@ package proxy_test
 import (
 	"bufio"
 	"io"
-	"net"
 	"net/http"
 	"net/netip"
 	"strconv"
@@ -167,39 +166,6 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 	}
 }
 
-func TestWebSocketPassesTheAnswerAfterTheClientStopsSending(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, echoOnceTheClientStops)
-	addr, out := startProxy(t, app.URL,
-		map[string]string{trustedProxies: trustLocalhost})
-	s := &sender{t: t, addr: addr, out: out}
-
-	conn, reader := s.openWebSocket()
-	send(t, conn, uploadBody)
-
-	// The client closes its sending side and waits for the answer, which the
-	// app sends only once it has seen the client stop. smallwebwaf passes the
-	// close on to the app through CloseWrite on upgradedConn; without that,
-	// it closes both connections, and the answer is lost.
-	tcp, ok := conn.(*net.TCPConn)
-	if !ok {
-		t.Fatalf("connection is a %T, want a *net.TCPConn", conn)
-	}
-
-	err := tcp.CloseWrite()
-	if err != nil {
-		t.Fatalf("close the sending side: %v", err)
-	}
-
-	got, err := io.ReadAll(reader)
-	if err != nil || string(got) != uploadBody {
-		t.Errorf("got %q (%v), want %q", got, err, uploadBody)
-	}
-
-	s.closeWebSocket(conn)
-}
-
 func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 	t.Parallel()
 
@@ -466,52 +432,12 @@ func answerAfterUpgrade(w http.ResponseWriter, _ *http.Request) {
 	}
 }
 
-// echoOnceTheClientStops is an app that switches protocols, as for a
-// WebSocket, reads what the client sends until the client stops sending,
-// and then sends it all back.
-func echoOnceTheClientStops(w http.ResponseWriter, _ *http.Request) {
-	conn, buffered, err := http.NewResponseController(w).Hijack()
-	if err != nil {
-		return
-	}
-
-	defer func() {
-		_ = conn.Close()
-	}()
-
-	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
-		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
-	_ = buffered.Flush()
-
-	received, _ := io.ReadAll(buffered)
-	_, _ = buffered.Write(received)
-	_ = buffered.Flush()
-}
-
 // webSocket opens a WebSocket from client to answerAfterUpgrade, sends a
 // line of bodyBytes on it, reads the answer, and closes it. It checks the
 // answer, and the log line as request does, and returns the log line.
 func (s *sender) webSocket() logLine {
 	s.t.Helper()
 
-	conn, reader := s.openWebSocket()
-	send(s.t, conn, strings.Repeat("u", bodyBytes-1)+"\n")
-
-	got, err := reader.ReadString('\n')
-	if err != nil || len(got) != answerBytes {
-		s.t.Errorf("got %d bytes (%v), want %d", len(got), err, answerBytes)
-	}
-
-	return s.closeWebSocket(conn)
-}
-
-// openWebSocket sends a request from client to switch protocols, as for a
-// WebSocket, and checks that the app switches. It returns the connection,
-// on which reading fails once waitLimit has passed, and a reader of what
-// the app sends on it.
-func (s *sender) openWebSocket() (net.Conn, *bufio.Reader) {
-	s.t.Helper()
-
 	conn := dial(s.t, s.addr)
 	send(s.t, conn, "GET /socket HTTP/1.1\r\nHost: "+appHost+"\r\n"+forwardedFor+
 		": "+client+"\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
@@ -534,13 +460,12 @@ func (s *sender) openWebSocket() (net.Conn, *bufio.Reader) {
 		s.t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
 	}
 
-	return conn, reader
+	send(s.t, conn, strings.Repeat("u", bodyBytes-1)+"\n")
-}
 
-// closeWebSocket closes conn, a WebSocket openWebSocket opened, checks its
+	got, err := reader.ReadString('\n')
-// log line as request does, and returns it.
+	if err != nil || len(got) != answerBytes {
-func (s *sender) closeWebSocket(conn net.Conn) logLine {
+		s.t.Errorf("got %d bytes (%v), want %d", len(got), err, answerBytes)
-	s.t.Helper()
+	}
 
 	_ = conn.Close()
 

internal/proxy/lookup.go

@@ -22,9 +22,8 @@ const (
 // database or through GeoJS, and notes them for the log line, unless
 // SWWAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
 // link-local address, which no lookup can place. The lookup database
-// answers at once. With GeoJS, while a setting needs the answer, such as a
+// answers at once. With GeoJS, while a setting needs the answer, a new
-// country list or a biased threshold, a new client's request waits for it.
+// client's request waits for it. ctx is the request's own context.
-// ctx is the request's own context.
 func (rq *request) lookUp(ctx context.Context) {
 	if rq.h.config.LookupSource == "off" || !canBePlaced(rq.client) {
 		return

internal/proxy/lookup_test.go

@@ -22,10 +22,6 @@ import (
 // and country.
 type asnAndCountry struct{ asn, asName, country string }
 
-// fileSource is the SWWAF_LOOKUP_SOURCE that looks clients up in the
-// lookup database.
-const fileSource = "file"
-
 func TestEveryClientIsLookedUpWithoutWaitingWhileNoSettingNeedsIt(t *testing.T) {
 	t.Parallel()
 
@@ -182,7 +178,7 @@ func TestClientsAreLookedUpInTheLookupDatabaseAndGeoJSIsNotAsked(t *testing.T) {
 		fromKP + "/32": {ASN: asnKP, ASName: asNameKP, Country: "KP"},
 	})
 	s, clk, server := startWithClock(t, geojsURL, map[string]string{
-		lookupSource:       fileSource,
+		lookupSource:       "file",
 		lookupDBPath:       path,
 		allowedCountries:   "DE",
 		rateLimitPerMinute: "1",
@@ -349,7 +345,6 @@ const unansweredGeoJSURL = "unanswered://geojs/v1/ip/geo.json"
 func TestMain(m *testing.M) {
 	transport, _ := http.DefaultTransport.(*http.Transport)
 	transport.RegisterProtocol("unanswered", unansweredGeoJS{})
-	transport.RegisterProtocol("abuseipdb", abuseIPDBStandIn{})
 
 	m.Run()
 }

internal/proxy/proxy.go

@@ -12,13 +12,11 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
@@ -59,9 +57,6 @@ type Params struct {
 	// GeoJSURL is where clients' AS numbers and countries are looked up
 	// while SWWAF_LOOKUP_SOURCE is geojs, normally lookup.URL.
 	GeoJSURL string
-	// AbuseIPDBURL is where clients are checked with AbuseIPDB while
-	// SWWAF_ABUSEIPDB_KEY is set, normally reputation.AbuseIPDBURL.
-	AbuseIPDBURL string
 	// LookupFile is the lookup database they are looked up in while
 	// SWWAF_LOOKUP_SOURCE is file, and nil otherwise.
 	LookupFile *lookup.File
@@ -73,29 +68,20 @@ type Params struct {
 	// against.
 	Rules *rules.Files
 	// Alerts receive the alert for each ban the proxy makes or makes
-	// permanent, for each count over an anomaly threshold, for each request
+	// permanent, and for GeoJS failing.
-	// whose client a blocklist, a DNSBL zone or AbuseIPDB lists, and for
-	// GeoJS failing, a fetch of a list failing, a query to a DNSBL zone or
-	// a check with AbuseIPDB failing, or the day's AbuseIPDB checks used up.
 	Alerts *alerts.Queue
 }
 
 // Server is the server smallwebwaf runs, with the parts of the proxy
 // whose state the state files keep, the lookup database, nil unless
-// SWWAF_LOOKUP_SOURCE is file, the lists fetched from URLs, which its Run
+// SWWAF_LOOKUP_SOURCE is file, and the metrics.
-// fetches, the DNSBL zones' verdicts, AbuseIPDB's scores and checks
-// spent, and the metrics.
 type Server struct {
 	*http.Server
 
 	Ledger     *bans.Ledger
 	Limiter    *ratelimit.Limiter
 	GeoJS      *lookup.GeoJS
-	Anomalies  *anomaly.Counters
 	LookupFile *lookup.File
-	Lists      *reputation.Lists
-	DNSBL      *reputation.DNSBL
-	AbuseIPDB  *reputation.AbuseIPDB
 	Metrics    *metrics.Metrics
 }
 
@@ -108,7 +94,6 @@ type Server struct {
 func New(params Params) *Server {
 	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
 	m := metrics.New(params.Config.MetricsTopN, params.Config.InstanceName)
-	lists, dnsbl, abuseIPDB := newReputation(params, m)
 	h := &handler{
 		config:     params.Config,
 		requestLog: params.RequestLog,
@@ -132,32 +117,18 @@ func New(params Params) *Server {
 			AttackBanDuration:    params.Config.AttackBanDuration,
 			MaxBans:              params.Config.MaxBans,
 		}),
-		anomalies: anomaly.New(anomaly.Params{
-			Client:         params.Config.AnomalyClient,
-			Net:            params.Config.AnomalyNet,
-			ASN:            params.Config.AnomalyASN,
-			Total:          params.Config.AnomalyTotal,
-			Watch:          params.Config.AnomalyWatch,
-			NetV4Prefix:    params.Config.AnomalyNetV4Prefix,
-			NetV6Prefix:    params.Config.AnomalyNetV6Prefix,
-			NamedNetblocks: params.Config.WatchNets,
-			Alerts:         params.Alerts,
-		}),
 		lookupFile: params.LookupFile,
-		lists:      lists,
-		dnsbl:      dnsbl,
-		abuseIPDB:  abuseIPDB,
 		rules:      params.Rules,
 		alerts:     params.Alerts,
 	}
 	h.geojs = lookup.New(lookup.Params{
 		URL:     params.GeoJSURL,
 		Timeout: params.Config.LookupTimeout,
-		// The country lists, the headers and the biased thresholds act on
+		// The country lists and the headers act on the answer before the
-		// the answer before the request goes on.
+		// request goes on.
 		Wait: len(params.Config.DeniedCountries) > 0 ||
 			len(params.Config.ExclusivelyAllowedCountries) > 0 ||
-			params.Config.AddLookupHeaders || biasedThresholdsSet(params.Config),
+			params.Config.AddLookupHeaders,
 		Answered:   h.addLookup,
 		Now:        params.Now,
 		ProcessLog: params.ProcessLog,
@@ -183,49 +154,11 @@ func New(params Params) *Server {
 		Ledger:     h.ledger,
 		Limiter:    h.limiter,
 		GeoJS:      h.geojs,
-		Anomalies:  h.anomalies,
 		LookupFile: h.lookupFile,
-		Lists:      h.lists,
-		DNSBL:      h.dnsbl,
-		AbuseIPDB:  h.abuseIPDB,
 		Metrics:    m,
 	}
 }
 
-// newReputation returns the lists fetched from URLs, the DNSBL zones'
-// verdicts and AbuseIPDB's scores, as the settings in params name them,
-// with none fetched, asked for or checked yet, and adds their metrics to
-// m, AbuseIPDB's while SWWAF_ABUSEIPDB_KEY is set.
-func newReputation(
-	params Params, m *metrics.Metrics,
-) (*reputation.Lists, *reputation.DNSBL, *reputation.AbuseIPDB) {
-	cfg := params.Config
-	lists := reputation.New(reputation.Params{
-		BlocklistURLs: cfg.BlocklistURLs, Refresh: cfg.BlocklistRefresh,
-		ASNLimitPercentURL: cfg.ASNLimitPercentURL, Now: params.Now,
-		ProcessLog: params.ProcessLog, Alerts: params.Alerts,
-	})
-	dnsbl := reputation.NewDNSBL(reputation.DNSBLParams{
-		Zones: cfg.DNSBLZones, Resolver: cfg.DNSBLResolver, CacheTTL: cfg.ReputationCacheTTL,
-		Timeout: cfg.ReputationTimeout, Now: params.Now, ProcessLog: params.ProcessLog,
-		Alerts: params.Alerts,
-	})
-	abuseIPDB := reputation.NewAbuseIPDB(reputation.AbuseIPDBParams{
-		URL: params.AbuseIPDBURL, Key: cfg.AbuseIPDBKey, MinScore: cfg.AbuseIPDBMinScore,
-		DailyBudget: cfg.AbuseIPDBDailyBudget, CacheTTL: cfg.ReputationCacheTTL,
-		Timeout: cfg.ReputationTimeout, Now: params.Now, ProcessLog: params.ProcessLog,
-		Alerts: params.Alerts,
-	})
-
-	m.AddReputation(lists, dnsbl)
-
-	if cfg.AbuseIPDBKey != "" {
-		m.AddAbuseIPDB(abuseIPDB)
-	}
-
-	return lists, dnsbl, abuseIPDB
-}
-
 // handler is the proxy. It holds what every request shares; what belongs
 // to one request is in a request.
 type handler struct {
@@ -239,11 +172,7 @@ type handler struct {
 	limiter    *ratelimit.Limiter
 	ledger     *bans.Ledger
 	geojs      *lookup.GeoJS
-	anomalies  *anomaly.Counters
 	lookupFile *lookup.File
-	lists      *reputation.Lists
-	dnsbl      *reputation.DNSBL
-	abuseIPDB  *reputation.AbuseIPDB
 	rules      *rules.Files
 	alerts     *alerts.Queue
 }
@@ -282,7 +211,6 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	// Once the request has ended, before its log line is written.
 	defer rq.addToHistory()
-	defer rq.countAnomalies()
 
 	refused := rq.check(r.Context())
 	rq.checked = time.Now()

internal/proxy/proxy_test.go

@@ -268,8 +268,7 @@ func startProxyWithAlerts(
 // queue: they wait in it, for the test to look at. With no geojsURL, there
 // is no stand-in for GeoJS to look clients up at, and SWWAF_LOOKUP_SOURCE
 // is off unless env sets it. While it is file, the lookup database
-// SWWAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
+// SWWAF_LOOKUP_DB_PATH names is read.
-// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY.
 func newProxy(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
@@ -316,7 +315,7 @@ func newProxy(
 
 	var lookupFile *lookup.File
 
-	if cfg.LookupSource == fileSource {
+	if cfg.LookupSource == "file" {
 		lookupFile, err = lookup.OpenFile(lookup.FileParams{
 			Path: cfg.LookupDBPath, Now: now, ProcessLog: processLog, Alerts: alertQueue,
 		})
@@ -326,15 +325,14 @@ func newProxy(
 	}
 
 	server := proxy.New(proxy.Params{
-		Config:       cfg,
+		Config:     cfg,
-		RequestLog:   out,
+		RequestLog: out,
-		ProcessLog:   processLog,
+		ProcessLog: processLog,
-		GeoJSURL:     geojsURL,
+		GeoJSURL:   geojsURL,
-		AbuseIPDBURL: abuseIPDBURL,
+		LookupFile: lookupFile,
-		LookupFile:   lookupFile,
+		Now:        now,
-		Now:          now,
+		Rules:      ruleFiles,
-		Rules:        ruleFiles,
+		Alerts:     alertQueue,
-		Alerts:       alertQueue,
 	})
 
 	return server, out, alertQueue

internal/proxy/reputation.go

@@ -1,98 +0,0 @@
-package proxy
-
-import (
-	"context"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
-)
-
-// deny is the SWWAF_BLOCKLIST_ACTION and the SWWAF_REPUTATION_ACTION that
-// refuses the requests of a client a source lists.
-const deny = "deny"
-
-// blocklistDenied notes the blocklists that list the client, as
-// noteListed does, and reports whether SWWAF_BLOCKLIST_ACTION, being deny,
-// refuses the request. Being limit, it lowers the client's limits instead
-// (see limitPercentages), and being log, it does nothing more.
-func (rq *request) blocklistDenied() bool {
-	listedBy := rq.h.lists.ListedBy(rq.client)
-	rq.blocklisted = len(listedBy) > 0
-	rq.noteListed(listedBy, "listed by a blocklist")
-
-	return rq.blocklisted && rq.h.config.BlocklistAction == deny
-}
-
-// dnsblDenied notes the DNSBL zones whose verdict lists the client, as
-// noteListed does, and reports whether SWWAF_REPUTATION_ACTION, being
-// deny, refuses the request. Being limit, it lowers the client's limits
-// instead (see limitPercentages), and being log, it does nothing more. A
-// zone without a verdict on the client is asked about it in the
-// background, and the request does not wait for the answer. ctx is the
-// request's own context.
-func (rq *request) dnsblDenied(ctx context.Context) bool {
-	listedBy := rq.h.dnsbl.ListedBy(ctx, rq.client)
-	rq.dnsblListed = len(listedBy) > 0
-	rq.noteListed(listedBy, "listed by a DNSBL zone")
-
-	return rq.dnsblListed && rq.h.config.ReputationAction == deny
-}
-
-// abuseIPDBDenied notes AbuseIPDB, as noteHit does, with the score, when
-// its score of the client is a hit, and reports whether
-// SWWAF_REPUTATION_ACTION, being deny, refuses the request, as dnsblDenied
-// does for a zone. While SWWAF_ABUSEIPDB_KEY is unset it does nothing. A
-// client without a score is checked in the background, by the request's
-// address, if its history counts an offence, and the request does not
-// wait for the answer. The score is then used for each address of the
-// client. ctx is the request's own context.
-func (rq *request) abuseIPDBDenied(ctx context.Context) bool {
-	if rq.h.config.AbuseIPDBKey == "" {
-		return false
-	}
-
-	client := clientGroup(rq.client)
-	held, _ := rq.h.limiter.Client(client)
-	offender := held.History.Offences != ratelimit.Offences{}
-
-	score, hit := rq.h.abuseIPDB.Hit(ctx, client, rq.client, offender)
-	if !hit {
-		return false
-	}
-
-	rq.abuseIPDBHit = true
-	rq.noteHit(reputation.AbuseIPDBSource, "scored by AbuseIPDB at or over "+
-		"SWWAF_ABUSEIPDB_MIN_SCORE", map[string]any{
-		"source": reputation.AbuseIPDBSource, "score": score,
-	})
-
-	return rq.h.config.ReputationAction == deny
-}
-
-// noteListed notes each of sources, the URLs of the blocklists or the
-// DNSBL zones, their keys masked, that list the client, as noteHit does,
-// with reason, and the source in the alert's detail.
-func (rq *request) noteListed(sources []string, reason string) {
-	for _, source := range sources {
-		rq.noteHit(source, reason, map[string]any{"source": source})
-	}
-}
-
-// noteHit adds source, which lists the client, to the log line's
-// reputation, counts it in the metrics, and raises a reputation_hit alert
-// with reason and detail.
-func (rq *request) noteHit(source, reason string, detail map[string]any) {
-	rq.line.Reputation = append(rq.line.Reputation, source)
-	rq.h.metrics.ReputationHit(source)
-	rq.h.alerts.Raise(alerts.Alert{
-		Event:    alerts.EventReputationHit,
-		Client:   rq.client,
-		Netblock: clientGroup(rq.client),
-		ASN:      rq.line.ASN,
-		ASName:   rq.line.ASName,
-		Country:  rq.line.Country,
-		Reason:   reason,
-		Detail:   detail,
-	})
-}

