Install the image's Ubuntu packages from the normal mirrors (closes #190)

The final image stage now apt-gets ca-certificates, nix-bin and runit
from the archive the image's own sources name, with no snapshot and no
hash check of the package lists. The borrowed CA bundle is dropped: the
archive is reached over plain HTTP, so the install needs none. The Ubuntu
base image stays pinned by digest, and every other pin is kept. SPEC.md
and docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro

Dockerfile

@@ -117,8 +117,9 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
     && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \
         -o /usr/local/bin/runsvinit .
 
-# The image an app's Dockerfile builds FROM, described under "Deployment"
-# in SPEC.md. It is the last stage, so a plain `docker build .` builds it.
+# The image, described under "Deployment" in SPEC.md. It runs rproxy unless
+# SMALLWEBWAF_COMMAND says servewaf, and an app's Dockerfile can build FROM it.
+# It is the last stage, so a plain `docker build .` builds it.
 #
 # ubuntu 26.04, 2026-09-27
 FROM ubuntu@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
@@ -132,32 +133,11 @@ RUN mkdir /etc/sysusers.d \
     && echo 'u  _runit-log  -  "runit svlogd user"  /nonexistent  /sbin/nologin' \
         > /etc/sysusers.d/runit.conf
 
-# ca-certificates, nix-bin and runit, from Ubuntu's archive as it was at
-# the snapshot moment, which is never earlier than the Ubuntu image above.
-# apt checks every package against the snapshot's InRelease files, and
-# this step checks those against the hashes named here, which are those
-# of the amd64 archive: other architectures use Ubuntu's ports archive.
-# apt also fetches the live archive's InRelease files, which change daily
-# and which the install does not use. The snapshot service is HTTPS only
-# and this image has no CA certificates yet, so this step uses the Go
-# image's. The snapshot service answers 503 at times; apt retries a
-# failed download, waiting twice as long before each retry, and this
-# step gives it five retries, about half a minute in all, where its
-# default of three gives up after seven seconds.
-RUN --mount=type=bind,from=builder,source=/etc/ssl/certs/ca-certificates.crt,target=/tmp/go-image-ca.crt \
-    apt-get update --snapshot 20261001T000000Z \
-        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
-        -o Acquire::Retries=5 \
-    && printf '%s\n' \
-        '45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute_InRelease' \
-        '802e675dd9de4c7f3916434a95e7c1d8eec0e82886622d7805ab19a2c6fe0365  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-updates_InRelease' \
-        '64b3353f0bd4970b4f7271962245bcea9ff24d4cc7bea16b433f8a60e42ca3dd  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-backports_InRelease' \
-        '1d5041572116a8b23aabf79ac7439ad8af83d57ad3fb0f9aa0d4523ec10c5908  snapshot.ubuntu.com_ubuntu_20261001T000000Z_dists_resolute-security_InRelease' \
-        | (cd /var/lib/apt/lists && sha256sum --check --strict) \
+# ca-certificates, nix-bin and runit, from Ubuntu's normal mirrors: the
+# live archive the image's own sources name, over plain HTTP, so no CA
+# certificate is needed and none is borrowed from the Go image.
+RUN apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
-        --snapshot 20261001T000000Z \
-        -o Acquire::https::CaInfo=/tmp/go-image-ca.crt \
-        -o Acquire::Retries=5 \
         ca-certificates nix-bin runit \
     && rm -rf /var/lib/apt/lists/*
 
@@ -197,11 +177,11 @@ RUN groupadd --system --gid 65532 smallwebwaf \
 
 # The state files' directory, SWWAF_STATE_DIR by default, where a volume
 # is mounted to keep them across deploys. The run script gives it to the
-# smallwebwaf user at each start.
+# smallwebwaf user at each start of servewaf.
 RUN mkdir /var/lib/smallwebwaf
 
-# The default rule file, in SWWAF_RULES_DIR by default, where an app's
-# Dockerfile can copy rule files of its own beside it.
+# The default rule file, in SWWAF_RULES_DIR by default, where a Dockerfile
+# built FROM this image can copy rule files of its own beside it.
 COPY share/rules.d/00-default.rules /etc/smallwebwaf/rules.d/00-default.rules
 
 # runsvinit starts runit's runsvdir on /etc/service, where Ubuntu's sv

README.md

@@ -1,27 +1,47 @@
 # smallwebwaf
 
 `smallwebwaf` is an MIT-licensed web application firewall, written in Go by
-[@sneak](https://sneak.berlin), for one self-hosted web app. It runs inside the
-app's own container, in front of the app. It refuses the requests of scrapers,
-scanners and other abusers before they reach the app.
+[@sneak](https://sneak.berlin), for self-hosted web apps. It refuses the
+requests of scrapers, scanners and other abusers before they reach an app.
 
 A web application firewall reads each request on its way to a web app and
-refuses the ones that look like abuse. `smallwebwaf` is also a reverse proxy: it
-accepts requests on the app's behalf, passes them to the app, and passes the
-app's answers back.
+refuses the ones that look like abuse. `smallwebwaf` is one binary with two
+commands that do this together:
 
-It needs no setting. Every setting has a default chosen for a service on the
+- `smallwebwaf rproxy` is a small reverse proxy in front of one app. It accepts
+  requests on the app's behalf and asks `servewaf` about each one. It passes the
+  allowed ones to the app, and the app's answers back. It keeps nothing, and
+  never touches disk.
+- `smallwebwaf servewaf` decides. It runs the checks, and keeps the bans,
+  counters and history. One `servewaf` serves many sites.
+
+The site keeps answering while `servewaf` is down, slow or restarting. `rproxy`
+waits at most 2 seconds for `servewaf`'s answer, and without one passes the
+request to the app.
+
+`rproxy` requires one setting, `SWRP_WAF_BACKEND`, which says where `servewaf`
+is. In a container of its own, it also needs `SWRP_UPSTREAM_URL`, which says
+where the app is. Every other setting has a default chosen for a service on the
 open internet. [`SPEC.md`](SPEC.md) says how `smallwebwaf` behaves and why. The
 reference documents under [`docs/`](docs/) are listed under "Documents" below.
 
 ## What it protects against
 
 - Scrapers that fetch every page of a site, all day. Rate limiting gives each
-  client 6000 requests a minute, 100,000 an hour and 1,000,000 a day. Byte
-  limits give it 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over
-  a limit is refused and banned. The first ban lasts an hour. Each repeat within
-  a day makes the next ban three times as long. A ban that would last more than
-  seven days is permanent.
+  client 500 requests a minute, 20,000 an hour and 300,000 a day. That leaves
+  room for programmatic use of an API, such as an automation fleet on another
+  host. A fleet of about 20 agents makes about 120 requests a minute at its
+  busiest. A gitea page opened with an empty cache loads about 40 files, so a
+  few such first visits fit in the minute limit too. The minute limit catches,
+  within seconds, a client firing requests as fast as it can. The hour limit
+  catches a client that keeps up more than about 5.5 a second for an hour. The
+  day limit catches a client that keeps up 4 a second around the clock. Counting
+  cannot catch a client that stays under all three limits, such as one that
+  keeps up 3 a second; only the protections below can. Byte limits give each
+  client 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over a limit
+  is refused and banned. The first ban lasts an hour. Each repeat within a day
+  makes the next ban three times as long. A ban that would last more than seven
+  days is permanent.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client for seven days at its first probe. Its
   next request during the ban makes the ban permanent. The default rule file
@@ -44,7 +64,7 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
 
 For the operator, it:
 
-- writes one JSON log line for every request, saying what it did and why (see
+- logs each request as JSON lines, saying what it did and why (see
   [`docs/request-log.md`](docs/request-log.md));
 - sends alerts to a webhook, Slack or ntfy (see
   [`docs/alerts.md`](docs/alerts.md));
@@ -55,8 +75,8 @@ For the operator, it:
 
 Not built, and not planned:
 
-- TLS and routing for several apps. Both stay with traefik, the reverse proxy in
-  front of the container.
+- TLS and routing by host name. Both stay with traefik, the reverse proxy in
+  front of `rproxy`.
 - Browser challenges such as captchas.
 - A web console.
 - Defence against floods large enough to fill the host's network link.
@@ -74,14 +94,68 @@ cd smallwebwaf
 make docker
 ```
 
-Push the image to a registry your hosts pull from. Then build the app's own
-image on it. The app's `Dockerfile` starts `FROM` the `smallwebwaf` image, named
-by digest, and adds:
+Push the image to a registry your hosts pull from.
+
+The image runs `rproxy` by default. To run `servewaf` from the same image, set
+the container's `SMALLWEBWAF_COMMAND` to `servewaf`.
+
+### The usual setup: three containers
+
+The usual setup is three containers on one private network:
+
+- the app;
+- `rproxy`, in front of the app, which traefik routes to;
+- `servewaf`, with a volume for its state files.
+
+```sh
+docker network create site
+
+docker run --detach --name servewaf --network site \
+    --env SMALLWEBWAF_COMMAND=servewaf \
+    --volume servewaf-state:/var/lib/smallwebwaf \
+    <registry>/smallwebwaf@sha256:<digest>
+
+docker run --detach --name app --network site \
+    <registry>/app@sha256:<digest>
+
+docker run --detach --name rproxy --network site \
+    --env SWRP_WAF_BACKEND=http://servewaf:8080 \
+    --env SWRP_UPSTREAM_URL=http://app:8081 \
+    <registry>/smallwebwaf@sha256:<digest>
+```
+
+Here the app listens on port 8081, at its container's address on that network.
+Point traefik's labels at port 8080 of `rproxy`
+(`traefik.http.services.<name>.loadbalancer.server.port=8080`). Publish no port
+of the app or of `servewaf`. Anything on that network can reach the app around
+`rproxy`, and can ask `servewaf` questions.
+
+With no setting, `servewaf` sends the address of every new visitor to GeoJS, a
+web service, to find its country and network. `SWWAF_LOOKUP_SOURCE=off` sends
+nothing. `SWWAF_LOOKUP_SOURCE=file`, with `SWWAF_LOOKUP_DB_PATH` naming a
+database file on your own host, looks addresses up in that file (see "Lookup of
+AS number and country" in [`SPEC.md`](SPEC.md)).
+
+### Many sites, one `servewaf`
+
+Run one `rproxy` for each app, all with `SWRP_WAF_BACKEND` naming the same
+`servewaf`. It keeps one table of clients and bans for all of them:
+
+- A client banned through one site is refused on all of them.
+- A client's requests on all of them count toward one set of limits.
+- Log lines, alerts and ban notes name the site by its host.
+
+### `rproxy` in the app's container
+
+An app's image can also be built on the `smallwebwaf` image, so that `rproxy`
+runs beside the app. `servewaf` still runs in a container of its own. The app's
+`Dockerfile` starts `FROM` the `smallwebwaf` image, named by digest, and adds:
 
 - the app's binary;
 - the packages the app needs, from the nixpkgs in the image;
 - a user for the app;
-- a `run` script that starts the app listening on `127.0.0.1:8081`.
+- a `run` script that starts the app listening on `127.0.0.1:8081`, the default
+  of `SWRP_UPSTREAM_URL`.
 
 ```dockerfile
 # The smallwebwaf image, pinned by digest.
@@ -116,38 +190,43 @@ main "$@"
 ```
 
 Leave `ENTRYPOINT` and `USER` out of the app's `Dockerfile`. The image's own
-entrypoint starts `smallwebwaf` and the app side by side, each as its own user.
-
-Deploy the app's image as you deploy any app. Point traefik's labels at port
-8080 (`traefik.http.services.<name>.loadbalancer.server.port=8080`). Mount a
-volume at `/var/lib/smallwebwaf`, so that bans and history survive a deploy. For
-example, with no setting:
-
-```sh
-docker run --detach --name app \
-    --volume app-smallwebwaf:/var/lib/smallwebwaf \
-    <registry>/app@sha256:<digest>
-```
-
-With no setting, the address of every new visitor is sent to GeoJS, a web
-service, to find its country and network. `SWWAF_LOOKUP_SOURCE=off` sends
-nothing. `SWWAF_LOOKUP_SOURCE=file`, with `SWWAF_LOOKUP_DB_PATH` naming a
-database file on your own host, looks addresses up in that file (see "Lookup of
-AS number and country" in [`SPEC.md`](SPEC.md)).
+entrypoint starts `rproxy` and the app side by side, each as its own user. Run
+the app's image with `SWRP_WAF_BACKEND` set.
 
 `deploy/example-app` is such an app. `make example-app` builds it and checks it
-(see "Checking that it works" below). To run `smallwebwaf` outside the image
-while working on it, see "Entrypoints" below.
+(see "Checking that it works" below). To run `rproxy` and `servewaf` on the host
+while working on them, see `script/run` under "Entrypoints" below.
+
+### When `servewaf` is down, slow or overloaded
+
+`SWRP_DEFAULT_DISPOSITION` decides what `rproxy` does with a request when
+`servewaf`:
+
+- cannot be connected to;
+- does not answer at all;
+- does not answer within `SWRP_TIMEOUT_MS`, 2 seconds by default.
+
+Its default, `allow`, passes the request to the app without `servewaf`'s answer.
+`deny` answers `503` instead. Either way the request gets no report, so its
+bytes are not counted and it is not added to its client's history. When
+`servewaf` does answer, a `deny` or an error goes to the visitor as `servewaf`
+gave it, and `SWRP_DEFAULT_DISPOSITION` plays no part.
 
 ## What happens to a request
 
-`smallwebwaf` handles each request in fifteen steps, in this order. Once a step
-refuses a request, the steps after it are skipped, apart from step 15, and
+A request goes through fifteen steps, in this order. Once `servewaf` refuses a
+request, the steps after that are skipped, apart from the report of step 15, and
 nothing of the request reaches the app. "What happens to a request" in
 [`SPEC.md`](SPEC.md) gives each step in full, under the same numbers.
 
+`rproxy` takes the first two:
+
 1. The health check, `GET /_smallwebwaf/healthz`, is answered at once.
-2. The client is identified.
+2. The visitor's address is worked out, and `servewaf` is asked about the
+   request.
+
+`servewaf` takes the checks:
+
 3. The static lists, `SWWAF_ALLOW_NETS` and `SWWAF_DENY_NETS`.
 4. The bans.
 5. The lookup of the client's AS number and country.
@@ -157,31 +236,36 @@ nothing of the request reaches the app. "What happens to a request" in
 9. The rate limits.
 10. The trap paths.
 11. The rule files.
-12. The Core Rule Set.
-13. `smallwebwaf`'s own endpoints, under `/_smallwebwaf/`.
+12. The header limits, and then the Core Rule Set.
+13. A path under `/_smallwebwaf/` is answered `404`, so that the app never sees
+    that prefix.
+
+`rproxy` takes the rest, with `servewaf` counting at the end:
+
 14. The request is passed to the app.
-15. After the answer: the byte limits, the error burst and the client's history.
+15. After the answer, `rproxy` sends `servewaf` a report. For an allowed
+    request, `servewaf` counts the byte limits and adds the request to the
+    client's history.
 
 A refused visitor is answered with `SWWAF_BAN_RESPONSE`, `403` by default (see
 "Ban lengths, response and scope" in [`SPEC.md`](SPEC.md)). A `block` rule or a
-Core Rule Set match answers `403`. A missing or wrong token gets `401`. A
-request over a size or time limit gets the status for that limit, such as `413`
-for a body too large (see "Size and time limits" in [`SPEC.md`](SPEC.md)).
+Core Rule Set match answers `403`. `rproxy` itself answers `405` to a method it
+does not pass on, and the status for a size or time limit, such as `413` for a
+body too large (see "`rproxy`" in [`SPEC.md`](SPEC.md)).
 
 ## Settings you are likely to touch
 
-Each setting is an environment variable of the app's container, such as
-`docker run -e SWWAF_MODE=observe ...`, read at start.
+Each setting is an environment variable, read at start. Those of `servewaf`
+start with `SWWAF_`, and those of `rproxy` with `SWRP_`.
 [`docs/settings.md`](docs/settings.md) lists every setting, its default and the
 values it takes. The ones most deployments touch:
 
-- `SWWAF_MODE=observe`: `smallwebwaf` makes no ban of its own, and refuses a
-  request only for a size or time limit or a missing or wrong token. A request
-  it would have refused is passed to the app, and its log line says what
-  `enforce` mode would have done. For trying a configuration before enforcing
-  it.
+- `SWWAF_MODE=observe`: `servewaf` refuses nothing and makes no ban of its own.
+  A request it would have refused is passed to the app, and its log line says
+  what `enforce` mode would have done. For trying a configuration before
+  enforcing it. The limits of `rproxy` still apply.
 - `SWWAF_ALLOW_NETS`: netblocks you trust, such as your monitoring. Their
-  clients are refused only for a size or time limit or a missing or wrong token.
+  clients skip `servewaf`'s checks.
 - `SWWAF_RATE_LIMIT_EXEMPT_NETS`: netblocks exempt from rate limiting and the
   byte limits, such as a machine that talks to the app all day.
 - `SWWAF_TRAP_PATHS`: paths only scanners ask for, such as
@@ -191,39 +275,49 @@ values it takes. The ones most deployments touch:
   refuses your app's ordinary requests. The log line names the rules a request
   matched. Keep the six default ids in a list you give (see
   [`docs/settings.md`](docs/settings.md)).
-- `SWWAF_REQUEST_MAX_BYTES`, `SWWAF_CLIENT_REQUEST_TIMEOUT` and
-  `SWWAF_UPSTREAM_REQUEST_TIMEOUT`: raise them for an app that takes uploads
-  over 100 MiB or slower than 60 seconds.
+- `SWRP_MAX_REQUEST_SIZE` and `SWRP_MAX_REQUEST_TIME_MS`: raise them for an app
+  that takes uploads over 100 MiB or slower than 60 seconds.
+- `SWRP_DEFAULT_DISPOSITION`: `allow` (the default) or `deny`, as above.
+- `SWRP_TRUSTED_PROXIES`: the netblocks whose `X-Forwarded-For` `rproxy`
+  believes, by default the private address ranges.
 - `SWWAF_LOOKUP_SOURCE`: `geojs` (the default), `file` or `off`, as above.
 - `SWWAF_ADMIN_TOKEN` and `SWWAF_METRICS_TOKEN`: switch on the ban endpoints and
-  the metrics. Give them as files to keep them from the app.
+  the metrics, at `servewaf`'s own address.
 - `SWWAF_ALERT_WEBHOOK_URL`, `SWWAF_ALERT_SLACK_WEBHOOK_URL` or
   `SWWAF_ALERT_NTFY_URL`: where alerts go.
-- `SWWAF_INSTANCE_NAME`: the name in every log line, alert and metric, such as
-  `fsn1app1/gitea`.
+- `SWWAF_INSTANCE_NAME`: the name in every line `servewaf` logs, and in every
+  alert and metric, such as `fsn1/servewaf`.
 
 ## Checking that it works
 
 - `docker inspect --format '{{.State.Health.Status}}' <container>` says
-  `healthy` once `smallwebwaf` answers and the app accepts connections. A log
-  line with `"msg":"starting"` gives the version, the address and every setting
-  in effect, with secrets masked.
-- A request to the site through traefik gets the app's answer, and its log line
-  has `"action":"forward"`. `https://<site>/_smallwebwaf/healthz` answers `ok`.
-- To see a refusal without banning yourself, run the container with
-  `SWWAF_MODE=observe` and ask for `/.env`. The request reaches the app. Its log
-  line has `"would_action":"banned"` and `"rule_ids":["env-file"]`. In `enforce`
-  mode the same request bans your address for seven days, and your next request
-  makes the ban permanent. Lift the ban by editing `bans.json` (see "Bans" in
-  [`SPEC.md`](SPEC.md)).
-- With `SWWAF_METRICS_TOKEN` set,
-  `curl -H "Authorization: Bearer $TOKEN" https://<site>/_smallwebwaf/metrics`
-  answers with the metrics.
-- `make example-app` builds the image and the example app on it, runs the app,
-  and checks it. It needs network access. It checks:
-    - the health check;
-    - a request forwarded to the app;
+  `healthy` for each container of `smallwebwaf`:
+    - for `rproxy`, once it answers and the app accepts connections, whether or
+      not `servewaf` answers;
+    - for `servewaf`, once it answers.
+- A log line with `"msg":"starting"` gives the version, the address and every
+  setting in effect, with secrets masked.
+- A request to the site through traefik gets the app's answer.
+  `https://<site>/_smallwebwaf/healthz` answers `ok`. `servewaf`'s log lines
+  about the request have `"action":"forward"`.
+- To see a refusal without banning yourself, run `servewaf` with
+  `SWWAF_MODE=observe` and ask for `/.env`. The request reaches the app.
+  `servewaf`'s log lines have `"would_action":"banned"` and
+  `"rule_ids":["env-file"]`. In `enforce` mode the same request bans your
+  address for seven days, and your next request makes the ban permanent. Lift
+  the ban by editing `bans.json` (see "Bans" in [`SPEC.md`](SPEC.md)).
+- With `SWWAF_METRICS_TOKEN` set, this answers with the metrics, from a host on
+  `servewaf`'s network:
+  `curl -H "Authorization: Bearer $TOKEN" http://servewaf:8080/_smallwebwaf/metrics`.
+- `make example-app` builds the image and the example app on it, runs the app
+  with `rproxy` in its container and `servewaf` in another, and checks them. It
+  needs network access. It checks:
+    - the health checks;
+    - a request passed to the app;
     - a ban for a broken limit, and a ban for a probe made permanent;
+    - that only `servewaf`'s container changes the state directory's owner;
+    - with `servewaf` stopped, the app still answering through `rproxy`;
+    - with `servewaf` started again, bans applying again;
     - orderly stops with `sv stop` and `docker stop`;
     - bans surviving a new container on the same volume;
     - a setting given as a file.
@@ -266,21 +360,26 @@ on the host.
 - `script/install-precommit`: installs that hook. `make hooks`.
 - `script/build`: builds `bin/smallwebwaf` with the Go on your host.
   `make build`.
-- `script/run`: builds `bin/smallwebwaf` and runs it with the settings in your
-  environment, listening on port 8080 in front of an app at
-  `SWWAF_UPSTREAM_URL`. Its state files go in `bin/state` and its rule files are
-  those of `share/rules.d`, unless `SWWAF_STATE_DIR` and `SWWAF_RULES_DIR` say
-  otherwise. `make run`.
-- `script/example-app`: builds the image and the example app on it, runs it with
-  a volume, and checks it as "Checking that it works" above describes. Then it
-  removes the containers, volumes and images. Needs network access.
-  `make example-app`.
-- `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind it at
-  the defaults. It sends through it a sample of gitea's ordinary use and the
-  requests the Core Rule Set is known to refuse, and prints what `smallwebwaf`
-  did with each. Needs network access, and a docker daemon that pushes to a
-  registry on `localhost` over plain HTTP. [`docs/gitea.md`](docs/gitea.md)
-  records the results. `make gitea-requests`.
+- `script/run`: builds `bin/smallwebwaf` and runs `servewaf` and `rproxy` on the
+  host, with the settings in your environment. `make run`. Unless your settings
+  say otherwise:
+    - `rproxy` listens on port 8080, in front of an app at
+      `http://127.0.0.1:8081`;
+    - `servewaf` listens on port 8090;
+    - its state files go in `bin/state`;
+    - its rule files are those of `share/rules.d`.
+- `script/example-app`: builds the image and the example app on it, runs them
+  with a volume, and checks them as "Checking that it works" above describes.
+  Then it removes the containers, the network, the volumes and the images. Needs
+  network access. `make example-app`.
+- `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind
+  `rproxy` and `servewaf`, three containers on one network. Every setting is at
+  its default, but for those that join the containers and the header that labels
+  each request. It sends through them a sample of gitea's ordinary use and the
+  requests the Core Rule Set is known to refuse, and prints what `servewaf` did
+  with each. Needs network access, and a docker daemon that pushes to a registry
+  on `localhost` over plain HTTP. [`docs/gitea.md`](docs/gitea.md) records the
+  results. `make gitea-requests`.
 
 ## Rationale
 
@@ -293,16 +392,16 @@ Small self-hosted sites receive a great deal of traffic nobody asked for:
 
 Most of it comes from a small number of hosting networks and countries. A
 single-person operation has no abuse desk and no CDN contract. It needs
-something small that can be put in front of one service and left alone.
+something small that can be put in front of its services and left alone.
 
 The existing tools each solve part of this. Rule-based firewalls catch attack
 payloads but do not limit request rates. Rate limiters count requests but cannot
 tell a residential visitor from a rented server farm. The products that do most
-of it want several containers, a database and a web console. None of them can
-say "clients from these networks are banned after half as many requests as
-anyone else". That is the useful thing to say when nearly all abuse comes from a
-known list of AS numbers. [`EVALUATION.md`](EVALUATION.md) goes through the
-candidates one by one.
+of it want a database and a web console. None of them can say "clients from
+these networks are banned after half as many requests as anyone else". That is
+the useful thing to say when nearly all abuse comes from a known list of AS
+numbers. [`EVALUATION.md`](EVALUATION.md) goes through the candidates one by
+one.
 
 `smallwebwaf` fills that gap with:
 
@@ -310,8 +409,8 @@ candidates one by one.
 - lower limits for the networks and countries abuse comes from;
 - bans that grow with repetition;
 - a log that is easy to search and ship;
-- one binary in the app's own container, with no database and no required
-  setting.
+- a site that keeps answering while the part that decides is down;
+- one binary, with no database and one required setting.
 
 ## Design
 
@@ -321,38 +420,36 @@ nixpkgs fixed at one release. An app's `Dockerfile` installs a package with
 [`docs/image.md`](docs/image.md) lists what the image holds and how each part is
 pinned.
 
-- runit, a service supervisor, runs `smallwebwaf` and the app side by side, each
-  as its own user, and starts either again when it exits. The app cannot touch
-  the state files or the process of `smallwebwaf`.
-- `smallwebwaf` listens on port 8080 and passes requests to the app on
-  `127.0.0.1:8081`. The app listens on `127.0.0.1` only, so nothing reaches it
-  except through `smallwebwaf`. `smallwebwaf`'s own endpoints are under
-  `/_smallwebwaf/`, on the same port.
+- runit, a service supervisor, runs `smallwebwaf` and starts it again when it
+  exits. In an app's image built on the `smallwebwaf` image, it runs `rproxy`
+  and the app side by side, each as its own user.
+- `rproxy` listens on port 8080 and passes requests to the app at
+  `SWRP_UPSTREAM_URL`. It answers the health check itself, and the refusals and
+  errors "`rproxy`" in [`SPEC.md`](SPEC.md) lists.
+- `servewaf` listens on port 8080 of its own container. Nothing should route the
+  internet there. Its own endpoints, under `/_smallwebwaf/`, are for your admin
+  tools and your metrics collector.
+- `rproxy` and `servewaf` use no token between them. Anything on their private
+  network can ask `servewaf` a question, or send it a report.
 - The app sees the headers traefik sent, with traefik's address added to
-  `X-Forwarded-For`, from a TCP peer on `127.0.0.1`. So the app must trust
-  `127.0.0.1` and `::1` for forwarded headers, besides the private address
-  ranges.
-- Both processes start with the container's environment variables, so every
-  setting of `smallwebwaf` starts with `SWWAF_`, and the app can read a token
-  given as one. A token given as a file that only the `smallwebwaf` user can
-  read is out of its reach (see "Settings given as files" in
-  [`docs/settings.md`](docs/settings.md)).
-- The state files live in `/var/lib/smallwebwaf`. A volume mounted there keeps
-  them across a deploy.
-- `docker stop` stops both processes at once. `smallwebwaf` gives the requests
-  in progress five seconds to finish, so the app must keep answering for five
-  seconds after `SIGTERM`.
+  `X-Forwarded-For`, from a TCP peer that is `rproxy`. So the app must trust
+  `rproxy`'s address for forwarded headers. With `rproxy` in the app's
+  container, that address is `127.0.0.1` or `::1`, which the private address
+  ranges leave out.
+- The state files live in `/var/lib/smallwebwaf` in `servewaf`'s container. A
+  volume mounted there keeps them across a deploy.
+- `docker stop` gives requests in progress five seconds to finish. With `rproxy`
+  in the app's container, the app must keep answering for five seconds after
+  `SIGTERM` for that to help them.
 
-"Deployment" in [`SPEC.md`](SPEC.md) has the rest: the health check, what
-happens when a process stops, moving `smallwebwaf` to another port, and the
-forwarded headers. "Architecture" in [`SPEC.md`](SPEC.md) lists the packages and
-what each does.
+"Deployment" in [`SPEC.md`](SPEC.md) has the rest: the health checks, what
+happens when a process stops, moving a port, and the forwarded headers.
+"Architecture" in [`SPEC.md`](SPEC.md) lists the packages and what each does.
 
 ## TODO
 
-- Planned, as "Planned, not built" in [`SPEC.md`](SPEC.md) describes:
-    - sharing bans between the instances of several apps;
-    - sending the log over RELP.
+- Planned, as "Planned, not built" in [`SPEC.md`](SPEC.md) describes: sending
+  the log over RELP.
 
 ## Documents
 

cmd/smallwebwaf/main.go

@@ -1,6 +1,8 @@
-// Command smallwebwaf is a web application firewall for one app: it runs
-// between traefik and the app, and passes requests through within its
-// limits. Everything it does is in internal/smallwebwaf.
+// Command smallwebwaf is a web application firewall. `smallwebwaf rproxy` is
+// the reverse proxy in front of one app, which asks servewaf about each request.
+// `smallwebwaf servewaf` decides, for many sites, and keeps what lasts.
+// `smallwebwaf healthcheck` is the container's health check. Everything it does
+// is in internal/smallwebwaf.
 package main
 
 import (

docs/admin-endpoints.md

@@ -1,8 +1,8 @@
 # Admin endpoints
 
 The endpoints under `/_smallwebwaf/`, what each takes and what each answers.
-"Admin endpoints" in [`SPEC.md`](../SPEC.md) says which checks they go through
-and how their tokens work.
+`smallwebwaf servewaf` answers them at its own address, on the private network.
+"Admin endpoints" in [`SPEC.md`](../SPEC.md) says how their tokens work.
 
 - `GET /_smallwebwaf/healthz`: `200` and `ok`, to anyone.
 - `GET /_smallwebwaf/metrics`: the metrics, for `SWWAF_METRICS_TOKEN` (see
@@ -20,29 +20,41 @@ and how their tokens work.
     - one that names an IPv4-mapped netblock, or an address with a zone.
 - `DELETE /_smallwebwaf/bans/<client>`: lifts every active ban covering the
   address `<client>`. It answers `404` when none is active.
-- `GET /_smallwebwaf/clients/<ip>`: what `smallwebwaf` knows of the client.
-  Under `client`, its counters and history as `clients.json` holds them, or
-  `null` when `clients.json` does not hold it. Under `bans`, every ban covering
-  the address, with its notes.
+- `GET /_smallwebwaf/clients/<ip>`: what `servewaf` knows of the client. Under
+  `client`, its counters and history as `clients.json` holds them, or `null`
+  when `clients.json` does not hold it. Under `bans`, every ban covering the
+  address, with its notes.
+- `POST /_smallwebwaf/report`: takes `rproxy`'s report, without a token. It
+  answers `204`, or `400` to a body that is no report (see "The report" in
+  [`SPEC.md`](../SPEC.md)).
+
+No check runs on these requests. A missing or wrong token is answered `401`. An
+endpoint whose token is unset answers `404`, as does any other path.
+
+`smallwebwaf rproxy` answers only the health check of these, at its own address.
+It asks `servewaf` about any other request under `/_smallwebwaf/`. One that
+passes the checks is answered `404`, so that the app never sees that prefix (see
+"`rproxy`" in [`SPEC.md`](../SPEC.md)).
 
 ## Examples
 
-With `SWWAF_ADMIN_TOKEN` set, and the token in `$TOKEN`:
+With `SWWAF_ADMIN_TOKEN` set, the token in `$TOKEN`, and `servewaf` reached as
+`servewaf:8080` on its network:
 
 ```sh
 # Every ban.
-curl -H "Authorization: Bearer $TOKEN" https://app.example/_smallwebwaf/bans
+curl -H "Authorization: Bearer $TOKEN" http://servewaf:8080/_smallwebwaf/bans
 
 # Ban 203.0.113.0/24 for seven days.
 curl -H "Authorization: Bearer $TOKEN" \
     --json '{"netblock": "203.0.113.0/24", "duration": "7d", "reason": "probes for logins"}' \
-    https://app.example/_smallwebwaf/bans
+    http://servewaf:8080/_smallwebwaf/bans
 
 # Lift the bans on 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" -X DELETE \
-    https://app.example/_smallwebwaf/bans/203.0.113.9
+    http://servewaf:8080/_smallwebwaf/bans/203.0.113.9
 
-# What smallwebwaf knows of 203.0.113.9.
+# What servewaf knows of 203.0.113.9.
 curl -H "Authorization: Bearer $TOKEN" \
-    https://app.example/_smallwebwaf/clients/203.0.113.9
+    http://servewaf:8080/_smallwebwaf/clients/203.0.113.9
 ```

docs/alerts.md

@@ -6,7 +6,7 @@ back or dropped.
 
 ## Events
 
-- `ban`: a ban `smallwebwaf` made.
+- `ban`: a ban `servewaf` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
   a request.
 - `waf_block`: the Core Rule Set scored a request at or over the threshold. The
@@ -34,35 +34,36 @@ on one line:
 
 ```json
 {
-    "instance": "fsn1app1/gitea",
-    "time": "2026-10-06T12:00:00.123461Z",
+    "instance": "fsn1/servewaf",
+    "time": "2026-10-06T12:00:50.123461Z",
     "event": "ban",
+    "host": "app.example",
     "client": "203.0.113.9",
     "netblock": "203.0.113.9/32",
     "asn": "",
     "as_name": "",
     "country": "",
-    "reason": "requests per minute over the limit of 6000",
+    "reason": "requests per minute over the limit of 500",
     "detail": {
-        "ban_expires": "2026-10-06T13:00:00.123Z",
+        "ban_expires": "2026-10-06T13:00:50.123Z",
         "cause": "limit",
         "notes": {
             "asn": "",
             "as_name": "",
             "country": "",
             "kind": "requests",
-            "limit": 6000,
+            "limit": 500,
             "window": "minute",
-            "count": 6001,
+            "count": 501,
             "request": {
-                "time": "2026-10-06T12:00:00.123456789Z",
+                "time": "2026-10-06T12:00:50.123456789Z",
                 "method": "GET",
                 "host": "app.example",
-                "path": "/owner/repo/commits/branch/main?page=812",
+                "path": "/owner/repo/commits/branch/main?page=501",
                 "status": 403,
                 "user_agent": "scraper/1.0"
             },
-            "requests": 8210,
+            "requests": 501,
             "refused": 0,
             "earlier_bans": {
                 "limit": 0,
@@ -78,6 +79,9 @@ on one line:
 
 - `instance`: `SWWAF_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
   one of the events above.
+- `host`: the site of the request that raised the alert, since one `servewaf`
+  serves many sites. It is left out of `source_failure`, `file_error` and
+  `summary`.
 - `client`: the address whose request raised the alert. Empty for
   `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -89,7 +93,7 @@ on one line:
 - `asn`, `as_name` and `country`: the client's, as known when the alert was
   raised. They are empty when GeoJS had not answered yet.
 - `reason`: a short sentence, such as
-  `requests per minute over the limit of 6000` or `listed by a blocklist`.
+  `requests per minute over the limit of 500` or `listed by a blocklist`.
 - `detail`: what is particular to the event:
     - for a ban, its `cause`, `ban_expires` and `notes` (the notes are listed
       under `bans.json` in [`state-files.md`](state-files.md));
@@ -107,10 +111,10 @@ on one line:
 ## Slack and ntfy
 
 Slack and ntfy get a message with a title and a text. The title is the instance
-and the event, such as `fsn1app1/gitea: ban`. The text is the `reason`, then one
+and the event, such as `fsn1/servewaf: ban`. The text is the `reason`, then one
 line for each of these that the alert has:
 
-- the client, the netblock and the country;
+- the host, the client, the netblock and the country;
 - the file, the source, the error and the mode from `detail`;
 - the suppressed repeats, if any.
 

docs/gitea.md

@@ -2,10 +2,11 @@
 
 These notes record what `smallwebwaf` does in front of gitea at the default
 settings. They are observations, not requirements; the requirements are in
-[`SPEC.md`](../SPEC.md). `script/gitea-requests` runs gitea behind the image and
-sends through it a sample of gitea's ordinary use and the requests named below.
-It reports each request the Core Rule Set refuses, so that these notes can be
-checked again when gitea or the Core Rule Set changes version.
+[`SPEC.md`](../SPEC.md). `script/gitea-requests` runs gitea behind `rproxy` and
+`servewaf`, and sends through them a sample of gitea's ordinary use and the
+requests named below. It reports each request the Core Rule Set refuses, so that
+these notes can be checked again when gitea or the Core Rule Set changes
+version.
 
 ## What the defaults cover
 
@@ -13,7 +14,7 @@ checked again when gitea or the Core Rule Set changes version.
   by it.
 - A clone is a response. It fits the defaults of 30 minutes and 1 GiB unless the
   repository is large or the link slow. A repository whose clone is larger than
-  1 GiB needs `SWWAF_RESPONSE_MAX_BYTES` raised, and the byte limits with it
+  1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised, and the byte limits with it
   ("Byte limits, per client" in `SPEC.md`).
 - A push is a request, and so is every other upload:
     - a git push;
@@ -23,10 +24,9 @@ checked again when gitea or the Core Rule Set changes version.
     - a release attachment.
 
     At the defaults, an upload larger than 100 MiB or taking more than 60
-    seconds is cut off ("Size and time limits" in `SPEC.md`). A gitea that takes
-    large uploads needs `SWWAF_REQUEST_MAX_BYTES`,
-    `SWWAF_CLIENT_REQUEST_TIMEOUT` and `SWWAF_UPSTREAM_REQUEST_TIMEOUT` raised
-    to fit.
+    seconds is cut off ("`rproxy`'s limits" in `SPEC.md`). A gitea that takes
+    large uploads needs `SWRP_MAX_REQUEST_SIZE` and `SWRP_MAX_REQUEST_TIME_MS`
+    raised to fit.
 
 - Archive download and blame or history pages are what scrapers hammer. The
   request limits do most of the work there.
@@ -34,11 +34,13 @@ checked again when gitea or the Core Rule Set changes version.
   day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
   43,200 requests a day. While it runs a job, it reports the job's log and state
   every second instead, two requests a second. So one runner busy all day sends
-  172,800 requests, under the request limits. Six such runners on one address,
-  each busy all day, pass the day limit of 1,000,000 within two days; five stay
-  under it. Their address is then banned, their running jobs fail, and each
-  repeat within a day makes the ban longer. Newer runners ask for work less
-  often. Put the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+  120 requests a minute and 172,800 a day, under the request limits. Two such
+  runners on one address, each busy all day, make 345,600 and pass the day limit
+  of 300,000. Three busy at once make 21,600 an hour and pass the hour limit of
+  20,000. Five busy at once make 600 a minute and pass the minute limit of 500.
+  Their address is then banned, their running jobs fail, and each repeat within
+  a day makes the ban longer. Newer runners ask for work less often. Put the
+  runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ## What the Core Rule Set lets through
 

docs/image.md

@@ -1,14 +1,15 @@
 # What the image holds
 
-The contents of the `smallwebwaf` image, and how each part is pinned.
+The contents of the `smallwebwaf` image, and how each part is pinned. The image
+runs `rproxy` by default, or `servewaf` with `SMALLWEBWAF_COMMAND=servewaf`.
 "Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
 is pinned that way.
 
 ## Contents
 
 - Ubuntu 26.04 LTS, pinned by digest.
-- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
-  archive at `20261001T000000Z`.
+- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's normal mirrors, the
+  live archive, not a dated snapshot.
 - Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
   `nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
   Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
@@ -18,16 +19,15 @@ is pinned that way.
 - The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
 - The service directory `/etc/service/smallwebwaf`, with the `run` script
   `share/smallwebwaf.run`.
-- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
-  with the default rule file `share/rules.d/00-default.rules`.
+- `/var/lib/smallwebwaf` for `servewaf`'s state files, and
+  `/etc/smallwebwaf/rules.d` with the default rule file
+  `share/rules.d/00-default.rules`.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
 
 ## Pins
 
-- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
-  `apt-get update` and `apt-get install`. The SHA-256 hash of each of the
-  snapshot's `InRelease` files is named in the `Dockerfile` and checked after
-  `apt-get update`. The hashes are the amd64 archive's.
+- Ubuntu's packages are not pinned: they come from the live archive, whose
+  packages change with every update.
 - nixpkgs: the release file `nixexprs.tar.xz` of
   `nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
   SHA-256 hash.

docs/metrics.md

@@ -1,8 +1,9 @@
 # The metrics
 
-What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
-[`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
-label as `exported_instance` unless the scrape sets `honor_labels: true`.
+What `GET /_smallwebwaf/metrics` answers with, at `servewaf`'s own address.
+"Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus
+keeps the `instance` label as `exported_instance` unless the scrape sets
+`honor_labels: true`. `rproxy` has no metrics.
 
 ## Traffic
 
@@ -11,13 +12,13 @@ label as `exported_instance` unless the scrape sets `honor_labels: true`.
   `action`;
 - `smallwebwaf_request_duration_seconds` and
   `smallwebwaf_upstream_duration_seconds`, as histograms;
-- `smallwebwaf_requests_in_flight`.
+- `smallwebwaf_requests_in_flight`: the questions and requests to its own
+  endpoints that `servewaf` is handling.
 
 ## Limits and bans
 
 - `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
   `bytes` or `refusals`);
-- `smallwebwaf_size_and_time_limit_hits_total`, by `limit`, the setting passed;
 - `smallwebwaf_offences_total`, by `kind`;
 - `smallwebwaf_bans_made_total`, by `cause`;
 - `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
@@ -79,3 +80,14 @@ By `file`:
   `smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
   `smallwebwaf_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.
+
+## When a request is counted
+
+`servewaf` counts a denied request at its decision, and a request to its own
+endpoints when it is answered. It counts an allowed request when its report
+comes, with the status, bytes and times the report gives. These are not counted:
+
+- a report itself;
+- an allowed request whose report never comes;
+- a question refused with `400`;
+- a question whose body stopped arriving.

docs/request-log.md

@@ -1,18 +1,37 @@
 # The request log's fields
 
-The fields of the JSON object `smallwebwaf` writes for each request. "Request
-log" in [`SPEC.md`](../SPEC.md) says when a line is written and how the log is
-sent to a syslog server. A field that does not apply to a request is left out.
+The fields of the JSON objects `rproxy` and `servewaf` write about each request.
+"Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line is
+written and how the log is sent to a syslog server. A field that does not apply
+to a request is left out.
 
-## Example
+## `servewaf`'s lines
+
+`smallwebwaf servewaf` writes two lines for each question it answers, joined by
+`request_id`. The field `servewaf_line` says which of the two a line is:
+
+- `decision`: the line it writes once it has answered the question;
+- `report`: the line it writes when `rproxy`'s report comes, with everything
+  known. The repetition is intended.
+
+A request to its own endpoints writes one line, without `servewaf_line`. A
+report writes no line but the `report` line of the request it names.
+
+These questions write no line:
+
+- a question refused with `400` (see "The question" under "`servewaf`" in
+  [`SPEC.md`](../SPEC.md));
+- a question whose body stopped arriving, which gets no answer.
+
+A `report` line:
 
 ```
-{"type":"request","time":"2026-10-03T12:00:00.123Z","instance":"fsn1app1/gitea","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"response_content_type":"text/html; charset=utf-8","upstream_status":200,"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"duration_total":3.217,"duration_checks":0.041,"duration_upstream_connect":0.052,"duration_upstream_first_byte":2.874,"duration_upstream_total":3.104}
+{"type":"request","servewaf_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/servewaf","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"waf_score":0,"duration_total":3.217,"duration_checks":0.041,"duration_waf":0.029,"duration_upstream_total":3.104}
 ```
 
-## Every line
+### Every line
 
-Every line has:
+Every one of these lines has:
 
 - `type`: `request` (the process's own messages have `process`);
 - the standard web log fields;
@@ -20,21 +39,38 @@ Every line has:
 - `asn`, `as_name` and `country`;
 - `action` and `duration_total`.
 
-## Standard web log fields
+### Standard web log fields
 
-- `time`: when the request arrived, RFC 3339 with milliseconds, in UTC;
-- `instance`: `SWWAF_INSTANCE_NAME`;
-- `client_ip`, `method`, `scheme`, `host`, `path`, `query`, `protocol`;
-- `status`: what the client was sent, `0` if nothing;
-- `request_bytes` and `response_bytes`: body bytes each way;
+- `time`: when `servewaf` had read the question's body, RFC 3339 with
+  milliseconds, in UTC. The `report` line gives the same time as the `decision`
+  line.
+- `instance`: `SWWAF_INSTANCE_NAME`.
+- `client_ip`: the visitor's address, as `rproxy` worked it out.
+- `method`, `path` and `query`: the visitor's request.
+- `scheme`: how the visitor reached `rproxy` or the trusted proxy in front of
+  it.
+- `host`: the site the visitor asked for.
+- `protocol`: the question's own, `HTTP/1.1`.
+- `status`:
+    - on the `decision` line, what `servewaf` answered: `200` for `allow`, the
+      status of `deny`, or `0` for `close`, as the visitor is then sent nothing;
+    - on the `report` line, what the visitor got, `0` if nothing.
+- `request_bytes`:
+    - on the `decision` line, how much of the question's body the Core Rule Set
+      read;
+    - on the `report` line, the bytes of the visitor's body that `rproxy` read,
+      with what a WebSocket carried from the visitor.
+- `response_bytes`:
+    - on the `decision` line, the body of `servewaf`'s answer;
+    - on the `report` line, the bytes of the answer's body, with what a
+      WebSocket carried from the app.
 - `referer` and `user_agent`.
 
-## Request detail
+### Request detail
 
-- `request_id`: the `X-Request-ID` a trusted proxy sent, or a new random one of
-  26 letters and digits.
-- `peer_ip`: the TCP peer, normally traefik.
-- `forwarded_for`: the `X-Forwarded-For` header as received.
+- `request_id`: the id `rproxy` made for the request when it arrived.
+- `peer_ip`: the address of `rproxy`'s TCP peer, normally traefik.
+- `forwarded_for`: the `X-Forwarded-For` header the visitor's request came with.
 - `client_group`: the client as rate limiting counts it, an IPv4 address as a
   /32 or an IPv6 group.
 - `asn`, `as_name` and `country`: the client's, as looked up. Each is empty
@@ -42,34 +78,32 @@ Every line has:
     - lookups are off;
     - the client is not looked up;
     - the source cannot place the client;
-    - GeoJS had not answered by the time the request went on.
-- `content_type` and `content_length`: the request's own.
+    - GeoJS had not answered by the time `servewaf` answered.
+- `content_type`: the visitor's `Content-Type`.
+- `content_length`: the body length the visitor announced.
 - `request_headers`: the headers listed in `SWWAF_LOG_REQUEST_HEADERS`, by name
   in lower case.
 - `has_authorization` and `has_cookie`: true when the request had those headers.
   Their values are never logged.
-- `websocket`: true when the app switched the connection to another protocol.
 
-## Response detail
+### Response detail
 
-- `upstream_status`: what the app answered. It differs from `status` when
-  `smallwebwaf` answered itself.
-- `response_content_type`, `cache_control` and `location`: the answer's headers.
-- `aborted`: true when the client went away early.
+- `response_content_type`: the type of `servewaf`'s own answer.
+- `aborted`: true when `rproxy` went away before the answer.
 
-## Decision
+### Decision
 
 - `action`: what was done:
-    - `forward`: passed to the app;
+    - `forward`: answered `allow`, so that `rproxy` passes it to the app;
     - `denied`: refused for `SWWAF_DENY_NETS`, or for a reputation source with
       the action `deny`;
     - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
       CrowdSec decision, each of which bans the client;
     - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
       refused by that check;
-    - `too_large` and `timed_out`: a size or time limit was passed;
-    - `upstream_error`: the app could not be reached, or its answer broke off;
-    - `admin`: answered at one of `smallwebwaf`'s own endpoints.
+    - `too_large`: over a header limit;
+    - `admin`: answered at one of `servewaf`'s own endpoints, or `404` for a
+      path under `/_smallwebwaf/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
   request it would have refused. `action` then names what was done, normally
   `forward`.
@@ -83,7 +117,9 @@ Every line has:
     - `minute_bytes`, `hour_bytes` and `day_bytes`: bytes.
 
     A count can have a fraction (see "Counting method" in
-    [`SPEC.md`](../SPEC.md)).
+    [`SPEC.md`](../SPEC.md)). The bytes of an allowed request are counted when
+    its report comes. So on the `decision` line, the bytes are without this
+    request's.
 
 - `limit_hit`: the limit broken:
     - `minute`, `hour` or `day` for a rate limit;
@@ -91,7 +127,7 @@ Every line has:
     - `error_burst`.
 
     A request whose bytes broke a limit was passed on whole, so its `action`
-    stays `forward`.
+    stays `forward`. Only its `report` line gives that limit.
 
 - `rule_ids`: the rule file rules that matched, in order, up to the one that
   refused.
@@ -106,14 +142,65 @@ Every line has:
 - `ban_expires`: when the client's ban ends, for a request that made one or was
   refused under one: a time, or `permanent`.
 
-## Timings
+### Timings
 
 All in milliseconds:
 
-- `duration_total`: from the request's headers being read to its log line;
-- `duration_checks`: to the end of the checks, before forwarding;
+- `duration_total`:
+    - on the `decision` line, from `servewaf` having read the question's body to
+      the line;
+    - on the `report` line, from `rproxy` having read the request's headers to
+      the end of the answer.
+- `duration_checks`: to the end of the checks;
 - `duration_waf`: the part of that the Core Rule Set took;
-- `duration_upstream_connect`: from the hand-over to the app until there was a
-  connection;
-- `duration_upstream_first_byte`: until the first byte of the answer;
-- `duration_upstream_total`: until the end of the answer.
+- `duration_upstream_total`: on the `report` line of an allowed request, from
+  the hand-over to the app to the end of the answer.
+
+### Requests to its own endpoints
+
+The line of a request to `servewaf`'s own endpoints has these fields, with these
+meanings where they differ:
+
+- `client_ip` and `peer_ip`: the request's TCP peer.
+- `request_id`: a new random one of 26 letters and digits.
+- `scheme`: `http`.
+- `time`: when the request's headers had been read.
+- `request_bytes`: the bytes read of a ban to add, and otherwise `0`.
+- `action`: `admin`.
+- `duration_total`: from the request's headers being read to the line.
+
+## `rproxy`'s line
+
+`smallwebwaf rproxy` writes one short line for each request. `request_id` joins
+it to `servewaf`'s two. It has these fields and no others:
+
+- `type`: `request`.
+- `time`: when the request arrived, RFC 3339 with milliseconds, in UTC.
+- `request_id`: the id `rproxy` made for the request when it arrived.
+- `client_ip`: the visitor's address.
+- `host` and `method`.
+- `path` and `query`: as the visitor sent them.
+- `status`: what the visitor got, `0` if nothing.
+- `request_bytes`: the bytes of the visitor's body that `rproxy` read, with what
+  a WebSocket carried from the visitor.
+- `response_bytes`: the bytes of the answer's body, with what a WebSocket
+  carried from the app.
+- `duration_request`: milliseconds from the request's headers being read until
+  the app had been sent the whole request, or the answer started if that was
+  sooner. It includes the wait for `servewaf`.
+- `duration_response`: milliseconds from then until the end of the answer.
+- `disposition`: what was done with the request: `allow`, `deny` or `close`. It
+  is `servewaf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left
+  out when:
+    - `servewaf` was not asked, as for the health check;
+    - the visitor went away while `servewaf` was being asked;
+    - `servewaf`'s answer had no valid `X-Smallwebwaf-Disposition`;
+    - `rproxy` could not pass on `servewaf`'s answer, and answered `502`.
+- `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave
+  `disposition`, and otherwise left out.
+
+For example:
+
+```
+{"type":"request","time":"2026-10-03T12:00:00.123Z","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","client_ip":"203.0.113.9","host":"app.example","method":"GET","path":"/","query":"","status":200,"request_bytes":0,"response_bytes":5120,"duration_request":1.204,"duration_response":3.104,"disposition":"allow"}
+```

docs/rules.md

@@ -54,14 +54,19 @@ empty-agent      user_agent  log     ^$
 
 ## A file of your own
 
-An app's `Dockerfile` adds rules of its own in a file named to sort after the
-default, such as `50-gitea.rules`:
+`servewaf` reads the rule files in its own container. Rules of your own go in a
+file named to sort after the default, such as `50-gitea.rules`:
 
 ```
 # 50-gitea.rules: WordPress probes, which gitea never serves
 wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
 ```
 
+A `Dockerfile` built on the `smallwebwaf` image, for `servewaf` to run from,
+adds it:
+
 ```dockerfile
 COPY 50-gitea.rules /etc/smallwebwaf/rules.d/50-gitea.rules
 ```
+
+Or mount it there. A `path` rule applies on every site behind that `servewaf`.

docs/settings.md

@@ -4,6 +4,10 @@ Every setting, its default and the values it takes, in the groups of "Settings"
 in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
 that take `off`, the `_FILE` form, and what each group does and why.
 
+The settings that start with `SWWAF_` are `servewaf`'s. Those that start with
+`SWRP_` are `rproxy`'s, and are under "`rproxy`" below. `SMALLWEBWAF_COMMAND`
+chooses between the two (see "The image's command" below).
+
 ## Forms of values
 
 - A duration is Go's syntax, with `d` for days: `90s`, `15m`, `24h`, `7d`. Zero
@@ -24,26 +28,22 @@ that take `off`, the `_FILE` form, and what each group does and why.
 
 ## Core
 
-- `SWWAF_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
-  `https` URL with a host and an optional port, and nothing more.
-- `SWWAF_LISTEN_ADDR` (default `:8080`): where `smallwebwaf` listens: `:` and a
+- `SWWAF_LISTEN_ADDR` (default `:8080`): where `servewaf` listens: `:` and a
   port, such as `:9000`. Leave the host out (see "Ports" in
   [`SPEC.md`](../SPEC.md)).
 - `SWWAF_INSTANCE_NAME` (default: the container's host name): the `instance`
-  name in every log line, alert and metric, such as `fsn1app1/gitea`. Valid
-  UTF-8. No control character while `SWWAF_ALERT_NTFY_URL` is set. 1 to 48
-  printable ASCII characters without a space while `SWWAF_LOG_REMOTE_URL` is set
-  and `SWWAF_LOG_REMOTE_APP_NAME` is not.
+  name in each line `servewaf` logs, and in each alert and metric, such as
+  `fsn1/servewaf`. Valid UTF-8. No control character while
+  `SWWAF_ALERT_NTFY_URL` is set. 1 to 48 printable ASCII characters without a
+  space while `SWWAF_LOG_REMOTE_URL` is set and `SWWAF_LOG_REMOTE_APP_NAME` is
+  not.
 - `SWWAF_MODE` (default `enforce`): `enforce` or `observe`.
-- `SWWAF_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
-  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
-  nothing.
 - `SWWAF_IPV6_GROUP_PREFIX` (default `64`): the prefix length of an IPv6
   client's group, from 32 to 128.
 - `SWWAF_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole
   number above zero.
-- `SWWAF_MAX_BANS` (default `5000`): how many of its own bans `smallwebwaf`
-  keeps, a whole number above zero.
+- `SWWAF_MAX_BANS` (default `5000`): how many of its own bans `servewaf` keeps,
+  a whole number above zero.
 
 ## Tokens
 
@@ -63,7 +63,7 @@ that take `off`, the `_FILE` form, and what each group does and why.
 
 ## Logging
 
-- `SWWAF_LOG_LEVEL` (default `info`): the least severe of `smallwebwaf`'s own
+- `SWWAF_LOG_LEVEL` (default `info`): the least severe of `servewaf`'s own
   messages that are written: `debug`, `info`, `warn` or `error`.
 - `SWWAF_LOG_REQUEST_HEADERS` (default
   `accept,accept-language,accept-encoding,content-type,origin,range`): the
@@ -99,9 +99,21 @@ that take `off`, the `_FILE` form, and what each group does and why.
 
 ## Request rate limits, per client
 
-- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `6000`), `SWWAF_RATE_LIMIT_PER_HOUR`
-  (default `100000`) and `SWWAF_RATE_LIMIT_PER_DAY` (default `1000000`): the
-  most requests a client may make in each window. A count or `off`.
+- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `500`, about 8 a second): the most
+  requests a client may make in a minute. A count or `off`. The default catches,
+  within seconds, a client firing requests as fast as it can. It leaves room for
+  a fleet of about 20 agents at its busiest, about 120 requests a minute. It
+  also leaves room for a few quick first visits to gitea with an empty cache,
+  about 40 files each.
+- `SWWAF_RATE_LIMIT_PER_HOUR` (default `20000`, about 5.5 a second): the most
+  requests a client may make in an hour. A count or `off`. The default leaves
+  room for an automation fleet at work. It catches a client that keeps up more
+  than about 5.5 a second for an hour.
+- `SWWAF_RATE_LIMIT_PER_DAY` (default `300000`, about 3.5 a second): the most
+  requests a client may make in a day. A count or `off`. The default catches a
+  scraper that keeps up 4 a second around the clock.
+- Counting cannot catch a client that stays under all three limits (see "Request
+  rate limits, per client" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
   rate limiting and the byte limits, such as `/assets/`.
 
@@ -113,27 +125,6 @@ that take `off`, the `_FILE` form, and what each group does and why.
 - `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
   `response`, `request` or `both`.
 
-## Size and time limits
-
-- `SWWAF_CLIENT_REQUEST_TIMEOUT` (default `60s`): how long a client may take to
-  send its request line and headers, and then, from the end of the headers, its
-  body. A duration or `off`.
-- `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` (default `32K`): the largest request
-  line and headers. A size over `4K`; never `off`.
-- `SWWAF_CLIENT_IDLE_TIMEOUT` (default `120s`): how long a kept-open connection
-  may wait for its next request before it is closed. A duration or `off`.
-- `SWWAF_CLIENT_RESPONSE_TIMEOUT` (default `30m`): how long the answer may take
-  to reach the client, from the end of the request to the last byte. A duration
-  or `off`.
-- `SWWAF_UPSTREAM_REQUEST_TIMEOUT` (default `60s`): how long connecting to the
-  app and sending it the whole request may take. A duration or `off`.
-- `SWWAF_UPSTREAM_RESPONSE_TIMEOUT` (default `30m`): how long the app may take
-  to send its whole answer. A duration or `off`.
-- `SWWAF_REQUEST_MAX_BYTES` (default `100M`): the largest request body. A size
-  or `off`.
-- `SWWAF_RESPONSE_MAX_BYTES` (default `1G`): the largest response body. A size
-  or `off`.
-
 ## Lookup of AS number and country
 
 - `SWWAF_LOOKUP_SOURCE` (default `geojs`): `geojs`, `file` or `off`. `off` stops
@@ -145,11 +136,12 @@ that take `off`, the `_FILE` form, and what each group does and why.
     - an anomaly threshold per AS number.
 - `SWWAF_LOOKUP_DB_PATH` (default empty): the IPinfo Lite database file, in its
   `.mmdb` form, for `SWWAF_LOOKUP_SOURCE=file`.
-- `SWWAF_LOOKUP_TIMEOUT` (default `1s`): how long a request waits for its
+- `SWWAF_LOOKUP_TIMEOUT` (default `800ms`): how long a request waits for its
   client's first answer from GeoJS, and how long a request to GeoJS may take. A
   duration; never `off`.
-- `SWWAF_ADD_LOOKUP_HEADERS` (default `false`): `true` passes the app the
-  client's AS number in `X-Client-ASN` and its country in `X-Client-Country`.
+- `SWWAF_ADD_LOOKUP_HEADERS` (default `false`): `true` has `rproxy` pass the app
+  the client's AS number in `X-Client-ASN` and its country in
+  `X-Client-Country`.
 