internal/proxy/reputation_test.go

@@ -1,960 +0,0 @@
-package proxy_test
-
-import (
-	"fmt"
-	"io"
-	"maps"
-	"net/http"
-	"net/netip"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// The reputation settings.
-const (
-	blocklistURLs      = "SWWAF_BLOCKLIST_URLS"
-	blocklistAction    = "SWWAF_BLOCKLIST_ACTION"
-	asnLimitPercentURL = "SWWAF_ASN_LIMIT_PERCENT_URL"
-)
-
-// The actions of SWWAF_BLOCKLIST_ACTION and SWWAF_REPUTATION_ACTION:
-// limitHalf gives a listed client half of every limit, and limitQuarter a
-// quarter.
-const (
-	actionDeny   = "deny"
-	actionLog    = "log"
-	limitHalf    = "limit:50"
-	limitQuarter = "limit:25"
-)
-
-// The lists these tests name, which are never fetched: each test puts in
-// the copies it needs, as reputation.json would at start.
-const (
-	dropURL = "https://lists.example/drop.txt"
-	torURL  = "https://lists.example/tor.txt"
-	asnURL  = "https://lists.example/asn.txt"
-)
-
-func TestEachBlocklistActionForAListedAddressAndAListedNetblock(t *testing.T) {
-	t.Parallel()
-
-	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
-
-	for _, tc := range []struct {
-		action string
-		// statuses and actions are those of a listed client's three
-		// requests, and percent their limit_percent, as percentText gives it.
-		statuses []int
-		actions  []string
-		percent  string
-	}{
-		{
-			actionDeny, []int{http.StatusForbidden, http.StatusForbidden, http.StatusForbidden},
-			[]string{denied, denied, denied}, none,
-		},
-		{
-			// Half of 4 requests a minute: the third breaks the limit.
-			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionRateLimited},
-			"50 from " + blocklistAction,
-		},
-		{
-			actionLog, []int{http.StatusOK, http.StatusOK, http.StatusOK},
-			[]string{forward, forward, forward}, none,
-		},
-	} {
-		t.Run(tc.action, func(t *testing.T) {
-			t.Parallel()
-
-			s, server, _ := startWithLookups(t, map[string]string{
-				rateLimitPerMinute: fourAMinute, blocklistURLs: dropURL,
-				blocklistAction: tc.action,
-			})
-			// fromDE is listed as an address, and fromKP in a netblock.
-			loadLists(t, server, map[string][]string{
-				dropURL: {"; DROP", fromDE, "198.51.100.0/24 ; SBL1"},
-			})
-
-			for _, from := range []string{fromDE, fromKP} {
-				for i := range 3 {
-					line := s.get(from, tc.statuses[i], tc.actions[i])
-					wantReputation(t, line, dropURL)
-					wantPercent(t, "limit_percent", line.LimitPercent,
-						line.LimitPercentSetting, tc.percent)
-
-					// A request refused for the list is not counted.
-					counted := line.fields["counts"] != nil
-					if counted != (tc.actions[i] != denied) {
-						t.Errorf("request from %s counted %t, logged %s", from, counted,
-							tc.actions[i])
-					}
-				}
-			}
-
-			// A client no list lists has the whole limit.
-			for range 3 {
-				line := s.get(unplaced, http.StatusOK, forward)
-				wantReputation(t, line)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-					none)
-			}
-
-			// A refusal for the list makes no ban.
-			if held := server.Ledger.Snapshot(); tc.action == actionDeny && len(held) != 0 {
-				t.Errorf("bans %+v, want none", held)
-			}
-		})
-	}
-}
-
-func TestBlocklistsComeAfterTheCountryListsAndSkipAllowNets(t *testing.T) {
-	t.Parallel()
-
-	s, server, queue := startWithLookups(t, map[string]string{
-		blocklistURLs: dropURL, deniedCountries: "kp", allowNets: fromDE,
-	})
-	loadLists(t, server, map[string][]string{dropURL: {fromDE, fromKP}})
-
-	// fromKP's country refuses it before the list is looked at, and fromDE,
-	// in SWWAF_ALLOW_NETS, is not checked at all: neither is noted, nor
-	// alerted.
-	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionCountryDenied))
-	wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward))
-	wantAlerts(t, queue)
-}
-
-func TestObserveModeForwardsAClientABlocklistDeniesAndAlertsIt(t *testing.T) {
-	t.Parallel()
-
-	s, server, queue := startWithLookups(t, map[string]string{
-		blocklistURLs: dropURL, mode: observe,
-	})
-	loadLists(t, server, map[string][]string{dropURL: {fromDE}})
-
-	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionDenied)
-	wantReputation(t, line, dropURL)
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit {
-		t.Errorf("alerts waiting %+v, want a reputation_hit alert", waiting)
-	}
-}
-
-func TestBlocklistLimitTakesPartInTheLowestPercentageOfEveryLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		action, asnPercent string
-		// want is the upload's limit_percent and bytes_percent, as
-		// percentText gives them, and limitHit its limit_hit.
-		want, limitHit string
-	}{
-		{limitHalf, asnDEQuarter, "25 from " + asnLimitPercent, minuteBytes},
-		{limitQuarter, asnDEHalf, "25 from " + blocklistAction, minuteBytes},
-		// The AS number's, the first of two alike.
-		{limitQuarter, asnDEQuarter, "25 from " + asnLimitPercent, minuteBytes},
-		{actionLog, asnDE + ":100", none, ""},
-	} {
-		t.Run(tc.action+" "+tc.asnPercent, func(t *testing.T) {
-			t.Parallel()
-
-			s, server, _ := startWithLookups(t, map[string]string{
-				bytesLimitPerMinute: twoUploads, blocklistURLs: dropURL,
-				blocklistAction: tc.action, asnLimitPercent: tc.asnPercent,
-			})
-			loadLists(t, server, map[string][]string{dropURL: {fromDE}})
-
-			// The upload's 100 bytes are over 49, a quarter of 199, and 99,
-			// half of it, and within 199.
-			line := s.uploadFrom(fromDE)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-				tc.want)
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
-				tc.want)
-
-			if line.LimitHit != tc.limitHit {
-				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
-			}
-		})
-	}
-}
-
-func TestASNLimitPercentFileCountsAsTheSettingDoesTheLowerWinning(t *testing.T) {
-	t.Parallel()
-
-	const (
-		fromURL     = "25 from " + asnLimitPercentURL
-		fromSetting = "25 from " + asnLimitPercent
-	)
-
-	for _, tc := range []struct {
-		name string
-		env  map[string]string
-		file string
-		// limitPercent and bytesPercent are the upload's, as percentText
-		// gives them.
-		limitPercent, bytesPercent string
-	}{
-		{"the file's alone", nil, asnDEQuarter, fromURL, fromURL},
-		{
-			"the file's, lower than the setting's",
-			map[string]string{asnLimitPercent: asnDEHalf}, asnDEQuarter, fromURL, fromURL,
-		},
-		{
-			"the setting's, lower than the file's",
-			map[string]string{asnLimitPercent: asnDEQuarter}, asnDEHalf,
-			fromSetting, fromSetting,
-		},
-		{
-			"the setting's, the first of two alike",
-			map[string]string{asnLimitPercent: asnDEQuarter}, asnDEQuarter,
-			fromSetting, fromSetting,
-		},
-		{"none, for an AS number the file does not list", nil, asnKP + ":25", none, none},
-		{
-			"SWWAF_ASN_BYTES_PERCENT's in place of the file's for the byte limits",
-			map[string]string{asnBytesPercent: asnDE + ":100"}, asnDEQuarter, fromURL, none,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			env := map[string]string{asnLimitPercentURL: asnURL}
-			maps.Copy(env, tc.env)
-
-			s, server, _ := startWithLookups(t, env)
-			loadLists(t, server, map[string][]string{asnURL: {"# by AS number", tc.file}})
-
-			line := s.uploadFrom(fromDE)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-				tc.limitPercent)
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
-				tc.bytesPercent)
-		})
-	}
-}
-
-func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	const emptyURL = "https://lists.example/empty.txt"
-
-	s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
-		blocklistURLs:   dropURL + "," + torURL + "," + emptyURL,
-		blocklistAction: actionLog,
-		metricsToken:    token,
-	})
-	loadLists(t, server, map[string][]string{dropURL: {fromDE}, torURL: {fromDE}})
-
-	// The second request's alerts are repeats, which the cooldown holds
-	// back.
-	for range 2 {
-		wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward),
-			dropURL, torURL)
-	}
-
-	hit := func(source string) alerts.Alert {
-		return alerts.Alert{
-			Instance: alertInstance,
-			Time:     clk.Now(),
-			Event:    alerts.EventReputationHit,
-			Client:   netip.MustParseAddr(fromDE),
-			Netblock: netip.MustParsePrefix(fromDE + "/32"),
-			ASN:      asnDE,
-			ASName:   asNameDE,
-			Country:  "DE",
-			Reason:   "listed by a blocklist",
-			Detail:   map[string]any{"source": source},
-		}
-	}
-	wantAlerts(t, queue, hit(dropURL), hit(torURL))
-
-	if queue.Suppressed() != 2 {
-		t.Errorf("%d alerts held back, want the second request's 2", queue.Suppressed())
-	}
-
-	// Each list's hits, none of its fetches failed, and when its copy was
-	// fetched, 0 for the one without.
-	metrics := s.scrape(unplaced)
-	fetched := float64(listsFetched().Unix())
-
-	for listURL, want := range map[string]struct{ hits, fetched float64 }{
-		dropURL: {2, fetched}, torURL: {2, fetched}, emptyURL: {0, 0},
-	} {
-		labels := `{instance="` + alertInstance + `",source="` + listURL + `"}`
-
-		if want.hits == 0 {
-			wantNoSeries(t, metrics, "smallwebwaf_reputation_hits_total"+labels)
-		} else {
-			wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, want.hits)
-		}
-
-		wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
-		wantMetric(t, metrics, "smallwebwaf_reputation_last_fetch_timestamp_seconds"+labels,
-			want.fetched)
-	}
-}
-
-// The DNSBL settings.
-const (
-	dnsblZones       = "SWWAF_DNSBL_ZONES"
-	dnsblResolver    = "SWWAF_DNSBL_RESOLVER"
-	reputationAction = "SWWAF_REPUTATION_ACTION"
-)
-
-// The DNSBL zones these tests name, which are never asked about the
-// clients the tests send requests from: each test puts in the verdicts it
-// needs, as reputation.json would at start. A query a test does start is
-// sent to noResolver, where nothing listens, so that none leaves the host.
-const (
-	dnsblZone  = "dnsbl.example"
-	otherZone  = "other.example"
-	noResolver = "127.0.0.1:9"
-)
-
-func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
-	t.Parallel()
-
-	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
-
-	for _, tc := range []struct {
-		action string
-		// statuses and actions are those of a listed client's three
-		// requests, and percent their limit_percent, as percentText gives it.
-		statuses []int
-		actions  []string
-		percent  string
-	}{
-		{
-			actionDeny, []int{http.StatusForbidden, http.StatusForbidden, http.StatusForbidden},
-			[]string{denied, denied, denied}, none,
-		},
-		{
-			// Half of 4 requests a minute: the third breaks the limit.
-			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionRateLimited},
-			"50 from " + reputationAction,
-		},
-		{
-			actionLog, []int{http.StatusOK, http.StatusOK, http.StatusOK},
-			[]string{forward, forward, forward}, none,
-		},
-	} {
-		t.Run(tc.action, func(t *testing.T) {
-			t.Parallel()
-
-			s, server, _ := startWithLookups(t, map[string]string{
-				rateLimitPerMinute: fourAMinute, dnsblZones: dnsblZone + "," + otherZone,
-				dnsblResolver: noResolver, reputationAction: tc.action,
-			})
-			listedBy := map[string][]string{
-				fromDE: {dnsblZone, otherZone}, fromKP: {otherZone}, unplaced: nil,
-			}
-			loadVerdicts(server, listedBy)
-
-			for _, from := range []string{fromDE, fromKP} {
-				for i := range 3 {
-					line := s.get(from, tc.statuses[i], tc.actions[i])
-					// In the order SWWAF_DNSBL_ZONES names them.
-					wantReputation(t, line, listedBy[from]...)
-					wantPercent(t, "limit_percent", line.LimitPercent,
-						line.LimitPercentSetting, tc.percent)
-
-					// A request refused for the verdict is not counted.
-					counted := line.fields["counts"] != nil
-					if counted != (tc.actions[i] != denied) {
-						t.Errorf("request from %s counted %t, logged %s", from, counted,
-							tc.actions[i])
-					}
-				}
-			}
-
-			// A client no zone lists has the whole limit.
-			for range 3 {
-				line := s.get(unplaced, http.StatusOK, forward)
-				wantReputation(t, line)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-					none)
-			}
-
-			// A refusal for the verdict makes no ban, and every client had its
-			// verdicts, so no zone was asked.
-			if held := server.Ledger.Snapshot(); tc.action == actionDeny && len(held) != 0 {
-				t.Errorf("bans %+v, want none", held)
-			}
-
-			if queries := server.DNSBL.Queries(dnsblZone); queries != 0 {
-				t.Errorf("%d queries, want none", queries)
-			}
-		})
-	}
-}
-
-func TestDNSBLZonesComeAfterTheBlocklistsAndSkipAllowNets(t *testing.T) {
-	t.Parallel()
-
-	s, server, queue := startWithLookups(t, map[string]string{
-		blocklistURLs: dropURL, dnsblZones: dnsblZone, dnsblResolver: noResolver,
-		reputationAction: actionDeny, allowNets: fromDE,
-	})
-	loadLists(t, server, map[string][]string{dropURL: {fromKP}})
-	loadVerdicts(server, map[string][]string{fromKP: {dnsblZone}, fromDE: {dnsblZone}})
-
-	// The blocklist refuses fromKP before its verdict is looked at, and
-	// fromDE, in SWWAF_ALLOW_NETS, is not checked at all: neither is noted
-	// for the zone, nor alerted, nor asked about.
-	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied),
-		dropURL)
-	wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward))
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Detail["source"] != dropURL {
-		t.Errorf("alerts waiting %+v, want the blocklist's reputation_hit alone", waiting)
-	}
-
-	if queries := server.DNSBL.Queries(dnsblZone); queries != 0 {
-		t.Errorf("%d queries, want none", queries)
-	}
-}
-
-func TestObserveModeForwardsAClientADNSBLZoneDeniesAndAlertsIt(t *testing.T) {
-	t.Parallel()
-
-	s, server, queue := startWithLookups(t, map[string]string{
-		dnsblZones: dnsblZone, dnsblResolver: noResolver, reputationAction: actionDeny,
-		mode: observe,
-	})
-	loadVerdicts(server, map[string][]string{fromDE: {dnsblZone}})
-
-	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionDenied)
-	wantReputation(t, line, dnsblZone)
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit {
-		t.Errorf("alerts waiting %+v, want a reputation_hit alert", waiting)
-	}
-}
-
-func TestReputationLimitTakesPartInTheLowestPercentageOfEveryLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		blocklistAction, reputationAction string
-		// want is the request's limit_percent and bytes_percent, as
-		// percentText gives them.
-		want string
-	}{
-		{limitHalf, limitQuarter, "25 from " + reputationAction},
-		{limitQuarter, limitHalf, "25 from " + blocklistAction},
-		// The blocklist's, the first of two alike.
-		{limitQuarter, limitQuarter, "25 from " + blocklistAction},
-		{actionLog, limitQuarter, "25 from " + reputationAction},
-		{actionLog, actionLog, none},
-	} {
-		t.Run(tc.blocklistAction+" "+tc.reputationAction, func(t *testing.T) {
-			t.Parallel()
-
-			s, server, _ := startWithLookups(t, map[string]string{
-				blocklistURLs: dropURL, blocklistAction: tc.blocklistAction,
-				dnsblZones: dnsblZone, dnsblResolver: noResolver,
-				reputationAction: tc.reputationAction,
-			})
-			loadLists(t, server, map[string][]string{dropURL: {fromDE}})
-			loadVerdicts(server, map[string][]string{fromDE: {dnsblZone}})
-
-			// Named by the blocklist, then by the zone.
-			line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-			wantReputation(t, line, dropURL, dnsblZone)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-				tc.want)
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
-				tc.want)
-		})
-	}
-}
-
-func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	s, clk, server, queue := startWithLookupsAndClock(t, map[string]string{
-		dnsblZones: dnsblZone + "," + otherZone, dnsblResolver: noResolver,
-		reputationAction: actionLog, metricsToken: token,
-	})
-	loadVerdicts(server, map[string][]string{
-		fromDE: {dnsblZone, otherZone}, unplaced: nil,
-	})
-
-	// The second request's alerts are repeats, which the cooldown holds
-	// back.
-	for range 2 {
-		wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward),
-			dnsblZone, otherZone)
-	}
-
-	hit := func(zone string) alerts.Alert {
-		return alerts.Alert{
-			Instance: alertInstance,
-			Time:     clk.Now(),
-			Event:    alerts.EventReputationHit,
-			Client:   netip.MustParseAddr(fromDE),
-			Netblock: netip.MustParsePrefix(fromDE + "/32"),
-			ASN:      asnDE,
-			ASName:   asNameDE,
-			Country:  "DE",
-			Reason:   "listed by a DNSBL zone",
-			Detail:   map[string]any{"source": zone},
-		}
-	}
-	wantAlerts(t, queue, hit(dnsblZone), hit(otherZone))
-
-	if queue.Suppressed() != 2 {
-		t.Errorf("%d alerts held back, want the second request's 2", queue.Suppressed())
-	}
-
-	// Each zone's hits, and its queries and their failures, none, since
-	// every client had its verdicts.
-	metrics := s.scrape(unplaced)
-
-	for _, zone := range []string{dnsblZone, otherZone} {
-		labels := `{instance="` + alertInstance + `",source="` + zone + `"}`
-
-		wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 2)
-		wantMetric(t, metrics, "smallwebwaf_reputation_queries_total"+labels, 0)
-		wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
-	}
-}
-
-func TestZoneKeyIsMaskedInTheLogTheAlertAndTheMetrics(t *testing.T) {
-	t.Parallel()
-
-	const (
-		key    = "abcdefghijklmnopqrstuvwxyz"
-		keyed  = key + ".xbl.dq.spamhaus.net"
-		masked = "********.xbl.dq.spamhaus.net"
-	)
-
-	s, server, queue := startWithLookups(t, map[string]string{
-		dnsblZones: keyed, dnsblResolver: noResolver, reputationAction: actionLog,
-		metricsToken: token,
-	})
-	loadVerdicts(server, map[string][]string{fromDE: {keyed}, unplaced: nil})
-
-	wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward), masked)
-
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Detail["source"] != masked {
-		t.Errorf("alerts waiting %+v, want a reputation_hit alert from %s", waiting,
-			masked)
-	}
-
-	metrics := s.scrape(unplaced)
-	wantMetric(t, metrics, `smallwebwaf_reputation_hits_total{instance="`+
-		alertInstance+`",source="`+masked+`"}`, 1)
-
-	for name, shown := range map[string]string{
-		"the log": s.out.text(), "the metrics": metrics,
-	} {
-		if strings.Contains(shown, key) {
-			t.Errorf("%s shows the key:\n%s", name, shown)
-		}
-	}
-}
-
-func TestRequestFromAClientWithoutAVerdictHasTheZoneAskedAboutIt(t *testing.T) {
-	t.Parallel()
-
-	s, server, _ := startWithLookups(t, map[string]string{
-		dnsblZones: dnsblZone + "," + otherZone, dnsblResolver: noResolver,
-	})
-	server.DNSBL.Load([]reputation.Verdict{{
-		Zone: otherZone, Client: netip.MustParseAddr(fromDE), Listed: true,
-		Fetched: verdictsFetched(),
-	}})
-
-	// The verdict of the other zone is used, and dnsbl.example, which has
-	// none, is asked about the client in the background, once: the second
-	// request finds the query under way, or the zone left alone after it
-	// failed, since nothing answers at noResolver.
-	for range 2 {
-		wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward), otherZone)
-	}
-
-	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
-		t.Errorf("%d queries to %s, want 1", queries, dnsblZone)
-	}
-
-	if queries := server.DNSBL.Queries(otherZone); queries != 0 {
-		t.Errorf("%d queries to %s, want none", queries, otherZone)
-	}
-}
-
-// The AbuseIPDB settings, and accountKey, the key the tests set.
-const (
-	abuseIPDBKey = "SWWAF_ABUSEIPDB_KEY"
-	accountKey   = "abuseipdb-key-0123456789abcdef"
-)
-
-// abuseipdb is how the request log, the alerts and the metrics name
-// AbuseIPDB.
-const abuseipdb = reputation.AbuseIPDBSource
-
-// abuseIPDBURL is where newProxy has clients checked with AbuseIPDB: at
-// abuseIPDBStandIn, which TestMain registers with Go's default transport,
-// through which AbuseIPDB is asked.
-const abuseIPDBURL = "abuseipdb://stand-in/api/v2/check"
-
-// abuseIPDBStandIn is a stand-in for AbuseIPDB that gives every client the
-// score 100, at once and without the network.
-type abuseIPDBStandIn struct{}
-
-// RoundTrip answers req with the score 100.
-func (abuseIPDBStandIn) RoundTrip(req *http.Request) (*http.Response, error) {
-	return &http.Response{
-		StatusCode: http.StatusOK,
-		Status:     "200 OK",
-		Header:     http.Header{},
-		Body:       io.NopCloser(strings.NewReader(`{"data":{"abuseConfidenceScore":100}}`)),
-		Request:    req,
-	}, nil
-}
-
-func TestOnlyAClientThatHasCommittedAnOffenceIsCheckedWithAbuseIPDB(t *testing.T) {
-	t.Parallel()
-
-	forward := requestlog.ActionForward
-
-	s, clk, server, _ := startWithLookupsAndClock(t, map[string]string{
-		abuseIPDBKey: accountKey, rateLimitPerMinute: "2", reputationAction: actionLog,
-	})
-
-	// Neither fromDE, until it breaks a rate limit, nor fromKP, which never
-	// does, is checked, nor fromDE under the ban that makes.
-	s.get(fromDE, http.StatusOK, forward)
-	s.get(fromDE, http.StatusOK, forward)
-	s.get(fromKP, http.StatusOK, forward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
-	wantAbuseIPDBChecks(t, server, 0)
-
-	// Once the ban has ended, fromDE's first request has it checked in the
-	// background, and goes on without its score, which its next request
-	// finds.
-	clk.advance(time.Hour)
-	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
-	wantAbuseIPDBChecks(t, server, 1)
-	waitUntil(func() bool { return len(server.AbuseIPDB.Snapshot().Scores) == 1 })
-	wantReputation(t, s.get(fromDE, http.StatusOK, forward), abuseipdb)
-
-	s.get(fromKP, http.StatusOK, forward)
-	wantAbuseIPDBChecks(t, server, 1)
-}
-
-func TestIPv6ClientCostsOneAbuseIPDBCheckWhicheverOfItsAddressesSends(t *testing.T) {
-	t.Parallel()
-
-	forward := requestlog.ActionForward
-
-	// 15 addresses of 2001:db8:1:2::/64, one client, each in a part of it
-	// of its own.
-	var addresses []string
-	for i := 1; i < 16; i++ {
-		addresses = append(addresses, fmt.Sprintf("2001:db8:1:2:%x::9", i<<12))
-	}
-
-	s, clk, server := startWithClock(t, "", map[string]string{
-		abuseIPDBKey: accountKey, reputationAction: actionLog,
-		rateLimitPerMinute: strconv.Itoa(len(addresses)),
-	})
-
-	// The client breaks the rate limit from its first address, which bans
-	// it for an hour.
-	for range addresses {
-		s.get(addresses[0], http.StatusOK, forward)
-	}
-
-	s.get(addresses[0], http.StatusForbidden, requestlog.ActionRateLimited)
-	clk.advance(time.Hour)
-
-	// Once the ban has ended, which set its counters back to zero, a
-	// request from each of its addresses has it checked once.
-	for _, address := range addresses {
-		s.get(address, http.StatusOK, forward)
-	}
-
-	wantAbuseIPDBChecks(t, server, 1)
-}
-
-// probePath is the path the ban rule of testRules, probe, matches.
-const probePath = "/.env"
-
-func TestClientARuleRefusedIsCheckedWithAbuseIPDBAtItsNextRequest(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		// path is what the client asks for, status and action what that
-		// request is answered and logged with, and want the offences its
-		// history then counts.
-		path   string
-		status int
-		action string
-		want   ratelimit.Offences
-	}{
-		{
-			"a block rule", "/blocked", http.StatusForbidden, requestlog.ActionRuleBlocked,
-			ratelimit.Offences{RuleBlocked: 1},
-		},
-		{
-			"a ban rule", probePath, http.StatusForbidden, requestlog.ActionBanned,
-			ratelimit.Offences{Attack: 1},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			s, clk, server := startWithClock(t, "", map[string]string{
-				abuseIPDBKey: accountKey, reputationAction: actionLog,
-				rulesDir: writeRules(t, testRules), attackBanDuration: "1h",
-			})
-
-			s.request(client, tc.path, tc.status, tc.action)
-			wantAbuseIPDBChecks(t, server, 0)
-
-			if got := historyOf(t, server, client).Offences; got != tc.want {
-				t.Errorf("history counts the offences %+v, want %+v", got, tc.want)
-			}
-
-			// Its next request, once a ban rule's ban has ended, has it
-			// checked.
-			clk.advance(time.Hour)
-			s.get(client, http.StatusOK, requestlog.ActionForward)
-			wantAbuseIPDBChecks(t, server, 1)
-		})
-	}
-}
-
-func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *testing.T) {
-	t.Parallel()
-
-	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
-
-	for _, tc := range []struct {
-		action string
-		// statuses and actions are those of fromDE's three requests, and
-		// percent their limit_percent, as percentText gives it.
-		statuses []int
-		actions  []string
-		percent  string
-	}{
-		{
-			actionDeny, []int{http.StatusForbidden, http.StatusForbidden, http.StatusForbidden},
-			[]string{denied, denied, denied}, none,
-		},
-		{
-			// Half of 4 requests a minute: the third breaks the limit.
-			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionRateLimited},
-			"50 from " + reputationAction,
-		},
-		{
-			actionLog, []int{http.StatusOK, http.StatusOK, http.StatusOK},
-			[]string{forward, forward, forward}, none,
-		},
-	} {
-		t.Run(tc.action, func(t *testing.T) {
-			t.Parallel()
-
-			s, server, _ := startWithLookups(t, map[string]string{
-				rateLimitPerMinute: fourAMinute, abuseIPDBKey: accountKey,
-				reputationAction: tc.action,
-			})
-			// At SWWAF_ABUSEIPDB_MIN_SCORE, 75 by default, and just under it.
-			loadScores(server, map[string]int64{fromDE: 75, fromKP: 74})
-
-			for i := range 3 {
-				line := s.get(fromDE, tc.statuses[i], tc.actions[i])
-				wantReputation(t, line, abuseipdb)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-					tc.percent)
-
-				// A request refused for the score is not counted.
-				counted := line.fields["counts"] != nil
-				if counted != (tc.actions[i] != denied) {
-					t.Errorf("request counted %t, logged %s", counted, tc.actions[i])
-				}
-			}
-
-			// fromKP's score is no hit, and it has the whole limit.
-			for range 3 {
-				line := s.get(fromKP, http.StatusOK, forward)
-				wantReputation(t, line)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-					none)
-			}
-
-			// A refusal for the score makes no ban.
-			if held := server.Ledger.Snapshot(); tc.action == actionDeny && len(held) != 0 {
-				t.Errorf("bans %+v, want none", held)
-			}
-		})
-	}
-}
-
-func TestAbuseIPDBHitRaisesAnAlertWithTheScoreOncePerCooldownAndIsCounted(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	s, server, queue := startWithLookups(t, map[string]string{
-		abuseIPDBKey: accountKey, reputationAction: actionLog, metricsToken: token,
-	})
-	loadScores(server, map[string]int64{fromDE: 90})
-
-	// The second request's alert is a repeat, which the cooldown holds back.
-	for range 2 {
-		wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward),
-			abuseipdb)
-	}
-
-	// The alert is made as a DNSBL zone's is, with the score besides.
-	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Event != alerts.EventReputationHit ||
-		waiting[0].Reason != "scored by AbuseIPDB at or over SWWAF_ABUSEIPDB_MIN_SCORE" ||
-		waiting[0].Detail["source"] != abuseipdb || waiting[0].Detail["score"] != int64(90) ||
-		queue.Suppressed() != 1 {
-		t.Errorf("alerts waiting %+v, %d held back, want AbuseIPDB's reputation_hit "+
-			"with the score 90, and 1", waiting, queue.Suppressed())
-	}
-
-	// The hits, and the checks, none, since no client committed an
-	// offence, so that the whole budget is left.
-	metrics := s.scrape(unplaced)
-	labels := `{instance="` + alertInstance + `",source="` + abuseipdb + `"}`
-
-	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 2)
-	wantMetric(t, metrics, "smallwebwaf_reputation_queries_total"+labels, 0)
-	wantMetric(t, metrics, "smallwebwaf_reputation_failures_total"+labels, 0)
-	wantMetric(t, metrics, "smallwebwaf_reputation_daily_budget_remaining"+labels, 900)
-}
-
-func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
-	t.Parallel()
-
-	forward := requestlog.ActionForward
-
-	s, clk, server, _ := startWithLookupsAndClock(t, map[string]string{
-		rateLimitPerMinute: "1", metricsToken: token,
-	})
-	loadScores(server, map[string]int64{fromDE: 100})
-
-	// fromDE's score is not used, and once it has committed an offence it
-	// is not checked either.
-	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
-	clk.advance(time.Hour)
-	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
-	wantAbuseIPDBChecks(t, server, 0)
-
-	wantNoSeries(t, s.scrape(unplaced), `smallwebwaf_reputation_daily_budget_remaining{`+
-		`instance="`+alertInstance+`",source="`+abuseipdb+`"}`)
-}
-
-// listsFetched is when loadLists has the copies fetched.
-func listsFetched() time.Time {
-	return time.Date(2026, 10, 5, 0, 0, 0, 0, time.UTC)
-}
-
-// verdictsFetched is when loadVerdicts has the verdicts fetched: half a
-// day before the time the tests' clock is set to, so that they are in use
-// until half a day later.
-func verdictsFetched() time.Time {
-	return time.Date(2026, 10, 5, 12, 0, 0, 0, time.UTC)
-}
-
-// loadVerdicts puts into server's DNSBL, for each client listedBy names,
-// a verdict of each zone SWWAF_DNSBL_ZONES names, fetched at
-// verdictsFetched, as reputation.json would at start: one that lists the
-// client from each zone listedBy gives for it, and one that does not from
-// each other zone.
-func loadVerdicts(server *proxy.Server, listedBy map[string][]string) {
-	verdicts := make([]reputation.Verdict, 0, len(listedBy)*len(server.DNSBL.Zones()))
-
-	for client, zones := range listedBy {
-		for _, zone := range server.DNSBL.Zones() {
-			verdicts = append(verdicts, reputation.Verdict{
-				Zone: zone, Client: netip.MustParseAddr(client),
-				Listed: slices.Contains(zones, zone), Fetched: verdictsFetched(),
-			})
-		}
-	}
-
-	server.DNSBL.Load(verdicts)
-}
-
-// loadScores puts into server's AbuseIPDB the score scores gives each
-// client, an IPv4 address, fetched at verdictsFetched, as reputation.json
-// would at start.
-func loadScores(server *proxy.Server, scores map[string]int64) {
-	kept := make([]reputation.Score, 0, len(scores))
-	for client, score := range scores {
-		kept = append(kept, reputation.Score{
-			Client: netip.MustParsePrefix(client + "/32"), Score: score,
-			Fetched: verdictsFetched(),
-		})
-	}
-
-	server.AbuseIPDB.Load(reputation.Checks{Scores: kept})
-}
-
-// wantAbuseIPDBChecks checks how many clients server has checked with
-// AbuseIPDB.
-func wantAbuseIPDBChecks(t *testing.T, server *proxy.Server, want int) {
-	t.Helper()
-
-	if got := server.AbuseIPDB.Checked(); got != want {
-		t.Errorf("%d clients checked with AbuseIPDB, want %d", got, want)
-	}
-}
-
-// loadLists puts copies of lists into server's lists, by URL, each with
-// its lines, fetched at listsFetched, as reputation.json would at start.
-func loadLists(t *testing.T, server *proxy.Server, copies map[string][]string) {
-	t.Helper()
-
-	lists := make([]reputation.List, 0, len(copies))
-	for listURL, lines := range copies {
-		lists = append(lists, reputation.List{
-			URL: listURL, Fetched: listsFetched(), Lines: lines,
-		})
-	}
-
-	err := server.Lists.Load(lists)
-	if err != nil {
-		t.Fatalf("load the lists: %v", err)
-	}
-}
-
-// wantReputation checks the URLs of the blocklists the log line names in
-// its reputation.
-func wantReputation(t *testing.T, line logLine, want ...string) {
-	t.Helper()
-
-	if !slices.Equal(line.Reputation, want) {
-		t.Errorf("log line has reputation %v, want %v", line.Reputation, want)
-	}
-}

internal/proxy/request.go

@@ -16,8 +16,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
-	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
@@ -58,20 +56,9 @@ type request struct {
 	lookedUp     bool
 	lookupAnswer lookup.Answer
 	// counted is true for a request the rate limits counted, whose bytes
-	// the byte limits count once it has ended. limitPercent and
+	// the byte limits count once it has ended.
-	// bytesPercent are then its client's limit percentages for the rate
+	counted bool
-	// limits and for the byte limits.
+	start   time.Time
-	counted                    bool
-	limitPercent, bytesPercent percentage
-	// attack is true for a request that matched a ban rule, and
-	// ruleBlocked for one a block rule refused, each an offence its
-	// client's history counts.
-	attack, ruleBlocked bool
-	// blocklisted is true once a blocklist is found to list the client,
-	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
-	// AbuseIPDB's score of it is a hit.
-	blocklisted, dnsblListed, abuseIPDBHit bool
-	start                                  time.Time
 	// checked is when the checks were done, and upstreamStart when the
 	// request was handed to the app.
 	checked       time.Time
@@ -221,15 +208,13 @@ func (rq *request) check(ctx context.Context) *refusal {
 // client in SWWAF_ALLOW_NETS skips them, and is not looked up. For any
 // other client, SWWAF_DENY_NETS comes first, then a ban on its netblock,
 // so that a client either refuses is not looked up, then the lookup of
-// its AS number and country, then the country lists, then the blocklists,
+// its AS number and country, and then the country lists; a request any of
-// then the DNSBL zones' verdicts, and then AbuseIPDB's score; a request
+// them refuses is not counted for the rate limits. Then come the rate
-// any of them refuses is not counted for the rate limits. Then come the
+// limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
-// rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
 // request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
-// every other request is counted, each of them by the client's limit
+// every other request is counted, and last the rule files. A request
-// percentages, and last the rule files. A request exempt from the rate
+// exempt from the rate limits is exempt from the byte limits too. ctx is
-// limits is exempt from the byte limits too. ctx is the request's own
+// the request's own context.
-// context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -252,22 +237,8 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionCountryDenied
 	}
 
-	if rq.blocklistDenied() {
-		return requestlog.ActionDenied
-	}
-
-	if rq.dnsblDenied(ctx) || rq.abuseIPDBDenied(ctx) {
-		return requestlog.ActionDenied
-	}
-
 	rq.counted = !isInside(rq.client, cfg.RateLimitExemptNets) &&
 		!pathExempt(rq.in.URL, cfg.RateLimitExemptPaths)
-	if rq.counted {
-		rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
-		rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
-		rq.line.BytesPercent, rq.line.BytesPercentSetting = rq.bytesPercent.logged()
-	}
-
 	if rq.counted && rq.limitBroken(now) {
 		return requestlog.ActionRateLimited
 	}
@@ -532,76 +503,39 @@ func timing(start, end time.Time) *float64 {
 }
 
 // addToHistory adds the request, which has ended, to its client's
-// history, and then the lookup's answer about the client, as
+// history, and then, for a client that was looked up, the lookup
-// answerAtTheEnd gives it, to that history and to the notes of the bans
+// database's answer about it, or the answer from GeoJS kept about it, to
-// on its netblock: an answer may have come before either was there, and
+// that history and to the notes of the bans on its netblock: an answer
-// one from GeoJS that comes later is added when it comes.
+// may have come before either was there, and one from GeoJS that comes
+// later is added when it comes.
 func (rq *request) addToHistory() {
 	forwarded := !rq.upstreamStart.IsZero()
+	group := clientGroup(rq.client)
 
-	rq.h.limiter.AddToHistory(clientGroup(rq.client), rq.h.now(), ratelimit.Request{
+	rq.h.limiter.AddToHistory(group, rq.h.now(), ratelimit.Request{
 		Forwarded:     forwarded,
 		Refused:       !forwarded && rq.refused.Load() != nil,
 		Status:        rq.out.status,
 		RequestBytes:  rq.requestBytes(),
 		ResponseBytes: rq.out.bytes,
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
-		Attack:        rq.attack,
-		RuleBlocked:   rq.ruleBlocked,
 	})
 
-	answer, found := rq.answerAtTheEnd()
+	if !rq.lookedUp {
-	if found {
-		rq.h.addLookup(answer)
-	}
-}
-
-// countAnomalies counts the request, which has ended, and its bytes, as
-// countedBytes gives them, for the anomaly thresholds, whatever was done
-// with it: a request refused, one from a client in SWWAF_ALLOW_NETS or
-// SWWAF_RATE_LIMIT_EXEMPT_NETS, and one for a path in
-// SWWAF_RATE_LIMIT_EXEMPT_PATHS are counted too. It is counted for its
-// client's AS number when answerAtTheEnd gives one. With every anomaly
-// threshold off, the default, it does nothing.
-func (rq *request) countAnomalies() {
-	if !anomalyThresholdsSet(rq.h.config) {
 		return
 	}
 
-	answer, _ := rq.answerAtTheEnd()
+	// The lookup database's answer was there at once.
-
-	rq.h.anomalies.Count(rq.h.now(), anomaly.Request{
-		Client:      rq.client,
-		ClientGroup: clientGroup(rq.client),
-		ASN:         answer.ASN,
-		ASName:      answer.ASName,
-		Country:     answer.Country,
-		Bytes:       rq.countedBytes(),
-	})
-}
-
-// anomalyThresholdsSet reports whether any anomaly threshold is set.
-func anomalyThresholdsSet(cfg *config.Config) bool {
-	off := anomaly.Thresholds{}
-
-	return cfg.AnomalyClient != off || cfg.AnomalyNet != off || cfg.AnomalyASN != off ||
-		cfg.AnomalyTotal != off || cfg.AnomalyWatch != off
-}
-
-// answerAtTheEnd returns, for a client that was looked up, the lookup's
-// answer about it as the request ends, and whether there is one: the
-// lookup database's, which was there at once, or the one GeoJS has given
-// by then, which a request does not wait for unless a setting needs it.
-func (rq *request) answerAtTheEnd() (lookup.Answer, bool) {
-	if !rq.lookedUp {
-		return lookup.Answer{}, false
-	}
-
 	if rq.h.config.LookupSource == "file" {
-		return rq.lookupAnswer, true
+		rq.h.addLookup(rq.lookupAnswer)
+
+		return
 	}
 
-	return rq.h.geojs.Kept(clientGroup(rq.client))
+	answer, kept := rq.h.geojs.Kept(group)
+	if kept {
+		rq.h.addLookup(answer)
+	}
 }
 
 // requestBytes is how many bytes of the request's body have been read.

internal/proxy/rules.go

@@ -12,8 +12,7 @@ import (
 // action of the rule that refuses it, ActionRuleBlocked for a block rule
 // and ActionBanned for a ban rule, or "" when none does. A ban rule bans
 // the client's netblock for a clear sign of attack, or in observe mode
-// raises the alert for the ban it would have made. Either rule's match
+// raises the alert for the ban it would have made.
-// is noted as an offence, for the client's history.
 func (rq *request) checkRules(now time.Time) string {
 	matched := rq.h.rules.Match(rq.in)
 
@@ -29,11 +28,8 @@ func (rq *request) checkRules(now time.Time) string {
 	// Only the last rule matched can refuse the request.
 	switch last := matched[len(matched)-1]; last.Action {
 	case rules.ActionBlock:
-		rq.ruleBlocked = true
-
 		return requestlog.ActionRuleBlocked
 	case rules.ActionBan:
-		rq.attack = true
 		rq.banForAttack(now, last)
 
 		return requestlog.ActionBanned

internal/ratelimit/ratelimit.go

@@ -117,15 +117,9 @@ type Responses struct {
 }
 
 // Offences are a client's offences, by kind.
-//
-//nolint:tagliatelle // the state files use snake_case, as the request log does
 type Offences struct {
-	// Limit is its requests that broke a rate limit or a byte limit,
+	// Limit is its requests that broke a rate limit or a byte limit.
-	// Attack those that matched a ban rule, a clear sign of attack, and
+	Limit int64 `json:"limit"`
-	// RuleBlocked those a block rule refused.
-	Limit       int64 `json:"limit"`
-	Attack      int64 `json:"attack"`
-	RuleBlocked int64 `json:"rule_blocked"`
 }
 
 // Request is what a client's history keeps of one of its requests.
@@ -143,11 +137,8 @@ type Request struct {
 	RequestBytes  int64
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit or a byte
-	// limit, Attack for one that matched a ban rule, and RuleBlocked for
+	// limit.
-	// one a block rule refused.
+	BrokeLimit bool
-	BrokeLimit  bool
-	Attack      bool
-	RuleBlocked bool
 }
 
 // New returns a Limiter for limits, with no client counted yet.
@@ -183,7 +174,7 @@ type Hit struct {
 	Kind string
 	// Window is "minute", "hour" or "day".
 	Window string
-	// Limit is the window's limit, as the client's percentage of it.
+	// Limit is the window's limit.
 	Limit int64
 	// Count is the client's requests, or bytes, counted in the window,
 	// this request's included.
@@ -205,24 +196,21 @@ type Counts struct {
 
 // Count counts a request from client at now, in every window, whether or
 // not it is refused, and returns the client's counts in each window. It
-// reports whether the request takes the client over a rate limit, of
+// reports whether the request takes the client over a rate limit, and the
-// which the client gets the percentage percent, rounded down, and the hit:
+// hit: the window whose limit it goes over, the shortest if it is over
-// the window whose limit it goes over, the shortest if it is over
+// several.
-// several. A limit that is off stays off.
+func (l *Limiter) Count(client netip.Prefix, now time.Time) (Counts, Hit, bool) {
-func (l *Limiter) Count(
+	return l.count(client, now, 1, 0)
-	client netip.Prefix, now time.Time, percent int64,
-) (Counts, Hit, bool) {
-	return l.count(client, now, 1, 0, percent)
 }
 
 // CountBytes counts bytes, those of a request from client that has ended,
 // at now, in every window, and returns the client's counts in each window.
-// It reports whether the bytes take the client over a byte limit, of which
+// It reports whether the bytes take the client over a byte limit, and the
-// the client gets the percentage percent, and the hit, as Count does.
+// hit, as Count does.
 func (l *Limiter) CountBytes(
-	client netip.Prefix, now time.Time, bytes, percent int64,
+	client netip.Prefix, now time.Time, bytes int64,
 ) (Counts, Hit, bool) {
-	return l.count(client, now, 0, bytes, percent)
+	return l.count(client, now, 0, bytes)
 }
 
 // Reset sets client's counts of requests and of bytes in every window
@@ -267,14 +255,6 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 	if r.BrokeLimit {
 		h.Offences.Limit++
 	}
-
-	if r.Attack {
-		h.Offences.Attack++
-	}
-
-	if r.RuleBlocked {
-		h.Offences.RuleBlocked++
-	}
 }
 
 // AddLookup gives client's history its AS number, AS name and country, as
@@ -378,7 +358,9 @@ func (l *Limiter) Load(clients []Client, now time.Time) {
 	for _, c := range clients {
 		for i, w := range l.windows {
 			for _, b := range []*Buckets{c.buckets()[i], c.byteBuckets()[i]} {
-				if b.Passed(now, w.length) {
+				// The window that ends at now covers neither bucket once it
+				// begins after the bucket under way has ended.
+				if !now.Add(-w.length).Before(b.Start.Add(w.length)) {
 					*b = Buckets{}
 				}
 			}
@@ -391,10 +373,9 @@ func (l *Limiter) Load(clients []Client, now time.Time) {
 // count adds requests and bytes from client at now to its buckets in
 // every window, and returns its counts. A limit is broken only by what is
 // added to it, so that a request whose bytes are counted after another of
-// the client's requests broke a rate limit does not break it too. The
+// the client's requests broke a rate limit does not break it too.
-// client gets the percentage percent of each limit.
 func (l *Limiter) count(
-	client netip.Prefix, now time.Time, requests, bytes, percent int64,
+	client netip.Prefix, now time.Time, requests, bytes int64,
 ) (Counts, Hit, bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -408,19 +389,18 @@ func (l *Limiter) count(
 	)
 
 	for i, w := range l.windows {
-		requestCounts[i] = requestBuckets[i].Add(now, w.length, requests)
+		requestCounts[i] = requestBuckets[i].add(now, w.length, requests)
-		byteCounts[i] = byteBuckets[i].Add(now, w.length, bytes)
+		byteCounts[i] = byteBuckets[i].add(now, w.length, bytes)
-		limit, byteLimit := percentOf(w.limit, percent), percentOf(w.byteLimit, percent)
 
 		switch {
 		case hit.Window != "":
-		case requests > 0 && w.limit > 0 && requestCounts[i] > float64(limit):
+		case requests > 0 && w.limit > 0 && requestCounts[i] > float64(w.limit):
 			hit = Hit{
-				Kind: KindRequests, Window: w.name, Limit: limit, Count: requestCounts[i],
+				Kind: KindRequests, Window: w.name, Limit: w.limit, Count: requestCounts[i],
 			}
-		case bytes > 0 && w.byteLimit > 0 && byteCounts[i] > float64(byteLimit):
+		case bytes > 0 && w.byteLimit > 0 && byteCounts[i] > float64(w.byteLimit):
 			hit = Hit{
-				Kind: KindBytes, Window: w.name, Limit: byteLimit, Count: byteCounts[i],
+				Kind: KindBytes, Window: w.name, Limit: w.byteLimit, Count: byteCounts[i],
 			}
 		}
 	}
@@ -466,27 +446,18 @@ type window struct {
 	byteLimit int64
 }
 
-// percentOf returns the percentage percent of limit, rounded down. It is
+// add counts n requests, or n bytes, at now in a window of length, and
-// written as limit's hundreds times percent, plus the rest's share, since
+// returns the client's count in the window that ends at now: what is in
-// limit*percent can overflow for a byte limit.
+// the bucket under way, and what is in the bucket before it weighted by
-func percentOf(limit, percent int64) int64 {
+// how much of that bucket the window still covers. With n zero it counts
-	const hundred = 100
+// nothing, and returns the count.
-
-	return limit/hundred*percent + limit%hundred*percent/hundred
-}
-
-// Add counts n requests, or n bytes, at now in a window of length, and
-// returns the count in the window that ends at now: what is in the bucket
-// under way, and what is in the bucket before it weighted by how much of
-// that bucket the window still covers. With n zero it counts nothing, and
-// returns the count. The anomaly counters count in Buckets too.
 //
 // Concurrent requests can be counted out of order, so now can be a moment
 // before the bucket under way began; such a request is counted in that
 // bucket. A request dated more than a second before it means the clock
 // was set back, and the buckets start afresh: otherwise the bucket before
 // would keep its full weight until the clock caught up.
-func (b *Buckets) Add(now time.Time, length time.Duration, n int64) float64 {
+func (b *Buckets) add(now time.Time, length time.Duration, n int64) float64 {
 	if now.Before(b.Start.Add(-time.Second)) {
 		*b = Buckets{}
 	}
@@ -511,14 +482,6 @@ func (b *Buckets) Add(now time.Time, length time.Duration, n int64) float64 {
 	return float64(b.Previous)*covered + float64(b.Current)
 }
 
-// Passed reports whether the window of length that ends at now covers
-// neither of b's buckets: it begins after the bucket under way has ended.
-// What they hold then counts no more, and a state file read at now drops
-// it.
-func (b *Buckets) Passed(now time.Time, length time.Duration) bool {
-	return !now.Add(-length).Before(b.Start.Add(length))
-}
-
 // add counts a response with status in its class. A status of 0, for
 // nothing sent, is not a response.
 func (r *Responses) add(status int) {

internal/ratelimit/ratelimit_test.go

@@ -1,7 +1,6 @@
 package ratelimit_test
 
 import (
-	"math"
 	"net/netip"
 	"testing"
 	"time"
@@ -12,10 +11,6 @@ import (
 // limit is the limit the tests set.
 const limit = 3
 
-// whole is the percentage of each limit a client gets when nothing lowers
-// its limits.
-const whole = 100
-
 // The windows, as Count names them.
 const (
 	minute = "minute"
@@ -67,14 +62,14 @@ func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 	start := midnight()
 
 	for range limit {
-		_, _, over := limiter.Count(client, start, whole)
+		_, _, over := limiter.Count(client, start)
 		if over {
 			t.Fatal("a request within the limit is over it")
 		}
 	}
 
 	// Over both limits; the minute's is named, with the four requests.
-	_, hit, over := limiter.Count(client, start, whole)
+	_, hit, over := limiter.Count(client, start)
 
 	want := ratelimit.Hit{
 		Kind: ratelimit.KindRequests, Window: minute, Limit: limit, Count: limit + 1,
@@ -85,61 +80,6 @@ func TestHitGivesTheLimitAndTheRequestsCounted(t *testing.T) {
 	}
 }
 
-func TestClientGetsItsPercentageOfEachLimitRoundedDown(t *testing.T) {
-	t.Parallel()
-
-	limiter := ratelimit.New(ratelimit.Limits{PerMinute: 5, BytesPerDay: math.MaxInt64})
-	client := netip.MustParsePrefix("203.0.113.9/32")
-	start := midnight()
-
-	// Half of 5 requests is 2.5, rounded down to 2: the third is over.
-	for range 2 {
-		_, _, over := limiter.Count(client, start, 50)
-		if over {
-			t.Fatal("a request within half the limit is over it")
-		}
-	}
-
-	_, hit, over := limiter.Count(client, start, 50)
-
-	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: minute, Limit: 2, Count: 3}
-	if !over || hit != want {
-		t.Errorf("the third request gives %+v and %t, want %+v and true", hit, over, want)
-	}
-
-	// Half of the largest byte limit is still far above a TiB: working it
-	// out does not overflow.
-	_, hit, over = limiter.CountBytes(client, start, 1<<40, 50)
-	if over {
-		t.Errorf("a TiB is over half the largest byte limit: %+v", hit)
-	}
-}
-
-func TestZeroPercentIsAZeroAllowanceAndALimitOffStaysOff(t *testing.T) {
-	t.Parallel()
-
-	// Only the hour has limits: the minute's and the day's are off.
-	limiter := ratelimit.New(ratelimit.Limits{PerHour: limit, BytesPerHour: 1000})
-	client := netip.MustParsePrefix("203.0.113.9/32")
-	start := midnight()
-
-	// At 0 percent, the first request and the first byte are over the
-	// hour's limits, which are 0; the minute's, which are off, stay off.
-	_, hit, _ := limiter.Count(client, start, 0)
-
-	want := ratelimit.Hit{Kind: ratelimit.KindRequests, Window: hour, Limit: 0, Count: 1}
-	if hit != want {
-		t.Errorf("the first request gives %+v, want %+v", hit, want)
-	}
-
-	_, hit, _ = limiter.CountBytes(client, start, 1, 0)
-
-	want = ratelimit.Hit{Kind: ratelimit.KindBytes, Window: hour, Limit: 0, Count: 1}
-	if hit != want {
-		t.Errorf("the first byte gives %+v, want %+v", hit, want)
-	}
-}
-
 func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 	t.Parallel()
 
@@ -160,12 +100,12 @@ func TestEachByteLimitIsBrokenByTheBytesCounted(t *testing.T) {
 			client := netip.MustParsePrefix("203.0.113.9/32")
 
 			// 600 bytes are within the limit, 600 more over it.
-			_, _, over := limiter.CountBytes(client, midnight(), 600, whole)
+			_, _, over := limiter.CountBytes(client, midnight(), 600)
 			if over {
 				t.Fatal("600 bytes are over the limit of 1000")
 			}
 
-			_, hit, over := limiter.CountBytes(client, midnight(), 600, whole)
+			_, hit, over := limiter.CountBytes(client, midnight(), 600)
 
 			want := ratelimit.Hit{
 				Kind: ratelimit.KindBytes, Window: tc.window, Limit: byteLimit, Count: 1200,
@@ -208,16 +148,16 @@ func TestCountGivesTheBytesInEachWindow(t *testing.T) {
 	client := netip.MustParsePrefix("203.0.113.9/32")
 	start := midnight()
 
-	limiter.CountBytes(client, start, 300, whole)
+	limiter.CountBytes(client, start, 300)
 
 	// A quarter into the next hour, the minute has only these 100 bytes.
 	// The hour still covers three quarters of the bucket before, whose 300
 	// bytes count 225, and these: 325. The day covers all 400.
 	later := start.Add(time.Hour + time.Hour/4)
-	limiter.CountBytes(client, later, 100, whole)
+	limiter.CountBytes(client, later, 100)
 
 	// A request's counts give the bytes counted so far too.
-	counts, _, _ := limiter.Count(client, later, whole)
+	counts, _, _ := limiter.Count(client, later)
 
 	want := ratelimit.Counts{
 		Minute: 1, Hour: 1, Day: 1, MinuteBytes: 100, HourBytes: 325, DayBytes: 400,
@@ -249,14 +189,14 @@ func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 	start := midnight()
 
 	for range 3 {
-		limiter.Count(client, start, whole)
+		limiter.Count(client, start)
 	}
 
 	// A quarter into the next hour, the minute has only this request. The
 	// hour still covers three quarters of the bucket before, with its three
 	// requests, which count 2.25, and this one: 3.25. The day covers all
 	// four.
-	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4), whole)
+	counts, _, _ := limiter.Count(client, start.Add(time.Hour+time.Hour/4))
 
 	want := ratelimit.Counts{Minute: 1, Hour: 3.25, Day: 4}
 	if counts != want {
@@ -424,7 +364,7 @@ func wantCount(
 ) {
 	t.Helper()
 
-	_, hit, _ := limiter.Count(client, now, whole)
+	_, hit, _ := limiter.Count(client, now)
 	if hit.Window != want {
 		t.Errorf("request from %s at %s is over %q, want %q",
 			client, now.Format(time.RFC3339), hit.Window, want)
@@ -439,7 +379,7 @@ func wantBytesCount(
 ) {
 	t.Helper()
 
-	_, hit, _ := limiter.CountBytes(client, now, bytes, whole)
+	_, hit, _ := limiter.CountBytes(client, now, bytes)
 	if hit.Kind != want {
 		t.Errorf("%d bytes from %s at %s break a limit on %q, want %q",
 			bytes, client, now.Format(time.RFC3339), hit.Kind, want)

internal/ratelimit/snapshot_test.go

@@ -16,7 +16,7 @@ func TestSnapshotListsTheClientsByAddress(t *testing.T) {
 
 	limiter := ratelimit.New(ratelimit.Limits{})
 	for _, i := range []int{2, 3, 0, 1} {
-		limiter.Count(netip.MustParsePrefix(want[i]), midnight(), whole)
+		limiter.Count(netip.MustParsePrefix(want[i]), midnight())
 	}
 
 	snapshot := limiter.Snapshot()
@@ -63,8 +63,8 @@ func TestLoadEmptiesBucketsWhoseTimeHasPassed(t *testing.T) {
 	start := midnight()
 
 	limiter := ratelimit.New(ratelimit.Limits{})
-	limiter.Count(client, start, whole)
+	limiter.Count(client, start)
-	limiter.CountBytes(client, start, 5, whole)
+	limiter.CountBytes(client, start, 5)
 	limiter.AddToHistory(client, start, ratelimit.Request{Forwarded: true})
 
 	loaded := func(now time.Time) ratelimit.Client {

internal/reputation/abuseipdb.go

@@ -1,328 +0,0 @@
-package reputation
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"slices"
-	"sync"
-	"time"
-
-	"github.com/hashicorp/golang-lru/v2/simplelru"
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-)
-
-const (
-	// AbuseIPDBURL is where clients are checked: the check endpoint of
-	// AbuseIPDB's API.
-	AbuseIPDBURL = "https://api.abuseipdb.com/api/v2/check"
-	// AbuseIPDBSource is how the request log, the alerts and the metrics
-	// name AbuseIPDB.
-	AbuseIPDBSource = "abuseipdb"
-	// maxAnswerBytes is the most of an answer of AbuseIPDB that is read.
-	maxAnswerBytes = 64 << 10
-	// day is the length of the day the checks are counted in, in UTC.
-	day = 24 * time.Hour
-)
-
-var (
-	errNoScore      = errors.New("the answer gives no abuseConfidenceScore")
-	errBudgetUsedUp = errors.New(
-		"checks spent; none is made until the day ends at 00:00 UTC")
-)
-
-// Score is what AbuseIPDB said about a client, as reputation.json holds
-// it: the client, an IPv4 address or an IPv6 group, its abuse confidence
-// score, from 0 to 100, and when AbuseIPDB answered.
-type Score struct {
-	Client  netip.Prefix `json:"client"`
-	Score   int64        `json:"score"`
-	Fetched time.Time    `json:"fetched"`
-}
-
-// Checks are what reputation.json keeps of the checks of clients with
-// AbuseIPDB: the day, in UTC, of the checks Spent counts, zero before the
-// first, and the scores still in use.
-type Checks struct {
-	Day    time.Time `json:"day,omitzero"`
-	Spent  int       `json:"spent"`
-	Scores []Score   `json:"scores"`
-}
-
-// AbuseIPDBParams are what NewAbuseIPDB needs.
-type AbuseIPDBParams struct {
-	// URL is where clients are checked, normally AbuseIPDBURL, with Key,
-	// the account's key (SWWAF_ABUSEIPDB_KEY).
-	URL string
-	Key string
-	// MinScore is the least score that is a hit (SWWAF_ABUSEIPDB_MIN_SCORE),
-	// and DailyBudget the most checks made in a day, in UTC
-	// (SWWAF_ABUSEIPDB_DAILY_BUDGET).
-	MinScore    int64
-	DailyBudget int
-	// CacheTTL is how long a score is used after it was fetched
-	// (SWWAF_REPUTATION_CACHE_TTL), and Timeout how long a check may take
-	// (SWWAF_REPUTATION_TIMEOUT).
-	CacheTTL time.Duration
-	Timeout  time.Duration
-	// Now tells the time, normally time.Now in UTC.
-	Now func() time.Time
-	// ProcessLog receives each check that fails, and why, and the day's
-	// budget used up.
-	ProcessLog *slog.Logger
-	// Alerts receive a source_failure alert for each.
-	Alerts *alerts.Queue
-}
-
-// AbuseIPDB checks clients with AbuseIPDB, in the background, and keeps
-// their scores. It is safe for concurrent use.
-type AbuseIPDB struct {
-	params     AbuseIPDBParams
-	httpClient *http.Client
-
-	mu sync.Mutex
-	// scores are by client. Each is added as it is fetched and never moved
-	// up, so that the one fetched longest ago is the first dropped.
-	scores *simplelru.LRU[netip.Prefix, Score]
-	// checking are the clients whose check is under way.
-	checking map[netip.Prefix]bool
-	// day is the day, in UTC, of the checks spent counts.
-	day   time.Time
-	spent int
-	// checks and failures count the checks made and those that failed,
-	// and retryAt is when a client may be checked again after the last
-	// check failed.
-	checks   int
-	failures int
-	retryAt  time.Time
-}
-
-// NewAbuseIPDB returns an AbuseIPDB with no score yet, and no check spent.
-func NewAbuseIPDB(params AbuseIPDBParams) *AbuseIPDB {
-	scores, err := simplelru.NewLRU[netip.Prefix, Score](maxVerdicts, nil)
-	if err != nil {
-		panic(err) // NewLRU fails only for a size below one
-	}
-
-	return &AbuseIPDB{
-		params:     params,
-		httpClient: &http.Client{},
-		scores:     scores,
-		checking:   map[netip.Prefix]bool{},
-	}
-}
-
-// Hit returns AbuseIPDB's score of client, an IPv4 address or an IPv6
-// group, and whether it is a hit: MinScore or more. A score is used until
-// CacheTTL has passed since it was fetched, whichever of the client's
-// addresses its request comes from. A client without one is checked in
-// the background, by addr, the address its request came from, if
-// offender, if it has committed an offence, unless its check is under
-// way, a check failed less than failureDelay ago, or the day's checks
-// have used up DailyBudget; Hit never waits for a check. The check that
-// uses the budget up is logged and raised as a source_failure alert. ctx
-// is the context of the client's request, and a check goes on after the
-// request ends.
-func (a *AbuseIPDB) Hit(
-	ctx context.Context, client netip.Prefix, addr netip.Addr, offender bool,
-) (int64, bool) {
-	a.mu.Lock()
-
-	now := a.params.Now()
-
-	kept, found := a.scores.Peek(client)
-	if found && now.Sub(kept.Fetched) < a.params.CacheTTL {
-		a.mu.Unlock()
-
-		return kept.Score, kept.Score >= a.params.MinScore
-	}
-
-	if today := now.Truncate(day); !a.day.Equal(today) {
-		a.day, a.spent = today, 0
-	}
-
-	check := offender && !a.checking[client] && !now.Before(a.retryAt) &&
-		a.spent < a.params.DailyBudget
-	if check {
-		a.checking[client] = true
-		a.checks++
-		a.spent++
-
-		go a.check(context.WithoutCancel(ctx), client, addr)
-	}
-
-	usedUp := check && a.spent == a.params.DailyBudget
-
-	a.mu.Unlock()
-
-	if usedUp {
-		a.alert("the daily budget of AbuseIPDB checks is used up",
-			fmt.Errorf("%d %w", a.params.DailyBudget, errBudgetUsedUp))
-	}
-
-	return 0, false
-}
-
-// Checked returns how many checks were made.
-func (a *AbuseIPDB) Checked() int {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-
-	return a.checks
-}
-
-// Failures returns how many checks failed.
-func (a *AbuseIPDB) Failures() int {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-
-	return a.failures
-}
-
-// BudgetLeft returns how many checks the day's budget has left.
-func (a *AbuseIPDB) BudgetLeft() int {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-
-	if !a.day.Equal(a.params.Now().Truncate(day)) {
-		return a.params.DailyBudget
-	}
-
-	return max(a.params.DailyBudget-a.spent, 0)
-}
-
-// Snapshot returns the checks spent and every score still in use, sorted
-// by client, as reputation.json keeps them.
-func (a *AbuseIPDB) Snapshot() Checks {
-	a.mu.Lock()
-
-	now := a.params.Now()
-	checks := Checks{Day: a.day, Spent: a.spent, Scores: make([]Score, 0, a.scores.Len())}
-
-	for _, kept := range a.scores.Values() {
-		if now.Sub(kept.Fetched) < a.params.CacheTTL {
-			checks.Scores = append(checks.Scores, kept)
-		}
-	}
-
-	a.mu.Unlock()
-
-	slices.SortFunc(checks.Scores, func(x, y Score) int {
-		return x.Client.Compare(y.Client)
-	})
-
-	return checks
-}
-
-// Load keeps checks, read from reputation.json, in place of those it
-// keeps, but for the scores past maxVerdicts, those fetched longest ago.
-// One fetched CacheTTL ago or more is neither used nor written, as for any
-// score.
-func (a *AbuseIPDB) Load(checks Checks) {
-	scores := slices.Clone(checks.Scores)
-	slices.SortStableFunc(scores, func(x, y Score) int {
-		return x.Fetched.Compare(y.Fetched)
-	})
-
-	a.mu.Lock()
-	defer a.mu.Unlock()
-
-	a.day, a.spent = checks.Day, checks.Spent
-	a.scores.Purge()
-
-	for _, kept := range scores {
-		a.scores.Add(kept.Client, kept)
-	}
-}
-
-// check checks client with AbuseIPDB by addr, one of its addresses, keeps
-// the score as client's, and notes the check as no longer under way. A
-// check that fails gives no score: it is counted, logged and raised as a
-// source_failure alert, and no client is checked for failureDelay.
-func (a *AbuseIPDB) check(ctx context.Context, client netip.Prefix, addr netip.Addr) {
-	score, err := a.ask(ctx, addr)
-	now := a.params.Now()
-
-	a.mu.Lock()
-
-	delete(a.checking, client)
-
-	if err == nil {
-		a.scores.Add(client, Score{Client: client, Score: score, Fetched: now})
-	} else {
-		a.failures++
-		a.retryAt = now.Add(failureDelay)
-	}
-
-	a.mu.Unlock()
-
-	if err != nil {
-		a.alert("checking a client with AbuseIPDB failed", err)
-	}
-}
-
-// ask asks AbuseIPDB for addr's abuse confidence score, sending the key
-// in the header Key. An answer other than 200, one that gives no score,
-// and none within Timeout, fail.
-func (a *AbuseIPDB) ask(ctx context.Context, addr netip.Addr) (int64, error) {
-	ctx, cancel := context.WithTimeout(ctx, a.params.Timeout)
-	defer cancel()
-
-	query := url.Values{"ipAddress": {addr.String()}}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
-		a.params.URL+"?"+query.Encode(), http.NoBody)
-	if err != nil {
-		return 0, fmt.Errorf("make the request: %w", err)
-	}
-
-	req.Header.Set("Key", a.params.Key)
-	req.Header.Set("Accept", "application/json")
-
-	res, err := a.httpClient.Do(req)
-	if err != nil {
-		// Do's error names the URL, which holds the client's address, which
-		// is not to be logged: only what went wrong is kept.
-		return 0, fmt.Errorf("check the client: %w", errors.Unwrap(err))
-	}
-
-	defer func() {
-		_ = res.Body.Close()
-	}()
-
-	if res.StatusCode != http.StatusOK {
-		return 0, fmt.Errorf("%w %s", errStatus, res.Status)
-	}
-
-	var answer struct {
-		Data struct {
-			AbuseConfidenceScore *int64 `json:"abuseConfidenceScore"`
-		} `json:"data"`
-	}
-
-	err = json.NewDecoder(io.LimitReader(res.Body, maxAnswerBytes)).Decode(&answer)
-	if err != nil {
-		return 0, fmt.Errorf("read the answer: %w", err)
-	}
-
-	if answer.Data.AbuseConfidenceScore == nil {
-		return 0, errNoScore
-	}
-
-	return *answer.Data.AbuseConfidenceScore, nil
-}
-
-// alert raises a source_failure alert from AbuseIPDB with reason and err,
-// and logs them.
-func (a *AbuseIPDB) alert(reason string, err error) {
-	// Raised before it is logged, so that the alert is there once the log
-	// line is.
-	raiseFailure(a.params.Alerts, reason, AbuseIPDBSource, err)
-	a.params.ProcessLog.Warn(reason, "source", AbuseIPDBSource, "error", err.Error())
-}