 ## Country lists
 
@@ -194,7 +186,9 @@ that take `off`, the `_FILE` form, and what each group does and why.
 - `SWWAF_WAF_EXEMPT_PATHS` (default empty): path prefixes the Core Rule Set does
   not inspect.
 - `SWWAF_WAF_BODY_LIMIT` (default `off`): `off`, or how much of a request body
-  the Core Rule Set reads, a size of at most `1G`.
+  the Core Rule Set reads, a size of at most `64K`. A question carries no more
+  of a body than 64 KiB, and the Core Rule Set reads at most 64 KiB less one
+  byte of it, whatever the value (see "The answer" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_ERROR_BURST_THRESHOLD` (default `30`): the most refusals of one client
   in a minute (see "Attack detection" in `SPEC.md`). A count or `off`.
 
@@ -315,6 +309,7 @@ Then mount its directory into the container read-only, and name the file:
 ```sh
 docker run \
     -v /srv/app/tokens:/etc/smallwebwaf/tokens:ro \
+    -e SMALLWEBWAF_COMMAND=servewaf \
     -e SWWAF_METRICS_TOKEN_FILE=/etc/smallwebwaf/tokens/metrics \
     ...
 ```
@@ -327,4 +322,81 @@ A few limits are fixed rather than settings:
 - at most 100,000 DNS blocklist verdicts and 100,000 AbuseIPDB scores are kept;
 - at most 1,000 DNS blocklist queries are under way at once;
 - at most 20,000 anomaly counters are kept;
-- each alert destination's queue holds at most 1,000 alerts.
+- each alert destination's queue holds at most 1,000 alerts;
+- `servewaf` holds at most 10,000 answered requests awaiting their reports;
+- `servewaf` refuses a request with more than 50 cookies or more than 100 header
+  fields (see "Answering in time" under "`servewaf`" in
+  [`SPEC.md`](../SPEC.md));
+- `rproxy` takes a request line and headers of at most 32 KiB, and closes a
+  kept-open connection idle for 120 seconds;
+- `rproxy` reads at most 1 MiB of the body of `servewaf`'s answer, and answers
+  `502` to a longer one.
+
+## `servewaf`'s answer and `rproxy`'s wait
+
+`SWWAF_LOOKUP_TIMEOUT` is the longest a question waits on an outside source.
+Keep it well under `rproxy`'s `SWRP_TIMEOUT_MS`, as the default is. No question
+waits for `SWWAF_REPUTATION_TIMEOUT`, since the DNS blocklists and AbuseIPDB are
+asked in the background (see "Answering in time" under "`servewaf`" in
+[`SPEC.md`](../SPEC.md)).
+
+## `rproxy`
+
+`smallwebwaf rproxy` reads the settings below and no others. They are read once
+at start, and an invalid value stops the start. None can be given as a file,
+since `rproxy` never touches disk. "`rproxy`" in [`SPEC.md`](../SPEC.md) says
+what they do.
+
+A time here is a whole number of milliseconds above zero, such as `2000`.
+
+- `SWRP_WAF_BACKEND` (required, no default): `servewaf`'s URL. An `http` or
+  `https` URL with a host and an optional port, and nothing more. `rproxy`
+  speaks HTTP/1.1 to it.
+- `SWRP_TIMEOUT_MS` (default `2000`): how long `rproxy` waits for `servewaf`'s
+  answer, to a question and to a report. A time; never `off`.
+- `SWRP_DEFAULT_DISPOSITION` (default `allow`): what is done with a request when
+  `servewaf` cannot be connected to, does not answer at all, or does not answer
+  within `SWRP_TIMEOUT_MS`. `allow` passes it to the app, and `deny` answers
+  `503`. It does not apply to an answer `servewaf` gives, such as an error.
+- `SWRP_MAX_REQUEST_SIZE` (default `100M`): the largest request body. A size or
+  `off`.
+- `SWRP_MAX_RESPONSE_SIZE` (default `1G`): the largest response body. A size or
+  `off`.
+- `SWRP_MAX_REQUEST_TIME_MS` (default `60000`): how long the visitor may take to
+  send its request line and headers. It then also bounds, from the end of the
+  headers, the time until the app has been sent the whole request. A time or
+  `off`.
+- `SWRP_MAX_RESPONSE_TIME_MS` (default `1800000`): how long the answer may take,
+  from the end of the request to its last byte reaching the visitor. A time or
+  `off`.
+- `SWRP_LISTEN_ADDR` (default `:8080`): where `rproxy` listens, such as `:9000`.
+- `SWRP_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
+  `https` URL with a host and an optional port, and nothing more.
+- `SWRP_TRUSTED_PROXIES` (default `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`):
+  the netblocks whose `X-Forwarded-For` is believed. Set but empty, it trusts
+  nothing. A client outside these netblocks cannot claim another address. Where
+  other containers reach `rproxy` directly, or visitors on a private network
+  reach traefik, they can name another address in the header. Narrowing the
+  setting to traefik's own network closes that gap.
+
+## The image's command
+
+`SMALLWEBWAF_COMMAND` (default `rproxy`) chooses what the image runs and what
+its health check checks: `rproxy` or `servewaf` (see "Deployment" in
+[`SPEC.md`](../SPEC.md)). It cannot be given as a file.
+
+## Where earlier settings went
+
+Nothing reads these names any more:
+
+- `SWWAF_UPSTREAM_URL` is `SWRP_UPSTREAM_URL`.
+- `SWWAF_TRUSTED_PROXIES` is `SWRP_TRUSTED_PROXIES`.
+- `SWWAF_REQUEST_MAX_BYTES` is `SWRP_MAX_REQUEST_SIZE`.
+- `SWWAF_RESPONSE_MAX_BYTES` is `SWRP_MAX_RESPONSE_SIZE`.
+- `SWWAF_CLIENT_REQUEST_TIMEOUT` and `SWWAF_UPSTREAM_REQUEST_TIMEOUT` are
+  `SWRP_MAX_REQUEST_TIME_MS`, in milliseconds.
+- `SWWAF_CLIENT_RESPONSE_TIMEOUT` and `SWWAF_UPSTREAM_RESPONSE_TIMEOUT` are
+  `SWRP_MAX_RESPONSE_TIME_MS`, in milliseconds.
+- `SWWAF_CLIENT_IDLE_TIMEOUT` and `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` have
+  no setting. `rproxy` closes a kept-open connection idle for 120 seconds, and
+  takes a request line and headers of at most 32 KiB.

docs/state-files.md

@@ -7,7 +7,7 @@ Each has a top-level `version` of 1.
 ## `bans.json`
 
 Active and past bans: every ban an admin made, and up to `SWWAF_MAX_BANS` of
-those `smallwebwaf` made. Per entry:
+those `servewaf` made. Per entry:
 
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
 - `cause`: `attack`, `limit`, `admin` or `crowdsec`;
@@ -63,8 +63,8 @@ since it was first seen:
 - total requests, and how many were forwarded and how many refused;
 - bytes in each direction;
 - responses by status class;
-- offences by kind: `limit`, `attack`, `rule_blocked`, `waf_blocked` and
-  `token_refused`.
+- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
+  may also hold `token_refused`, which is kept, and which nothing adds to.
 
 ## `lookups.json`
 

internal/alerts/alerts.go

@@ -150,13 +150,16 @@ type Params struct {
 
 // Alert is one alert, as the webhook is sent it and alerts.json holds it,
 // with the fields of "The JSON object" in docs/alerts.md. ASN, ASName and
-// Country are, for a ban, the client's as the ban's notes give them.
+// Country are, for a ban, the client's as the ban's notes give them. Host is
+// the site of the request that raised the alert, while one servewaf serves
+// many sites, and "" otherwise.
 //
 //nolint:tagliatelle // docs/alerts.md names the alert's fields in snake_case
 type Alert struct {
 	Instance string       `json:"instance"`
 	Time     time.Time    `json:"time"`
 	Event    string       `json:"event"`
+	Host     string       `json:"host,omitempty"`
 	Client   netip.Addr   `json:"client"`
 	Netblock netip.Prefix `json:"netblock"`
 	ASN      string       `json:"asn"`
@@ -899,12 +902,16 @@ func title(alert *Alert) string {
 }
 
 // text returns the text of alert in Slack and ntfy: its reason, then a
-// line for each of its client, netblock and country, the file, source,
-// error and mode its detail gives, and its suppressed repeats, that it
-// has.
+// line for each of its host, client, netblock and country, the file,
+// source, error and mode its detail gives, and its suppressed repeats, that
+// it has.
 func text(alert *Alert) string {
 	lines := []string{alert.Reason}
 
+	if alert.Host != "" {
+		lines = append(lines, "host: "+alert.Host)
+	}
+
 	if alert.Client.IsValid() {
 		lines = append(lines, "client: "+alert.Client.String())
 	}

internal/alerts/alerts_test.go

@@ -1284,9 +1284,11 @@ func anAlertForEachEvent() []eventMessage {
 				Event: alerts.EventWAFBlock, Client: netip.MustParseAddr("192.0.2.1"),
 				Netblock: netip.MustParsePrefix("192.0.2.1/32"),
 				Reason:   "refused by the Core Rule Set",
+				Host:     "app.example",
 			},
 			"fsn1app1/gitea: waf_block", "default shield",
-			"refused by the Core Rule Set\nclient: 192.0.2.1\nnetblock: 192.0.2.1/32",
+			"refused by the Core Rule Set\nhost: app.example\nclient: 192.0.2.1\n" +
+				"netblock: 192.0.2.1/32",
 		},
 		{
 			alerts.Alert{

internal/anomaly/anomaly.go

@@ -103,6 +103,8 @@ type Counter struct {
 
 // Request is a request that has ended, as the counters count it.
 type Request struct {
+	// Host is the site the alert names, "" for none.
+	Host string
 	// Client is the client's address, and ClientGroup the client it is
 	// counted as: its IPv4 address, or the IPv6 netblock of
 	// SWWAF_IPV6_GROUP_PREFIX its address is in.
@@ -396,6 +398,7 @@ func alertFor(r Request, k key, o overThreshold) alerts.Alert {
 
 	return alerts.Alert{
 		Event:    alerts.EventAnomaly,
+		Host:     r.Host,
 		Client:   r.Client,
 		Netblock: k.netblock,
 		ASN:      r.ASN,

internal/config/config.go

@@ -1,7 +1,10 @@
-// Package config reads smallwebwaf's settings. Every setting is an
-// environment variable whose name starts with SWWAF_, or a file such a
-// variable names, every setting has a default, and this package is the
-// one place they are read.
+// Package config reads smallwebwaf's settings, and is the one place they are
+// read. Every setting is an environment variable. The settings of `smallwebwaf
+// servewaf` start with SWWAF_, every one of them has a default, and most can be
+// given as a file instead. Those of `smallwebwaf rproxy` start with SWRP_. Each
+// of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
+// since rproxy never touches disk. SMALLWEBWAF_COMMAND chooses which of the two
+// the image runs.
 package config
 
 import (
@@ -28,13 +31,11 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
-// Config is smallwebwaf's settings. A timeout, size or rate limit of zero
-// is off.
+// Config is the settings of `smallwebwaf servewaf`. A time or size limit of
+// zero is off.
 type Config struct {
-	// ListenAddr is where smallwebwaf listens (SWWAF_LISTEN_ADDR).
+	// ListenAddr is where servewaf listens (SWWAF_LISTEN_ADDR).
 	ListenAddr string
-	// UpstreamURL is the app (SWWAF_UPSTREAM_URL).
-	UpstreamURL *url.URL
 	// InstanceName is the name every log line and alert gives as instance,
 	// and every metric carries as its label instance (SWWAF_INSTANCE_NAME),
 	// by default the host's name, which docker sets to the first 12
@@ -43,42 +44,14 @@ type Config struct {
 	// Observe is true in observe mode, when SWWAF_MODE is observe rather
 	// than enforce: a request that SWWAF_DENY_NETS, a ban, the country
 	// lists, a rate limit, a rule or the Core Rule Set would refuse is
-	// passed to the app instead, and no ban is made.
+	// allowed instead, and no ban is made.
 	Observe bool
-	// TrustedProxies are the netblocks whose X-Forwarded-For is
-	// believed (SWWAF_TRUSTED_PROXIES).
-	TrustedProxies []netip.Prefix
 	// IPv6GroupPrefix is the length of the IPv6 netblock that is one client
 	// (SWWAF_IPV6_GROUP_PREFIX), from 32 to 128.
 	IPv6GroupPrefix int
 	// MaxTrackedClients is the most clients the table of clients holds, in
 	// memory and in clients.json (SWWAF_MAX_TRACKED_CLIENTS).
 	MaxTrackedClients int
-	// ClientRequestTimeout bounds reading the whole request from the
-	// client (SWWAF_CLIENT_REQUEST_TIMEOUT).
-	ClientRequestTimeout time.Duration
-	// ClientRequestHeaderMaxBytes is the largest request line and headers
-	// a client may send (SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES). It is
-	// never off, and always more than 4K.
-	ClientRequestHeaderMaxBytes int64
-	// ClientIdleTimeout bounds how long a kept-open client connection
-	// may wait for its next request (SWWAF_CLIENT_IDLE_TIMEOUT).
-	ClientIdleTimeout time.Duration
-	// ClientResponseTimeout bounds writing the whole response to the
-	// client (SWWAF_CLIENT_RESPONSE_TIMEOUT).
-	ClientResponseTimeout time.Duration
-	// UpstreamRequestTimeout bounds connecting to the app and writing
-	// the whole request to it (SWWAF_UPSTREAM_REQUEST_TIMEOUT).
-	UpstreamRequestTimeout time.Duration
-	// UpstreamResponseTimeout bounds reading the whole response from
-	// the app (SWWAF_UPSTREAM_RESPONSE_TIMEOUT).
-	UpstreamResponseTimeout time.Duration
-	// RequestMaxBytes is the largest request body
-	// (SWWAF_REQUEST_MAX_BYTES).
-	RequestMaxBytes int64
-	// ResponseMaxBytes is the largest response body
-	// (SWWAF_RESPONSE_MAX_BYTES).
-	ResponseMaxBytes int64
 	// AllowNets are the netblocks whose clients skip every check
 	// (SWWAF_ALLOW_NETS). RateLimitExemptNets are those whose clients the
 	// rate limits neither count nor refuse (SWWAF_RATE_LIMIT_EXEMPT_NETS).
@@ -258,9 +231,8 @@ type Config struct {
 	// attack (SWWAF_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that smallwebwaf may refuse after a rule file or Core Rule Set match
-	// or for a missing or wrong token; one more breaks a limit
-	// (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
+	// that servewaf may refuse after a rule file or Core Rule Set match; one
+	// more breaks a limit (SWWAF_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
 	// (SWWAF_LOG_REMOTE_URL), nil while it is unset and nothing is sent.
@@ -363,8 +335,8 @@ const (
 	// masked is what the log shows for a token that is set, and in place of
 	// a secret in another setting.
 	masked = "********"
-	// defaultListenAddr and defaultUpstreamURL are the defaults of
-	// SWWAF_LISTEN_ADDR and SWWAF_UPSTREAM_URL.
+	// defaultListenAddr is the default of SWWAF_LISTEN_ADDR and
+	// SWRP_LISTEN_ADDR, and defaultUpstreamURL that of SWRP_UPSTREAM_URL.
 	defaultListenAddr  = ":8080"
 	defaultUpstreamURL = "http://127.0.0.1:8081"
 )
@@ -392,13 +364,14 @@ var (
 	errHeaderTakenOut = errors.New(
 		"is taken out of every request by Go's HTTP server, so it can never " +
 			"be logged")
-	errOnBothLists          = errors.New("is in SWWAF_DENIED_COUNTRIES too")
-	errNotLookupSource      = errors.New("is not geojs, file or off")
-	errNeedsLookups         = errors.New("it needs each client looked up")
-	errNeedsDBPath          = errors.New("it names the file to look clients up in")
-	errDBPathUnused         = errors.New("only file reads it")
-	errNotOver4K            = errors.New("is not a size of more than 4K, such as 32K")
-	errOver1G               = errors.New("is more than 1G, the most Coraza reads")
+	errOnBothLists     = errors.New("is in SWWAF_DENIED_COUNTRIES too")
+	errNotLookupSource = errors.New("is not geojs, file or off")
+	errNeedsLookups    = errors.New("it needs each client looked up")
+	errNeedsDBPath     = errors.New("it names the file to look clients up in")
+	errDBPathUnused    = errors.New("only file reads it")
+	errOver64K         = errors.New(
+		"is more than 64K, the most servewaf gets of a body")
+	errNotCommand           = errors.New("is not rproxy or servewaf")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -487,38 +460,27 @@ var (
 func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	cfg := &Config{
-		ListenAddr:           env.address("SWWAF_LISTEN_ADDR", defaultListenAddr),
-		UpstreamURL:          env.appURL("SWWAF_UPSTREAM_URL", defaultUpstreamURL),
+		ListenAddr:           env.address("SWWAF_LISTEN_ADDR"),
 		InstanceName:         env.instanceName(),
 		Observe:              env.observe("SWWAF_MODE", "enforce"),
-		TrustedProxies:       env.netblocks("SWWAF_TRUSTED_PROXIES", privateRanges),
 		IPv6GroupPrefix:      env.ipv6GroupPrefix("SWWAF_IPV6_GROUP_PREFIX", "64"),
 		MaxTrackedClients:    env.numberNotOff("SWWAF_MAX_TRACKED_CLIENTS", "20000"),
-		ClientRequestTimeout: env.duration("SWWAF_CLIENT_REQUEST_TIMEOUT", "60s"),
-		ClientRequestHeaderMaxBytes: env.headerSize(
-			"SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES", "32K"),
-		ClientIdleTimeout:       env.duration("SWWAF_CLIENT_IDLE_TIMEOUT", "120s"),
-		ClientResponseTimeout:   env.duration("SWWAF_CLIENT_RESPONSE_TIMEOUT", "30m"),
-		UpstreamRequestTimeout:  env.duration("SWWAF_UPSTREAM_REQUEST_TIMEOUT", "60s"),
-		UpstreamResponseTimeout: env.duration("SWWAF_UPSTREAM_RESPONSE_TIMEOUT", "30m"),
-		RequestMaxBytes:         env.size("SWWAF_REQUEST_MAX_BYTES", "100M"),
-		ResponseMaxBytes:        env.size("SWWAF_RESPONSE_MAX_BYTES", "1G"),
-		AllowNets:               env.netblocks("SWWAF_ALLOW_NETS", ""),
-		RateLimitExemptNets:     env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
-		DenyNets:                env.netblocks("SWWAF_DENY_NETS", ""),
-		RateLimitPerMinute:      env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "6000"),
-		RateLimitPerHour:        env.count("SWWAF_RATE_LIMIT_PER_HOUR", "100000"),
-		RateLimitPerDay:         env.count("SWWAF_RATE_LIMIT_PER_DAY", "1000000"),
-		RateLimitExemptPaths:    env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
-		BytesLimitPerMinute:     env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
-		BytesLimitPerHour:       env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
-		BytesLimitPerDay:        env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
-		BytesCount:              env.bytesCount("SWWAF_BYTES_COUNT", "both"),
-		LookupSource:            env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
-		LookupDBPath:            env.value("SWWAF_LOOKUP_DB_PATH", ""),
-		LookupTimeout:           env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "1s"),
-		AddLookupHeaders:        env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
-		DeniedCountries:         env.countries("SWWAF_DENIED_COUNTRIES", ""),
+		AllowNets:            env.netblocks("SWWAF_ALLOW_NETS", ""),
+		RateLimitExemptNets:  env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
+		DenyNets:             env.netblocks("SWWAF_DENY_NETS", ""),
+		RateLimitPerMinute:   env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"),
+		RateLimitPerHour:     env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"),
+		RateLimitPerDay:      env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"),
+		RateLimitExemptPaths: env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
+		BytesLimitPerMinute:  env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"),
+		BytesLimitPerHour:    env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"),
+		BytesLimitPerDay:     env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"),
+		BytesCount:           env.bytesCount("SWWAF_BYTES_COUNT", "both"),
+		LookupSource:         env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
+		LookupDBPath:         env.value("SWWAF_LOOKUP_DB_PATH", ""),
+		LookupTimeout:        env.durationNotOff("SWWAF_LOOKUP_TIMEOUT", "800ms"),
+		AddLookupHeaders:     env.boolean("SWWAF_ADD_LOOKUP_HEADERS", "false"),
+		DeniedCountries:      env.countries("SWWAF_DENIED_COUNTRIES", ""),
 		ExclusivelyAllowedCountries: env.countries(
 			"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES", ""),
 		ASNLimitPercent:      env.percents("SWWAF_ASN_LIMIT_PERCENT", ParseASN),
@@ -610,22 +572,30 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 	return cfg, nil
 }
 
-// ListenAddrAndUpstreamURL reads only SWWAF_LISTEN_ADDR and
-// SWWAF_UPSTREAM_URL, either of which may be given as a file, as
-// FromEnvironment does. The health check needs no other setting, so it
-// reads no other, nor a file that another names.
-func ListenAddrAndUpstreamURL(
-	lookupEnv func(string) (string, bool),
-) (string, *url.URL, error) {
-	env := &environment{lookupEnv: lookupEnv}
-	listenAddr := env.address("SWWAF_LISTEN_ADDR", defaultListenAddr)
-	upstreamURL := env.appURL("SWWAF_UPSTREAM_URL", defaultUpstreamURL)
+// Command reads only SMALLWEBWAF_COMMAND, the command the image runs and its
+// health check checks: rproxy when it is unset or empty, or servewaf. It cannot
+// be given as a file. Any other value is an error that names the setting.
+func Command(lookupEnv func(string) (string, bool)) (string, error) {
+	command, _ := lookupEnv("SMALLWEBWAF_COMMAND")
 
-	if env.err != nil {
-		return "", nil, env.err
+	switch command {
+	case "", "rproxy":
+		return "rproxy", nil
+	case "servewaf":
+		return command, nil
+	default:
+		return "", fmt.Errorf("SMALLWEBWAF_COMMAND: %q %w", command, errNotCommand)
 	}
+}
 
-	return listenAddr, upstreamURL, nil
+// ServeWAFListenAddr reads only SWWAF_LISTEN_ADDR, which may be given as a
+// file, as FromEnvironment does. The health check in servewaf's container needs
+// no other setting, so it reads no other, nor a file that another names.
+func ServeWAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
+	env := &environment{lookupEnv: lookupEnv}
+	listenAddr := env.address("SWWAF_LISTEN_ADDR")
+
+	return listenAddr, env.err
 }
 
 // InstanceName reads only SWWAF_INSTANCE_NAME, which may be given as a
@@ -707,9 +677,10 @@ func (e *environment) check(name string, err error) {
 	}
 }
 
-// address reads a setting that is an address to listen on.
-func (e *environment) address(name, defaultValue string) string {
-	address, err := parseListenAddr(e.value(name, defaultValue))
+// address reads a setting that is an address to listen on, by default
+// defaultListenAddr.
+func (e *environment) address(name string) string {
+	address, err := parseListenAddr(e.value(name, defaultListenAddr))
 	e.check(name, err)
 
 	return address
@@ -777,15 +748,6 @@ func (e *environment) wafBodyLimit(name, defaultValue string) int64 {
 	return limit
 }
 
-// headerSize reads the setting that is the largest request line and
-// headers.
-func (e *environment) headerSize(name, defaultValue string) int64 {
-	size, err := parseHeaderSize(e.value(name, defaultValue))
-	e.check(name, err)
-
-	return size
-}
-
 // count reads a setting that is a number of requests.
 func (e *environment) count(name, defaultValue string) int64 {
 	count, err := parseCount(e.value(name, defaultValue))
@@ -1432,30 +1394,17 @@ func parseSize(value string) (int64, error) {
 	return n * unit, nil
 }
 
-// parseHeaderSize reads the largest request line and headers: a size as
-// parseSize reads it, but more than 4K and never off. Go's server reads 4K
-// past the limit it is given before it refuses, so proxy.New gives it this
-// size less 4K, which must leave a limit.
-func parseHeaderSize(value string) (int64, error) {
-	size, err := parseSize(value)
-	if err != nil || size <= 4*kibibyte {
-		return 0, fmt.Errorf("%q %w", value, errNotOver4K)
-	}
-
-	return size, nil
-}
-
 // parseWAFBodyLimit reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 1G, since
-// Coraza, which runs the Core Rule Set, refuses to load with more.
+// reads: a size as parseSize reads it, or off, but at most 64K, since servewaf
+// gets no more of a body than that.
 func parseWAFBodyLimit(value string) (int64, error) {
 	limit, err := parseSize(value)
 	if err != nil {
 		return 0, err
 	}
 
-	if limit > gibibyte {
-		return 0, fmt.Errorf("%q %w", value, errOver1G)
+	if limit > 64*kibibyte {
+		return 0, fmt.Errorf("%q %w", value, errOver64K)
 	}
 
 	return limit, nil

internal/config/config_test.go

@@ -23,98 +23,88 @@ import (
 
 // The settings, by name.
 const (
-	listenAddr              = "SWWAF_LISTEN_ADDR"
-	upstreamURL             = "SWWAF_UPSTREAM_URL"
-	mode                    = "SWWAF_MODE"
-	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
-	ipv6GroupPrefix         = "SWWAF_IPV6_GROUP_PREFIX"
-	maxTrackedClients       = "SWWAF_MAX_TRACKED_CLIENTS"
-	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
-	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
-	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
-	clientResponseTimeout   = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	upstreamRequestTimeout  = "SWWAF_UPSTREAM_REQUEST_TIMEOUT"
-	upstreamResponseTimeout = "SWWAF_UPSTREAM_RESPONSE_TIMEOUT"
-	requestMaxBytes         = "SWWAF_REQUEST_MAX_BYTES"
-	responseMaxBytes        = "SWWAF_RESPONSE_MAX_BYTES"
-	allowNets               = "SWWAF_ALLOW_NETS"
-	rateLimitExemptNets     = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
-	denyNets                = "SWWAF_DENY_NETS"
-	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerHour        = "SWWAF_RATE_LIMIT_PER_HOUR"
-	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths    = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
-	bytesLimitPerMinute     = "SWWAF_BYTES_LIMIT_PER_MINUTE"
-	bytesLimitPerHour       = "SWWAF_BYTES_LIMIT_PER_HOUR"
-	bytesLimitPerDay        = "SWWAF_BYTES_LIMIT_PER_DAY"
-	bytesCount              = "SWWAF_BYTES_COUNT"
-	lookupSource            = "SWWAF_LOOKUP_SOURCE"
-	lookupDBPath            = "SWWAF_LOOKUP_DB_PATH"
-	lookupTimeout           = "SWWAF_LOOKUP_TIMEOUT"
-	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
-	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
-	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	asnLimitPercent         = "SWWAF_ASN_LIMIT_PERCENT"
-	countryLimitPercent     = "SWWAF_COUNTRY_LIMIT_PERCENT"
-	asnBytesPercent         = "SWWAF_ASN_BYTES_PERCENT"
-	countryBytesPercent     = "SWWAF_COUNTRY_BYTES_PERCENT"
-	unknownLimitPercent     = "SWWAF_UNKNOWN_LIMIT_PERCENT"
-	asnLimitPercentURL      = "SWWAF_ASN_LIMIT_PERCENT_URL"
-	blocklistURLs           = "SWWAF_BLOCKLIST_URLS"
-	blocklistRefresh        = "SWWAF_BLOCKLIST_REFRESH"
-	blocklistAction         = "SWWAF_BLOCKLIST_ACTION"
-	dnsblZones              = "SWWAF_DNSBL_ZONES"
-	dnsblResolver           = "SWWAF_DNSBL_RESOLVER"
-	abuseIPDBKey            = "SWWAF_ABUSEIPDB_KEY"
-	abuseIPDBMinScore       = "SWWAF_ABUSEIPDB_MIN_SCORE"
-	abuseIPDBDailyBudget    = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
-	reputationAction        = "SWWAF_REPUTATION_ACTION"
-	reputationCacheTTL      = "SWWAF_REPUTATION_CACHE_TTL"
-	reputationTimeout       = "SWWAF_REPUTATION_TIMEOUT"
-	crowdSecURL             = "SWWAF_CROWDSEC_LAPI_URL"
-	crowdSecKey             = "SWWAF_CROWDSEC_LAPI_KEY"
-	banResponse             = "SWWAF_BAN_RESPONSE"
-	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
-	attackBanDuration       = "SWWAF_ATTACK_BAN_DURATION"
-	maxBans                 = "SWWAF_MAX_BANS"
-	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
-	stateDir                = "SWWAF_STATE_DIR"
-	stateWriteDelay         = "SWWAF_STATE_WRITE_DELAY"
-	stateCounterInterval    = "SWWAF_STATE_COUNTER_INTERVAL"
-	adminToken              = "SWWAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
-	metricsToken            = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
-	metricsTopN             = "SWWAF_METRICS_TOP_N"
-	instanceName            = "SWWAF_INSTANCE_NAME"
-	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
-	logLevel                = "SWWAF_LOG_LEVEL"
-	rulesDir                = "SWWAF_RULES_DIR"
-	rulesEnabled            = "SWWAF_RULES_ENABLED"
-	wafMode                 = "SWWAF_WAF_MODE"
-	wafParanoiaLevel        = "SWWAF_WAF_PARANOIA_LEVEL"
-	wafAnomalyThreshold     = "SWWAF_WAF_ANOMALY_THRESHOLD"
-	wafDisabledRules        = "SWWAF_WAF_DISABLED_RULES"
-	wafExemptPaths          = "SWWAF_WAF_EXEMPT_PATHS"
-	wafBodyLimit            = "SWWAF_WAF_BODY_LIMIT"
-	trapPaths               = "SWWAF_TRAP_PATHS"
-	errorBurstThreshold     = "SWWAF_ERROR_BURST_THRESHOLD"
-	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
-	logRemoteTLSCAFile      = "SWWAF_LOG_REMOTE_TLS_CA_FILE"
-	logRemoteBuffer         = "SWWAF_LOG_REMOTE_BUFFER"
-	logRemoteFacility       = "SWWAF_LOG_REMOTE_FACILITY"
-	logRemoteAppName        = "SWWAF_LOG_REMOTE_APP_NAME"
-	alertWebhookURL         = "SWWAF_ALERT_WEBHOOK_URL"
-	alertWebhookHeaders     = "SWWAF_ALERT_WEBHOOK_HEADERS"
-	alertSlackWebhookURL    = "SWWAF_ALERT_SLACK_WEBHOOK_URL"
-	alertNtfyURL            = "SWWAF_ALERT_NTFY_URL"
-	alertNtfyToken          = "SWWAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
-	alertEvents             = "SWWAF_ALERT_EVENTS"
-	alertCooldown           = "SWWAF_ALERT_COOLDOWN"
-	alertMaxPerHour         = "SWWAF_ALERT_MAX_PER_HOUR"
-	anomalyNetV4Prefix      = "SWWAF_ANOMALY_NET_V4_PREFIX"
-	anomalyNetV6Prefix      = "SWWAF_ANOMALY_NET_V6_PREFIX"
-	watchNets               = "SWWAF_WATCH_NETS"
+	listenAddr           = "SWWAF_LISTEN_ADDR"
+	mode                 = "SWWAF_MODE"
+	ipv6GroupPrefix      = "SWWAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWWAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWWAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWWAF_DENY_NETS"
+	rateLimitPerMinute   = "SWWAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerHour     = "SWWAF_RATE_LIMIT_PER_HOUR"
+	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
+	bytesLimitPerMinute  = "SWWAF_BYTES_LIMIT_PER_MINUTE"
+	bytesLimitPerHour    = "SWWAF_BYTES_LIMIT_PER_HOUR"
+	bytesLimitPerDay     = "SWWAF_BYTES_LIMIT_PER_DAY"
+	bytesCount           = "SWWAF_BYTES_COUNT"
+	lookupSource         = "SWWAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWWAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWWAF_ADD_LOOKUP_HEADERS"
+	deniedCountries      = "SWWAF_DENIED_COUNTRIES"
+	allowedCountries     = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	asnLimitPercent      = "SWWAF_ASN_LIMIT_PERCENT"
+	countryLimitPercent  = "SWWAF_COUNTRY_LIMIT_PERCENT"
+	asnBytesPercent      = "SWWAF_ASN_BYTES_PERCENT"
+	countryBytesPercent  = "SWWAF_COUNTRY_BYTES_PERCENT"
+	unknownLimitPercent  = "SWWAF_UNKNOWN_LIMIT_PERCENT"
+	asnLimitPercentURL   = "SWWAF_ASN_LIMIT_PERCENT_URL"
+	blocklistURLs        = "SWWAF_BLOCKLIST_URLS"
+	blocklistRefresh     = "SWWAF_BLOCKLIST_REFRESH"
+	blocklistAction      = "SWWAF_BLOCKLIST_ACTION"
+	dnsblZones           = "SWWAF_DNSBL_ZONES"
+	dnsblResolver        = "SWWAF_DNSBL_RESOLVER"
+	abuseIPDBKey         = "SWWAF_ABUSEIPDB_KEY"
+	abuseIPDBMinScore    = "SWWAF_ABUSEIPDB_MIN_SCORE"
+	abuseIPDBDailyBudget = "SWWAF_ABUSEIPDB_DAILY_BUDGET"
+	reputationAction     = "SWWAF_REPUTATION_ACTION"
+	reputationCacheTTL   = "SWWAF_REPUTATION_CACHE_TTL"
+	reputationTimeout    = "SWWAF_REPUTATION_TIMEOUT"
+	crowdSecURL          = "SWWAF_CROWDSEC_LAPI_URL"
+	crowdSecKey          = "SWWAF_CROWDSEC_LAPI_KEY"
+	banResponse          = "SWWAF_BAN_RESPONSE"
+	limitBanDuration     = "SWWAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWWAF_MAX_BAN_DURATION"
+	attackBanDuration    = "SWWAF_ATTACK_BAN_DURATION"
+	maxBans              = "SWWAF_MAX_BANS"
+	banScopeV4Prefix     = "SWWAF_BAN_SCOPE_V4_PREFIX"
+	stateDir             = "SWWAF_STATE_DIR"
+	stateWriteDelay      = "SWWAF_STATE_WRITE_DELAY"
+	stateCounterInterval = "SWWAF_STATE_COUNTER_INTERVAL"
+	adminToken           = "SWWAF_ADMIN_TOKEN"   //nolint:gosec // the setting's name
+	metricsToken         = "SWWAF_METRICS_TOKEN" //nolint:gosec // the setting's name
+	metricsTopN          = "SWWAF_METRICS_TOP_N"
+	instanceName         = "SWWAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWWAF_LOG_REQUEST_HEADERS"
+	logLevel             = "SWWAF_LOG_LEVEL"
+	rulesDir             = "SWWAF_RULES_DIR"
+	rulesEnabled         = "SWWAF_RULES_ENABLED"
+	wafMode              = "SWWAF_WAF_MODE"
+	wafParanoiaLevel     = "SWWAF_WAF_PARANOIA_LEVEL"
+	wafAnomalyThreshold  = "SWWAF_WAF_ANOMALY_THRESHOLD"
+	wafDisabledRules     = "SWWAF_WAF_DISABLED_RULES"
+	wafExemptPaths       = "SWWAF_WAF_EXEMPT_PATHS"
+	wafBodyLimit         = "SWWAF_WAF_BODY_LIMIT"
+	trapPaths            = "SWWAF_TRAP_PATHS"
+	errorBurstThreshold  = "SWWAF_ERROR_BURST_THRESHOLD"
+	logRemoteURL         = "SWWAF_LOG_REMOTE_URL"
+	logRemoteTLSCAFile   = "SWWAF_LOG_REMOTE_TLS_CA_FILE"
+	logRemoteBuffer      = "SWWAF_LOG_REMOTE_BUFFER"
+	logRemoteFacility    = "SWWAF_LOG_REMOTE_FACILITY"
+	logRemoteAppName     = "SWWAF_LOG_REMOTE_APP_NAME"
+	alertWebhookURL      = "SWWAF_ALERT_WEBHOOK_URL"
+	alertWebhookHeaders  = "SWWAF_ALERT_WEBHOOK_HEADERS"
+	alertSlackWebhookURL = "SWWAF_ALERT_SLACK_WEBHOOK_URL"
+	alertNtfyURL         = "SWWAF_ALERT_NTFY_URL"
+	alertNtfyToken       = "SWWAF_ALERT_NTFY_TOKEN" //nolint:gosec // the setting's name
+	alertEvents          = "SWWAF_ALERT_EVENTS"
+	alertCooldown        = "SWWAF_ALERT_COOLDOWN"
+	alertMaxPerHour      = "SWWAF_ALERT_MAX_PER_HOUR"
+	anomalyNetV4Prefix   = "SWWAF_ANOMALY_NET_V4_PREFIX"
+	anomalyNetV6Prefix   = "SWWAF_ANOMALY_NET_V6_PREFIX"
+	watchNets            = "SWWAF_WATCH_NETS"
 )
 
 // The anomaly thresholds: each of the prefixes below, which name a scope,
@@ -252,48 +242,34 @@ func TestDefaults(t *testing.T) {
 	cfg := fromEnvironment(t, environment{})
 
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:                  ":8080",
-		Observe:                     false,
-		ClientRequestTimeout:        time.Minute,
-		ClientRequestHeaderMaxBytes: 32 << 10,
-		ClientIdleTimeout:           2 * time.Minute,
-		ClientResponseTimeout:       30 * time.Minute,
-		UpstreamRequestTimeout:      time.Minute,
-		UpstreamResponseTimeout:     30 * time.Minute,
-		RequestMaxBytes:             100 << 20,
-		ResponseMaxBytes:            1 << 30,
-		RateLimitPerMinute:          6000,
-		RateLimitPerHour:            100000,
-		RateLimitPerDay:             1000000,
-		BanResponse:                 403,
-		LimitBanDuration:            time.Hour,
-		LimitBanRepeatWindow:        24 * time.Hour,
-		MaxBanDuration:              7 * 24 * time.Hour,
-		AttackBanDuration:           7 * 24 * time.Hour,
-		MaxBans:                     5000,
-		BanScopeV4Prefix:            32,
-		StateDir:                    "/var/lib/smallwebwaf",
-		StateWriteDelay:             10 * time.Second,
-		StateCounterInterval:        15 * time.Minute,
-		MetricsToken:                "",
-		MetricsTopN:                 50,
-		RulesDir:                    "/etc/smallwebwaf/rules.d",
-		RulesEnabled:                true,
+		ListenAddr:           ":8080",
+		Observe:              false,
+		RateLimitPerMinute:   500,
+		RateLimitPerHour:     20000,
+		RateLimitPerDay:      300000,
+		BanResponse:          403,
+		LimitBanDuration:     time.Hour,
+		LimitBanRepeatWindow: 24 * time.Hour,
+		MaxBanDuration:       7 * 24 * time.Hour,
+		AttackBanDuration:    7 * 24 * time.Hour,
+		MaxBans:              5000,
+		BanScopeV4Prefix:     32,
+		StateDir:             "/var/lib/smallwebwaf",
+		StateWriteDelay:      10 * time.Second,
+		StateCounterInterval: 15 * time.Minute,
+		MetricsToken:         "",
+		MetricsTopN:          50,
+		RulesDir:             "/etc/smallwebwaf/rules.d",
+		RulesEnabled:         true,
 	})
 	wantLookupSettings(t, cfg, config.Config{
-		LookupSource: defaultLookupSource, LookupTimeout: time.Second,
+		LookupSource: defaultLookupSource, LookupTimeout: 800 * time.Millisecond,
 	})
 	wantByteLimitSettings(t, cfg, config.Config{
 		BytesLimitPerMinute: 4 << 30, BytesLimitPerHour: 20 << 30,
 		BytesLimitPerDay: 200 << 30, BytesCount: "both",
 	})
 
-	if cfg.UpstreamURL.String() != "http://127.0.0.1:8081" {
-		t.Errorf("%s is %s", upstreamURL, cfg.UpstreamURL)
-	}
-
-	wantNetblocks(t, cfg.TrustedProxies,
-		"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
 	wantNetblocks(t, cfg.AllowNets)
 	wantNetblocks(t, cfg.RateLimitExemptNets)
 	wantNetblocks(t, cfg.DenyNets)
@@ -322,8 +298,13 @@ func TestNoSingleRequestBreaksAByteLimitAtTheDefaults(t *testing.T) {
 
 	cfg := fromEnvironment(t, environment{})
 
+	rproxy, err := rproxyConfig(map[string]string{wafBackend: backendURL})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
 	// The largest request body and the largest response, both counted.
-	largest := cfg.RequestMaxBytes + cfg.ResponseMaxBytes
+	largest := rproxy.MaxRequestSize + rproxy.MaxResponseSize
 	for _, limit := range []int64{
 		cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.BytesLimitPerDay,
 	} {
@@ -337,77 +318,54 @@ func TestValuesAsSet(t *testing.T) {
 	t.Parallel()
 
 	cfg := fromEnvironment(t, environment{
-		listenAddr:              "127.0.0.1:9000",
-		upstreamURL:             "https://app.internal:8443/",
-		mode:                    "observe",
-		trustedProxies:          " 192.0.2.1, 10.1.2.3/8 ,2001:db8::/32",
-		clientRequestTimeout:    "90s",
-		clientHeaderMaxBytes:    "8K",
-		clientIdleTimeout:       "5m",
-		clientResponseTimeout:   "7d",
-		upstreamRequestTimeout:  "1h30m",
-		upstreamResponseTimeout: off,
-		requestMaxBytes:         "512K",
-		responseMaxBytes:        "1234",
-		allowNets:               "192.0.2.7",
-		rateLimitExemptNets:     "2001:db8::/48, 10.9.8.7",
-		denyNets:                "198.51.100.0/24",
-		rateLimitPerMinute:      "60",
-		rateLimitPerHour:        "600",
-		rateLimitPerDay:         "6000",
-		deniedCountries:         "cn, RU,kp,Xk",
-		allowedCountries:        "de",
-		banResponse:             "429",
-		limitBanDuration:        "15m",
-		limitBanRepeatWindow:    "2d",
-		maxBanDuration:          "30d",
-		attackBanDuration:       "1d",
-		maxBans:                 "100",
-		banScopeV4Prefix:        "24",
-		stateDir:                "/srv/waf-state",
-		stateWriteDelay:         "500ms",
-		stateCounterInterval:    "1h",
-		metricsToken:            token,
-		metricsTopN:             "10",
-		rulesDir:                "/srv/waf-rules",
-		rulesEnabled:            "false",
+		listenAddr:           "127.0.0.1:9000",
+		mode:                 "observe",
+		allowNets:            "192.0.2.7",
+		rateLimitExemptNets:  "2001:db8::/48, 10.9.8.7",
+		denyNets:             "198.51.100.0/24",
+		rateLimitPerMinute:   "60",
+		rateLimitPerHour:     "600",
+		rateLimitPerDay:      "6000",
+		deniedCountries:      "cn, RU,kp,Xk",
+		allowedCountries:     "de",
+		banResponse:          "429",
+		limitBanDuration:     "15m",
+		limitBanRepeatWindow: "2d",
+		maxBanDuration:       "30d",
+		attackBanDuration:    "1d",
+		maxBans:              "100",
+		banScopeV4Prefix:     "24",
+		stateDir:             "/srv/waf-state",
+		stateWriteDelay:      "500ms",
+		stateCounterInterval: "1h",
+		metricsToken:         token,
+		metricsTopN:          "10",
+		rulesDir:             "/srv/waf-rules",
+		rulesEnabled:         "false",
 	})
 
 	wantSettings(t, cfg, config.Config{
-		ListenAddr:                  "127.0.0.1:9000",
-		Observe:                     true,
-		ClientRequestTimeout:        90 * time.Second,
-		ClientRequestHeaderMaxBytes: 8 << 10,
-		ClientIdleTimeout:           5 * time.Minute,
-		ClientResponseTimeout:       7 * 24 * time.Hour,
-		UpstreamRequestTimeout:      90 * time.Minute,
-		UpstreamResponseTimeout:     0,
-		RequestMaxBytes:             512 << 10,
-		ResponseMaxBytes:            1234,
-		RateLimitPerMinute:          60,
-		RateLimitPerHour:            600,
-		RateLimitPerDay:             6000,
-		BanResponse:                 429,
-		LimitBanDuration:            15 * time.Minute,
-		LimitBanRepeatWindow:        48 * time.Hour,
-		MaxBanDuration:              30 * 24 * time.Hour,
-		AttackBanDuration:           24 * time.Hour,
-		MaxBans:                     100,
-		BanScopeV4Prefix:            24,
-		StateDir:                    "/srv/waf-state",
-		StateWriteDelay:             500 * time.Millisecond,
-		StateCounterInterval:        time.Hour,
-		MetricsToken:                token,
-		MetricsTopN:                 10,
-		RulesDir:                    "/srv/waf-rules",
-		RulesEnabled:                false,
+		ListenAddr:           "127.0.0.1:9000",
+		Observe:              true,
+		RateLimitPerMinute:   60,
+		RateLimitPerHour:     600,
+		RateLimitPerDay:      6000,
+		BanResponse:          429,
+		LimitBanDuration:     15 * time.Minute,
+		LimitBanRepeatWindow: 48 * time.Hour,
+		MaxBanDuration:       30 * 24 * time.Hour,
+		AttackBanDuration:    24 * time.Hour,
+		MaxBans:              100,
+		BanScopeV4Prefix:     24,
+		StateDir:             "/srv/waf-state",
+		StateWriteDelay:      500 * time.Millisecond,
+		StateCounterInterval: time.Hour,
+		MetricsToken:         token,
+		MetricsTopN:          10,
+		RulesDir:             "/srv/waf-rules",
+		RulesEnabled:         false,
 	})
 
-	if cfg.UpstreamURL.String() != "https://app.internal:8443/" {
-		t.Errorf("%s is %s", upstreamURL, cfg.UpstreamURL)
-	}
-
-	wantNetblocks(t, cfg.TrustedProxies, "192.0.2.1/32", "10.0.0.0/8", "2001:db8::/32")
 	wantNetblocks(t, cfg.AllowNets, "192.0.2.7/32")
 	wantNetblocks(t, cfg.RateLimitExemptNets, "2001:db8::/48", "10.9.8.7/32")
 	wantNetblocks(t, cfg.DenyNets, "198.51.100.0/24")
@@ -581,13 +539,13 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			environment{
 				wafMode: config.WAFModeDetect, wafParanoiaLevel: "4", wafAnomalyThreshold: "10",
 				wafDisabledRules: "942100, 920350", wafExemptPaths: "/api/, /static/",
-				wafBodyLimit: "128K",
+				wafBodyLimit: "32K",
 			},
 			config.Config{
 				WAFMode: config.WAFModeDetect, WAFParanoiaLevel: 4, WAFAnomalyThreshold: 10,
 				WAFDisabledRules: []int{942100, 920350},
 				WAFExemptPaths:   []string{"/api/", "/static/"},
-				WAFBodyLimit:     128 << 10,
+				WAFBodyLimit:     32 << 10,
 			},
 		},
 		{
@@ -615,12 +573,12 @@ func TestCoreRuleSetSettings(t *testing.T) {
 	}
 }
 
-func TestWAFBodyLimitOf1G(t *testing.T) {
+func TestWAFBodyLimitOf64K(t *testing.T) {
 	t.Parallel()
 
-	cfg := fromEnvironment(t, environment{wafBodyLimit: "1G"})
-	if cfg.WAFBodyLimit != 1<<30 {
-		t.Errorf("1G read as %d", cfg.WAFBodyLimit)
+	cfg := fromEnvironment(t, environment{wafBodyLimit: "64K"})
+	if cfg.WAFBodyLimit != 64<<10 {
+		t.Errorf("64K read as %d", cfg.WAFBodyLimit)
 	}
 }
 
@@ -669,10 +627,10 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			wafBodyLimit, "128KB",
 			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
 		},
-		{wafBodyLimit, "2G", `"2G" is more than 1G, the most Coraza reads`},
+		{wafBodyLimit, "65K", `"65K" is more than 64K, the most servewaf gets of a body`},
 		{
-			wafBodyLimit, "1073741825",
-			`"1073741825" is more than 1G, the most Coraza reads`,
+			wafBodyLimit, "65537",
+			`"65537" is more than 64K, the most servewaf gets of a body`,
 		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
@@ -1165,7 +1123,7 @@ func TestLookupSettingsAsSet(t *testing.T) {
 
 	cfg = fromEnvironment(t, environment{lookupSource: off})
 	wantLookupSettings(t, cfg, config.Config{
-		LookupSource: off, LookupTimeout: time.Second,
+		LookupSource: off, LookupTimeout: 800 * time.Millisecond,
 	})
 }
 
@@ -1967,45 +1925,15 @@ func TestSizesAndOff(t *testing.T) {
 	t.Parallel()
 
 	cfg := fromEnvironment(t, environment{
-		requestMaxBytes:      "3G",
-		responseMaxBytes:     off,
-		clientRequestTimeout: off,
-		clientIdleTimeout:    off,
+		bytesLimitPerMinute: "3G",
+		bytesLimitPerHour:   off,
+		alertCooldown:       off,
 	})
 
-	if cfg.RequestMaxBytes != 3<<30 || cfg.ResponseMaxBytes != 0 ||
-		cfg.ClientRequestTimeout != 0 || cfg.ClientIdleTimeout != 0 {
-		t.Errorf("3G, off, off and off read as %d, %d, %s and %s",
-			cfg.RequestMaxBytes, cfg.ResponseMaxBytes, cfg.ClientRequestTimeout,
-			cfg.ClientIdleTimeout)
-	}
-}
-
-func TestRequestHeaderMaxBytesJustOver4K(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{clientHeaderMaxBytes: "4097"})
-	if cfg.ClientRequestHeaderMaxBytes != 4097 {
-		t.Errorf("4097 read as %d", cfg.ClientRequestHeaderMaxBytes)
-	}
-}
-
-func TestRequestHeaderMaxBytesRefusalNeverOffersOff(t *testing.T) {
-	t.Parallel()
-
-	for _, value := range []string{"32KB", "0", "4K", off} {
-		t.Run(value, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := config.FromEnvironment(
-				environment{clientHeaderMaxBytes: value}.lookupEnv)
-
-			want := clientHeaderMaxBytes + `: "` + value +
-				`" is not a size of more than 4K, such as 32K`
-			if err == nil || err.Error() != want {
-				t.Errorf("error %v, want %s", err, want)
-			}
-		})
+	if cfg.BytesLimitPerMinute != 3<<30 || cfg.BytesLimitPerHour != 0 ||
+		cfg.AlertCooldown != 0 {
+		t.Errorf("3G, off and off read as %d, %d and %s",
+			cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.AlertCooldown)
 	}
 }
 
@@ -2034,34 +1962,12 @@ func TestBanResponseCloseIsZero(t *testing.T) {
 	}
 }
 
-func TestTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
-	t.Parallel()
-
-	cfg := fromEnvironment(t, environment{trustedProxies: ""})
-	if len(cfg.TrustedProxies) != 0 {
-		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
-	}
-}
-
 func TestInvalidValueStopsTheStart(t *testing.T) {
 	t.Parallel()
 
 	wantStartStopped(t, []struct{ name, value string }{
 		{listenAddr, "8080"}, {listenAddr, ":http"}, {listenAddr, ":65536"},
-		{upstreamURL, "127.0.0.1:8081"},
-		{upstreamURL, "ftp://127.0.0.1:8081"},
-		{upstreamURL, "http://"},
-		{upstreamURL, "http://:8081"},
-		{upstreamURL, "http://127.0.0.1:0"},
-		{upstreamURL, "http://127.0.0.1:99999"},
-		{upstreamURL, "http://127.0.0.1:8081/app"},
-		{upstreamURL, "http://127.0.0.1:8081/?a=1"},
-		{upstreamURL, "http://user:secret@127.0.0.1:8081"},
 		{mode, "Observe"}, {mode, "block"}, {mode, ""},
-		{trustedProxies, "10.0.0.0/33"},
-		{trustedProxies, "traefik"},
-		{trustedProxies, "10.0.0.0/8,,192.168.0.0/16"},
-		{trustedProxies, "fe80::1%eth0"},
 		{ipv6GroupPrefix, "31"}, {ipv6GroupPrefix, "129"}, {ipv6GroupPrefix, "/64"},
 		{ipv6GroupPrefix, off}, {ipv6GroupPrefix, ""},
 		{maxTrackedClients, "0"}, {maxTrackedClients, "-1"}, {maxTrackedClients, off},
@@ -2069,19 +1975,18 @@ func TestInvalidValueStopsTheStart(t *testing.T) {
 		{allowNets, "192.0.2.0/24,monitoring"},
 		{rateLimitExemptNets, "2001:db8::/129"},
 		{denyNets, "198.51.100.0/24,"},
-		{clientRequestTimeout, "60"}, {clientRequestTimeout, ""},
-		{clientIdleTimeout, "0s"},
-		{clientIdleTimeout, "2 minutes"},
-		{clientResponseTimeout, "1y"},
-		{upstreamRequestTimeout, "-1s"},
-		{upstreamResponseTimeout, "0s"},
-		{upstreamResponseTimeout, "1.5d"},
-		{requestMaxBytes, "100MB"},
-		{requestMaxBytes, "100m"},
-		{requestMaxBytes, "1.5M"},
-		{responseMaxBytes, "0"},
-		{responseMaxBytes, "-5"},
-		{responseMaxBytes, "99999999999G"},
+		{alertCooldown, "60"}, {alertCooldown, ""},
+		{alertCooldown, "0s"},
+		{alertCooldown, "2 minutes"},
+		{alertCooldown, "1y"},
+		{alertCooldown, "-1s"},
+		{alertCooldown, "1.5d"},
+		{bytesLimitPerMinute, "100MB"},
+		{bytesLimitPerMinute, "100m"},
+		{bytesLimitPerMinute, "1.5M"},
+		{bytesLimitPerHour, "0"},
+		{bytesLimitPerHour, "-5"},
+		{bytesLimitPerHour, "99999999999G"},
 		{rateLimitPerMinute, ""},
 		{rateLimitPerMinute, "1K"},
 		{rateLimitPerHour, "0"},
@@ -2246,10 +2151,10 @@ func TestSettingFromFileIsCheckedAsTheSettingItself(t *testing.T) {
 	t.Parallel()
 
 	_, err := config.FromEnvironment(environment{
-		requestMaxBytes + "_FILE": writeFile(t, "lots\n"),
+		bytesLimitPerMinute + "_FILE": writeFile(t, "lots\n"),
 	}.lookupEnv)
 
-	want := requestMaxBytes + `: "lots" is not a size such as 512K, 100M or 5G, or off`
+	want := bytesLimitPerMinute + `: "lots" is not a size such as 512K, 100M or 5G, or off`
 	if err == nil || err.Error() != want {
 		t.Errorf("error %v, want %s", err, want)
 	}
@@ -2354,99 +2259,89 @@ func writeFile(t *testing.T, contents string) string {
 func TestLogsEachSettingWithItsValue(t *testing.T) {
 	t.Parallel()
 
-	cfg := fromEnvironment(t, environment{clientRequestTimeout: "45s"})
+	cfg := fromEnvironment(t, environment{rateLimitPerMinute: "45"})
 	hostname, _ := os.Hostname()
 
 	want := map[string]string{
-		listenAddr:              ":8080",
-		upstreamURL:             "http://127.0.0.1:8081",
-		mode:                    "enforce",
-		trustedProxies:          "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
-		ipv6GroupPrefix:         "64",
-		maxTrackedClients:       "20000",
-		clientRequestTimeout:    "45s",
-		clientHeaderMaxBytes:    "32K",
-		clientIdleTimeout:       "120s",
-		clientResponseTimeout:   "30m",
-		upstreamRequestTimeout:  "60s",
-		upstreamResponseTimeout: "30m",
-		requestMaxBytes:         "100M",
-		responseMaxBytes:        "1G",
-		allowNets:               "",
-		rateLimitExemptNets:     "",
-		denyNets:                "",
-		rateLimitPerMinute:      "6000",
-		rateLimitPerHour:        "100000",
-		rateLimitPerDay:         "1000000",
-		rateLimitExemptPaths:    "",
-		bytesLimitPerMinute:     "4G",
-		bytesLimitPerHour:       "20G",
-		bytesLimitPerDay:        "200G",
-		bytesCount:              "both",
-		lookupSource:            defaultLookupSource,
-		lookupDBPath:            "",
-		lookupTimeout:           "1s",
-		addLookupHeaders:        "false",
-		deniedCountries:         "",
-		allowedCountries:        "",
-		asnLimitPercent:         "",
-		countryLimitPercent:     "",
-		asnBytesPercent:         "",
-		countryBytesPercent:     "",
-		unknownLimitPercent:     "100",
-		asnLimitPercentURL:      "",
-		blocklistURLs:           "",
-		blocklistRefresh:        "24h",
-		blocklistAction:         actionDeny,
-		dnsblZones:              "",
-		dnsblResolver:           "",
-		abuseIPDBKey:            "",
-		abuseIPDBMinScore:       "75",
-		abuseIPDBDailyBudget:    "900",
-		reputationAction:        "limit:25",
-		reputationCacheTTL:      defaultReputationCacheTTL,
-		reputationTimeout:       "2s",
-		crowdSecURL:             "",
-		crowdSecKey:             "",
-		banResponse:             "403",
-		limitBanDuration:        "1h",
-		limitBanRepeatWindow:    "24h",
-		maxBanDuration:          "7d",
-		attackBanDuration:       "7d",
-		maxBans:                 "5000",
-		banScopeV4Prefix:        "32",
-		stateDir:                "/var/lib/smallwebwaf",
-		stateWriteDelay:         "10s",
-		stateCounterInterval:    "15m",
-		adminToken:              "",
-		metricsToken:            "",
-		metricsTopN:             "50",
-		instanceName:            hostname,
-		logRequestHeaders:       defaultLogRequestHeaders,
-		logLevel:                "info",
-		rulesDir:                "/etc/smallwebwaf/rules.d",
-		rulesEnabled:            "true",
-		wafMode:                 config.WAFModeBlock,
-		wafParanoiaLevel:        "1",
-		wafAnomalyThreshold:     "5",
-		wafDisabledRules:        defaultWAFDisabledRules,
-		wafExemptPaths:          "",
-		wafBodyLimit:            off,
-		trapPaths:               "",
-		errorBurstThreshold:     "30",
-		logRemoteURL:            "",
-		logRemoteTLSCAFile:      "",
-		logRemoteBuffer:         "10000",
-		logRemoteFacility:       "local0",
-		logRemoteAppName:        hostname,
-		alertWebhookURL:         "",
-		alertWebhookHeaders:     "",
-		alertSlackWebhookURL:    "",
-		alertNtfyURL:            "",
-		alertNtfyToken:          "",
-		alertEvents:             defaultAlertEvents,
-		alertCooldown:           defaultAlertCooldown,
-		alertMaxPerHour:         "60",
+		listenAddr:           ":8080",
+		mode:                 "enforce",
+		ipv6GroupPrefix:      "64",
+		maxTrackedClients:    "20000",
+		allowNets:            "",
+		rateLimitExemptNets:  "",
+		denyNets:             "",
+		rateLimitPerMinute:   "45",
+		rateLimitPerHour:     "20000",
+		rateLimitPerDay:      "300000",
+		rateLimitExemptPaths: "",
+		bytesLimitPerMinute:  "4G",
+		bytesLimitPerHour:    "20G",
+		bytesLimitPerDay:     "200G",
+		bytesCount:           "both",
+		lookupSource:         defaultLookupSource,
+		lookupDBPath:         "",
+		lookupTimeout:        "800ms",
+		addLookupHeaders:     "false",
+		deniedCountries:      "",
+		allowedCountries:     "",
+		asnLimitPercent:      "",
+		countryLimitPercent:  "",
+		asnBytesPercent:      "",
+		countryBytesPercent:  "",
+		unknownLimitPercent:  "100",
+		asnLimitPercentURL:   "",
+		blocklistURLs:        "",
+		blocklistRefresh:     "24h",
+		blocklistAction:      actionDeny,
+		dnsblZones:           "",
+		dnsblResolver:        "",
+		abuseIPDBKey:         "",
+		abuseIPDBMinScore:    "75",
+		abuseIPDBDailyBudget: "900",
+		reputationAction:     "limit:25",
+		reputationCacheTTL:   defaultReputationCacheTTL,
+		reputationTimeout:    "2s",
+		crowdSecURL:          "",
+		crowdSecKey:          "",
+		banResponse:          "403",
+		limitBanDuration:     "1h",
+		limitBanRepeatWindow: "24h",
+		maxBanDuration:       "7d",
+		attackBanDuration:    "7d",
+		maxBans:              "5000",
+		banScopeV4Prefix:     "32",
+		stateDir:             "/var/lib/smallwebwaf",
+		stateWriteDelay:      "10s",
+		stateCounterInterval: "15m",
+		adminToken:           "",
+		metricsToken:         "",
+		metricsTopN:          "50",
+		instanceName:         hostname,
+		logRequestHeaders:    defaultLogRequestHeaders,
+		logLevel:             "info",
+		rulesDir:             "/etc/smallwebwaf/rules.d",
+		rulesEnabled:         "true",
+		wafMode:              config.WAFModeBlock,
+		wafParanoiaLevel:     "1",
+		wafAnomalyThreshold:  "5",
+		wafDisabledRules:     defaultWAFDisabledRules,
+		wafExemptPaths:       "",
+		wafBodyLimit:         off,
+		trapPaths:            "",
+		errorBurstThreshold:  "30",
+		logRemoteURL:         "",
+		logRemoteTLSCAFile:   "",
+		logRemoteBuffer:      "10000",
+		logRemoteFacility:    "local0",
+		logRemoteAppName:     hostname,
+		alertWebhookURL:      "",
+		alertWebhookHeaders:  "",
+		alertSlackWebhookURL: "",
+		alertNtfyURL:         "",
+		alertNtfyToken:       "",
+		alertEvents:          defaultAlertEvents,
+		alertCooldown:        defaultAlertCooldown,
+		alertMaxPerHour:      "60",
 	}
 	maps.Copy(want, loggedAnomalyDefaults())
 
@@ -2481,14 +2376,6 @@ func wantSettings(t *testing.T, got *config.Config, want config.Config) {
 
 	if got.ListenAddr != want.ListenAddr ||
 		got.Observe != want.Observe ||
-		got.ClientRequestTimeout != want.ClientRequestTimeout ||
-		got.ClientRequestHeaderMaxBytes != want.ClientRequestHeaderMaxBytes ||
-		got.ClientIdleTimeout != want.ClientIdleTimeout ||
-		got.ClientResponseTimeout != want.ClientResponseTimeout ||
-		got.UpstreamRequestTimeout != want.UpstreamRequestTimeout ||
-		got.UpstreamResponseTimeout != want.UpstreamResponseTimeout ||
-		got.RequestMaxBytes != want.RequestMaxBytes ||
-		got.ResponseMaxBytes != want.ResponseMaxBytes ||
 		got.RateLimitPerMinute != want.RateLimitPerMinute ||
 		got.RateLimitPerHour != want.RateLimitPerHour ||
 		got.RateLimitPerDay != want.RateLimitPerDay {

internal/config/rproxy.go

@@ -0,0 +1,192 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+	"math"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// RProxy is the settings of `smallwebwaf rproxy`. A size or time limit of zero
+// is off.
+type RProxy struct {
+	// ListenAddr is where rproxy listens (SWRP_LISTEN_ADDR).
+	ListenAddr string
+	// UpstreamURL is the app (SWRP_UPSTREAM_URL).
+	UpstreamURL *url.URL
+	// TrustedProxies are the netblocks whose X-Forwarded-For is believed
+	// (SWRP_TRUSTED_PROXIES).
+	TrustedProxies []netip.Prefix
+	// WAFBackend is servewaf's URL (SWRP_WAF_BACKEND).
+	WAFBackend *url.URL
+	// Timeout is how long rproxy waits for servewaf's answer to a question,
+	// and to a report (SWRP_TIMEOUT_MS). It cannot be off.
+	Timeout time.Duration
+	// DefaultDisposition is what is done with a request when servewaf cannot be
+	// connected to, does not answer at all, or does not answer within Timeout:
+	// allow or deny (SWRP_DEFAULT_DISPOSITION).
+	DefaultDisposition string
+	// MaxRequestSize is the largest request body (SWRP_MAX_REQUEST_SIZE), and
+	// MaxResponseSize the largest response body (SWRP_MAX_RESPONSE_SIZE).
+	MaxRequestSize  int64
+	MaxResponseSize int64
+	// MaxRequestTime bounds sending the whole request: the visitor's request
+	// line and headers, and then, from their end, its body on its way to the
+	// app (SWRP_MAX_REQUEST_TIME_MS). MaxResponseTime bounds the answer, from
+	// the end of the request to its last byte reaching the visitor
+	// (SWRP_MAX_RESPONSE_TIME_MS).
+	MaxRequestTime  time.Duration
+	MaxResponseTime time.Duration
+
+	// settings are the values read, as given or by default, for the log line
+	// at start.
+	settings []slog.Attr
+}
+
+var (
+	errNeedsWAFBackend = errors.New(
+		"is required: it is servewaf's URL, such as http://servewaf:8080")
+	errNotDisposition  = errors.New("is not allow or deny")
+	errNotMilliseconds = errors.New(
+		"is not a whole number of milliseconds above zero, such as 2000")
+	errNotMillisecondsOrOff = errors.New(
+		"is not a whole number of milliseconds above zero, such as 60000, or off")
+)
+
+// RProxyFromEnvironment reads rproxy's settings with lookupEnv, normally
+// os.LookupEnv. A setting that is not set takes its default, and
+// SWRP_WAF_BACKEND, which has none, must be set. A setting that is set but
+// invalid is an error that names it. Since rproxy never touches disk, its
+// settings have no _FILE form.
+func RProxyFromEnvironment(lookupEnv func(string) (string, bool)) (*RProxy, error) {
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+	cfg := &RProxy{
+		ListenAddr:         env.address("SWRP_LISTEN_ADDR"),
+		UpstreamURL:        env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL),
+		TrustedProxies:     env.netblocks("SWRP_TRUSTED_PROXIES", privateRanges),
+		WAFBackend:         env.wafBackend("SWRP_WAF_BACKEND"),
+		Timeout:            env.milliseconds("SWRP_TIMEOUT_MS", "2000"),
+		DefaultDisposition: env.disposition("SWRP_DEFAULT_DISPOSITION", "allow"),
+		MaxRequestSize:     env.size("SWRP_MAX_REQUEST_SIZE", "100M"),
+		MaxResponseSize:    env.size("SWRP_MAX_RESPONSE_SIZE", "1G"),
+		MaxRequestTime:     env.millisecondsOrOff("SWRP_MAX_REQUEST_TIME_MS", "60000"),
+		MaxResponseTime:    env.millisecondsOrOff("SWRP_MAX_RESPONSE_TIME_MS", "1800000"),
+	}
+
+	if env.err != nil {
+		return nil, env.err
+	}
+
+	cfg.settings = env.settings
+
+	return cfg, nil
+}
+
+// RProxyListenAddrAndUpstreamURL reads only SWRP_LISTEN_ADDR and
+// SWRP_UPSTREAM_URL. The health check in rproxy's container needs no other
+// setting, so it reads no other.
+func RProxyListenAddrAndUpstreamURL(
+	lookupEnv func(string) (string, bool),
+) (string, *url.URL, error) {
+	env := &environment{lookupEnv: withoutFileForms(lookupEnv)}
+	listenAddr := env.address("SWRP_LISTEN_ADDR")
+	upstreamURL := env.appURL("SWRP_UPSTREAM_URL", defaultUpstreamURL)
+
+	if env.err != nil {
+		return "", nil, env.err
+	}
+
+	return listenAddr, upstreamURL, nil
+}
+
+// withoutFileForms returns lookupEnv finding no setting named with _FILE, since
+// rproxy never touches disk.
+func withoutFileForms(
+	lookupEnv func(string) (string, bool),
+) func(string) (string, bool) {
+	return func(name string) (string, bool) {
+		if strings.HasSuffix(name, "_FILE") {
+			return "", false
+		}
+
+		return lookupEnv(name)
+	}
+}
+
+// LogValue makes an RProxy log as each setting's name with the value it was
+// given, or its default.
+func (c *RProxy) LogValue() slog.Value {
+	return slog.GroupValue(c.settings...)
+}
+
+// wafBackend reads the setting that is servewaf's URL, which must be set.
+func (e *environment) wafBackend(name string) *url.URL {
+	value := e.value(name, "")
+	if value == "" {
+		e.check(name, errNeedsWAFBackend)
+
+		return nil
+	}
+
+	backend, err := parseUpstreamURL(value)
+	e.check(name, err)
+
+	return backend
+}
+
+// disposition reads the setting that is what is done with a request when servewaf
+// cannot be connected to, does not answer at all, or does not answer in time:
+// allow or deny.
+func (e *environment) disposition(name, defaultValue string) string {
+	value := e.value(name, defaultValue)
+	if value != "allow" && value != "deny" {
+		e.check(name, fmt.Errorf("%q %w", value, errNotDisposition))
+	}
+
+	return value
+}
+
+// milliseconds reads a setting that is a whole number of milliseconds above
+// zero.
+func (e *environment) milliseconds(name, defaultValue string) time.Duration {
+	value := e.value(name, defaultValue)
+
+	duration, valid := parseMilliseconds(value)
+	if !valid {
+		e.check(name, fmt.Errorf("%q %w", value, errNotMilliseconds))
+	}
+
+	return duration
+}
+
+// millisecondsOrOff reads a setting that is a whole number of milliseconds
+// above zero, or off, which is 0.
+func (e *environment) millisecondsOrOff(name, defaultValue string) time.Duration {
+	value := e.value(name, defaultValue)
+	if value == off {
+		return 0
+	}
+
+	duration, valid := parseMilliseconds(value)
+	if !valid {
+		e.check(name, fmt.Errorf("%q %w", value, errNotMillisecondsOrOff))
+	}
+
+	return duration
+}
+
+// parseMilliseconds reads a whole number of milliseconds above zero, and
+// reports whether it is one.
+func parseMilliseconds(value string) (time.Duration, bool) {
+	n, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || n <= 0 || n > math.MaxInt64/int64(time.Millisecond) {
+		return 0, false
+	}
+
+	return time.Duration(n) * time.Millisecond, true
+}

internal/config/rproxy_test.go

@@ -0,0 +1,231 @@
+package config_test
+
+import (
+	"net/netip"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+// rproxy's settings, by name, and their values in these tests.
+const (
+	wafBackend        = "SWRP_WAF_BACKEND"
+	rproxyTimeout     = "SWRP_TIMEOUT_MS"
+	rproxyDefault     = "SWRP_DEFAULT_DISPOSITION"
+	rproxyListen      = "SWRP_LISTEN_ADDR"
+	rproxyUpstream    = "SWRP_UPSTREAM_URL"
+	rproxyTrusted     = "SWRP_TRUSTED_PROXIES"
+	rproxyMaxRequest  = "SWRP_MAX_REQUEST_SIZE"
+	rproxyMaxResponse = "SWRP_MAX_RESPONSE_SIZE"
+	rproxyRequestTime = "SWRP_MAX_REQUEST_TIME_MS"
+	rproxyAnswerTime  = "SWRP_MAX_RESPONSE_TIME_MS"
+	backendURL        = "http://servewaf:8080"
+	rproxyDefaultAddr = ":8080"
+	rproxyDefaultApp  = "http://127.0.0.1:8081"
+	notASize          = "a lot"
+)
+
+// rproxyConfig reads rproxy's settings from env.
+func rproxyConfig(env map[string]string) (*config.RProxy, error) {
+	return config.RProxyFromEnvironment(func(name string) (string, bool) {
+		value, ok := env[name]
+
+		return value, ok
+	})
+}
+
+func TestRProxyDefaults(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if cfg.ListenAddr != rproxyDefaultAddr ||
+		cfg.UpstreamURL.String() != rproxyDefaultApp ||
+		cfg.WAFBackend.String() != backendURL {
+		t.Errorf("addresses %q, %v, %v", cfg.ListenAddr, cfg.UpstreamURL, cfg.WAFBackend)
+	}
+
+	if cfg.Timeout != 2*time.Second || cfg.DefaultDisposition != "allow" {
+		t.Errorf("timeout %v, default disposition %q", cfg.Timeout, cfg.DefaultDisposition)
+	}
+
+	if cfg.MaxRequestSize != 100<<20 || cfg.MaxResponseSize != 1<<30 {
+		t.Errorf("sizes %d and %d", cfg.MaxRequestSize, cfg.MaxResponseSize)
+	}
+
+	if cfg.MaxRequestTime != time.Minute || cfg.MaxResponseTime != 30*time.Minute {
+		t.Errorf("times %v and %v", cfg.MaxRequestTime, cfg.MaxResponseTime)
+	}
+
+	want := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("172.16.0.0/12"),
+		netip.MustParsePrefix("192.168.0.0/16"),
+	}
+	if !slices.Equal(cfg.TrustedProxies, want) {
+		t.Errorf("trusted proxies %v, want %v", cfg.TrustedProxies, want)
+	}
+}
+
+func TestRProxySettingsAreRead(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{
+		wafBackend:        "https://waf.example:8443",
+		rproxyListen:      ":9000",
+		rproxyUpstream:    "http://app:3000",
+		rproxyTrusted:     "192.0.2.0/24",
+		rproxyTimeout:     "150",
+		rproxyDefault:     "deny",
+		rproxyMaxRequest:  "1K",
+		rproxyMaxResponse: off,
+		rproxyRequestTime: off,
+		rproxyAnswerTime:  "250",
+	})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if cfg.ListenAddr != ":9000" || cfg.UpstreamURL.Host != "app:3000" ||
+		cfg.WAFBackend.Host != "waf.example:8443" ||
+		cfg.TrustedProxies[0] != netip.MustParsePrefix("192.0.2.0/24") {
+		t.Errorf("addresses %+v", cfg)
+	}
+
+	if cfg.Timeout != 150*time.Millisecond || cfg.DefaultDisposition != "deny" ||
+		cfg.MaxRequestSize != 1024 || cfg.MaxResponseSize != 0 ||
+		cfg.MaxRequestTime != 0 || cfg.MaxResponseTime != 250*time.Millisecond {
+		t.Errorf("limits %+v", cfg)
+	}
+}
+
+func TestRProxyInvalidSettingsAreRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, value string
+	}{
+		{wafBackend, ""},
+		{wafBackend, "servewaf:8080"},
+		{wafBackend, "http://servewaf:8080/path"},
+		{rproxyTimeout, "0"},
+		{rproxyTimeout, "-1"},
+		{rproxyTimeout, off},
+		{rproxyTimeout, "2s"},
+		{rproxyTimeout, "1.25"},
+		{rproxyTimeout, "99999999999999999"},
+		{rproxyDefault, "maybe"},
+		{rproxyListen, "8080"},
+		{rproxyUpstream, "app"},
+		{rproxyUpstream, "127.0.0.1:8081"},
+		{rproxyUpstream, "ftp://127.0.0.1:8081"},
+		{rproxyUpstream, "http://"},
+		{rproxyUpstream, "http://:8081"},
+		{rproxyUpstream, "http://127.0.0.1:0"},
+		{rproxyUpstream, "http://127.0.0.1:99999"},
+		{rproxyUpstream, "http://127.0.0.1:8081/app"},
+		{rproxyUpstream, "http://127.0.0.1:8081/?a=1"},
+		{rproxyUpstream, "http://user:secret@127.0.0.1:8081"},
+		{rproxyTrusted, "not a netblock"},
+		{rproxyTrusted, "10.0.0.0/33"},
+		{rproxyTrusted, "10.0.0.0/8,,192.168.0.0/16"},
+		{rproxyTrusted, "fe80::1%eth0"},
+		{rproxyMaxRequest, notASize},
+		{rproxyMaxResponse, notASize},
+		{rproxyRequestTime, "0"},
+		{rproxyRequestTime, "1m"},
+		{rproxyAnswerTime, "0"},
+	} {
+		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := rproxyConfig(map[string]string{wafBackend: backendURL, tc.name: tc.value})
+			if err == nil || !strings.HasPrefix(err.Error(), tc.name+": ") {
+				t.Errorf("error %v, want one naming %s", err, tc.name)
+			}
+		})
+	}
+}
+
+func TestRProxyTrustedProxiesSetButEmptyTrustNothing(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL, rproxyTrusted: ""})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	if len(cfg.TrustedProxies) != 0 {
+		t.Errorf("trusted proxies %v, want none", cfg.TrustedProxies)
+	}
+}
+
+func TestRProxyNeedsItsBackend(t *testing.T) {
+	t.Parallel()
+
+	_, err := rproxyConfig(nil)
+	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+		t.Errorf("error %v, want one saying %s is required", err, wafBackend)
+	}
+}
+
+func TestRProxyReadsNoFile(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "backend")
+
+	err := os.WriteFile(path, []byte("http://from-a-file:8080\n"), 0o600)
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	_, err = rproxyConfig(map[string]string{wafBackend + "_FILE": path})
+	if err == nil || !strings.HasPrefix(err.Error(), wafBackend+": is required") {
+		t.Errorf("error %v, want %s still required", err, wafBackend)
+	}
+
+	cfg, err := rproxyConfig(map[string]string{
+		wafBackend:              backendURL,
+		rproxyTimeout + "_FILE": "/nonexistent/timeout",
+	})
+	if err != nil {
+		t.Fatalf("settings: %v, with the file left unread", err)
+	}
+
+	if cfg.Timeout != 2*time.Second {
+		t.Errorf("timeout %v, want the default", cfg.Timeout)
+	}
+}
+
+func TestRProxySettingsAreLoggedByName(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := rproxyConfig(map[string]string{wafBackend: backendURL})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	group := cfg.LogValue().Group()
+
+	names := make([]string, 0, len(group))
+	for _, attr := range group {
+		names = append(names, attr.Key)
+	}
+
+	for _, name := range []string{
+		rproxyListen, rproxyUpstream, rproxyTrusted, wafBackend, rproxyTimeout, rproxyDefault,
+		rproxyMaxRequest, rproxyMaxResponse, rproxyRequestTime, rproxyAnswerTime,
+	} {
+		if !slices.Contains(names, name) {
+			t.Errorf("%s is not logged, only %v", name, names)
+		}
+	}
+}

internal/lookup/lookup.go

@@ -179,7 +179,7 @@ func New(params Params) *GeoJS {
 // own address for IPv4, and an address in the same place for an IPv6
 // netblock.
 func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
-	answer, asked := g.answerOrWait(ctx, client)
+	answer, asked := g.answerOrWait(ctx, client, g.wait)
 	if asked == nil {
 		return answer
 	}
@@ -209,6 +209,14 @@ func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
 	return answer
 }
 
+// LookUpWithoutWaiting is LookUp for a request that does not need the answer,
+// whatever Wait says: it returns the zero Answer at once when none is kept.
+func (g *GeoJS) LookUpWithoutWaiting(ctx context.Context, client netip.Prefix) Answer {
+	answer, _ := g.answerOrWait(ctx, client, false)
+
+	return answer
+}
+
 // Kept returns client's answer, if one is kept, without asking GeoJS.
 func (g *GeoJS) Kept(client netip.Prefix) (Answer, bool) {
 	g.mu.Lock()
@@ -263,9 +271,9 @@ func (g *GeoJS) Load(answers []Answer) {
 // answerOrWait returns client's kept answer if it has one. Otherwise it
 // puts the client among those waiting if there is room, has GeoJS asked
 // about them if it can be, and returns what to wait on for the answer, or
-// nil when there is nothing to wait for.
+// nil when there is nothing to wait for or mustWait is false.
 func (g *GeoJS) answerOrWait(
-	ctx context.Context, client netip.Prefix,
+	ctx context.Context, client netip.Prefix, mustWait bool,
 ) (Answer, <-chan struct{}) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
@@ -283,7 +291,7 @@ func (g *GeoJS) answerOrWait(
 
 	g.ask(ctx)
 
-	if !g.wait {
+	if !mustWait {
 		return Answer{}, nil // the answer is not needed before the request goes on
 	}
 

internal/lookup/lookup_test.go

@@ -72,6 +72,39 @@ func TestKeptAnswerIsUsedFor7DaysThenAskedAgain(t *testing.T) {
 	})
 }
 
+func TestLookUpWithoutWaitingAsksGeoJSAndGoesOnAtOnce(t *testing.T) {
+	t.Parallel()
+
+	synctest.Test(t, func(t *testing.T) {
+		geojs, clock, g := start()
+		client := netip.MustParsePrefix("203.0.113.9/32")
+
+		// Wait is set, and GeoJS does not answer.
+		geojs.set(hanging)
+
+		began := time.Now()
+		answer := g.LookUpWithoutWaiting(t.Context(), client)
+
+		if waited := time.Since(began); waited != 0 || answer != (lookup.Answer{}) {
+			t.Errorf("got %+v after %s, want no answer at once", answer, waited)
+		}
+
+		waitForRequests(t, geojs, 1)
+		wantAsked(t, geojs, 0, "203.0.113.9")
+
+		// That request is abandoned, and has failed once this returns. GeoJS
+		// answers when it is asked again, and the answer is kept.
+		time.Sleep(timeout)
+		synctest.Wait()
+		geojs.set(answering)
+		waitForCountry(t, g, clock, client, germany)
+
+		if got := g.LookUpWithoutWaiting(t.Context(), client).Country; got != germany {
+			t.Errorf("the kept answer gives the country %q, want %q", got, germany)
+		}
+	})
+}
+
 func TestNewClientWaitsAtMostOneSecondThenCountsAsNotFound(t *testing.T) {
 	t.Parallel()
 
@@ -123,8 +156,8 @@ func TestRequestWaitsAsLongAsTheTimeoutSaysAndGeoJSIsAbandonedAfterIt(t *testing
 	t.Parallel()
 
 	synctest.Test(t, func(t *testing.T) {
-		// A timeout longer than the default second, and a GeoJS that does
-		// not answer.
+		// A timeout longer than the default, and a GeoJS that does not
+		// answer.
 		const longerTimeout = 3 * time.Second
 
 		m := metrics.New(1, "app")

internal/metrics/metrics.go

@@ -28,16 +28,15 @@ type Metrics struct {
 	registry prometheus.Registerer
 	handler  http.Handler
 
-	inFlight             prometheus.Gauge
-	requests             *prometheus.CounterVec
-	requestBytes         *prometheus.CounterVec
-	responseBytes        *prometheus.CounterVec
-	requestDuration      prometheus.Histogram
-	upstreamDuration     prometheus.Histogram
-	rateLimitHits        *prometheus.CounterVec
-	sizeAndTimeLimitHits *prometheus.CounterVec
-	offences             *prometheus.CounterVec
-	wafMatches           *prometheus.CounterVec
+	inFlight         prometheus.Gauge
+	requests         *prometheus.CounterVec
+	requestBytes     *prometheus.CounterVec
+	responseBytes    *prometheus.CounterVec
+	requestDuration  prometheus.Histogram
+	upstreamDuration prometheus.Histogram
+	rateLimitHits    *prometheus.CounterVec
+	offences         *prometheus.CounterVec
+	wafMatches       *prometheus.CounterVec
 	// ruleMatches are made by AddRules, and reputationHits by
 	// AddReputation.
 	ruleMatches    *prometheus.CounterVec
@@ -100,9 +99,6 @@ func New(topN int, instanceName string) *Metrics {
 			"Requests that broke a rate limit, a byte limit or the error burst, by "+
 				"its window and its kind, requests, bytes or refusals.",
 			[]string{"window", "kind"}),
-		sizeAndTimeLimitHits: counterVec("smallwebwaf_size_and_time_limit_hits_total",
-			"Requests that passed a size or time limit, by its setting.",
-			[]string{"limit"}),
 		offences: counterVec("smallwebwaf_offences_total",
 			"Offences, by kind.", []string{"kind"}),
 		wafMatches: counterVec("smallwebwaf_waf_matches_total",
@@ -143,7 +139,7 @@ func New(topN int, instanceName string) *Metrics {
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
 		m.inFlight, m.requests, m.requestBytes, m.responseBytes,
 		m.requestDuration, m.upstreamDuration,
-		m.rateLimitHits, m.sizeAndTimeLimitHits, m.offences, m.wafMatches,
+		m.rateLimitHits, m.offences, m.wafMatches,
 		m.countries, m.asns,
 		m.GeoJSRequests, m.GeoJSFailures, m.GeoJSUnanswered,
 		m.stateFileWrites, m.stateFileWriteFailures,
@@ -395,36 +391,26 @@ func (m *Metrics) RequestStarted() {
 	m.inFlight.Inc()
 }
 
-// RequestEnded counts a request that has ended, from its log line. limit
-// is the setting whose size or time limit the request passed, "" if none.
-// duration is how long the request took, and upstreamDuration how long it
-// took from when it was passed to the app, zero if it was not.
-func (m *Metrics) RequestEnded(
-	line *requestlog.Line, limit string, duration, upstreamDuration time.Duration,
-) {
+// RequestEnded counts a request that has ended without being passed to the app,
+// from its log line. duration is how long the request took.
+func (m *Metrics) RequestEnded(line *requestlog.Line, duration time.Duration) {
 	m.inFlight.Dec()
+	m.count(line, duration, 0)
+}
 
-	class := statusClass(line.Status)
-	m.requests.WithLabelValues(class, line.Action).Inc()
-	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
-	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
-	m.requestDuration.Observe(duration.Seconds())
+// RequestAllowed counts a question of rproxy's, answered allow, as no longer
+// under way. RequestReported counts the request it was about.
+func (m *Metrics) RequestAllowed() {
+	m.inFlight.Dec()
+}
 
-	if upstreamDuration > 0 {
-		m.upstreamDuration.Observe(upstreamDuration.Seconds())
-	}
-
-	if limit != "" {
-		m.sizeAndTimeLimitHits.WithLabelValues(limit).Inc()
-	}
-
-	if line.Country != "" {
-		m.countries.add(line.Country, line)
-	}
-
-	if line.ASN != "" {
-		m.asns.add(line.ASN, line)
-	}
+// RequestReported counts a request rproxy passed to the app, from what its
+// report says, which line holds: duration is how long the request took, and
+// upstreamDuration how long it took from when it was passed to the app.
+func (m *Metrics) RequestReported(
+	line *requestlog.Line, duration, upstreamDuration time.Duration,
+) {
+	m.count(line, duration, upstreamDuration)
 }
 
 // LimitHit counts a request that broke a rate limit, a byte limit or the
@@ -438,11 +424,10 @@ func (m *Metrics) LimitHit(hit ratelimit.Hit) {
 // them.
 func (m *Metrics) Offences(r ratelimit.Request) {
 	for kind, committed := range map[string]bool{
-		"limit":         r.BrokeLimit,
-		"attack":        r.Attack,
-		"rule_blocked":  r.RuleBlocked,
-		"waf_blocked":   r.WAFBlocked,
-		"token_refused": r.TokenRefused,
+		"limit":        r.BrokeLimit,
+		"attack":       r.Attack,
+		"rule_blocked": r.RuleBlocked,
+		"waf_blocked":  r.WAFBlocked,
 	} {
 		if committed {
 			m.offences.WithLabelValues(kind).Inc()
@@ -493,6 +478,30 @@ func (m *Metrics) StateFileEditSetAside(name string) {
 	m.stateFileEditsSetAside.WithLabelValues(name).Inc()
 }
 
+// count counts a request that has ended, as RequestEnded and RequestReported
+// describe.
+func (m *Metrics) count(
+	line *requestlog.Line, duration, upstreamDuration time.Duration,
+) {
+	class := statusClass(line.Status)
+	m.requests.WithLabelValues(class, line.Action).Inc()
+	m.requestBytes.WithLabelValues(class, line.Action).Add(float64(line.RequestBytes))
+	m.responseBytes.WithLabelValues(class, line.Action).Add(float64(line.ResponseBytes))
+	m.requestDuration.Observe(duration.Seconds())
+
+	if upstreamDuration > 0 {
+		m.upstreamDuration.Observe(upstreamDuration.Seconds())
+	}
+
+	if line.Country != "" {
+		m.countries.add(line.Country, line)
+	}
+
+	if line.ASN != "" {
+		m.asns.add(line.ASN, line)
+	}
+}
+
 // addReputationQueries adds the counter of the queries to source, a DNSBL
 // zone, or of the checks of clients with AbuseIPDB, which count tells.
 func (m *Metrics) addReputationQueries(source prometheus.Labels, count func() int) {

internal/proxy/admin.go

@@ -9,7 +9,6 @@ import (
 	"io"
 	"net/http"
 	"net/netip"
-	"os"
 	"strings"
 	"time"
 
@@ -41,16 +40,22 @@ var (
 	errNotAddress = errors.New("is not an address, such as 203.0.113.9")
 )
 
-// answerAdmin answers a request for smallwebwaf itself, under
-// /_smallwebwaf/, once it has passed the checks. Each endpoint needs a
-// token, sent as Authorization: Bearer <token>: the metrics
-// SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without
-// it is refused with 401, which counts toward the error burst. An
-// endpoint whose token is unset answers 404, as any other request under
-// /_smallwebwaf/ does.
+// answerHealth answers a request for the health endpoint.
+func (rq *request) answerHealth() {
+	rq.line.Action = requestlog.ActionAdmin
+	// Set here rather than left to Go's server, which would set it only
+	// after the log line has taken the response's headers.
+	rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	_, _ = io.WriteString(rq.out, "ok\n")
+}
+
+// answerAdmin answers a request for one of servewaf's own endpoints. Each
+// needs a token, sent as Authorization: Bearer <token>: the metrics
+// SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without it is
+// refused with 401. An endpoint whose token is unset answers 404, as any other
+// path does.
 func (rq *request) answerAdmin() {
 	rq.line.Action = requestlog.ActionAdmin
-	rq.startClientResponseTimeout()
 
 	token, answer := rq.endpoint()
 
@@ -58,12 +63,8 @@ func (rq *request) answerAdmin() {
 	case token == "":
 		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 	case !hasToken(rq.in, token):
-		rq.tokenRefused = true
 		rq.out.Header().Set("WWW-Authenticate", "Bearer")
-		rq.answer(refusal{
-			status: http.StatusUnauthorized,
-			action: requestlog.ActionAdmin,
-		})
+		http.Error(rq.out, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
 	default:
 		answer()
 	}
@@ -120,26 +121,7 @@ type banToAdd struct {
 // an admin, from now for the duration the body gives, with its reason,
 // and answers with that ban.
 func (rq *request) addBan() {
-	// The body must arrive within SWWAF_CLIENT_REQUEST_TIMEOUT, as any
-	// other request's must.
-	rq.stopReadingBody(rq.clientRequestDeadline())
-
 	toAdd, err := rq.readBanToAdd()
-	if refused := rq.refused.Load(); refused != nil {
-		rq.answer(*refused) // the body is over SWWAF_REQUEST_MAX_BYTES
-
-		return
-	}
-
-	if errors.Is(err, os.ErrDeadlineExceeded) {
-		rq.answer(refusal{
-			status: http.StatusRequestTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  "SWWAF_CLIENT_REQUEST_TIMEOUT",
-		})
-
-		return
-	}
 
 	var (
 		netblock netip.Prefix
@@ -168,12 +150,9 @@ func (rq *request) addBan() {
 // readBanToAdd reads the body of POST BansPath: a JSON object with
 // nothing but whitespace after it, in at most banBodyMaxBytes.
 func (rq *request) readBanToAdd() (banToAdd, error) {
-	var body io.ReadCloser = http.NoBody
-	if rq.body != nil {
-		body = rq.body
-	}
+	data, err := io.ReadAll(http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes))
+	rq.requestBytes = int64(len(data))
 
-	data, err := io.ReadAll(http.MaxBytesReader(nil, body, banBodyMaxBytes))
 	if err != nil {
 		return banToAdd{}, fmt.Errorf("%w: %w", errNotBanToAdd, err)
 	}
@@ -271,9 +250,9 @@ type clientAnswer struct {
 	Bans   []state.BanEntry  `json:"bans"`
 }
 
-// showClient answers GET ClientsPath<ip> with what smallwebwaf knows of
-// the client: its counters, its history, which holds its country as last
-// looked up and its offences, and its bans with their notes.
+// showClient answers GET ClientsPath<ip> with what servewaf knows of the client:
+// its counters, its history, which holds its country as last looked up and its
+// offences, and its bans with their notes.
 func (rq *request) showClient() {
 	addr, err := pathAddress(rq.in.URL.Path, ClientsPath)
 	if err != nil {

internal/proxy/admin_test.go

@@ -5,7 +5,6 @@ import (
 	"net/http"
 	"net/netip"
 	"reflect"
-	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -23,8 +22,6 @@ const (
 	// how a request carries it.
 	adminSecret = "fedcba9876543210fedcba9876543210"
 	adminBearer = "Bearer " + adminSecret
-	// adminClient is the client the tests' admin sends its requests from.
-	adminClient = "192.0.2.10"
 	// banOtherClient is the body of a request to ban otherClient for an
 	// hour.
 	banOtherClient = `{"netblock": "` + otherClient + `", "duration": "1h", ` +
@@ -43,8 +40,7 @@ func TestAdminEndpointsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{adminBearer, bearer, "Bearer ", ""} {
 		for _, e := range adminEndpoints() {
-			s.adminRequest(adminClient, authorization, e.method, e.path, e.body,
-				http.StatusNotFound, requestlog.ActionAdmin)
+			s.adminRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
 		}
 	}
 
@@ -71,8 +67,8 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 		for _, authorization := range []string{
 			"", bearer, "Bearer " + strings.ToUpper(adminSecret), "Basic " + adminSecret,
 		} {
-			got := s.adminRequest(adminClient, authorization, e.method, e.path, e.body,
-				http.StatusUnauthorized, requestlog.ActionAdmin)
+			got := s.adminRequest(authorization, e.method, e.path, e.body,
+				http.StatusUnauthorized)
 			if got.header.Get("WWW-Authenticate") != "Bearer" {
 				t.Errorf("%s %s with %q was answered without WWW-Authenticate: Bearer",
 					e.method, e.path, authorization)
@@ -265,64 +261,12 @@ func TestBanToAddThatCannotBeReadIsRefused(t *testing.T) {
 	}
 }
 
-func TestBanToAddOverTheRequestSizeLimitIsRefused(t *testing.T) {
-	t.Parallel()
-
-	s, _, server := startWithClock(t, "", map[string]string{
-		adminToken:      adminSecret,
-		requestMaxBytes: "16",
-	})
-
-	// Sent in a chunk, its length is not announced, so that it is found
-	// over SWWAF_REQUEST_MAX_BYTES only as it is read.
-	chunk := `{"netblock": "203.0.113.9", "duration": "1h"}`
-	s.adminRequest(adminClient, adminBearer+"\r\nTransfer-Encoding: chunked",
-		http.MethodPost, proxy.BansPath,
-		strconv.FormatInt(int64(len(chunk)), 16)+"\r\n"+chunk+"\r\n0\r\n\r\n",
-		http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge)
-
-	if held := server.Ledger.Snapshot(); len(held) != 0 {
-		t.Errorf("the ledger holds %+v, want no ban", held)
-	}
-}
-
-func TestBanToAddSlowerThanTheClientRequestTimeoutIsRefused(t *testing.T) {
-	t.Parallel()
-
-	s, _, server := startWithClock(t, "", map[string]string{
-		adminToken:           adminSecret,
-		metricsToken:         token,
-		clientRequestTimeout: shortTimeoutSetting,
-	})
-
-	// The chunk announces 256 bytes and the rest of it never comes, so only
-	// the timeout ends the wait. A hold-up of the test process can only
-	// make the answer later, so the time is checked only for not being
-	// shorter than the timeout.
-	start := time.Now()
-
-	s.adminRequest(adminClient, adminBearer+"\r\nTransfer-Encoding: chunked",
-		http.MethodPost, proxy.BansPath, "100\r\n"+`{"netblock": "203.0.113.9", `,
-		http.StatusRequestTimeout, requestlog.ActionTimedOut)
-
-	if took := time.Since(start); took < shortTimeout {
-		t.Errorf("answered after %s, before the timeout of %s ran out", took, shortTimeout)
-	}
-
-	wantLimitHits(t, s.addr, clientRequestTimeout, 1)
-
-	if held := server.Ledger.Snapshot(); len(held) != 0 {
-		t.Errorf("the ledger holds %+v, want no ban", held)
-	}
-}
-
 func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	t.Parallel()
 
 	s, clk, _ := startWithClock(t, "", map[string]string{
-		adminToken:          adminSecret,
-		rateLimitPerMinute:  "2",
-		rateLimitExemptNets: adminClient,
+		adminToken:         adminSecret,
+		rateLimitPerMinute: "2",
 	})
 	start := clk.Now()
 
@@ -371,61 +315,6 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 		http.StatusBadRequest)
 }
 
-func TestBannedClientIsRefusedAtTheEndpointsEvenWithTheToken(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithClock(t, "", map[string]string{adminToken: adminSecret})
-
-	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
-
-	// otherClient cannot lift its own ban either.
-	for _, e := range adminEndpoints() {
-		s.adminRequest(otherClient, adminBearer, e.method, e.path, e.body,
-			http.StatusForbidden, requestlog.ActionBanned)
-	}
-}
-
-func TestAdminRequestsCountTowardTheLimits(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithClock(t, "", map[string]string{
-		adminToken:         adminSecret,
-		rateLimitPerMinute: "2",
-	})
-
-	// A request refused for a missing token and one answered count toward
-	// the limit of two a minute, so the next breaks it.
-	s.adminRequest(client, "", http.MethodGet, proxy.BansPath, "",
-		http.StatusUnauthorized, requestlog.ActionAdmin)
-	s.adminRequest(client, adminBearer, http.MethodGet, proxy.BansPath, "",
-		http.StatusOK, requestlog.ActionAdmin)
-	s.adminRequest(client, adminBearer, http.MethodGet, proxy.BansPath, "",
-		http.StatusForbidden, requestlog.ActionRateLimited)
-}
-
-func TestClientInAllowNetsSkipsTheChecksButNeedsTheToken(t *testing.T) {
-	t.Parallel()
-
-	const allowed = "192.0.2.60" // in SWWAF_ALLOW_NETS
-
-	s, clk, server := startWithClock(t, "", map[string]string{
-		adminToken:         adminSecret,
-		allowNets:          allowed,
-		rateLimitPerMinute: "1",
-	})
-
-	// A ban on it refuses nothing, and its requests are not counted.
-	server.Ledger.BanForAdmin(netip.MustParsePrefix(allowed+"/32"), clk.Now(),
-		time.Time{}, "")
-
-	for range 2 {
-		s.adminRequest(allowed, "", http.MethodGet, proxy.BansPath, "",
-			http.StatusUnauthorized, requestlog.ActionAdmin)
-		s.adminRequest(allowed, adminBearer, http.MethodGet, proxy.BansPath, "",
-			http.StatusOK, requestlog.ActionAdmin)
-	}
-}
-
 func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	t.Parallel()
 
@@ -435,8 +324,7 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	})
 
 	for _, e := range adminEndpoints() {
-		s.adminRequest(adminClient, "", e.method, e.path, e.body,
-			http.StatusUnauthorized, requestlog.ActionAdmin)
+		s.adminRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
 	}
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {
@@ -461,39 +349,33 @@ func adminEndpoints() []adminEndpoint {
 	}
 }
 
-// admin sends a request with method for path, with body, from
-// adminClient, with the admin token, and checks that it is answered with
-// status, its log line's action admin. It returns the answer.
+// admin sends a request with method for path, with body, to servewaf's own
+// address, with the admin token, and checks that it is answered with status, its
+// log line's action admin. It returns the answer.
 func (s *sender) admin(method, path, body string, status int) answer {
 	s.t.Helper()
 
-	return s.adminRequest(adminClient, adminBearer, method, path, body, status,
-		requestlog.ActionAdmin)
+	return s.adminRequest(adminBearer, method, path, body, status)
 }
 
-// adminRequest sends a request with method for path, with body, from the
-// client at from, with authorization as its Authorization header unless
-// it is "", and checks its answer's status and its log line's action, as
-// request does. authorization may end in more header lines. A body that
-// is not "" has its length announced, unless authorization names
-// Transfer-Encoding. It returns the answer.
+// adminRequest is admin with authorization as the request's Authorization header
+// unless it is "".
 func (s *sender) adminRequest(
-	from, authorization, method, path, body string, status int, action string,
+	authorization, method, path, body string, status int,
 ) answer {
 	s.t.Helper()
 
-	var header []string
-
+	req := newRequest(s.t, method, s.serveWAFAddr, path, strings.NewReader(body))
 	if authorization != "" {
-		header = append(header, "Authorization: "+authorization)
+		req.Header.Set("Authorization", authorization)
 	}
 
-	if body != "" && !strings.Contains(authorization, "Transfer-Encoding") {
-		header = append(header, "Content-Length: "+strconv.Itoa(len(body)))
-	}
+	got := do(s.t, req)
+	wantStatus(s.t, got, status)
 
-	_, got := s.requestWithBody(method, from, path, strings.Join(header, "\r\n"),
-		body, status, action)
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
+	s.sent++
+	wantLine(s.t, line, status, requestlog.ActionAdmin)
 
 	return got
 }

internal/proxy/alerts_test.go

@@ -224,7 +224,9 @@ func startAppWithAlerts(
 
 	addr, out, server, queue := startProxyWithAlerts(t, app.URL, "", clk.Now, settings)
 
-	return &sender{t: t, addr: addr, out: out}, clk, server, queue
+	s := &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}
+
+	return s, clk, server, queue
 }
 
 // banAlert returns the alert for event, raised by a request from client at
@@ -237,6 +239,7 @@ func banAlert(
 		Instance: alertInstance,
 		Time:     raised,
 		Event:    event,
+		Host:     appHost,
 		Client:   netip.MustParseAddr(client),
 		Netblock: ban.Netblock,
 		Reason:   ban.Reason,

internal/proxy/anomaly_internal_test.go

@@ -15,9 +15,11 @@ func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
 	// anomaly counters, nor a clock, and the request no response: reading
 	// any of them to count the request panics.
 	rq := &request{
-		h:        &handler{config: &config.Config{LookupSource: "geojs"}},
-		client:   netip.MustParseAddr("203.0.113.9"),
-		lookedUp: true,
+		decision: decision{
+			client:   netip.MustParseAddr("203.0.113.9"),
+			lookedUp: true,
+		},
+		h: &handler{config: &config.Config{LookupSource: "geojs"}},
 	}
 
 	defer func() {

internal/proxy/anomaly_test.go

@@ -117,6 +117,7 @@ func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
 					Instance: alertInstance,
 					Time:     start,
 					Event:    alerts.EventAnomaly,
+					Host:     appHost,
 					Client:   netip.MustParseAddr(client),
 					Netblock: scope.netblock,
 					ASN:      asnDE,

internal/proxy/answertime_test.go

@@ -0,0 +1,564 @@
+package proxy_test
+
+import (
+	"fmt"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+const (
+	// answerTimeLimit is the default of rproxy's SWRP_TIMEOUT_MS, the time
+	// servewaf has to answer.
+	answerTimeLimit = 2 * time.Second
+	// defaultLookupWait is the default of SWWAF_LOOKUP_TIMEOUT.
+	defaultLookupWait = 800 * time.Millisecond
+	// The header limits SPEC.md gives.
+	cookieLimit      = 50
+	headerFieldLimit = 100
+	// cookieHeader is the header the cookie limit counts.
+	cookieHeader = "Cookie"
+	// tooLarge is how servewaf refuses a request over the header limits.
+	tooLarge = http.StatusRequestHeaderFieldsTooLarge
+	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
+	// that unansweredGeoJSURL names too.
+	silentAbuseIPDBURL = "unanswered://abuseipdb/api/v2/check"
+	// wholeLimit is the percentage of a rate limit that lowers it not at all.
+	wholeLimit = 100
+	// clientsDecision is the CrowdSec decision list holding client alone.
+	clientsDecision = `[{"duration": "4h0m0s", "scenario": "crowdsecurity/ssh-bf", ` +
+		`"scope": "Ip", "type": "ban", "value": "` + client + `"}]`
+)
+
+// cookies returns a Cookie header's value with count cookies.
+func cookies(count int) string {
+	parts := make([]string, 0, count)
+	for i := range count {
+		parts = append(parts, "c"+strconv.Itoa(i)+"=1")
+	}
+
+	return strings.Join(parts, "; ")
+}
+
+// fillHeaders adds headers to a question until the checks see total header
+// fields: all but ClientHeader and PeerHeader, which servewaf removes. Go's
+// client sends nothing else but Host, which the limit does not count, once
+// User-Agent is set.
+func fillHeaders(req *http.Request, total int) {
+	req.Header.Set("User-Agent", "test")
+
+	for i := len(req.Header) - 2; i < total; i++ {
+		req.Header.Set("X-Filler-"+strconv.Itoa(i), "1")
+	}
+}
+
+func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	began := time.Now()
+	got := do(t, req)
+
+	if took := time.Since(began); took >= answerTimeLimit/2 {
+		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
+	}
+
+	wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
+
+	line := s.out.requestLine(t)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+	if line.DurationWAF != nil {
+		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
+	}
+}
+
+func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
+	t.Parallel()
+
+	repeated := make([]string, headerFieldLimit)
+	for i := range repeated {
+		repeated[i] = "1"
+	}
+
+	for _, tc := range []struct {
+		name string
+		make func(*http.Request)
+		// refused is true for a request over a limit, and false for one at it.
+		refused bool
+	}{
+		{"cookies at the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit))
+		}, false},
+		{"cookies over the limit", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+		}, true},
+		{"parts empty or only spaces and tabs are no cookies", func(req *http.Request) {
+			req.Header.Set(cookieHeader, cookies(cookieLimit)+"; \t;;")
+		}, false},
+		{"parts of no-break spaces count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat(" ;", cookieLimit+1))
+		}, true},
+		{"cookies over the limit across two headers", func(req *http.Request) {
+			req.Header[cookieHeader] = []string{cookies(cookieLimit), "last=1"}
+		}, true},
+		{"cookies without a value count", func(req *http.Request) {
+			req.Header.Set(cookieHeader, strings.Repeat("a;", cookieLimit+1))
+		}, true},
+		{"header fields at the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit)
+		}, false},
+		{"header fields over the limit", func(req *http.Request) {
+			fillHeaders(req, headerFieldLimit+1)
+		}, true},
+		{"a header sent many times counts each time", func(req *http.Request) {
+			req.Header["X-Filler"] = repeated
+		}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", map[string]string{wafMode: block})
+			req := s.question(siteA, client, "/")
+			tc.make(req)
+
+			got := do(t, req)
+			line := s.out.requestLine(t)
+
+			if tc.refused {
+				wantDisposition(t, got, tooLarge, proxy.DispositionDeny)
+				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+				return
+			}
+
+			wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+
+			if line.DurationWAF == nil {
+				t.Error("the Core Rule Set did not read a request within the limits")
+			}
+		})
+	}
+}
+
+func TestHeaderLimitsHoldWhateverTheCoreRuleSetSettingsSay(t *testing.T) {
+	t.Parallel()
+
+	for _, env := range []map[string]string{
+		{wafMode: off},
+		{wafMode: "detect"},
+		{wafMode: block, "SWWAF_WAF_EXEMPT_PATHS": "/"},
+	} {
+		t.Run(fmt.Sprint(env), func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", env)
+			req := s.question(siteA, client, "/")
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
+		})
+	}
+}
+
+func TestClientInTheAllowNetsSkipsTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{wafMode: block, allowNets: client})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), http.StatusOK, proxy.DispositionAllow)
+}
+
+func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{mode: observe, wafMode: block})
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, strings.Repeat("a;", 16000))
+
+	began := time.Now()
+	got := do(t, req)
+
+	if took := time.Since(began); took >= answerTimeLimit/2 {
+		t.Errorf("answered after %s, want well within %s", took, answerTimeLimit)
+	}
+
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
+
+	line := s.out.requestLine(t)
+	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
+		t.Errorf("would_action %q and duration_waf %v, want %q and none",
+			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
+	}
+}
+
+func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
+	t.Parallel()
+
+	s := startServeWAF(t, "", map[string]string{rateLimitPerMinute: "1"})
+	ask := func() answer {
+		req := s.question(siteA, client, "/")
+		req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+		return do(t, req)
+	}
+
+	wantDisposition(t, ask(), tooLarge, proxy.DispositionDeny)
+	wantDisposition(t, ask(), http.StatusForbidden, proxy.DispositionDeny)
+
+	lines := s.out.requestLines(t, 2)
+	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
+}
+
+func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, path, action string
+	}{
+		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
+		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			s := startServeWAF(t, "", map[string]string{
+				trapPaths: trapPathList, rulesDir: writeRules(t, testRules),
+			})
+			req := s.question(siteA, client, tc.path)
+			req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+			wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
+			wantLine(t, s.out.requestLine(t), http.StatusForbidden, tc.action)
+		})
+	}
+}
+
+func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{
+		unknownLimitPercent: "0", lookupTimeout: "1h",
+	})
+	req := s.question(siteA, fromDE, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), tooLarge, proxy.DispositionDeny)
+
+	line := s.out.requestLine(t)
+	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+
+	if line.LimitPercent != nil {
+		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
+	}
+
+	// The client is under no ban, and GeoJS places it in a country.
+	wantDisposition(t, s.ask(fromDE, "/"), http.StatusOK, proxy.DispositionAllow)
+}
+
+func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{unknownLimitPercent: "0"})
+	s.server.GeoJS.Load([]lookup.Answer{{
+		Client: netip.MustParsePrefix(client + "/32"), ASN: "AS64512",
+		Answered: s.clock.Now(), Used: s.clock.Now(),
+	}})
+
+	req := s.question(siteA, client, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	wantDisposition(t, do(t, req), http.StatusForbidden, proxy.DispositionDeny)
+	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
+}
+
+func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
+	t.Parallel()
+
+	geojsURL, _ := startGeoJS(t)
+	s := startServeWAF(t, geojsURL, map[string]string{
+		mode: observe, addLookupHeaders: on, lookupTimeout: "1h",
+	})
+	req := s.question(siteA, fromDE, "/")
+	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
+
+	got := do(t, req)
+	wantDisposition(t, got, http.StatusOK, proxy.DispositionAllow)
+
+	asn, country := got.header.Get("X-Client-Asn"), got.header.Get("X-Client-Country")
+	if asn != asnDE || country != "DE" {
+		t.Errorf("answered with the AS number %q and the country %q, want %q and DE",
+			asn, country, asnDE)
+	}
+}
+
+// newServeWAFInBubble makes a servewaf for a synctest bubble: GeoJS never
+// answers, a setting needs its answer, and everything is at its default but
+// for env. No request to it may use the network.
+func newServeWAFInBubble(t *testing.T, env map[string]string) (*proxy.Server, *output) {
+	t.Helper()
+
+	settings := map[string]string{deniedCountries: "KP"}
+	maps.Copy(settings, env)
+
+	server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now, settings)
+
+	return server, out
+}
+
+// askDirectly hands a question about a request from client straight to server,
+// as change leaves it, and returns the answer's status and how long it took.
+func askDirectly(
+	t *testing.T, server *proxy.Server, change func(*http.Request),
+) (int, time.Duration) {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	req.RemoteAddr = net.JoinHostPort(rproxyPeer, "1234")
+	req.Header.Set(proxy.ClientHeader, client)
+	req.Header.Set(requestIDHeader, "the-id")
+	change(req)
+
+	recorder := httptest.NewRecorder()
+	began := time.Now()
+
+	server.Handler.ServeHTTP(recorder, req)
+
+	return recorder.Code, time.Since(began)
+}
+
+// banClient bans client at now.
+func banClient(_ *testing.T, server *proxy.Server, now time.Time) {
+	server.Ledger.BanForLimit(netip.MustParsePrefix(client+"/32"), now, bans.Notes{})
+}
+
+// countClient counts one request from client at now for the rate limits.
+func countClient(_ *testing.T, server *proxy.Server, now time.Time) {
+	server.Limiter.Count(netip.MustParsePrefix(client+"/32"), now, wholeLimit)
+}
+
+// listClient puts client on the blocklist at dropURL.
+func listClient(t *testing.T, server *proxy.Server, now time.Time) {
+	t.Helper()
+
+	err := server.Lists.Load([]reputation.List{{
+		URL: dropURL, Tried: now, Fetched: now, Lines: []string{client},
+	}})
+	if err != nil {
+		t.Fatalf("load the blocklist: %v", err)
+	}
+}
+
+// decideOnClient puts client on the CrowdSec decision list.
+func decideOnClient(t *testing.T, server *proxy.Server, now time.Time) {
+	t.Helper()
+	loadDecisions(t, server, now, clientsDecision)
+}
+
+// leaveAsItIs prepares nothing.
+func leaveAsItIs(*testing.T, *proxy.Server, time.Time) {}
+
+func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
+	t.Parallel()
+
+	const forbidden = http.StatusForbidden
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *proxy.Server, now time.Time)
+		// cookie is the request's Cookie header.
+		cookie string
+		status int
+		action string
+	}{
+		{
+			name: "SWWAF_DENY_NETS", env: map[string]string{denyNets: client},
+			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
+		},
+		{
+			name:    "a ban",
+			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
+		},
+		{
+			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+		},
+		{
+			name:    "the rate limits, with a biased threshold",
+			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
+			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+		},
+		{
+			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
+			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
+		},
+		{
+			name:    "the CrowdSec decision list",
+			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
+			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
+		},
+		{
+			name: "the header limits", cookie: cookies(cookieLimit + 1),
+			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
+			// says, so that a request that does not wait takes no time at all.
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newServeWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(t, server, func(req *http.Request) {
+					req.Header.Set(cookieHeader, tc.cookie)
+				})
+
+				if status != tc.status || took != 0 {
+					t.Errorf("answered %d after %s, want %d at once; output:\n%s",
+						status, took, tc.status, out.text())
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+
+				// GeoJS's request is abandoned before the bubble ends.
+				time.Sleep(defaultLookupWait)
+			})
+		})
+	}
+}
+
+func TestAQuestionWaitsForASlowGeoJSOnlyAsLongAsTheDefaultSays(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		env  map[string]string
+		// prepare gets the server ready, at now, before the question.
+		prepare func(t *testing.T, server *proxy.Server, now time.Time)
+		status  int
+		action  string
+	}{
+		{"nothing refuses it", nil, leaveAsItIs, http.StatusOK, requestlog.ActionForward},
+		{
+			"a country list needs the answer", map[string]string{allowedCountries: "DE"},
+			leaveAsItIs, http.StatusForbidden, requestlog.ActionCountryDenied,
+		},
+		{
+			"a blocklist that only logs",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: actionLog},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"a blocklist that only limits",
+			map[string]string{blocklistURLs: dropURL, blocklistAction: limitQuarter},
+			listClient, http.StatusOK, requestlog.ActionForward,
+		},
+		{
+			"over a rate limit on an exempt path",
+			map[string]string{rateLimitPerMinute: "1", rateLimitExemptPaths: "/"},
+			countClient, http.StatusOK, requestlog.ActionForward,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			synctest.Test(t, func(t *testing.T) {
+				server, out := newServeWAFInBubble(t, tc.env)
+				tc.prepare(t, server, time.Now())
+
+				status, took := askDirectly(t, server, func(*http.Request) {})
+
+				if status != tc.status || took != defaultLookupWait {
+					t.Errorf("answered %d after %s, want %d after %s; output:\n%s",
+						status, took, tc.status, defaultLookupWait, out.text())
+				}
+
+				wantLine(t, out.requestLine(t), tc.status, tc.action)
+			})
+		})
+	}
+}
+
+func TestServeWAFAnswersWithinTheTimeLimitWhileEveryOutsideSourceHangs(t *testing.T) {
+	t.Parallel()
+
+	held, askedGeoJS, _ := startHeldGeoJS(t)
+
+	// A resolver that takes every query and answers none.
+	resolver, err := (&net.ListenConfig{}).ListenPacket(t.Context(), "udp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	t.Cleanup(func() { _ = resolver.Close() })
+
+	server, out, _ := newServeWAFWith(t, func(params proxy.Params) *proxy.Server {
+		params.AbuseIPDBURL = silentAbuseIPDBURL
+
+		return proxy.NewServeWAF(params)
+	}, held, time.Now, map[string]string{
+		deniedCountries: "KP", wafMode: block,
+		dnsblZones: dnsblZone, dnsblResolver: resolver.LocalAddr().String(),
+		abuseIPDBKey:  accountKey,
+		blocklistURLs: held + "/drop.txt", asnLimitPercentURL: held + "/asn.txt",
+		crowdSecURL: held, crowdSecKey: bouncerKey,
+	})
+
+	// AbuseIPDB is asked only about a client with an offence.
+	group := netip.MustParsePrefix(client + "/32")
+	server.Limiter.AddToHistory(group, time.Now(), ratelimit.Request{Attack: true})
+
+	go server.Lists.Run(t.Context())
+
+	status, took := askDirectly(t, server, func(req *http.Request) {
+		req.Header.Set("User-Agent", "test")
+		req.Header.Set("Accept", "*/*")
+		req.Host = siteA
+	})
+
+	if status != http.StatusOK || took >= answerTimeLimit {
+		t.Errorf("answered %d after %s, want %d within %s; output:\n%s",
+			status, took, http.StatusOK, answerTimeLimit, out.text())
+	}
+
+	// Each outside source was asked, and none has answered. The stand-in for
+	// GeoJS is the lists' too, which name no address.
+	if !slices.Contains(askedGeoJS(), client) {
+		t.Errorf("GeoJS was asked about %q, not %s", askedGeoJS(), client)
+	}
+
+	if queries := server.DNSBL.Queries(dnsblZone); queries != 1 {
+		t.Errorf("%d queries to the DNS blocklist, want 1", queries)
+	}
+
+	if checked := server.AbuseIPDB.Checked(); checked != 1 {
+		t.Errorf("%d checks with AbuseIPDB, want 1", checked)
+	}
+}

internal/proxy/bans.go

@@ -58,13 +58,12 @@ func (rq *request) limitBroken(now time.Time) bool {
 }
 
 // countBytes counts the request's bytes, as countedBytes gives them, for
-// the byte limits, once its response has ended, and notes the client's
-// byte totals for the log line; its requests stay there as the rate limits
-// counted them. Only a request passed to the app has them counted, and
-// only one the rate limits counted; in observe mode, not one that enforce
-// mode would have refused. Bytes that take the client over a byte limit,
-// as its limit percentage for the byte limits lowers it, break it; the
-// response was passed on whole.
+// the byte limits, once its report has come, and notes the client's byte totals
+// for the log line; its requests stay there as the rate limits counted them.
+// Only an allowed request has them counted, and only one the rate limits
+// counted; in observe mode, not one that enforce mode would have refused. Bytes
+// that take the client over a byte limit, as its limit percentage for the byte
+// limits lowers it, break it; the response was passed on whole.
 func (rq *request) countBytes() {
 	if !rq.counted || rq.line.WouldAction != "" {
 		return
@@ -84,9 +83,8 @@ func (rq *request) countBytes() {
 }
 