internal/reputation/abuseipdb_test.go

@@ -1,663 +0,0 @@
-package reputation_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"reflect"
-	"slices"
-	"strings"
-	"sync"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/metrics"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
-)
-
-// The tests of AbuseIPDB run in synctest bubbles, as those of the lists
-// do, and AbuseIPDB is a stand-in reached without the network, for the
-// same reason. A bubble's clock starts at midnight UTC, as a day the
-// checks are counted in starts.
-
-const (
-	// key is the account's key the tests give, the only one the stand-in
-	// takes.
-	key = "abuseipdb-key-0123456789abcdef"
-	// suspect and other are clients that have committed an offence.
-	suspect = "203.0.113.9"
-	other   = "2001:db8::9"
-)
-
-func TestOnlyAnOffenderWithoutAScoreIsChecked(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
-		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
-
-		// A client that has committed no offence is not checked.
-		wantScore(t, checker, suspect, false, 0, false)
-		synctest.Wait()
-		wantChecked(t, abuseIPDB)
-
-		// An offender is, and from then on its score is used, whether or not
-		// it is an offender.
-		wantScore(t, checker, suspect, true, 0, false)
-		synctest.Wait()
-		wantScore(t, checker, suspect, true, 100, true)
-		wantScore(t, checker, suspect, false, 100, true)
-		synctest.Wait()
-		wantChecked(t, abuseIPDB, suspect)
-	})
-}
-
-func TestIPv6ClientIsCheckedOnceAndItsScoreUsedForEachOfItsAddresses(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		// 15 addresses of 2001:db8:1:2::/64, one client, each in a part of
-		// it of its own.
-		var addresses []string
-		for i := 1; i < 16; i++ {
-			addresses = append(addresses, fmt.Sprintf("2001:db8:1:2:%x::9", i<<12))
-		}
-
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{addresses[0]: 100}}
-		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
-
-		// A request from each has the client checked once, by the first.
-		for _, address := range addresses {
-			hitFrom(t, checker, address, true)
-		}
-
-		synctest.Wait()
-		wantChecked(t, abuseIPDB, addresses[0])
-
-		// Its score is the whole client's.
-		for _, address := range addresses {
-			wantScore(t, checker, address, true, 100, true)
-		}
-
-		synctest.Wait()
-		wantChecked(t, abuseIPDB, addresses[0])
-	})
-}
-
-func TestScoreAtOrOverTheMinimumIsAHit(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		scores := map[string]int64{"192.0.2.74": 74, "192.0.2.75": 75, "192.0.2.100": 100}
-		p := abuseIPDBParams()
-		p.MinScore = 75
-		checker := newAbuseIPDB(&abuseIPDBStandIn{scores: scores}, p)
-
-		for client := range scores {
-			hitFrom(t, checker, client, true)
-		}
-
-		synctest.Wait()
-
-		for client, score := range scores {
-			wantScore(t, checker, client, true, score, score >= 75)
-		}
-	})
-}
-
-func TestScoreUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
-		checker := newAbuseIPDB(abuseIPDB, abuseIPDBParams())
-
-		hitFrom(t, checker, suspect, true)
-		synctest.Wait()
-
-		// AbuseIPDB gives another score from now on, but the one kept is
-		// used, and the client is not checked again, until the TTL has
-		// passed.
-		abuseIPDB.setScore(suspect, 80)
-		time.Sleep(cacheTTL - time.Nanosecond)
-		wantScore(t, checker, suspect, true, 100, true)
-		synctest.Wait()
-		wantChecked(t, abuseIPDB, suspect)
-
-		// Then it is not used, and the client is checked again.
-		time.Sleep(time.Nanosecond)
-		wantScore(t, checker, suspect, true, 0, false)
-		synctest.Wait()
-		wantScore(t, checker, suspect, true, 80, true)
-		wantChecked(t, abuseIPDB, suspect, suspect)
-	})
-}
-
-func TestDailyBudgetKeptAcrossARestartAndWholeAgainAsTheDayEnds(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		var log bytes.Buffer
-
-		queue := newQueue()
-		p := abuseIPDBParams()
-		p.DailyBudget = 3
-		p.Alerts = queue
-		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
-		checker := newAbuseIPDB(abuseIPDB, p)
-
-		// At noon, the first three offenders spend the budget, and the
-		// fourth, unchecked, is not.
-		time.Sleep(12 * time.Hour)
-
-		const unchecked = "192.0.2.4"
-
-		clients := []string{suspect, "192.0.2.2", "192.0.2.3", unchecked}
-		for _, client := range clients {
-			hitFrom(t, checker, client, true)
-		}
-
-		synctest.Wait()
-		wantChecked(t, abuseIPDB, clients[:3]...)
-		wantBudgetLeft(t, checker, 0)
-
-		// The check that used the budget up raised the alert, and logged it.
-		const usedUp = "the daily budget of AbuseIPDB checks is used up"
-
-		wantFailureAlert(t, queue, time.Now(), usedUp,
-			"3 checks spent; none is made until the day ends at 00:00 UTC", 0)
-
-		if !strings.Contains(log.String(), `"msg":"`+usedUp+`"`) {
-			t.Errorf("logged\n%s\nwant the budget used up", log.String())
-		}
-
-		// Restarted with what reputation.json keeps, it uses the scores, and
-		// checks no client until the day ends.
-		restarted := &abuseIPDBStandIn{}
-		again := newAbuseIPDB(restarted, p)
-		again.Load(checker.Snapshot())
-
-		wantScore(t, again, suspect, true, 100, true)
-		wantBudgetLeft(t, again, 0)
-		time.Sleep(12*time.Hour - time.Nanosecond)
-		wantScore(t, again, unchecked, true, 0, false)
-		synctest.Wait()
-		wantChecked(t, restarted)
-
-		// At midnight the budget is whole again.
-		time.Sleep(time.Nanosecond)
-		wantBudgetLeft(t, again, 3)
-		wantScore(t, again, unchecked, true, 0, false)
-		synctest.Wait()
-		wantChecked(t, restarted, unchecked)
-		wantBudgetLeft(t, again, 2)
-	})
-}
-
-func TestFailedCheckGivesNoScoreAndNoClientIsCheckedForAMinute(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		// key is the key sent, status and body what AbuseIPDB answers with,
-		// and error the failure.
-		key, body string
-		status    int
-		error     string
-	}{
-		{
-			"a refusal, past AbuseIPDB's own limit", key,
-			`{"errors":[{"detail":"Daily rate limit of 1000 requests exceeded"}]}`,
-			http.StatusTooManyRequests, "the server answered 429 Too Many Requests",
-		},
-		{
-			"a refusal of a wrong key", "wrong-key-0123456789abcdef", "", 0,
-			"the server answered 401 Unauthorized",
-		},
-		{
-			"a server failure", key, "", http.StatusInternalServerError,
-			"the server answered 500 Internal Server Error",
-		},
-		{
-			"an answer without a score", key, `{"data":{"ipAddress":"` + suspect + `"}}`,
-			http.StatusOK, "the answer gives no abuseConfidenceScore",
-		},
-		{
-			"an answer that is not JSON", key, "<html>", http.StatusOK,
-			"read the answer: invalid character '<' looking for beginning of value",
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			synctest.Test(t, func(t *testing.T) {
-				var log bytes.Buffer
-
-				queue := newQueue()
-				p := abuseIPDBParams()
-				p.Key = tc.key
-				p.Alerts = queue
-				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-				abuseIPDB := &abuseIPDBStandIn{status: tc.status, body: tc.body}
-				checker := newAbuseIPDB(abuseIPDB, p)
-
-				// The failure gives no score, and no client is checked within a
-				// minute of it.
-				wantScore(t, checker, suspect, true, 0, false)
-				synctest.Wait()
-				time.Sleep(time.Minute - time.Nanosecond)
-				wantScore(t, checker, other, true, 0, false)
-				synctest.Wait()
-				wantChecked(t, abuseIPDB, suspect)
-				wantFailures(t, checker, 1)
-
-				time.Sleep(time.Nanosecond)
-				wantScore(t, checker, other, true, 0, false)
-				synctest.Wait()
-				wantChecked(t, abuseIPDB, suspect, other)
-				wantFailures(t, checker, 2)
-
-				if scores := checker.Snapshot().Scores; len(scores) != 0 {
-					t.Errorf("scores %+v, want none", scores)
-				}
-
-				// One alert for the first failure; the cooldown holds back the
-				// second.
-				wantFailureAlert(t, queue, time.Now().Add(-time.Minute),
-					"checking a client with AbuseIPDB failed", tc.error, 1)
-
-				if !strings.Contains(log.String(), `"msg":"checking a client with `+
-					`AbuseIPDB failed","source":"abuseipdb","error":"`+tc.error) {
-					t.Errorf("logged\n%s\nwant the failures", log.String())
-				}
-			})
-		})
-	}
-}
-
-func TestCheckNotAnsweredWithinTheTimeoutFailsAndHitNeverWaits(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		queue := newQueue()
-		p := abuseIPDBParams()
-		p.Alerts = queue
-		abuseIPDB := &abuseIPDBStandIn{hanging: true}
-		checker := newAbuseIPDB(abuseIPDB, p)
-		began := time.Now()
-
-		// The second, while the first's check is under way, starts none.
-		wantScore(t, checker, suspect, true, 0, false)
-		wantScore(t, checker, suspect, true, 0, false)
-
-		if waited := time.Since(began); waited != 0 {
-			t.Errorf("waited %s for the check, want no wait", waited)
-		}
-
-		time.Sleep(timeout - time.Nanosecond)
-		synctest.Wait()
-		wantChecked(t, abuseIPDB, suspect)
-		wantFailures(t, checker, 0)
-
-		time.Sleep(time.Nanosecond)
-		synctest.Wait()
-		wantFailures(t, checker, 1)
-		wantFailureAlert(t, queue, time.Now(), "checking a client with AbuseIPDB failed",
-			"check the client: context deadline exceeded", 0)
-	})
-}
-
-func TestKeyIsSentInTheKeyHeaderAndNeverShown(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		var log bytes.Buffer
-
-		queue := newQueue()
-		p := abuseIPDBParams()
-		p.Alerts = queue
-		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-		abuseIPDB := &abuseIPDBStandIn{scores: map[string]int64{suspect: 100}}
-		checker := newAbuseIPDB(abuseIPDB, p)
-		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
-		m.AddAbuseIPDB(checker)
-
-		// One check that AbuseIPDB answers, and one it refuses with an answer
-		// that names the key.
-		wantScore(t, checker, suspect, true, 0, false)
-		synctest.Wait()
-		wantScore(t, checker, suspect, true, 100, true)
-
-		abuseIPDB.answerWith(http.StatusUnauthorized, `{"errors":[{"detail":"`+key+`"}]}`)
-		wantScore(t, checker, other, true, 0, false)
-		synctest.Wait()
-		wantFailures(t, checker, 1)
-
-		abuseIPDB.mu.Lock()
-		sent := slices.Clone(abuseIPDB.keys)
-		abuseIPDB.mu.Unlock()
-
-		if !slices.Equal(sent, []string{key, key}) {
-			t.Errorf("checks sent the keys %v, want %s twice", sent, key)
-		}
-
-		alerted, err := json.Marshal(waiting(queue))
-		if err != nil {
-			t.Fatalf("encode the alerts: %v", err)
-		}
-
-		kept, err := json.Marshal(checker.Snapshot())
-		if err != nil {
-			t.Fatalf("encode the checks: %v", err)
-		}
-
-		for name, shown := range map[string]string{
-			"the log": log.String(), "the alerts": string(alerted),
-			"the metrics": scrapeMetrics(t, m), "reputation.json": string(kept),
-		} {
-			if strings.Contains(shown, key) {
-				t.Errorf("%s shows the key:\n%s", name, shown)
-			}
-		}
-	})
-}
-
-func TestMetricsCountTheChecksTheFailuresAndTheBudgetLeft(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		abuseIPDB := &abuseIPDBStandIn{}
-		p := abuseIPDBParams()
-		p.DailyBudget = 5
-		checker := newAbuseIPDB(abuseIPDB, p)
-		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), reputation.NewDNSBL(dnsblParams()))
-		m.AddAbuseIPDB(checker)
-
-		// One check that AbuseIPDB answers, and one that fails.
-		hitFrom(t, checker, suspect, true)
-		synctest.Wait()
-		abuseIPDB.answerWith(http.StatusInternalServerError, "")
-		hitFrom(t, checker, other, true)
-		synctest.Wait()
-
-		scraped := scrapeMetrics(t, m)
-
-		for series, want := range map[string]string{
-			"queries_total":          "2",
-			"failures_total":         "1",
-			"daily_budget_remaining": "3",
-		} {
-			line := "\nsmallwebwaf_reputation_" + series +
-				`{instance="app",source="abuseipdb"} ` + want + "\n"
-			if !strings.Contains(scraped, line) {
-				t.Errorf("metrics\n%s\nwant%s", scraped, line)
-			}
-		}
-	})
-}
-
-func TestScoreFetchedATTLAgoIsNeitherUsedNorKept(t *testing.T) {
-	t.Parallel()
-
-	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
-	p := abuseIPDBParams()
-	p.Now = func() time.Time { return now }
-	checker := reputation.NewAbuseIPDB(p)
-
-	// The last score still in use, and one, of other's /64, fetched a TTL
-	// ago.
-	inUse := reputation.Score{
-		Client: netip.MustParsePrefix(suspect + "/32"), Score: 100,
-		Fetched: now.Add(-cacheTTL + time.Nanosecond),
-	}
-	stale := reputation.Score{
-		Client: netip.MustParsePrefix("2001:db8::/64"), Score: 100,
-		Fetched: now.Add(-cacheTTL),
-	}
-
-	checker.Load(reputation.Checks{Scores: []reputation.Score{stale, inUse}})
-
-	wantScore(t, checker, suspect, false, 100, true)
-	wantScore(t, checker, other, false, 0, false)
-
-	got := checker.Snapshot().Scores
-	if !reflect.DeepEqual(got, []reputation.Score{inUse}) {
-		t.Errorf("scores %+v, want only %+v", got, inUse)
-	}
-}
-
-func TestAtMost100000ScoresKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
-	t.Parallel()
-
-	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
-	p := abuseIPDBParams()
-	p.Now = func() time.Time { return now }
-	checker := reputation.NewAbuseIPDB(p)
-
-	// 100,001 scores, listed by client, as reputation.json lists them, each
-	// fetched a millisecond before the one before it: the last is one too
-	// many.
-	const count = 100001
-
-	scores := make([]reputation.Score, 0, count)
-
-	addr := netip.MustParseAddr("198.18.0.0")
-	for i := range count {
-		scores = append(scores, reputation.Score{
-			Client:  netip.PrefixFrom(addr, 32),
-			Fetched: now.Add(-time.Duration(i) * time.Millisecond),
-		})
-		addr = addr.Next()
-	}
-
-	checker.Load(reputation.Checks{Scores: scores})
-
-	got := checker.Snapshot().Scores
-	if len(got) != count-1 || !slices.Contains(got, scores[0]) ||
-		slices.Contains(got, scores[count-1]) {
-		t.Errorf("%d scores kept, want all but the one fetched longest ago", len(got))
-	}
-}
-
-// abuseIPDBStandIn is a stand-in for AbuseIPDB. It answers a check sent
-// with key by the client's score, as scores gives it, 0 for a client it
-// does not give; a check sent with another key with 401; and, while
-// status is not 0, every check with status and body; and while hanging,
-// none at all. It notes each client checked, and the key sent.
-type abuseIPDBStandIn struct {
-	mu      sync.Mutex
-	scores  map[string]int64
-	status  int
-	body    string
-	hanging bool
-	checked []string
-	keys    []string
-}
-
-// RoundTrip has the stand-in answer req, in place of the network. A check
-// abandoned before the stand-in answers fails, as over the network.
-func (s *abuseIPDBStandIn) RoundTrip(req *http.Request) (*http.Response, error) {
-	client := req.URL.Query().Get("ipAddress")
-	sent := req.Header.Get("Key")
-
-	s.mu.Lock()
-	s.checked = append(s.checked, client)
-	s.keys = append(s.keys, sent)
-	score := s.scores[client]
-	status, body, hanging := s.status, s.body, s.hanging
-	s.mu.Unlock()
-
-	switch {
-	case hanging:
-		<-req.Context().Done()
-
-		return nil, req.Context().Err()
-	case sent != key:
-		status = http.StatusUnauthorized
-	case status == 0:
-		status = http.StatusOK
-		body = fmt.Sprintf(`{"data":{"ipAddress":%q,"abuseConfidenceScore":%d}}`, client,
-			score)
-	}
-
-	return &http.Response{
-		StatusCode: status,
-		Status:     fmt.Sprintf("%d %s", status, http.StatusText(status)),
-		Header:     http.Header{},
-		Body:       io.NopCloser(strings.NewReader(body)),
-		Request:    req,
-	}, nil
-}
-
-// setScore has the stand-in give client score.
-func (s *abuseIPDBStandIn) setScore(client string, score int64) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	s.scores[client] = score
-}
-
-// answerWith has the stand-in answer every check with status and body.
-func (s *abuseIPDBStandIn) answerWith(status int, body string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	s.status, s.body = status, body
-}
-
-// abuseIPDBParams returns the AbuseIPDBParams of the tests: key, a minimum
-// score of 75, a daily budget of 900, and the cache TTL and timeout of the
-// DNSBL tests, by the bubble's clock, with alerts to a queue that sends
-// none.
-func abuseIPDBParams() reputation.AbuseIPDBParams {
-	return reputation.AbuseIPDBParams{
-		URL:         "https://abuseipdb.example/api/v2/check",
-		Key:         key,
-		MinScore:    75,
-		DailyBudget: 900,
-		CacheTTL:    cacheTTL,
-		Timeout:     timeout,
-		Now:         time.Now,
-		ProcessLog:  slog.New(slog.DiscardHandler),
-		Alerts:      newQueue(),
-	}
-}
-
-// newAbuseIPDB returns the AbuseIPDB of p, checking clients with
-// abuseIPDB.
-func newAbuseIPDB(
-	abuseIPDB *abuseIPDBStandIn, p reputation.AbuseIPDBParams,
-) *reputation.AbuseIPDB {
-	checker := reputation.NewAbuseIPDB(p)
-	checker.SetTransport(abuseIPDB)
-
-	return checker
-}
-
-// wantScore checks the score checker gives client, and whether it is a
-// hit, as a request from client finds them, offender or not.
-func wantScore(
-	t *testing.T, checker *reputation.AbuseIPDB, client string, offender bool,
-	score int64, hit bool,
-) {
-	t.Helper()
-
-	gotScore, gotHit := hitFrom(t, checker, client, offender)
-	if gotScore != score || gotHit != hit {
-		t.Errorf("%s has the score %d, a hit %t, want %d, %t", client, gotScore, gotHit,
-			score, hit)
-	}
-}
-
-// hitFrom is checker's Hit for a request from address, offender or not.
-// Its client is address for an IPv4 address, and its /64 for an IPv6 one,
-// as smallwebwaf counts clients.
-func hitFrom(
-	t *testing.T, checker *reputation.AbuseIPDB, address string, offender bool,
-) (int64, bool) {
-	t.Helper()
-
-	addr := netip.MustParseAddr(address)
-
-	client := netip.PrefixFrom(addr, addr.BitLen())
-	if addr.Is6() {
-		client = netip.PrefixFrom(addr, 64).Masked()
-	}
-
-	return checker.Hit(t.Context(), client, addr, offender)
-}
-
-// wantChecked checks the clients the stand-in was asked about, in any
-// order.
-func wantChecked(t *testing.T, abuseIPDB *abuseIPDBStandIn, want ...string) {
-	t.Helper()
-
-	abuseIPDB.mu.Lock()
-	got := slices.Sorted(slices.Values(abuseIPDB.checked))
-	abuseIPDB.mu.Unlock()
-
-	want = slices.Sorted(slices.Values(want))
-
-	if !slices.Equal(got, want) {
-		t.Errorf("checked %v, want %v", got, want)
-	}
-}
-
-// wantFailures checks how many checks failed.
-func wantFailures(t *testing.T, checker *reputation.AbuseIPDB, want int) {
-	t.Helper()
-
-	if got := checker.Failures(); got != want {
-		t.Errorf("%d checks failed, want %d", got, want)
-	}
-}
-
-// wantFailureAlert checks that the one alert waiting in queue is a
-// source_failure alert from AbuseIPDB, raised at raised, with reason and
-// the error failure, and that the cooldown has held back held repeats of
-// it.
-func wantFailureAlert(
-	t *testing.T, queue *alerts.Queue, raised time.Time, reason, failure string,
-	held int64,
-) {
-	t.Helper()
-
-	got := waiting(queue)
-	if len(got) != 1 || !got[0].Time.Equal(raised) ||
-		got[0].Event != alerts.EventSourceFailure || got[0].Reason != reason ||
-		got[0].Detail["source"] != reputation.AbuseIPDBSource ||
-		got[0].Detail["error"] != failure || queue.Suppressed() != held {
-		t.Errorf("alerts waiting %+v, %d held back, want only AbuseIPDB's %q with %q, "+
-			"and %d", got, queue.Suppressed(), reason, failure, held)
-	}
-}
-
-// wantBudgetLeft checks how many checks the day's budget has left.
-func wantBudgetLeft(t *testing.T, checker *reputation.AbuseIPDB, want int) {
-	t.Helper()
-
-	if got := checker.BudgetLeft(); got != want {
-		t.Errorf("%d checks left, want %d", got, want)
-	}
-}
-
-// scrapeMetrics returns the metrics m serves.
-func scrapeMetrics(t *testing.T, m *metrics.Metrics) string {
-	t.Helper()
-
-	scraped := httptest.NewRecorder()
-	m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
-		http.NoBody))
-
-	return scraped.Body.String()
-}

internal/reputation/dnsbl.go

@@ -1,332 +0,0 @@
-package reputation
-
-import (
-	"cmp"
-	"context"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"log/slog"
-	"net"
-	"net/netip"
-	"slices"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/hashicorp/golang-lru/v2/simplelru"
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/config"
-)
-
-const (
-	// maxVerdicts is how many verdicts of the DNSBL zones are kept, and how
-	// many scores of AbuseIPDB. Past it, the one fetched longest ago is
-	// dropped.
-	maxVerdicts = 100000
-	// maxQueries is how many queries may be under way at once. Past it, a
-	// zone is not asked about a client until the client's next request, so
-	// that a swarm of new addresses cannot fill the memory.
-	maxQueries = 1000
-	// failureDelay is how long a zone is not asked again after a query to
-	// it fails, and no client is checked with AbuseIPDB after a check
-	// fails, so that a source refusing them is not asked on every request.
-	failureDelay = time.Minute
-)
-
-var (
-	errAsk        = errors.New("ask the zone")
-	errRefused    = errors.New("the zone refused the query")
-	errNotListing = errors.New("the answer is outside 127.0.0.0/8")
-)
-
-// Verdict is what a zone said about a client, as reputation.json holds
-// it: the zone, the client's address, whether the zone lists it, and when
-// the zone answered.
-type Verdict struct {
-	Zone    string     `json:"zone"`
-	Client  netip.Addr `json:"client"`
-	Listed  bool       `json:"listed"`
-	Fetched time.Time  `json:"fetched"`
-}
-
-// DNSBLParams are what NewDNSBL needs.
-type DNSBLParams struct {
-	// Zones are the DNSBL zones clients are asked about in
-	// (SWWAF_DNSBL_ZONES).
-	Zones []string
-	// Resolver is the resolver they are asked through
-	// (SWWAF_DNSBL_RESOLVER), or, while it is the zero AddrPort, the
-	// host's, as /etc/resolv.conf names it.
-	Resolver netip.AddrPort
-	// CacheTTL is how long a verdict is used after it was fetched
-	// (SWWAF_REPUTATION_CACHE_TTL), and Timeout how long a query may take
-	// (SWWAF_REPUTATION_TIMEOUT).
-	CacheTTL time.Duration
-	Timeout  time.Duration
-	// Now tells the time, normally time.Now in UTC.
-	Now func() time.Time
-	// ProcessLog receives each query that fails, and why.
-	ProcessLog *slog.Logger
-	// Alerts receive a source_failure alert for each query that fails.
-	Alerts *alerts.Queue
-}
-
-// DNSBL asks the DNSBL zones about clients, in the background, and keeps
-// their verdicts. It is safe for concurrent use.
-type DNSBL struct {
-	params   DNSBLParams
-	resolver *net.Resolver
-
-	mu sync.Mutex
-	// verdicts are by query. Each is added as it is fetched and never moved
-	// up, so that the one fetched longest ago is the first dropped.
-	verdicts *simplelru.LRU[query, Verdict]
-	// asking are the queries under way.
-	asking map[query]bool
-	// queries and failures count, by zone, the queries made and those that
-	// failed, and retryAt is when a zone whose last query failed may be
-	// asked again.
-	queries  map[string]int
-	failures map[string]int
-	retryAt  map[string]time.Time
-}
-
-// query is a client's address, to ask a zone about.
-type query struct {
-	zone   string
-	client netip.Addr
-}
-
-// NewDNSBL returns a DNSBL with no verdict yet.
-func NewDNSBL(params DNSBLParams) *DNSBL {
-	verdicts, err := simplelru.NewLRU[query, Verdict](maxVerdicts, nil)
-	if err != nil {
-		panic(err) // NewLRU fails only for a size below one
-	}
-
-	resolver := &net.Resolver{}
-	if params.Resolver.IsValid() {
-		// Dial is used by Go's own resolver alone.
-		resolver.PreferGo = true
-		resolver.Dial = func(ctx context.Context, network, _ string) (net.Conn, error) {
-			var dialer net.Dialer
-
-			return dialer.DialContext(ctx, network, params.Resolver.String())
-		}
-	}
-
-	return &DNSBL{
-		params:   params,
-		resolver: resolver,
-		verdicts: verdicts,
-		asking:   map[query]bool{},
-		queries:  map[string]int{},
-		failures: map[string]int{},
-		retryAt:  map[string]time.Time{},
-	}
-}
-
-// Zones returns the zones, in the order SWWAF_DNSBL_ZONES names them.
-func (d *DNSBL) Zones() []string {
-	return slices.Clone(d.params.Zones)
-}
-
-// ListedBy returns the zones whose verdict on addr, a client's address,
-// lists it, in the order SWWAF_DNSBL_ZONES names them, each with its key
-// masked, as config.MaskZoneKey masks it, since they go to the request
-// log, the alerts and the metrics. A verdict is used until CacheTTL has
-// passed since it was fetched. Each zone without one is asked about addr
-// in the background, unless a query about addr to it is under way, the
-// zone is left alone after a failure, or maxQueries are under way;
-// ListedBy never waits for a query. ctx is the context of the client's
-// request, and a query goes on after the request ends.
-func (d *DNSBL) ListedBy(ctx context.Context, addr netip.Addr) []string {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	now := d.params.Now()
-
-	var listedBy []string
-
-	for _, zone := range d.params.Zones {
-		q := query{zone: zone, client: addr}
-
-		kept, found := d.verdicts.Peek(q)
-
-		switch {
-		case found && now.Sub(kept.Fetched) < d.params.CacheTTL:
-			if kept.Listed {
-				listedBy = append(listedBy, config.MaskZoneKey(zone))
-			}
-		case !d.asking[q] && !now.Before(d.retryAt[zone]) && len(d.asking) < maxQueries:
-			d.asking[q] = true
-			d.queries[zone]++
-
-			go d.ask(context.WithoutCancel(ctx), q)
-		}
-	}
-
-	return listedBy
-}
-
-// Queries returns how many queries were made to zone.
-func (d *DNSBL) Queries(zone string) int {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	return d.queries[zone]
-}
-
-// Failures returns how many queries to zone failed.
-func (d *DNSBL) Failures(zone string) int {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	return d.failures[zone]
-}
-
-// Snapshot returns every verdict still in use, sorted by client, then by
-// zone, as reputation.json lists them.
-func (d *DNSBL) Snapshot() []Verdict {
-	d.mu.Lock()
-
-	now := d.params.Now()
-	verdicts := make([]Verdict, 0, d.verdicts.Len())
-
-	for _, kept := range d.verdicts.Values() {
-		if now.Sub(kept.Fetched) < d.params.CacheTTL {
-			verdicts = append(verdicts, kept)
-		}
-	}
-
-	d.mu.Unlock()
-
-	slices.SortFunc(verdicts, func(a, b Verdict) int {
-		return cmp.Or(a.Client.Compare(b.Client), strings.Compare(a.Zone, b.Zone))
-	})
-
-	return verdicts
-}
-
-// Load keeps verdicts, read from reputation.json, in place of those it
-// keeps, but for those of a zone SWWAF_DNSBL_ZONES does not name, and,
-// past maxVerdicts, those fetched longest ago. One fetched CacheTTL ago or
-// more is neither used nor written, as for any verdict.
-func (d *DNSBL) Load(verdicts []Verdict) {
-	verdicts = slices.Clone(verdicts)
-	slices.SortStableFunc(verdicts, func(a, b Verdict) int {
-		return a.Fetched.Compare(b.Fetched)
-	})
-
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	d.verdicts.Purge()
-
-	for _, kept := range verdicts {
-		if slices.Contains(d.params.Zones, kept.Zone) {
-			d.verdicts.Add(query{zone: kept.Zone, client: kept.Client}, kept)
-		}
-	}
-}
-
-// ask asks q's zone about q's client, keeps the verdict, and notes the
-// query as no longer under way. A query that fails gives no verdict: it
-// is counted, logged and raised as a source_failure alert, which show the
-// zone with its key masked, and the zone is not asked again for
-// failureDelay.
-func (d *DNSBL) ask(ctx context.Context, q query) {
-	listed, err := d.lookUp(ctx, q)
-	now := d.params.Now()
-
-	d.mu.Lock()
-
-	delete(d.asking, q)
-
-	if err == nil {
-		d.verdicts.Add(q, Verdict{
-			Zone: q.zone, Client: q.client, Listed: listed, Fetched: now,
-		})
-	} else {
-		d.failures[q.zone]++
-		d.retryAt[q.zone] = now.Add(failureDelay)
-	}
-
-	d.mu.Unlock()
-
-	if err != nil {
-		const failed = "asking a DNSBL zone failed"
-
-		shown := config.MaskZoneKey(q.zone)
-
-		// Raised before it is logged, so that the alert is there once the
-		// log line is.
-		raiseFailure(d.params.Alerts, failed, shown, err)
-		d.params.ProcessLog.Warn(failed, "zone", shown, "error", err.Error())
-	}
-}
-
-// lookUp asks q's zone about q's client through the resolver, and returns
-// whether the zone lists it, as readAnswer reads the answer. No such name
-// is a client the zone does not list. A query not answered within Timeout
-// fails.
-func (d *DNSBL) lookUp(ctx context.Context, q query) (bool, error) {
-	ctx, cancel := context.WithTimeout(ctx, d.params.Timeout)
-	defer cancel()
-
-	answer, err := d.resolver.LookupNetIP(ctx, "ip4", queryName(q.zone, q.client))
-
-	var dnsErr *net.DNSError
-
-	switch {
-	case err == nil:
-		return readAnswer(answer)
-	case errors.As(err, &dnsErr) && dnsErr.IsNotFound:
-		return false, nil
-	case errors.As(err, &dnsErr):
-		// The error names the name asked about, which holds the client's
-		// address, which is not to be logged: only what went wrong is kept.
-		return false, fmt.Errorf("%w: %s", errAsk, dnsErr.Err)
-	default:
-		return false, fmt.Errorf("%w: %w", errAsk, err)
-	}
-}
-
-// queryName returns the name a zone is asked about addr by, as RFC 5782
-// builds it: the four numbers of an IPv4 address, or the 32 hex digits of
-// an IPv6 address, in reverse order, each followed by a dot, then the zone
-// and a dot, which makes it a full name, to which the resolver adds no
-// search domain of /etc/resolv.conf.
-func queryName(zone string, addr netip.Addr) string {
-	parts := strings.Split(addr.String(), ".")
-	if addr.Is6() {
-		parts = strings.Split(hex.EncodeToString(addr.AsSlice()), "")
-	}
-
-	slices.Reverse(parts)
-
-	return strings.Join(parts, ".") + "." + zone + "."
-}
-
-// readAnswer reads the addresses a zone answered with. An address in
-// 127.0.0.0/8 lists the client, as RFC 5782 has zones answer, but one in
-// 127.255.255.0/24 is how Spamhaus refuses a query, such as one sent
-// through a public resolver or one past its limit, and is a failure. So is
-// an address outside 127.0.0.0/8, such as a resolver gives that answers
-// even for names that do not exist.
-func readAnswer(answer []netip.Addr) (bool, error) {
-	listing := netip.MustParsePrefix("127.0.0.0/8")
-	refusal := netip.MustParsePrefix("127.255.255.0/24")
-
-	for _, addr := range answer {
-		switch {
-		case refusal.Contains(addr):
-			return false, fmt.Errorf("%w: %s", errRefused, addr)
-		case !listing.Contains(addr):
-			return false, fmt.Errorf("%w: %s", errNotListing, addr)
-		}
-	}
-
-	return len(answer) > 0, nil
-}

internal/reputation/dnsbl_test.go

@@ -1,737 +0,0 @@
-package reputation_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/binary"
-	"errors"
-	"io"
-	"log/slog"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"reflect"
-	"slices"
-	"strings"
-	"sync"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/metrics"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
-)
-
-// The tests of the DNSBL zones run in synctest bubbles, as those of the
-// lists do, and the resolver the zones are asked through is a stand-in
-// reached through an in-memory connection, net.Pipe's, for the same
-// reason. They run one at a time, none in parallel with another test of
-// this package: Go's resolver counts the queries under way in one
-// sync.WaitGroup for the whole process, and the process fails when
-// queries from two bubbles, or from a bubble and from outside one, are
-// under way at once. TestMain has the resolver make its configuration,
-// which it makes on its first query, outside every bubble, since the
-// configuration holds a channel, which the bubble it was made in would
-// keep to itself.
-
-const (
-	// zone and otherZone are the DNSBL zones the tests name.
-	zone      = "dnsbl.example"
-	otherZone = "other.example"
-	// cacheTTL is the tests' SWWAF_REPUTATION_CACHE_TTL, and timeout their
-	// SWWAF_REPUTATION_TIMEOUT: a second, the least time /etc/resolv.conf
-	// can have Go's resolver wait for one server, so that it is the
-	// DNSBL's own timeout that ends a query, whatever that file says.
-	cacheTTL = 24 * time.Hour
-	timeout  = time.Second
-	// listed and unlisted are clients zone is asked about by the names
-	// listedName and unlistedName, and most tests have zone list the first
-	// alone, by answering with listing.
-	listed       = "192.0.2.99"
-	unlisted     = "192.0.2.100"
-	listedName   = "99.2.0.192." + zone + "."
-	unlistedName = "100.2.0.192." + zone + "."
-	listing      = "127.0.0.2"
-)
-
-// The DNS response codes the stand-in answers with, besides no error.
-const (
-	serverFailure = 2
-	noSuchName    = 3
-	refused       = 5
-)
-
-var errNoNetwork = errors.New("the test dials nothing")
-
-func TestMain(m *testing.M) {
-	// A query that fails at once, as nothing is dialled for it.
-	resolver := &net.Resolver{
-		PreferGo: true,
-		Dial: func(context.Context, string, string) (net.Conn, error) {
-			return nil, errNoNetwork
-		},
-	}
-	_, _ = resolver.LookupNetIP(context.Background(), "ip4", "warm-up.invalid.")
-
-	m.Run()
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestZonesListOrNotClientsByTheirIPv4AndIPv6Addresses(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		// The addresses of the examples of RFC 5782, and the names it
-		// gives for them.
-		const (
-			v4 = "192.0.2.99"
-			v6 = "2001:db8:1:2:3:4:567:89ab"
-			// v6Name is the hex digits of v6, in reverse order.
-			v6Name = "b.a.9.8.7.6.5.0.4.0.0.0.3.0.0.0.2.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2."
-		)
-
-		resolver := &resolverStandIn{answers: map[string]answer{
-			"99.2.0.192." + zone + ".":      {addrs: []string{listing}},
-			v6Name + otherZone + ".":        {addrs: []string{"127.0.0.4", "127.0.0.10"}},
-			"99.2.0.192." + otherZone + ".": {},
-		}}
-		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
-
-		// Neither client has a verdict yet, so neither is listed, and each
-		// zone is asked about each.
-		wantZones(t, dnsbl, v4)
-		wantZones(t, dnsbl, v6)
-		synctest.Wait()
-
-		wantZones(t, dnsbl, v4, zone)
-		wantZones(t, dnsbl, v6, otherZone)
-		wantAsked(t, resolver,
-			"99.2.0.192."+zone+".", "99.2.0.192."+otherZone+".",
-			v6Name+zone+".", v6Name+otherZone+".")
-	})
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestListedByNeverWaitsForAQuery(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, dnsblParams(zone))
-		began := time.Now()
-
-		// The second, while the first's query is under way, starts none.
-		wantZones(t, dnsbl, listed)
-		wantZones(t, dnsbl, listed)
-
-		if waited := time.Since(began); waited != 0 {
-			t.Errorf("waited %s for the query, want no wait", waited)
-		}
-
-		synctest.Wait()
-		wantQueries(t, dnsbl, 1, 0)
-		waitForTheResolver()
-	})
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestVerdictUsedUntilTheCacheTTLHasPassedSinceItWasFetched(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		resolver := &resolverStandIn{answers: map[string]answer{
-			listedName: {addrs: []string{listing}},
-		}}
-		dnsbl := newDNSBL(resolver, dnsblParams(zone))
-
-		wantZones(t, dnsbl, listed)
-		wantZones(t, dnsbl, unlisted)
-		synctest.Wait()
-
-		// The zone lists the other client from now on, but the verdicts
-		// kept are used, and the zone is not asked again, until the TTL
-		// has passed.
-		resolver.set(listedName, answer{rcode: noSuchName})
-		resolver.set(unlistedName, answer{addrs: []string{listing}})
-		time.Sleep(cacheTTL - time.Nanosecond)
-
-		wantZones(t, dnsbl, listed, zone)
-		wantZones(t, dnsbl, unlisted)
-		synctest.Wait()
-		wantQueries(t, dnsbl, 2, 0)
-
-		// Then neither verdict is used, and both clients are asked about
-		// again.
-		time.Sleep(time.Nanosecond)
-		wantZones(t, dnsbl, listed)
-		wantZones(t, dnsbl, unlisted)
-		synctest.Wait()
-
-		wantQueries(t, dnsbl, 4, 0)
-		wantZones(t, dnsbl, listed)
-		wantZones(t, dnsbl, unlisted, zone)
-	})
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestQueryNotAnsweredWithinTheTimeoutFails(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		queue := newQueue()
-		p := dnsblParams(zone)
-		p.Alerts = queue
-		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, p)
-
-		wantZones(t, dnsbl, listed)
-		time.Sleep(timeout - time.Nanosecond)
-		synctest.Wait()
-		wantQueries(t, dnsbl, 1, 0)
-
-		time.Sleep(time.Nanosecond)
-		synctest.Wait()
-		wantQueries(t, dnsbl, 1, 1)
-
-		if got := waiting(queue); len(got) != 1 ||
-			got[0].Detail["error"] != "ask the zone: i/o timeout" {
-			t.Errorf("alerts waiting %+v, want the timeout's", got)
-		}
-
-		if verdicts := dnsbl.Snapshot(); len(verdicts) != 0 {
-			t.Errorf("verdicts %+v, want none", verdicts)
-		}
-
-		waitForTheResolver()
-	})
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestZoneThatFailsOrRefusesGivesNoVerdictAndIsLeftAloneForAMinute(t *testing.T) {
-	for _, tc := range []struct {
-		name   string
-		answer answer
-		error  string
-	}{
-		{
-			"a server failure", answer{rcode: serverFailure},
-			"ask the zone: server misbehaving",
-		},
-		{"a refusal", answer{rcode: refused}, "ask the zone: server misbehaving"},
-		{
-			"an answer in 127.255.255.0/24, with which Spamhaus refuses a query",
-			answer{addrs: []string{"127.255.255.254"}},
-			"the zone refused the query: 127.255.255.254",
-		},
-		{
-			"an answer outside 127.0.0.0/8, as for a name that does not exist",
-			answer{addrs: []string{"192.0.2.1"}},
-			"the answer is outside 127.0.0.0/8: 192.0.2.1",
-		},
-	} {
-		//nolint:paralleltest // one at a time, as the comment at the top of this file says
-		t.Run(tc.name, func(t *testing.T) {
-			synctest.Test(t, func(t *testing.T) {
-				var log bytes.Buffer
-
-				queue := newQueue()
-				p := dnsblParams(zone)
-				p.Alerts = queue
-				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-				dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
-					listedName: tc.answer,
-				}}, p)
-
-				// The failure gives no verdict, and the zone is not asked
-				// again within a minute of it.
-				wantZones(t, dnsbl, listed)
-				synctest.Wait()
-				time.Sleep(time.Minute - time.Nanosecond)
-				wantZones(t, dnsbl, listed)
-				synctest.Wait()
-				wantQueries(t, dnsbl, 1, 1)
-
-				time.Sleep(time.Nanosecond)
-				wantZones(t, dnsbl, listed)
-				synctest.Wait()
-				wantQueries(t, dnsbl, 2, 2)
-
-				if verdicts := dnsbl.Snapshot(); len(verdicts) != 0 {
-					t.Errorf("verdicts %+v, want none", verdicts)
-				}
-
-				// One alert for the first failure; the cooldown holds back
-				// the second.
-				wantAlert(t, queue, alerts.Alert{
-					Time:   time.Now().Add(-time.Minute),
-					Event:  alerts.EventSourceFailure,
-					Reason: "asking a DNSBL zone failed",
-					Detail: map[string]any{"source": zone, "error": tc.error},
-				})
-
-				if !strings.Contains(log.String(), `"msg":"asking a DNSBL zone failed",`+
-					`"zone":"`+zone+`","error":"`+tc.error) {
-					t.Errorf("logged\n%s\nwant the failures", log.String())
-				}
-			})
-		})
-	}
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestAtMost1000QueriesUnderWay(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		dnsbl := newDNSBL(&resolverStandIn{hanging: true}, dnsblParams(zone))
-
-		client := netip.MustParseAddr("198.18.0.0")
-		for range 1001 {
-			dnsbl.ListedBy(t.Context(), client)
-			client = client.Next()
-		}
-
-		synctest.Wait()
-		wantQueries(t, dnsbl, 1000, 0)
-		waitForTheResolver()
-	})
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestMetricsCountEachZonesQueriesAndThoseThatFailed(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		resolver := &resolverStandIn{answers: map[string]answer{
-			listedName:                      {addrs: []string{listing}},
-			"99.2.0.192." + otherZone + ".": {rcode: serverFailure},
-		}}
-		dnsbl := newDNSBL(resolver, dnsblParams(zone, otherZone))
-		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), dnsbl)
-
-		wantZones(t, dnsbl, listed)
-		synctest.Wait()
-
-		scraped := httptest.NewRecorder()
-		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
-			"/", http.NoBody))
-
-		for series, want := range map[string]string{
-			"queries_total" + `{instance="app",source="` + zone + `"}`:       "1",
-			"failures_total" + `{instance="app",source="` + zone + `"}`:      "0",
-			"queries_total" + `{instance="app",source="` + otherZone + `"}`:  "1",
-			"failures_total" + `{instance="app",source="` + otherZone + `"}`: "1",
-		} {
-			line := "\nsmallwebwaf_reputation_" + series + " " + want + "\n"
-			if !strings.Contains(scraped.Body.String(), line) {
-				t.Errorf("metrics\n%s\nwant%s", scraped.Body.String(), line)
-			}
-		}
-	})
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestZoneKeyIsMaskedInTheVerdictsTheFailuresAndTheMetrics(t *testing.T) {
-	const (
-		key    = "abcdefghijklmnopqrstuvwxyz"
-		keyed  = key + ".xbl.dq.spamhaus.net"
-		masked = "********.xbl.dq.spamhaus.net"
-	)
-
-	synctest.Test(t, func(t *testing.T) {
-		var log bytes.Buffer
-
-		queue := newQueue()
-		p := dnsblParams(keyed)
-		p.Alerts = queue
-		p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-		dnsbl := newDNSBL(&resolverStandIn{answers: map[string]answer{
-			"99.2.0.192." + keyed + ".":  {addrs: []string{listing}},
-			"100.2.0.192." + keyed + ".": {rcode: serverFailure},
-		}}, p)
-		m := metrics.New(1, "app")
-		m.AddReputation(reputation.New(params()), dnsbl)
-
-		// Both clients are asked about before either answer comes, so that
-		// the failure does not keep the zone from the other query.
-		wantZones(t, dnsbl, listed)
-		wantZones(t, dnsbl, unlisted)
-		synctest.Wait()
-		wantZones(t, dnsbl, listed, masked)
-
-		if got := waiting(queue); len(got) != 1 || got[0].Detail["source"] != masked {
-			t.Errorf("alerts waiting %+v, want the failure's, from %s", got, masked)
-		}
-
-		scraped := httptest.NewRecorder()
-		m.ServeHTTP(scraped, httptest.NewRequestWithContext(t.Context(), http.MethodGet,
-			"/", http.NoBody))
-
-		for name, shown := range map[string]string{
-			"the log": log.String(), "the metrics": scraped.Body.String(),
-		} {
-			if strings.Contains(shown, key) || !strings.Contains(shown, masked) {
-				t.Errorf("%s shows the key, or does not name the zone:\n%s", name, shown)
-			}
-		}
-	})
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestVerdictsKeptAcrossARestart(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		resolver := &resolverStandIn{answers: map[string]answer{
-			listedName: {addrs: []string{listing}},
-		}}
-		dnsbl := newDNSBL(resolver, dnsblParams(zone))
-		fetched := time.Now()
-
-		wantZones(t, dnsbl, unlisted)
-		wantZones(t, dnsbl, listed)
-		synctest.Wait()
-
-		kept := dnsbl.Snapshot()
-
-		want := []reputation.Verdict{
-			{Zone: zone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: fetched},
-			{Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: fetched},
-		}
-		if !reflect.DeepEqual(kept, want) {
-			t.Errorf("verdicts %+v, want %+v", kept, want)
-		}
-
-		// Restarted an hour later with what reputation.json keeps, it uses
-		// the verdicts, and asks the zone nothing, until the TTL has passed
-		// since they were fetched.
-		time.Sleep(time.Hour)
-
-		restarted := &resolverStandIn{}
-		again := newDNSBL(restarted, dnsblParams(zone))
-		again.Load(kept)
-
-		wantZones(t, again, listed, zone)
-		wantZones(t, again, unlisted)
-		synctest.Wait()
-		wantAsked(t, restarted)
-
-		time.Sleep(cacheTTL - time.Hour)
-		wantZones(t, again, listed)
-		synctest.Wait()
-		wantAsked(t, restarted, listedName)
-	})
-}
-
-func TestNeitherAVerdictOfAZoneNotNamedNorOnePastItsTTLIsKept(t *testing.T) {
-	t.Parallel()
-
-	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
-	p := dnsblParams(zone)
-	p.Now = func() time.Time { return now }
-	dnsbl := reputation.NewDNSBL(p)
-
-	// The last verdict still in use, one fetched a TTL ago, and one of a
-	// zone SWWAF_DNSBL_ZONES does not name.
-	inUse := reputation.Verdict{
-		Zone: zone, Client: netip.MustParseAddr(listed), Listed: true,
-		Fetched: now.Add(-cacheTTL + time.Nanosecond),
-	}
-	stale := reputation.Verdict{
-		Zone: zone, Client: netip.MustParseAddr(unlisted), Fetched: now.Add(-cacheTTL),
-	}
-	notNamed := reputation.Verdict{
-		Zone: otherZone, Client: netip.MustParseAddr(listed), Listed: true, Fetched: now,
-	}
-
-	dnsbl.Load([]reputation.Verdict{notNamed, stale, inUse})
-
-	if got := dnsbl.Snapshot(); !reflect.DeepEqual(got, []reputation.Verdict{inUse}) {
-		t.Errorf("verdicts %+v, want only %+v", got, inUse)
-	}
-}
-
-func TestAtMost100000VerdictsKeptTheOneFetchedLongestAgoDroppedFirst(t *testing.T) {
-	t.Parallel()
-
-	now := time.Date(2026, 10, 7, 0, 0, 0, 0, time.UTC)
-	p := dnsblParams(zone)
-	p.Now = func() time.Time { return now }
-	dnsbl := reputation.NewDNSBL(p)
-
-	// 100,001 verdicts, listed by client, as reputation.json lists them,
-	// each fetched a millisecond before the one before it: the last is one
-	// too many.
-	const count = 100001
-
-	verdicts := make([]reputation.Verdict, 0, count)
-
-	client := netip.MustParseAddr("198.18.0.0")
-	for i := range count {
-		verdicts = append(verdicts, reputation.Verdict{
-			Zone: zone, Client: client, Fetched: now.Add(-time.Duration(i) * time.Millisecond),
-		})
-		client = client.Next()
-	}
-
-	dnsbl.Load(verdicts)
-
-	got := dnsbl.Snapshot()
-	if len(got) != count-1 || !slices.Contains(got, verdicts[0]) ||
-		slices.Contains(got, verdicts[count-1]) {
-		t.Errorf("%d verdicts kept, want all but the one fetched longest ago", len(got))
-	}
-}
-
-//nolint:paralleltest // one at a time, as the comment at the top of this file says
-func TestQueriesGoToTheResolverSWWAFDNSBLResolverNames(t *testing.T) {
-	resolver := &resolverStandIn{answers: map[string]answer{
-		listedName: {addrs: []string{listing}},
-	}}
-
-	conn, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	served := make(chan struct{})
-
-	go func() {
-		resolver.serveUDP(conn)
-		close(served)
-	}()
-
-	t.Cleanup(func() {
-		_ = conn.Close()
-
-		<-served
-	})
-
-	p := dnsblParams(zone)
-	p.Resolver = netip.MustParseAddrPort(conn.LocalAddr().String())
-	// On the real clock: the stand-in answers at once, so only a test
-	// process held up for a whole minute would see the query fail.
-	p.Timeout = time.Minute
-
-	isListed, err := reputation.NewDNSBL(p).LookUp(zone, netip.MustParseAddr(listed))
-	if err != nil || !isListed {
-		t.Errorf("listed %t (%v), want true", isListed, err)
-	}
-
-	wantAsked(t, resolver, listedName)
-}
-
-// resolverStandIn is a stand-in for the resolver the zones are asked
-// through. It answers each query by the name asked about, as answers
-// gives, with no such name for a name answers does not give, and not at
-// all while hanging. It notes each name asked about.
-type resolverStandIn struct {
-	mu      sync.Mutex
-	answers map[string]answer
-	hanging bool
-	names   []string
-}
-
-// answer is how the stand-in answers a name: with an A record of each of
-// addrs, or with the response code rcode, unless it is 0, for no error.
-type answer struct {
-	addrs []string
-	rcode uint16
-}
-
-// What the stand-in reads of a query, and writes in its reply.
-const (
-	// headerLength is the length of a DNS message's header, which the
-	// question follows: its id, its flags, and how many questions,
-	// answers and other records it holds, two bytes each.
-	headerLength = 12
-	// typeAndClass is the length of the type and the class that end a
-	// question, after its name.
-	typeAndClass = 4
-	// replyFlags mark a reply to a query that asked for recursion, which
-	// is available, with no error. The response code goes in their last
-	// four bits.
-	replyFlags = 0x8180
-	// maxMessage is the longest query read over UDP.
-	maxMessage = 1232
-)
-
-// set has the stand-in answer name with given.
-func (s *resolverStandIn) set(name string, given answer) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	s.answers[name] = given
-}
-
-// dial connects Go's resolver to the stand-in through an in-memory
-// connection, on which it sends each query, and reads each reply, after
-// its length, as over TCP.
-func (s *resolverStandIn) dial(context.Context, string, string) (net.Conn, error) {
-	client, server := net.Pipe()
-
-	go s.serve(server)
-
-	return client, nil
-}
-
-// serve answers the queries that come on conn until the resolver closes
-// it.
-func (s *resolverStandIn) serve(conn net.Conn) {
-	defer func() {
-		_ = conn.Close()
-	}()
-
-	for {
-		var length [2]byte
-
-		_, err := io.ReadFull(conn, length[:])
-		if err != nil {
-			return
-		}
-
-		message := make([]byte, binary.BigEndian.Uint16(length[:]))
-
-		_, err = io.ReadFull(conn, message)
-		if err != nil {
-			return
-		}
-
-		reply, answered := s.reply(message)
-		if !answered {
-			continue // the resolver gives up, and closes conn
-		}
-
-		//nolint:gosec // a reply of a few dozen bytes
-		_, err = conn.Write(append(binary.BigEndian.AppendUint16(nil, uint16(len(reply))),
-			reply...))
-		if err != nil {
-			return
-		}
-	}
-}
-
-// serveUDP answers the queries that come on conn, each in a datagram, as
-// a resolver does, until conn is closed.
-func (s *resolverStandIn) serveUDP(conn net.PacketConn) {
-	message := make([]byte, maxMessage)
-
-	for {
-		n, from, err := conn.ReadFrom(message)
-		if err != nil {
-			return
-		}
-
-		reply, answered := s.reply(message[:n])
-		if answered {
-			_, _ = conn.WriteTo(reply, from)
-		}
-	}
-}
-
-// reply returns the stand-in's reply to message, a query, and false for
-// none, while it hangs. It notes the name asked about.
-func (s *resolverStandIn) reply(message []byte) ([]byte, bool) {
-	// The name is labels, each after its length, ended by a length of 0.
-	var labels []string
-
-	end := headerLength
-	for message[end] != 0 {
-		length := int(message[end])
-		labels = append(labels, string(message[end+1:end+1+length]))
-		end += 1 + length
-	}
-
-	end += 1 + typeAndClass
-	name := strings.Join(labels, ".") + "."
-
-	s.mu.Lock()
-	s.names = append(s.names, name)
-	given, found := s.answers[name]
-	hanging := s.hanging
-	s.mu.Unlock()
-
-	if hanging {
-		return nil, false
-	}
-
-	if !found {
-		given = answer{rcode: noSuchName}
-	}
-
-	// The query's id, the flags, one question, the answers, and no other
-	// records, then the question, as asked.
-	reply := slices.Clone(message[:2])
-	reply = binary.BigEndian.AppendUint16(reply, replyFlags|given.rcode)
-	reply = binary.BigEndian.AppendUint16(reply, 1)
-	//nolint:gosec // a handful of answers
-	reply = binary.BigEndian.AppendUint16(reply, uint16(len(given.addrs)))
-	reply = append(reply, 0, 0, 0, 0)
-	reply = append(reply, message[headerLength:end]...)
-
-	// An A record starts with the name asked about, by a pointer to it in
-	// the question, then its type, A, its class, IN, how long it may be
-	// kept, 60 seconds, and the length of its address, 4 bytes.
-	record := []byte{0xc0, headerLength, 0, 1, 0, 1, 0, 0, 0, 60, 0, 4}
-
-	for _, addr := range given.addrs {
-		reply = append(reply, record...)
-		reply = append(reply, netip.MustParseAddr(addr).AsSlice()...)
-	}
-
-	return reply, true
-}
-
-// dnsblParams returns the DNSBLParams of zones, with the tests' cache TTL
-// and timeout, by the bubble's clock, with alerts to a queue that sends
-// none.
-func dnsblParams(zones ...string) reputation.DNSBLParams {
-	return reputation.DNSBLParams{
-		Zones:      zones,
-		CacheTTL:   cacheTTL,
-		Timeout:    timeout,
-		Now:        time.Now,
-		ProcessLog: slog.New(slog.DiscardHandler),
-		Alerts:     newQueue(),
-	}
-}
-
-// waitForTheResolver waits, on the bubble's clock, an hour, until Go's
-// resolver has given up on every stand-in that does not answer: it waits
-// for a server as long as /etc/resolv.conf has it wait, a few seconds,
-// even after the query was given up, and a bubble cannot end before it.
-func waitForTheResolver() {
-	time.Sleep(time.Hour)
-}
-
-// newDNSBL returns the DNSBL of p, asking resolver.
-func newDNSBL(resolver *resolverStandIn, p reputation.DNSBLParams) *reputation.DNSBL {
-	dnsbl := reputation.NewDNSBL(p)
-	dnsbl.SetDial(resolver.dial)
-
-	return dnsbl
-}
-
-// wantZones checks the zones whose verdict dnsbl says lists client, as a
-// request from client finds them.
-func wantZones(t *testing.T, dnsbl *reputation.DNSBL, client string, want ...string) {
-	t.Helper()
-
-	got := dnsbl.ListedBy(t.Context(), netip.MustParseAddr(client))
-	if !slices.Equal(got, want) {
-		t.Errorf("%s is listed by %v, want %v", client, got, want)
-	}
-}
-
-// wantQueries checks how many queries dnsbl made to zone, and how many of
-// them failed.
-func wantQueries(t *testing.T, dnsbl *reputation.DNSBL, queries, failures int) {
-	t.Helper()
-
-	if dnsbl.Queries(zone) != queries || dnsbl.Failures(zone) != failures {
-		t.Errorf("%d queries and %d failures, want %d and %d", dnsbl.Queries(zone),
-			dnsbl.Failures(zone), queries, failures)
-	}
-}
-
-// wantAsked checks the names the stand-in was asked about, in any order.
-func wantAsked(t *testing.T, resolver *resolverStandIn, want ...string) {
-	t.Helper()
-
-	resolver.mu.Lock()
-	got := slices.Sorted(slices.Values(resolver.names))
-	resolver.mu.Unlock()
-
-	slices.Sort(want)
-
-	if !slices.Equal(got, want) {
-		t.Errorf("asked about %v, want %v", got, want)
-	}
-}

internal/reputation/export_test.go

@@ -1,33 +0,0 @@
-package reputation
-
-import (
-	"context"
-	"net"
-	"net/http"
-	"net/netip"
-)
-
-// SetTransport has l's fetches go through transport instead of the
-// network.
-func (l *Lists) SetTransport(transport http.RoundTripper) {
-	l.httpClient.Transport = transport
-}
-
-// SetTransport has a's checks go through transport instead of the
-// network.
-func (a *AbuseIPDB) SetTransport(transport http.RoundTripper) {
-	a.httpClient.Transport = transport
-}
-
-// SetDial has d's queries go through dial instead of the network.
-func (d *DNSBL) SetDial(
-	dial func(ctx context.Context, network, address string) (net.Conn, error),
-) {
-	d.resolver = &net.Resolver{PreferGo: true, Dial: dial}
-}
-
-// LookUp asks zone about addr at once, as a query in the background does,
-// and returns whether zone lists addr.
-func (d *DNSBL) LookUp(zone string, addr netip.Addr) (bool, error) {
-	return d.lookUp(context.Background(), query{zone: zone, client: addr})
-}