 // countRefusal counts the request for the error burst once it has been
-// answered, if smallwebwaf refused it after a rule file match, a trap path
-// or a Core Rule Set match, or for a missing or wrong token, and in
-// observe mode if enforce mode would have: more than
+// answered, if servewaf refused it after a rule file match, a trap path or a
+// Core Rule Set match, and in observe mode if enforce mode would have: more than
 // SWWAF_ERROR_BURST_THRESHOLD such refusals of the client within a minute
 // break a limit. A client in SWWAF_ALLOW_NETS, which the checks skip, is
 // not counted, and nothing is while the threshold is off.
@@ -96,11 +94,7 @@ func (rq *request) countRefusal() {
 		return
 	}
 
-	// In observe mode, a request that enforce mode would have refused
-	// before it reached the endpoint has had no token refused there.
-	tokenRefused := rq.tokenRefused && rq.line.WouldAction == "" &&
-		!isInside(rq.client, cfg.AllowNets)
-	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked && !tokenRefused {
+	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked {
 		return
 	}
 
@@ -127,16 +121,9 @@ func (rq *request) countRefusal() {
 
 // countedBytes returns the request's bytes, once it has ended, as the
 // byte limits and the anomaly thresholds count them: the response's body
-// bytes, the request's, or both, as SWWAF_BYTES_COUNT says. For an
-// upgraded connection, such as a WebSocket, which has closed by then, what
-// it carried from the app counts with the response's and what it carried
-// from the client with the request's.
+// bytes, the request's, or both, as SWWAF_BYTES_COUNT says.
 func (rq *request) countedBytes() int64 {
-	response, request := rq.out.bytes, rq.requestBytes()
-	if rq.upgraded != nil {
-		response += rq.upgraded.fromApp.Load()
-		request += rq.upgraded.toApp.Load()
-	}
+	response, request := rq.out.bytes, rq.requestBytes
 
 	switch rq.h.config.BytesCount {
 	case "response":
@@ -151,7 +138,7 @@ func (rq *request) countedBytes() int64 {
 // banForLimit bans the client's netblock at now for a broken limit, the
 // one hit names, notes the offence for the log line and counts the hit in
 // the metrics. status is what the client was sent, or is sent:
-// SWWAF_BAN_RESPONSE for a request over a rate limit, the app's answer for
+// SWWAF_BAN_RESPONSE for a request over a rate limit, what the report says for
 // one whose bytes broke a byte limit, the refusal for one that broke the
 // error burst. The ban's notes give the client's limit percentage for a
 // rate limit or a byte limit; the error burst is not lowered. The ban sets
@@ -323,6 +310,7 @@ func (rq *request) alertBan(ban bans.Ban) {
 
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    event,
+		Host:     rq.site,
 		Client:   rq.client,
 		Netblock: ban.Netblock,
 		ASN:      ban.Notes.ASN,
@@ -339,11 +327,11 @@ func (rq *request) alertBan(ban bans.Ban) {
 func (rq *request) noted(now time.Time, status int) bans.Request {
 	return bans.Request{
 		Time:      now,
-		Method:    rq.in.Method,
-		Host:      rq.in.Host,
-		Path:      rq.in.URL.RequestURI(),
+		Method:    rq.line.Method,
+		Host:      rq.line.Host,
+		Path:      rq.requestURI,
 		Status:    status,
-		UserAgent: rq.in.UserAgent(),
+		UserAgent: rq.line.UserAgent,
 	}
 }
 

internal/proxy/bans_test.go

@@ -9,6 +9,7 @@ import (
 	"net/netip"
 	"reflect"
 	"slices"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -25,6 +26,8 @@ const (
 	userAgent = "ban-test/1.0"
 	// permanent is the log line's ban_expires for a permanent ban.
 	permanent = "permanent"
+	// banResponseClose is the SWWAF_BAN_RESPONSE that closes the connection.
+	banResponseClose = "close"
 )
 
 func TestBrokenLimitBansTheClient(t *testing.T) {
@@ -237,7 +240,7 @@ func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 		{"", http.StatusForbidden},
 		{"403", http.StatusForbidden},
 		{"429", http.StatusTooManyRequests},
-		{"close", 0},
+		{banResponseClose, 0},
 	} {
 		t.Run(banResponse+"="+tc.setting, func(t *testing.T) {
 			t.Parallel()
@@ -372,7 +375,7 @@ func (c *clock) advance(d time.Duration) {
 	c.now = c.now.Add(d)
 }
 
-// startWithClock starts smallwebwaf in front of an app that answers 200,
+// startWithClock starts servewaf, and rproxy in front of an app that answers 200,
 // with the settings in env on top of trusting localhost's
 // X-Forwarded-For, clients' AS numbers and countries looked up at
 // geojsURL, and a clock set to midnight, the start of a bucket in every
@@ -389,18 +392,19 @@ func startWithClock(
 
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, clk.Now, settings)
 
-	return &sender{t: t, addr: addr, out: out}, clk, server
+	return &sender{t: t, addr: addr, serveWAFAddr: server.Addr, out: out}, clk, server
 }
 
-// sender sends requests to smallwebwaf one after another, each on a
-// connection of its own, and checks each one's answer and log line. They
-// must be the only requests smallwebwaf is sent, since the log lines are
-// matched to them in order.
+// sender sends requests to rproxy one after another, each on a connection of its
+// own, and checks each one's answer and log line. serveWAFAddr is where servewaf's
+// own endpoints are, which adminRequest asks. Every request servewaf gets must
+// come through the sender, since the log lines are matched to them in order.
 type sender struct {
-	t    *testing.T
-	addr string
-	out  *output
-	sent int
+	t            *testing.T
+	addr         string
+	serveWAFAddr string
+	out          *output
+	sent         int
 }
 
 // get sends a GET request for / from the client at from.
@@ -417,22 +421,19 @@ func (s *sender) get(from string, status int, action string) logLine {
 func (s *sender) request(from, path string, status int, action string) logLine {
 	s.t.Helper()
 
-	line, _ := s.requestWithHeader(from, path, "", status, action)
-
-	return line
+	return s.requestWithHeader(from, path, "", status, action)
 }
 
 // requestWithHeader is request with header, such as "Authorization:
-// Bearer x", added to the request unless it is "". It returns the body of
-// the answer too.
+// Bearer x", added to the request unless it is "".
 func (s *sender) requestWithHeader(
 	from, path, header string, status int, action string,
-) (logLine, string) {
+) logLine {
 	s.t.Helper()
 
-	line, got := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
+	line, _ := s.requestWithBody(http.MethodGet, from, path, header, "", status, action)
 
-	return line, string(got.body)
+	return line
 }
 
 // requestWithBody is requestWithHeader for a request with method, whose
@@ -448,10 +449,14 @@ func (s *sender) requestWithBody(
 		header += "\r\n"
 	}
 
+	// rproxy refuses a request with more than one.
+	if !strings.Contains(header, "User-Agent:") {
+		header += "User-Agent: " + userAgent + "\r\n"
+	}
+
 	conn := dial(s.t, s.addr)
-	send(s.t, conn, method+" "+path+" HTTP/1.1\r\nHost: "+appHost+
-		"\r\nUser-Agent: "+userAgent+"\r\n"+forwardedFor+": "+from+"\r\n"+
-		header+"\r\n"+body)
+	send(s.t, conn, method+" "+path+" HTTP/1.1\r\nHost: "+appHost+"\r\n"+
+		forwardedFor+": "+from+"\r\n"+header+"\r\n"+body)
 
 	err := conn.SetReadDeadline(time.Now().Add(waitLimit))
 	if err != nil {
@@ -476,7 +481,7 @@ func (s *sender) requestWithBody(
 			got.status, status)
 	}
 
-	line := s.out.requestLines(s.t, s.sent+1)[s.sent]
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
 	s.sent++
 	wantLine(s.t, line, status, action)
 

internal/proxy/biased.go

@@ -34,19 +34,19 @@ func biasedThresholdsSet(cfg *config.Config) bool {
 // percentage SWWAF_ASN_LIMIT_PERCENT gives its AS number, the one the file
 // SWWAF_ASN_LIMIT_PERCENT_URL names gives it, the one
 // SWWAF_COUNTRY_LIMIT_PERCENT gives its country, for a client without a
-// country, SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists,
-// the percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a
-// client a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit,
-// the percentage of SWWAF_REPUTATION_ACTION while it is limit. For the
-// byte limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT
-// take the place of the first three for an AS number or a country they
-// list.
+// country, unless its request skipped the wait for GeoJS,
+// SWWAF_UNKNOWN_LIMIT_PERCENT, for a client a blocklist lists, the
+// percentage of SWWAF_BLOCKLIST_ACTION while it is limit, and for a client
+// a DNSBL zone's verdict lists, or whose AbuseIPDB score is a hit, the
+// percentage of SWWAF_REPUTATION_ACTION while it is limit. For the byte
+// limits, SWWAF_ASN_BYTES_PERCENT and SWWAF_COUNTRY_BYTES_PERCENT take the
+// place of the first three for an AS number or a country they list.
 func (rq *request) limitPercentages() (percentage, percentage) {
 	cfg := rq.h.config
 	asn, country := rq.line.ASN, rq.line.Country
 
 	unknown := percentage{percent: whole}
-	if country == "" {
+	if country == "" && !rq.skippedLookupWait {
 		unknown = percentage{cfg.UnknownLimitPercent, "SWWAF_UNKNOWN_LIMIT_PERCENT"}
 	}
 

internal/proxy/biased_test.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"io"
 	"maps"
-	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -281,12 +280,12 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 	// says, with a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
-			time.Now, map[string]string{unknownLimitPercent: "0"})
+		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+			map[string]string{unknownLimitPercent: "0"})
 
-		// Once the second the request waits for its answer is up, the client
+		// Once the time the request waits for its answer is up, the client
 		// counts as without a country, and its zero allowance refuses the
-		// request before it reaches the app.
+		// request.
 		serveFromDE(t, server, http.MethodGet, http.NoBody)
 
 		line := out.requestLine(t)
@@ -320,13 +319,8 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, with a GeoJS that never answers.
 			synctest.Test(t, func(t *testing.T) {
-				// The request's body is over SWWAF_REQUEST_MAX_BYTES, so that it
-				// is refused after the checks, and never reaches the app.
-				server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
-					time.Now, map[string]string{
-						lookupTimeout: timeout.String(), requestMaxBytes: "1",
-						tc.setting: tc.value,
-					})
+				server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+					map[string]string{lookupTimeout: timeout.String(), tc.setting: tc.value})
 				began := time.Now()
 
 				serveFromDE(t, server, http.MethodPost, strings.NewReader("ab"))
@@ -340,8 +334,7 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 					t.Errorf("the request waited %s for its answer, want %s", waited, want)
 				}
 
-				wantLine(t, out.requestLine(t), http.StatusRequestEntityTooLarge,
-					requestlog.ActionTooLarge)
+				wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
 
 				// The bubble's clock stops once this function returns, so the
 				// request to GeoJS, which a request that did not wait leaves
@@ -467,13 +460,15 @@ func (s *sender) uploadFrom(from string) logLine {
 	return line
 }
 
-// serveFromDE hands a request from fromDE with method and body straight to
-// server's handler, without the network, and returns once it is answered.
+// serveFromDE hands a question about a request from fromDE with method and body
+// straight to server's handler, without the network, and returns once it is
+// answered.
 func serveFromDE(t *testing.T, server *proxy.Server, method string, body io.Reader) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), method, "/", body)
-	req.RemoteAddr = net.JoinHostPort(fromDE, "1234")
+	req.Header.Set(proxy.ClientHeader, fromDE)
+	req.Header.Set(requestIDHeader, "the-id")
 
 	server.Handler.ServeHTTP(httptest.NewRecorder(), req)
 }

internal/proxy/bytelimits_test.go

@@ -47,8 +47,6 @@ const (
 func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 	t.Parallel()
 
-	const scraper = "192.0.2.200"
-
 	for _, tc := range []struct {
 		setting, window string
 		// apart is the time between the two requests, which the window
@@ -94,7 +92,7 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 
 			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
-			wantMetric(t, s.scrape(scraper), `smallwebwaf_rate_limit_hits_total{`+
+			wantMetric(t, s.scrape(), `smallwebwaf_rate_limit_hits_total{`+
 				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
 		})
 	}
@@ -126,7 +124,7 @@ func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
 	// The 70 bytes passed on before the app broke off are over the limit of
 	// 50, and ban the client for an hour.
 	line, got := s.requestWithBody(http.MethodGet, client, "/", "", "", http.StatusOK,
-		requestlog.ActionUpstreamError)
+		requestlog.ActionForward)
 	if len(got.body) != answerBytes || line.LimitHit != minuteBytes ||
 		line.BanExpires != expires {
 		t.Errorf("got %d bytes, and the log line has limit_hit %q and ban_expires %q, "+
@@ -168,39 +166,6 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 	}
 }
 
-func TestWebSocketPassesTheAnswerAfterTheClientStopsSending(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, echoOnceTheClientStops)
-	addr, out := startProxy(t, app.URL,
-		map[string]string{trustedProxies: trustLocalhost})
-	s := &sender{t: t, addr: addr, out: out}
-
-	conn, reader := s.openWebSocket()
-	send(t, conn, uploadBody)
-
-	// The client closes its sending side and waits for the answer, which the
-	// app sends only once it has seen the client stop. smallwebwaf passes the
-	// close on to the app through CloseWrite on upgradedConn; without that,
-	// it closes both connections, and the answer is lost.
-	tcp, ok := conn.(*net.TCPConn)
-	if !ok {
-		t.Fatalf("connection is a %T, want a *net.TCPConn", conn)
-	}
-
-	err := tcp.CloseWrite()
-	if err != nil {
-		t.Fatalf("close the sending side: %v", err)
-	}
-
-	got, err := io.ReadAll(reader)
-	if err != nil || string(got) != uploadBody {
-		t.Errorf("got %q (%v), want %q", got, err, uploadBody)
-	}
-
-	s.closeWebSocket(conn)
-}
-
 func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 	t.Parallel()
 
@@ -465,28 +430,6 @@ func answerAfterUpgrade(w http.ResponseWriter, _ *http.Request) {
 	}
 }
 
-// echoOnceTheClientStops is an app that switches protocols, as for a
-// WebSocket, reads what the client sends until the client stops sending,
-// and then sends it all back.
-func echoOnceTheClientStops(w http.ResponseWriter, _ *http.Request) {
-	conn, buffered, err := http.NewResponseController(w).Hijack()
-	if err != nil {
-		return
-	}
-
-	defer func() {
-		_ = conn.Close()
-	}()
-
-	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
-		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
-	_ = buffered.Flush()
-
-	received, _ := io.ReadAll(buffered)
-	_, _ = buffered.Write(received)
-	_ = buffered.Flush()
-}
-
 // webSocket opens a WebSocket from client to answerAfterUpgrade, sends a
 // line of bodyBytes on it, reads the answer, and closes it. It checks the
 // answer, and the log line as request does, and returns the log line.
@@ -543,7 +486,7 @@ func (s *sender) closeWebSocket(conn net.Conn) logLine {
 
 	_ = conn.Close()
 
-	line := s.out.requestLines(s.t, s.sent+1)[s.sent]
+	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
 	s.sent++
 	wantLine(s.t, line, http.StatusSwitchingProtocols, requestlog.ActionForward)
 

internal/proxy/client.go

@@ -5,10 +5,9 @@ import (
 	"net/http"
 	"net/netip"
 	"slices"
-	"strings"
 )
 
-// peerAddress is the address of the request's TCP peer, normally traefik.
+// peerAddress is the address of the request's TCP peer.
 func peerAddress(r *http.Request) netip.Addr {
 	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
 	if err != nil {
@@ -18,58 +17,24 @@ func peerAddress(r *http.Request) netip.Addr {
 	return addrPort.Addr().Unmap()
 }
 
-// clientAddress works out who the client is. A peer outside the trusted
-// proxies is the client, and what it says in X-Forwarded-For is ignored.
-// For a peer inside them, X-Forwarded-For is read from the right, and the
-// first address outside them is the client; if every address in it is
-// inside, the leftmost is, and with no header, the peer. An entry that is
-// not an address ends the reading, since nothing to its left can be
-// believed.
-func clientAddress(
-	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
-) netip.Addr {
-	client := peer
-	if !isInside(peer, trusted) {
-		return client
-	}
-
-	entries := strings.Split(strings.Join(forwardedFor, ","), ",")
-	for _, entry := range slices.Backward(entries) {
-		addr, err := netip.ParseAddr(strings.TrimSpace(entry))
-		if err != nil {
-			break
-		}
-
-		client = addr.Unmap()
-		if !isInside(client, trusted) {
-			break
-		}
-	}
-
-	return client
-}
-
-// requestIDHeader carries the request's id, from traefik and to the app.
+// requestIDHeader carries the request's id, from rproxy.
 const requestIDHeader = "X-Request-ID"
 
-// requestID is the request's id: the one a trusted proxy sent, or a new
-// random one. A peer outside the trusted proxies did not come through
-// traefik, so the id it sends is its own claim, and is replaced.
-func requestID(r *http.Request, peerTrusted bool) string {
-	id := r.Header.Get(requestIDHeader)
-	if !peerTrusted || id == "" {
-		id = rand.Text()
+// requestID is the request's id: the one a question gives, or for any other
+// request a new random one.
+func requestID(r *http.Request, isQuestion bool) string {
+	if isQuestion {
+		return r.Header.Get(requestIDHeader)
 	}
 
-	return id
+	return rand.Text()
 }
 
-// scheme is how the client reached traefik, as a trusted proxy says in
-// X-Forwarded-Proto, or otherwise http, the only scheme smallwebwaf
-// serves.
-func scheme(r *http.Request, peerTrusted bool) string {
+// scheme is how the visitor reached rproxy, or the trusted proxy in front of
+// it, as a question says in X-Forwarded-Proto, or otherwise http.
+func scheme(r *http.Request, isQuestion bool) string {
 	proto := r.Header.Get("X-Forwarded-Proto")
-	if !peerTrusted || proto == "" {
+	if !isQuestion || proto == "" {
 		return "http"
 	}
 
@@ -95,48 +60,3 @@ func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 		return netblock.Contains(addr)
 	})
 }
-
-// setForwardedHeaders sets the headers in which the app learns about the
-// client, so that it sees what it would see from traefik directly. A
-// trusted proxy's forwarded headers pass on, with the proxy's own address
-// added to X-Forwarded-For. Those of any other peer are its own claims and
-// are replaced: X-Forwarded-For names the peer, X-Forwarded-Host the host
-// it asked for, and X-Forwarded-Proto plain http, which is how it reached
-// smallwebwaf.
-func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
-	forwardedFor := peer.String()
-
-	if trusted {
-		// ReverseProxy removes these from out before Rewrite.
-		for _, name := range []string{"Forwarded", "X-Forwarded-Host", "X-Forwarded-Proto"} {
-			values, ok := in.Header[name]
-			if ok {
-				out.Header[name] = values
-			}
-		}
-
-		prior := in.Header.Values("X-Forwarded-For")
-		if len(prior) > 0 {
-			forwardedFor = strings.Join(prior, ", ") + ", " + forwardedFor
-		}
-
-		out.Header.Set("X-Forwarded-For", forwardedFor)
-
-		return
-	}
-
-	// ReverseProxy has removed Forwarded and the three set below; these
-	// are the other headers in which traefik tells the app about the
-	// client and its request.
-	for _, name := range []string{
-		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
-		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
-		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
-	} {
-		out.Header.Del(name)
-	}
-
-	out.Header.Set("X-Forwarded-For", forwardedFor)
-	out.Header.Set("X-Forwarded-Host", in.Host)
-	out.Header.Set("X-Forwarded-Proto", "http")
-}

internal/proxy/client_test.go

@@ -1,165 +0,0 @@
-package proxy_test
-
-import (
-	"encoding/json"
-	"net/http"
-	"testing"
-)
-
-const (
-	// trustLocalhost trusts the address every test connects from, and a
-	// network for proxies in front of it.
-	trustLocalhost = localhost + "/32,10.0.0.0/8"
-	// appHost is the host every test asks for.
-	appHost = "app.example"
-	// client is the client's address, as a proxy names it.
-	client = "203.0.113.9"
-	// forwardedFor is the header that lists the client and its proxies,
-	// and forwardedProto the one that gives the scheme the client used.
-	forwardedFor   = "X-Forwarded-For"
-	forwardedProto = "X-Forwarded-Proto"
-	// secure is the scheme a client reached traefik with, and plain the
-	// one smallwebwaf serves.
-	secure = "https"
-	plain  = "http"
-)
-
-// appHeaders is what the app tells about the headers it received.
-type appHeaders struct {
-	Host           string `json:"host"`
-	ForwardedFor   string `json:"forwardedFor"`
-	ForwardedHost  string `json:"forwardedHost"`
-	ForwardedProto string `json:"forwardedProto"`
-	RealIP         string `json:"realIp"`
-}
-
-// clientAddressCase is a request and what smallwebwaf makes of it.
-type clientAddressCase struct {
-	name       string
-	env        map[string]string
-	header     http.Header
-	wantClient string
-	wantApp    appHeaders
-}
-
-func TestClientAddressAndForwardedHeaders(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range clientAddressCases() {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got, line := requestWithHeaders(t, tc.env, tc.header)
-
-			tc.wantApp.Host = appHost
-			if got != tc.wantApp {
-				t.Errorf("app received %+v, want %+v", got, tc.wantApp)
-			}
-
-			if line.ClientIP != tc.wantClient || line.PeerIP != localhost {
-				t.Errorf("log line has client_ip %q and peer_ip %q, want %q and %q",
-					line.ClientIP, line.PeerIP, tc.wantClient, localhost)
-			}
-		})
-	}
-}
-
-// clientAddressCases are the requests TestClientAddressAndForwardedHeaders
-// sends, from 127.0.0.1, which the default trusted proxies leave out.
-func clientAddressCases() []clientAddressCase {
-	trusted := map[string]string{trustedProxies: trustLocalhost}
-	forged := http.Header{
-		forwardedFor:       {client},
-		"X-Forwarded-Host": {"forged.example"},
-		forwardedProto:     {secure},
-		"X-Real-Ip":        {client},
-	}
-	replaced := appHeaders{
-		ForwardedFor: localhost, ForwardedHost: appHost, ForwardedProto: plain,
-	}
-
-	return []clientAddressCase{{
-		name: "a peer outside the trusted proxies is the client, " +
-			"and its forwarded headers are replaced",
-		header: forged, wantClient: localhost, wantApp: replaced,
-	}, {
-		name:   "set but empty, the trusted proxies trust nothing",
-		env:    map[string]string{trustedProxies: ""},
-		header: forged, wantClient: localhost, wantApp: replaced,
-	}, {
-		name: "behind a trusted peer, the client is the first address " +
-			"outside the trusted proxies from the right",
-		env: trusted,
-		header: http.Header{
-			forwardedFor:       {"198.51.100.7, " + client + ", 10.0.0.2"},
-			"X-Forwarded-Host": {appHost},
-			forwardedProto:     {secure},
-			"X-Real-Ip":        {client},
-		},
-		wantClient: client,
-		wantApp: appHeaders{
-			ForwardedFor:  "198.51.100.7, " + client + ", 10.0.0.2, " + localhost,
-			ForwardedHost: appHost, ForwardedProto: secure, RealIP: client,
-		},
-	}, {
-		name:       "when every address is a trusted proxy, the leftmost is the client",
-		env:        trusted,
-		header:     http.Header{forwardedFor: {"10.0.0.5, 10.0.0.2"}},
-		wantClient: "10.0.0.5",
-		wantApp:    appHeaders{ForwardedFor: "10.0.0.5, 10.0.0.2, " + localhost},
-	}, {
-		name:       "with no header, a trusted peer is the client",
-		env:        trusted,
-		wantClient: localhost,
-		wantApp:    appHeaders{ForwardedFor: localhost},
-	}, {
-		name:       "an entry that is not an address ends the reading",
-		env:        trusted,
-		header:     http.Header{forwardedFor: {client + ", unknown, 10.0.0.2"}},
-		wantClient: "10.0.0.2",
-		wantApp: appHeaders{
-			ForwardedFor: client + ", unknown, 10.0.0.2, " + localhost,
-		},
-	}, {
-		name:       "several header lines are read as one list",
-		env:        trusted,
-		header:     http.Header{forwardedFor: {"2001:db8::7", "10.0.0.2"}},
-		wantClient: "2001:db8::7",
-		wantApp:    appHeaders{ForwardedFor: "2001:db8::7, 10.0.0.2, " + localhost},
-	}}
-}
-
-// requestWithHeaders sends a request for appHost with header through
-// smallwebwaf, with the settings in env, and returns the headers the app
-// received and the request's log line.
-func requestWithHeaders(
-	t *testing.T, env map[string]string, header http.Header,
-) (appHeaders, logLine) {
-	t.Helper()
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		_ = json.NewEncoder(w).Encode(appHeaders{
-			Host:           r.Host,
-			ForwardedFor:   r.Header.Get(forwardedFor),
-			ForwardedHost:  r.Header.Get("X-Forwarded-Host"),
-			ForwardedProto: r.Header.Get(forwardedProto),
-			RealIP:         r.Header.Get("X-Real-IP"),
-		})
-	})
-	addr, out := startProxy(t, app.URL, env)
-
-	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
-	req.Host = appHost
-	req.Header = header.Clone()
-
-	answered := do(t, req)
-
-	var got appHeaders
-
-	err := json.Unmarshal(answered.body, &got)
-	if err != nil {
-		t.Fatalf("decode the app's answer %q: %v", answered.body, err)
-	}
-
-	return got, out.requestLine(t)
-}

internal/proxy/coreruleset.go

@@ -1,9 +1,6 @@
 package proxy
 
 import (
-	"errors"
-	"net/http"
-	"os"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
@@ -19,8 +16,7 @@ import (
 // SWWAF_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
 // and in block mode refuses the request, which is an offence its client's
 // history counts, and so returns ActionWAFBlocked. It returns "" for a
-// request it does not refuse, and for one whose body meets a size or time
-// limit while the Core Rule Set reads it, which it notes nothing of.
+// request it does not refuse.
 func (rq *request) checkCoreRuleSet() string {
 	cfg := rq.h.config
 	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
@@ -29,10 +25,10 @@ func (rq *request) checkCoreRuleSet() string {
 
 	start := time.Now()
 
-	result := rq.inspect()
-	if rq.refused.Load() != nil {
-		return "" // the refusal for that limit, which check returns
-	}
+	// A question's body has been read into memory, so that reading it here
+	// cannot fail.
+	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
+	rq.requestBytes = int64(len(read))
 
 	rq.line.DurationWAF = new(requestlog.Milliseconds(time.Since(start)))
 	rq.line.WAFRuleIDs = result.RuleIDs
@@ -58,39 +54,6 @@ func (rq *request) checkCoreRuleSet() string {
 	return requestlog.ActionWAFBlocked
 }
 
-// inspect runs the Core Rule Set on the request, which reads the part of
-// its body it inspects within SWWAF_CLIENT_REQUEST_TIMEOUT, and keeps that
-// part for the app. A client that runs out of time is refused with 408
-// here, and a body over SWWAF_REQUEST_MAX_BYTES with 413 as it is read;
-// check returns the refusal. A body that breaks off for any other reason
-// is passed on as far as it came, and the request to the app fails there,
-// as it would have without the Core Rule Set.
-func (rq *request) inspect() waf.Result {
-	if rq.body == nil {
-		// Nothing is read of no body, so nothing can go wrong reading it.
-		result, _, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, http.NoBody)
-
-		return result
-	}
-
-	_ = rq.rc.SetReadDeadline(rq.clientRequestDeadline())
-	result, read, err := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.body)
-	// The timeouts that run while the request goes to the app take over.
-	_ = rq.rc.SetReadDeadline(time.Time{})
-
-	rq.body.readByCoreRuleSet = read
-
-	if errors.Is(err, os.ErrDeadlineExceeded) {
-		rq.refuse(refusal{
-			status: http.StatusRequestTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  "SWWAF_CLIENT_REQUEST_TIMEOUT",
-		})
-	}
-
-	return result
-}
-
 // alertWAFBlock raises the waf_block alert for the request, which the Core
 // Rule Set scored at result, at or over SWWAF_WAF_ANOMALY_THRESHOLD. Its
 // detail gives the rule ids, the score, the method and the path with the
@@ -113,6 +76,7 @@ func (rq *request) alertWAFBlock(result waf.Result) {
 
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    alerts.EventWAFBlock,
+		Host:     rq.site,
 		Client:   rq.client,
 		Netblock: rq.h.clientGroup(rq.client),
 		ASN:      rq.line.ASN,

internal/proxy/coreruleset_test.go

@@ -8,7 +8,6 @@ import (
 	"strconv"
 	"strings"
 	"testing"
-	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
@@ -29,6 +28,13 @@ const (
 // formData is the type of a form's body.
 const formData = "application/x-www-form-urlencoded"
 
+// sizeLimit is SWWAF_WAF_BODY_LIMIT in the tests that read bodies, 1K as a
+// setting.
+const (
+	sizeLimit        = 1 << 10
+	sizeLimitSetting = "1K"
+)
+
 // sqlInjection asks for / with an SQL injection in its query, which only
 // the Core Rule Set's rule 942100 matches, with a score of 5, the default
 // SWWAF_WAF_ANOMALY_THRESHOLD.
@@ -96,7 +102,7 @@ func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *test
 			} {
 				s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
 
-				line, _ := s.requestWithHeader(client, attack.path, attack.header,
+				line := s.requestWithHeader(client, attack.path, attack.header,
 					tc.status, tc.action)
 				wantWAF(t, line, &attack.score, attack.ruleIDs...)
 			}
@@ -299,7 +305,7 @@ func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
 				tc.name, len(got.body), got.status, len(tc.body))
 		}
 
-		line := out.requestLines(t, i+1)[i]
+		line := out.endedLines(t, i+1)[i]
 		wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
 		if line.RequestBytes != int64(len(tc.body)) {
@@ -309,119 +315,6 @@ func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
 	}
 }
 
-func TestFormBodyLongerThanTheLimitStreamsOnToTheApp(t *testing.T) {
-	t.Parallel()
-
-	const (
-		first = "a=" // and twice the limit of b's, then the rest
-		rest  = 64 * sizeLimit
-	)
-
-	// past is closed once the app has received twice what the Core Rule
-	// Set reads, and got is the length of the whole body it received.
-	past := make(chan struct{})
-	got := make(chan int64, 1)
-	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-		n, _ := io.CopyN(io.Discard, r.Body, 2*sizeLimit)
-
-		close(past)
-
-		m, _ := io.Copy(io.Discard, r.Body)
-		got <- n + m
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		wafMode: block, wafBodyLimit: sizeLimitSetting,
-	})
-
-	// The client sends the rest only once the app has received the first
-	// part: were smallwebwaf to hold the body until the end, it would
-	// never come.
-	body, sender := io.Pipe()
-
-	go func() {
-		_, _ = io.WriteString(sender, first+strings.Repeat("b", 2*sizeLimit))
-
-		select {
-		case <-past:
-		case <-time.After(waitLimit):
-			t.Error("the app got no more than the Core Rule Set reads " +
-				"before the whole body was sent")
-
-			_ = sender.CloseWithError(io.ErrUnexpectedEOF)
-
-			return
-		}
-
-		_, _ = io.WriteString(sender, strings.Repeat("b", rest))
-		_ = sender.Close()
-	}()
-
-	req := newRequest(t, http.MethodPost, addr, "/", body)
-	req.Header.Set("Content-Type", formData)
-	wantStatus(t, do(t, req), http.StatusOK)
-
-	want := int64(len(first) + 2*sizeLimit + rest)
-	if n := <-got; n != want {
-		t.Errorf("the app got %d bytes, want %d", n, want)
-	}
-
-	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
-}
-
-func TestClientTooSlowToSendWhatTheCoreRuleSetReads(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		wafMode: block, wafBodyLimit: sizeLimitSetting,
-		clientRequestTimeout: shortTimeoutSetting, metricsToken: token,
-	})
-
-	conn := dial(t, addr)
-	send(t, conn, "POST /comment HTTP/1.1\r\nHost: app\r\nContent-Type: "+formData+
-		"\r\nContent-Length: 100\r\n\r\ncontent=the first bytes")
-
-	wantStatus(t, readResponse(t, conn), http.StatusRequestTimeout)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusRequestTimeout, requestlog.ActionTimedOut)
-	wantNotSentToTheApp(t, line)
-	wantLimitHits(t, addr, clientRequestTimeout, 1)
-}
-
-func TestBodyOverTheSizeLimitWhileTheCoreRuleSetReadsIt(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		wafMode: block, wafBodyLimit: "4K",
-		requestMaxBytes: sizeLimitSetting, metricsToken: token,
-	})
-
-	// Sent in chunks, its length is not announced, and is found to be over
-	// the limit as the Core Rule Set reads it.
-	body := io.MultiReader(strings.NewReader("a=" + strings.Repeat("b", 2*sizeLimit)))
-	req := newRequest(t, http.MethodPost, addr, "/", body)
-	req.Header.Set("Content-Type", formData)
-	wantStatus(t, do(t, req), http.StatusRequestEntityTooLarge)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge)
-	wantNotSentToTheApp(t, line)
-	wantLimitHits(t, addr, requestMaxBytes, 1)
-}
-
-// wantNotSentToTheApp checks that the request of line was not sent to the
-// app at all.
-func wantNotSentToTheApp(t *testing.T, line logLine) {
-	t.Helper()
-
-	_, sent := line.fields["duration_upstream_total"]
-	if sent {
-		t.Error("log line has duration_upstream_total, for a request sent to the app")
-	}
-}
-
 func TestResponsesAreNotInspected(t *testing.T) {
 	t.Parallel()
 
@@ -441,14 +334,12 @@ func TestResponsesAreNotInspected(t *testing.T) {
 		t.Errorf("answered %d with %q, want 200 with the app's page", got.status, got.body)
 	}
 
-	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionForward)
+	wantLine(t, out.endedLine(t), http.StatusOK, requestlog.ActionForward)
 }
 
 func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T) {
 	t.Parallel()
 
-	const scraper = "192.0.2.200"
-
 	s, _, server := startWithClock(t, "", map[string]string{
 		wafMode: block, errorBurstThreshold: "2", metricsToken: token,
 	})
@@ -474,7 +365,7 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 		t.Errorf("history counts the offences %+v, want %+v", offences, want)
 	}
 
-	metrics := s.scrape(scraper)
+	metrics := s.scrape()
 	wantMetric(t, metrics,
 		`smallwebwaf_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
 	wantMetric(t, metrics,
@@ -486,8 +377,6 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T) {
 	t.Parallel()
 
-	const scraper = "192.0.2.200"
-
 	s, _, server := startWithClock(t, "", map[string]string{
 		wafMode: detect, errorBurstThreshold: "2", metricsToken: token,
 	})
@@ -503,7 +392,7 @@ func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T
 		t.Errorf("history counts the offences %+v, want none", offences)
 	}
 
-	metrics := s.scrape(scraper)
+	metrics := s.scrape()
 	wantMetric(t, metrics,
 		`smallwebwaf_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
 	wantNoSeries(t, metrics,
@@ -576,6 +465,7 @@ func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
 				Instance: alertInstance,
 				Time:     clk.Now(),
 				Event:    alerts.EventWAFBlock,
+				Host:     appHost,
 				Client:   netip.MustParseAddr(client),
 				Netblock: netip.MustParsePrefix(client + "/32"),
 				Reason:   "scored by the Core Rule Set at or over SWWAF_WAF_ANOMALY_THRESHOLD",

internal/proxy/countries_test.go

@@ -65,7 +65,7 @@ func TestCountryLists(t *testing.T) {
 				req.Header.Set(forwardedFor, sent.client)
 				got := do(t, req)
 
-				line := out.requestLines(t, i+1)[i]
+				line := out.endedLines(t, i+1)[i]
 				if line.ASN != sent.asn || line.ASName != sent.asName ||
 					line.Country != sent.country {
 					t.Errorf("log line has %q, %q and %q, want %q, %q and %q",
@@ -90,7 +90,7 @@ func TestCountryLists(t *testing.T) {
 	}
 }
 
-func TestCountryRefusalComesBeforeTheBody(t *testing.T) {
+func TestCountryRefusalKeepsARequestFromTheApp(t *testing.T) {
 	t.Parallel()
 
 	var calls atomic.Int32
@@ -109,13 +109,9 @@ func TestCountryRefusalComesBeforeTheBody(t *testing.T) {
 	req.Header.Set(forwardedFor, fromKP)
 	wantStatus(t, do(t, req), http.StatusForbidden)
 
-	line := out.requestLine(t)
+	line := out.endedLine(t)
 	wantLine(t, line, http.StatusForbidden, requestlog.ActionCountryDenied)
 
-	if line.RequestBytes != 0 {
-		t.Errorf("log line has request_bytes %d, want 0", line.RequestBytes)
-	}
-
 	if calls.Load() != 0 {
 		t.Errorf("the app was called %d times, want none", calls.Load())
 	}
@@ -211,7 +207,7 @@ func TestPrivateAddressIsNeverLookedUp(t *testing.T) {
 
 				wantStatus(t, do(t, req), http.StatusOK)
 
-				line := out.requestLines(t, i+1)[i]
+				line := out.endedLines(t, i+1)[i]
 				wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
 				for _, field := range []string{"asn", "as_name", "country"} {
@@ -284,9 +280,9 @@ func TestExclusiveListRefusesAPrivateAddressUnlessAllowed(t *testing.T) {
 // each in an AS of its own, and no other address. It returns its URL, and
 // what returns the addresses it has been asked about. A test that needs
 // the stand-in to be asked or to answer sets SWWAF_LOOKUP_TIMEOUT to an
-// hour, whether or not a request waits for the answer: on the default
-// second, a hold-up of the test process can abandon the request to the
-// stand-in, and leave the client unknown.
+// hour, whether or not a request waits for the answer: on the default, a
+// hold-up of the test process can abandon the request to the stand-in, and
+// leave the client unknown.
 func startGeoJS(t *testing.T) (string, func() []string) {
 	t.Helper()
 

internal/proxy/crowdsec_test.go

@@ -84,7 +84,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 
 	// The ban and the hit are counted, and the list has the metrics of any
 	// list fetched from a URL.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	labels := `{instance="` + alertInstance + `",source="` + decisionsURL + `"}`
 
 	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="crowdsec",`+

internal/proxy/errorburst_test.go

@@ -17,8 +17,8 @@ import (
 
 const errorBurstThreshold = "SWWAF_ERROR_BURST_THRESHOLD"
 
-// refused is a request the tests here send, which smallwebwaf refuses
-// after a rule file match, or for a missing or wrong token.
+// refused is a request the tests here send, which servewaf refuses after a rule
+// file match.
 type refused int
 
 const (
@@ -27,11 +27,6 @@ const (
 	// banRule is one its ban rule refuses with 403, and bans the client
 	// for.
 	banRule
-	// noMetricsToken is one for the metrics without a token, and
-	// wrongAdminToken one for the bans with the metrics token, each
-	// refused with 401.
-	noMetricsToken
-	wrongAdminToken
 )
 
 // send sends r from the client at from, checks its answer and log line as
@@ -45,14 +40,6 @@ func (r refused) send(s *sender, from string) logLine {
 			requestlog.ActionRuleBlocked)
 	case banRule:
 		return s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
-	case noMetricsToken:
-		return s.request(from, proxy.MetricsPath, http.StatusUnauthorized,
-			requestlog.ActionAdmin)
-	case wrongAdminToken:
-		line, _ := s.requestWithHeader(from, proxy.BansPath, "Authorization: "+bearer,
-			http.StatusUnauthorized, requestlog.ActionAdmin)
-
-		return line
 	}
 
 	s.t.Fatalf("no request for the refusal %d", r)
@@ -60,7 +47,7 @@ func (r refused) send(s *sender, from string) logLine {
 	return logLine{}
 }
 
-// startForErrorBurst is startWithClock with testRules, both tokens and
+// startForErrorBurst is startWithClock with testRules, the metrics token and
 // SWWAF_ERROR_BURST_THRESHOLD at threshold, and the settings in env.
 func startForErrorBurst(
 	t *testing.T, threshold string, env map[string]string,
@@ -70,7 +57,6 @@ func startForErrorBurst(
 	settings := map[string]string{
 		errorBurstThreshold: threshold,
 		rulesDir:            writeRules(t, testRules),
-		adminToken:          adminSecret,
 		metricsToken:        token,
 	}
 	maps.Copy(settings, env)
@@ -87,14 +73,7 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 		refusals []refused
 	}{
 		{"block rule", []refused{blockRule, blockRule, blockRule, blockRule}},
-		{
-			"missing or wrong token",
-			[]refused{noMetricsToken, wrongAdminToken, noMetricsToken, wrongAdminToken},
-		},
-		{
-			"a mix ending in a ban rule",
-			[]refused{blockRule, noMetricsToken, blockRule, banRule},
-		},
+		{"a ban rule last", []refused{blockRule, blockRule, blockRule, banRule}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -130,13 +109,11 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 	t.Parallel()
 
-	const scraper = "192.0.2.200"
-
 	s, clk, server := startForErrorBurst(t, "2", nil)
 	start := clk.Now()
 
 	blockRule.send(s, client)
-	wrongAdminToken.send(s, client)
+	blockRule.send(s, client)
 	line := blockRule.send(s, client)
 
 	expires := start.Add(time.Hour)
@@ -173,19 +150,17 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
 	}
 
-	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 2, TokenRefused: 1}
+	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 3}
 	if offences := historyOf(t, server, client).Offences; offences != wantOffences {
 		t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
 	}
 
-	metrics := s.scrape(scraper)
+	metrics := s.scrape()
 	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
 		`kind="refusals",window="minute"}`, 1)
 	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 1)
 	wantMetric(t, metrics,
-		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 2)
-	wantMetric(t, metrics,
-		`smallwebwaf_offences_total{instance="app",kind="token_refused"}`, 1)
+		`smallwebwaf_offences_total{instance="app",kind="rule_blocked"}`, 3)
 	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 1)
 }
 
@@ -291,19 +266,15 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
 		allowNets: allowed, rateLimitExemptNets: exempt,
 	})
 
-	// A client in SWWAF_ALLOW_NETS still needs the token, but is not
-	// counted.
+	// A client in SWWAF_ALLOW_NETS is not refused, and so not counted.
 	for range 3 {
-		line := noMetricsToken.send(s, allowed)
-		if line.LimitHit != "" {
-			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
-		}
+		s.request(allowed, blockedPath, http.StatusOK, requestlog.ActionForward)
 	}
 
 	// One the rate limits do not apply to is.
-	noMetricsToken.send(s, exempt)
+	blockRule.send(s, exempt)
 
-	line := wrongAdminToken.send(s, exempt)
+	line := blockRule.send(s, exempt)
 	if line.LimitHit != requestlog.LimitHitErrorBurst {
 		t.Errorf("log line has limit_hit %q, want error_burst", line.LimitHit)
 	}
@@ -336,7 +307,6 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 		mode:                observe,
 		errorBurstThreshold: "1",
 		rulesDir:            writeRules(t, testRules),
-		adminToken:          adminSecret,
 	})
 	start := clk.Now()
 	held := bans.Ban{
@@ -347,10 +317,11 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	}
 	server.Ledger.Load([]bans.Ban{held})
 
-	// Under a ban, enforce mode would have refused these before the
-	// endpoint, so their tokens are not counted.
+	// Under a ban, enforce mode would have refused these before the rule, so
+	// they are not counted.
 	for range 2 {
-		line := wrongAdminToken.send(s, otherClient)
+		line := s.request(otherClient, blockedPath, http.StatusOK,
+			requestlog.ActionForward)
 		wantWouldAction(t, line, requestlog.ActionBanned)
 
 		if line.LimitHit != "" {
@@ -360,7 +331,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 
 	// The block rule's refusal, which enforce mode would have answered 403,
 	// is the second of the client's, and would have banned it.
-	wrongAdminToken.send(s, client)
+	s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
 
 	line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
 	wantWouldAction(t, line, requestlog.ActionRuleBlocked)

internal/proxy/health_test.go

@@ -2,24 +2,18 @@ package proxy_test
 
 import (
 	"net/http"
-	"sync/atomic"
 	"testing"
 
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
+func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	t.Parallel()
 
-	var calls atomic.Int32
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		calls.Add(1)
-	})
 	// With a limit of one request a minute, any request counted before
 	// the last one would have it refused.
-	addr, out := startProxy(t, app.URL, map[string]string{rateLimitPerMinute: "1"})
+	s, _, _ := startWithClock(t, "", map[string]string{rateLimitPerMinute: "1"})
 
 	const (
 		healthChecks = 3
@@ -27,8 +21,7 @@ func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
 	)
 
 	for range healthChecks {
-		got := get(t, addr, proxy.HealthPath)
-		wantStatus(t, got, http.StatusOK)
+		got := s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
 
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
 			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+
@@ -36,21 +29,12 @@ func TestHealthEndpointIsAnsweredBeforeAnyCheck(t *testing.T) {
 		}
 	}
 
-	wantStatus(t, get(t, addr, "/"), http.StatusOK)
-
-	lines := out.requestLines(t, healthChecks+1)
-	for _, line := range lines[:healthChecks] {
-		wantLine(t, line, http.StatusOK, requestlog.ActionAdmin)
+	s.get(client, http.StatusOK, requestlog.ActionForward)
 
+	for _, line := range s.out.endedLines(t, healthChecks)[:healthChecks] {
 		if line.ResponseContentType != contentType {
 			t.Errorf("health check's log line has response_content_type %q, "+
 				"want %q", line.ResponseContentType, contentType)
 		}
 	}
-
-	wantLine(t, lines[healthChecks], http.StatusOK, requestlog.ActionForward)
-
-	if calls.Load() != 1 {
-		t.Errorf("the app was called %d times, want once", calls.Load())
-	}
 }

internal/proxy/history_test.go

@@ -86,7 +86,7 @@ func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
 
 	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
 	wantStatus(t, got, http.StatusOK)
-	out.requestLine(t)
+	out.endedLine(t)
 
 	history := historyOf(t, server, localhost)
 	if history.RequestBytes != 3 || history.ResponseBytes != 5 {
@@ -95,38 +95,33 @@ func TestHistoryCountsTheBodiesEachWay(t *testing.T) {
 	}
 }
 
-func TestHealthEndpointIsNotInTheHistory(t *testing.T) {
+func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
 	t.Parallel()
 
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
+	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	wantStatus(t, get(t, addr, proxy.HealthPath), http.StatusOK)
-	out.requestLine(t)
+	s.adminRequest("", http.MethodGet, proxy.HealthPath, "", http.StatusOK)
+	s.adminRequest("", http.MethodGet, proxy.MetricsPath, "", http.StatusUnauthorized)
+	s.scrape()
 
 	if clients := server.Limiter.Snapshot(); len(clients) != 0 {
 		t.Errorf("the table holds %+v, want no client", clients)
 	}
 }
 
-func TestRequestForSmallwebwafIsRefusedOnlyWithoutTheToken(t *testing.T) {
+func TestPathUnderTheOwnPrefixIsNeitherForwardedNorRefused(t *testing.T) {
 	t.Parallel()
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now,
-		map[string]string{metricsToken: token})
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, nil)
 
-	// The metrics and the 404 are neither forwarded nor refused; the 401
-	// is refused.
-	scrape(t, addr)
 	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
-	wantStatus(t, get(t, addr, proxy.MetricsPath), http.StatusUnauthorized)
-	out.requestLines(t, 3)
+	out.endedLine(t)
 
 	history := historyOf(t, server, localhost)
-	if history.Requests != 3 || history.Forwarded != 0 || history.Refused != 1 {
+	if history.Requests != 1 || history.Forwarded != 0 || history.Refused != 0 {
 		t.Errorf("history counts %d requests, %d forwarded and %d refused, "+
-			"want 3, 0 and 1", history.Requests, history.Forwarded, history.Refused)
+			"want 1, 0 and 0", history.Requests, history.Forwarded, history.Refused)
 	}
 }
 

internal/proxy/limits_test.go

@@ -1,162 +0,0 @@
-package proxy_test
-
-import (
-	"bytes"
-	"errors"
-	"io"
-	"net/http"
-	"strconv"
-	"sync/atomic"
-	"testing"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// sizeLimit is the size limit the tests set, 1K as a setting.
-const (
-	sizeLimit        = 1 << 10
-	sizeLimitSetting = "1K"
-)
-
-func TestRequestBodyLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		size int
-		// announced sends the size in Content-Length; otherwise the body
-		// is sent in chunks with no length given.
-		announced bool
-		want      int
-		action    string
-		// refusedBeforeApp is a refusal before anything reaches the app.
-		// A body over the limit with no length given has already partly
-		// reached the app when it is refused.
-		refusedBeforeApp bool
-	}{
-		{"announced, over the limit", 2 * sizeLimit, true,
-			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, true},
-		{"announced, at the limit", sizeLimit, true,
-			http.StatusOK, requestlog.ActionForward, false},
-		{"not announced, over the limit", 4 * sizeLimit, false,
-			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge, false},
-		{"not announced, at the limit", sizeLimit, false,
-			http.StatusOK, requestlog.ActionForward, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var calls atomic.Int32
-
-			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-				calls.Add(1)
-
-				_, _ = io.Copy(io.Discard, r.Body)
-			})
-			addr, out := startProxy(t, app.URL, map[string]string{
-				requestMaxBytes: sizeLimitSetting,
-				metricsToken:    token,
-			})
-
-			var body io.Reader = bytes.NewReader(make([]byte, tc.size))
-			if !tc.announced {
-				body = io.MultiReader(body) // hides the length
-			}
-
-			wantStatus(t, do(t, newRequest(t, http.MethodPost, addr, "/upload", body)),
-				tc.want)
-			wantLine(t, out.requestLine(t), tc.want, tc.action)
-
-			hits := 0
-			if tc.action == requestlog.ActionTooLarge {
-				hits = 1
-			}
-
-			wantLimitHits(t, addr, requestMaxBytes, hits)
-
-			if tc.refusedBeforeApp && calls.Load() != 0 {
-				t.Errorf("the app was called %d times, want never", calls.Load())
-			}
-		})
-	}
-}
-
-func TestResponseBodyLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		size int
-		// announced sends the size in Content-Length; otherwise the body
-		// is sent in chunks with no length given.
-		announced bool
-		want      int
-		action    string
-		// received is how much of a body the client gets, and cutOff
-		// whether the connection is then cut.
-		received int
-		cutOff   bool
-	}{
-		{"announced, over the limit", 2 * sizeLimit, true, http.StatusBadGateway,
-			requestlog.ActionTooLarge, len("Bad Gateway\n"), false},
-		{"announced, at the limit", sizeLimit, true, http.StatusOK,
-			requestlog.ActionForward, sizeLimit, false},
-		{"not announced, over the limit", 4 * sizeLimit, false, http.StatusOK,
-			requestlog.ActionTooLarge, sizeLimit, true},
-		{"not announced, at the limit", sizeLimit, false, http.StatusOK,
-			requestlog.ActionForward, sizeLimit, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-				answerWithSize(w, tc.size, tc.announced)
-			})
-			addr, out := startProxy(t, app.URL, map[string]string{
-				responseMaxBytes: sizeLimitSetting,
-				metricsToken:     token,
-			})
-
-			got := get(t, addr, "/download")
-			wantStatus(t, got, tc.want)
-
-			if len(got.body) != tc.received ||
-				errors.Is(got.err, io.ErrUnexpectedEOF) != tc.cutOff {
-				t.Errorf("client got %d bytes (%v), want %d",
-					len(got.body), got.err, tc.received)
-			}
-
-			line := out.requestLine(t)
-			wantLine(t, line, tc.want, tc.action)
-
-			if line.UpstreamStatus != http.StatusOK {
-				t.Errorf("log line has upstream_status %d", line.UpstreamStatus)
-			}
-
-			hits := 0
-			if tc.action == requestlog.ActionTooLarge {
-				hits = 1
-			}
-
-			wantLimitHits(t, addr, responseMaxBytes, hits)
-		})
-	}
-}
-
-// answerWithSize answers with a body of size bytes, announced in
-// Content-Length or sent in chunks with no length given.
-func answerWithSize(w http.ResponseWriter, size int, announced bool) {
-	body := make([]byte, size)
-	if announced {
-		w.Header().Set("Content-Length", strconv.Itoa(size))
-		_, _ = w.Write(body)
-
-		return
-	}
-
-	// Sending part of it before the end keeps Go's server from working
-	// out the length.
-	_, _ = w.Write(body[:size/2])
-	_ = http.NewResponseController(w).Flush()
-	_, _ = w.Write(body[size/2:])
-}

internal/proxy/lookup.go

@@ -4,15 +4,15 @@ import (
 	"context"
 	"net/http"
 	"net/netip"
+	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 )
 
-// The headers in which the app is passed the client's AS number and
-// country while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes every header
-// name in this form, as it sends it and as it receives it, so X-Client-ASN
-// arrives as X-Client-Asn, and Del removes a client's own whatever their
-// case; header names are not case-sensitive.
+// The headers in which an answer of allow gives rproxy the client's AS number
+// and country, for the app, while SWWAF_ADD_LOOKUP_HEADERS is set. Go writes
+// every header name in this form, as it sends it and as it receives it, so
+// X-Client-ASN arrives as X-Client-Asn; header names are not case-sensitive.
 const (
 	asnHeader     = "X-Client-Asn"
 	countryHeader = "X-Client-Country"
@@ -23,17 +23,24 @@ const (
 // SWWAF_LOOKUP_SOURCE is off or the client is on a private, loopback or
 // link-local address, which no lookup can place. The lookup database
 // answers at once. With GeoJS, while a setting needs the answer, such as a
-// country list or a biased threshold, a new client's request waits for it.
-// ctx is the request's own context.
-func (rq *request) lookUp(ctx context.Context) {
+// country list or a biased threshold, a new client's request waits for it,
+// unless refusedWhateverTheAnswer reports true. ctx is the request's own
+// context.
+func (rq *request) lookUp(ctx context.Context, now time.Time) {
 	if rq.h.config.LookupSource == "off" || !canBePlaced(rq.client) {
 		return
 	}
 
-	if rq.h.config.LookupSource == "file" {
-		rq.lookupAnswer = rq.h.lookupFile.LookUp(rq.h.clientGroup(rq.client))
-	} else {
-		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, rq.h.clientGroup(rq.client))
+	client := rq.h.clientGroup(rq.client)
+
+	switch {
+	case rq.h.config.LookupSource == "file":
+		rq.lookupAnswer = rq.h.lookupFile.LookUp(client)
+	case rq.refusedWhateverTheAnswer(now):
+		rq.lookupAnswer = rq.h.geojs.LookUpWithoutWaiting(ctx, client)
+		rq.skippedLookupWait = rq.lookupAnswer.Answered.IsZero()
+	default:
+		rq.lookupAnswer = rq.h.geojs.LookUp(ctx, client)
 	}
 
 	rq.lookedUp = true
@@ -52,8 +59,8 @@ func (h *handler) addLookup(answer lookup.Answer) {
 		answer.ASN, answer.ASName, answer.Country)
 }
 
-// setLookupHeaders sets the headers in which the app is passed the
-// client's AS number and country, leaving out one that is unknown.
+// setLookupHeaders sets the headers that give the client's AS number and
+// country, leaving out one that is unknown.
 func setLookupHeaders(header http.Header, asn, country string) {
 	if asn != "" {
 		header.Set(asnHeader, asn)

internal/proxy/lookup_test.go

@@ -1,9 +1,7 @@
 package proxy_test
 
 import (
-	"net"
 	"net/http"
-	"net/http/httptest"
 	"net/netip"
 	"path/filepath"
 	"slices"
@@ -142,7 +140,7 @@ func TestRequestThatWaitedForItsLookupIsCountedWhenItGoesOn(t *testing.T) {
 		t.Fatalf("first request: %v", err)
 	}
 
-	wantLine(t, out.requestLines(t, 2)[1], http.StatusOK, requestlog.ActionForward)
+	wantLine(t, out.endedLines(t, 2)[1], http.StatusOK, requestlog.ActionForward)
 
 	// The third request's count holds all three: the first was counted
 	// when it went on, in the minute under way, and the second's count
@@ -150,7 +148,7 @@ func TestRequestThatWaitedForItsLookupIsCountedWhenItGoesOn(t *testing.T) {
 	clk.advance(500 * time.Millisecond)
 	wantStatus(t, do(t, requestFromDE()), http.StatusOK)
 
-	if got := out.requestLines(t, 3)[2].Counts.Minute; got != 3 {
+	if got := out.endedLines(t, 3)[2].Counts.Minute; got != 3 {
 		t.Errorf("the third request's count in the minute is %v, want 3", got)
 	}
 }
@@ -319,7 +317,7 @@ func TestLookupHeadersArePassedToTheAppAndTheClientsOwnRemoved(t *testing.T) {
 	addr, out, _ := startProxyWithClock(t, app.URL, geojsURL, time.Now, map[string]string{
 		trustedProxies:   trustLocalhost,
 		lookupTimeout:    "1h",
-		addLookupHeaders: "true",
+		addLookupHeaders: on,
 	})
 	s := &sender{t: t, addr: addr, out: out}
 
@@ -383,22 +381,19 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 	// network, which would keep that clock from moving on: the request is
 	// handed to the proxy's handler, and GeoJS is one that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		// Not the default second. The exclusive list needs the answer, and
-		// the app is never reached.
+		// Not the default. The exclusive list needs the answer, and the app
+		// is never reached.
 		const timeout = 3 * time.Second
 
-		server, out, _ := newProxy(t, "http://app.invalid", unansweredGeoJSURL,
-			time.Now, map[string]string{
+		server, out, _ := newServeWAF(t, unansweredGeoJSURL, time.Now,
+			map[string]string{
 				lookupTimeout:    timeout.String(),
 				allowedCountries: "DE",
 			})
 
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/",
-			http.NoBody)
-		req.RemoteAddr = net.JoinHostPort(fromDE, "1234")
 		began := time.Now()
 