internal/reputation/reputation.go

@@ -1,509 +0,0 @@
-// Package reputation fetches the lists the settings name by URL: the
-// blocklists of SWWAF_BLOCKLIST_URLS, and the file of AS:percent lines
-// SWWAF_ASN_LIMIT_PERCENT_URL names. It keeps the last good copy of each,
-// whole, comment lines included, which is used while a fetch fails, and
-// when each was last tried. It also asks the DNSBL zones of
-// SWWAF_DNSBL_ZONES about clients, and keeps their verdicts, and checks
-// clients with AbuseIPDB, and keeps their scores and the checks spent
-// today. The state package writes all of these to reputation.json and
-// reads them from it, so that a restart keeps them too.
-package reputation
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/netip"
-	"slices"
-	"strings"
-	"sync"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/config"
-)
-
-const (
-	// maxListBytes is the most of a list that is read. A longer one is a
-	// failure, so that a wrong URL cannot fill the memory.
-	maxListBytes = 16 << 20
-	// fetchTimeout bounds one fetch of a list.
-	fetchTimeout = time.Minute
-	// mappedBits is the length of ::ffff:0.0.0.0/96, the netblock of every
-	// IPv4-mapped address.
-	mappedBits = 96
-)
-
-var (
-	errStatus        = errors.New("the server answered")
-	errTooLong       = errors.New("the list is longer than 16 MiB")
-	errNotNetblock   = errors.New("is not an address or a netblock, such as 192.0.2.0/24")
-	errNotASNPercent = errors.New(
-		"is not an AS number, : and a percentage, such as AS64496:50")
-)
-
-// List is a list as reputation.json holds it: the URL it is fetched from,
-// when it was last tried, the fetch failed or not, and its last good copy:
-// when that was fetched, and its lines, as fetched, comment lines
-// included, both left out while no fetch of it has succeeded.
-type List struct {
-	URL     string    `json:"url"`
-	Tried   time.Time `json:"tried"`
-	Fetched time.Time `json:"fetched,omitzero"`
-	Lines   []string  `json:"lines,omitzero"`
-}
-
-// Params are what New needs.
-type Params struct {
-	// BlocklistURLs are the blocklists (SWWAF_BLOCKLIST_URLS), and
-	// ASNLimitPercentURL the file of AS:percent lines
-	// (SWWAF_ASN_LIMIT_PERCENT_URL), "" while it is unset.
-	BlocklistURLs      []string
-	ASNLimitPercentURL string
-	// Refresh is how long after a list was last fetched or tried it is
-	// fetched again (SWWAF_BLOCKLIST_REFRESH).
-	Refresh time.Duration
-	// Now tells the time, normally time.Now in UTC.
-	Now func() time.Time
-	// ProcessLog receives each fetch of a list, and why one failed.
-	ProcessLog *slog.Logger
-	// Alerts receive a source_failure alert for each fetch that fails.
-	Alerts *alerts.Queue
-}
-
-// Lists are the lists Params names, each with its last good copy. They
-// are safe for concurrent use.
-type Lists struct {
-	params     Params
-	httpClient *http.Client
-
-	mu sync.Mutex
-	// lists are by URL, one for each URL Params names.
-	lists map[string]*list
-}
-
-// list is one list: what reputation.json keeps of it, its last try, zero
-// before the first, and its last good copy, what that copy says, and how
-// many fetches of it failed.
-type list struct {
-	kept     List
-	entries  entries
-	failures int
-}
-
-// entries are what the lines of a copy say: for a blocklist, the netblocks
-// it names, with the lengths among them, and for the file of AS:percent
-// lines, the percentage it gives each AS number.
-type entries struct {
-	netblocks map[netip.Prefix]bool
-	lengths   []int
-	percents  map[string]int64
-}
-
-// New returns the lists, without a copy of any yet.
-func New(params Params) *Lists {
-	l := &Lists{params: params, httpClient: &http.Client{}, lists: map[string]*list{}}
-
-	for _, listURL := range l.URLs() {
-		l.lists[listURL] = &list{kept: List{URL: listURL}}
-	}
-
-	return l
-}
-
-// URLs returns the URL of every list: the blocklists' in the order
-// SWWAF_BLOCKLIST_URLS names them, then SWWAF_ASN_LIMIT_PERCENT_URL.
-func (l *Lists) URLs() []string {
-	urls := slices.Clone(l.params.BlocklistURLs)
-	if l.params.ASNLimitPercentURL != "" {
-		urls = append(urls, l.params.ASNLimitPercentURL)
-	}
-
-	return urls
-}
-
-// ListedBy returns the URLs of the blocklists whose copy lists addr, in
-// the order SWWAF_BLOCKLIST_URLS names them.
-func (l *Lists) ListedBy(addr netip.Addr) []string {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	var listedBy []string
-
-	for _, listURL := range l.params.BlocklistURLs {
-		if l.lists[listURL].entries.contain(addr) {
-			listedBy = append(listedBy, listURL)
-		}
-	}
-
-	return listedBy
-}
-
-// ASNLimitPercent returns the percentage the copy of the file of
-// AS:percent lines gives asn, and whether it lists asn.
-func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
-	if l.params.ASNLimitPercentURL == "" {
-		return 0, false
-	}
-
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	percent, listed := l.lists[l.params.ASNLimitPercentURL].entries.percents[asn]
-
-	return percent, listed
-}
-
-// Fetched returns when the copy in use of the list at listURL was
-// fetched, or zero while there is none.
-func (l *Lists) Fetched(listURL string) time.Time {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	return l.lists[listURL].kept.Fetched
-}
-
-// Failures returns how many fetches of the list at listURL failed.
-func (l *Lists) Failures(listURL string) int {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	return l.lists[listURL].failures
-}
-
-// Run fetches each list once Refresh has passed since it was last fetched
-// or tried, the later of the two, until ctx is done. A list never tried is
-// fetched at once, and so is one whose last try or copy, read from
-// reputation.json, is that old.
-func (l *Lists) Run(ctx context.Context) {
-	if len(l.lists) == 0 {
-		return
-	}
-
-	for ctx.Err() == nil {
-		next := l.fetchDue(ctx)
-		timer := time.NewTimer(next.Sub(l.params.Now()))
-
-		select {
-		case <-ctx.Done():
-		case <-timer.C:
-		}
-
-		timer.Stop()
-	}
-}
-
-// Snapshot returns each list that has been tried, with its copy, if it
-// has one, sorted by URL, as reputation.json lists them.
-func (l *Lists) Snapshot() []List {
-	l.mu.Lock()
-
-	tried := make([]List, 0, len(l.lists))
-
-	for _, held := range l.lists {
-		if !held.kept.Tried.IsZero() {
-			tried = append(tried, held.kept)
-		}
-	}
-
-	l.mu.Unlock()
-
-	slices.SortFunc(tried, func(a, b List) int {
-		return strings.Compare(a.URL, b.URL)
-	})
-
-	return tried
-}
-
-// Load puts lists, read from reputation.json, in place of the last tries
-// and copies held. A list Params does not name is dropped. A copy with a
-// line that parse refuses is an error, and then nothing changes.
-func (l *Lists) Load(lists []List) error {
-	found := make(map[string]entries, len(lists))
-
-	for _, kept := range lists {
-		if _, named := l.lists[kept.URL]; !named {
-			continue
-		}
-
-		read, err := l.parse(kept.URL, kept.Lines)
-		if err != nil {
-			return fmt.Errorf("the copy of %s: %w", kept.URL, err)
-		}
-
-		found[kept.URL] = read
-	}
-
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	for listURL, held := range l.lists {
-		held.kept, held.entries = List{URL: listURL}, entries{}
-	}
-
-	for _, kept := range lists {
-		read, named := found[kept.URL]
-		if named {
-			l.lists[kept.URL].kept, l.lists[kept.URL].entries = kept, read
-		}
-	}
-
-	return nil
-}
-
-// fetchDue fetches each list that is due, one after another, and returns
-// when the next is due. Once ctx has ended, it starts none, since a fetch
-// cut off is noted as a try.
-func (l *Lists) fetchDue(ctx context.Context) time.Time {
-	var next time.Time
-
-	for _, listURL := range l.URLs() {
-		due := l.due(listURL)
-		if ctx.Err() == nil && !l.params.Now().Before(due) {
-			l.fetch(ctx, listURL)
-			due = l.due(listURL)
-		}
-
-		if next.IsZero() || due.Before(next) {
-			next = due
-		}
-	}
-
-	return next
-}
-
-// due returns when the list at listURL is to be fetched: Refresh after it
-// was last fetched or tried, the later of the two.
-func (l *Lists) due(listURL string) time.Time {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	held := l.lists[listURL]
-
-	last := held.kept.Fetched
-	if held.kept.Tried.After(last) {
-		last = held.kept.Tried
-	}
-
-	return last.Add(l.params.Refresh)
-}
-
-// fetch fetches the list at listURL, and notes the try. A good copy takes
-// the place of the one held. A failure leaves that in use, and is counted,
-// logged and raised as a source_failure alert. A fetch cut off as ctx
-// ends, as smallwebwaf stops, is no failure, but is still noted as a try,
-// so that a restart waits for it: the server may have had its request.
-func (l *Lists) fetch(ctx context.Context, listURL string) {
-	lines, err := l.get(ctx, listURL)
-
-	var found entries
-	if err == nil {
-		found, err = l.parse(listURL, lines)
-	}
-
-	cutOff := err != nil && ctx.Err() != nil
-	now := l.params.Now()
-
-	l.mu.Lock()
-
-	held := l.lists[listURL]
-	held.kept.Tried = now
-
-	if err == nil {
-		held.kept.Fetched, held.kept.Lines = now, lines
-		held.entries = found
-	} else if !cutOff {
-		held.failures++
-	}
-
-	l.mu.Unlock()
-
-	if cutOff {
-		return
-	}
-
-	if err != nil {
-		const failed = "fetching a list failed"
-
-		// Raised before it is logged, so that the alert is there once the
-		// log line is.
-		raiseFailure(l.params.Alerts, failed, listURL, err)
-		l.params.ProcessLog.Warn(failed, "url", listURL, "error", err.Error())
-
-		return
-	}
-
-	l.params.ProcessLog.Info("fetched a list", "url", listURL, "lines", len(lines))
-}
-
-// raiseFailure raises a source_failure alert into queue, with reason, and
-// in its detail the source that failed, a list's URL, a zone with its key
-// masked or abuseipdb, and err.
-func raiseFailure(queue *alerts.Queue, reason, source string, err error) {
-	queue.Raise(alerts.Alert{
-		Event:  alerts.EventSourceFailure,
-		Reason: reason,
-		Detail: map[string]any{"source": source, "error": err.Error()},
-	})
-}
-
-// get fetches the list at listURL, and returns its lines. An answer other
-// than 200, or a list longer than maxListBytes, is a failure.
-func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
-	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
-	defer cancel()
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, listURL, http.NoBody)
-	if err != nil {
-		return nil, fmt.Errorf("make the request: %w", err)
-	}
-
-	res, err := l.httpClient.Do(req)
-	if err != nil {
-		// Do's error names the URL, which the log line and the alert name
-		// already: only what went wrong is kept.
-		return nil, fmt.Errorf("fetch the list: %w", errors.Unwrap(err))
-	}
-
-	defer func() {
-		_ = res.Body.Close()
-	}()
-
-	if res.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("%w %s", errStatus, res.Status)
-	}
-
-	body, err := io.ReadAll(io.LimitReader(res.Body, maxListBytes+1))
-	if err != nil {
-		return nil, fmt.Errorf("read the list: %w", err)
-	}
-
-	if len(body) > maxListBytes {
-		return nil, errTooLong
-	}
-
-	lines := []string{}
-	for line := range strings.Lines(string(body)) {
-		lines = append(lines, strings.TrimSuffix(line, "\n"))
-	}
-
-	return lines, nil
-}
-
-// parse reads the lines of the list at listURL: those of a blocklist, or
-// of the file of AS:percent lines. Anything after a ; or a # on a line is
-// left out, and so is a line left blank. Any other line that does not read
-// is an error naming it by its number.
-func (l *Lists) parse(listURL string, lines []string) (entries, error) {
-	if listURL == l.params.ASNLimitPercentURL {
-		return parsePercents(lines)
-	}
-
-	return parseNetblocks(lines)
-}
-
-// parseNetblocks reads a blocklist's lines, each an address or a netblock
-// as the settings take them.
-func parseNetblocks(lines []string) (entries, error) {
-	found := entries{netblocks: map[netip.Prefix]bool{}}
-
-	for i, line := range lines {
-		text := withoutComment(line)
-		if text == "" {
-			continue
-		}
-
-		netblock, ok := parseNetblock(text)
-		if !ok {
-			return entries{}, fmt.Errorf("line %d %w", i+1, errNotNetblock)
-		}
-
-		found.netblocks[netblock] = true
-
-		if !slices.Contains(found.lengths, netblock.Bits()) {
-			found.lengths = append(found.lengths, netblock.Bits())
-		}
-	}
-
-	return found, nil
-}
-
-// parseNetblock reads text, a line of a blocklist, and reports whether it
-// is an address or a netblock as the settings take them. A client's IPv4
-// address is checked as IPv4, never IPv4-mapped, so an IPv4-mapped line,
-// such as ::ffff:192.0.2.0/120, is read as the IPv4 address or netblock it
-// stands for, 192.0.2.0/24, and a mapped netblock shorter than /96, which
-// stands for none, is refused.
-func parseNetblock(text string) (netip.Prefix, bool) {
-	netblock, err := config.ParseNetblock(text)
-	if err != nil {
-		return netip.Prefix{}, false
-	}
-
-	// The address as written: ParseNetblock's has the bits past the
-	// netblock's length cleared, the ::ffff among them below /96.
-	written, _, _ := strings.Cut(text, "/")
-	if addr, _ := netip.ParseAddr(written); !addr.Is4In6() {
-		return netblock, true
-	}
-
-	if netblock.Bits() < mappedBits {
-		return netip.Prefix{}, false
-	}
-
-	return netip.PrefixFrom(netblock.Addr().Unmap(), netblock.Bits()-mappedBits), true
-}
-
-// parsePercents reads the lines of the file of AS:percent lines, each an
-// AS number, : and a percentage, as SWWAF_ASN_LIMIT_PERCENT takes them. An
-// AS number listed more than once gets the lowest of its percentages.
-func parsePercents(lines []string) (entries, error) {
-	found := entries{percents: map[string]int64{}}
-
-	for i, line := range lines {
-		text := withoutComment(line)
-		if text == "" {
-			continue
-		}
-
-		asnText, percentText, _ := strings.Cut(text, ":")
-		asn, asnErr := config.ParseASN(asnText)
-
-		percent, percentErr := config.ParsePercent(percentText)
-		if asnErr != nil || percentErr != nil {
-			return entries{}, fmt.Errorf("line %d %w", i+1, errNotASNPercent)
-		}
-
-		earlier, listed := found.percents[asn]
-		if !listed || percent < earlier {
-			found.percents[asn] = percent
-		}
-	}
-
-	return found, nil
-}
-
-// withoutComment returns line without anything after a ; or a #, and
-// without the spaces around what is left.
-func withoutComment(line string) string {
-	text, _, _ := strings.Cut(line, ";")
-	text, _, _ = strings.Cut(text, "#")
-
-	return strings.TrimSpace(text)
-}
-
-// contain reports whether the netblocks of a blocklist's copy hold addr:
-// whether addr, cut to one of their lengths, is one of them.
-func (e entries) contain(addr netip.Addr) bool {
-	for _, length := range e.lengths {
-		netblock, err := addr.Prefix(length)
-		if err == nil && e.netblocks[netblock] {
-			return true
-		}
-	}
-
-	return false
-}

internal/reputation/reputation_test.go

@@ -1,610 +0,0 @@
-package reputation_test
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"reflect"
-	"slices"
-	"strings"
-	"sync"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
-)
-
-// The tests run in a synctest bubble, where the time package runs on a
-// clock of the test's own: time.Sleep moves it on at once, and
-// synctest.Wait returns once Run waits for the next list to be due, so
-// that every fetch due by then has been made. The stand-in for the
-// servers the lists are fetched from answers without the network, since a
-// fetch waiting on the network would keep that clock from moving on.
-
-const (
-	// dropURL and torURL are the blocklists, and asnURL the file of
-	// AS:percent lines.
-	dropURL = "https://lists.example/drop.txt"
-	torURL  = "https://lists.example/tor.txt"
-	asnURL  = "https://lists.example/asn.txt"
-	// refresh is the tests' SWWAF_BLOCKLIST_REFRESH, and cooldown their
-	// SWWAF_ALERT_COOLDOWN, longer than it.
-	refresh  = 24 * time.Hour
-	cooldown = 48 * time.Hour
-	// drop is a blocklist as the Spamhaus DROP list is written, with an
-	// address and a netblock in each of its comments, which list nothing.
-	drop = "; Spamhaus DROP List 2026/10/07 - (c) 2026 The Spamhaus Project SLL\n" +
-		"; Last-Modified: Wed, 07 Oct 2026 00:00:00 GMT ; 192.0.2.1\n" +
-		"# 198.51.100.0/24\n" +
-		"\n" +
-		"203.0.113.0/24 ; SBL1\n" +
-		"  192.0.2.9  # one address\n" +
-		"2001:db8:1::/48 ; SBL2\n"
-)
-
-func TestListedAddressesAndNetblocksWithTheCommentsLeftOut(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{dropURL: drop}}
-		lists := start(t, servers, params(dropURL))
-
-		for addr, want := range map[string][]string{
-			"203.0.113.0":   {dropURL},
-			"203.0.113.255": {dropURL},
-			"192.0.2.9":     {dropURL},
-			"2001:db8:1::7": {dropURL},
-			"203.0.114.0":   nil,
-			"192.0.2.8":     nil,
-			"192.0.2.1":     nil,
-			"198.51.100.7":  nil,
-			"2001:db8:2::7": nil,
-		} {
-			wantListedBy(t, lists, addr, want...)
-		}
-	})
-}
-
-func TestIPv4MappedLineListsTheIPv4AddressOrNetblockItStandsFor(t *testing.T) {
-	t.Parallel()
-
-	now := time.Now()
-	lists := reputation.New(params(dropURL))
-
-	err := lists.Load([]reputation.List{{
-		URL: dropURL, Tried: now, Fetched: now,
-		Lines: []string{"::ffff:192.0.2.9", "::ffff:203.0.113.0/120"},
-	}})
-	if err != nil {
-		t.Fatalf("load: %v", err)
-	}
-
-	for addr, want := range map[string][]string{
-		"192.0.2.9":     {dropURL},
-		"203.0.113.255": {dropURL},
-		"192.0.2.8":     nil,
-		"203.0.114.0":   nil,
-	} {
-		wantListedBy(t, lists, addr, want...)
-	}
-
-	// A mapped netblock shorter than /96 stands for no IPv4 one.
-	err = lists.Load([]reputation.List{{
-		URL: dropURL, Tried: now, Fetched: now, Lines: []string{"::ffff:198.51.100.0/88"},
-	}})
-
-	const want = "the copy of " + dropURL +
-		": line 1 is not an address or a netblock, such as 192.0.2.0/24"
-	if err == nil || err.Error() != want {
-		t.Errorf("error %v, want %s", err, want)
-	}
-}
-
-func TestClientIsListedByEachBlocklistThatListsIt(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{
-			dropURL: "203.0.113.0/24\n", torURL: "203.0.113.9\n",
-		}}
-		lists := start(t, servers, params(torURL, dropURL))
-
-		// In the order SWWAF_BLOCKLIST_URLS names them.
-		wantListedBy(t, lists, "203.0.113.9", torURL, dropURL)
-		wantListedBy(t, lists, "203.0.113.8", dropURL)
-	})
-}
-
-func TestListFetchedAgainOnceRefreshHasPassed(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{dropURL: "203.0.113.9\n"}}
-		lists := start(t, servers, params(dropURL))
-		began := time.Now()
-
-		wantFetches(t, servers, 1)
-
-		servers.set(dropURL, "203.0.113.10\n")
-		time.Sleep(refresh - time.Nanosecond)
-		wantFetches(t, servers, 1)
-		wantListedBy(t, lists, "203.0.113.9", dropURL)
-
-		time.Sleep(time.Nanosecond)
-		wantFetches(t, servers, 2)
-		wantListedBy(t, lists, "203.0.113.9")
-		wantListedBy(t, lists, "203.0.113.10", dropURL)
-
-		if fetched := lists.Fetched(dropURL); !fetched.Equal(began.Add(refresh)) {
-			t.Errorf("the copy in use was fetched at %s, want %s", fetched,
-				began.Add(refresh))
-		}
-	})
-}
-
-func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		// fail has the stand-in answer the fetches after the first so that
-		// they fail with error.
-		fail  func(servers *standIn)
-		error string
-	}{
-		{
-			"an answer other than 200",
-			func(servers *standIn) { servers.set(dropURL, "") },
-			"the server answered 503 Service Unavailable",
-		},
-		{
-			"a line that does not read",
-			func(servers *standIn) { servers.set(dropURL, "203.0.113.10\n<html>\n") },
-			"line 2 is not an address or a netblock, such as 192.0.2.0/24",
-		},
-		{
-			"a list longer than 16 MiB",
-			func(servers *standIn) {
-				servers.set(dropURL, strings.Repeat("#\n", 8<<20+1))
-			},
-			"the list is longer than 16 MiB",
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			synctest.Test(t, func(t *testing.T) {
-				var log bytes.Buffer
-
-				servers := &standIn{lists: map[string]string{dropURL: drop}}
-				queue := newQueue()
-				p := params(dropURL)
-				p.ProcessLog = slog.New(slog.NewJSONHandler(&log, nil))
-				p.Alerts = queue
-				lists := start(t, servers, p)
-				kept := lists.Snapshot()
-
-				tc.fail(servers)
-
-				// Each failure is tried again once refresh has passed since it.
-				for range 2 {
-					time.Sleep(refresh)
-					synctest.Wait()
-				}
-
-				wantFetches(t, servers, 3)
-				wantListedBy(t, lists, "203.0.113.9", dropURL)
-
-				want := kept[0]
-				want.Tried = time.Now()
-
-				if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{want}) {
-					t.Errorf("lists %+v, want the first copy, last tried now, %+v", got, want)
-				}
-
-				if lists.Failures(dropURL) != 2 {
-					t.Errorf("%d failures, want 2", lists.Failures(dropURL))
-				}
-
-				// One alert for the first failure; the cooldown holds back the
-				// second.
-				wantAlert(t, queue, alerts.Alert{
-					Time:   time.Now().Add(-refresh),
-					Event:  alerts.EventSourceFailure,
-					Reason: "fetching a list failed",
-					Detail: map[string]any{"source": dropURL, "error": tc.error},
-				})
-
-				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
-					`"url":"`+dropURL+`","error":"`+tc.error) {
-					t.Errorf("logged\n%s\nwant the failures", log.String())
-				}
-			})
-		})
-	}
-}
-
-func TestFetchNotDoneWithinAMinuteFails(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{}, hanging: true}
-		lists := start(t, servers, params(dropURL))
-
-		time.Sleep(time.Minute - time.Nanosecond)
-		synctest.Wait()
-
-		if lists.Failures(dropURL) != 0 {
-			t.Errorf("%d failures before a minute, want none", lists.Failures(dropURL))
-		}
-
-		time.Sleep(time.Nanosecond)
-		synctest.Wait()
-
-		if lists.Failures(dropURL) != 1 {
-			t.Errorf("%d failures after a minute, want 1", lists.Failures(dropURL))
-		}
-	})
-}
-
-func TestKeptCopyIsFetchedAgainOnceRefreshHasPassedSinceItWasFetched(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{
-			dropURL: "203.0.113.10\n", torURL: "198.51.100.10\n",
-		}}
-		lists := reputation.New(params(dropURL, torURL))
-		lists.SetTransport(servers)
-
-		// drop.txt was fetched an hour ago, and tor.txt a refresh ago, as
-		// reputation.json says at start.
-		err := lists.Load([]reputation.List{
-			{URL: dropURL, Fetched: time.Now().Add(-time.Hour), Lines: []string{"203.0.113.9"}},
-			{URL: torURL, Fetched: time.Now().Add(-refresh), Lines: []string{"198.51.100.9"}},
-		})
-		if err != nil {
-			t.Fatalf("load: %v", err)
-		}
-
-		run(t, lists)
-
-		wantFetches(t, servers, 1)
-		wantListedBy(t, lists, "203.0.113.9", dropURL)
-		wantListedBy(t, lists, "198.51.100.10", torURL)
-
-		time.Sleep(refresh - time.Hour - time.Nanosecond)
-		wantFetches(t, servers, 1)
-
-		time.Sleep(time.Nanosecond)
-		wantFetches(t, servers, 2)
-		wantListedBy(t, lists, "203.0.113.10", dropURL)
-	})
-}
-
-func TestRestartWaitsRefreshAfterTheLastTryEvenOneThatFailed(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		// drop.txt is fetched, and a refresh later the fetch downloads it
-		// whole but fails on a line that does not read.
-		servers := &standIn{lists: map[string]string{dropURL: "198.51.100.1\n"}}
-		lists := start(t, servers, params(dropURL))
-
-		servers.set(dropURL, "198.51.100.2\n<html>\n")
-		time.Sleep(refresh)
-		wantFetches(t, servers, 2)
-
-		// Restarted with what reputation.json keeps, it waits a refresh
-		// after the failed try, as it does while it runs.
-		restarted := &standIn{lists: map[string]string{dropURL: "198.51.100.2\n"}}
-		again := reputation.New(params(dropURL))
-		again.SetTransport(restarted)
-
-		err := again.Load(lists.Snapshot())
-		if err != nil {
-			t.Fatalf("load: %v", err)
-		}
-
-		run(t, again)
-		wantFetches(t, restarted, 0)
-		wantListedBy(t, again, "198.51.100.1", dropURL)
-
-		time.Sleep(refresh - time.Nanosecond)
-		wantFetches(t, restarted, 0)
-
-		time.Sleep(time.Nanosecond)
-		wantFetches(t, restarted, 1)
-		wantListedBy(t, again, "198.51.100.2", dropURL)
-	})
-}
-
-func TestFetchCutOffAsItStopsIsNoFailureButARestartWaitsForIt(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		// Stopped 30 seconds into the fetch of drop.txt, before tor.txt's.
-		servers := &standIn{lists: map[string]string{}, hanging: true}
-		queue := newQueue()
-		p := params(dropURL, torURL)
-		p.Alerts = queue
-
-		lists := reputation.New(p)
-		lists.SetTransport(servers)
-
-		ctx, stop := context.WithCancel(t.Context())
-		stopped := make(chan struct{})
-
-		go func() {
-			lists.Run(ctx)
-			close(stopped)
-		}()
-
-		time.Sleep(30 * time.Second)
-		stop()
-		<-stopped
-
-		wantFetches(t, servers, 1)
-
-		if lists.Failures(dropURL) != 0 || len(waiting(queue)) != 0 {
-			t.Errorf("%d failures and alerts %+v, want none", lists.Failures(dropURL),
-				waiting(queue))
-		}
-
-		// Restarted an hour later with what reputation.json keeps, it fetches
-		// tor.txt, never tried, at once, and drop.txt a refresh after its
-		// cut-off try.
-		time.Sleep(time.Hour)
-
-		restarted := &standIn{lists: map[string]string{
-			dropURL: "203.0.113.7\n", torURL: "198.51.100.7\n",
-		}}
-		again := reputation.New(params(dropURL, torURL))
-		again.SetTransport(restarted)
-
-		err := again.Load(lists.Snapshot())
-		if err != nil {
-			t.Fatalf("load: %v", err)
-		}
-
-		run(t, again)
-		wantFetches(t, restarted, 1)
-		wantListedBy(t, again, "198.51.100.7", torURL)
-
-		time.Sleep(refresh - time.Hour - time.Nanosecond)
-		wantFetches(t, restarted, 1)
-
-		time.Sleep(time.Nanosecond)
-		wantFetches(t, restarted, 2)
-		wantListedBy(t, again, "203.0.113.7", dropURL)
-	})
-}
-
-func TestASNLimitPercentFileGivesEachASNumberItsLowestPercentage(t *testing.T) {
-	t.Parallel()
-
-	synctest.Test(t, func(t *testing.T) {
-		servers := &standIn{lists: map[string]string{
-			asnURL: "# hosting networks\nAS14061:50 ; DigitalOcean\nas16276:25\n\n" +
-				"AS14061:10\nAS14061:30\n",
-		}}
-		p := params()
-		p.ASNLimitPercentURL = asnURL
-		lists := start(t, servers, p)
-
-		for asn, want := range map[string]int64{"AS14061": 10, "AS16276": 25} {
-			percent, listed := lists.ASNLimitPercent(asn)
-			if !listed || percent != want {
-				t.Errorf("%s has %d (listed %t), want %d", asn, percent, listed, want)
-			}
-		}
-
-		if _, listed := lists.ASNLimitPercent("AS64496"); listed {
-			t.Error("AS64496 is listed")
-		}
-
-		// A line that does not read fails the fetch.
-		servers.set(asnURL, "AS14061:50\nAS16276\n")
-		time.Sleep(refresh)
-		synctest.Wait()
-
-		if lists.Failures(asnURL) != 1 {
-			t.Errorf("%d failures, want 1", lists.Failures(asnURL))
-		}
-	})
-}
-
-func TestLoadDropsCopiesOfListsNotNamedAndRefusesOnesThatDoNotRead(t *testing.T) {
-	t.Parallel()
-
-	fetched := time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
-	kept := reputation.List{
-		URL: dropURL, Tried: fetched, Fetched: fetched, Lines: []string{"203.0.113.9"},
-	}
-	lists := reputation.New(params(dropURL))
-
-	err := lists.Load([]reputation.List{kept, {
-		URL: torURL, Tried: fetched, Fetched: fetched, Lines: []string{"198.51.100.9"},
-	}})
-	if err != nil {
-		t.Fatalf("load: %v", err)
-	}
-
-	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
-		t.Errorf("copies %+v, want only %+v", got, kept)
-	}
-
-	err = lists.Load([]reputation.List{{URL: dropURL, Fetched: fetched, Lines: []string{
-		"; DROP", "203.0.113.300",
-	}}})
-
-	const want = "the copy of " + dropURL +
-		": line 2 is not an address or a netblock, such as 192.0.2.0/24"
-	if err == nil || err.Error() != want {
-		t.Errorf("error %v, want %s", err, want)
-	}
-
-	if got := lists.Snapshot(); !reflect.DeepEqual(got, []reputation.List{kept}) {
-		t.Errorf("copies %+v after the error, want %+v still", got, kept)
-	}
-}
-
-// standIn is a stand-in for the servers the lists are fetched from. It
-// notes the URL of each fetch.
-type standIn struct {
-	mu sync.Mutex
-	// lists are what it answers with, by URL; it answers a URL it has no
-	// list for with 503, and none at all while hanging.
-	lists   map[string]string
-	hanging bool
-	fetches []string
-}
-
-// RoundTrip has the stand-in answer req, in place of the network. A fetch
-// abandoned before the stand-in answers fails, as over the network.
-func (s *standIn) RoundTrip(req *http.Request) (*http.Response, error) {
-	s.mu.Lock()
-	s.fetches = append(s.fetches, req.URL.String())
-	list, found := s.lists[req.URL.String()]
-	hanging := s.hanging
-	s.mu.Unlock()
-
-	if hanging {
-		<-req.Context().Done()
-
-		return nil, req.Context().Err()
-	}
-
-	status := http.StatusOK
-	if !found {
-		status = http.StatusServiceUnavailable
-	}
-
-	return &http.Response{
-		StatusCode: status,
-		Status:     fmt.Sprintf("%d %s", status, http.StatusText(status)),
-		Header:     http.Header{},
-		Body:       io.NopCloser(strings.NewReader(list)),
-		Request:    req,
-	}, nil
-}
-
-// set has the stand-in answer listURL with list, or with 503 for "".
-func (s *standIn) set(listURL, list string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if list == "" {
-		delete(s.lists, listURL)
-
-		return
-	}
-
-	s.lists[listURL] = list
-}
-
-// params returns the Params of the blocklists at urls, refreshed every
-// refresh, by the bubble's clock, with alerts to a queue that sends none.
-func params(urls ...string) reputation.Params {
-	return reputation.Params{
-		BlocklistURLs: urls,
-		Refresh:       refresh,
-		Now:           time.Now,
-		ProcessLog:    slog.New(slog.DiscardHandler),
-		Alerts:        newQueue(),
-	}
-}
-
-// newQueue returns a queue of alerts to a webhook that is never sent
-// them, with a cooldown of cooldown.
-func newQueue() *alerts.Queue {
-	return alerts.New(alerts.Params{
-		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
-		Events:     alerts.Events(),
-		Cooldown:   cooldown,
-		Now:        time.Now,
-	})
-}
-
-// start returns the lists of p, fetched through servers by Run, which runs
-// until the test ends, once Run has fetched those due at start.
-func start(t *testing.T, servers *standIn, p reputation.Params) *reputation.Lists {
-	t.Helper()
-
-	lists := reputation.New(p)
-	lists.SetTransport(servers)
-	run(t, lists)
-
-	return lists
-}
-
-// run runs lists' Run until the test ends, and waits until it has fetched
-// the lists due.
-func run(t *testing.T, lists *reputation.Lists) {
-	t.Helper()
-
-	ctx, stop := context.WithCancel(t.Context())
-	stopped := make(chan struct{})
-
-	go func() {
-		lists.Run(ctx)
-		close(stopped)
-	}()
-
-	t.Cleanup(func() {
-		stop()
-		<-stopped
-	})
-
-	synctest.Wait()
-}
-
-// wantFetches waits until Run has made the fetches due, and checks how
-// many the servers have had.
-func wantFetches(t *testing.T, servers *standIn, want int) {
-	t.Helper()
-
-	synctest.Wait()
-
-	servers.mu.Lock()
-	got := len(servers.fetches)
-	servers.mu.Unlock()
-
-	if got != want {
-		t.Errorf("%d fetches, want %d", got, want)
-	}
-}
-
-// wantListedBy checks the URLs of the blocklists lists says list addr.
-func wantListedBy(t *testing.T, lists *reputation.Lists, addr string, want ...string) {
-	t.Helper()
-
-	got := lists.ListedBy(netip.MustParseAddr(addr))
-	if !slices.Equal(got, want) {
-		t.Errorf("%s is listed by %v, want %v", addr, got, want)
-	}
-}
-
-// waiting returns the alerts waiting in queue.
-func waiting(queue *alerts.Queue) []alerts.Alert {
-	return queue.Snapshot().Waiting[alerts.DestinationWebhook]
-}
-
-// wantAlert checks that want is the one alert waiting in queue, and that
-// the cooldown has held back one repeat of it.
-func wantAlert(t *testing.T, queue *alerts.Queue, want alerts.Alert) {
-	t.Helper()
-
-	got := waiting(queue)
-	if len(got) != 1 || !reflect.DeepEqual(got[0], want) || queue.Suppressed() != 1 {
-		t.Errorf("alerts waiting %+v, %d held back, want only %+v and 1", got,
-			queue.Suppressed(), want)
-	}
-}

internal/requestlog/requestlog.go

@@ -35,9 +35,7 @@ const (
 	// rule.
 	ActionRuleBlocked = "rule_blocked"
 	// ActionDenied is a request refused because its client is in
-	// SWWAF_DENY_NETS, in a blocklist while SWWAF_BLOCKLIST_ACTION is deny,
+	// SWWAF_DENY_NETS.
-	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
-	// SWWAF_REPUTATION_ACTION is deny.
 	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
@@ -119,15 +117,6 @@ type Line struct {
 	// ActionBanned, ActionCountryDenied, ActionRateLimited or
 	// ActionRuleBlocked.
 	WouldAction string `json:"would_action,omitempty"`
-	// LimitPercent and LimitPercentSetting are, for a request the rate
-	// limits counted whose client a biased threshold gives a percentage of
-	// the rate limits below 100, that percentage and the setting that gave
-	// it. BytesPercent and BytesPercentSetting are the same for the byte
-	// limits.
-	LimitPercent        *int64 `json:"limit_percent,omitempty"`
-	LimitPercentSetting string `json:"limit_percent_setting,omitempty"`
-	BytesPercent        *int64 `json:"bytes_percent,omitempty"`
-	BytesPercentSetting string `json:"bytes_percent_setting,omitempty"`
 	// Counts are, for a request the rate limits counted, the client's
 	// requests as they counted them with this one, and its bytes as the
 	// byte limits counted them, with this request's once it has ended if
@@ -139,10 +128,6 @@ type Line struct {
 	// Counts names its count: minute, hour or day for a rate limit, and
 	// minute_bytes, hour_bytes or day_bytes for a byte limit.
 	LimitHit string `json:"limit_hit,omitempty"`
-	// Reputation are the URLs of the blocklists that list the client, then
-	// the DNSBL zones whose verdict lists it, their keys masked, then
-	// abuseipdb when its score is a hit.
-	Reputation []string `json:"reputation,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`
 	// BanExpires is when the ban the request made, or was refused under,

internal/smallwebwaf/smallwebwaf.go

@@ -21,7 +21,6 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/state"
@@ -170,15 +169,14 @@ func newServer(
 	}
 
 	server := proxy.New(proxy.Params{
-		Config:       cfg,
+		Config:     cfg,
-		RequestLog:   stdout,
+		RequestLog: stdout,
-		ProcessLog:   processLog,
+		ProcessLog: processLog,
-		GeoJSURL:     lookup.URL,
+		GeoJSURL:   lookup.URL,
-		AbuseIPDBURL: reputation.AbuseIPDBURL,
+		LookupFile: lookupFile,
-		LookupFile:   lookupFile,
+		Now:        now,
-		Now:          now,
+		Rules:      ruleFiles,
-		Rules:        ruleFiles,
+		Alerts:     alertQueue,
-		Alerts:       alertQueue,
 	})
 	server.Metrics.AddAlerts(alertQueue)
 
@@ -202,11 +200,7 @@ func loadStateFiles(
 		Ledger:          server.Ledger,
 		Limiter:         server.Limiter,
 		GeoJS:           server.GeoJS,
-		Lists:           server.Lists,
-		DNSBL:           server.DNSBL,
-		AbuseIPDB:       server.AbuseIPDB,
 		Alerts:          alertQueue,
-		Anomalies:       server.Anomalies,
 		Now:             now,
 		ProcessLog:      processLog,
 		Metrics:         server.Metrics,
@@ -272,9 +266,8 @@ func startSending(
 
 // serve serves requests on listener, writes the state files as they are
 // due, takes in an admin's edits of them, reads the rule files again as
-// they change, and the lookup database when it is replaced, fetches the
+// they change, and the lookup database when it is replaced, and sends the
-// lists the settings name by URL as they are due, and sends the alerts,
+// alerts, until ctx is done. Then it gives the requests in progress
-// until ctx is done. Then it gives the requests in progress
 // shutdownTimeout to finish, and writes every state file, alerts.json with
 // the alerts still waiting.
 func serve(
@@ -299,7 +292,6 @@ func serve(
 			server.LookupFile.Watch(writing)
 		}
 	})
-	listsFetched := inBackground(func() { server.Lists.Run(writing) })
 	alertsSent := inBackground(func() { alertQueue.Run(writing) })
 
 	select {
@@ -343,7 +335,6 @@ func serve(
 	<-watched
 	<-rulesWatched
 	<-lookupFileWatched
-	<-listsFetched
 	<-alertsSent
 
 	err = files.WriteAll()

internal/smallwebwaf/smallwebwaf_test.go

@@ -38,7 +38,6 @@ const (
 	stateWriteDelay      = "SWWAF_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWWAF_STATE_COUNTER_INTERVAL"
 	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
-	rateLimitExemptNets  = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
 	rulesDir             = "SWWAF_RULES_DIR"
 	lookupSource         = "SWWAF_LOOKUP_SOURCE"
 	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
@@ -523,7 +522,7 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 		// The requests sent until a replacement takes effect, and those
 		// for the metrics, must not break a rate limit, whose ban would
 		// refuse them too.
-		rateLimitExemptNets: placed + "," + localhost,
+		"SWWAF_RATE_LIMIT_EXEMPT_NETS": placed + "," + localhost,
 	}
 	began := time.Now()
 	// Each replacement is written beside the file and renamed over it, as
@@ -574,111 +573,6 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 	}
 }
 
-func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T) {
-	t.Parallel()
-
-	const (
-		token    = "0123456789abcdef0123456789abcdef"
-		torPath  = "/tor.txt"
-		dropPath = "/drop.txt"
-		// copyright is the DROP list's date and copyright line.
-		copyright = "; Spamhaus DROP List 2026/10/07 - (c) 2026 The Spamhaus Project SLL"
-	)
-
-	failing, torFetches := new(atomic.Bool), new(atomic.Int32)
-	lists := map[string]string{
-		torPath:  "198.51.100.0/24\n",
-		dropPath: copyright + "\n" + placed + " ; SBL1\n",
-	}
-	server := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			if r.URL.Path == torPath {
-				torFetches.Add(1)
-			}
-
-			if failing.Load() {
-				w.WriteHeader(http.StatusServiceUnavailable)
-
-				return
-			}
-
-			_, _ = io.WriteString(w, lists[r.URL.Path])
-		}))
-	t.Cleanup(server.Close)
-
-	torURL, dropURL := server.URL+torPath, server.URL+dropPath
-	dir := t.TempDir()
-	env := map[string]string{
-		listenAddr:             localhost + ":0",
-		upstreamURL:            startApp(t),
-		stateDir:               dir,
-		rulesDir:               t.TempDir(),
-		trustedProxies:         localhost + "/32",
-		metricsToken:           token,
-		instanceName:           instance,
-		"SWWAF_BLOCKLIST_URLS": torURL,
-		// The requests sent until the list takes effect, and those for the
-		// metrics, must not break a rate limit, whose ban would refuse them
-		// too.
-		rateLimitExemptNets: placed + "," + localhost,
-	}
-	failures := `smallwebwaf_reputation_failures_total{instance="fsn1app1/gitea",` +
-		`source="` + torURL + `"} `
-
-	// tor.txt cannot be fetched at first, which is counted.
-	failing.Store(true)
-	runUntilStopped(t, env, func(url string) {
-		metricsWith(t, url+"_smallwebwaf/metrics", token, failures+"1")
-	})
-
-	// Restarted with drop.txt named after it and the server answering, tor.txt
-	// waits SWWAF_BLOCKLIST_REFRESH after its failed try, kept in reputation.json,
-	// while drop.txt, never tried, is fetched at once. Lists are fetched in the
-	// order named, so once drop.txt refuses the client, tor.txt has had its turn.
-	failing.Store(false)
-
-	env["SWWAF_BLOCKLIST_URLS"] = torURL + "," + dropURL
-	out := runUntilStopped(t, env, func(url string) {
-		for statusFrom(t, url, placed) != http.StatusForbidden {
-			time.Sleep(pollInterval)
-		}
-	})
-	wantDeniedByList(t, out.line(t, "action", "denied"), dropURL)
-
-	if fetches := torFetches.Load(); fetches != 1 {
-		t.Errorf("tor.txt fetched %d times, want once, before the restart", fetches)
-	}
-
-	// After another restart, with the server failing, the copy of drop.txt
-	// kept in reputation.json, its copyright line included, refuses the
-	// client from the first request.
-	failing.Store(true)
-
-	out = runUntilStopped(t, env, func(url string) {
-		wantStatus(t, url, placed, http.StatusForbidden)
-	})
-	wantDeniedByList(t, out.line(t, "type", "request"), dropURL)
-
-	path := filepath.Join(dir, "reputation.json")
-
-	kept, err := os.ReadFile(path) //nolint:gosec // a file in the test's directory
-	if err != nil || !strings.Contains(string(kept), `"`+copyright+`"`) {
-		t.Errorf("reputation.json holds\n%s\nwant the copy with %q (%v)", kept, copyright,
-			err)
-	}
-}
-
-// wantDeniedByList checks that the request log line is of a request the
-// blocklist at listURL refused.
-func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
-	t.Helper()
-
-	reputation, _ := line["reputation"].([]any)
-	if line["action"] != "denied" || len(reputation) != 1 || reputation[0] != listURL {
-		t.Errorf("request log line %v, want one denied for %s", line, listURL)
-	}
-}
-
 func TestLookupDatabaseThatCannotBeReadStopsTheStart(t *testing.T) {
 	t.Parallel()
 
@@ -1120,7 +1014,7 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
 		"SWWAF_REQUEST_MAX_BYTES":               "100M",
 		"SWWAF_RESPONSE_MAX_BYTES":              "5G",
 		"SWWAF_ALLOW_NETS":                      "",
-		rateLimitExemptNets:                     "",
+		"SWWAF_RATE_LIMIT_EXEMPT_NETS":          "",
 		"SWWAF_DENY_NETS":                       "",
 		"SWWAF_RATE_LIMIT_PER_MINUTE":           "1000",
 		"SWWAF_RATE_LIMIT_PER_HOUR":             "10000",

internal/state/state.go

@@ -1,11 +1,8 @@
 // Package state keeps smallwebwaf's state in JSON files in
 // SWWAF_STATE_DIR, as the "Persistent state" section of SPEC.md describes:
 // bans.json holds the bans, clients.json each client's counters and
-// history, lookups.json GeoJS's answers, reputation.json the last try and
+// history, lookups.json GeoJS's answers, and alerts.json the cooldowns,
-// last good copy of each list fetched from a URL, the DNSBL zones'
+// the hour under way and the alerts waiting for each destination. Load
-// verdicts, and AbuseIPDB's scores and checks spent, and alerts.json the
-// cooldowns, the hour under way, the alerts waiting for each destination
-// and the anomaly counters. Load
 // reads them at start, Watch takes in an admin's edit of one while
 // smallwebwaf runs, and Run and WriteAll write them. The disk is read and
 // written outside the parts' locks, which are held only to take a
@@ -32,12 +29,10 @@ import (
 
 	"github.com/fsnotify/fsnotify"
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
 )
 
 // version is the version of the files' format, the only one read.
@@ -49,11 +44,10 @@ const fileMode = 0o600
 
 // The state files' names.
 const (
-	bansJSON       = "bans.json"
+	bansJSON    = "bans.json"
-	clientsJSON    = "clients.json"
+	clientsJSON = "clients.json"
-	lookupsJSON    = "lookups.json"
+	lookupsJSON = "lookups.json"
-	reputationJSON = "reputation.json"
+	alertsJSON  = "alerts.json"
-	alertsJSON     = "alerts.json"
 )
 
 var (
@@ -62,7 +56,6 @@ var (
 	errMissing     = errors.New("has no")
 	errCause       = errors.New("is not limit, attack or admin")
 	errDestination = errors.New("is not webhook, slack or ntfy")
-	errScope       = errors.New("is not client, net, asn, total or watch")
 	errWaitingList = errors.New(`waiting is a list, but now lists the alerts by ` +
 		`destination: put the list under "webhook", as "waiting": {"webhook": [...]}, ` +
 		`or remove the file`)
@@ -77,17 +70,13 @@ type Params struct {
 	// is (SWWAF_STATE_COUNTER_INTERVAL).
 	WriteDelay      time.Duration
 	CounterInterval time.Duration
-	// Ledger, Limiter, GeoJS, Lists, DNSBL, AbuseIPDB, Alerts and Anomalies
+	// Ledger, Limiter, GeoJS and Alerts hold the state. Alerts also
-	// hold the state. Alerts also receive a file_error alert for an edit set
+	// receive a file_error alert for an edit set aside, and for a write
-	// aside, and for a write that fails while smallwebwaf runs.
+	// that fails while smallwebwaf runs.
-	Ledger    *bans.Ledger
+	Ledger  *bans.Ledger
-	Limiter   *ratelimit.Limiter
+	Limiter *ratelimit.Limiter
-	GeoJS     *lookup.GeoJS
+	GeoJS   *lookup.GeoJS
-	Lists     *reputation.Lists
+	Alerts  *alerts.Queue
-	DNSBL     *reputation.DNSBL
-	AbuseIPDB *reputation.AbuseIPDB
-	Alerts    *alerts.Queue
-	Anomalies *anomaly.Counters
 	// Now tells the time by which the counters' buckets run out, normally
 	// time.Now in UTC.
 	Now func() time.Time
@@ -145,24 +134,12 @@ type lookupsFile struct {
 	Lookups []lookup.Answer `json:"lookups"`
 }
 
-// reputationFile is reputation.json, indented for an admin to read and
-// edit, so that each line of a list's copy is on a line of its own.
-type reputationFile struct {
-	Version   int                  `json:"version"`
-	Lists     []reputation.List    `json:"lists"`
-	Verdicts  []reputation.Verdict `json:"verdicts"`
-	AbuseIPDB reputation.Checks    `json:"abuseipdb"`
-}
-
 // alertsFile is alerts.json, indented for an admin to read and edit.
-//
-//nolint:tagliatelle // the state files use snake_case, as the request log does
 type alertsFile struct {
-	Version         int                       `json:"version"`
+	Version   int                       `json:"version"`
-	Cooldowns       []alerts.Cooldown         `json:"cooldowns"`
+	Cooldowns []alerts.Cooldown         `json:"cooldowns"`
-	Hour            alerts.Hour               `json:"hour"`
+	Hour      alerts.Hour               `json:"hour"`
-	Waiting         map[string][]alerts.Alert `json:"waiting"`
+	Waiting   map[string][]alerts.Alert `json:"waiting"`
-	AnomalyCounters []anomaly.Counter         `json:"anomaly_counters"`
 }
 
 // stateFile is the struct of a state file. Once the file is decoded, its
@@ -175,10 +152,10 @@ type stateFile interface {
 }
 
 // Load checks that files can be written in Dir, and reads the state files
-// in it into the parts of Params that hold the state. A missing file is
+// in it into the ledger, the limiter and GeoJS. A missing file is empty
-// empty state, as on a first start. A file that does not parse, has an
+// state, as on a first start. A file that does not parse, has an unknown
-// unknown version, or has an entry without a field it needs, is an error
+// version, or has an entry without a field it needs, is an error that
-// that names the file and, where the JSON decoder tells it, the line and
+// names the file and, where the JSON decoder tells it, the line and
 // column, or else the entry.
 func Load(params Params) (*Files, error) {
 	err := checkWritable(params.Dir)
@@ -191,17 +168,16 @@ func Load(params Params) (*Files, error) {
 	bansRead, bansErr := f.read(bansJSON)
 	clientsRead, clientsErr := f.read(clientsJSON)
 	lookupsRead, lookupsErr := f.read(lookupsJSON)
-	reputationRead, reputationErr := f.read(reputationJSON)
 	alertsRead, alertsErr := f.read(alertsJSON)
 
-	err = errors.Join(bansErr, clientsErr, lookupsErr, reputationErr, alertsErr)
+	err = errors.Join(bansErr, clientsErr, lookupsErr, alertsErr)
 	if err != nil {
 		return nil, err
 	}
 
 	params.ProcessLog.Info("read the state files", "directory", params.Dir,
 		"bans", bansRead, "clients", clientsRead, "lookups", lookupsRead,
-		"lists", reputationRead, "alerts_waiting", alertsRead)
+		"alerts_waiting", alertsRead)
 
 	return f, nil
 }
@@ -230,9 +206,7 @@ func (f *Files) Run(ctx context.Context) {
 
 			f.logFailure(bansJSON, f.writeFile(bansJSON))
 		case <-interval.C:
-			for _, name := range []string{
+			for _, name := range []string{bansJSON, clientsJSON, lookupsJSON, alertsJSON} {
-				bansJSON, clientsJSON, lookupsJSON, reputationJSON, alertsJSON,
-			} {
 				f.logFailure(name, f.writeFile(name))
 			}
 		}
@@ -243,7 +217,7 @@ func (f *Files) Run(ctx context.Context) {
 // fails does not keep the others from being written.
 func (f *Files) WriteAll() error {
 	return errors.Join(f.writeFile(bansJSON), f.writeFile(clientsJSON),
-		f.writeFile(lookupsJSON), f.writeFile(reputationJSON), f.writeFile(alertsJSON))
+		f.writeFile(lookupsJSON), f.writeFile(alertsJSON))
 }
 
 // Watch watches Dir until ctx is done, and takes in an admin's edit of a
@@ -278,7 +252,7 @@ func (f *Files) Watch(ctx context.Context) {
 			return
 		case event := <-watcher.Events:
 			switch name := filepath.Base(event.Name); name {
-			case bansJSON, clientsJSON, lookupsJSON, reputationJSON, alertsJSON:
+			case bansJSON, clientsJSON, lookupsJSON, alertsJSON:
 				f.fileChanged(name)
 			}
 		case err = <-watcher.Errors:
@@ -424,29 +398,32 @@ func (f *Files) takeIn(name string, data []byte, edit bool) (int, error) {
 
 		f.params.GeoJS.Load(file.Lookups)
 		entries = len(file.Lookups)
-	case reputationJSON:
+	case alertsJSON:
-		var file reputationFile
+		// waiting was a list, of the alerts waiting for the webhook, before
+		// alerts went to Slack and ntfy too.
+		var written struct {
+			Waiting json.RawMessage `json:"waiting"`
+		}
+
+		if json.Unmarshal(data, &written) == nil &&
+			bytes.HasPrefix(written.Waiting, []byte("[")) {
+			return 0, fmt.Errorf("%s: %w", path, errWaitingList)
+		}
+
+		var file alertsFile
 
 		err := parse(path, data, &file)
 		if err != nil {
 			return 0, err
 		}
 
-		err = f.params.Lists.Load(file.Lists)
+		f.params.Alerts.Load(alerts.State{
-		if err != nil {
+			Cooldowns: file.Cooldowns, Hour: file.Hour, Waiting: file.Waiting,
-			return 0, fmt.Errorf("%s: %w", path, err)
+		})
-		}
 
-		f.params.DNSBL.Load(file.Verdicts)
+		for _, waiting := range file.Waiting {
-		f.params.AbuseIPDB.Load(file.AbuseIPDB)
+			entries += len(waiting)
-		entries = len(file.Lists)
-	case alertsJSON:
-		waiting, err := f.takeInAlerts(path, data)
-		if err != nil {
-			return 0, err
 		}
-
-		entries = waiting
 	}
 
 	f.sums[name] = sha256.Sum256(data)
@@ -454,41 +431,6 @@ func (f *Files) takeIn(name string, data []byte, edit bool) (int, error) {
 	return entries, nil
 }
 
-// takeInAlerts parses data, what alerts.json, at path, holds, puts it
-// into the alerts and the anomaly counters, in place of what they held,
-// and returns how many alerts wait in it, as takeIn describes.
-func (f *Files) takeInAlerts(path string, data []byte) (int, error) {
-	// waiting was a list, of the alerts waiting for the webhook, before
-	// alerts went to Slack and ntfy too.
-	var written struct {
-		Waiting json.RawMessage `json:"waiting"`
-	}
-
-	if json.Unmarshal(data, &written) == nil &&
-		bytes.HasPrefix(written.Waiting, []byte("[")) {
-		return 0, fmt.Errorf("%s: %w", path, errWaitingList)
-	}
-
-	var file alertsFile
-
-	err := parse(path, data, &file)
-	if err != nil {
-		return 0, err
-	}
-
-	f.params.Alerts.Load(alerts.State{
-		Cooldowns: file.Cooldowns, Hour: file.Hour, Waiting: file.Waiting,
-	})
-	f.params.Anomalies.Load(file.AnomalyCounters, f.params.Now())
-
-	entries := 0
-	for _, waiting := range file.Waiting {
-		entries += len(waiting)
-	}
-
-	return entries, nil
-}
-
 // writeFile writes the state file name from what smallwebwaf holds. An
 // edit made since smallwebwaf last read or wrote the file is taken in
 // first, so that it is not overwritten, or set aside if it does not
@@ -564,37 +506,32 @@ func (f *Files) setAside(name string, parseErr error) error {
 func (f *Files) encode(name string) ([]byte, error) {
 	switch name {
 	case bansJSON:
-		return encodeIndented(bansFile{
+		file := bansFile{Version: version, Bans: BanEntries(f.params.Ledger.Snapshot())}
-			Version: version, Bans: BanEntries(f.params.Ledger.Snapshot()),
+
-		})
+		data, err := json.MarshalIndent(file, "", "    ")
+		if err != nil {
+			return nil, err
+		}
+
+		return append(data, '\n'), nil
 	case clientsJSON:
 		return encodeOnePerLine("clients", f.params.Limiter.Snapshot())
 	case lookupsJSON:
 		return encodeOnePerLine("lookups", f.params.GeoJS.Snapshot())
-	case reputationJSON:
-		return encodeIndented(reputationFile{
-			Version: version, Lists: f.params.Lists.Snapshot(),
-			Verdicts: f.params.DNSBL.Snapshot(), AbuseIPDB: f.params.AbuseIPDB.Snapshot(),
-		})
 	default: // alerts.json
 		held := f.params.Alerts.Snapshot()
-
+		file := alertsFile{
-		return encodeIndented(alertsFile{
 			Version: version, Cooldowns: held.Cooldowns, Hour: held.Hour,
-			Waiting: held.Waiting, AnomalyCounters: f.params.Anomalies.Snapshot(),
+			Waiting: held.Waiting,
-		})
+		}
-	}
-}
 
-// encodeIndented encodes file, a state file's struct, indented for an
+		data, err := json.MarshalIndent(file, "", "    ")
-// admin to read and edit.
+		if err != nil {
-func encodeIndented(file any) ([]byte, error) {
+			return nil, err
-	data, err := json.MarshalIndent(file, "", "    ")
+		}
-	if err != nil {
-		return nil, err
-	}
 
-	return append(data, '\n'), nil
+		return append(data, '\n'), nil
+	}
 }
 
 // BanEntries returns held as bans.json lists them, an empty list for
@@ -734,92 +671,10 @@ func (f *lookupsFile) check(data []byte) error {
 	return nil
 }
 
-// check refuses a list without its URL, which would name no list, or the
-// time it was last tried, which would have it fetched at once, and a copy
-// of it without the time it was fetched, or without its lines, which hold
-// the list. It refuses a verdict without its zone or its client, which
-// would be about no one, whether the zone lists the client, or the time
-// it was fetched, which would drop it, and so an AbuseIPDB score without
-// its client, the score, or the time it was fetched. A verdict's listed is
-// false for a client the zone does not list, and a score can be 0, which
-// the structs cannot tell from a missing one, so each is read again as
-// written.
-func (f *reputationFile) check(data []byte) error {
-	for i, kept := range f.Lists {
-		switch {
-		case kept.URL == "":
-			return missing(i, "url")
-		case kept.Tried.IsZero():
-			return missing(i, "tried")
-		case kept.Fetched.IsZero() && kept.Lines != nil:
-			return missing(i, "fetched")
-		case kept.Lines == nil && !kept.Fetched.IsZero():
-			return missing(i, "lines")
-		}
-	}
-
-	var written struct {
-		Verdicts []struct {
-			Listed *bool `json:"listed"`
-		} `json:"verdicts"`
-	}
-
-	err := json.Unmarshal(data, &written)
-	if err != nil {
-		return err
-	}
-
-	for i, verdict := range f.Verdicts {
-		switch {
-		case verdict.Zone == "":
-			return fmt.Errorf("verdicts %w", missing(i, "zone"))
-		case !verdict.Client.IsValid():
-			return fmt.Errorf("verdicts %w", missing(i, "client"))
-		case written.Verdicts[i].Listed == nil:
-			return fmt.Errorf("verdicts %w", missing(i, "listed"))
-		case verdict.Fetched.IsZero():
-			return fmt.Errorf("verdicts %w", missing(i, "fetched"))
-		}
-	}
-
-	return checkScores(f.AbuseIPDB.Scores, data)
-}
-
-// checkScores refuses an AbuseIPDB score, of scores, read from data, as
-// reputationFile's check describes.
-func checkScores(scores []reputation.Score, data []byte) error {
-	var written struct {
-		AbuseIPDB struct {
-			Scores []struct {
-				Score *int64 `json:"score"`
-			} `json:"scores"`
-		} `json:"abuseipdb"`
-	}
-
-	err := json.Unmarshal(data, &written)
-	if err != nil {
-		return err
-	}
-
-	for i, kept := range scores {
-		switch {
-		case !kept.Client.IsValid():
-			return fmt.Errorf("abuseipdb scores %w", missing(i, "client"))
-		case written.AbuseIPDB.Scores[i].Score == nil:
-			return fmt.Errorf("abuseipdb scores %w", missing(i, "score"))
-		case kept.Fetched.IsZero():
-			return fmt.Errorf("abuseipdb scores %w", missing(i, "fetched"))
-		}
-	}
-
-	return nil
-}
-
 // check refuses a cooldown without its event or when its alert was sent,
 // which would hold back no repeat, alerts waiting for a destination with
-// another name than webhook, slack or ntfy, most likely misspelt, an
+// another name than webhook, slack or ntfy, most likely misspelt, and an
-// alert waiting without its event or its time, and an anomaly counter as
+// alert waiting without its event or its time.
-// checkAnomalyCounters does.
 func (f *alertsFile) check([]byte) error {
 	for i, cooldown := range f.Cooldowns {
 		switch {
@@ -845,58 +700,9 @@ func (f *alertsFile) check([]byte) error {
 		}
 	}
 