-		server.Handler.ServeHTTP(httptest.NewRecorder(), req)
+		serveFromDE(t, server, http.MethodGet, http.NoBody)
 
 		if waited := time.Since(began); waited != timeout {
 			t.Errorf("the request waited %s for its answer, want %s", waited, timeout)

internal/proxy/metrics_test.go

@@ -7,8 +7,6 @@ import (
 	"net/netip"
 	"strconv"
 	"strings"
-	"sync"
-	"sync/atomic"
 	"testing"
 	"time"
 
@@ -30,41 +28,21 @@ const (
 func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	t.Parallel()
 
-	var calls atomic.Int32
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		calls.Add(1)
-	})
-	addr, out := startProxy(t, app.URL, nil)
+	s, _, _ := startWithClock(t, "", nil)
 
 	// An empty token does not match the unset one either.
-	for i, authorization := range []string{bearer, "Bearer ", ""} {
-		req := newRequest(t, http.MethodGet, addr, proxy.MetricsPath, http.NoBody)
-		if authorization != "" {
-			req.Header.Set("Authorization", authorization)
-		}
-
-		wantStatus(t, do(t, req), http.StatusNotFound)
-		wantLine(t, out.requestLines(t, i+1)[i], http.StatusNotFound,
-			requestlog.ActionAdmin)
-	}
-
-	if calls.Load() != 0 {
-		t.Errorf("the app was called %d times, want never", calls.Load())
+	for _, authorization := range []string{bearer, "Bearer ", ""} {
+		s.adminRequest(authorization, http.MethodGet, proxy.MetricsPath, "",
+			http.StatusNotFound)
 	}
 }
 
 func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 	t.Parallel()
 
-	var calls atomic.Int32
+	s, _, _ := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {
-		calls.Add(1)
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{metricsToken: token})
-
-	for i, tc := range []struct {
+	for _, tc := range []struct {
 		method, path, authorization string
 		status                      int
 	}{
@@ -81,14 +59,7 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		{http.MethodGet, "/_smallwebwaf/bans", bearer, http.StatusNotFound},
 		{http.MethodPost, proxy.HealthPath, "", http.StatusNotFound},
 	} {
-		req := newRequest(t, tc.method, addr, tc.path, http.NoBody)
-		if tc.authorization != "" {
-			req.Header.Set("Authorization", tc.authorization)
-		}
-
-		got := do(t, req)
-		wantStatus(t, got, tc.status)
-		wantLine(t, out.requestLines(t, i+1)[i], tc.status, requestlog.ActionAdmin)
+		got := s.adminRequest(tc.authorization, tc.method, tc.path, "", tc.status)
 
 		if tc.status == http.StatusUnauthorized &&
 			got.header.Get("WWW-Authenticate") != "Bearer" {
@@ -101,58 +72,28 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 			t.Errorf("the metrics are\n%s", got.body)
 		}
 	}
-
-	if calls.Load() != 0 {
-		t.Errorf("the app was called %d times, want never", calls.Load())
-	}
-}
-
-func TestMetricsAreAskedForThroughTheChecks(t *testing.T) {
-	t.Parallel()
-
-	s, _, _ := startWithClock(t, "", map[string]string{
-		metricsToken:       token,
-		rateLimitPerMinute: "1",
-	})
-
-	// Asking for the metrics counts toward the client's limit of one
-	// request a minute, so its next request breaks it, and bans it. A
-	// banned client is refused the metrics too.
-	s.scrape(client)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
-	s.requestWithHeader(client, proxy.MetricsPath, "Authorization: "+bearer,
-		http.StatusForbidden, requestlog.ActionBanned)
 }
 
 func TestMetricsCountTheTraffic(t *testing.T) {
 	t.Parallel()
 
-	arrived, release := make(chan struct{}), make(chan struct{})
 	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.Copy(io.Discard, r.Body)
-
-		if r.URL.Path == "/held" {
-			close(arrived)
-			<-release
-		}
-
 		_, _ = io.WriteString(w, "hello")
 	})
-	releaseApp := sync.OnceFunc(func() { close(release) })
-	t.Cleanup(releaseApp)
-
-	addr, out := startProxy(t, app.URL, map[string]string{metricsToken: token})
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now,
+		map[string]string{metricsToken: token})
 
 	got := do(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("abc")))
 	wantStatus(t, got, http.StatusOK)
 	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
-	out.requestLines(t, 2)
+	out.endedLines(t, 2)
 
 	forward := `{action="forward",instance="app",status_class="2xx"}`
 	notFound := `{action="admin",instance="app",status_class="4xx"}`
 
 	// The request for the metrics is itself under way.
-	metrics := scrape(t, addr)
+	metrics := scrape(t, server.Addr)
 	wantMetric(t, metrics, "smallwebwaf_requests_total"+forward, 1)
 	wantMetric(t, metrics, "smallwebwaf_requests_total"+notFound, 1)
 	wantMetric(t, metrics, "smallwebwaf_request_bytes_total"+forward, 3)
@@ -166,50 +107,20 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 	wantMetric(t, metrics, `smallwebwaf_requests_in_flight{instance="app"}`, 1)
 	metric(t, metrics, `go_goroutines{instance="app"}`)
 	metric(t, metrics, `process_start_time_seconds{instance="app"}`)
-
-	// A request the app holds is under way until it ends.
-	httpClient := newClient(t)
-	held := newRequest(t, http.MethodGet, addr, "/held", http.NoBody)
-	ended := make(chan error, 1)
-
-	go func() {
-		res, err := httpClient.Do(held)
-		if err == nil {
-			err = readAnswer(res).err
-		}
-
-		ended <- err
-	}()
-
-	<-arrived
-	wantMetric(t, scrape(t, addr), `smallwebwaf_requests_in_flight{instance="app"}`, 2)
-	releaseApp()
-
-	err := <-ended
-	if err != nil {
-		t.Fatalf("held request: %v", err)
-	}
-
-	out.requestLines(t, 5)
-	wantMetric(t, scrape(t, addr), `smallwebwaf_requests_in_flight{instance="app"}`, 1)
 }
 
 func TestMetricsCountLimitsAndBans(t *testing.T) {
 	t.Parallel()
 
-	const (
-		scraper = "192.0.2.200" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
-		denied  = "192.0.2.50"  // in SWWAF_DENY_NETS
-	)
+	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
 
 	s, clk, _ := startWithClock(t, "", map[string]string{
-		metricsToken:        token,
-		rateLimitPerMinute:  "1",
-		rateLimitExemptNets: scraper,
-		denyNets:            denied,
-		banResponse:         "close",
-		limitBanDuration:    "1h",
-		maxBanDuration:      "2h",
+		metricsToken:       token,
+		rateLimitPerMinute: "1",
+		denyNets:           denied,
+		banResponse:        banResponseClose,
+		limitBanDuration:   "1h",
+		maxBanDuration:     "2h",
 	})
 
 	// SWWAF_BAN_RESPONSE=close sends no status at all.
@@ -219,7 +130,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionRateLimited)
 
-	metrics := s.scrape(scraper)
+	metrics := s.scrape()
 	wantMetric(t, metrics,
 		`smallwebwaf_requests_total{action="denied",instance="app",status_class="none"}`, 1)
 	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
@@ -230,38 +141,35 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 0)
 
 	clk.advance(time.Hour)
-	wantMetric(t, s.scrape(scraper), `smallwebwaf_active_bans{instance="app"}`, 0)
+	wantMetric(t, s.scrape(), `smallwebwaf_active_bans{instance="app"}`, 0)
 
 	// A limit broken again right after would ban for three hours, longer
 	// than SWWAF_MAX_BAN_DURATION, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, 0, requestlog.ActionRateLimited)
 
-	metrics = s.scrape(scraper)
+	metrics = s.scrape()
 	wantMetric(t, metrics, `smallwebwaf_rate_limit_hits_total{instance="app",`+
 		`kind="requests",window="minute"}`, 2)
 	wantMetric(t, metrics, `smallwebwaf_offences_total{instance="app",kind="limit"}`, 2)
 	wantMetric(t, metrics, `smallwebwaf_bans_made_total{cause="limit",instance="app"}`, 2)
 	wantMetric(t, metrics, `smallwebwaf_active_bans{instance="app"}`, 1)
 	wantMetric(t, metrics, `smallwebwaf_permanent_bans{instance="app"}`, 1)
-	// denied, client, and the scraper as of its earlier requests.
-	wantMetric(t, metrics, `smallwebwaf_tracked_clients{instance="app"}`, 3)
+	// denied and client.
+	wantMetric(t, metrics, `smallwebwaf_tracked_clients{instance="app"}`, 2)
 }
 
 func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 	t.Parallel()
 
-	const scraper = "192.0.2.200" // in SWWAF_RATE_LIMIT_EXEMPT_NETS
-
 	s, clk, server := startWithClock(t, "", map[string]string{
-		metricsToken:        token,
-		adminToken:          adminSecret,
-		rateLimitExemptNets: scraper,
+		metricsToken: token,
+		adminToken:   adminSecret,
 	})
 
 	const admins = `smallwebwaf_bans_made_total{cause="admin",instance="app"}`
 
-	wantMetric(t, s.scrape(scraper), admins, 0)
+	wantMetric(t, s.scrape(), admins, 0)
 
 	// As an admin's edit of bans.json that adds a ban is taken in.
 	server.Ledger.LoadEdit([]bans.Ban{{
@@ -269,11 +177,11 @@ func TestMetricsCountTheBansAnAdminMakes(t *testing.T) {
 		Start:    clk.Now(),
 	}})
 
-	wantMetric(t, s.scrape(scraper), admins, 1)
+	wantMetric(t, s.scrape(), admins, 1)
 
 	// And a ban made through the endpoint.
 	s.admin(http.MethodPost, proxy.BansPath, banOtherClient, http.StatusOK)
-	wantMetric(t, s.scrape(scraper), admins, 2)
+	wantMetric(t, s.scrape(), admins, 2)
 }
 
 func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
@@ -312,7 +220,7 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 			// Each is counted before the next is sent, so that the
 			// countries are ranked in the order sent.
 			lines++
-			out.requestLines(t, lines)
+			out.endedLines(t, lines)
 		}
 	}
 
@@ -321,7 +229,7 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 	send(fromDE, 2, http.StatusOK)
 	send(fromFR, 1, http.StatusOK)
 
-	metrics := scrape(t, addr)
+	metrics := scrape(t, server.Addr)
 	lines++
 
 	wantMetric(t, metrics,
@@ -349,7 +257,7 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 	// from then on, and DE's is gone.
 	send(fromFR, 3, http.StatusOK)
 
-	metrics = scrape(t, addr)
+	metrics = scrape(t, server.Addr)
 	wantMetric(t, metrics,
 		`smallwebwaf_country_requests_total{country="KP",instance="app"}`, 3)
 	wantMetric(t, metrics,
@@ -383,13 +291,12 @@ func TestMetricsByASNumberKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 		answer(fromDE, "AS64501"), answer(fromKP, "AS64502"),
 	})
 
-	// With one AS number of its own, the other is counted as other. The
-	// metrics are asked for from a private address, which has no AS number.
+	// With one AS number of its own, the other is counted as other.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.get(fromKP, http.StatusOK, requestlog.ActionForward)
 
-	metrics := s.scrape("10.0.0.9")
+	metrics := s.scrape()
 	wantMetric(t, metrics,
 		`smallwebwaf_asn_requests_total{asn="AS64501",instance="app"}`, 2)
 	wantMetric(t, metrics,
@@ -412,11 +319,12 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	t.Cleanup(geojs.Close)
 
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, _ := startProxyWithGeoJS(t, app.URL, geojs.URL, map[string]string{
-		trustedProxies:  trustLocalhost,
-		metricsToken:    token,
-		deniedCountries: "kp",
-	})
+	addr, _, server := startProxyWithClock(t, app.URL, geojs.URL, time.Now,
+		map[string]string{
+			trustedProxies:  trustLocalhost,
+			metricsToken:    token,
+			deniedCountries: "kp",
+		})
 
 	// GeoJS fails, so the client counts as coming from an unknown country,
 	// which SWWAF_DENIED_COUNTRIES does not refuse.
@@ -424,16 +332,16 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)
 
-	// The client stops waiting for GeoJS after a second, so GeoJS's
-	// failure can come after its request has ended.
+	// The client stops waiting for GeoJS once SWWAF_LOOKUP_TIMEOUT is up, so
+	// GeoJS's failure can come after its request has ended.
 	deadline := time.Now().Add(waitLimit)
-	metrics := scrape(t, addr)
+	metrics := scrape(t, server.Addr)
 
 	for metric(t, metrics, `smallwebwaf_geojs_failures_total{instance="app"}`) == 0 &&
 		time.Now().Before(deadline) {
 		time.Sleep(pollInterval)
 
-		metrics = scrape(t, addr)
+		metrics = scrape(t, server.Addr)
 	}
 
 	wantMetric(t, metrics, `smallwebwaf_geojs_requests_total{instance="app"}`, 1)
@@ -452,8 +360,8 @@ func keptAnswer(addr, country string) lookup.Answer {
 	}
 }
 
-// scrape asks smallwebwaf at addr for the metrics, with the token, and
-// returns them.
+// scrape asks servewaf at addr for the metrics, with the token, and returns
+// them.
 func scrape(t *testing.T, addr string) string {
 	t.Helper()
 
@@ -468,15 +376,12 @@ func scrape(t *testing.T, addr string) string {
 	return string(got.body)
 }
 
-// scrape asks for the metrics, with the token, from the client at from,
-// and returns them.
-func (s *sender) scrape(from string) string {
+// scrape asks for the metrics, with the token, and returns them.
+func (s *sender) scrape() string {
 	s.t.Helper()
 
-	_, metrics := s.requestWithHeader(from, proxy.MetricsPath, "Authorization: "+bearer,
-		http.StatusOK, requestlog.ActionAdmin)
-
-	return metrics
+	return string(s.adminRequest(bearer, http.MethodGet, proxy.MetricsPath, "",
+		http.StatusOK).body)
 }
 
 // metric returns the value of series in metrics, which are in the
@@ -524,22 +429,3 @@ func wantNoSeries(t *testing.T, metrics, series string) {
 		t.Errorf("there is a series %s", series)
 	}
 }
-
-// wantLimitHits checks that the metrics of smallwebwaf at addr count hits
-// requests that passed the size or time limit of the setting limit, with
-// no series for it when hits is 0.
-func wantLimitHits(t *testing.T, addr, limit string, hits int) {
-	t.Helper()
-
-	series := `smallwebwaf_size_and_time_limit_hits_total{instance="app",limit="` +
-		limit + `"}`
-	metrics := scrape(t, addr)
-
-	if hits == 0 {
-		wantNoSeries(t, metrics, series)
-
-		return
-	}
-
-	wantMetric(t, metrics, series, float64(hits))
-}

internal/proxy/observe_test.go

@@ -1,17 +1,13 @@
 package proxy_test
 
 import (
-	"bytes"
-	"io"
 	"net/http"
 	"net/netip"
 	"reflect"
-	"sync/atomic"
 	"testing"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
@@ -76,11 +72,6 @@ func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 				// Passed to the app, which answered it.
 				line := s.get(sent.from, http.StatusOK, requestlog.ActionForward)
 				wantWouldAction(t, line, sent.refusal)
-
-				if line.UpstreamStatus != http.StatusOK {
-					t.Errorf("log line has upstream_status %d, want 200",
-						line.UpstreamStatus)
-				}
 			}
 		})
 	}
@@ -133,62 +124,6 @@ func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
 	}
 }
 
-func TestObserveModeKeepsTheSizeLimitsAndTheToken(t *testing.T) {
-	t.Parallel()
-
-	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
-
-	var calls atomic.Int32
-
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		calls.Add(1)
-		answerWithSize(w, 2*sizeLimit, true)
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		mode:             observe,
-		trustedProxies:   trustLocalhost,
-		denyNets:         denied,
-		requestMaxBytes:  sizeLimitSetting,
-		responseMaxBytes: sizeLimitSetting,
-		metricsToken:     token,
-	})
-
-	// SWWAF_DENY_NETS would refuse each request; instead a size limit or
-	// the missing token does.
-	for i, tc := range []struct {
-		method, path string
-		body         io.Reader
-		status       int
-		action       string
-	}{
-		{
-			http.MethodPost, "/upload", bytes.NewReader(make([]byte, 2*sizeLimit)),
-			http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge,
-		},
-		{
-			http.MethodGet, "/download", http.NoBody,
-			http.StatusBadGateway, requestlog.ActionTooLarge,
-		},
-		{
-			http.MethodGet, proxy.MetricsPath, http.NoBody,
-			http.StatusUnauthorized, requestlog.ActionAdmin,
-		},
-	} {
-		req := newRequest(t, tc.method, addr, tc.path, tc.body)
-		req.Header.Set(forwardedFor, denied)
-		wantStatus(t, do(t, req), tc.status)
-
-		line := out.requestLines(t, i+1)[i]
-		wantLine(t, line, tc.status, tc.action)
-		wantWouldAction(t, line, requestlog.ActionDenied)
-	}
-
-	// The upload was refused before it reached the app.
-	if calls.Load() != 1 {
-		t.Errorf("the app was called %d times, want once", calls.Load())
-	}
-}
-
 // wantWouldAction checks the request log line's would_action, and that a
 // line that should have none has no such field.
 func wantWouldAction(t *testing.T, line logLine, want string) {

internal/proxy/passthrough_test.go

@@ -1,556 +0,0 @@
-package proxy_test
-
-import (
-	"bufio"
-	"bytes"
-	"errors"
-	"io"
-	"net/http"
-	"reflect"
-	"slices"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/proxy"
-	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// A request target with an escaped slash and space in its path, and a
-// query with a parameter ReverseProxy cannot parse.
-const (
-	rawPath  = "/some%2Fpath/with%20space"
-	rawQuery = "b=2&a=1&bad=%zz;x"
-)
-
-// chunkSize is the size of each part of a body a test sends in parts.
-const chunkSize = 1 << 10
-
-var errNotStreamed = errors.New("the first part never reached the app")
-
-// appSaw is what the app received.
-type appSaw struct {
-	method string
-	target string
-	header http.Header
-	body   []byte
-}
-
-func TestPassesRequestAndAnswerUnchanged(t *testing.T) {
-	t.Parallel()
-
-	requestBody := bytes.Repeat([]byte("request body "), 8000)
-	answerBody := bytes.Repeat([]byte("answer body "), 8000)
-	saw := make(chan appSaw, 1)
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		body, _ := io.ReadAll(r.Body)
-		saw <- appSaw{r.Method, r.RequestURI, r.Header.Clone(), body}
-
-		w.Header().Set("X-App", "yes")
-		w.Header().Add("Set-Cookie", "a=1")
-		w.Header().Add("Set-Cookie", "b=2")
-		w.WriteHeader(http.StatusTeapot)
-		_, _ = w.Write(answerBody)
-	})
-	addr, out := startProxy(t, app.URL, nil)
-
-	req := newRequest(t, http.MethodPatch, addr, rawPath+"?"+rawQuery,
-		bytes.NewReader(requestBody))
-	req.Header.Add("X-Test", "one")
-	req.Header.Add("X-Test", "two")
-	req.Header.Set("User-Agent", "test-agent")
-
-	got := do(t, req)
-
-	wantAppSaw(t, <-saw, requestBody)
-	wantAnswer(t, got, answerBody)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusTeapot, requestlog.ActionForward)
-	wantRequestFields(t, line, addr, len(requestBody), len(answerBody))
-}
-
-func TestPassesThePathAsSent(t *testing.T) {
-	t.Parallel()
-
-	for _, path := range []string{
-		// An encoded slash and a character Go escapes: |, ^, and é sent
-		// as its UTF-8 bytes.
-		"/a%2Fb|c", "/feat%2Fx/file^1", "/x%2Fy/café",
-		// A path starting with //, which Go would send as a scheme and
-		// host if it were put in URL.Opaque.
-		"//a%2Fb",
-	} {
-		t.Run(path, func(t *testing.T) {
-			t.Parallel()
-
-			saw := make(chan string, 1)
-			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-				saw <- r.RequestURI
-			})
-			addr, out := startProxy(t, app.URL, nil)
-
-			conn := dial(t, addr)
-			send(t, conn, "GET "+path+"?q=1 HTTP/1.1\r\nHost: "+appHost+"\r\n\r\n")
-
-			got := readResponse(t, conn)
-			if got.status != http.StatusOK {
-				t.Fatalf("status %d, want %d", got.status, http.StatusOK)
-			}
-
-			target := <-saw
-			if target != path+"?q=1" {
-				t.Errorf("app saw %s, want %s", target, path+"?q=1")
-			}
-
-			line := out.requestLine(t)
-			if line.Path != path {
-				t.Errorf("log line has path %s, want %s", line.Path, path)
-			}
-		})
-	}
-}
-
-// wantAppSaw checks that the app received the test's request unchanged.
-func wantAppSaw(t *testing.T, saw appSaw, body []byte) {
-	t.Helper()
-
-	if saw.method != http.MethodPatch || saw.target != rawPath+"?"+rawQuery {
-		t.Errorf("app saw %s %s, want %s %s", saw.method, saw.target,
-			http.MethodPatch, rawPath+"?"+rawQuery)
-	}
-
-	if !slices.Equal(saw.header.Values("X-Test"), []string{"one", "two"}) {
-		t.Errorf("app saw X-Test %q", saw.header.Values("X-Test"))
-	}
-
-	if saw.header.Get("User-Agent") != "test-agent" {
-		t.Errorf("app saw User-Agent %q", saw.header.Get("User-Agent"))
-	}
-
-	if !bytes.Equal(saw.body, body) {
-		t.Errorf("app saw a body of %d bytes, want the %d sent",
-			len(saw.body), len(body))
-	}
-}
-
-// wantAnswer checks that the client received the app's answer unchanged.
-func wantAnswer(t *testing.T, got answer, body []byte) {
-	t.Helper()
-
-	wantStatus(t, got, http.StatusTeapot)
-
-	if got.header.Get("X-App") != "yes" {
-		t.Errorf("client got X-App %q", got.header.Get("X-App"))
-	}
-
-	if !slices.Equal(got.header.Values("Set-Cookie"), []string{"a=1", "b=2"}) {
-		t.Errorf("client got Set-Cookie %q", got.header.Values("Set-Cookie"))
-	}
-
-	if got.err != nil || !bytes.Equal(got.body, body) {
-		t.Errorf("client got %d bytes (%v), want the %d the app sent",
-			len(got.body), got.err, len(body))
-	}
-}
-
-// wantRequestFields checks the log line's fields about the request. Its
-// time, its id and its timings are checked only for being there.
-func wantRequestFields(t *testing.T, line logLine, host string, sent, received int) {
-	t.Helper()
-
-	bytes := float64(sent + received)
-
-	want := withTimings(line, requestlog.Line{
-		Type: requestType, Time: line.Time, Instance: "app",
-		ClientIP: localhost, Method: http.MethodPatch, Scheme: plain, Host: host,
-		Path: rawPath, Query: rawQuery, Protocol: protocol,
-		Status: http.StatusTeapot, RequestBytes: int64(sent),
-		ResponseBytes: int64(received), UserAgent: "test-agent",
-		RequestID: line.RequestID, PeerIP: localhost, ClientGroup: localhost + "/32",
-		ContentLength: int64(sent), ResponseContentType: "text/plain; charset=utf-8",
-		UpstreamStatus: http.StatusTeapot, Action: requestlog.ActionForward,
-		Counts: ratelimit.Counts{
-			Minute: 1, Hour: 1, Day: 1,
-			MinuteBytes: bytes, HourBytes: bytes, DayBytes: bytes,
-		},
-	})
-	if !reflect.DeepEqual(line.Line, want) {
-		t.Errorf("log line\n%+v\nwant\n%+v", line.Line, want)
-	}
-
-	_, err := time.Parse(time.RFC3339, line.Time)
-	if err != nil || line.RequestID == "" || line.DurationTotal <= 0 ||
-		line.DurationUpstreamTotal == nil || *line.DurationUpstreamTotal <= 0 {
-		t.Errorf("log line has time %q, request_id %q and durations %v and %v",
-			line.Time, line.RequestID, line.DurationTotal,
-			line.fields["duration_upstream_total"])
-	}
-}
-
-func TestAddsNoContentTypeTheAppDidNotSend(t *testing.T) {
-	t.Parallel()
-
-	const typed = "text/plain"
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/typed" {
-			w.Header().Set("Content-Type", typed)
-		} else {
-			// The key with no value keeps Go's server from adding one.
-			w.Header()["Content-Type"] = nil
-		}
-
-		_, _ = io.WriteString(w, "<!doctype html><title>page</title>")
-	})
-	addr, _ := startProxy(t, app.URL, nil)
-
-	got := get(t, addr, "/")
-	if got.header.Values("Content-Type") != nil {
-		t.Errorf("client got Content-Type %q, want none",
-			got.header.Get("Content-Type"))
-	}
-
-	got = get(t, addr, "/typed")
-	if got.header.Get("Content-Type") != typed {
-		t.Errorf("client got Content-Type %q, want %q",
-			got.header.Get("Content-Type"), typed)
-	}
-}
-
-func TestStreamsTheRequestBody(t *testing.T) {
-	t.Parallel()
-
-	chunk := bytes.Repeat([]byte("x"), chunkSize)
-	firstArrived := make(chan struct{})
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		first := make([]byte, len(chunk))
-
-		_, err := io.ReadFull(r.Body, first)
-		if err != nil {
-			return
-		}
-
-		close(firstArrived)
-
-		rest, _ := io.ReadAll(r.Body)
-		_, _ = w.Write(rest)
-	})
-	addr, _ := startProxy(t, app.URL, nil)
-
-	body, writer := io.Pipe()
-
-	go func() {
-		_, _ = writer.Write(chunk)
-
-		select {
-		case <-firstArrived:
-			_, _ = writer.Write(chunk)
-			_ = writer.Close()
-		case <-time.After(waitLimit):
-			_ = writer.CloseWithError(errNotStreamed)
-		}
-	}()
-
-	got := do(t, newRequest(t, http.MethodPost, addr, "/upload", body))
-	if got.err != nil || !bytes.Equal(got.body, chunk) {
-		t.Errorf("app read %d bytes after the first part (%v), want %d",
-			len(got.body), got.err, len(chunk))
-	}
-}
-
-func TestStreamsTheAnswerBody(t *testing.T) {
-	t.Parallel()
-
-	chunk := bytes.Repeat([]byte("y"), chunkSize)
-	firstArrived := make(chan struct{})
-
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = w.Write(chunk)
-		_ = http.NewResponseController(w).Flush()
-
-		select {
-		case <-firstArrived:
-			_, _ = w.Write(chunk)
-		case <-time.After(waitLimit):
-		}
-	})
-	addr, _ := startProxy(t, app.URL, nil)
-
-	req := newRequest(t, http.MethodGet, addr, "/download", http.NoBody)
-
-	res, err := newClient(t).Do(req)
-	if err != nil {
-		t.Fatalf("request: %v", err)
-	}
-
-	first := make([]byte, len(chunk))
-	_, err = io.ReadFull(res.Body, first)
-
-	close(firstArrived)
-
-	got := readAnswer(res)
-	if err != nil || got.err != nil || !bytes.Equal(got.body, chunk) {
-		t.Errorf("client read %d bytes after the first part (%v, %v), want %d",
-			len(got.body), err, got.err, len(chunk))
-	}
-}
-
-func TestUpgradedConnectionOutlastsTheTimeouts(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, echoAfterUpgrade)
-	addr, out := startProxy(t, app.URL, map[string]string{
-		clientRequestTimeout:    shortTimeoutSetting,
-		clientResponseTimeout:   shortTimeoutSetting,
-		upstreamRequestTimeout:  shortTimeoutSetting,
-		upstreamResponseTimeout: shortTimeoutSetting,
-	})
-
-	conn := dial(t, addr)
-	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
-		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
-
-	reader := bufio.NewReader(conn)
-
-	res, err := http.ReadResponse(reader, nil)
-	if err != nil {
-		t.Fatalf("read the answer to the upgrade: %v", err)
-	}
-
-	answered := time.Now()
-	_ = res.Body.Close()
-
-	if res.StatusCode != http.StatusSwitchingProtocols {
-		t.Fatalf("status %d, want %d", res.StatusCode, http.StatusSwitchingProtocols)
-	}
-
-	// Every timeout started before the upgrade was answered, the response
-	// timeouts last, at the end of the request: wait until just past
-	// shortTimeout after the answer was read, then use the connection.
-	time.Sleep(time.Until(answered.Add(shortTimeout + 100*time.Millisecond)))
-	send(t, conn, "still here\n")
-
-	echoed, err := reader.ReadString('\n')
-	if err != nil || echoed != "still here\n" {
-		t.Errorf("echo %q (%v), want %q", echoed, err, "still here\n")
-	}
-
-	_ = conn.Close()
-
-	wantLine(t, out.requestLine(t), http.StatusSwitchingProtocols,
-		requestlog.ActionForward)
-}
-
-// echoAfterUpgrade is an app that switches protocols on request, and then
-// sends back each line it receives.
-func echoAfterUpgrade(w http.ResponseWriter, r *http.Request) {
-	if r.Header.Get("Upgrade") != "websocket" {
-		http.Error(w, "not an upgrade", http.StatusBadRequest)
-
-		return
-	}
-
-	conn, buffered, err := http.NewResponseController(w).Hijack()
-	if err != nil {
-		return
-	}
-
-	defer func() {
-		_ = conn.Close()
-	}()
-
-	_, _ = buffered.WriteString("HTTP/1.1 101 Switching Protocols\r\n" +
-		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
-	_ = buffered.Flush()
-
-	for {
-		line, err := buffered.ReadString('\n')
-		if err != nil {
-			return
-		}
-
-		_, _ = buffered.WriteString(line)
-		_ = buffered.Flush()
-	}
-}
-
-func TestAnswers502WhenTheAppSwitchesToAnotherProtocol(t *testing.T) {
-	t.Parallel()
-
-	// answerAfterUpgrade switches to websocket whatever the client asked
-	// for, and ReverseProxy passes on a switch only to the protocol the
-	// client asked for, here "websocket, foo".
-	app := startApp(t, answerAfterUpgrade)
-	addr, out := startProxy(t, app.URL, nil)
-
-	conn := dial(t, addr)
-	send(t, conn, "GET /ws HTTP/1.1\r\nHost: app\r\n"+
-		"Connection: Upgrade\r\nUpgrade: websocket, foo\r\n\r\n")
-
-	wantStatus(t, readResponse(t, conn), http.StatusBadGateway)
-	wantLine(t, out.requestLine(t), http.StatusBadGateway, requestlog.ActionUpstreamError)
-}
-
-func TestServerHasTheDefaultLimits(t *testing.T) {
-	t.Parallel()
-
-	cfg, err := config.FromEnvironment(func(string) (string, bool) { return "", false })
-	if err != nil {
-		t.Fatalf("default settings: %v", err)
-	}
-
-	server := proxy.New(proxy.Params{
-		Config:     cfg,
-		RequestLog: io.Discard,
-		ProcessLog: requestlog.NewProcessLogger(io.Discard, cfg.InstanceName, cfg.LogLevel),
-	})
-
-	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
-		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
-		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
-			"header timeout %s", server.Addr, server.MaxHeaderBytes,
-			server.IdleTimeout, server.ReadHeaderTimeout)
-	}
-}
-
-func TestRefusesHeadersOverTheLimit(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name  string
-		env   map[string]string
-		limit int
-	}{
-		{"by default", nil, 32 << 10},
-		{"as set", map[string]string{clientHeaderMaxBytes: "8K"}, 8 << 10},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var calls atomic.Int32
-
-			app := startApp(t, func(http.ResponseWriter, *http.Request) {
-				calls.Add(1)
-			})
-			addr, _ := startProxy(t, app.URL, tc.env)
-
-			// size counts every byte of the request: the request line,
-			// the headers and the blank line that ends them.
-			const (
-				start = "GET / HTTP/1.1\r\nHost: app\r\nX-Large: "
-				end   = "\r\n\r\n"
-			)
-
-			for _, sent := range []struct{ size, want int }{
-				{tc.limit, http.StatusOK},
-				{tc.limit + 1, http.StatusRequestHeaderFieldsTooLarge},
-			} {
-				conn := dial(t, addr)
-				send(t, conn,
-					start+strings.Repeat("a", sent.size-len(start)-len(end))+end)
-				wantStatus(t, readResponse(t, conn), sent.want)
-			}
-
-			if calls.Load() != 1 {
-				t.Errorf("the app was called %d times, want once", calls.Load())
-			}
-		})
-	}
-}
-
-func TestAnswers502WhenTheAppCannotBeReached(t *testing.T) {
-	t.Parallel()
-
-	// No test can listen on port 1: listening on port 0 gets one from 32768 up.
-	addr, out := startProxy(t, "http://"+localhost+":1", nil)
-
-	wantStatus(t, get(t, addr, "/"), http.StatusBadGateway)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusBadGateway, requestlog.ActionUpstreamError)
-
-	// There never was a connection to the app, nor an answer from it.
-	wantTimings(t, line, "duration_total", "duration_checks",
-		"duration_upstream_total")
-
-	logged := slices.ContainsFunc(out.lines(t), func(line map[string]any) bool {
-		return line["type"] == "process" && line["msg"] == "request to the app failed"
-	})
-	if !logged {
-		t.Errorf("no process line says the request to the app failed")
-	}
-}
-
-func TestLogLevelHoldsBackNoRequestLine(t *testing.T) {
-	t.Parallel()
-
-	// At error the warning that the request to the app failed is held back,
-	// and is written before the answer is.
-	addr, out := startProxy(t, "http://"+localhost+":1", map[string]string{
-		"SWWAF_LOG_LEVEL": "error",
-	})
-
-	wantStatus(t, get(t, addr, "/"), http.StatusBadGateway)
-	wantLine(t, out.requestLine(t), http.StatusBadGateway, requestlog.ActionUpstreamError)
-
-	for _, line := range out.lines(t) {
-		if line["type"] == "process" {
-			t.Errorf("process line %v, want none at error", line)
-		}
-	}
-}
-
-func TestLogsAnAnswerThatBrokeOff(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = io.WriteString(w, "the first part")
-		_ = http.NewResponseController(w).Flush()
-
-		panic(http.ErrAbortHandler) // drops the connection mid-answer
-	})
-	addr, out := startProxy(t, app.URL, nil)
-
-	got := get(t, addr, "/")
-	if string(got.body) != "the first part" || !errors.Is(got.err, io.ErrUnexpectedEOF) {
-		t.Errorf("client read %q (%v), want the first part cut off", got.body, got.err)
-	}
-
-	wantLine(t, out.requestLine(t), http.StatusOK, requestlog.ActionUpstreamError)
-}
-
-func TestLogsAClientThatWentAway(t *testing.T) {
-	t.Parallel()
-
-	arrived := make(chan struct{})
-
-	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-		close(arrived)
-		<-r.Context().Done()
-	})
-	addr, out := startProxy(t, app.URL, nil)
-
-	conn := dial(t, addr)
-	send(t, conn, "GET /slow HTTP/1.1\r\nHost: app\r\n\r\n")
-
-	select {
-	case <-arrived:
-	case <-time.After(waitLimit):
-		t.Fatal("the request never reached the app")
-	}
-
-	_ = conn.Close()
-
-	line := out.requestLine(t)
-	if !line.Aborted || line.Status != 0 || line.Action != requestlog.ActionForward {
-		t.Errorf("log line has aborted %v, status %d and action %q, "+
-			"want true, 0 and %q",
-			line.Aborted, line.Status, line.Action, requestlog.ActionForward)
-	}
-}

internal/proxy/proxy.go

@@ -1,16 +1,19 @@
-// Package proxy passes each request to the app and the app's answer back,
-// unchanged, within the size and time limits, and writes one request log
-// line for each request.
+// Package proxy is servewaf's server. It runs the checks on the request each of
+// rproxy's questions carries, and answers rproxy what to do with that request. It
+// takes rproxy's report once the visitor's answer has ended, which counts the
+// request's bytes and writes its last log line. It answers servewaf's own
+// endpoints: the health check, the metrics, the bans and the clients. It passes
+// nothing to an app: internal/rproxy does that.
 package proxy
 
 import (
 	"io"
-	"log"
 	"log/slog"
 	"net/http"
-	"strings"
 	"time"
 
+	lru "github.com/hashicorp/golang-lru/v2"
+
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
@@ -19,23 +22,16 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// How smallwebwaf keeps connections to the app open between requests.
-const (
-	appIdleConns       = 100
-	appIdleConnTimeout = 90 * time.Second
-)
-
-// adminPrefix starts the path of every request for smallwebwaf itself,
-// which never reaches the app.
+// adminPrefix starts the path of each of servewaf's own endpoints. The app never
+// sees a path under it.
 const adminPrefix = "/_smallwebwaf/"
 
-// HealthPath is smallwebwaf's health endpoint, which the container's
-// health check asks.
+// HealthPath is the health endpoint of servewaf and of rproxy, which the
+// container's health check asks.
 const HealthPath = "/_smallwebwaf/healthz"
 
 // MetricsPath is where the metrics are, for a request that carries
@@ -46,14 +42,15 @@ const MetricsPath = "/_smallwebwaf/metrics"
 // a client's address, lifts them, with SWWAF_ADMIN_TOKEN.
 const BansPath = "/_smallwebwaf/bans"
 
-// ClientsPath is where an admin asks what smallwebwaf knows of a client,
-// by the client's address after it, with SWWAF_ADMIN_TOKEN.
+// ClientsPath is where an admin asks what servewaf knows of a client, by the
+// client's address after it, with SWWAF_ADMIN_TOKEN.
 const ClientsPath = "/_smallwebwaf/clients/"
 
-// Params are what New needs.
+// Params are what NewServeWAF needs.
 type Params struct {
 	Config *config.Config
-	// RequestLog receives one JSON line per request.
+	// RequestLog receives two JSON lines per question, one at its decision and
+	// one when its report comes, and one per request to servewaf's own endpoints.
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
@@ -73,7 +70,7 @@ type Params struct {
 	// Rules are the rule files' rules, which each request is checked
 	// against.
 	Rules *rules.Files
-	// Alerts receive the alert for each ban the proxy makes or makes
+	// Alerts receive the alert for each ban servewaf makes or makes
 	// permanent, for each count over an anomaly threshold, for each request
 	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
 	// AbuseIPDB lists, for each request the Core Rule Set scores at or over
@@ -83,11 +80,10 @@ type Params struct {
 	Alerts *alerts.Queue
 }
 
-// Server is the server smallwebwaf runs, with the parts of the proxy
-// whose state the state files keep, the lookup database, nil unless
-// SWWAF_LOOKUP_SOURCE is file, the lists fetched from URLs, which its Run
-// fetches, the DNSBL zones' verdicts, AbuseIPDB's scores and checks
-// spent, and the metrics.
+// Server is the server servewaf runs, with the parts whose state the state
+// files keep, the lookup database, nil unless SWWAF_LOOKUP_SOURCE is file, the
+// lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
+// AbuseIPDB's scores and checks spent, and the metrics.
 type Server struct {
 	*http.Server
 
@@ -102,24 +98,24 @@ type Server struct {
 	Metrics    *metrics.Metrics
 }
 
-// New returns the server smallwebwaf runs: each request it reads passes
-// through the proxy. Go's server itself refuses a request line and
-// headers over SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES, with 431, closes a
-// connection idle for SWWAF_CLIENT_IDLE_TIMEOUT, and applies
-// SWWAF_CLIENT_REQUEST_TIMEOUT while the headers arrive; the proxy
-// applies the timeouts and size limits from then on.
-func New(params Params) *Server {
-	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
+// newHandler returns the handler with what every request shares, as the
+// settings in params make it.
+func newHandler(params Params) *handler {
 	m := metrics.New(params.Config.MetricsTopN, params.Config.InstanceName)
 	lists, dnsbl, abuseIPDB := newReputation(params, m)
+
+	awaitingReport, err := lru.New[string, *decision](maxAwaitingReport)
+	if err != nil {
+		panic(err) // New fails only for a size below one
+	}
+
 	h := &handler{
-		config:     params.Config,
-		requestLog: params.RequestLog,
-		processLog: params.ProcessLog,
-		errorLog:   errorLog,
-		transport:  newTransport(),
-		now:        params.Now,
-		metrics:    m,
+		config:         params.Config,
+		requestLog:     params.RequestLog,
+		processLog:     params.ProcessLog,
+		now:            params.Now,
+		metrics:        m,
+		awaitingReport: awaitingReport,
 		limiter: ratelimit.New(ratelimit.Limits{
 			PerMinute:      params.Config.RateLimitPerMinute,
 			PerHour:        params.Config.RateLimitPerHour,
@@ -171,29 +167,7 @@ func New(params Params) *Server {
 	m.AddBansAndClients(h.ledger, h.limiter, params.Now)
 	m.AddRules(params.Rules)
 
-	return &Server{
-		Server: &http.Server{
-			Addr:              params.Config.ListenAddr,
-			Handler:           h,
-			ReadHeaderTimeout: params.Config.ClientRequestTimeout,
-			// Off is an IdleTimeout of 0, which Go's server replaces with
-			// ReadTimeout: no limit, as long as ReadTimeout stays unset.
-			IdleTimeout: params.Config.ClientIdleTimeout,
-			// Go's server reads 4 KiB past MaxHeaderBytes before it
-			// refuses, so the limit a client meets is the setting.
-			MaxHeaderBytes: int(params.Config.ClientRequestHeaderMaxBytes - 4<<10),
-			ErrorLog:       errorLog,
-		},
-		Ledger:     h.ledger,
-		Limiter:    h.limiter,
-		GeoJS:      h.geojs,
-		Anomalies:  h.anomalies,
-		LookupFile: h.lookupFile,
-		Lists:      h.lists,
-		DNSBL:      h.dnsbl,
-		AbuseIPDB:  h.abuseIPDB,
-		Metrics:    m,
-	}
+	return h
 }
 
 // newReputation returns the lists fetched from URLs, the DNSBL zones'
@@ -233,7 +207,10 @@ func newReputation(
 
 // newCoreRuleSet returns the Core Rule Set at SWWAF_WAF_PARANOIA_LEVEL,
 // without the rules SWWAF_WAF_DISABLED_RULES switches off, reading bodies
-// up to SWWAF_WAF_BODY_LIMIT, or nil while SWWAF_WAF_MODE is off.
+// up to SWWAF_WAF_BODY_LIMIT, or nil while SWWAF_WAF_MODE is off. It reads at
+// most QuestionBodyMaxBytes less one byte: a question's body of
+// QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
+// JSON or XML body over its limit.
 func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
 	if cfg.WAFMode == config.WAFModeOff {
 		return nil
@@ -241,26 +218,24 @@ func newCoreRuleSet(cfg *config.Config) *waf.CoreRuleSet {
 
 	coreRuleSet, err := waf.New(waf.Params{
 		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
-		BodyLimit: cfg.WAFBodyLimit,
+		BodyLimit: min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
 	})
 	if err != nil {
 		// The Core Rule Set is built in, and the settings cannot break it:
-		// the paranoia level is from 1 to 4, the body limit at most 1G, and
-		// the id of no rule switches nothing off.
+		// the paranoia level is from 1 to 4, and the id of no rule switches
+		// nothing off.
 		panic(err)
 	}
 
 	return coreRuleSet
 }
 
-// handler is the proxy. It holds what every request shares; what belongs
-// to one request is in a request.
+// handler is servewaf's handler. It holds what every request shares; what
+// belongs to one request is in a request.
 type handler struct {
 	config      *config.Config
 	requestLog  io.Writer
 	processLog  *slog.Logger
-	errorLog    *log.Logger
-	transport   http.RoundTripper
 	now         func() time.Time
 	metrics     *metrics.Metrics
 	limiter     *ratelimit.Limiter
@@ -274,68 +249,7 @@ type handler struct {
 	rules       *rules.Files
 	coreRuleSet *waf.CoreRuleSet
 	alerts      *alerts.Queue
-}
-
-// newTransport returns what carries requests to the app. It never goes
-// through a proxy named in the environment, and leaves the app's answers
-// compressed or not as the app sent them.
-func newTransport() *http.Transport {
-	return &http.Transport{
-		MaxIdleConns:        appIdleConns,
-		MaxIdleConnsPerHost: appIdleConns,
-		IdleConnTimeout:     appIdleConnTimeout,
-		DisableCompression:  true,
-	}
-}
-
-// ServeHTTP handles one request: it works out the client, runs the
-// checks, passes the request to the app and the answer back within the
-// limits, or answers it itself if it is for smallwebwaf, and writes the
-// request's log line.
-func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	rq := h.newRequest(w, r)
-	defer rq.finish()
-
-	// The health endpoint is answered at once, before any check, so that
-	// a health checker is never refused. It does not ask the app.
-	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
-		rq.line.Action = requestlog.ActionAdmin
-		// Set here rather than left to Go's server, which would set it only
-		// after the log line has taken the response's headers.
-		rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
-		_, _ = io.WriteString(rq.out, "ok\n")
-
-		return
-	}
-
-	// Once the request has ended, before its log line is written. The
-	// last deferred runs first: countRefusal before addToHistory, so that
-	// a broken error burst is in the client's history.
-	defer rq.addToHistory()
-	defer rq.countAnomalies()
-	defer rq.countRefusal()
-
-	refused := rq.check(r.Context())
-	rq.checked = time.Now()
-
-	if refused != nil {
-		rq.answer(*refused)
-
-		return
-	}
-
-	// A request for smallwebwaf itself is answered where another would be
-	// passed to the app, so that it goes through every check first.
-	if strings.HasPrefix(r.URL.Path, adminPrefix) {
-		rq.answerAdmin()
-
-		return
-	}
-
-	// Once the response has ended, before the request is added to its
-	// client's history. Deferred, since ReverseProxy panics to end a
-	// response it cannot finish.
-	defer rq.countBytes()
-
-	rq.forward(r.Context())
+	// awaitingReport holds the decision on each answered question by its id
+	// until its report comes, and nil for a question still being handled.
+	awaitingReport *lru.Cache[string, *decision]
 }

internal/proxy/proxy_test.go

@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"io"
+	"log/slog"
 	"maps"
 	"net"
 	"net/http"
@@ -19,78 +20,76 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rproxy"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
 const (
-	// shortTimeout is what a test sets a timeout to, to see it run out.
-	// It starts before the test has set up its case, such as an upgrade
-	// or the app's buffers filling, so it is as long as the hold-up of the
-	// test process that wantTimedOut allows: a shorter one can run out
-	// first on a busy host.
-	shortTimeout = waitLimit / 2
-	// longTimeoutSetting is a timeout that does not run out in a test.
-	longTimeoutSetting = "1m"
 	// waitLimit bounds how long a test waits for what should happen.
 	waitLimit = 10 * time.Second
 	// pollInterval is how often a test looks for a log line.
 	pollInterval = 10 * time.Millisecond
-	// localhost is where every test server listens, and so the address
-	// smallwebwaf sees each test's requests come from.
+	// localhost is where every test server listens, and so the address rproxy
+	// sees each test's requests come from.
 	localhost = "127.0.0.1"
 	// requestType is the type that marks a request log line.
 	requestType = "request"
-	// protocol is the protocol of every test's requests.
+	// protocol is the protocol of every question.
 	protocol = "HTTP/1.1"
+	// trustLocalhost trusts the address every test connects from, and a
+	// network for proxies in front of it.
+	trustLocalhost = localhost + "/32,10.0.0.0/8"
+	// appHost is the host every test asks for.
+	appHost = "app.example"
+	// client is the client's address, as a proxy names it.
+	client = "203.0.113.9"
+	// forwardedFor is the header that lists the client and its proxies,
+	// and forwardedProto the one that gives the scheme the client used.
+	forwardedFor   = "X-Forwarded-For"
+	forwardedProto = "X-Forwarded-Proto"
+	// secure is the scheme a client reached traefik with, and plain the one
+	// rproxy serves.
+	secure = "https"
+	plain  = "http"
 )
 
-// shortTimeoutSetting is shortTimeout as a setting's value.
-//
-//nolint:gochecknoglobals // a constant cannot call String
-var shortTimeoutSetting = shortTimeout.String()
-
 // The settings the tests set.
 const (
-	clientRequestTimeout    = "SWWAF_CLIENT_REQUEST_TIMEOUT"
-	clientHeaderMaxBytes    = "SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES"
-	clientIdleTimeout       = "SWWAF_CLIENT_IDLE_TIMEOUT"
-	clientResponseTimeout   = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	upstreamRequestTimeout  = "SWWAF_UPSTREAM_REQUEST_TIMEOUT"
-	upstreamResponseTimeout = "SWWAF_UPSTREAM_RESPONSE_TIMEOUT"
-	mode                    = "SWWAF_MODE"
-	requestMaxBytes         = "SWWAF_REQUEST_MAX_BYTES"
-	responseMaxBytes        = "SWWAF_RESPONSE_MAX_BYTES"
-	trustedProxies          = "SWWAF_TRUSTED_PROXIES"
-	ipv6GroupPrefix         = "SWWAF_IPV6_GROUP_PREFIX"
-	maxTrackedClients       = "SWWAF_MAX_TRACKED_CLIENTS"
-	allowNets               = "SWWAF_ALLOW_NETS"
-	rateLimitExemptNets     = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
-	denyNets                = "SWWAF_DENY_NETS"
-	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
-	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
-	rateLimitExemptPaths    = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
-	lookupSource            = "SWWAF_LOOKUP_SOURCE"
-	lookupDBPath            = "SWWAF_LOOKUP_DB_PATH"
-	lookupTimeout           = "SWWAF_LOOKUP_TIMEOUT"
-	addLookupHeaders        = "SWWAF_ADD_LOOKUP_HEADERS"
-	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
-	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	banResponse             = "SWWAF_BAN_RESPONSE"
-	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
-	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
-	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
-	maxBans                 = "SWWAF_MAX_BANS"
-	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
-	instanceName            = "SWWAF_INSTANCE_NAME"
-	logRequestHeaders       = "SWWAF_LOG_REQUEST_HEADERS"
-	attackBanDuration       = "SWWAF_ATTACK_BAN_DURATION"
-	rulesDir                = "SWWAF_RULES_DIR"
-	wafMode                 = "SWWAF_WAF_MODE"
+	mode                 = "SWWAF_MODE"
+	trustedProxies       = "SWRP_TRUSTED_PROXIES"
+	ipv6GroupPrefix      = "SWWAF_IPV6_GROUP_PREFIX"
+	maxTrackedClients    = "SWWAF_MAX_TRACKED_CLIENTS"
+	allowNets            = "SWWAF_ALLOW_NETS"
+	rateLimitExemptNets  = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
+	denyNets             = "SWWAF_DENY_NETS"
+	rateLimitPerMinute   = "SWWAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerDay      = "SWWAF_RATE_LIMIT_PER_DAY"
+	rateLimitExemptPaths = "SWWAF_RATE_LIMIT_EXEMPT_PATHS"
+	lookupSource         = "SWWAF_LOOKUP_SOURCE"
+	lookupDBPath         = "SWWAF_LOOKUP_DB_PATH"
+	lookupTimeout        = "SWWAF_LOOKUP_TIMEOUT"
+	addLookupHeaders     = "SWWAF_ADD_LOOKUP_HEADERS"
+	deniedCountries      = "SWWAF_DENIED_COUNTRIES"
+	allowedCountries     = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	banResponse          = "SWWAF_BAN_RESPONSE"
+	limitBanDuration     = "SWWAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration       = "SWWAF_MAX_BAN_DURATION"
+	maxBans              = "SWWAF_MAX_BANS"
+	banScopeV4Prefix     = "SWWAF_BAN_SCOPE_V4_PREFIX"
+	instanceName         = "SWWAF_INSTANCE_NAME"
+	logRequestHeaders    = "SWWAF_LOG_REQUEST_HEADERS"
+	attackBanDuration    = "SWWAF_ATTACK_BAN_DURATION"
+	rulesDir             = "SWWAF_RULES_DIR"
+	wafMode              = "SWWAF_WAF_MODE"
 )
 
 // off is the value that switches a setting off.
 const off = "off"
 
+// on is the value that switches a setting that takes true or false on.
+const on = "true"
+
 // output collects what smallwebwaf writes on stdout.
 type output struct {
 	mu  sync.Mutex
@@ -176,6 +175,73 @@ func (o *output) requestLine(t *testing.T) logLine {
 	return o.requestLines(t, 1)[0]
 }
 
+// endedLines waits for count requests that went through rproxy, or to servewaf's
+// own endpoints, to have ended, and returns the last log line of each, in the
+// order servewaf took them. A question's last line is the one its report writes.
+func (o *output) endedLines(t *testing.T, count int) []logLine {
+	t.Helper()
+
+	deadline := time.Now().Add(waitLimit)
+	for time.Now().Before(deadline) {
+		found := o.lastLines(t)
+
+		ended := len(found) >= count
+		for _, line := range found[:min(count, len(found))] {
+			if line.ServeWAFLine == requestlog.ServeWAFLineDecision {
+				ended = false
+			}
+		}
+
+		if ended {
+			return found
+		}
+
+		time.Sleep(pollInterval)
+	}
+
+	t.Fatalf("fewer than %d requests have ended after %s", count, waitLimit)
+
+	return nil
+}
+
+// lastLines returns the last request log line written so far of each request,
+// in the order servewaf took them.
+func (o *output) lastLines(t *testing.T) []logLine {
+	t.Helper()
+
+	var found []logLine
+
+	places := map[string]int{}
+
+	for _, fields := range o.lines(t) {
+		if fields["type"] != requestType {
+			continue
+		}
+
+		line := decodeLine(t, fields)
+
+		place, seen := places[line.RequestID]
+		if seen {
+			found[place] = line
+
+			continue
+		}
+
+		places[line.RequestID] = len(found)
+		found = append(found, line)
+	}
+
+	return found
+}
+
+// endedLine waits for a test's one request to have ended, and returns its last
+// log line.
+func (o *output) endedLine(t *testing.T) logLine {
+	t.Helper()
+
+	return o.endedLines(t, 1)[0]
+}
+
 // decodeLine reads a request log line's fields into a logLine.
 func decodeLine(t *testing.T, fields map[string]any) logLine {
 	t.Helper()
@@ -195,7 +261,7 @@ func decodeLine(t *testing.T, fields map[string]any) logLine {
 	return line
 }
 
-// startApp starts app as the app smallwebwaf passes requests to.
+// startApp starts app as the app rproxy passes requests to.
 func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
 	t.Helper()
 
@@ -205,9 +271,9 @@ func startApp(t *testing.T, app http.HandlerFunc) *httptest.Server {
 	return server
 }
 
-// startProxy starts smallwebwaf in front of the app at appURL, with the
-// settings in env on top of the defaults, and returns where it listens and
-// what it writes.
+// startProxy starts servewaf, and rproxy in front of the app at appURL, each with
+// the settings in env on top of the defaults, and returns where rproxy listens
+// and what servewaf writes.
 func startProxy(t *testing.T, appURL string, env map[string]string) (string, *output) {
 	t.Helper()
 
@@ -227,10 +293,10 @@ func startProxyWithGeoJS(
 }
 
 // startProxyWithClock is startProxyWithGeoJS with requests counted and
-// bans made by the time now tells, and returns the server as well. Unless
-// env sets SWWAF_RULES_DIR, it is an empty directory, of no rules, and
-// unless it sets SWWAF_INSTANCE_NAME, that is app, the label instance of
-// every metric.
+// bans made by the time now tells, and returns servewaf's server as well, whose
+// Addr is where servewaf listens. Unless env sets SWWAF_RULES_DIR, it is an empty
+// directory, of no rules, and unless it sets SWWAF_INSTANCE_NAME, that is app,
+// the label instance of every metric.
 func startProxyWithClock(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
@@ -243,14 +309,70 @@ func startProxyWithClock(
 }
 
 // startProxyWithAlerts is startProxyWithClock, and returns the queue of
-// the alerts the proxy raises as well, as newProxy makes them.
+// the alerts servewaf raises as well, as newServeWAF makes them.
 func startProxyWithAlerts(
 	t *testing.T, appURL, geojsURL string, now func() time.Time,
 	env map[string]string,
 ) (string, *output, *proxy.Server, *alerts.Queue) {
 	t.Helper()
 
-	server, out, alertQueue := newProxy(t, appURL, geojsURL, now, env)
+	server, out, alertQueue := newServeWAF(t, geojsURL, now, env)
+	serve(t, server)
+
+	return startRProxy(t, server.Addr, appURL, env), out, server, alertQueue
+}
+
+// serve serves server on a port of its own until the test ends, and sets its
+// Addr to where it listens.
+func serve(t *testing.T, server *proxy.Server) {
+	t.Helper()
+
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	server.Addr = listener.Addr().String()
+
+	go func() {
+		_ = server.Serve(listener)
+	}()
+
+	t.Cleanup(func() {
+		_ = server.Close()
+	})
+}
+
+// startRProxy starts rproxy in front of the app at appURL, asking the servewaf
+// at serveWAFAddr, with the settings in env on top of the defaults, and returns
+// where it listens. What it writes is dropped. SWRP_TIMEOUT_MS is a minute unless
+// env sets it, so that on a busy host SWRP_DEFAULT_DISPOSITION does not decide.
+func startRProxy(
+	t *testing.T, serveWAFAddr, appURL string, env map[string]string,
+) string {
+	t.Helper()
+
+	settings := map[string]string{
+		"SWRP_WAF_BACKEND":  "http://" + serveWAFAddr,
+		"SWRP_UPSTREAM_URL": appURL,
+		"SWRP_TIMEOUT_MS":   "60000",
+	}
+	maps.Copy(settings, env)
+
+	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
+		value, ok := settings[name]
+
+		return value, ok
+	})
+	if err != nil {
+		t.Fatalf("settings %v: %v", settings, err)
+	}
+
+	server := rproxy.New(rproxy.Params{
+		Config:     cfg,
+		RequestLog: io.Discard,
+		ProcessLog: requestlog.NewProcessLogger(io.Discard, "rproxy", slog.LevelInfo),
+	})
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
 	if err != nil {
@@ -265,28 +387,35 @@ func startProxyWithAlerts(
 		_ = server.Close()
 	})
 
-	return listener.Addr().String(), out, server, alertQueue
+	return listener.Addr().String()
 }
 
-// newProxy makes the server startProxyWithClock starts, without starting
-// it, and returns it, what it writes, and the queue of the alerts the
-// proxy raises, as the settings in env make it. No alert is sent from the
-// queue: they wait in it, for the test to look at. With no geojsURL, there
-// is no stand-in for GeoJS to look clients up at, and SWWAF_LOOKUP_SOURCE
-// is off unless env sets it. While it is file, the lookup database
-// SWWAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
-// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY. SWWAF_WAF_MODE is off
-// unless env sets it, so that only the tests of the Core Rule Set have
-// their requests inspected by it.
-func newProxy(
-	t *testing.T, appURL, geojsURL string, now func() time.Time,
-	env map[string]string,
+// newServeWAF makes servewaf's server, without starting it, and returns it, what
+// it writes, and the queue of the alerts it raises, as the settings in env make
+// it. No alert is sent from the queue: they wait in it, for the test to look at.
+// With no geojsURL, there is no stand-in for GeoJS to look clients up at, and
+// SWWAF_LOOKUP_SOURCE is off unless env sets it. While it is file, the lookup
+// database SWWAF_LOOKUP_DB_PATH names is read. Clients are checked with AbuseIPDB
+// at abuseIPDBURL while env sets SWWAF_ABUSEIPDB_KEY. SWWAF_WAF_MODE is off unless
+// env sets it, so that only the tests of the Core Rule Set have their requests
+// inspected by it.
+func newServeWAF(
+	t *testing.T, geojsURL string, now func() time.Time, env map[string]string,
+) (*proxy.Server, *output, *alerts.Queue) {
+	t.Helper()
+
+	return newServeWAFWith(t, proxy.NewServeWAF, geojsURL, now, env)
+}
+
+// newServeWAFWith is newServeWAF for the server build makes.
+func newServeWAFWith(
+	t *testing.T, build func(proxy.Params) *proxy.Server,
+	geojsURL string, now func() time.Time, env map[string]string,
 ) (*proxy.Server, *output, *alerts.Queue) {
 	t.Helper()
 
 	settings := map[string]string{
-		"SWWAF_UPSTREAM_URL": appURL, rulesDir: t.TempDir(), instanceName: "app",
-		wafMode: off,
+		rulesDir: t.TempDir(), instanceName: "app", wafMode: off,
 	}
 	if geojsURL == "" {
 		settings[lookupSource] = off
@@ -334,7 +463,7 @@ func newProxy(
 		}
 	}
 