-	return checkAnomalyCounters(f.AnomalyCounters)
-}
-
-// checkAnomalyCounters refuses an anomaly counter whose scope is not
-// client, net, asn, total or watch, most likely misspelt, and one without
-// a field it needs, as missingFromCounter tells.
-func checkAnomalyCounters(counters []anomaly.Counter) error {
-	for i, counter := range counters {
-		if !slices.Contains(anomaly.Scopes(), counter.Scope) {
-			return fmt.Errorf("anomaly_counters entry %d's scope %q %w", i+1,
-				counter.Scope, errScope)
-		}
-
-		field := missingFromCounter(counter)
-		if field != "" {
-			return fmt.Errorf("anomaly_counters %w", missing(i, field))
-		}
-	}
-
 	return nil
 }
 
-// missingFromCounter returns the first field counter, an anomaly counter,
-// needs and has not, or "" when it has them all: what tells it from the
-// others in its scope, without which it would never be counted again, the
-// netblock of a client, net or watch counter, the AS number of an asn one
-// and the name of a watch one; and the start of a window in which it has
-// requests or bytes, without which they would be dropped.
-func missingFromCounter(counter anomaly.Counter) string {
-	scope := counter.Scope
-
-	switch {
-	case scope != anomaly.ScopeASN && scope != anomaly.ScopeTotal &&
-		!counter.Netblock.IsValid():
-		return "netblock"
-	case scope == anomaly.ScopeASN && counter.ASN == "":
-		return "asn"
-	case scope == anomaly.ScopeWatch && counter.Name == "":
-		return "name"
-	case countsWithoutStart(counter.Minute):
-		return "minute.start"
-	case countsWithoutStart(counter.Hour):
-		return "hour.start"
-	case countsWithoutStart(counter.MinuteBytes):
-		return "minute_bytes.start"
-	case countsWithoutStart(counter.HourBytes):
-		return "hour_bytes.start"
-	default:
-		return ""
-	}
-}
-
 // countsWithoutStart reports whether b holds requests, or bytes, but no
 // start, which places them in time.
 func countsWithoutStart(b ratelimit.Buckets) bool {

internal/state/state_test.go

@@ -22,27 +22,19 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
-	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/state"
 )
 
 const (
 	// The state files.
-	bansJSON       = "bans.json"
+	bansJSON    = "bans.json"
-	clientsJSON    = "clients.json"
+	clientsJSON = "clients.json"
-	lookupsJSON    = "lookups.json"
+	lookupsJSON = "lookups.json"
-	reputationJSON = "reputation.json"
+	alertsJSON  = "alerts.json"
-	alertsJSON     = "alerts.json"
-	// blocklistURL and torURL are the blocklists the tests' lists name, and
-	// dnsblZone the DNSBL zone of the tests' verdicts.
-	blocklistURL = "https://lists.example/drop.txt"
-	torURL       = "https://lists.example/tor.txt"
-	dnsblZone    = "dnsbl.example"
 	// The AS number and AS name the tests' clients are looked up in.
 	asn    = "AS64496"
 	asName = "Example Net"
@@ -53,9 +45,6 @@ const (
 	// maxLogLines is how many lines of the process log wait for a test to
 	// read them.
 	maxLogLines = 64
-	// whole is the percentage of each limit a client gets when nothing
-	// lowers its limits.
-	whole = 100
 )
 
 // permanentBansJSON is bans.json holding permanentBan.
@@ -164,104 +153,6 @@ const filledAlertsJSON = `{
                 "suppressed_repeats": 0
             }
         ]
-    },
-    "anomaly_counters": [
-        {
-            "scope": "asn",
-            "asn": "AS64496",
-            "hour_bytes": {
-                "start": "2026-10-06T00:00:00Z",
-                "current": 8,
-                "previous": 0
-            }
-        },
-        {
-            "scope": "net",
-            "netblock": "203.0.113.0/24",
-            "minute": {
-                "start": "2026-10-06T00:00:00Z",
-                "current": 1,
-                "previous": 0
-            }
-        },
-        {
-            "scope": "total",
-            "minute": {
-                "start": "2026-10-06T00:00:00Z",
-                "current": 1,
-                "previous": 0
-            },
-            "minute_bytes": {
-                "start": "2026-10-06T00:00:00Z",
-                "current": 8,
-                "previous": 0
-            }
-        },
-        {
-            "scope": "watch",
-            "netblock": "203.0.113.0/24",
-            "name": "office",
-            "hour": {
-                "start": "2026-10-06T00:00:00Z",
-                "current": 1,
-                "previous": 0
-            }
-        }
-    ]
-}
-`
-
-// filledReputationJSON is reputation.json holding the blocklists' last
-// tries and the copy of one, with its comment line, two verdicts of a
-// DNSBL zone, and the AbuseIPDB checks spent today with two scores, as
-// fill puts them in.
-const filledReputationJSON = `{
-    "version": 1,
-    "lists": [
-        {
-            "url": "https://lists.example/drop.txt",
-            "tried": "2026-10-06T00:00:00Z",
-            "fetched": "2026-10-05T23:00:00Z",
-            "lines": [
-                "; Spamhaus DROP List 2026/10/05 - (c) 2026 The Spamhaus Project SLL",
-                "203.0.113.0/24 ; SBL1",
-                "2001:db8::/32 ; SBL2"
-            ]
-        },
-        {
-            "url": "https://lists.example/tor.txt",
-            "tried": "2026-10-06T00:00:00Z"
-        }
-    ],
-    "verdicts": [
-        {
-            "zone": "dnsbl.example",
-            "client": "203.0.113.9",
-            "listed": true,
-            "fetched": "2026-10-05T23:00:00Z"
-        },
-        {
-            "zone": "dnsbl.example",
-            "client": "2001:db8::1",
-            "listed": false,
-            "fetched": "2026-10-05T22:00:00Z"
-        }
-    ],
-    "abuseipdb": {
-        "day": "2026-10-06T00:00:00Z",
-        "spent": 3,
-        "scores": [
-            {
-                "client": "203.0.113.9/32",
-                "score": 100,
-                "fetched": "2026-10-05T23:00:00Z"
-            },
-            {
-                "client": "2001:db8::/64",
-                "score": 0,
-                "fetched": "2026-10-05T22:00:00Z"
-            }
-        ]
     }
 }
 `
@@ -292,52 +183,18 @@ func TestFilesWrittenAndReadBack(t *testing.T) {
 	wantEqual(t, clientsJSON, after.Limiter.Snapshot(), before.Limiter.Snapshot())
 	wantEqual(t, lookupsJSON, after.GeoJS.Snapshot(), before.GeoJS.Snapshot())
 
-	if got, want := after.Lists.Snapshot(), before.Lists.Snapshot(); !reflect.DeepEqual(
-		got, want) {
-		t.Errorf("%s read back\n%+v\nwant\n%+v", reputationJSON, got, want)
-	}
-
-	wantEqual(t, reputationJSON, after.DNSBL.Snapshot(), before.DNSBL.Snapshot())
-
-	checks, wantChecks := after.AbuseIPDB.Snapshot(), before.AbuseIPDB.Snapshot()
-	if !reflect.DeepEqual(checks, wantChecks) {
-		t.Errorf("%s read back\n%+v\nwant\n%+v", reputationJSON, checks, wantChecks)
-	}
-
 	if got, want := after.Alerts.Snapshot(), before.Alerts.Snapshot(); !reflect.DeepEqual(
 		got, want) {
 		t.Errorf("%s read back\n%+v\nwant\n%+v", alertsJSON, got, want)
 	}
 
-	wantEqual(t, alertsJSON, after.Anomalies.Snapshot(), before.Anomalies.Snapshot())
-
 	// Each one-per-line file lists its entries by client, and nothing
-	// but the five files is left in the directory.
+	// but the four files is left in the directory.
 	wantEntries(t, filepath.Join(dir, clientsJSON), "clients",
 		"192.0.2.1/32", "203.0.113.9/32", "2001:db8::/64")
 	wantEntries(t, filepath.Join(dir, lookupsJSON), "lookups",
 		"192.0.2.1/32", "203.0.113.9/32")
-	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
+	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON)
-}
-
-func TestReputationJSONKeepsEachCopyWholeOneLineToALine(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	params := newParams(dir)
-	fill(params)
-
-	files := load(t, params)
-
-	err := files.WriteAll()
-	if err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	got := readFile(t, filepath.Join(dir, reputationJSON))
-	if got != filledReputationJSON {
-		t.Errorf("reputation.json\n%s\nwant\n%s", got, filledReputationJSON)
-	}
 }
 
 func TestAlertsJSONIsIndentedWithTheCooldownsTheHourAndTheAlertsWaiting(t *testing.T) {
@@ -391,49 +248,6 @@ func TestSourceFailureCooldownKeptInAlertsJSONAcrossARestart(t *testing.T) {
 	}
 }
 
-func TestAnomalyCountersKeptInAlertsJSONAcrossARestart(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	request := anomaly.Request{
-		Client:      netip.MustParseAddr("203.0.113.9"),
-		ClientGroup: netip.MustParsePrefix("203.0.113.9/32"),
-	}
-
-	// The whole service may have two requests a minute.
-	withThreshold := func() state.Params {
-		params := newParams(dir)
-		params.Anomalies = anomaly.New(anomaly.Params{
-			Total: anomaly.Thresholds{RequestsPerMinute: 2}, Alerts: params.Alerts,
-		})
-
-		return params
-	}
-
-	before := withThreshold()
-	files := load(t, before)
-
-	for range 2 {
-		before.Anomalies.Count(midnight(), request)
-	}
-
-	err := files.WriteAll()
-	if err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	// After the restart, the third request in the minute is over it.
-	after := withThreshold()
-	load(t, after)
-	after.Anomalies.Count(midnight(), request)
-
-	waiting := after.Alerts.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Event != alerts.EventAnomaly ||
-		waiting[0].Detail["count"] != float64(3) {
-		t.Errorf("alerts wait %+v, want one for 3 requests", waiting)
-	}
-}
-
 func TestBansJSONIsIndentedWithNullForAPermanentBan(t *testing.T) {
 	t.Parallel()
 
@@ -461,13 +275,9 @@ func TestMissingFilesAreEmptyState(t *testing.T) {
 	load(t, params)
 
 	held := params.Alerts.Snapshot()
-	checks := params.AbuseIPDB.Snapshot()
-
 	if len(params.Ledger.Snapshot()) != 0 || len(params.Limiter.Snapshot()) != 0 ||
-		len(params.GeoJS.Snapshot()) != 0 || len(params.Lists.Snapshot()) != 0 ||
+		len(params.GeoJS.Snapshot()) != 0 || len(held.Cooldowns) != 0 ||
-		len(params.DNSBL.Snapshot()) != 0 || len(checks.Scores) != 0 || checks.Spent != 0 ||
+		len(held.Waiting[alerts.DestinationWebhook]) != 0 || held.Hour.Sent != 0 {
-		len(held.Cooldowns) != 0 || len(held.Waiting[alerts.DestinationWebhook]) != 0 ||
-		held.Hour.Sent != 0 {
 		t.Error("state from no files")
 	}
 }
@@ -519,21 +329,6 @@ func TestFileThatDoesNotParseStopsTheStart(t *testing.T) {
 			`{"version": 1, "waiting": {"webhook": [], "slak": []}}`,
 			`: waiting "slak" is not webhook, slack or ntfy`,
 		},
-		{
-			"an anomaly counter of an unknown scope", alertsJSON,
-			`{"version": 1, "anomaly_counters": [{"scope": "total"}, ` +
-				`{"scope": "nett", "netblock": "203.0.113.0/24"}]}`,
-			`: anomaly_counters entry 2's scope "nett" is not client, net, asn, total ` +
-				`or watch`,
-		},
-		{
-			"a copy of a list with a line that does not read", reputationJSON,
-			`{"version": 1, "lists": [{"url": "` + blocklistURL + `", ` +
-				`"tried": "2026-10-06T00:00:00Z", "fetched": "2026-10-06T00:00:00Z", ` +
-				`"lines": ["; DROP", "203.0.113.300"]}]}`,
-			`: the copy of ` + blocklistURL + `: line 2 is not an address or a netblock, ` +
-				`such as 192.0.2.0/24`,
-		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -629,121 +424,6 @@ func TestEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 	}
 }
 
-func TestReputationJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
-	t.Parallel()
-
-	const (
-		drop    = `"url": "` + blocklistURL + `", `
-		tried   = `"tried": "2026-10-06T00:00:00Z", `
-		fetched = `"fetched": "2026-10-06T00:00:00Z"`
-		// verdictZone, verdictClient and listed start a verdict, which
-		// fetched ends.
-		verdictZone   = `"zone": "` + dnsblZone + `", `
-		verdictClient = `"client": "198.51.100.7", `
-		listed        = `"listed": false, `
-	)
-
-	for _, tc := range []struct {
-		name, content string
-		// want is what the error says after the file's path.
-		want string
-	}{
-		{
-			"a list without its URL",
-			`{"version": 1, "lists": [{` + tried + fetched + `, "lines": []}]}`,
-			`: entry 1 has no "url"`,
-		},
-		{
-			"a list without the time it was last tried",
-			`{"version": 1, "lists": [{` + drop + fetched + `, "lines": []}]}`,
-			`: entry 1 has no "tried"`,
-		},
-		{
-			"a copy of a list without the time it was fetched",
-			`{"version": 1, "lists": [{` + drop + tried + `"lines": []}]}`,
-			`: entry 1 has no "fetched"`,
-		},
-		{
-			// An empty list has no lines, which is not having none.
-			"a copy of a list without its lines",
-			`{"version": 1, "lists": [{` + drop + tried + fetched + `, "lines": []}, ` +
-				`{"url": "` + torURL + `", ` + tried + fetched + `}]}`,
-			`: entry 2 has no "lines"`,
-		},
-		{
-			"a verdict without its zone",
-			`{"version": 1, "verdicts": [{` + verdictClient + listed + fetched + `}]}`,
-			`: verdicts entry 1 has no "zone"`,
-		},
-		{
-			"a verdict without its client",
-			`{"version": 1, "verdicts": [{` + verdictZone + listed + fetched + `}]}`,
-			`: verdicts entry 1 has no "client"`,
-		},
-		{
-			// A client the zone does not list has a listed of false, which is
-			// not having none.
-			"a verdict without whether the zone lists the client",
-			`{"version": 1, "verdicts": [{` + verdictZone + verdictClient + listed +
-				fetched + `}, {` + verdictZone + verdictClient + fetched + `}]}`,
-			`: verdicts entry 2 has no "listed"`,
-		},
-		{
-			"a verdict without the time it was fetched",
-			`{"version": 1, "verdicts": [{` + verdictZone + verdictClient +
-				`"listed": true}]}`,
-			`: verdicts entry 1 has no "fetched"`,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			wantRefused(t, reputationJSON, tc.content, tc.want)
-		})
-	}
-}
-
-func TestReputationJSONScoreWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
-	t.Parallel()
-
-	// scores opens the list of AbuseIPDB scores, and ends closes it; client,
-	// score and fetched make a score.
-	const (
-		scores  = `{"version": 1, "abuseipdb": {"scores": [`
-		client  = `"client": "198.51.100.7/32", `
-		score   = `"score": 0, `
-		fetched = `"fetched": "2026-10-06T00:00:00Z"`
-		ends    = `}]}}`
-	)
-
-	for _, tc := range []struct {
-		name, content string
-		// want is what the error says after the file's path.
-		want string
-	}{
-		{
-			"without its client", scores + `{` + score + fetched + ends,
-			`: abuseipdb scores entry 1 has no "client"`,
-		},
-		{
-			// A score of 0 is not having none.
-			"without the score",
-			scores + `{` + client + score + fetched + `}, {` + client + fetched + ends,
-			`: abuseipdb scores entry 2 has no "score"`,
-		},
-		{
-			"without the time it was fetched", scores + `{` + client + `"score": 100` + ends,
-			`: abuseipdb scores entry 1 has no "fetched"`,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			wantRefused(t, reputationJSON, tc.content, tc.want)
-		})
-	}
-}
-
 func TestAlertsJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 	t.Parallel()
 
@@ -772,39 +452,6 @@ func TestAlertsJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 			`{"version": 1, "waiting": {"slack": [{"event": "ban"}]}}`,
 			`: waiting slack entry 1 has no "time"`,
 		},
-		{
-			// The whole service's counter needs nothing to tell it apart.
-			"an anomaly counter of a netblock without it",
-			`{"version": 1, "anomaly_counters": [{"scope": "total"}, {"scope": "net"}]}`,
-			`: anomaly_counters entry 2 has no "netblock"`,
-		},
-		{
-			"an anomaly counter of a client without its netblock",
-			`{"version": 1, "anomaly_counters": [{"scope": "client"}]}`,
-			`: anomaly_counters entry 1 has no "netblock"`,
-		},
-		{
-			"an anomaly counter of an AS number without it",
-			`{"version": 1, "anomaly_counters": [{"scope": "asn"}]}`,
-			`: anomaly_counters entry 1 has no "asn"`,
-		},
-		{
-			"an anomaly counter of a named netblock without its name",
-			`{"version": 1, "anomaly_counters": [` +
-				`{"scope": "watch", "netblock": "203.0.113.0/24"}]}`,
-			`: anomaly_counters entry 1 has no "name"`,
-		},
-		{
-			"an anomaly counter of a named netblock without its netblock",
-			`{"version": 1, "anomaly_counters": [{"scope": "watch", "name": "office"}]}`,
-			`: anomaly_counters entry 1 has no "netblock"`,
-		},
-		{
-			"an anomaly counter with bytes in a window without its start",
-			`{"version": 1, "anomaly_counters": [` +
-				`{"scope": "total", "hour_bytes": {"current": 5}}]}`,
-			`: anomaly_counters entry 1 has no "hour_bytes.start"`,
-		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -847,9 +494,7 @@ func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
 func TestUnknownVersionStopsTheStart(t *testing.T) {
 	t.Parallel()
 
-	for _, file := range []string{
+	for _, file := range []string{bansJSON, clientsJSON, lookupsJSON, alertsJSON} {
-		bansJSON, clientsJSON, lookupsJSON, reputationJSON, alertsJSON,
-	} {
 		for _, content := range []string{`{"version": 2}`, `{}`} {
 			t.Run(file+" "+content, func(t *testing.T) {
 				t.Parallel()
@@ -951,9 +596,8 @@ func TestEveryFileWrittenEveryCounterInterval(t *testing.T) {
 
 			time.Sleep(time.Nanosecond)
 			synctest.Wait()
-			wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
+			wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON)
-			removeFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON,
+			removeFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON)
-				reputationJSON)
 		}
 	})
 }
@@ -1069,7 +713,7 @@ func TestFailedWriteLeavesTheFileAsItWas(t *testing.T) {
 
 	params.Ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
 		bans.Notes{})
-	params.Limiter.Count(netip.MustParsePrefix("203.0.113.9/32"), midnight(), whole)
+	params.Limiter.Count(netip.MustParsePrefix("203.0.113.9/32"), midnight())
 
 	err = files.WriteAll()
 	if err == nil || !strings.Contains(err.Error(), bansJSON+".tmp") {
@@ -1172,7 +816,7 @@ func TestFileThatCannotBeReadIsNotWrittenOver(t *testing.T) {
 		t.Errorf("bans.json is now %v (%v), want the socket", info, err)
 	}
 
-	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
+	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON)
 	wantWriteFailed(t, params, bansJSON)
 }
 
@@ -1245,32 +889,6 @@ func TestEditOfEachFileTakenIn(t *testing.T) {
 	wantEqual(t, lookupsJSON, params.GeoJS.Snapshot(),
 		[]lookup.Answer{{Client: client, Country: "FR", Answered: midnight()}})
 
-	edit(t, dir, reputationJSON, `{"version": 1, "lists": [{"url": "`+blocklistURL+`", `+
-		`"tried": "2026-10-06T00:00:00Z", "fetched": "2026-10-06T00:00:00Z", `+
-		`"lines": ["198.51.100.7"]}], "verdicts": [{"zone": "`+dnsblZone+`", `+
-		`"client": "198.51.100.7", "listed": true, "fetched": "2026-10-06T00:00:00Z"}], `+
-		`"abuseipdb": {"day": "2026-10-06T00:00:00Z", "spent": 9, "scores": [`+
-		`{"client": "198.51.100.7/32", "score": 80, "fetched": "2026-10-06T00:00:00Z"}]}}`)
-	wantTakenIn(t, lines, dir, reputationJSON)
-
-	listedBy := params.Lists.ListedBy(client.Addr())
-	if !slices.Equal(listedBy, []string{blocklistURL}) {
-		t.Errorf("%s taken in lists %s on %v, want on the blocklist", reputationJSON,
-			client.Addr(), listedBy)
-	}
-
-	wantEqual(t, reputationJSON, params.DNSBL.Snapshot(), []reputation.Verdict{{
-		Zone: dnsblZone, Client: client.Addr(), Listed: true, Fetched: midnight(),
-	}})
-
-	checks := reputation.Checks{
-		Day: midnight(), Spent: 9,
-		Scores: []reputation.Score{{Client: client, Score: 80, Fetched: midnight()}},
-	}
-	if got := params.AbuseIPDB.Snapshot(); !reflect.DeepEqual(got, checks) {
-		t.Errorf("%s taken in as\n%+v\nwant\n%+v", reputationJSON, got, checks)
-	}
-
 	// A netblock with bits past its length is read as the netblock it is
 	// in.
 	edit(t, dir, alertsJSON, `{"version": 1, "cooldowns": [{"event": "ban", `+
@@ -1498,7 +1116,7 @@ func TestBrokenEditSetAsideAtTheNextWrite(t *testing.T) {
 	edit(t, dir, bansJSON, broken)
 	edit(t, dir, clientsJSON, `{"version": 1, "clients": []}`)
 	wantTakenIn(t, lines, dir, clientsJSON)
-	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
+	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON)
 
 	// The next write sets it aside, logged with where the error is, and
 	// writes bans.json again from what smallwebwaf still holds.
@@ -1522,8 +1140,7 @@ func TestBrokenEditSetAsideAtTheNextWrite(t *testing.T) {
 		t.Errorf("alerts waiting %+v, want a file_error alert for %s", waiting, path+".bad")
 	}
 
-	wantFiles(t, dir, alertsJSON, bansJSON, bansJSON+".bad", clientsJSON, lookupsJSON,
+	wantFiles(t, dir, alertsJSON, bansJSON, bansJSON+".bad", clientsJSON, lookupsJSON)
-		reputationJSON)
 
 	if got := readFile(t, path+".bad"); got != broken {
 		t.Errorf("bans.json.bad holds\n%s\nwant the edit", got)
@@ -1652,21 +1269,11 @@ func midnight() time.Time {
 }
 
 // newParams returns Params for the state files in dir, with parts that
-// hold nothing yet. GeoJS is never asked, the lists, two blocklists, are
+// hold nothing yet. GeoJS is never asked, and the alerts, at most two an
-// never fetched, and the alerts, at most two an hour, are
+// hour, are never sent.
-// never sent. The anomaly counters count the scopes fill counts, with
-// thresholds fill does not reach.
 func newParams(dir string) state.Params {
 	discard := slog.New(slog.DiscardHandler)
 	m := metrics.New(1, "app")
-	queue := alerts.New(alerts.Params{
-		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
-		Events:     alerts.Events(),
-		Cooldown:   15 * time.Minute,
-		MaxPerHour: 2,
-		Instance:   "fsn1app1/gitea",
-		Now:        midnight,
-	})
 
 	return state.Params{
 		Dir:             dir,
@@ -1683,28 +1290,13 @@ func newParams(dir string) state.Params {
 		GeoJS: lookup.New(lookup.Params{
 			Now: midnight, ProcessLog: discard, Metrics: m,
 		}),
-		Lists: reputation.New(reputation.Params{
+		Alerts: alerts.New(alerts.Params{
-			BlocklistURLs: []string{blocklistURL, torURL}, Refresh: 24 * time.Hour,
+			WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
-			Now: midnight, ProcessLog: discard, Alerts: queue,
+			Events:     alerts.Events(),
-		}),
+			Cooldown:   15 * time.Minute,
-		DNSBL: reputation.NewDNSBL(reputation.DNSBLParams{
+			MaxPerHour: 2,
-			Zones: []string{dnsblZone}, CacheTTL: 24 * time.Hour, Timeout: time.Second,
+			Instance:   "fsn1app1/gitea",
-			Now: midnight, ProcessLog: discard, Alerts: queue,
+			Now:        midnight,
-		}),
-		AbuseIPDB: reputation.NewAbuseIPDB(reputation.AbuseIPDBParams{
-			MinScore: 75, DailyBudget: 900, CacheTTL: 24 * time.Hour, Timeout: time.Second,
-			Now: midnight, ProcessLog: discard, Alerts: queue,
-		}),
-		Alerts: queue,
-		Anomalies: anomaly.New(anomaly.Params{
-			Net:            anomaly.Thresholds{RequestsPerMinute: 1000},
-			ASN:            anomaly.Thresholds{BytesPerHour: 1 << 30},
-			Total:          anomaly.Thresholds{RequestsPerMinute: 1000, BytesPerMinute: 1 << 30},
-			Watch:          anomaly.Thresholds{RequestsPerHour: 1000},
-			NetV4Prefix:    24,
-			NetV6Prefix:    48,
-			NamedNetblocks: []anomaly.NamedNetblock{{Name: "office", Netblock: office()}},
-			Alerts:         queue,
 		}),
 		Now:        midnight,
 		ProcessLog: discard,
@@ -1712,18 +1304,10 @@ func newParams(dir string) state.Params {
 	}
 }
 
-// office is the named netblock of the anomaly counters of newParams.
-func office() netip.Prefix {
-	return netip.MustParsePrefix("203.0.113.0/24")
-}
-
 // fill puts a permanent ban an admin made, a ban for a broken limit and
 // one for a clear sign of attack, clients with counts and histories,
-// GeoJS answers, the blocklists' last tries and the copy of one, two
+// GeoJS answers, and alerts, as filledAlertsJSON holds them, into the
-// verdicts of a DNSBL zone, and the AbuseIPDB checks spent today with two
+// parts of params.
-// scores, as filledReputationJSON holds them, and alerts
-// and anomaly counters, as filledAlertsJSON holds them, into the parts of
-// params.
 func fill(params state.Params) {
 	now := midnight()
 	client := netip.MustParsePrefix("203.0.113.9/32")
@@ -1736,10 +1320,10 @@ func fill(params state.Params) {
 		bans.Notes{RuleID: "env-file", Target: "path"})
 
 	for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
-		params.Limiter.Count(netip.MustParsePrefix(c), now, whole)
+		params.Limiter.Count(netip.MustParsePrefix(c), now)
 	}
 
-	params.Limiter.CountBytes(client, now, 8, whole)
+	params.Limiter.CountBytes(client, now, 8)
 	params.Limiter.AddToHistory(client, now, ratelimit.Request{
 		Forwarded: true, Status: 200, RequestBytes: 3, ResponseBytes: 5,
 	})
@@ -1756,32 +1340,6 @@ func fill(params state.Params) {
 		},
 	})
 
-	// The copy of drop.txt was fetched an hour ago, and the fetches of it
-	// and of tor.txt tried since failed.
-	err := params.Lists.Load([]reputation.List{{
-		URL: blocklistURL, Tried: now, Fetched: now.Add(-time.Hour),
-		Lines: []string{
-			"; Spamhaus DROP List 2026/10/05 - (c) 2026 The Spamhaus Project SLL",
-			"203.0.113.0/24 ; SBL1",
-			"2001:db8::/32 ; SBL2",
-		},
-	}, {URL: torURL, Tried: now}})
-	if err != nil {
-		panic(err) // the copy reads
-	}
-
-	params.DNSBL.Load([]reputation.Verdict{
-		{
-			Zone: dnsblZone, Client: netip.MustParseAddr("2001:db8::1"),
-			Fetched: now.Add(-2 * time.Hour),
-		},
-		{Zone: dnsblZone, Client: client.Addr(), Listed: true, Fetched: now.Add(-time.Hour)},
-	})
-	params.AbuseIPDB.Load(reputation.Checks{Day: now, Spent: 3, Scores: []reputation.Score{
-		{Client: netip.MustParsePrefix("2001:db8::/64"), Fetched: now.Add(-2 * time.Hour)},
-		{Client: client, Score: 100, Fetched: now.Add(-time.Hour)},
-	}})
-
 	// An alert waiting, a repeat of it the cooldown holds back, another
 	// alert waiting, and one past the two an hour, for the hour's summary.
 	ban := alerts.Alert{
@@ -1800,10 +1358,6 @@ func fill(params state.Params) {
 	params.Alerts.Raise(alerts.Alert{
 		Event: alerts.EventSourceFailure, Reason: "asking GeoJS failed",
 	})
-
-	params.Anomalies.Count(now, anomaly.Request{
-		Client: client.Addr(), ClientGroup: client, ASN: asn, Bytes: 8,
-	})
 }
 
 // permanentBan is the ban permanentBansJSON holds.