-	server := proxy.New(proxy.Params{
+	server := build(proxy.Params{
 		Config:       cfg,
 		RequestLog:   out,
 		ProcessLog:   processLog,
@@ -378,7 +507,7 @@ func readAnswer(res *http.Response) answer {
 	return answer{status: res.StatusCode, header: res.Header, body: body, err: err}
 }
 
-// newRequest makes a request for path to smallwebwaf at addr.
+// newRequest makes a request for path to addr, where rproxy or servewaf listens.
 func newRequest(t *testing.T, method, addr, path string, body io.Reader) *http.Request {
 	t.Helper()
 
@@ -402,15 +531,15 @@ func do(t *testing.T, req *http.Request) answer {
 	return readAnswer(res)
 }
 
-// get sends a GET request for path to smallwebwaf at addr.
+// get sends a GET request for path to addr.
 func get(t *testing.T, addr, path string) answer {
 	t.Helper()
 
 	return do(t, newRequest(t, http.MethodGet, addr, path, http.NoBody))
 }
 
-// dial opens a connection to smallwebwaf at addr, for requests the HTTP
-// client cannot make, such as one that stops sending halfway.
+// dial opens a connection to addr, for requests the HTTP client cannot make,
+// such as one that stops sending halfway.
 func dial(t *testing.T, addr string) net.Conn {
 	t.Helper()
 
@@ -471,14 +600,3 @@ func wantStatus(t *testing.T, got answer, status int) {
 		t.Errorf("status %d, want %d", got.status, status)
 	}
 }
-
-// wantTimedOut checks that what began at start ended once shortTimeout
-// had run out, and not much later.
-func wantTimedOut(t *testing.T, start time.Time) {
-	t.Helper()
-
-	took := time.Since(start)
-	if took < shortTimeout || took > shortTimeout+waitLimit/2 {
-		t.Errorf("took %s, want %s", took, shortTimeout)
-	}
-}

internal/proxy/ratelimits_test.go

@@ -51,7 +51,7 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 		req.Header.Set(forwardedFor, sent.client)
 		wantStatus(t, do(t, req), sent.want)
 
-		line := out.requestLines(t, i+1)[i]
+		line := out.endedLines(t, i+1)[i]
 		if line.ClientIP != sent.logged {
 			t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.logged)
 		}

internal/proxy/reputation.go

@@ -110,6 +110,7 @@ func (rq *request) noteHit(hit bans.ReputationHit, reason string) {
 	rq.h.metrics.ReputationHit(hit.Source)
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    alerts.EventReputationHit,
+		Host:     rq.site,
 		Client:   rq.client,
 		Netblock: rq.h.clientGroup(rq.client),
 		ASN:      rq.line.ASN,

internal/proxy/reputation_test.go

@@ -272,6 +272,7 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 			Instance: alertInstance,
 			Time:     clk.Now(),
 			Event:    alerts.EventReputationHit,
+			Host:     appHost,
 			Client:   netip.MustParseAddr(fromDE),
 			Netblock: netip.MustParsePrefix(fromDE + "/32"),
 			ASN:      asnDE,
@@ -289,7 +290,7 @@ func TestEachBlocklistThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 
 	// Each list's hits, none of its fetches failed, and when its copy was
 	// fetched, 0 for the one without.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	fetched := float64(listsFetched().Unix())
 
 	for listURL, want := range map[string]struct{ hits, fetched float64 }{
@@ -513,6 +514,7 @@ func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 			Instance: alertInstance,
 			Time:     clk.Now(),
 			Event:    alerts.EventReputationHit,
+			Host:     appHost,
 			Client:   netip.MustParseAddr(fromDE),
 			Netblock: netip.MustParsePrefix(fromDE + "/32"),
 			ASN:      asnDE,
@@ -530,7 +532,7 @@ func TestEachZoneThatListsAClientRaisesAnAlertOncePerCooldownAndIsCounted(
 
 	// Each zone's hits, and its queries and their failures, none, since
 	// every client had its verdicts.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 
 	for _, zone := range []string{dnsblZone, otherZone} {
 		labels := `{instance="` + alertInstance + `",source="` + zone + `"}`
@@ -564,7 +566,7 @@ func TestZoneKeyIsMaskedInTheLogTheAlertAndTheMetrics(t *testing.T) {
 			masked)
 	}
 
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	wantMetric(t, metrics, `smallwebwaf_reputation_hits_total{instance="`+
 		alertInstance+`",source="`+masked+`"}`, 1)
 
@@ -737,10 +739,6 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			"a trap path", "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned,
 			ratelimit.Offences{Attack: 1},
 		},
-		{
-			"a missing token", proxy.MetricsPath, http.StatusUnauthorized,
-			requestlog.ActionAdmin, ratelimit.Offences{TokenRefused: 1},
-		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -748,7 +746,7 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 			s, clk, server := startWithClock(t, "", map[string]string{
 				abuseIPDBKey: accountKey, reputationAction: actionLog,
 				rulesDir: writeRules(t, testRules), attackBanDuration: "1h",
-				trapPaths: trapPathList, metricsToken: token, wafMode: block,
+				trapPaths: trapPathList, wafMode: block,
 			})
 
 			s.request(client, tc.path, tc.status, tc.action)
@@ -862,7 +860,7 @@ func TestAbuseIPDBHitRaisesAnAlertWithTheScoreOncePerCooldownAndIsCounted(
 
 	// The hits, and the checks, none, since no client committed an
 	// offence, so that the whole budget is left.
-	metrics := s.scrape(unplaced)
+	metrics := s.scrape()
 	labels := `{instance="` + alertInstance + `",source="` + abuseipdb + `"}`
 
 	wantMetric(t, metrics, "smallwebwaf_reputation_hits_total"+labels, 2)
@@ -889,7 +887,7 @@ func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
 	wantAbuseIPDBChecks(t, server, 0)
 
-	wantNoSeries(t, s.scrape(unplaced), `smallwebwaf_reputation_daily_budget_remaining{`+
+	wantNoSeries(t, s.scrape(), `smallwebwaf_reputation_daily_budget_remaining{`+
 		`instance="`+alertInstance+`",source="`+abuseipdb+`"}`)
 }
 

internal/proxy/request.go

@@ -2,17 +2,10 @@ package proxy
 
 import (
 	"context"
-	"errors"
-	"io"
 	"net/http"
-	"net/http/httptrace"
-	"net/http/httputil"
 	"net/netip"
-	"os"
 	"slices"
 	"strings"
-	"sync"
-	"sync/atomic"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
@@ -24,40 +17,36 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
-// flushAfterEachWrite has ReverseProxy pass on each part of the app's
-// answer as soon as it arrives.
-const flushAfterEachWrite time.Duration = -1
-
-// refusal is smallwebwaf refusing a request, or refusing to go on with it:
-// the status the client is answered if the response has not started yet,
-// 0 to close the connection without an answer, the action the log line
-// names, and the setting whose size or time limit the request passed, if
-// that is why.
+// refusal is servewaf refusing a request: the status the visitor is to get, 0
+// to close its connection without an answer, and the action the log line names.
 type refusal struct {
 	status int
 	action string
-	limit  string
 }
 
-// request is one request on its way through smallwebwaf, from the moment
-// its headers have been read to its log line.
-type request struct {
-	h  *handler
-	in *http.Request
-	// rc sets the deadlines of the connection to the client.
-	rc   *http.ResponseController
-	out  *responseWriter
-	body *requestBody // nil for a request without a body
-	line requestlog.Line
-
-	client      netip.Addr
-	peer        netip.Addr
-	peerTrusted bool
+// decision is what the checks note of a request: its log line, and what
+// counting the request needs once it has ended. servewaf keeps a copy of it
+// until the request's report comes. It holds no credentials, since the log line
+// never does, and neither the request's objects nor their bodies.
+type decision struct {
+	line   requestlog.Line
+	client netip.Addr
+	// requestURI is the path with the query, as a ban's notes keep it.
+	requestURI string
+	// site is, for a question, the host the visitor asked for, which the
+	// alerts name, since one servewaf serves many sites.
+	site string
+	// allowed is true for a question answered with DispositionAllow.
+	allowed bool
 	// lookedUp is true once the client's AS number and country have been
 	// looked up, whether or not an answer was there, and lookupAnswer is
 	// what the lookup gave then, the zero Answer while GeoJS had given none.
 	lookedUp     bool
 	lookupAnswer lookup.Answer
+	// skippedLookupWait is true for a request that did not wait for GeoJS and
+	// found no answer kept. SWWAF_UNKNOWN_LIMIT_PERCENT does not apply to it,
+	// so that not waiting never lowers its client's limits.
+	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
 	// the byte limits count once it has ended. limitPercent and
 	// bytesPercent are then its client's limit percentages for the rate
@@ -65,93 +54,80 @@ type request struct {
 	counted                    bool
 	limitPercent, bytesPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
-	// trap path, ruleBlocked for one a block rule refused, wafBlocked for
-	// one the Core Rule Set refused, and tokenRefused for one refused for a
-	// missing or wrong token, each an offence its client's history counts.
-	attack, ruleBlocked, wafBlocked, tokenRefused bool
+	// trap path, ruleBlocked for one a block rule refused, and wafBlocked for
+	// one the Core Rule Set refused, each an offence its client's history
+	// counts.
+	attack, ruleBlocked, wafBlocked bool
+	// reputation is the reputation sources that list the client, for the
+	// notes of a ban the request makes.
+	reputation []bans.ReputationHit
+}
+
+// request is one request to servewaf, from the moment its headers have been
+// read to its log line.
+type request struct {
+	decision
+
+	h   *handler
+	in  *http.Request
+	out *responseWriter
+
 	// blocklisted is true once a blocklist is found to list the client,
 	// dnsblListed once a DNSBL zone's verdict is, and abuseIPDBHit once
 	// AbuseIPDB's score of it is a hit.
 	blocklisted, dnsblListed, abuseIPDBHit bool
-	// reputation is the reputation sources that list the client, for the
-	// notes of a ban the request makes.
-	reputation []bans.ReputationHit
-	start      time.Time
-	// checked is when the checks were done, and upstreamStart when the
-	// request was handed to the app.
-	checked       time.Time
-	upstreamStart time.Time
-	// cancel ends the request to the app.
-	cancel context.CancelFunc
-	// refused is the first refusal, from whichever goroutine meets it.
-	refused atomic.Pointer[refusal]
-	// complete is true once the app's whole answer has been passed on.
-	complete bool
-	// upgraded is the connection to the app once the app has switched
-	// protocols, as for a WebSocket, and nil otherwise.
-	upgraded *upgradedConn
-
-	// mu guards what follows. The timeouts run on goroutines of their
-	// own, and the transport starts and stops them, and notes the times
-	// below, from its own; once timersStopped is set, none of the timeouts
-	// acts any more.
-	mu                    sync.Mutex
-	timersStopped         bool
-	clientRequestTimer    *time.Timer
-	upstreamRequestTimer  *time.Timer
-	upstreamResponseTimer *time.Timer
-	// connected is when there was a connection to the app, requestSent
-	// when the app had been sent the whole request, and answerStarted
-	// when the first byte of its answer arrived.
-	connected     time.Time
-	requestSent   time.Time
-	answerStarted time.Time
+	start                                  time.Time
+	// checked is when the checks were done.
+	checked time.Time
+	// refused is what the request was refused with, nil if it was not.
+	refused *refusal
+	// requestBytes is how many bytes of the request's body have been read.
+	requestBytes int64
 }
 
-// newRequest starts handling r: it notes the time, counts the request as
-// under way, works out the client, and starts the log line with what is
-// known of the request.
-func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
+// startRequest starts handling r from client, which came through peer: it
+// notes the time, counts the request as under way, and starts the log line
+// with what is known of the request. isQuestion says whether r is a question,
+// whose headers give the request's id and scheme.
+func (h *handler) startRequest(
+	w http.ResponseWriter, r *http.Request, client, peer netip.Addr, isQuestion bool,
+) *request {
 	h.metrics.RequestStarted()
 
 	start := time.Now()
-	peer := peerAddress(r)
-	trusted := h.config.TrustedProxies
-	peerTrusted := isInside(peer, trusted)
 	forwardedFor := r.Header.Values("X-Forwarded-For")
-	client := clientAddress(peer, forwardedFor, trusted)
 
 	rq := &request{
-		h:           h,
-		in:          r,
-		rc:          http.NewResponseController(w),
-		out:         &responseWriter{ResponseWriter: w},
-		client:      client,
-		peer:        peer,
-		peerTrusted: peerTrusted,
-		start:       start,
-		line: requestlog.Line{
-			Time:             requestlog.FormatTime(start),
-			Instance:         h.config.InstanceName,
-			ClientIP:         client.String(),
-			Method:           r.Method,
-			Scheme:           scheme(r, peerTrusted),
-			Host:             r.Host,
-			Path:             rules.Path(r),
-			Query:            r.URL.RawQuery,
-			Protocol:         r.Proto,
-			Referer:          r.Referer(),
-			UserAgent:        r.UserAgent(),
-			RequestID:        requestID(r, peerTrusted),
-			PeerIP:           peer.String(),
-			ForwardedFor:     strings.Join(forwardedFor, ", "),
-			ClientGroup:      h.clientGroup(client).String(),
-			ContentType:      r.Header.Get("Content-Type"),
-			RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
-			HasAuthorization: len(r.Header.Values("Authorization")) > 0,
-			HasCookie:        len(r.Header.Values("Cookie")) > 0,
-			Action:           requestlog.ActionForward,
+		decision: decision{
+			client:     client,
+			requestURI: r.URL.RequestURI(),
+			line: requestlog.Line{
+				Time:             requestlog.FormatTime(start),
+				Instance:         h.config.InstanceName,
+				ClientIP:         client.String(),
+				Method:           r.Method,
+				Scheme:           scheme(r, isQuestion),
+				Host:             r.Host,
+				Path:             rules.Path(r),
+				Query:            r.URL.RawQuery,
+				Protocol:         r.Proto,
+				Referer:          r.Referer(),
+				UserAgent:        r.UserAgent(),
+				RequestID:        requestID(r, isQuestion),
+				PeerIP:           peer.String(),
+				ForwardedFor:     strings.Join(forwardedFor, ", "),
+				ClientGroup:      h.clientGroup(client).String(),
+				ContentType:      r.Header.Get("Content-Type"),
+				RequestHeaders:   requestHeaders(r, h.config.LogRequestHeaders),
+				HasAuthorization: len(r.Header.Values("Authorization")) > 0,
+				HasCookie:        len(r.Header.Values("Cookie")) > 0,
+				Action:           requestlog.ActionForward,
+			},
 		},
+		h:     h,
+		in:    r,
+		out:   &responseWriter{ResponseWriter: w},
+		start: start,
 	}
 
 	// A length of -1 is a body whose length was not announced.
@@ -159,10 +135,6 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 		rq.line.ContentLength = r.ContentLength
 	}
 
-	if r.Body != http.NoBody {
-		rq.body = &requestBody{body: limitBody(r.Body, h.config.RequestMaxBytes), rq: rq}
-	}
-
 	return rq
 }
 
@@ -187,45 +159,28 @@ func requestHeaders(r *http.Request, names []string) map[string]string {
 	return headers
 }
 
-// check is the one place where a request can be refused once its client
-// is known, before anything reaches the app, and before its body is read,
-// but for the part the Core Rule Set reads. It returns nil to let the
-// request through. The checks of checkClient come first, answered with
-// SWWAF_BAN_RESPONSE, or 403 for a block rule or the Core Rule Set, and
-// then the size limit, so that a request the rate limits count is counted
-// even when it is refused for its size. In observe mode a request
-// checkClient refuses goes on to the size limit like any other. A size or
-// time limit the Core Rule Set's reading of the body meets ends the
-// request in either mode. ctx is the request's own context.
+// check is the one place where a request can be refused. It returns nil to let
+// the request through. The checks of checkClient decide: a request they refuse
+// is answered with SWWAF_BAN_RESPONSE, 403 for a block rule or the Core Rule Set,
+// or 431 for the header limits. In observe mode nothing is refused, and the log
+// line names what enforce mode would have done. ctx is the request's own context.
 func (rq *request) check(ctx context.Context) *refusal {
 	action := rq.checkClient(ctx)
 
-	refused := rq.refused.Load()
-	if refused != nil {
-		return refused
-	}
-
 	switch {
 	case action == "":
+		return nil
 	case rq.h.config.Observe:
-		// The log line names what enforce mode would have done.
 		rq.line.WouldAction = action
+
+		return nil
 	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
 		return &refusal{status: http.StatusForbidden, action: action}
+	case action == requestlog.ActionTooLarge:
+		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
 	default:
 		return rq.banResponse(action)
 	}
-
-	maxBytes := rq.h.config.RequestMaxBytes
-	if maxBytes > 0 && rq.in.ContentLength > maxBytes {
-		return &refusal{
-			status: http.StatusRequestEntityTooLarge,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_REQUEST_MAX_BYTES",
-		}
-	}
-
-	return nil
 }
 
 // checkClient runs the checks on the request's client, and returns the
@@ -240,9 +195,9 @@ func (rq *request) check(ctx context.Context) *refusal {
 // rate limits, unless the client is in SWWAF_RATE_LIMIT_EXEMPT_NETS or the
 // request's path is exempt under SWWAF_RATE_LIMIT_EXEMPT_PATHS, so that
 // every other request is counted, each of them by the client's limit
-// percentages, then SWWAF_TRAP_PATHS, then the rule files, and last the
-// Core Rule Set. A request exempt from the rate limits is exempt from the
-// byte limits too. ctx is the request's own context.
+// percentages, then SWWAF_TRAP_PATHS, then the rule files, then the header
+// limits, and last the Core Rule Set. A request exempt from the rate limits
+// is exempt from the byte limits too. ctx is the request's own context.
 func (rq *request) checkClient(ctx context.Context) string {
 	cfg := rq.h.config
 	if isInside(rq.client, cfg.AllowNets) {
@@ -259,7 +214,7 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionBanned
 	}
 
-	rq.lookUp(ctx)
+	rq.lookUp(ctx, now)
 
 	// The lookup can wait for GeoJS, so the checks after it read the time
 	// again: a request counted at the time it arrived could be counted
@@ -283,8 +238,7 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return requestlog.ActionDenied
 	}
 
-	rq.counted = !isInside(rq.client, cfg.RateLimitExemptNets) &&
-		!pathExempt(rq.in, cfg.RateLimitExemptPaths)
+	rq.counted = rq.countedByRateLimits()
 	if rq.counted {
 		rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
 		rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
@@ -304,9 +258,23 @@ func (rq *request) checkClient(ctx context.Context) string {
 		return action
 	}
 
+	if rq.overHeaderLimits() {
+		return requestlog.ActionTooLarge
+	}
+
 	return rq.checkCoreRuleSet()
 }
 
+// countedByRateLimits reports whether the rate limits count the request: its
+// client is not in SWWAF_RATE_LIMIT_EXEMPT_NETS, and its path is not exempt
+// under SWWAF_RATE_LIMIT_EXEMPT_PATHS.
+func (rq *request) countedByRateLimits() bool {
+	cfg := rq.h.config
+
+	return !isInside(rq.client, cfg.RateLimitExemptNets) &&
+		!pathExempt(rq.in, cfg.RateLimitExemptPaths)
+}
+
 // pathExempt reports whether r is exempt under prefixes,
 // SWWAF_RATE_LIMIT_EXEMPT_PATHS or SWWAF_WAF_EXEMPT_PATHS: whether its
 // path as sent, the path the app receives, not percent-decoded, starts
@@ -330,249 +298,40 @@ func pathExempt(r *http.Request, prefixes []string) bool {
 	})
 }
 
-// forward passes the request to the app and the app's answer back. ctx
-// is the request's own context.
-func (rq *request) forward(ctx context.Context) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	rq.cancel = cancel
-	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
-		GotConn:              rq.gotConn,
-		WroteRequest:         rq.wroteRequest,
-		GotFirstResponseByte: rq.gotFirstResponseByte,
-	})
-
-	out := rq.in.WithContext(ctx)
-	if rq.body != nil {
-		out.Body = rq.body
-	}
-
-	reverseProxy := &httputil.ReverseProxy{
-		Rewrite:        rq.rewrite,
-		Transport:      rq.h.transport,
-		FlushInterval:  flushAfterEachWrite,
-		ErrorLog:       rq.h.errorLog,
-		ModifyResponse: rq.modifyResponse,
-		ErrorHandler:   rq.answerError,
-	}
-
-	rq.startRequestTimers()
-	rq.upstreamStart = time.Now()
-	reverseProxy.ServeHTTP(rq.out, out)
-}
-
-// rewrite makes the request the app receives: the client's request,
-// unchanged, sent to SWWAF_UPSTREAM_URL, with the forwarded headers and
-// the request's id set, without any X-Client-ASN or X-Client-Country the
-// client sent, whatever SWWAF_ADD_LOOKUP_HEADERS says, and, while it is
-// set, with the client's AS number and country in them.
-func (rq *request) rewrite(pr *httputil.ProxyRequest) {
-	upstream := rq.h.config.UpstreamURL
-	pr.Out.URL.Scheme = upstream.Scheme
-	pr.Out.URL.Host = upstream.Host
-	// ReverseProxy drops query parameters it cannot parse; the app gets
-	// the query as the client sent it.
-	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
-	// ReverseProxy sends the path URL.EscapedPath gives, which, for a path
-	// holding a character Go escapes, such as |, is the whole path decoded
-	// and escaped again, %2F turned into /. Opaque is sent as it is, so the
-	// app gets the path as the client sent it. Left out are a target that
-	// is no path, such as *, and a path starting with //, which Go would
-	// send in Opaque as a scheme and host.
-	path := rules.Path(pr.In)
-	if strings.HasPrefix(path, "/") && !strings.HasPrefix(path, "//") {
-		pr.Out.URL.Opaque = path
-	}
-
-	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
-	pr.Out.Header.Set(requestIDHeader, rq.line.RequestID)
-	pr.Out.Header.Del(asnHeader)
-	pr.Out.Header.Del(countryHeader)
-
-	if rq.h.config.AddLookupHeaders {
-		setLookupHeaders(pr.Out.Header, rq.line.ASN, rq.line.Country)
-	}
-}
-
-// modifyResponse looks at the app's answer before ReverseProxy passes it
-// on.
-func (rq *request) modifyResponse(res *http.Response) error {
-	rq.line.UpstreamStatus = res.StatusCode
-
-	if res.StatusCode == http.StatusSwitchingProtocols {
-		// An upgraded connection, such as a WebSocket, is not cut by the
-		// timeouts. ReverseProxy writes this answer straight to the
-		// connection it takes over, not through rq.out, and then copies
-		// what passes each way through res.Body, the connection to the app.
-		// It may still refuse the switch, as when the app's Upgrade is not
-		// the client's, so the status is noted only once it has taken over
-		// the connection, by rq.out's Hijack.
-		rq.stopTimers()
-		rq.line.Websocket = true
-
-		conn, ok := res.Body.(io.ReadWriteCloser)
-		if ok {
-			rq.upgraded = &upgradedConn{ReadWriteCloser: conn}
-			res.Body = rq.upgraded
-		}
-
-		return nil
-	}
-
-	maxBytes := rq.h.config.ResponseMaxBytes
-	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
-		rq.refuse(refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_RESPONSE_MAX_BYTES",
-		})
-
-		return errResponseTooLarge
-	}
-
-	// Go's server adds a Content-Type it guesses from the body to a
-	// response whose headers have no Content-Type key. The key with no
-	// value sends none, as the app sent none.
-	if res.Header.Get("Content-Type") == "" {
-		rq.out.Header()["Content-Type"] = nil
-	}
-
-	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
-	rq.startClientResponseTimeout()
-
-	return nil
-}
-
-// answerError is ReverseProxy's ErrorHandler: the request could not be
-// passed to the app, or the app's answer cannot be passed on.
-func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
-	if rq.upgraded != nil {
-		// The app switched protocols, but the switch was not passed on,
-		// and ReverseProxy leaves the app's connection open when it
-		// refuses it.
-		_ = rq.upgraded.Close()
-	}
-
-	refused := rq.refused.Load()
-	if refused == nil {
-		if rq.in.Context().Err() != nil {
-			return // the client has gone, and there is no one to answer
-		}
-
-		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
-
-		refused = &refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionUpstreamError,
-		}
-	}
-
-	rq.answer(*refused)
-}
-
-// answer sends smallwebwaf's own answer, unless the response has already
-// started, and records the refusal for the log line.
-func (rq *request) answer(r refusal) {
-	rq.refused.CompareAndSwap(nil, &r)
-
-	if rq.out.status != 0 {
-		return // too late to answer: the connection can only be cut
-	}
-
-	if r.status == 0 {
-		// SWWAF_BAN_RESPONSE is close. This panic has Go's server close
-		// the connection without an answer, and log nothing; the log line
-		// is still written as the handler returns.
-		panic(http.ErrAbortHandler)
-	}
-
-	// A client found too slow is read no more; any other may go on
-	// sending until its time is up, so that Go's server can read the
-	// rest of the body and end the request cleanly.
-	deadline := rq.clientRequestDeadline()
-	if r.status == http.StatusRequestTimeout {
-		deadline = time.Now()
-	}
-
-	rq.stopReadingBody(deadline)
-
-	timeout := rq.h.config.ClientResponseTimeout
-	if timeout > 0 {
-		_ = rq.rc.SetWriteDeadline(time.Now().Add(timeout))
-	}
-
-	http.Error(rq.out, http.StatusText(r.status), r.status)
-}
-
-// refuse records r, unless an earlier refusal was, and ends the request
-// to the app, if one was made: smallwebwaf reads the body of a request
-// it answers itself too.
-func (rq *request) refuse(r refusal) {
-	rq.refused.CompareAndSwap(nil, &r)
-
-	if rq.cancel != nil {
-		rq.cancel()
-	}
-}
-
-// finish ends the request's timeouts, counts it in the metrics and writes
-// its log line.
+// finish counts the request in the metrics and writes its log line.
 func (rq *request) finish() {
-	rq.stopTimers()
-
-	refused := rq.refused.Load()
-	if refused == nil {
-		rq.stopReadingBody(rq.clientRequestDeadline())
-	}
-
 	line := &rq.line
 	line.Status = rq.out.status
 	line.ResponseBytes = rq.out.bytes
-	header := rq.out.Header()
-	line.ResponseContentType = header.Get("Content-Type")
-	line.CacheControl = header.Get("Cache-Control")
-	line.Location = header.Get("Location")
-	line.RequestBytes = rq.requestBytes()
-
-	// limit is the setting whose size or time limit the request passed.
-	var limit string
+	line.ResponseContentType = rq.out.Header().Get("Content-Type")
+	line.RequestBytes = rq.requestBytes
 
 	switch {
-	case refused != nil:
-		line.Action = refused.action
-		limit = refused.limit
-	case errors.Is(rq.out.err, os.ErrDeadlineExceeded):
-		// The client took longer than SWWAF_CLIENT_RESPONSE_TIMEOUT to
-		// take the response.
-		line.Action = requestlog.ActionTimedOut
-		limit = "SWWAF_CLIENT_RESPONSE_TIMEOUT"
-	case !rq.complete && (rq.out.err != nil || rq.in.Context().Err() != nil):
+	case rq.refused != nil:
+		line.Action = rq.refused.action
+	case rq.out.err != nil || rq.in.Context().Err() != nil:
 		line.Aborted = true
 	}
 
-	now := time.Now()
-	duration := now.Sub(rq.start)
+	duration := time.Since(rq.start)
 	line.DurationTotal = requestlog.Milliseconds(duration)
 	line.DurationChecks = timing(rq.start, rq.checked)
 
-	var upstreamDuration time.Duration
-
-	if !rq.upstreamStart.IsZero() {
-		upstreamDuration = now.Sub(rq.upstreamStart)
-		line.DurationUpstreamTotal = new(requestlog.Milliseconds(upstreamDuration))
-
-		rq.mu.Lock()
-		line.DurationUpstreamConnect = timing(rq.upstreamStart, rq.connected)
-		line.DurationUpstreamFirstByte = timing(rq.upstreamStart, rq.answerStarted)
-		rq.mu.Unlock()
+	// Counted before the log line is written, so that the metrics count
+	// every request whose line is out. An allowed request is the exception:
+	// its report gives the status, bytes and times the metrics count.
+	if rq.allowed {
+		rq.h.metrics.RequestAllowed()
+	} else {
+		rq.h.metrics.RequestEnded(line, duration)
 	}
 
-	// Counted before the log line is written, so that the metrics count
-	// every request whose line is out.
-	rq.h.metrics.RequestEnded(line, limit, duration, upstreamDuration)
+	rq.writeLine()
+}
 
-	err := requestlog.Write(rq.h.requestLog, line)
+// writeLine writes the request's log line.
+func (rq *request) writeLine() {
+	err := requestlog.Write(rq.h.requestLog, &rq.line)
 	if err != nil {
 		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
 	}
@@ -596,18 +355,16 @@ func timing(start, end time.Time) *float64 {
 // before either was there, and one from GeoJS that comes later is added
 // when it comes.
 func (rq *request) addToHistory() {
-	forwarded := !rq.upstreamStart.IsZero()
 	request := ratelimit.Request{
-		Forwarded:     forwarded,
-		Refused:       !forwarded && rq.refused.Load() != nil,
+		Forwarded:     rq.allowed,
+		Refused:       rq.refused != nil,
 		Status:        rq.out.status,
-		RequestBytes:  rq.requestBytes(),
+		RequestBytes:  rq.requestBytes,
 		ResponseBytes: rq.out.bytes,
 		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
 		Attack:        rq.attack,
 		RuleBlocked:   rq.ruleBlocked,
 		WAFBlocked:    rq.wafBlocked,
-		TokenRefused:  rq.tokenRefused,
 	}
 
 	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)
@@ -634,6 +391,7 @@ func (rq *request) countAnomalies() {
 	answer, _ := rq.answerAtTheEnd()
 
 	rq.h.anomalies.Count(rq.h.now(), anomaly.Request{
+		Host:        rq.site,
 		Client:      rq.client,
 		ClientGroup: rq.h.clientGroup(rq.client),
 		ASN:         answer.ASN,
@@ -667,228 +425,38 @@ func (rq *request) answerAtTheEnd() (lookup.Answer, bool) {
 	return rq.h.geojs.Kept(rq.h.clientGroup(rq.client))
 }
 
-// requestBytes is how many bytes of the request's body have been read.
-func (rq *request) requestBytes() int64 {
-	if rq.body == nil {
-		return 0
-	}
+// responseWriter is servewaf's answer to a request. It notes the status and
+// size for the log line, and the first error writing the answer.
+type responseWriter struct {
+	http.ResponseWriter
 
-	return rq.body.bytes.Load()
+	// status is the status sent, or zero before one is.
+	status int
+	bytes  int64
+	err    error
 }
 
-// clientRequestDeadline is when the client must have sent its whole
-// request, or zero when SWWAF_CLIENT_REQUEST_TIMEOUT is off.
-func (rq *request) clientRequestDeadline() time.Time {
-	timeout := rq.h.config.ClientRequestTimeout
-	if timeout == 0 {
-		return time.Time{}
+// WriteHeader sends the status and headers.
+func (w *responseWriter) WriteHeader(status int) {
+	if w.status == 0 {
+		w.status = status
 	}
 
-	return rq.start.Add(timeout)
+	w.ResponseWriter.WriteHeader(status)
 }
 
-// stopReadingBody ends, at deadline, the reading of a client body that has
-// not arrived whole: Go's server then reads no more of it, and closes the
-// connection after the answer.
-func (rq *request) stopReadingBody(deadline time.Time) {
-	if rq.body == nil || rq.body.received.Load() {
-		return
+// Write sends part of the body.
+func (w *responseWriter) Write(p []byte) (int, error) {
+	if w.status == 0 {
+		w.status = http.StatusOK
 	}
 
-	_ = rq.rc.SetReadDeadline(deadline)
-}
+	n, err := w.ResponseWriter.Write(p)
+	w.bytes += int64(n)
 
-// startRequestTimers starts the timeouts that run while the request goes
-// to the app: SWWAF_CLIENT_REQUEST_TIMEOUT until the client has sent its
-// whole body, and SWWAF_UPSTREAM_REQUEST_TIMEOUT until the app has been
-// sent the whole request.
-func (rq *request) startRequestTimers() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if rq.body != nil && rq.h.config.ClientRequestTimeout > 0 {
-		rq.clientRequestTimer = time.AfterFunc(
-			time.Until(rq.clientRequestDeadline()), func() {
-				rq.requestTimedOut("SWWAF_CLIENT_REQUEST_TIMEOUT")
-			})
+	if w.err == nil {
+		w.err = err
 	}
 
-	timeout := rq.h.config.UpstreamRequestTimeout
-	if timeout > 0 {
-		rq.upstreamRequestTimer = time.AfterFunc(timeout, func() {
-			rq.requestTimedOut("SWWAF_UPSTREAM_REQUEST_TIMEOUT")
-		})
-	}
-}
-
-// requestTimedOut is called when limit, SWWAF_CLIENT_REQUEST_TIMEOUT or
-// SWWAF_UPSTREAM_REQUEST_TIMEOUT, runs out while the request is still on
-// its way to the app. The answer names the side smallwebwaf was waiting
-// on at that moment: 408 when it was waiting for the client to send more
-// of its body, 504 when it was waiting for the app to be reached or to
-// take what it had.
-func (rq *request) requestTimedOut(limit string) {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if rq.timersStopped {
-		return
-	}
-
-	if rq.body == nil || !rq.body.waiting.Load() {
-		// Once the app has answered, the transport, ReverseProxy and Go's
-		// server each close the client's body, and closing it reads what
-		// is left of a body under 256 KiB without requestBody.Read, so
-		// waiting is false while that read waits for the client. That
-		// read ends now, before refuse: should smallwebwaf still answer
-		// itself, answer then sets the deadline it gives its own answers.
-		if !rq.answerStarted.IsZero() {
-			rq.stopReadingBody(time.Now())
-		}
-
-		rq.refuse(refusal{
-			status: http.StatusGatewayTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  limit,
-		})
-
-		return
-	}
-
-	rq.refuse(refusal{
-		status: http.StatusRequestTimeout,
-		action: requestlog.ActionTimedOut,
-		limit:  limit,
-	})
-	// The transport gives up on the app only once its Read of the
-	// client's body returns, so that Read is ended now. The lock keeps
-	// this from reaching the connection after the request is handled.
-	_ = rq.rc.SetReadDeadline(time.Now())
-}
-
-// bodyReceived is called once the client has sent its whole body.
-func (rq *request) bodyReceived() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	stopTimer(rq.clientRequestTimer)
-}
-
-// gotConn is called once there is a connection to the app, a new one or
-// one kept open from an earlier request.
-func (rq *request) gotConn(httptrace.GotConnInfo) {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	rq.connected = time.Now()
-}
-
-// gotFirstResponseByte is called once the first byte of the app's answer
-// has arrived.
-func (rq *request) gotFirstResponseByte() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	rq.answerStarted = time.Now()
-}
-
-// wroteRequest is called once the app has been sent the whole request:
-// the request timeouts end and SWWAF_UPSTREAM_RESPONSE_TIMEOUT starts.
-func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
-	if info.Err != nil {
-		return // the transport gives up, or tries again
-	}
-
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if rq.timersStopped {
-		return
-	}
-
-	stopTimer(rq.clientRequestTimer)
-	stopTimer(rq.upstreamRequestTimer)
-	rq.requestSent = time.Now()
-
-	timeout := rq.h.config.UpstreamResponseTimeout
-	if timeout > 0 {
-		rq.upstreamResponseTimer = time.AfterFunc(timeout, rq.responseTimedOut)
-	}
-}
-
-// responseTimedOut is called when SWWAF_UPSTREAM_RESPONSE_TIMEOUT runs out
-// before the app has sent its whole answer.
-func (rq *request) responseTimedOut() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	if !rq.timersStopped {
-		rq.refuse(refusal{
-			status: http.StatusGatewayTimeout,
-			action: requestlog.ActionTimedOut,
-			limit:  "SWWAF_UPSTREAM_RESPONSE_TIMEOUT",
-		})
-	}
-}
-
-// responseReceived is called once the app has sent its whole answer. An
-// app may answer before the client has sent its whole body, as with a 404
-// it sends without reading it. The timeouts then run on: until the
-// transport's read of the body returns, Go's server cannot send the
-// answer, and SWWAF_CLIENT_REQUEST_TIMEOUT is what ends that read for a
-// client that stops sending.
-func (rq *request) responseReceived() {
-	rq.complete = true
-
-	if rq.body != nil && !rq.body.received.Load() {
-		return
-	}
-
-	rq.stopTimers()
-}
-
-// startClientResponseTimeout sets SWWAF_CLIENT_RESPONSE_TIMEOUT on the
-// connection to the client: the response must reach the client within it
-// of the end of the request, or of now if the app answers before it has
-// the whole request.
-func (rq *request) startClientResponseTimeout() {
-	timeout := rq.h.config.ClientResponseTimeout
-	if timeout == 0 {
-		return
-	}
-
-	from := rq.sentAt()
-	if from.IsZero() {
-		from = time.Now()
-	}
-
-	_ = rq.rc.SetWriteDeadline(from.Add(timeout))
-}
-
-// sentAt is when the app had been sent the whole request, or zero.
-func (rq *request) sentAt() time.Time {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	return rq.requestSent
-}
-
-// stopTimers stops the request's timeouts and keeps any from starting
-// later: the app's answer is complete, the connection upgraded, or the
-// request handled.
-func (rq *request) stopTimers() {
-	rq.mu.Lock()
-	defer rq.mu.Unlock()
-
-	rq.timersStopped = true
-	stopTimer(rq.clientRequestTimer)
-	stopTimer(rq.upstreamRequestTimer)
-	stopTimer(rq.upstreamResponseTimer)
-}
-
-// stopTimer stops t, which is nil when its timeout is off.
-func stopTimer(t *time.Timer) {
-	if t != nil {
-		t.Stop()
-	}
+	return n, err
 }

internal/proxy/request_internal_test.go

@@ -1,55 +0,0 @@
-package proxy
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"sneak.berlin/go/smallwebwaf/internal/config"
-)
-
-func TestAnAnswerWithoutAContentTypeGetsNone(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			rq := &request{
-				h:   &handler{config: &config.Config{}},
-				out: &responseWriter{ResponseWriter: w},
-			}
-			app := &http.Response{
-				StatusCode: http.StatusOK,
-				Header:     http.Header{},
-				Body:       http.NoBody,
-			}
-
-			err := rq.modifyResponse(app)
-			if err != nil {
-				t.Errorf("modifyResponse: %v", err)
-			}
-
-			// The headers go out with this, the first part of the body,
-			// which Go's server would guess a Content-Type from.
-			_, _ = io.WriteString(w, "<!doctype html><title>page</title>")
-		}))
-	t.Cleanup(srv.Close)
-
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, srv.URL,
-		http.NoBody)
-	if err != nil {
-		t.Fatalf("new request: %v", err)
-	}
-
-	res, err := srv.Client().Do(req)
-	if err != nil {
-		t.Fatalf("get: %v", err)
-	}
-
-	_ = res.Body.Close()
-
-	if res.Header.Values("Content-Type") != nil {
-		t.Errorf("client got Content-Type %q, want none",
-			res.Header.Get("Content-Type"))
-	}
-}

internal/proxy/requestlog_test.go

@@ -2,7 +2,6 @@ package proxy_test
 
 import (
 	"io"
-	"maps"
 	"math"
 	"net/http"
 	"reflect"
@@ -42,9 +41,6 @@ func TestLogLineHasEachFieldWhereItApplies(t *testing.T) {
 			return
 		}
 
-		w.Header().Set("Content-Type", "text/html")
-		w.Header().Set("Cache-Control", "no-store")
-		w.Header().Set("Location", "/elsewhere")
 		w.WriteHeader(http.StatusFound)
 		_, _ = io.WriteString(w, "moved")
 	})
@@ -70,7 +66,7 @@ func TestLogLineHasEachFieldWhereItApplies(t *testing.T) {
 
 	// A request's log line can come after its answer: each is waited for
 	// before the next request, so that the lines are in order.
-	full := out.requestLines(t, 1)[0]
+	full := out.endedLines(t, 1)[0]
 
 	// This one comes from 127.0.0.1, which the rate limits do not count,
 	// with a body of 4 bytes whose length it does not announce, so that its
@@ -81,7 +77,7 @@ func TestLogLineHasEachFieldWhereItApplies(t *testing.T) {
 		"Transfer-Encoding: chunked\r\n\r\n4\r\nbody\r\n0\r\n\r\n")
 	wantStatus(t, readResponse(t, conn), http.StatusNoContent)
 
-	bare := out.requestLines(t, 2)[1]
+	bare := out.endedLines(t, 2)[1]
 
 	wantFullLine(t, full)
 	wantBareLine(t, bare)
@@ -108,24 +104,23 @@ func wantFullLine(t *testing.T, line logLine) {
 	headers := map[string]string{"accept": "text/html", "x-custom": "one, two"}
 
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, Time: line.Time, Instance: instance,
+		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Time: line.Time, Instance: instance,
 		ClientIP: ipv6Client, Method: http.MethodPost, Scheme: secure,
 		Host: appHost, Path: "/full", Protocol: protocol,
 		Status: http.StatusFound, RequestBytes: 3, ResponseBytes: 5,
-		RequestID: "from-traefik", PeerIP: localhost,
+		RequestID: line.RequestID, PeerIP: localhost,
 		ForwardedFor: "198.51.100.7, " + ipv6Client, ClientGroup: ipv6Group,
 		ContentType: "application/x-www-form-urlencoded", ContentLength: 3,
 		RequestHeaders: headers, HasAuthorization: true, HasCookie: true,
-		ResponseContentType: "text/html", UpstreamStatus: http.StatusFound,
-		CacheControl: "no-store", Location: "/elsewhere",
 		Action: requestlog.ActionForward,
 		// Its 3 bytes in and 5 out, each way counted by default.
 		Counts: ratelimit.Counts{
 			Minute: 1, Hour: 1, Day: 1, MinuteBytes: 8, HourBytes: 8, DayBytes: 8,
 		},
 	})
-	if !reflect.DeepEqual(line.Line, want) {
-		t.Errorf("log line\n%+v\nwant\n%+v", line.Line, want)
+	if !reflect.DeepEqual(line.Line, want) || line.RequestID == "from-traefik" {
+		t.Errorf("log line\n%+v\nwant\n%+v, with a new request id", line.Line, want)
 	}
 }
 
@@ -135,12 +130,13 @@ func wantBareLine(t *testing.T, line logLine) {
 	t.Helper()
 
 	want := withTimings(line, requestlog.Line{
-		Type: requestType, Time: line.Time, Instance: instance,
+		Type: requestType, ServeWAFLine: requestlog.ServeWAFLineReport,
+		Time: line.Time, Instance: instance,
 		ClientIP: localhost, Method: http.MethodPost, Scheme: plain,
 		Host: appHost, Path: "/bare", Protocol: protocol,
 		Status: http.StatusNoContent, RequestBytes: 4, RequestID: line.RequestID,
 		PeerIP: localhost, ClientGroup: localhost + "/32",
-		UpstreamStatus: http.StatusNoContent, Action: requestlog.ActionForward,
+		Action: requestlog.ActionForward,
 	})
 	if !reflect.DeepEqual(line.Line, want) || line.RequestID == "" {
 		t.Errorf("log line\n%+v\nwant\n%+v, with a request id", line.Line, want)
@@ -148,8 +144,7 @@ func wantBareLine(t *testing.T, line logLine) {
 
 	for _, name := range []string{
 		"forwarded_for", "content_type", "content_length", "request_headers",
-		"has_authorization", "has_cookie", "websocket", "response_content_type",
-		"cache_control", "location", "counts",
+		"has_authorization", "has_cookie", "response_content_type", "counts",
 	} {
 		_, present := line.fields[name]
 		if present {
@@ -162,8 +157,6 @@ func wantBareLine(t *testing.T, line logLine) {
 func withTimings(line logLine, want requestlog.Line) requestlog.Line {
 	want.DurationTotal = line.DurationTotal
 	want.DurationChecks = line.DurationChecks
-	want.DurationUpstreamConnect = line.DurationUpstreamConnect
-	want.DurationUpstreamFirstByte = line.DurationUpstreamFirstByte
 	want.DurationUpstreamTotal = line.DurationUpstreamTotal
 
 	return want
@@ -188,7 +181,7 @@ func TestHasAuthorizationAndHasCookieEachComeFromTheirOwnHeader(t *testing.T) {
 			req.Header.Set(tc.header, "secret")
 			wantStatus(t, do(t, req), http.StatusOK)
 
-			line := out.requestLine(t)
+			line := out.endedLine(t)
 
 			_, otherPresent := line.fields[tc.other]
 			if line.fields[tc.field] != true || otherPresent {
@@ -199,81 +192,20 @@ func TestHasAuthorizationAndHasCookieEachComeFromTheirOwnHeader(t *testing.T) {
 	}
 }
 
-func TestRequestIDAndSchemeComeOnlyFromATrustedProxy(t *testing.T) {
-	t.Parallel()
-
-	const sentID = "from-traefik"
-
-	sent := http.Header{requestIDHeader: {sentID}, forwardedProto: {secure}}
-	trusted := map[string]string{trustedProxies: trustLocalhost}
-
-	for _, tc := range []struct {
-		name   string
-		env    map[string]string
-		header http.Header
-		// wantID is the request id logged, "" for a new one.
-		wantID, wantScheme string
-	}{
-		{"a trusted proxy's are kept", trusted, sent, sentID, secure},
-		{"without them, the id is new and the scheme http", trusted, nil, "", plain},
-		{"another peer's are replaced", nil, sent, "", plain},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			received := make(chan string, 2)
-			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-				received <- r.Header.Get(requestIDHeader)
-			})
-			addr, out := startProxy(t, app.URL, tc.env)
-
-			// Two requests, so that two new ids can be told apart.
-			ids := make([]string, 0, 2)
-
-			for i := range 2 {
-				req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
-				maps.Copy(req.Header, tc.header)
-				wantStatus(t, do(t, req), http.StatusOK)
-
-				line := out.requestLines(t, i+1)[i]
-				ids = append(ids, line.RequestID)
-
-				got := <-received
-				if line.RequestID != got || line.Scheme != tc.wantScheme {
-					t.Errorf("log line has request_id %q and scheme %q, and the "+
-						"app received id %q; want the same id and scheme %q",
-						line.RequestID, line.Scheme, got, tc.wantScheme)
-				}
-			}
-
-			switch {
-			case tc.wantID != "" && (ids[0] != tc.wantID || ids[1] != tc.wantID):
-				t.Errorf("request ids %q, want %q", ids, tc.wantID)
-			case tc.wantID == "" && (slices.Contains(ids, sentID) ||
-				slices.Contains(ids, "") || ids[0] == ids[1]):
-				t.Errorf("request ids %q, want two new ones", ids)
-			}
-		})
-	}
-}
-
 func TestTimingsAreInOrder(t *testing.T) {
 	t.Parallel()
 
 	const denied = "192.0.2.50" // in SWWAF_DENY_NETS
 
 	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		// The pauses set the times apart; a hold-up of the test only
-		// lengthens them.
-		time.Sleep(time.Millisecond)
-		w.WriteHeader(http.StatusOK)
-		_ = http.NewResponseController(w).Flush()
-
+		// The pause sets the times apart; a hold-up of the test only lengthens
+		// it.
 		time.Sleep(time.Millisecond)
 
 		_, _ = io.WriteString(w, "done")
 	})
-	addr, out := startProxy(t, app.URL, map[string]string{
+
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now, map[string]string{
 		trustedProxies: trustLocalhost,
 		denyNets:       denied,
 	})
@@ -281,20 +213,19 @@ func TestTimingsAreInOrder(t *testing.T) {
 	// Each log line is waited for before the next request, so that the
 	// lines are in order.
 	wantStatus(t, get(t, addr, "/"), http.StatusOK)
-	forwarded := out.requestLines(t, 1)[0]
+	forwarded := out.endedLines(t, 1)[0]
 
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Header.Set(forwardedFor, denied)
 	wantStatus(t, do(t, req), http.StatusForbidden)
-	refused := out.requestLines(t, 2)[1]
+	refused := out.endedLines(t, 2)[1]
 
-	wantStatus(t, get(t, addr, proxy.HealthPath), http.StatusOK)
-	health := out.requestLines(t, 3)[2]
+	wantStatus(t, get(t, server.Addr, proxy.HealthPath), http.StatusOK)
+	health := out.endedLines(t, 3)[2]
 
 	// A request passed to the app has every timing; one refused, none of
 	// the app's; the health check, which runs no check, only the total.
 	wantTimings(t, forwarded, "duration_total", "duration_checks",
-		"duration_upstream_connect", "duration_upstream_first_byte",
 		"duration_upstream_total")
 	wantTimings(t, refused, "duration_total", "duration_checks")
 	wantTimings(t, health, "duration_total")
@@ -307,17 +238,12 @@ func TestTimingsAreInOrder(t *testing.T) {
 	// exact.
 	total := microseconds(forwarded.DurationTotal)
 	checks := microseconds(*forwarded.DurationChecks)
-	connect := microseconds(*forwarded.DurationUpstreamConnect)
-	firstByte := microseconds(*forwarded.DurationUpstreamFirstByte)
 	upstream := microseconds(*forwarded.DurationUpstreamTotal)
 
-	// The checks end before the request is handed to the app, and the
-	// connection comes before the answer, which the app ends after a
-	// pause.
-	if checks+upstream > total || connect >= firstByte || firstByte >= upstream {
-		t.Errorf("timings in microseconds: total %d, checks %d, connect %d, "+
-			"first byte %d, upstream total %d", total, checks, connect, firstByte,
-			upstream)
+	// The checks end before the request is handed to the app.
+	if checks+upstream > total {
+		t.Errorf("timings in microseconds: total %d, checks %d, upstream total %d",
+			total, checks, upstream)
 	}
 
 	if *refused.DurationChecks > refused.DurationTotal {
@@ -350,22 +276,3 @@ func wantTimings(t *testing.T, line logLine, want ...string) {
 func microseconds(milliseconds float64) int64 {
 	return int64(math.Round(milliseconds * 1000))
 }
-
-func TestLogsAnUpgradedConnection(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, echoAfterUpgrade)
-	addr, out := startProxy(t, app.URL, nil)
-
-	conn := dial(t, addr)
-	send(t, conn, "GET /socket HTTP/1.1\r\nHost: app\r\n"+
-		"Connection: Upgrade\r\nUpgrade: websocket\r\n\r\n")
-	wantStatus(t, readResponse(t, conn), http.StatusSwitchingProtocols)
-
-	_ = conn.Close()
-
-	line := out.requestLine(t)
-	if line.fields["websocket"] != true {
-		t.Errorf("log line has websocket %v, want true", line.fields["websocket"])
-	}
-}

internal/proxy/rulefiles_test.go

@@ -185,8 +185,6 @@ func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
 func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 	t.Parallel()
 
-	const scraper = "192.0.2.200"
-
 	s, _, _ := startWithClock(t, "", map[string]string{
 		rulesDir:     writeRules(t, testRules),
 		metricsToken: token,
@@ -196,7 +194,7 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
 	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
 
-	metrics := s.scrape(scraper)
+	metrics := s.scrape()
 	wantMetric(t, metrics,
 		`smallwebwaf_rule_matches_total{action="block",instance="app",rule_id="blocked"}`, 1)
 	wantMetric(t, metrics,

internal/proxy/servewaf.go

@@ -0,0 +1,509 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// The headers of rproxy's question and of servewaf's answer, as
+// "servewaf" in SPEC.md gives them.
+const (
+	// ClientHeader marks a request as rproxy's question, and gives the
+	// visitor's address.
+	ClientHeader = "X-Smallwebwaf-Client"
+	// PeerHeader gives the address of rproxy's own TCP peer.
+	PeerHeader = "X-Smallwebwaf-Peer"
+	// ContentLengthHeader gives the body length the visitor announced.
+	ContentLengthHeader = "X-Smallwebwaf-Content-Length"
+	// DispositionHeader gives servewaf's answer.
+	DispositionHeader = "X-Smallwebwaf-Disposition"
+)
+
+// The values of DispositionHeader.
+const (
+	// DispositionAllow tells rproxy to pass the request to the app.
+	DispositionAllow = "allow"
+	// DispositionDeny tells rproxy to give the visitor the answer's status,
+	// headers and body.
+	DispositionDeny = "deny"
+	// DispositionClose tells rproxy to close the visitor's connection
+	// without an answer, which SWWAF_BAN_RESPONSE asks for when it is close.
+	// servewaf closing the question's connection instead would read as
+	// servewaf being down, and rproxy would then let the request through.
+	DispositionClose = "close"
+)
+
+// ReportPath is where rproxy sends the report of each request servewaf
+// answered.
+const ReportPath = "/_smallwebwaf/report"
+
+// QuestionBodyMaxBytes is the most of a visitor's body a question carries.
+const QuestionBodyMaxBytes = 64 << 10
+
+// The header limits: the most cookies and header fields a request may have
+// when the checks reach the Core Rule Set. Real clients never reach them.
+const (
+	maxCookies      = 50
+	maxHeaderFields = 100
+)
+
+const (
+	// maxAwaitingReport is the most answered requests held until their
+	// reports come. Past it, the request answered longest ago is dropped.
+	maxAwaitingReport = 10000
+	// maxRequestIDBytes is the longest id a question may give.
+	maxRequestIDBytes = 128
+	// reportBodyMaxBytes is the most of a report's body that is read. It is
+	// far above any report's.
+	reportBodyMaxBytes = 1 << 20
+	// maxHTTPStatus is the highest status a report may give.
+	maxHTTPStatus = 599
+	// maxReportedBytes is the most bytes a report may give for each way, 1
+	// PiB, so that adding them up cannot overflow.
+	maxReportedBytes = 1 << 50
+	// maxReportedMilliseconds is the longest duration a report may give,
+	// about 31 years, so that it fits a time.Duration.
+	maxReportedMilliseconds = 1e12
+	// serveWAFTimeout bounds how long a request to servewaf takes to arrive,
+	// and its answer to leave, and serveWAFIdleTimeout how long a kept-open
+	// connection waits for its next request.
+	serveWAFTimeout     = 60 * time.Second
+	serveWAFIdleTimeout = 120 * time.Second
+)
+
+var (
+	errReportFieldMissing = errors.New("a field is missing")
+	errReportValue        = errors.New("a value is out of range")
+)
+
+// Report is the JSON object rproxy posts to ReportPath once the visitor's
+// answer has ended, its fields named as the request log's of the same
+// meaning. RequestID is the question's id. Status is what the visitor got, 0
+// if nothing. The durations are in milliseconds.
+//
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
+type Report struct {
+	RequestID             string  `json:"request_id"`
+	Status                int     `json:"status"`
+	RequestBytes          int64   `json:"request_bytes"`
+	ResponseBytes         int64   `json:"response_bytes"`
+	DurationTotal         float64 `json:"duration_total"`
+	DurationUpstreamTotal float64 `json:"duration_upstream_total"`
+}
+
+// NewServeWAF returns the server `smallwebwaf servewaf` runs. It answers
+// rproxy's questions, takes rproxy's reports and answers its own endpoints. It
+// passes nothing to an app. rproxy applies the size and time limits to the
+// visitor. Go's default limit on a request's line and headers, 1 MiB, stays: it
+// is far above rproxy's, and a question refused for its size would have rproxy
+// let the request through.
+func NewServeWAF(params Params) *Server {
+	h := newHandler(params)
+
+	return &Server{
+		Server: &http.Server{
+			Addr:         params.Config.ListenAddr,
+			Handler:      h,
+			ErrorLog:     slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn),
+			ReadTimeout:  serveWAFTimeout,
+			WriteTimeout: serveWAFTimeout,
+			IdleTimeout:  serveWAFIdleTimeout,
+		},
+		Ledger:     h.ledger,
+		Limiter:    h.limiter,
+		GeoJS:      h.geojs,
+		Anomalies:  h.anomalies,
+		LookupFile: h.lookupFile,
+		Lists:      h.lists,
+		DNSBL:      h.dnsbl,
+		AbuseIPDB:  h.abuseIPDB,
+		Metrics:    h.metrics,
+	}
+}
+
+// ServeHTTP handles one request to servewaf: a request carrying ClientHeader is
+// rproxy's question, and any other is for servewaf itself.
+func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if len(r.Header.Values(ClientHeader)) > 0 {
+		h.answerQuestion(w, r)
+
+		return
+	}
+
+	h.answerOwnEndpoint(w, r)
+}
+
+// refusedWhateverTheAnswer reports whether the request is one that does not wait
+// for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
+// its client: it is over the header limits, a blocklist lists its client while
+// SWWAF_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
+// over a whole rate limit. In observe mode, which refuses nothing, none is.
+// rproxy lets a request through when servewaf answers too late.
+func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
+	if rq.h.config.Observe {
+		return false
+	}
+
+	lists := rq.h.lists
+	_, decided := lists.CrowdSecDecision(rq.client, now)
+
+	return decided || rq.overHeaderLimits() ||
+		(rq.h.config.BlocklistAction == deny && len(lists.ListedBy(rq.client)) > 0) ||
+		(rq.countedByRateLimits() &&
+			rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now))
+}
+
+// overHeaderLimits reports whether servewaf refuses the request for its
+// headers: it has more than maxHeaderFields fields, each value of a header sent
+// twice being one, or more than maxCookies cookies, each part of a Cookie header
+// between semicolons being one unless it is empty or only spaces and tabs. The
+// Core Rule Set runs each of its rules on each cookie, so that thousands of small
+// cookies keep it busy for over a second. It trims only spaces and control
+// characters, of which a header value can hold only tabs, so a part of Unicode
+// spaces is a cookie to it.
+func (rq *request) overHeaderLimits() bool {
+	fields, cookies := 0, 0
+
+	for _, values := range rq.in.Header {
+		fields += len(values)
+	}
+
+	for _, value := range rq.in.Header.Values("Cookie") {
+		for part := range strings.SplitSeq(value, ";") {
+			if strings.Trim(part, " \t") != "" {
+				cookies++
+			}
+		}
+	}
+
+	return fields > maxHeaderFields || cookies > maxCookies
+}
+
+// answerQuestion runs the checks on the visitor's request a question
+// carries, and answers rproxy what to do with it. A denied request's counting
+// is finished here, and an allowed one's by its report.
+func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
+	client, body, ok := h.readQuestion(w, r)
+	if !ok {
+		return
+	}
+
+	// One that cannot be read leaves the log line's peer_ip invalid.
+	peer, _ := netip.ParseAddr(r.Header.Get(PeerHeader))
+
+	rq := h.startRequest(w, asTheVisitorSentIt(r, body), client.Unmap(), peer.Unmap(),
+		true)
+	// The last deferred runs first, so that what is held has the finished log
+	// line. Go's server sends the answer only once this function has
+	// returned, so the report cannot come before it is held.
+	defer rq.holdForReport()
+	defer rq.finish()
+
+	rq.site = r.Host
+	rq.line.ServeWAFLine = requestlog.ServeWAFLineDecision
+	refused := rq.check(r.Context())
+	rq.checked = time.Now()
+	underOwnPrefix := strings.HasPrefix(r.URL.Path, adminPrefix)
+
+	if refused == nil && !underOwnPrefix {
+		// In observe mode, what enforce mode would have refused counts here.
+		defer rq.countRefusal()
+
+		rq.allow()
+
+		return
+	}
+
+	// The last deferred runs first: countRefusal before addToHistory, so that a
+	// broken error burst is in the client's history.
+	defer rq.addToHistory()
+	defer rq.countAnomalies()
+	defer rq.countRefusal()
+
+	if refused != nil {
+		rq.deny(*refused)
+
+		return
+	}
+
+	// The app never sees this prefix. servewaf's own endpoints are at its
+	// own address, so this answers as a path with no endpoint does.
+	rq.line.Action = requestlog.ActionAdmin
+	rq.out.Header().Set(DispositionHeader, DispositionDeny)
+	http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
+}
+
+// readQuestion returns the visitor's address and the body a question carries,
+// and whether servewaf takes the question. It answers a question it does not
+// take with 400 and no disposition, which rproxy treats as it treats no
+// answer. The id of a question it takes is held from here on, without a
+// decision yet, so that another question with that id is refused while this
+// one is being handled.
+//
+// The body is read before any check, since Go's server does not send an answer
+// until it has read the body. A question whose body stops arriving gets no
+// answer, and is not looked at.
+func (h *handler) readQuestion(
+	w http.ResponseWriter, r *http.Request,
+) (netip.Addr, []byte, bool) {
+	client, err := netip.ParseAddr(r.Header.Get(ClientHeader))
+	if err != nil || client.Zone() != "" {
+		h.refuseQuestion(w, ClientHeader+" is not an address without a zone")
+
+		return netip.Addr{}, nil, false
+	}
+
+	id := r.Header.Get(requestIDHeader)
+	if id == "" || len(id) > maxRequestIDBytes || !utf8.ValidString(id) {
+		h.refuseQuestion(w, requestIDHeader+" is not a valid id")
+
+		return netip.Addr{}, nil, false
+	}
+
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, QuestionBodyMaxBytes))
+
+	if _, tooLarge := errors.AsType[*http.MaxBytesError](err); tooLarge {
+		h.refuseQuestion(w, "the body is over 64 KiB")
+
+		return netip.Addr{}, nil, false
+	}
+
+	if err != nil {
+		h.processLog.Warn("a question's body stopped arriving", "error", err.Error())
+		// This panic has Go's server close the connection without an answer,
+		// and log nothing.
+		panic(http.ErrAbortHandler)
+	}
+
+	held, _ := h.awaitingReport.ContainsOrAdd(id, nil)
+	if held {
+		h.refuseQuestion(w, requestIDHeader+" is the id of a request servewaf holds")
+
+		return netip.Addr{}, nil, false
+	}
+
+	return client, body, true
+}
+
+// refuseQuestion answers a question servewaf does not take, for reason.
+func (h *handler) refuseQuestion(w http.ResponseWriter, reason string) {
+	h.processLog.Warn("a question is refused", "reason", reason)
+	http.Error(w, reason, http.StatusBadRequest)
+}
+
+// asTheVisitorSentIt returns a copy of r, a question, as the checks and the
+// log line are to see it: without the headers rproxy adds for servewaf, with
+// body, which has been read of r, and with the length the visitor announced,
+// as -1 when it announced none. The question's own length covers only the part
+// of the body it carries.
+func asTheVisitorSentIt(r *http.Request, body []byte) *http.Request {
+	sent := r.Clone(r.Context())
+	announced := sent.Header.Get(ContentLengthHeader)
+
+	sent.Header.Del(ClientHeader)
+	sent.Header.Del(PeerHeader)
+	sent.Header.Del(ContentLengthHeader)
+	sent.Header.Del("Content-Length")
+
+	sent.ContentLength = -1
+
+	length, err := strconv.ParseInt(announced, 10, 64)
+	if err == nil && length >= 0 {
+		sent.ContentLength = length
+		sent.Header.Set("Content-Length", announced)
+	}
+
+	sent.Body = http.NoBody
+	if len(body) > 0 {
+		sent.Body = io.NopCloser(bytes.NewReader(body))
+	}
+
+	return sent
+}
+
+// allow answers a question with DispositionAllow and, while
+// SWWAF_ADD_LOOKUP_HEADERS is set, the client's AS number and country.
+func (rq *request) allow() {
+	rq.allowed = true
+
+	header := rq.out.Header()
+	header.Set(DispositionHeader, DispositionAllow)
+
+	if rq.h.config.AddLookupHeaders {
+		setLookupHeaders(header, rq.line.ASN, rq.line.Country)
+	}
+
+	rq.out.WriteHeader(http.StatusOK)
+}
+
+// holdForReport holds a copy of what the report's steps need, by the request's
+// id. A report only ever reaches that copy, never the request being handled.
+func (rq *request) holdForReport() {
+	held := rq.decision
+	rq.h.awaitingReport.Add(rq.line.RequestID, &held)
+}
+
+// deny answers a question with what the visitor is to get for r.
+func (rq *request) deny(r refusal) {
+	rq.refused = &r
+
+	if r.status == 0 {
+		// SWWAF_BAN_RESPONSE is close. Written past rq.out, since the log line's
+		// status stays 0: the visitor is sent nothing.
+		rq.out.Header().Set(DispositionHeader, DispositionClose)
+		rq.out.ResponseWriter.WriteHeader(http.StatusOK)
+
+		return
+	}
+
+	rq.out.Header().Set(DispositionHeader, DispositionDeny)
+	http.Error(rq.out, http.StatusText(r.status), r.status)
+}
+
+// answerOwnEndpoint answers a request to servewaf's own address. No check
+// runs on it: the address is on the private network, where the peers are
+// rproxy and the admin's tools, not visitors.
+func (h *handler) answerOwnEndpoint(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodPost && r.URL.Path == ReportPath {
+		h.takeReport(w, r)
+
+		return
+	}
+
+	peer := peerAddress(r)
+
+	rq := h.startRequest(w, r, peer, peer, false)
+	defer rq.finish()
+
+	if r.Method == http.MethodGet && r.URL.Path == HealthPath {
+		rq.answerHealth()
+
+		return
+	}
+
+	rq.answerAdmin()
+}
+
+// takeReport answers POST ReportPath: it finishes the request the report
+// names, if it holds that request's decision, and ignores the report
+// otherwise.
+func (h *handler) takeReport(w http.ResponseWriter, r *http.Request) {
+	report, err := readReport(w, r)
+	if err != nil {
+		h.processLog.Warn("a report is refused", "error", err.Error())
+		http.Error(w, "the body is not a report", http.StatusBadRequest)
+
+		return
+	}
+
+	held, found := h.awaitingReport.Peek(report.RequestID)
+	// Remove reports true to one report only, of several that name the id. A
+	// question still being handled is held as nil.
+	if found && held != nil && h.awaitingReport.Remove(report.RequestID) {
+		h.finishWith(held, report)
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// readReport reads a report from r's body, which must be one JSON object with
+// all of Report's fields, in the ranges SPEC.md gives.
+func readReport(w http.ResponseWriter, r *http.Request) (Report, error) {
+	var report Report
+
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, reportBodyMaxBytes))
+	if err != nil {
+		return report, fmt.Errorf("read the body: %w", err)
+	}
+
+	var fields map[string]json.RawMessage
+
+	err = json.Unmarshal(body, &fields)
+	if err != nil {
+		return report, fmt.Errorf("decode the body: %w", err)
+	}
+
+	for _, name := range []string{
+		"request_id", "status", "request_bytes", "response_bytes",
+		"duration_total", "duration_upstream_total",
+	} {
+		value, there := fields[name]
+		if !there || string(value) == "null" {
+			return report, fmt.Errorf("%w: %s", errReportFieldMissing, name)
+		}
+	}
+
+	err = json.Unmarshal(body, &report)
+	if err != nil {
+		return report, fmt.Errorf("decode the body: %w", err)
+	}
+
+	return report, report.checkRanges()
+}
+
+// checkRanges returns an error for a value of the report that cannot be true.
+func (report *Report) checkRanges() error {
+	switch {
+	case report.Status != 0 &&
+		(report.Status < http.StatusContinue || report.Status > maxHTTPStatus):
+		return fmt.Errorf("%w: status", errReportValue)
+	case report.RequestBytes < 0 || report.RequestBytes > maxReportedBytes:
+		return fmt.Errorf("%w: request_bytes", errReportValue)
+	case report.ResponseBytes < 0 || report.ResponseBytes > maxReportedBytes:
+		return fmt.Errorf("%w: response_bytes", errReportValue)
+	case report.DurationTotal < 0 || report.DurationTotal > maxReportedMilliseconds:
+		return fmt.Errorf("%w: duration_total", errReportValue)
+	case report.DurationUpstreamTotal < 0 ||
+		report.DurationUpstreamTotal > maxReportedMilliseconds:
+		return fmt.Errorf("%w: duration_upstream_total", errReportValue)
+	}
+
+	return nil
+}
+
+// finishWith finishes a request with what its report says, and writes the
+// request's last log line, which holds its decision's fields and the report's.
+// For an allowed request it first counts the request's bytes, and adds it to its
+// client's history, the anomaly counters and the metrics, with the status and
+// bytes the report gives. A denied request's counting was finished at its
+// decision.
+func (h *handler) finishWith(held *decision, report Report) {
+	rq := &request{
+		decision:     *held,
+		h:            h,
+		out:          &responseWriter{status: report.Status, bytes: report.ResponseBytes},
+		requestBytes: report.RequestBytes,
+	}
+
+	rq.line.ServeWAFLine = requestlog.ServeWAFLineReport
+	rq.line.Status = report.Status
+	rq.line.RequestBytes = report.RequestBytes
+	rq.line.ResponseBytes = report.ResponseBytes
+	rq.line.DurationTotal = report.DurationTotal
+
+	if rq.allowed {
+		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
+
+		rq.countBytes()
+		rq.countAnomalies()
+		rq.addToHistory()
+
+		rq.h.metrics.RequestReported(&rq.line,
+			time.Duration(report.DurationTotal*float64(time.Millisecond)),
+			time.Duration(report.DurationUpstreamTotal*float64(time.Millisecond)))
+	}
+
+	rq.writeLine()
+}

internal/proxy/staticlists_test.go

@@ -17,7 +17,7 @@ const (
 	unlistedAddr = "2001:db8::2"
 )
 
-func TestAllowNetsSkipEveryCheckButTheSizeLimit(t *testing.T) {
+func TestAllowNetsSkipEveryCheck(t *testing.T) {
 	t.Parallel()
 
 	var calls atomic.Int32
@@ -34,7 +34,6 @@ func TestAllowNetsSkipEveryCheckButTheSizeLimit(t *testing.T) {
 		denyNets:           fromKP,
 		deniedCountries:    "kp",
 		rateLimitPerMinute: "1",
-		requestMaxBytes:    "1K",
 	})
 
 	// Neither SWWAF_DENY_NETS, the country lists nor the limit of one
@@ -49,14 +48,6 @@ func TestAllowNetsSkipEveryCheckButTheSizeLimit(t *testing.T) {
 		t.Errorf("GeoJS was asked about %v, want nothing", asked())
 	}
 
-	// The size limit still applies.
-	body := strings.NewReader(strings.Repeat("a", 2<<10))
-	req := newRequest(t, http.MethodPost, addr, "/", body)
-	req.Header.Set(forwardedFor, fromKP)
-	wantStatus(t, do(t, req), http.StatusRequestEntityTooLarge)
-	wantLine(t, out.requestLines(t, 3)[2],
-		http.StatusRequestEntityTooLarge, requestlog.ActionTooLarge)
-
 	if calls.Load() != 2 {
 		t.Errorf("the app was called %d times, want 2", calls.Load())
 	}
@@ -82,7 +73,7 @@ func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
 	})
 }
 
-func TestDenyNetsRefuseBeforeTheLookupAndTheBody(t *testing.T) {
+func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 	t.Parallel()
 
 	var calls atomic.Int32
@@ -101,13 +92,9 @@ func TestDenyNetsRefuseBeforeTheLookupAndTheBody(t *testing.T) {
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusForbidden)
 
-	line := out.requestLine(t)
+	line := out.endedLine(t)
 	wantLine(t, line, http.StatusForbidden, requestlog.ActionDenied)
 
-	if line.RequestBytes != 0 {
-		t.Errorf("log line has request_bytes %d, want 0", line.RequestBytes)
-	}
-
 	if len(asked()) != 0 {
 		t.Errorf("GeoJS was asked about %v, want nothing", asked())
 	}
@@ -180,6 +167,6 @@ func wantAnswers(t *testing.T, addr string, out *output, requests []sentRequest)
 		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 		req.Header.Set(forwardedFor, sent.client)
 		wantStatus(t, do(t, req), sent.status)
-		wantLine(t, out.requestLines(t, i+1)[i], sent.status, sent.action)
+		wantLine(t, out.endedLines(t, i+1)[i], sent.status, sent.action)
 	}
 }

internal/proxy/timeouts_test.go

@@ -1,453 +0,0 @@
-package proxy_test
-
-import (
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-)
-
-// largeBodySize is more than the connections between the client,
-// smallwebwaf and the app can hold while nobody reads, so that a sender
-// soon waits.
-const largeBodySize = 64 << 20
-
-// writeSize is how much a test sender writes at a time.
-const writeSize = 32 << 10
-
-func TestRequestTimeouts(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		// limit is the setting set to shortTimeout, which runs out; long
-		// is one set to longTimeoutSetting, which does not, or "".
-		limit, long string
-		// appTakesNothing has the app never read, while the client sends
-		// as fast as it can; otherwise the app reads, and the client
-		// stops sending halfway.
-		appTakesNothing bool
-		want            int
-	}{
-		{
-			name:  "client request timeout, waiting on the client",
-			limit: clientRequestTimeout,
-			want:  http.StatusRequestTimeout,
-		},
-		{
-			name:  "upstream request timeout, waiting on the client",
-			limit: upstreamRequestTimeout,
-			long:  clientRequestTimeout,
-			want:  http.StatusRequestTimeout,
-		},
-		{
-			name:            "upstream request timeout, waiting on the app",
-			limit:           upstreamRequestTimeout,
-			appTakesNothing: true,
-			want:            http.StatusGatewayTimeout,
-		},
-		{
-			name:            "client request timeout, waiting on the app",
-			limit:           clientRequestTimeout,
-			long:            upstreamRequestTimeout,
-			appTakesNothing: true,
-			want:            http.StatusGatewayTimeout,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var (
-				app         *httptest.Server
-				appURL      string
-				sendRequest func(*testing.T, string) net.Conn
-				appGotBody  atomic.Bool
-			)
-
-			if tc.appTakesNothing {
-				appURL, sendRequest = startAppThatTakesNothing(t), sendLargeBody
-			} else {
-				app = startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-					n, _ := io.Copy(io.Discard, r.Body)
-					appGotBody.Store(n > 0)
-				})
-				appURL, sendRequest = app.URL, sendPartOfBody
-			}
-
-			env := map[string]string{tc.limit: shortTimeoutSetting, metricsToken: token}
-			if tc.long != "" {
-				env[tc.long] = longTimeoutSetting
-			}
-
-			addr, out := startProxy(t, appURL, env)
-			start := time.Now()
-			got := readResponse(t, sendRequest(t, addr))
-			wantTimedOut(t, start)
-
-			want := tc.want
-
-			if app != nil {
-				// Close returns once the app has finished with the request.
-				app.Close()
-
-				// Until some of the body has reached the app, smallwebwaf
-				// waits on the app, and SPEC.md asks for 504; the timeout
-				// runs out then only if the test process is held up.
-				if !appGotBody.Load() {
-					want = http.StatusGatewayTimeout
-				}
-			}
-
-			wantStatus(t, got, want)
-			wantLine(t, out.requestLine(t), want, requestlog.ActionTimedOut)
-			wantLimitHits(t, addr, tc.limit, 1)
-		})
-	}
-}
-
-// startAppThatTakesNothing starts an app that accepts connections and
-// never reads from them, and returns its URL.
-func startAppThatTakesNothing(t *testing.T) string {
-	t.Helper()
-
-	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	var (
-		mu   sync.Mutex
-		held []net.Conn
-	)
-
-	hold := func(conn net.Conn) {
-		mu.Lock()
-		defer mu.Unlock()
-
-		held = append(held, conn)
-	}
-
-	go func() {
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-
-			hold(conn)
-		}
-	}()
-
-	t.Cleanup(func() {
-		_ = listener.Close()
-
-		mu.Lock()
-		defer mu.Unlock()
-
-		for _, conn := range held {
-			_ = conn.Close()
-		}
-	})
-
-	return "http://" + listener.Addr().String()
-}
-
-// sendPartOfBody sends a request that announces a large body, and only
-// the first bytes of it.
-func sendPartOfBody(t *testing.T, addr string) net.Conn {
-	t.Helper()
-
-	conn := dial(t, addr)
-	send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: "+
-		strconv.Itoa(largeBodySize)+"\r\n\r\nthe first bytes")
-
-	return conn
-}
-
-// sendLargeBody sends a request with a large body, as fast as smallwebwaf
-// takes it, from a goroutine of its own.
-func sendLargeBody(t *testing.T, addr string) net.Conn {
-	t.Helper()
-
-	conn := dial(t, addr)
-	send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: "+
-		strconv.Itoa(largeBodySize)+"\r\n\r\n")
-
-	go func() {
-		chunk := make([]byte, writeSize)
-		for range largeBodySize / writeSize {
-			_, err := conn.Write(chunk)
-			if err != nil {
-				return
-			}
-		}
-	}()
-
-	return conn
-}
-
-func TestClientStopsSendingAfterTheAppHasAnswered(t *testing.T) {
-	t.Parallel()
-
-	// answeredAt is when the app answered, or nil if the bytes the client
-	// sent never reached it.
-	var answeredAt atomic.Pointer[time.Time]
-
-	// The app answers without reading the whole body, as an app does for
-	// a path it does not serve, and only once smallwebwaf waits for the
-	// rest of it: the app takes the bytes the client sent, and then waits
-	// half the timeout, far longer than smallwebwaf takes to go on to
-	// wait.
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		_, err := io.ReadFull(r.Body, make([]byte, len("the first bytes")))
-		if err != nil {
-			return
-		}
-
-		time.Sleep(shortTimeout / 2)
-		answeredAt.Store(new(time.Now()))
-		http.NotFound(w, r)
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		clientRequestTimeout: shortTimeoutSetting,
-		metricsToken:         token,
-	})
-
-	start := time.Now()
-	got := readResponse(t, sendPartOfBody(t, addr))
-	wantTimedOut(t, start)
-
-	// Close returns once the app has finished with the request.
-	app.Close()
-
-	// The app's answer came before the time ran out, so the client is
-	// sent that answer, not smallwebwaf's 408. Only a hold-up of the test
-	// process can make it come later, and SPEC.md then asks for 408, as
-	// smallwebwaf was waiting for the client, or for 504 if the bytes the
-	// client sent had not reached the app.
-	at := answeredAt.Load()
-	want := http.StatusNotFound
-
-	switch {
-	case at == nil:
-		want = http.StatusGatewayTimeout
-	case at.Sub(start) >= shortTimeout:
-		want = http.StatusRequestTimeout
-	}
-
-	wantStatus(t, got, want)
-	wantLine(t, out.requestLine(t), want, requestlog.ActionTimedOut)
-	wantLimitHits(t, addr, clientRequestTimeout, 1)
-}
-
-func TestClientStopsSendingWithLittleOfItsBodyLeft(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		// limit is the setting set to shortTimeout, which runs out, and
-		// clientTimeout what SWWAF_CLIENT_REQUEST_TIMEOUT is set to when it
-		// is not limit.
-		limit, clientTimeout string
-	}{
-		{
-			name:  "client request timeout",
-			limit: clientRequestTimeout,
-		},
-		{
-			name:          "upstream request timeout, client request timeout off",
-			limit:         upstreamRequestTimeout,
-			clientTimeout: off,
-		},
-		{
-			name:          "upstream request timeout, client request timeout longer",
-			limit:         upstreamRequestTimeout,
-			clientTimeout: longTimeoutSetting,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			// appClosed is closed once smallwebwaf has closed its
-			// connection to the app, which it does once it has the app's
-			// answer.
-			appClosed := make(chan struct{})
-
-			// The app answers without reading the rest of the body, and
-			// says it closes the connection, only once smallwebwaf waits
-			// for the client to send more: it takes the bytes the client
-			// sent, and then waits half the timeout, far longer than
-			// smallwebwaf takes to go on to wait.
-			app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-				conn, buf, err := http.NewResponseController(w).Hijack()
-				if err != nil {
-					return
-				}
-
-				_, _ = io.ReadFull(buf.Reader, make([]byte, len("the first bytes")))
-
-				time.Sleep(shortTimeout / 2)
-
-				_, _ = buf.WriteString("HTTP/1.1 404 Not Found\r\n" +
-					"Content-Length: 0\r\nConnection: close\r\n\r\n")
-				_ = buf.Flush()
-				_, _ = io.Copy(io.Discard, buf.Reader)
-				_ = conn.Close()
-
-				close(appClosed)
-			})
-
-			env := map[string]string{tc.limit: shortTimeoutSetting, metricsToken: token}
-			if tc.clientTimeout != "" {
-				env[clientRequestTimeout] = tc.clientTimeout
-			}
-
-			addr, out := startProxy(t, app.URL, env)
-
-			// Less than 256 KiB of the body is left after the first bytes,
-			// little enough for Go's server in smallwebwaf to read the rest
-			// itself before it sends the app's answer.
-			start := time.Now()
-			conn := dial(t, addr)
-			send(t, conn, "POST /upload HTTP/1.1\r\nHost: app\r\nContent-Length: 200000\r\n\r\n"+
-				"the first bytes")
-
-			select {
-			case <-appClosed:
-			case <-time.After(waitLimit):
-				t.Fatal("smallwebwaf did not close its connection to the app")
-			}
-
-			// More of the body, which can no longer go to the app, and then
-			// nothing.
-			send(t, conn, strings.Repeat("x", 8<<10))
-
-			got := readResponse(t, conn)
-			wantTimedOut(t, start)
-			wantStatus(t, got, http.StatusNotFound)
-			wantLine(t, out.requestLine(t), http.StatusNotFound, requestlog.ActionTimedOut)
-			wantLimitHits(t, addr, tc.limit, 1)
-		})
-	}
-}
-
-func TestAppTooSlowToAnswer(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
-		<-r.Context().Done()
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		upstreamResponseTimeout: shortTimeoutSetting,
-		metricsToken:            token,
-	})
-
-	start := time.Now()
-
-	wantStatus(t, get(t, addr, "/slow"), http.StatusGatewayTimeout)
-	wantTimedOut(t, start)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusGatewayTimeout, requestlog.ActionTimedOut)
-
-	_, answered := line.fields["upstream_status"]
-	if answered {
-		t.Errorf("log line has upstream_status %v for an app that never answered",
-			line.fields["upstream_status"])
-	}
-
-	wantLimitHits(t, addr, upstreamResponseTimeout, 1)
-}
-
-func TestAppTooSlowToFinishItsAnswer(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
-		_, _ = io.WriteString(w, "the first part")
-		_ = http.NewResponseController(w).Flush()
-
-		<-r.Context().Done()
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		upstreamResponseTimeout: shortTimeoutSetting,
-	})
-
-	start := time.Now()
-	got := get(t, addr, "/slow")
-	wantStatus(t, got, http.StatusOK)
-
-	if string(got.body) != "the first part" || !errors.Is(got.err, io.ErrUnexpectedEOF) {
-		t.Errorf("client read %q (%v), want the first part cut off", got.body, got.err)
-	}
-
-	wantTimedOut(t, start)
-
-	line := out.requestLine(t)
-	wantLine(t, line, http.StatusOK, requestlog.ActionTimedOut)
-
-	if line.UpstreamStatus != http.StatusOK {
-		t.Errorf("log line has upstream_status %d, want %d",
-			line.UpstreamStatus, http.StatusOK)
-	}
-}
-
-func TestClientTooSlowToTakeTheAnswer(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
-		chunk := make([]byte, writeSize)
-		for range largeBodySize / writeSize {
-			_, err := w.Write(chunk)
-			if err != nil {
-				return
-			}
-		}
-	})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		clientResponseTimeout: shortTimeoutSetting,
-		metricsToken:          token,
-	})
-
-	start := time.Now()
-
-	// The client asks, and never reads the answer.
-	conn := dial(t, addr)
-	send(t, conn, "GET /large HTTP/1.1\r\nHost: app\r\n\r\n")
-
-	line := out.requestLine(t)
-	wantTimedOut(t, start)
-	wantLine(t, line, http.StatusOK, requestlog.ActionTimedOut)
-	wantLimitHits(t, addr, clientResponseTimeout, 1)
-}
-
-func TestClosesAnIdleConnection(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, _ := startProxy(t, app.URL, map[string]string{
-		clientIdleTimeout: shortTimeoutSetting,
-	})
-
-	// The idle time starts once the answer is sent, so after start.
-	start := time.Now()
-	conn := dial(t, addr)
-	send(t, conn, "GET / HTTP/1.1\r\nHost: app\r\n\r\n")
-	wantStatus(t, readResponse(t, conn), http.StatusOK)
-
-	// The read deadline readResponse set still bounds this read.
-	_, err := conn.Read(make([]byte, 1))
-	if !errors.Is(err, io.EOF) {
-		t.Fatalf("read on the idle connection: %v, want it closed", err)
-	}
-
-	wantTimedOut(t, start)
-}

internal/ratelimit/history_test.go

@@ -23,8 +23,8 @@ func TestHistoryKeepsEveryRequest(t *testing.T) {
 		{Forwarded: true, Status: 502, ResponseBytes: 12},
 		// Closed without an answer: refused, and no response.
 		{Refused: true, Status: 0},
-		// Answered 404 at smallwebwaf's own endpoints: neither forwarded
-		// nor refused.
+		// Answered 404 for a path under /_smallwebwaf/: neither forwarded nor
+		// refused.
 		{Status: 404},
 	} {
 		limiter.AddToHistory(client, start.Add(time.Duration(i)*time.Minute), r)

internal/ratelimit/ratelimit.go

@@ -92,10 +92,9 @@ type History struct {
 	ASName   string    `json:"as_name,omitempty"`
 	Country  string    `json:"country,omitempty"`
 	LookedUp time.Time `json:"looked_up,omitzero"`
-	// Requests are all the client's requests: Forwarded those passed to
-	// the app, Refused those refused before anything reached it, a 401 at
-	// smallwebwaf's own endpoints included, and neither the others
-	// smallwebwaf answered there.
+	// Requests are all the client's requests: Forwarded those servewaf allowed,
+	// Refused those it refused, and neither those for a path under
+	// /_smallwebwaf/.
 	Requests  int64 `json:"requests"`
 	Forwarded int64 `json:"forwarded"`
 	Refused   int64 `json:"refused"`
@@ -124,21 +123,20 @@ type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
 	// of a ban rule or a request for a trap path, RuleBlocked those a block
-	// rule refused, WAFBlocked those the Core Rule Set refused, and
-	// TokenRefused those refused for a missing or wrong token.
-	Limit        int64 `json:"limit"`
-	Attack       int64 `json:"attack"`
-	RuleBlocked  int64 `json:"rule_blocked"`
-	WAFBlocked   int64 `json:"waf_blocked"`
-	TokenRefused int64 `json:"token_refused"`
+	// rule refused, and WAFBlocked those the Core Rule Set refused.
+	Limit       int64 `json:"limit"`
+	Attack      int64 `json:"attack"`
+	RuleBlocked int64 `json:"rule_blocked"`
+	WAFBlocked  int64 `json:"waf_blocked"`
+	// TokenRefused is what a clients.json written by an earlier version gives,
+	// which must still load. Nothing adds to it.
+	TokenRefused int64 `json:"token_refused,omitempty"`
 }
 
 // Request is what a client's history keeps of one of its requests.
 type Request struct {
-	// Forwarded is true for a request passed to the app, Refused for one
-	// refused before anything reached it, a 401 at smallwebwaf's own
-	// endpoints included. Both are false for any other request smallwebwaf
-	// answered there.
+	// Forwarded is true for a request servewaf allowed, and Refused for one it
+	// refused. Both are false for a request for a path under /_smallwebwaf/.
 	Forwarded bool
 	Refused   bool
 	// Status is what the client was sent, 0 if nothing was.
@@ -149,14 +147,12 @@ type Request struct {
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
-	// asked for a trap path, RuleBlocked for one a block rule refused,
-	// WAFBlocked for one the Core Rule Set refused, and TokenRefused for
-	// one refused for a missing or wrong token.
-	BrokeLimit   bool
-	Attack       bool
-	RuleBlocked  bool
-	WAFBlocked   bool
-	TokenRefused bool
+	// asked for a trap path, RuleBlocked for one a block rule refused, and
+	// WAFBlocked for one the Core Rule Set refused.
+	BrokeLimit  bool
+	Attack      bool
+	RuleBlocked bool
+	WAFBlocked  bool
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
@@ -228,6 +224,30 @@ func (l *Limiter) Count(
 	return l.count(client, now, 1, 0, percent)
 }
 
+// OverARateLimit reports whether one more request from client at now would
+// take it over a whole rate limit. A client's percentage can only lower a
+// limit, so that request is over the limit at any percentage. It counts
+// nothing, and does not make the client the most recently seen.
+func (l *Limiter) OverARateLimit(client netip.Prefix, now time.Time) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	c, seen := l.clients.Peek(client)
+	if !seen {
+		return false
+	}
+
+	buckets := c.buckets()
+
+	for i, w := range l.windows {
+		if w.limit > 0 && buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
+			return true
+		}
+	}
+
+	return false
+}
+
 // CountBytes counts bytes, those of a request from client that has ended,
 // at now, in every window, and returns the client's counts in each window.
 // It reports whether the bytes take the client over a byte limit, of which
@@ -310,10 +330,6 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 	if r.WAFBlocked {
 		h.Offences.WAFBlocked++
 	}
-
-	if r.TokenRefused {
-		h.Offences.TokenRefused++
-	}
 }
 
 // AddLookup gives client's history its AS number, AS name and country, as

internal/ratelimit/ratelimit_test.go

@@ -26,6 +26,50 @@ const (
 	hour   = "hour"
 )
 
+func TestOverARateLimitSaysWhatTheNextRequestWouldDoAndCountsNothing(t *testing.T) {
+	t.Parallel()
+
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	now := midnight()
+	limiter := ratelimit.New(ratelimit.Limits{PerMinute: limit, PerDay: limit + 1},
+		tableSize)
+
+	if limiter.OverARateLimit(client, now) {
+		t.Error("a client never seen is over a rate limit")
+	}
+
+	if limiter.Len() != 0 {
+		t.Error("asking about a client never seen added it to the table")
+	}
+
+	for range limit {
+		if limiter.OverARateLimit(client, now) {
+			t.Error("a client with room for another request is over a rate limit")
+		}
+
+		wantCount(t, limiter, client, now, "")
+	}
+
+	if !limiter.OverARateLimit(client, now) {
+		t.Error("a client at its limit is not over a rate limit")
+	}
+
+	held, _ := limiter.Client(client)
+	if held.Minute.Current != limit {
+		t.Errorf("the client's minute holds %d requests, want %d", held.Minute.Current, limit)
+	}
+
+	wantCount(t, limiter, client, now, minute)
+
+	// A limit that is off is never gone over.
+	off := ratelimit.New(ratelimit.Limits{}, tableSize)
+	off.Count(client, now, whole)
+
+	if off.OverARateLimit(client, now) {
+		t.Error("a client is over a rate limit that is off")
+	}
+}
+
 func TestEachWindowRefusesAtItsLimitAndLetsTheClientBack(t *testing.T) {
 	t.Parallel()
 

internal/requestlog/requestlog.go

@@ -1,6 +1,7 @@
 // Package requestlog writes the lines smallwebwaf prints on stdout: one
-// JSON object per request, marked "type":"request", and the process's own
-// messages as JSON lines marked "type":"process".
+// JSON object per request, two from servewaf and a short one from rproxy, marked
+// "type":"request", and the process's own messages as JSON lines marked
+// "type":"process".
 package requestlog
 
 import (
@@ -13,18 +14,13 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
-// The action a request line names: what smallwebwaf did with the
-// request.
+// The action a request line names: what servewaf did with the request.
 const (
-	// ActionForward is a request passed to the app.
+	// ActionForward is a request servewaf allowed, which rproxy passes to the
+	// app.
 	ActionForward = "forward"
-	// ActionTooLarge is a request or response over its size limit.
+	// ActionTooLarge is a request over the header limits.
 	ActionTooLarge = "too_large"
-	// ActionTimedOut is a request or response that ran out of time.
-	ActionTimedOut = "timed_out"
-	// ActionUpstreamError is a request the app could not be reached
-	// for, or whose answer could not be passed on.
-	ActionUpstreamError = "upstream_error"
 	// ActionRateLimited is a request refused because it took its client
 	// over a rate limit, which bans the client.
 	ActionRateLimited = "rate_limited"
@@ -46,8 +42,8 @@ const (
 	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
-	// ActionAdmin is a request smallwebwaf answered at one of its own
-	// endpoints, under /_smallwebwaf/.
+	// ActionAdmin is a request servewaf answered at one of its own endpoints,
+	// or a question about a path under /_smallwebwaf/.
 	ActionAdmin = "admin"
 )
 
@@ -60,6 +56,16 @@ const OffenceLimit = "limit"
 // that broke the error burst.
 const LimitHitErrorBurst = "error_burst"
 
+// The servewaf_line a request line names, which says which of servewaf's two
+// lines about a question it is.
+const (
+	// ServeWAFLineDecision is servewaf's line at its decision.
+	ServeWAFLineDecision = "decision"
+	// ServeWAFLineReport is servewaf's line when rproxy's report comes, with
+	// the decision's fields and the report's together.
+	ServeWAFLineReport = "report"
+)
+
 // timeLayout is RFC 3339 with milliseconds.
 const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 
@@ -70,9 +76,12 @@ const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 //nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Line struct {
 	Type string `json:"type"`
+	// ServeWAFLine is ServeWAFLineDecision or ServeWAFLineReport on servewaf's
+	// two lines about a question.
+	ServeWAFLine string `json:"servewaf_line,omitempty"`
 
-	// The standard web log fields. Scheme is how the client reached
-	// smallwebwaf, or the trusted proxy in front of it.
+	// The standard web log fields. Scheme is how the client reached rproxy, or
+	// the trusted proxy in front of it.
 	Time          string `json:"time"`
 	Instance      string `json:"instance"`
 	ClientIP      string `json:"client_ip"`
@@ -88,8 +97,8 @@ type Line struct {
 	Referer       string `json:"referer"`
 	UserAgent     string `json:"user_agent"`
 
-	// Request detail. RequestID is the X-Request-ID a trusted proxy sent,
-	// or a new one, and is sent on to the app. ForwardedFor is the
+	// Request detail. RequestID is the id rproxy made for the request, or for a
+	// request to servewaf's own endpoints a new one. ForwardedFor is the
 	// X-Forwarded-For header as received. ClientGroup is the netblock the
 	// client is counted as. ASN, ASName and Country are the client's AS
 	// number, AS name and country, as looked up.
@@ -108,17 +117,10 @@ type Line struct {
 	RequestHeaders   map[string]string `json:"request_headers,omitempty"`
 	HasAuthorization bool              `json:"has_authorization,omitempty"`
 	HasCookie        bool              `json:"has_cookie,omitempty"`
-	// Websocket is true when the connection was upgraded, as for a
-	// WebSocket.
-	Websocket bool `json:"websocket,omitempty"`
 
-	// Response detail, from the headers of the answer: the app's, as
-	// passed on, or those of smallwebwaf's own. Aborted is true when the
-	// client went away early.
+	// Response detail, of servewaf's own answer. Aborted is true when rproxy, or
+	// the admin's tool, went away before the answer.
 	ResponseContentType string `json:"response_content_type,omitempty"`
-	UpstreamStatus      int    `json:"upstream_status,omitempty"`
-	CacheControl        string `json:"cache_control,omitempty"`
-	Location            string `json:"location,omitempty"`
 	Aborted             bool   `json:"aborted,omitempty"`
 
 	// The decision.
@@ -126,7 +128,8 @@ type Line struct {
 	// WouldAction is, in observe mode, the action enforce mode would have
 	// taken with a request it would have refused: ActionDenied,
 	// ActionBanned, ActionCountryDenied, ActionRateLimited,
-	// ActionRuleBlocked or ActionWAFBlocked.
+	// ActionRuleBlocked, ActionWAFBlocked, or, in servewaf, ActionTooLarge
+	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// LimitPercent and LimitPercentSetting are, for a request the rate
 	// limits counted whose client a biased threshold gives a percentage of
@@ -167,23 +170,60 @@ type Line struct {
 
 	// The timings, in milliseconds. DurationChecks is the time until the
 	// checks were done, and DurationWAF the part of it the Core Rule Set
-	// took. DurationUpstreamConnect, DurationUpstreamFirstByte and
-	// DurationUpstreamTotal run from when the request was handed to the
-	// app: until there was a connection to it, until the first byte of its
-	// answer arrived, and until the end. Each but DurationTotal is nil for
-	// a request that did not get that far.
-	DurationTotal             float64  `json:"duration_total"`
-	DurationChecks            *float64 `json:"duration_checks,omitempty"`
-	DurationWAF               *float64 `json:"duration_waf,omitempty"`
-	DurationUpstreamConnect   *float64 `json:"duration_upstream_connect,omitempty"`
-	DurationUpstreamFirstByte *float64 `json:"duration_upstream_first_byte,omitempty"`
-	DurationUpstreamTotal     *float64 `json:"duration_upstream_total,omitempty"`
+	// took. DurationUpstreamTotal is what the report of an allowed request gives,
+	// from the hand-over to the app until the end of its answer. Each but
+	// DurationTotal is nil for a request that did not get that far.
+	DurationTotal         float64  `json:"duration_total"`
+	DurationChecks        *float64 `json:"duration_checks,omitempty"`
+	DurationWAF           *float64 `json:"duration_waf,omitempty"`
+	DurationUpstreamTotal *float64 `json:"duration_upstream_total,omitempty"`
+}
+
+// RProxyLine is rproxy's short line in the request log about one request. The
+// field names, and their order, are those of docs/request-log.md. A field that
+// does not apply to a request is left out of its line.
+//
+//nolint:tagliatelle // docs/request-log.md names the fields in snake_case
+type RProxyLine struct {
+	Type          string `json:"type"`
+	Time          string `json:"time"`
+	RequestID     string `json:"request_id"`
+	ClientIP      string `json:"client_ip"`
+	Host          string `json:"host"`
+	Method        string `json:"method"`
+	Path          string `json:"path"`
+	Query         string `json:"query"`
+	Status        int    `json:"status"`
+	RequestBytes  int64  `json:"request_bytes"`
+	ResponseBytes int64  `json:"response_bytes"`
+	// DurationRequest runs in milliseconds from the request's headers being read
+	// until the app has been sent the whole request, or the answer has started
+	// if that is sooner. DurationResponse runs from then until the answer ends.
+	DurationRequest  float64 `json:"duration_request"`
+	DurationResponse float64 `json:"duration_response"`
+	// Disposition is the valid disposition servewaf answered or, while
+	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
+	// when neither gave one.
+	Disposition        string `json:"disposition,omitempty"`
+	DefaultDisposition bool   `json:"default_disposition,omitempty"`
 }
 
 // Write writes line to w as one JSON line marked "type":"request".
 func Write(w io.Writer, line *Line) error {
 	line.Type = "request"
 
+	return writeJSONLine(w, line)
+}
+
+// WriteRProxyLine writes line to w as one JSON line marked "type":"request".
+func WriteRProxyLine(w io.Writer, line *RProxyLine) error {
+	line.Type = "request"
+
+	return writeJSONLine(w, line)
+}
+
+// writeJSONLine writes line to w as one JSON line.
+func writeJSONLine(w io.Writer, line any) error {
 	encoded, err := json.Marshal(line)
 	if err != nil {
 		return fmt.Errorf("encode the request log line: %w", err)

internal/requestlog/requestlog_test.go

@@ -67,6 +67,28 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	}
 }
 
+func TestWriteRProxyLineWritesOneJSONLineWithOnlyItsFields(t *testing.T) {
+	t.Parallel()
+
+	var out bytes.Buffer
+
+	err := requestlog.WriteRProxyLine(&out, &requestlog.RProxyLine{
+		RequestID:   "an-id",
+		Disposition: "allow",
+	})
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	const want = `{"type":"request","time":"","request_id":"an-id","client_ip":"",` +
+		`"host":"","method":"","path":"","query":"","status":0,"request_bytes":0,` +
+		`"response_bytes":0,"duration_request":0,"duration_response":0,` +
+		`"disposition":"allow"}` + "\n"
+	if out.String() != want {
+		t.Errorf("wrote %s, want %s", out.String(), want)
+	}
+}
+
 func TestProcessLinesAreMarkedProcessAndGiveTheInstance(t *testing.T) {
 	t.Parallel()
 

internal/rproxy/bodies.go

@@ -1,4 +1,4 @@
-package proxy
+package rproxy
 
 import (
 	"bufio"
@@ -7,39 +7,38 @@ import (
 	"net"
 	"net/http"
 	"sync/atomic"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
 // errResponseTooLarge ends an app's response body that is longer than
-// SWWAF_RESPONSE_MAX_BYTES.
+// SWRP_MAX_RESPONSE_SIZE.
 var errResponseTooLarge = errors.New(
-	"the response body is over SWWAF_RESPONSE_MAX_BYTES")
+	"the response body is over SWRP_MAX_RESPONSE_SIZE")
 
-// requestBody is the client's request body on its way to the app. The
-// transport reads it on a goroutine of its own.
+// requestBody is the visitor's request body. rproxy first reads up to the first
+// 64 KiB of it into held, and then, on its way to the app, the transport reads
+// it on a goroutine of its own.
 type requestBody struct {
-	// body is the client's body, ending in an *http.MaxBytesError past
-	// SWWAF_REQUEST_MAX_BYTES.
+	// body is the visitor's body, ending in an *http.MaxBytesError past
+	// SWRP_MAX_REQUEST_SIZE.
 	body io.ReadCloser
 	rq   *request
-	// readByCoreRuleSet is what the Core Rule Set read of the body before
-	// the request went to the app, and Read gives first.
-	readByCoreRuleSet []byte
-	// waiting is true while a Read waits for the client to send more.
+	// held is the part read before the request goes to the app, which Read gives
+	// first.
+	held []byte
+	// waiting is true while a Read waits for the visitor to send more.
 	waiting atomic.Bool
-	// received is true once the client has sent the whole body.
+	// received is true once the visitor has sent the whole body.
 	received atomic.Bool
 	// bytes is how much of the body has been read.
 	bytes atomic.Int64
 }
 
-// Read reads from the client's body, after what the Core Rule Set read of
-// it, which has been counted already.
+// Read reads from the visitor's body, after the part held, which has been
+// counted already.
 func (b *requestBody) Read(p []byte) (int, error) {
-	if len(b.readByCoreRuleSet) > 0 {
-		n := copy(p, b.readByCoreRuleSet)
-		b.readByCoreRuleSet = b.readByCoreRuleSet[n:]
+	if len(b.held) > 0 {
+		n := copy(p, b.held)
+		b.held = b.held[n:]
 
 		return n, nil
 	}
@@ -54,27 +53,22 @@ func (b *requestBody) Read(p []byte) (int, error) {
 	switch {
 	case errors.Is(err, io.EOF):
 		b.received.Store(true)
-		b.rq.bodyReceived()
 	case errors.As(err, &tooLarge):
-		b.rq.refuse(refusal{
-			status: http.StatusRequestEntityTooLarge,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_REQUEST_MAX_BYTES",
-		})
+		b.rq.refuse(http.StatusRequestEntityTooLarge)
 	}
 
 	return n, err
 }
 
-// Close closes the client's body.
+// Close closes the visitor's body.
 func (b *requestBody) Close() error {
 	return b.body.Close()
 }
 
-// responseBody is the app's response body on its way to the client.
+// responseBody is the app's response body on its way to the visitor.
 type responseBody struct {
 	// body is the app's body, ending in an *http.MaxBytesError past
-	// SWWAF_RESPONSE_MAX_BYTES.
+	// SWRP_MAX_RESPONSE_SIZE.
 	body io.ReadCloser
 	rq   *request
 }
@@ -92,20 +86,13 @@ func (b *responseBody) Read(p []byte) (int, error) {
 	case errors.Is(err, io.EOF):
 		b.rq.responseReceived()
 	case errors.As(err, &tooLarge):
-		b.rq.refuse(refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionTooLarge,
-			limit:  "SWWAF_RESPONSE_MAX_BYTES",
-		})
+		b.rq.refuse(http.StatusBadGateway)
 
 		return n, errResponseTooLarge
 	case b.rq.in.Context().Err() == nil:
-		// The answer broke off, not because the client went away. If a
-		// timeout cut it, that refusal came first and is the one kept.
-		b.rq.refuse(refusal{
-			status: http.StatusBadGateway,
-			action: requestlog.ActionUpstreamError,
-		})
+		// The answer broke off, not because the visitor went away. If a time
+		// limit cut it, that refusal came first and is the one kept.
+		b.rq.refuse(http.StatusBadGateway)
 	}
 
 	return n, err
@@ -117,15 +104,14 @@ func (b *responseBody) Close() error {
 }
 
 // upgradedConn is the connection to the app once the app has switched
-// protocols, as for a WebSocket. ReverseProxy writes to it what the client
-// sends and reads from it what the app sends, on goroutines of its own,
-// until the connection closes; it counts the bytes each way, for the byte
-// limits.
+// protocols, as for a WebSocket. ReverseProxy writes to it what the visitor
+// sends and reads from it what the app sends, on goroutines of its own, until
+// the connection closes; it counts the bytes each way, for the report.
 type upgradedConn struct {
 	io.ReadWriteCloser
 
 	// fromApp is how many bytes the app has sent, and toApp how many the
-	// client has.
+	// visitor has.
 	fromApp atomic.Int64
 	toApp   atomic.Int64
 }
@@ -138,7 +124,7 @@ func (c *upgradedConn) Read(p []byte) (int, error) {
 	return n, err
 }
 
-// Write sends the app what the client sent.
+// Write sends the app what the visitor sent.
 func (c *upgradedConn) Write(p []byte) (int, error) {
 	n, err := c.ReadWriteCloser.Write(p)
 	c.toApp.Add(int64(n))
@@ -146,9 +132,9 @@ func (c *upgradedConn) Write(p []byte) (int, error) {
 	return n, err
 }
 
-// CloseWrite tells the app that the client sends no more, while what the
-// app sends still passes. ReverseProxy calls it once the client has
-// stopped sending, and closes the connection there if it is not supported.
+// CloseWrite tells the app that the visitor sends no more, while what the app
+// sends still passes. ReverseProxy calls it once the visitor has stopped
+// sending, and closes the connection there if it is not supported.
 func (c *upgradedConn) CloseWrite() error {
 	conn, ok := c.ReadWriteCloser.(interface{ CloseWrite() error })
 	if !ok {
@@ -158,8 +144,8 @@ func (c *upgradedConn) CloseWrite() error {
 	return conn.CloseWrite()
 }
 
-// limitBody returns body, cut off with an *http.MaxBytesError after
-// maxBytes, or unchanged if maxBytes is zero, which is off.
+// limitBody returns body, cut off with an *http.MaxBytesError after maxBytes, or
+// unchanged if maxBytes is zero, which is off.
 func limitBody(body io.ReadCloser, maxBytes int64) io.ReadCloser {
 	if maxBytes == 0 {
 		return body
@@ -169,19 +155,18 @@ func limitBody(body io.ReadCloser, maxBytes int64) io.ReadCloser {
 	return http.MaxBytesReader(nil, body, maxBytes)
 }
 
-// responseWriter is the response to the client. It notes the status and
-// size for the log line, and the first error writing to the client.
+// responseWriter is the response to the visitor. It notes the status and size
+// for the log line and the report.
 type responseWriter struct {
 	http.ResponseWriter
 
 	// status is the final status sent, or zero before one is.
 	status int
 	bytes  int64
-	err    error
 }
 
-// WriteHeader sends the status and headers. An informational 1xx status
-// is passed on and the final status still comes later.
+// WriteHeader sends the status and headers. An informational 1xx status is
+// passed on and the final status still comes later.
 func (w *responseWriter) WriteHeader(status int) {
 	if status >= http.StatusOK && w.status == 0 {
 		w.status = status
@@ -196,26 +181,20 @@ func (w *responseWriter) Write(p []byte) (int, error) {
 		w.status = http.StatusOK
 	}
 
-	n, err := w.ResponseWriter.Write(p)
+	n, err := w.ResponseWriter.Write(p) //nolint:gosec // the answer, as it was given
 	w.bytes += int64(n)
-	w.noteError(err)
 
 	return n, err
 }
 
-// FlushError sends what has been written so far.
-// http.ResponseController calls it, as ReverseProxy does after each
-// write.
+// FlushError sends what has been written so far. http.ResponseController calls
+// it, as ReverseProxy does after each write.
 func (w *responseWriter) FlushError() error {
-	err := http.NewResponseController(w.ResponseWriter).Flush()
-	w.noteError(err)
-
-	return err
+	return http.NewResponseController(w.ResponseWriter).Flush()
 }
 
-// Hijack takes over the connection to the client, which ReverseProxy does
-// only to pass on the app's 101 Switching Protocols: that is then the
-// status sent.
+// Hijack takes over the connection to the visitor, which ReverseProxy does only
+// to pass on the app's 101 Switching Protocols: that is then the status sent.
 func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	conn, buffered, err := http.NewResponseController(w.ResponseWriter).Hijack()
 	if err == nil {
@@ -225,15 +204,8 @@ func (w *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	return conn, buffered, err
 }
 
-// Unwrap lets http.ResponseController reach net/http's own
-// ResponseWriter for what responseWriter does not do itself.
+// Unwrap lets http.ResponseController reach net/http's own ResponseWriter for
+// what responseWriter does not do itself.
 func (w *responseWriter) Unwrap() http.ResponseWriter {
 	return w.ResponseWriter
 }
-
-// noteError keeps the first error writing to the client.
-func (w *responseWriter) noteError(err error) {
-	if w.err == nil {
-		w.err = err
-	}
-}

internal/rproxy/client.go

@@ -0,0 +1,122 @@
+package rproxy
+
+import (
+	"net/http"
+	"net/netip"
+	"slices"
+	"strings"
+)
+
+// The headers rproxy sets on the requests it passes to the app. Go writes every
+// header name in this form, as it sends it and as it receives it, so
+// X-Client-ASN arrives as X-Client-Asn, and Del removes a visitor's own whatever
+// their case; header names are not case-sensitive.
+const (
+	requestIDHeader = "X-Request-ID"
+	asnHeader       = "X-Client-Asn"
+	countryHeader   = "X-Client-Country"
+)
+
+// peerAddress is the address of the request's TCP peer, normally traefik, without
+// any IPv6 zone, which servewaf refuses.
+func peerAddress(r *http.Request) netip.Addr {
+	addrPort, err := netip.ParseAddrPort(r.RemoteAddr)
+	if err != nil {
+		return netip.Addr{}
+	}
+
+	return addrPort.Addr().Unmap().WithZone("")
+}
+
+// clientAddress works out who the visitor is. A peer outside the trusted
+// proxies is the visitor, and what it says in X-Forwarded-For is ignored. For a
+// peer inside them, X-Forwarded-For is read from the right, and the first
+// address outside them is the visitor; if every address in it is inside, the
+// leftmost is, and with no header, the peer. An entry that is not an address
+// ends the reading, since nothing to its left can be believed. The visitor's
+// address never has an IPv6 zone, which servewaf refuses.
+func clientAddress(
+	peer netip.Addr, forwardedFor []string, trusted []netip.Prefix,
+) netip.Addr {
+	client := peer
+	if !isInside(peer, trusted) {
+		return client
+	}
+
+	entries := strings.Split(strings.Join(forwardedFor, ","), ",")
+	for _, entry := range slices.Backward(entries) {
+		addr, err := netip.ParseAddr(strings.TrimSpace(entry))
+		if err != nil {
+			break
+		}
+
+		client = addr.Unmap().WithZone("")
+		if !isInside(client, trusted) {
+			break
+		}
+	}
+
+	return client
+}
+
+// scheme is how the visitor reached traefik, as a trusted proxy says in
+// X-Forwarded-Proto, or otherwise http, the only scheme rproxy serves.
+func scheme(r *http.Request, peerTrusted bool) string {
+	proto := r.Header.Get("X-Forwarded-Proto")
+	if !peerTrusted || proto == "" {
+		return "http"
+	}
+
+	return proto
+}
+
+// isInside reports whether addr is in one of the netblocks.
+func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
+	return slices.ContainsFunc(netblocks, func(netblock netip.Prefix) bool {
+		return netblock.Contains(addr)
+	})
+}
+
+// setForwardedHeaders sets the headers in which the app learns about the
+// visitor, so that it sees what it would see from traefik directly. A trusted
+// proxy's forwarded headers pass on, with the proxy's own address added to
+// X-Forwarded-For. Those of any other peer are its own claims and are replaced:
+// X-Forwarded-For names the peer, X-Forwarded-Host the host it asked for, and
+// X-Forwarded-Proto plain http, which is how it reached rproxy.
+func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
+	forwardedFor := peer.String()
+
+	if trusted {
+		// ReverseProxy removes these from out before Rewrite.
+		for _, name := range []string{"Forwarded", "X-Forwarded-Host", "X-Forwarded-Proto"} {
+			values, ok := in.Header[name]
+			if ok {
+				out.Header[name] = values
+			}
+		}
+
+		prior := in.Header.Values("X-Forwarded-For")
+		if len(prior) > 0 {
+			forwardedFor = strings.Join(prior, ", ") + ", " + forwardedFor
+		}
+
+		out.Header.Set("X-Forwarded-For", forwardedFor)
+
+		return
+	}
+
+	// ReverseProxy has removed Forwarded and the three set below; these are the
+	// other headers in which traefik tells the app about the visitor and its
+	// request.
+	for _, name := range []string{
+		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
+		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
+		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
+	} {
+		out.Header.Del(name)
+	}
+
+	out.Header.Set("X-Forwarded-For", forwardedFor)
+	out.Header.Set("X-Forwarded-Host", in.Host)
+	out.Header.Set("X-Forwarded-Proto", "http")
+}

internal/rproxy/limits_test.go

@@ -0,0 +1,811 @@
+package rproxy_test
+
+import (
+	"bytes"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+)
+
+// post is the start of a POST whose headers end with what follows it.
+const post = "POST / HTTP/1.1\r\nHost: site.example\r\n"
+
+// announcedLength is the header that announces a body of size bytes, and the
+// end of the headers.
+func announcedLength(size int) string {
+	return "Content-Length: " + strconv.Itoa(size) + "\r\n\r\n"
+}
+
+func TestServerHasTheFixedLimits(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := config.RProxyFromEnvironment(func(name string) (string, bool) {
+		if name == "SWRP_WAF_BACKEND" {
+			return nowhere, true
+		}
+
+		return "", false
+	})
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+
+	server := rproxy.New(rproxy.Params{
+		Config:     cfg,
+		RequestLog: io.Discard,
+		ProcessLog: requestlog.NewProcessLogger(io.Discard, "test", slog.LevelInfo),
+	})
+
+	if server.Addr != ":8080" || server.MaxHeaderBytes != 28<<10 ||
+		server.IdleTimeout != 2*time.Minute || server.ReadHeaderTimeout != time.Minute {
+		t.Errorf("server listens on %q with header limit %d, idle time %s and "+
+			"header timeout %s", server.Addr, server.MaxHeaderBytes,
+			server.IdleTimeout, server.ReadHeaderTimeout)
+	}
+}
+
+func TestABodyAnnouncedOverItsLimitIsRefusedOnceServeWAFAllowsIt(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, limit string
+		size, asked int
+	}{
+		{"with the limit within the first part", "1K", 1025, 1024},
+		{"with the limit past the first part", "128K", 129 << 10, questionBodyMaxBytes},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {
+				t.Error("the app was asked")
+			})
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+				maxRequestSize: tc.limit,
+			})
+
+			got := visit(t, newRequest(t, http.MethodPost, addr, "/",
+				bytes.NewReader(make([]byte, tc.size))))
+			if got.status != http.StatusRequestEntityTooLarge {
+				t.Errorf("answered %+v, want 413", got)
+			}
+
+			if asked := servewaf.question(t); len(asked.body) != tc.asked {
+				t.Errorf("the question carries %d bytes, want %d", len(asked.body), tc.asked)
+			}
+
+			report := servewaf.report(t)
+			if report.Status != http.StatusRequestEntityTooLarge {
+				t.Errorf("report %+v, want status 413", report)
+			}
+		})
+	}
+}
+
+func TestADenyOutranksTheBodySizeLimit(t *testing.T) {
+	t.Parallel()
+
+	servewaf := startServeWAF(t, deny)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxRequestSize: "1K",
+	})
+
+	got := visit(t, newRequest(t, http.MethodPost, addr, "/",
+		bytes.NewReader(make([]byte, 1025))))
+	if got.status != http.StatusForbidden {
+		t.Errorf("answered %+v, want servewaf's 403", got)
+	}
+}
+
+func TestABodyNotAnnouncedOverItsLimitIsRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, limit string
+		size        int
+		// mayReachApp is true when the part of the body the limit lets through
+		// goes on to the app before the limit is met. The app may still not have
+		// started on the request when it is cut off.
+		mayReachApp bool
+	}{
+		{"within the first part", "1K", 2 << 10, false},
+		{"past the first part", "128K", 129 << 10, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var asked atomic.Bool
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+				asked.Store(true)
+				greet(w, r)
+			})
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+				maxRequestSize: tc.limit,
+			})
+
+			conn := dial(t, addr)
+			send(t, conn, post+"Transfer-Encoding: chunked\r\n\r\n"+
+				strconv.FormatInt(int64(tc.size), 16)+"\r\n"+strings.Repeat("x", tc.size)+
+				"\r\n0\r\n\r\n")
+
+			if status := readStatus(t, conn); status != http.StatusRequestEntityTooLarge {
+				t.Errorf("status %d, want 413", status)
+			}
+
+			if asked.Load() && !tc.mayReachApp {
+				t.Error("the app was asked")
+			}
+		})
+	}
+}
+
+func TestAResponseOverItsLimit(t *testing.T) {
+	t.Parallel()
+
+	large := strings.Repeat("x", 2<<10)
+
+	t.Run("announced, is refused", func(t *testing.T) {
+		t.Parallel()
+
+		servewaf := startServeWAF(t, allow)
+		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set(contentLengthHeader, strconv.Itoa(len(large)))
+			_, _ = io.WriteString(w, large)
+		})
+		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+			maxResponseSize: "1K",
+		})
+
+		got := get(t, addr, "/")
+		if got.status != http.StatusBadGateway {
+			t.Errorf("answered %d, want 502", got.status)
+		}
+
+		if report := servewaf.report(t); report.Status != http.StatusBadGateway {
+			t.Errorf("report %+v, want status 502", report)
+		}
+	})
+
+	t.Run("not announced, is cut off", func(t *testing.T) {
+		t.Parallel()
+
+		servewaf := startServeWAF(t, allow)
+		app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+			_, _ = io.WriteString(w, large[:1])
+			_ = http.NewResponseController(w).Flush()
+			_, _ = io.WriteString(w, large[1:])
+		})
+		addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+			maxResponseSize: "1K",
+		})
+
+		conn := dial(t, addr)
+		send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+		text, err := io.ReadAll(conn)
+		if err != nil || bytes.Contains(text, []byte(large)) {
+			t.Errorf("read %d bytes (%v), want the answer cut off", len(text), err)
+		}
+
+		report := servewaf.report(t)
+		if report.Status != http.StatusOK || report.ResponseBytes > 1<<10 {
+			t.Errorf("report %+v, want status 200 and at most 1K of the answer", report)
+		}
+	})
+}
+
+func TestAHeadWhoseAnswerAnnouncesMoreThanTheResponseLimitIsPassedOn(t *testing.T) {
+	t.Parallel()
+
+	const announced = "2048"
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set(contentLengthHeader, announced)
+	})
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxResponseSize: "1K",
+	})
+
+	got := visit(t, newRequest(t, http.MethodHead, addr, "/", http.NoBody))
+	if got.status != http.StatusOK || got.header.Get(contentLengthHeader) != announced {
+		t.Errorf("answered %+v, want the app's 200 announcing %s bytes", got, announced)
+	}
+}
+
+func TestASettingOfOffSetsNoLimit(t *testing.T) {
+	t.Parallel()
+
+	for _, setting := range []string{
+		maxRequestSize, maxResponseSize, maxRequestTime, maxResponseTime,
+	} {
+		t.Run(setting, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+				setting: "off",
+			})
+
+			// A body and an answer that a limit of zero would cut off, as it would the
+			// next answer, which rproxy gives itself.
+			wantGreeting(t, visit(t, newRequest(t, http.MethodPost, addr, "/",
+				strings.NewReader("a body"))))
+
+			if got := get(t, addr, proxy.HealthPath); got.status != http.StatusOK {
+				t.Errorf("answered %+v, want rproxy's own 200", got)
+			}
+		})
+	}
+}
+
+func TestAVisitorTooSlowToSendTheFirstPartIsAnswered408(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, rest string
+	}{
+		{"with its length announced", announcedLength(100) + "some of it"},
+		{"with no length announced", "Transfer-Encoding: chunked\r\n\r\na\r\nsome of it\r\n"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+				maxRequestTime: "500",
+			})
+
+			conn := dial(t, addr)
+			send(t, conn, post+tc.rest)
+
+			if status := readStatus(t, conn); status != http.StatusRequestTimeout {
+				t.Errorf("status %d, want 408", status)
+			}
+
+			line := out.requestLine(t)
+			if line["disposition"] != nil || line["request_bytes"] != 10.0 {
+				t.Errorf("line %v, want no disposition and 10 bytes", line)
+			}
+
+			if len(servewaf.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+
+			servewaf.wantNoReport(t)
+		})
+	}
+}
+
+func TestAVisitorThatGoesAwayBeforeTheFirstPartIsNotAsked(t *testing.T) {
+	t.Parallel()
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
+
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(100)+"some of it")
+	_ = conn.Close()
+
+	line := out.requestLine(t)
+	if line["status"] != 0.0 || line["disposition"] != nil {
+		t.Errorf("line %v, want no answer and no disposition", line)
+	}
+
+	if len(servewaf.questions) != 0 {
+		t.Error("servewaf was asked")
+	}
+}
+
+func TestABodyThatCannotBeReadClosesTheConnectionWithoutAnAnswer(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, request string
+		stopsSending  bool
+	}{
+		{
+			"a malformed chunk", post + "Transfer-Encoding: chunked\r\n\r\nnot a chunk\r\n",
+			false,
+		},
+		{"a visitor that stops sending", post + announcedLength(100) + "some of it", true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
+
+			conn := dial(t, addr)
+			send(t, conn, tc.request)
+
+			if tc.stopsSending {
+				tcpConn, ok := conn.(*net.TCPConn)
+				if !ok {
+					t.Fatalf("the connection is a %T", conn)
+				}
+
+				err := tcpConn.CloseWrite()
+				if err != nil {
+					t.Fatalf("stop sending: %v", err)
+				}
+			}
+
+			text, err := io.ReadAll(conn)
+			if err != nil || len(text) != 0 {
+				t.Errorf("read %q (%v), want the connection closed without an answer",
+					text, err)
+			}
+
+			line := out.requestLine(t)
+			if line["status"] != 0.0 || line["disposition"] != nil {
+				t.Errorf("line %v, want no answer and no disposition", line)
+			}
+
+			if len(servewaf.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+		})
+	}
+}
+
+// deadlineRecorder notes the time limits rproxy sets on reading the visitor's body
+// and on sending its answer.
+type deadlineRecorder struct {
+	*httptest.ResponseRecorder
+
+	readDeadline  time.Time
+	writeDeadline time.Time
+}
+
+// SetReadDeadline notes deadline.
+func (w *deadlineRecorder) SetReadDeadline(deadline time.Time) error {
+	w.readDeadline = deadline
+
+	return nil
+}
+
+// SetWriteDeadline notes deadline.
+func (w *deadlineRecorder) SetWriteDeadline(deadline time.Time) error {
+	w.writeDeadline = deadline
+
+	return nil
+}
+
+func TestABodyLeftUnreadIsReadOnlyUntilTheRequestTimeLimit(t *testing.T) {
+	t.Parallel()
+
+	const (
+		limit = 5 * time.Minute
+		// announced is over what Go's server reads of a body left unread, so that
+		// the app's own server answers without waiting for the rest.
+		announced = 100 * questionBodyMaxBytes
+	)
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	})
+	_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
+		maxRequestTime: strconv.FormatInt(limit.Milliseconds(), 10),
+	})
+
+	// The visitor sends the first part and a little more, and then nothing.
+	stalled, stop := io.Pipe()
+
+	t.Cleanup(func() { _ = stop.Close() })
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/",
+		io.MultiReader(bytes.NewReader(make([]byte, questionBodyMaxBytes+1)), stalled))
+	req.ContentLength = announced
+	req.Header.Set(contentLengthHeader, strconv.Itoa(announced))
+
+	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
+
+	before := time.Now()
+
+	server.Handler.ServeHTTP(w, req)
+
+	if w.Code != http.StatusNoContent {
+		t.Errorf("status %d, want the app's 204", w.Code)
+	}
+
+	if w.readDeadline.Before(before.Add(limit)) ||
+		w.readDeadline.After(time.Now().Add(limit)) {
+		t.Errorf("the reading of the body ends at %s, want %s from the request",
+			w.readDeadline, limit)
+	}
+}
+
+func TestAnAnswerRProxyGivesItselfHasTheResponseTimeToBeSent(t *testing.T) {
+	t.Parallel()
+
+	const limit = 5 * time.Minute
+
+	for _, tc := range []struct {
+		name, target string
+		status       int
+	}{
+		{"servewaf's deny", "/", http.StatusForbidden},
+		{"rproxy's own 400", "x:admin", http.StatusBadRequest},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, deny)
+			app := startApp(t, greet)
+			_, _, server := startServer(t, servewaf.URL, app.URL, map[string]string{
+				maxResponseTime: strconv.FormatInt(limit.Milliseconds(), 10),
+			})
+
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, tc.target,
+				http.NoBody)
+			w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
+
+			before := time.Now()
+
+			server.Handler.ServeHTTP(w, req)
+
+			if w.Code != tc.status {
+				t.Errorf("status %d, want %d", w.Code, tc.status)
+			}
+
+			if w.writeDeadline.Before(before.Add(limit)) ||
+				w.writeDeadline.After(time.Now().Add(limit)) {
+				t.Errorf("the time limit on sending ends at %s, want %s from the answer",
+					w.writeDeadline, limit)
+			}
+		})
+	}
+}
+
+func TestAVisitorTooSlowToSendTheRestIsAnswered408(t *testing.T) {
+	t.Parallel()
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxRequestTime: "3000",
+	})
+
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(2*questionBodyMaxBytes)+
+		strings.Repeat("x", questionBodyMaxBytes+1))
+
+	if status := readStatus(t, conn); status != http.StatusRequestTimeout {
+		t.Errorf("status %d, want 408", status)
+	}
+
+	if asked := servewaf.question(t); len(asked.body) != questionBodyMaxBytes {
+		t.Errorf("the question carries %d bytes", len(asked.body))
+	}
+
+	if report := servewaf.report(t); report.Status != http.StatusRequestTimeout {
+		t.Errorf("report %+v, want status 408", report)
+	}
+}
+
+// startAppThatTakesNothing starts an app that accepts connections and never
+// reads from them, and returns its URL.
+func startAppThatTakesNothing(t *testing.T) string {
+	t.Helper()
+
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	stopped := make(chan struct{})
+
+	t.Cleanup(func() {
+		close(stopped)
+
+		_ = listener.Close()
+	})
+
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+
+			go func() {
+				<-stopped
+
+				_ = conn.Close()
+			}()
+		}
+	}()
+
+	return "http://" + listener.Addr().String()
+}
+
+func TestAnAppTooSlowToTakeTheRequestIsAnswered504(t *testing.T) {
+	t.Parallel()
+
+	// More than the connections hold while nobody reads, written a little at a
+	// time, so that rproxy soon waits for the app.
+	const (
+		bodySize  = 64 << 20
+		writeSize = 32 << 10
+	)
+
+	servewaf := startServeWAF(t, allow)
+	addr, _ := startRProxy(t, servewaf.URL, startAppThatTakesNothing(t),
+		map[string]string{maxRequestTime: "3000"})
+
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(bodySize))
+
+	go func() {
+		part := make([]byte, writeSize)
+
+		for range bodySize / writeSize {
+			_, err := conn.Write(part)
+			if err != nil {
+				return
+			}
+		}
+	}()
+
+	if status := readStatus(t, conn); status != http.StatusGatewayTimeout {
+		t.Errorf("status %d, want 504", status)
+	}
+}
+
+func TestAnAppTooSlowToAnswerIsAnswered504(t *testing.T) {
+	t.Parallel()
+
+	release := make(chan struct{})
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		<-release
+	})
+
+	t.Cleanup(func() { close(release) })
+
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxResponseTime: "300",
+	})
+
+	got := get(t, addr, "/")
+	if got.status != http.StatusGatewayTimeout {
+		t.Errorf("answered %d, want 504", got.status)
+	}
+
+	if report := servewaf.report(t); report.Status != http.StatusGatewayTimeout {
+		t.Errorf("report %+v, want status 504", report)
+	}
+}
+
+func TestAnAppTooSlowToFinishItsAnswerIsCutOff(t *testing.T) {
+	t.Parallel()
+
+	release := make(chan struct{})
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, "the start")
+		_ = http.NewResponseController(w).Flush()
+
+		<-release
+	})
+
+	t.Cleanup(func() { close(release) })
+
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxResponseTime: "300",
+	})
+
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+	// dial's deadline ends this read with an error if the connection stays open.
+	_, err := io.ReadAll(conn)
+	if err != nil {
+		t.Errorf("read: %v, want the connection closed", err)
+	}
+
+	if report := servewaf.report(t); report.Status != http.StatusOK {
+		t.Errorf("report %+v, want the status the visitor got", report)
+	}
+}
+
+func TestAVisitorTooSlowToTakeTheAnswerIsCutOff(t *testing.T) {
+	t.Parallel()
+
+	// More than the connections hold while nobody reads.
+	const (
+		bodySize  = 64 << 20
+		writeSize = 32 << 10
+	)
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		part := make([]byte, writeSize)
+
+		for range bodySize / writeSize {
+			_, err := w.Write(part)
+			if err != nil {
+				return
+			}
+		}
+	})
+	addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxResponseTime: "500",
+	})
+
+	// The visitor asks, and never reads the answer.
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+	line := out.requestLine(t)
+
+	responseBytes, _ := line["response_bytes"].(float64)
+	if line["status"] != float64(http.StatusOK) || responseBytes >= bodySize {
+		t.Errorf("line %v, want status 200 and the answer cut off", line)
+	}
+
+	report := servewaf.report(t)
+	if report.Status != http.StatusOK || report.ResponseBytes >= bodySize {
+		t.Errorf("report %+v, want status 200 and the answer cut off", report)
+	}
+}
+
+func TestAnAppThatCannotBeReachedIsAnswered502WithAReport(t *testing.T) {
+	t.Parallel()
+
+	servewaf := startServeWAF(t, allow)
+	addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
+
+	got := get(t, addr, "/")
+	if got.status != http.StatusBadGateway {
+		t.Errorf("answered %d, want 502", got.status)
+	}
+
+	if report := servewaf.report(t); report.Status != http.StatusBadGateway {
+		t.Errorf("report %+v, want status 502", report)
+	}
+}
+
+func TestAVisitorThatStopsSendingAfterTheAppHasAnsweredGetsTheAnswer(t *testing.T) {
+	t.Parallel()
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, greeting)
+	})
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxRequestTime: "3000",
+	})
+
+	// Far more announced than sent, so that Go's server answers for the app
+	// without waiting for the rest.
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(100*questionBodyMaxBytes)+
+		strings.Repeat("x", questionBodyMaxBytes))
+
+	if status := readStatus(t, conn); status != http.StatusOK {
+		t.Errorf("status %d, want the app's 200", status)
+	}
+}
+
+func TestAVisitorThatStopsSendingWhileTheAppWorksGetsNoAnswer(t *testing.T) {
+	t.Parallel()
+
+	working := make(chan struct{})
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
+		close(working)
+		<-r.Context().Done()
+	})
+	addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
+
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+	select {
+	case <-working:
+	case <-time.After(waitLimit):
+		t.Fatal("the app was not asked")
+	}
+
+	tcpConn, ok := conn.(*net.TCPConn)
+	if !ok {
+		t.Fatalf("the connection is a %T", conn)
+	}
+
+	err := tcpConn.CloseWrite()
+	if err != nil {
+		t.Fatalf("stop sending: %v", err)
+	}
+
+	text, err := io.ReadAll(conn)
+	if err != nil || len(text) != 0 {
+		t.Errorf("read %q (%v), want the connection closed without an answer", text, err)
+	}
+
+	if line := out.requestLine(t); line["status"] != 0.0 {
+		t.Errorf("line %v, want status 0", line)
+	}
+}
+
+func TestTheRequestTimeLimitDoesNotCutAnAnswerOnceTheAppHasTheRequest(t *testing.T) {
+	t.Parallel()
+
+	const answer = "the end of a long answer"
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		_ = http.NewResponseController(w).Flush()
+
+		time.Sleep(2100 * time.Millisecond)
+
+		_, _ = io.WriteString(w, answer)
+	})
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		maxRequestTime: "2000",
+	})
+
+	got := visit(t, newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body")))
+	if got.status != http.StatusOK || got.body != answer {
+		t.Errorf("answered %d %q, want the app's whole answer", got.status, got.body)
+	}
+}
+
+func TestAVisitorThatStopsSendingGetsAnAnswerRProxyGivesByTheDeadline(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, start string
+		status      int
+	}{
+		{"a deny", post, http.StatusForbidden},
+		{
+			"the health check",
+			"GET " + proxy.HealthPath + " HTTP/1.1\r\nHost: site.example\r\n",
+			http.StatusOK,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, deny)
+			app := startApp(t, greet)
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+				maxRequestTime: "500",
+			})
+
+			// Go's server waits for a little of the body left before it sends an answer,
+			// and the time for sending the request ends that wait.
+			conn := dial(t, addr)
+			send(t, conn, tc.start+announcedLength(questionBodyMaxBytes+100)+
+				strings.Repeat("x", questionBodyMaxBytes))
+
+			if status := readStatus(t, conn); status != tc.status {
+				t.Errorf("status %d, want %d", status, tc.status)
+			}
+		})
+	}
+}

internal/rproxy/question_test.go

@@ -0,0 +1,523 @@
+package rproxy_test
+
+import (
+	"bytes"
+	"crypto/rand"
+	"io"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+)
+
+// questionBodyMaxBytes is the most of a body a question carries.
+const questionBodyMaxBytes = proxy.QuestionBodyMaxBytes
+
+// chunked is the encoding of a body whose length the visitor did not announce.
+const chunked = "chunked"
+
+// pathGoReencodes is a path Go's client would decode and escape again, %2F turned
+// into / and | into %7C, unless told to send it as it is. A test sets it as the
+// visitor's URL.Opaque, so that the visitor sends it unchanged too.
+const pathGoReencodes = "/some%2Fpath/with%20space|pipe"
+
+func TestQuestionIsTheVisitorsRequestWithRProxysHeaders(t *testing.T) {
+	t.Parallel()
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
+
+	const target = pathGoReencodes + "?b=2&a=1&bad=%zz;x"
+
+	req := newRequest(t, http.MethodDelete, addr, target, http.NoBody)
+	req.URL.Opaque = pathGoReencodes
+	req.Host = site
+	req.Header.Set("X-Test", "from the visitor")
+	req.Header.Set(forwardedForHeader, "198.51.100.1")
+	req.Header.Set(forwardedProtoHeader, "gopher")
+	req.Header.Set(requestIDHeader, "the-visitor's")
+	req.Header.Set(proxy.ClientHeader, "198.51.100.2")
+	req.Header.Set(proxy.PeerHeader, "198.51.100.3")
+	req.Header.Set(proxy.ContentLengthHeader, "12345")
+	// Go's client then sends no User-Agent, so that one in the question would be
+	// Go's own.
+	req.Header["User-Agent"] = nil
+
+	wantGreeting(t, visit(t, req))
+
+	asked := servewaf.question(t)
+	if asked.method != http.MethodDelete || asked.target != target ||
+		asked.host != site {
+		t.Errorf("asked about %s %s at %s", asked.method, asked.target, asked.host)
+	}
+
+	if asked.header.Get(requestIDHeader) == "the-visitor's" {
+		t.Error("the question carries the visitor's id")
+	}
+
+	// Exactly these: visit's connection has the visitor send Connection: close.
+	want := http.Header{}
+	want.Set("Connection", "close")
+	want.Set("X-Test", "from the visitor")
+	want.Set(forwardedForHeader, "198.51.100.1")
+	want.Set(forwardedProtoHeader, "http")
+	want.Set(requestIDHeader, asked.header.Get(requestIDHeader))
+	want.Set(proxy.ClientHeader, localhost)
+	want.Set(proxy.PeerHeader, localhost)
+
+	if !maps.EqualFunc(asked.header, want, slices.Equal) {
+		t.Errorf("the question's headers are %v, want %v", asked.header, want)
+	}
+}
+
+func TestQuestionNamesTheVisitorATrustedProxySpeaksFor(t *testing.T) {
+	t.Parallel()
+
+	const visitor = "203.0.113.9"
+
+	for _, tc := range []struct {
+		name, trusted, client, proto, forwarded string
+	}{
+		{
+			"from a trusted proxy", localhost + "/32", visitor, "https",
+			visitor + ", " + localhost,
+		},
+		{"from a peer not trusted", "10.0.0.0/8", localhost, "http", localhost},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			forwarded := make(chan http.Header, 1)
+			app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+				forwarded <- r.Header.Clone()
+
+				greet(w, r)
+			})
+			addr, out := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+				trustedProxies: tc.trusted,
+			})
+
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header.Set(forwardedForHeader, visitor)
+			req.Header.Set(forwardedProtoHeader, "https")
+			wantGreeting(t, visit(t, req))
+
+			asked := servewaf.question(t)
+			if asked.header.Get(proxy.ClientHeader) != tc.client ||
+				asked.header.Get(proxy.PeerHeader) != localhost ||
+				asked.header.Get(forwardedForHeader) != visitor ||
+				asked.header.Get(forwardedProtoHeader) != tc.proto {
+				t.Errorf("the question's headers are %v", asked.header)
+			}
+
+			if line := out.requestLine(t); line["client_ip"] != tc.client {
+				t.Errorf("line %v, want client_ip %s", line, tc.client)
+			}
+
+			if got := (<-forwarded).Get(forwardedForHeader); got != tc.forwarded {
+				t.Errorf("the app saw %s %q, want %q", forwardedForHeader, got, tc.forwarded)
+			}
+		})
+	}
+}
+
+func TestQuestionNamesTheClientAsTheForwardedAddressesSay(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name   string
+		header []string
+		client string
+	}{
+		{
+			"the first address outside the trusted proxies, from the right",
+			[]string{"198.51.100.7, 203.0.113.9, 10.0.0.2"}, "203.0.113.9",
+		},
+		{
+			"the leftmost, when every address is a trusted proxy",
+			[]string{"10.0.0.5, 10.0.0.2"}, "10.0.0.5",
+		},
+		{"the peer, with no header", nil, localhost},
+		{
+			"the last address read, before an entry that is not an address",
+			[]string{"203.0.113.9, unknown, 10.0.0.2"}, "10.0.0.2",
+		},
+		{
+			"read as one list, with several header lines",
+			[]string{"2001:db8::7", "10.0.0.2"}, "2001:db8::7",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+				trustedProxies: localhost + "/32,10.0.0.0/8",
+			})
+
+			req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+			req.Header[forwardedForHeader] = tc.header
+			wantGreeting(t, visit(t, req))
+
+			if got := servewaf.question(t).header.Get(proxy.ClientHeader); got != tc.client {
+				t.Errorf("the question names %s, want %s", got, tc.client)
+			}
+		})
+	}
+}
+
+// randomBytes returns n random bytes.
+func randomBytes(n int) []byte {
+	body := make([]byte, n)
+	_, _ = rand.Read(body) // it never returns an error
+
+	return body
+}
+
+func TestFirst64KiBReachServeWAFAndTheWholeBodyTheApp(t *testing.T) {
+	t.Parallel()
+
+	for _, size := range []int{
+		1, questionBodyMaxBytes - 1, questionBodyMaxBytes, questionBodyMaxBytes + 1,
+		5 * questionBodyMaxBytes,
+	} {
+		for _, announced := range []bool{true, false} {
+			name := strconv.Itoa(size) + " bytes, length announced: " +
+				strconv.FormatBool(announced)
+
+			t.Run(name, func(t *testing.T) {
+				t.Parallel()
+
+				body := randomBytes(size)
+				servewaf := startServeWAF(t, allow)
+				received := make(chan []byte, 1)
+				app := startApp(t, func(w http.ResponseWriter, r *http.Request) {
+					whole, _ := io.ReadAll(r.Body)
+					received <- whole
+
+					greet(w, r)
+				})
+				addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
+
+				req := newRequest(t, http.MethodPost, addr, "/", bytes.NewReader(body))
+				if !announced {
+					// Go's client sends a body of unknown length in chunks.
+					req.ContentLength = -1
+				}
+
+				wantGreeting(t, visit(t, req))
+
+				asked := servewaf.question(t)
+				want := body[:min(size, questionBodyMaxBytes)]
+				wantQuestionBody(t, asked, want, size, announced)
+
+				if !bytes.Equal(<-received, body) {
+					t.Error("the app did not get the whole body")
+				}
+
+				if report := servewaf.report(t); report.RequestBytes != int64(size) {
+					t.Errorf("report %+v, of %d bytes", report, size)
+				}
+			})
+		}
+	}
+}
+
+// wantQuestionBody checks the body a question carries, want, and how it gives
+// the length of the visitor's body, of size bytes.
+func wantQuestionBody(
+	t *testing.T, asked question, want []byte, size int, announced bool,
+) {
+	t.Helper()
+
+	if !bytes.Equal(asked.body, want) {
+		t.Errorf("the question carries %d bytes, want the first %d", len(asked.body),
+			len(want))
+	}
+
+	values := asked.header.Values(proxy.ContentLengthHeader)
+
+	if announced {
+		if !slices.Equal(values, []string{strconv.Itoa(size)}) ||
+			asked.contentLength != int64(len(want)) {
+			t.Errorf("announced %v and length %d, want %d and %d", values,
+				asked.contentLength, size, len(want))
+		}
+
+		return
+	}
+
+	if len(values) != 0 || !slices.Equal(asked.transferEncoding, []string{chunked}) {
+		t.Errorf("announced %v and encoded %v, want none and chunked", values,
+			asked.transferEncoding)
+	}
+}
+
+func TestDenyNeedsOnlyTheFirstPartOfALargeBody(t *testing.T) {
+	t.Parallel()
+
+	servewaf := startServeWAF(t, deny)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
+
+	// Far more announced than sent. Go's server does not wait for that much, so
+	// the answer comes at once.
+	conn := dial(t, addr)
+	send(t, conn, post+announcedLength(100*questionBodyMaxBytes)+
+		strings.Repeat("x", questionBodyMaxBytes))
+
+	if status := readStatus(t, conn); status != http.StatusForbidden {
+		t.Errorf("status %d, want servewaf's 403", status)
+	}
+
+	if report := servewaf.report(t); report.RequestBytes != questionBodyMaxBytes {
+		t.Errorf("report %+v, want the first part's bytes", report)
+	}
+}
+
+func TestAQuestionCarriesItsBodyWhateverTheMethod(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, framing, body string
+		encoding            []string
+	}{
+		{
+			chunked, "Transfer-Encoding: chunked\r\n\r\n4\r\nbody\r\n0\r\n\r\n", "body",
+			[]string{chunked},
+		},
+		{
+			"chunked and empty", "Transfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "",
+			[]string{chunked},
+		},
+		{"with its length", announcedLength(4) + "body", "body", nil},
+	} {
+		for _, method := range []string{
+			http.MethodGet, http.MethodDelete, http.MethodPost,
+		} {
+			t.Run(method+" "+tc.name, func(t *testing.T) {
+				t.Parallel()
+
+				servewaf := startServeWAF(t, deny)
+				addr, _ := startRProxy(t, servewaf.URL, nowhere, nil)
+
+				conn := dial(t, addr)
+				send(t, conn, method+" /x HTTP/1.1\r\nHost: site.example\r\n"+tc.framing)
+
+				if status := readStatus(t, conn); status != http.StatusForbidden {
+					t.Errorf("status %d, want servewaf's 403", status)
+				}
+
+				asked := servewaf.question(t)
+				if string(asked.body) != tc.body ||
+					!slices.Equal(asked.transferEncoding, tc.encoding) {
+					t.Errorf("the question carries %q, encoded %v, want %q, encoded %v",
+						asked.body, asked.transferEncoding, tc.body, tc.encoding)
+				}
+			})
+		}
+	}
+}
+
+func TestAMethodNotPassedOnIsAnswered405(t *testing.T) {
+	t.Parallel()
+
+	for _, method := range []string{http.MethodTrace, "PROPFIND", "LOCK", "BREW"} {
+		t.Run(method, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, func(http.ResponseWriter, *http.Request) {
+				t.Error("the app was asked")
+			})
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
+
+			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
+			if got.status != http.StatusMethodNotAllowed ||
+				got.header.Get("Allow") != "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY" {
+				t.Errorf("answered %+v, want 405 naming the methods passed on", got)
+			}
+
+			line := out.requestLine(t)
+			if line["status"] != float64(http.StatusMethodNotAllowed) ||
+				line["disposition"] != nil || line["default_disposition"] != nil {
+				t.Errorf("line %v, want status 405 and no disposition", line)
+			}
+
+			if len(servewaf.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+
+			servewaf.wantNoReport(t)
+		})
+	}
+}
+
+func TestEachMethodPassedOnReachesServeWAFAndTheApp(t *testing.T) {
+	t.Parallel()
+
+	for _, method := range []string{
+		http.MethodGet, http.MethodHead, http.MethodPost, http.MethodOptions,
+		http.MethodPut, http.MethodDelete, http.MethodPatch, "QUERY",
+	} {
+		t.Run(method, func(t *testing.T) {
+			t.Parallel()
+
+			reached := make(chan string, 1)
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, func(_ http.ResponseWriter, r *http.Request) {
+				reached <- r.Method
+			})
+			addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
+
+			got := visit(t, newRequest(t, method, addr, "/", http.NoBody))
+			if got.status != http.StatusOK {
+				t.Errorf("answered %+v, want the app's 200", got)
+			}
+
+			if asked := servewaf.question(t); asked.method != method {
+				t.Errorf("servewaf was asked about %s", asked.method)
+			}
+
+			if atApp := <-reached; atApp != method {
+				t.Errorf("the app was asked %s", atApp)
+			}
+		})
+	}
+}
+
+func TestARequestThatCannotGoToServeWAFAsSentIsRefused(t *testing.T) {
+	t.Parallel()
+
+	const host = "Host: site.example\r\n\r\n"
+
+	for name, request := range map[string]string{
+		"a target of a scheme":    "GET x:admin HTTP/1.1\r\n" + host,
+		"a target of a URL":       "GET http://site.example/ HTTP/1.1\r\n" + host,
+		"a host Go will not send": "GET http://a<b/ HTTP/1.1\r\n" + host,
+		"a target of a host":      "GET site.example:443 HTTP/1.1\r\n" + host,
+		"a target of *":           "GET * HTTP/1.1\r\n" + host,
+		"a target of //":          "GET //x/y HTTP/1.1\r\n" + host,
+		"a target of // escaped":  "GET //x%2Fadmin| HTTP/1.1\r\n" + host,
+		"an empty Host":           "GET / HTTP/1.1\r\nHost:\r\n\r\n",
+		"HTTP/1.0 with no Host":   "GET / HTTP/1.0\r\n\r\n",
+		"a Host with a zone":      "GET / HTTP/1.1\r\nHost: [fe80::1%25eth0]:80\r\n\r\n",
+		"two User-Agents": "GET / HTTP/1.1\r\nUser-Agent: a\r\nUser-Agent: b\r\n" +
+			host,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, allow)
+			app := startApp(t, greet)
+			addr, out := startRProxy(t, servewaf.URL, app.URL, nil)
+
+			conn := dial(t, addr)
+			send(t, conn, request)
+
+			if status := readStatus(t, conn); status != http.StatusBadRequest {
+				t.Errorf("status %d, want 400", status)
+			}
+
+			line := out.requestLine(t)
+			if line["status"] != float64(http.StatusBadRequest) ||
+				line["disposition"] != nil || line["default_disposition"] != nil {
+				t.Errorf("line %v, want status 400 and no disposition", line)
+			}
+
+			if len(servewaf.questions) != 0 {
+				t.Error("servewaf was asked")
+			}
+
+			servewaf.wantNoReport(t)
+		})
+	}
+}
+
+func TestAHostWithAPercentSignButNoBracketGoesToServeWAF(t *testing.T) {
+	t.Parallel()
+
+	const host = "a%b"
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, nil)
+
+	conn := dial(t, addr)
+	send(t, conn, "GET / HTTP/1.1\r\nHost: "+host+"\r\n\r\n")
+
+	if status := readStatus(t, conn); status != http.StatusOK {
+		t.Errorf("status %d, want the app's 200", status)
+	}
+
+	if asked := servewaf.question(t); asked.host != host {
+		t.Errorf("asked about the host %q, want %q", asked.host, host)
+	}
+}
+
+func TestATrustedPeerWithNoForwardedProtoIsAskedAboutAsHTTP(t *testing.T) {
+	t.Parallel()
+
+	const want = "http"
+
+	servewaf := startServeWAF(t, allow)
+	app := startApp(t, greet)
+	addr, _ := startRProxy(t, servewaf.URL, app.URL, map[string]string{
+		trustedProxies: localhost + "/32",
+	})
+
+	wantGreeting(t, get(t, addr, "/"))
+
+	asked := servewaf.question(t)
+	if got := asked.header.Get(forwardedProtoHeader); got != want {
+		t.Errorf("the question's %s is %q, want %s", forwardedProtoHeader, got, want)
+	}
+}
+
+func TestAQuestionNamesNoZone(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, remoteAddr, forwardedFor, client, peer string
+	}{
+		{"from a link-local peer", "[fe80::1%eth0]:1234", "", "fe80::1", "fe80::1"},
+		{
+			"from X-Forwarded-For through a trusted peer", localhost + ":1234",
+			"2001:db8::1%eth0", "2001:db8::1", localhost,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			servewaf := startServeWAF(t, deny)
+			app := startApp(t, greet)
+			_, out, server := startServer(t, servewaf.URL, app.URL, map[string]string{
+				trustedProxies: localhost + "/32",
+			})
+
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+			req.RemoteAddr = tc.remoteAddr
+			req.Header.Set(forwardedForHeader, tc.forwardedFor)
+
+			server.Handler.ServeHTTP(httptest.NewRecorder(), req)
+
+			asked := servewaf.question(t)
+			if asked.header.Get(proxy.ClientHeader) != tc.client ||
+				asked.header.Get(proxy.PeerHeader) != tc.peer {
+				t.Errorf("the question's headers are %v", asked.header)
+			}
+
+			if line := out.requestLine(t); line["client_ip"] != tc.client {
+				t.Errorf("line %v, want client_ip %s", line, tc.client)
+			}
+		})
+	}
+}

internal/rproxy/request.go

@@ -0,0 +1,593 @@
+package rproxy
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptrace"
+	"net/http/httputil"
+	"net/netip"
+	"net/url"
+	"os"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+)
+
+// flushAfterEachWrite has ReverseProxy pass on each part of the app's answer as
+// soon as it arrives.
+const flushAfterEachWrite time.Duration = -1
+
+// reportStatusMax is the highest status servewaf takes in a report. An app can
+// send a higher one, up to 999, and the visitor gets that as it is.
+const reportStatusMax = 599
+
+// plainText is the Content-Type of the answers rproxy gives itself.
+const plainText = "text/plain; charset=utf-8"
+
+// request is one request on its way through rproxy, from the moment its headers
+// have been read to its log line and report.
+type request struct {
+	h  *handler
+	in *http.Request
+	// rc sets the deadlines of the connection to the visitor.
+	rc   *http.ResponseController
+	out  *responseWriter
+	body *requestBody // nil for a request without a body
+
+	// id is the fresh id made for the request when it arrived.
+	id          string
+	client      netip.Addr
+	peer        netip.Addr
+	peerTrusted bool
+	start       time.Time
+
+	// disposition is what is done with the request: servewaf's valid disposition,
+	// or SWRP_DEFAULT_DISPOSITION. It is "" when neither gave one.
+	disposition string
+	// answered is true when servewaf gave disposition, which makes a report due,
+	// and byDefault when SWRP_DEFAULT_DISPOSITION did.
+	answered  bool
+	byDefault bool
+	// asn and country are servewaf's X-Client-ASN and X-Client-Country, for the
+	// app.
+	asn, country string
+
+	// upstreamStart is when the request was handed to the app.
+	upstreamStart time.Time
+	// cancel ends the request to the app.
+	cancel context.CancelFunc
+	// refused is the status of the first refusal, from whichever goroutine meets
+	// it: what the visitor is answered if the response has not started yet.
+	refused atomic.Int64
+	// upgraded is the connection to the app once the app has switched protocols,
+	// as for a WebSocket, and nil otherwise.
+	upgraded *upgradedConn
+
+	// mu guards what follows. The time limits run on goroutines of their own,
+	// and the transport starts and stops them, and notes the times below, from
+	// its own; once timersStopped is set, neither time limit acts any more.
+	mu            sync.Mutex
+	timersStopped bool
+	requestTimer  *time.Timer
+	responseTimer *time.Timer
+	// requestEnd is when the app had been sent the whole request, or the answer
+	// started, if that was sooner.
+	requestEnd time.Time
+	// answerStarted is when the first byte of the app's answer arrived.
+	answerStarted time.Time
+}
+
+// newRequest starts handling r: it notes the time, works out the visitor from
+// the TCP peer and X-Forwarded-For, and makes the request's id.
+func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
+	peer := peerAddress(r)
+	trusted := h.config.TrustedProxies
+
+	rq := &request{
+		h:           h,
+		in:          r,
+		rc:          http.NewResponseController(w),
+		out:         &responseWriter{ResponseWriter: w},
+		id:          rand.Text(),
+		client:      clientAddress(peer, r.Header.Values("X-Forwarded-For"), trusted),
+		peer:        peer,
+		peerTrusted: isInside(peer, trusted),
+		start:       time.Now(),
+	}
+
+	if r.Body != http.NoBody {
+		rq.body = &requestBody{body: limitBody(r.Body, h.config.MaxRequestSize), rq: rq}
+	}
+
+	return rq
+}
+
+// answerHealth answers the health check.
+func (rq *request) answerHealth() {
+	rq.prepareOwnAnswer(rq.requestDeadline())
+	rq.out.Header().Set("Content-Type", plainText)
+	rq.send(http.StatusOK, []byte("ok\n"))
+}
+
+// readFirstPartOfBody reads up to the first 64 KiB of the body into memory,
+// within SWRP_MAX_REQUEST_TIME_MS, and reports whether the request goes on. A
+// visitor too slow to send it is answered 408. For a malformed chunk, or a
+// visitor that went away or stopped its sending side, the connection is closed
+// without an answer. A body over SWRP_MAX_REQUEST_SIZE goes on with the part
+// read, so that servewaf is asked first; passToApp then refuses it.
+func (rq *request) readFirstPartOfBody() bool {
+	if rq.body == nil {
+		return true
+	}
+
+	_ = rq.rc.SetReadDeadline(rq.requestDeadline())
+	held, err := io.ReadAll(io.LimitReader(rq.body, proxy.QuestionBodyMaxBytes))
+	// From here on, the request timer ends a read of the rest of the body, so that
+	// the answer can name the side rproxy was waiting on.
+	_ = rq.rc.SetReadDeadline(time.Time{})
+
+	rq.body.held = held
+
+	switch {
+	case err == nil || rq.refused.Load() != 0:
+		return true
+	case errors.Is(err, os.ErrDeadlineExceeded):
+		rq.answer(http.StatusRequestTimeout)
+
+		return false
+	default:
+		// This panic has Go's server close the connection without an answer, and
+		// log nothing; the deferred finish still runs.
+		panic(http.ErrAbortHandler)
+	}
+}
+
+// setPathAsSent has out, the URL of a request made from in, send the path as the
+// visitor sent it. Go sends the path URL.EscapedPath gives, which, for a path
+// holding a character Go escapes, such as |, is the whole path decoded and
+// escaped again, %2F turned into /. Opaque is sent as it is.
+func setPathAsSent(out *url.URL, in *http.Request) {
+	out.Opaque = rules.Path(in)
+}
+
+// forward passes the request to the app, the part of the body held and then the
+// rest, and the app's answer back. ctx is the request's own context.
+func (rq *request) forward(ctx context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	rq.cancel = cancel
+	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
+		WroteRequest:         rq.wroteRequest,
+		GotFirstResponseByte: rq.gotFirstResponseByte,
+	})
+
+	out := rq.in.WithContext(ctx)
+	if rq.body != nil {
+		out.Body = rq.body
+	}
+
+	reverseProxy := &httputil.ReverseProxy{
+		Rewrite:        rq.rewrite,
+		Transport:      rq.h.transport,
+		FlushInterval:  flushAfterEachWrite,
+		ErrorLog:       rq.h.errorLog,
+		ModifyResponse: rq.modifyResponse,
+		ErrorHandler:   rq.answerError,
+	}
+
+	rq.startRequestTimer()
+	rq.upstreamStart = time.Now()
+	reverseProxy.ServeHTTP(rq.out, out)
+}
+
+// rewrite makes the request the app receives: the visitor's request, unchanged,
+// sent to SWRP_UPSTREAM_URL, with the forwarded headers and the request's id set,
+// without any X-Client-ASN or X-Client-Country the visitor sent, and with
+// servewaf's.
+func (rq *request) rewrite(pr *httputil.ProxyRequest) {
+	upstream := rq.h.config.UpstreamURL
+	pr.Out.URL.Scheme = upstream.Scheme
+	pr.Out.URL.Host = upstream.Host
+	// ReverseProxy drops query parameters it cannot parse; the app gets the
+	// query as the visitor sent it.
+	pr.Out.URL.RawQuery = pr.In.URL.RawQuery
+	setPathAsSent(pr.Out.URL, pr.In)
+
+	setForwardedHeaders(pr.In, pr.Out, rq.peer, rq.peerTrusted)
+	pr.Out.Header.Set(requestIDHeader, rq.id)
+	pr.Out.Header.Del(asnHeader)
+	pr.Out.Header.Del(countryHeader)
+
+	if rq.asn != "" {
+		pr.Out.Header.Set(asnHeader, rq.asn)
+	}
+
+	if rq.country != "" {
+		pr.Out.Header.Set(countryHeader, rq.country)
+	}
+}
+
+// modifyResponse looks at the app's answer before ReverseProxy passes it on.
+func (rq *request) modifyResponse(res *http.Response) error {
+	if res.StatusCode == http.StatusSwitchingProtocols {
+		// An upgraded connection, such as a WebSocket, is not cut by the time
+		// limits. ReverseProxy writes this answer straight to the connection it
+		// takes over, not through rq.out, and then copies what passes each way
+		// through res.Body, the connection to the app. It may still refuse the
+		// switch, as when the app's Upgrade is not the visitor's, so the status
+		// is noted only once it has taken over the connection, by rq.out's
+		// Hijack.
+		rq.stopTimers()
+
+		conn, ok := res.Body.(io.ReadWriteCloser)
+		if ok {
+			rq.upgraded = &upgradedConn{ReadWriteCloser: conn}
+			res.Body = rq.upgraded
+		}
+
+		return nil
+	}
+
+	maxBytes := rq.h.config.MaxResponseSize
+	if maxBytes > 0 && res.Body != http.NoBody && res.ContentLength > maxBytes {
+		rq.refuse(http.StatusBadGateway)
+
+		return errResponseTooLarge
+	}
+
+	// Go's server adds a Content-Type it guesses from the body to a response
+	// whose headers have no Content-Type key. The key with no value sends none,
+	// as the app sent none.
+	if res.Header.Get("Content-Type") == "" {
+		rq.out.Header()["Content-Type"] = nil
+	}
+
+	res.Body = &responseBody{body: limitBody(res.Body, maxBytes), rq: rq}
+	rq.setResponseDeadline()
+
+	return nil
+}
+
+// answerError is ReverseProxy's ErrorHandler: the request could not be passed to
+// the app, or the app's answer cannot be passed on.
+func (rq *request) answerError(_ http.ResponseWriter, _ *http.Request, err error) {
+	if rq.upgraded != nil {
+		// The app switched protocols, but the switch was not passed on, and
+		// ReverseProxy leaves the app's connection open when it refuses it.
+		_ = rq.upgraded.Close()
+	}
+
+	status := int(rq.refused.Load())
+	if status == 0 {
+		if rq.in.Context().Err() != nil {
+			// The visitor went away or stopped its sending side. This panic has Go's
+			// server close the connection without an answer, and log nothing; the
+			// deferred finish still runs.
+			panic(http.ErrAbortHandler)
+		}
+
+		rq.h.processLog.Warn("request to the app failed", "error", err.Error())
+
+		status = http.StatusBadGateway
+	}
+
+	rq.answer(status)
+}
+
+// answer sends rproxy's own answer, unless the response has already started.
+func (rq *request) answer(status int) {
+	rq.refused.CompareAndSwap(0, int64(status))
+
+	if rq.out.status != 0 {
+		return // too late to answer: the connection can only be cut
+	}
+
+	// A visitor found too slow is read no more; any other may go on sending until
+	// its time is up, so that Go's server can read the rest of the body and end
+	// the request cleanly.
+	deadline := rq.requestDeadline()
+	if status == http.StatusRequestTimeout {
+		deadline = time.Now()
+	}
+
+	rq.prepareOwnAnswer(deadline)
+
+	header := rq.out.Header()
+	header.Set("Content-Type", plainText)
+	header.Set("X-Content-Type-Options", "nosniff")
+	rq.send(status, []byte(http.StatusText(status)+"\n"))
+}
+
+// send gives the visitor an answer rproxy holds whole: status, the headers set so
+// far and body. Go's server would otherwise send so short an answer only once the
+// handler has returned, after finish has written the log line and sent the report.
+// Without Content-Length, the flush would send the body in chunks, the last of
+// which would still wait for the handler. A HEAD's answer has no body, so any
+// Content-Length it has stays as servewaf gave it.
+func (rq *request) send(status int, body []byte) {
+	if rq.in.Method != http.MethodHead {
+		rq.out.Header().Set("Content-Length", strconv.Itoa(len(body)))
+	}
+
+	rq.out.WriteHeader(status)
+	_, _ = rq.out.Write(body)
+	_ = rq.rc.Flush()
+}
+
+// prepareOwnAnswer readies the connection for an answer rproxy gives itself: the
+// reading of a body that has not arrived whole ends at deadline, and the answer
+// has SWRP_MAX_RESPONSE_TIME_MS from now to reach the visitor, even when the app
+// used that time up first.
+func (rq *request) prepareOwnAnswer(deadline time.Time) {
+	rq.stopReadingBody(deadline)
+	rq.endRequest()
+
+	limit := rq.h.config.MaxResponseTime
+	if limit > 0 {
+		_ = rq.rc.SetWriteDeadline(time.Now().Add(limit))
+	}
+}
+
+// refuse records status, unless an earlier refusal was, and ends the request to
+// the app, if one was made.
+func (rq *request) refuse(status int) {
+	rq.refused.CompareAndSwap(0, int64(status))
+
+	if rq.cancel != nil {
+		rq.cancel()
+	}
+}
+
+// finish ends the request's time limits, writes its log line and, if servewaf
+// answered the question, sends the report. ctx is the request's own context.
+func (rq *request) finish(ctx context.Context) {
+	rq.stopTimers()
+
+	if rq.refused.Load() == 0 {
+		rq.stopReadingBody(rq.requestDeadline())
+	}
+
+	requestEnd := rq.endRequest()
+	end := time.Now()
+	requestBytes, responseBytes := rq.bytesEachWay()
+
+	err := requestlog.WriteRProxyLine(rq.h.requestLog, &requestlog.RProxyLine{
+		Time:               requestlog.FormatTime(rq.start),
+		RequestID:          rq.id,
+		ClientIP:           rq.client.String(),
+		Host:               rq.in.Host,
+		Method:             rq.in.Method,
+		Path:               rules.Path(rq.in),
+		Query:              rq.in.URL.RawQuery,
+		Status:             rq.out.status,
+		RequestBytes:       requestBytes,
+		ResponseBytes:      responseBytes,
+		DurationRequest:    requestlog.Milliseconds(requestEnd.Sub(rq.start)),
+		DurationResponse:   requestlog.Milliseconds(end.Sub(requestEnd)),
+		Disposition:        rq.disposition,
+		DefaultDisposition: rq.byDefault,
+	})
+	if err != nil {
+		rq.h.processLog.Error("writing the request log failed", "error", err.Error())
+	}
+
+	if !rq.answered {
+		return
+	}
+
+	report := &proxy.Report{
+		RequestID:     rq.id,
+		Status:        min(rq.out.status, reportStatusMax),
+		RequestBytes:  requestBytes,
+		ResponseBytes: responseBytes,
+		DurationTotal: requestlog.Milliseconds(end.Sub(rq.start)),
+	}
+	if !rq.upstreamStart.IsZero() {
+		report.DurationUpstreamTotal = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
+	}
+
+	rq.h.sendReport(ctx, report)
+}
+
+// bytesEachWay returns the body bytes of the request and of the answer. For an
+// upgraded connection, such as a WebSocket, which has closed by then, what it
+// carried from the visitor counts with the request's and what it carried from the
+// app with the answer's.
+func (rq *request) bytesEachWay() (int64, int64) {
+	var requestBytes int64
+	if rq.body != nil {
+		requestBytes = rq.body.bytes.Load()
+	}
+
+	responseBytes := rq.out.bytes
+
+	if rq.upgraded != nil {
+		requestBytes += rq.upgraded.toApp.Load()
+		responseBytes += rq.upgraded.fromApp.Load()
+	}
+
+	return requestBytes, responseBytes
+}
+
+// requestDeadline is when the visitor must have sent its whole request, or zero
+// when SWRP_MAX_REQUEST_TIME_MS is off.
+func (rq *request) requestDeadline() time.Time {
+	limit := rq.h.config.MaxRequestTime
+	if limit == 0 {
+		return time.Time{}
+	}
+
+	return rq.start.Add(limit)
+}
+
+// stopReadingBody ends, at deadline, the reading of a visitor's body that has not
+// arrived whole: Go's server then reads no more of it, and closes the connection
+// after the answer.
+func (rq *request) stopReadingBody(deadline time.Time) {
+	if rq.body == nil || rq.body.received.Load() {
+		return
+	}
+
+	_ = rq.rc.SetReadDeadline(deadline)
+}
+
+// startRequestTimer starts SWRP_MAX_REQUEST_TIME_MS, which runs from the
+// request's headers being read until the app has been sent the whole request.
+func (rq *request) startRequestTimer() {
+	deadline := rq.requestDeadline()
+	if deadline.IsZero() {
+		return
+	}
+
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	rq.requestTimer = time.AfterFunc(time.Until(deadline), rq.requestTimedOut)
+}
+
+// requestTimedOut is called when SWRP_MAX_REQUEST_TIME_MS runs out while the
+// request is still on its way to the app. The answer names the side rproxy was
+// waiting on at that moment: 408 when it was waiting for the visitor to send more
+// of its body, 504 when it was waiting for the app to be reached or to take what
+// it had.
+func (rq *request) requestTimedOut() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if rq.timersStopped {
+		return
+	}
+
+	if rq.body == nil || !rq.body.waiting.Load() {
+		// Once the app has answered, the transport, ReverseProxy and Go's server
+		// each close the visitor's body, and closing it reads what is left of a
+		// body under 256 KiB without requestBody.Read, so waiting is false while
+		// that read waits for the visitor. That read ends now, before refuse:
+		// should rproxy still answer itself, answer then sets the deadline it
+		// gives its own answers.
+		if !rq.answerStarted.IsZero() {
+			rq.stopReadingBody(time.Now())
+		}
+
+		rq.refuse(http.StatusGatewayTimeout)
+
+		return
+	}
+
+	rq.refuse(http.StatusRequestTimeout)
+	// The transport gives up on the app only once its Read of the visitor's body
+	// returns, so that Read is ended now. The lock keeps this from reaching the
+	// connection after the request is handled.
+	_ = rq.rc.SetReadDeadline(time.Now())
+}
+
+// gotFirstResponseByte is called once the first byte of the app's answer has
+// arrived.
+func (rq *request) gotFirstResponseByte() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	rq.answerStarted = time.Now()
+}
+
+// wroteRequest is called once the app has been sent the whole request:
+// SWRP_MAX_REQUEST_TIME_MS ends and SWRP_MAX_RESPONSE_TIME_MS starts.
+func (rq *request) wroteRequest(info httptrace.WroteRequestInfo) {
+	if info.Err != nil {
+		return // the transport gives up, or tries again
+	}
+
+	requestEnd := rq.endRequest()
+
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if rq.timersStopped {
+		return
+	}
+
+	stopTimer(rq.requestTimer)
+
+	limit := rq.h.config.MaxResponseTime
+	if limit > 0 {
+		rq.responseTimer = time.AfterFunc(time.Until(requestEnd.Add(limit)),
+			rq.responseTimedOut)
+	}
+}
+
+// responseTimedOut is called when SWRP_MAX_RESPONSE_TIME_MS runs out before the
+// app has sent its whole answer.
+func (rq *request) responseTimedOut() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if !rq.timersStopped {
+		rq.refuse(http.StatusGatewayTimeout)
+	}
+}
+
+// responseReceived is called once the app has sent its whole answer. An app may
+// answer before the visitor has sent its whole body, as with a 404 it sends
+// without reading it. The time limits then run on: until the transport's read of
+// the body returns, Go's server cannot send the answer, and
+// SWRP_MAX_REQUEST_TIME_MS is what ends that read for a visitor that stops
+// sending.
+func (rq *request) responseReceived() {
+	if rq.body != nil && !rq.body.received.Load() {
+		return
+	}
+
+	rq.stopTimers()
+}
+
+// setResponseDeadline sets SWRP_MAX_RESPONSE_TIME_MS on the connection to the
+// visitor: the app's answer must reach the visitor within it of the end of the
+// request.
+func (rq *request) setResponseDeadline() {
+	requestEnd := rq.endRequest()
+
+	limit := rq.h.config.MaxResponseTime
+	if limit > 0 {
+		_ = rq.rc.SetWriteDeadline(requestEnd.Add(limit))
+	}
+}
+
+// endRequest notes now as the end of the request, unless an end is noted, and
+// returns the end noted.
+func (rq *request) endRequest() time.Time {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	if rq.requestEnd.IsZero() {
+		rq.requestEnd = time.Now()
+	}
+
+	return rq.requestEnd
+}
+
+// stopTimers stops the request's time limits and keeps any from starting later:
+// the app's answer is complete, the connection upgraded, or the request handled.
+func (rq *request) stopTimers() {
+	rq.mu.Lock()
+	defer rq.mu.Unlock()
+
+	rq.timersStopped = true
+	stopTimer(rq.requestTimer)
+	stopTimer(rq.responseTimer)
+}
+
+// stopTimer stops t, which is nil when its time limit is off.
+func stopTimer(t *time.Timer) {
+	if t != nil {
+		t.Stop()
+	}
+}

internal/rproxy/rproxy.go

@@ -0,0 +1,228 @@
+// Package rproxy is the reverse proxy in front of one app that asks servewaf
+// about each request. It passes a request servewaf allows to the app and the
+// app's answer back, within the size and time limits. Any other answer from
+// servewaf goes to the visitor as servewaf gave it. SWRP_DEFAULT_DISPOSITION
+// decides only when servewaf cannot be connected to, does not answer at all, or
+// does not answer within SWRP_TIMEOUT_MS. rproxy itself refuses a request with a
+// method it does not pass on, or one it cannot put to servewaf as the visitor
+// sent it. It keeps nothing between requests and never touches disk. "rproxy" in
+// SPEC.md says what it does.
+package rproxy
+
+import (
+	"context"
+	"io"
+	"log"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+)
+
+// How rproxy keeps connections to the app and to servewaf open between
+// requests.
+const (
+	idleConns       = 100
+	idleConnTimeout = 90 * time.Second
+)
+
+// The limits on a connection from a visitor that have no setting.
+const (
+	// requestHeaderMaxBytes is the largest request line and headers a visitor
+	// may send.
+	requestHeaderMaxBytes = 32 << 10
+	// goServerExtraHeaderBytes is how far past MaxHeaderBytes Go's server reads
+	// before it refuses.
+	goServerExtraHeaderBytes = 4 << 10
+	// idleTimeout is how long a kept-open connection may wait for its next
+	// request.
+	idleTimeout = 120 * time.Second
+)
+
+// adminPrefix starts the path of every request for smallwebwaf itself, which
+// never reaches the app.
+const adminPrefix = "/_smallwebwaf/"
+
+// allowedMethods lists the methods rproxy passes on, as an Allow header gives
+// them. It answers any other method 405 itself.
+const allowedMethods = "GET, HEAD, POST, OPTIONS, PUT, DELETE, PATCH, QUERY"
+
+// Params are what New needs.
+type Params struct {
+	Config *config.RProxy
+	// RequestLog receives one short JSON line per request.
+	RequestLog io.Writer
+	// ProcessLog receives the process's own messages.
+	ProcessLog *slog.Logger
+}
+
+// Server is the server `smallwebwaf rproxy` runs.
+type Server struct {
+	*http.Server
+
+	h *handler
+}
+
+// New returns the server `smallwebwaf rproxy` runs. Go's server itself refuses
+// a request line and headers over requestHeaderMaxBytes, with 431, closes a
+// connection idle for idleTimeout, and applies SWRP_MAX_REQUEST_TIME_MS while
+// the headers arrive. The handler applies the time and size limits from then
+// on.
+func New(params Params) *Server {
+	backend := params.Config.WAFBackend
+	errorLog := slog.NewLogLogger(params.ProcessLog.Handler(), slog.LevelWarn)
+	h := &handler{
+		config:            params.Config,
+		requestLog:        params.RequestLog,
+		processLog:        params.ProcessLog,
+		errorLog:          errorLog,
+		transport:         newTransport(),
+		serveWAFTransport: newServeWAFTransport(),
+		reportURL: (&url.URL{
+			Scheme: backend.Scheme, Host: backend.Host, Path: proxy.ReportPath,
+		}).String(),
+	}
+
+	return &Server{
+		Server: &http.Server{
+			Addr:              params.Config.ListenAddr,
+			Handler:           h,
+			ErrorLog:          errorLog,
+			ReadHeaderTimeout: params.Config.MaxRequestTime,
+			IdleTimeout:       idleTimeout,
+			MaxHeaderBytes:    requestHeaderMaxBytes - goServerExtraHeaderBytes,
+		},
+		h: h,
+	}
+}
+
+// WaitForReports returns once the reports being sent have gone or failed,
+// which SWRP_TIMEOUT_MS bounds. Any report after this call is dropped: that of
+// a WebSocket that closes while rproxy stops, for one.
+func (s *Server) WaitForReports() {
+	s.h.reportsMu.Lock()
+	s.h.reportsStopped = true
+	s.h.reportsMu.Unlock()
+
+	s.h.reports.Wait()
+}
+
+// handler is the proxy. It holds what every request shares; what belongs to
+// one request is in a request.
+type handler struct {
+	config     *config.RProxy
+	requestLog io.Writer
+	processLog *slog.Logger
+	errorLog   *log.Logger
+	// transport carries requests to the app, and serveWAFTransport questions and
+	// reports to servewaf.
+	transport         http.RoundTripper
+	serveWAFTransport http.RoundTripper
+	// reportURL is where the reports go.
+	reportURL string
+	// reports waits for the reports being sent. reportsMu guards starting one
+	// against reportsStopped, which is set once nothing is to wait for another.
+	reports        sync.WaitGroup
+	reportsMu      sync.Mutex
+	reportsStopped bool
+}
+
+// newTransport returns what carries requests to the app. It never goes through
+// a proxy named in the environment, and leaves answers compressed or not as they
+// were sent.
+func newTransport() *http.Transport {
+	return &http.Transport{
+		MaxIdleConns:        idleConns,
+		MaxIdleConnsPerHost: idleConns,
+		IdleConnTimeout:     idleConnTimeout,
+		DisableCompression:  true,
+	}
+}
+
+// newServeWAFTransport returns what carries questions and reports to servewaf.
+// It speaks HTTP/1.1 only. Go's HTTP/2 client refuses to send a visitor's Upgrade
+// header, or a Connection header other than close or keep-alive, and that would
+// read as servewaf giving no answer.
+func newServeWAFTransport() *http.Transport {
+	transport := newTransport()
+	transport.Protocols = new(http.Protocols)
+	transport.Protocols.SetHTTP1(true)
+
+	return transport
+}
+
+// ServeHTTP handles one request: it answers the health check itself, refuses a
+// request with a method it does not pass on or one it cannot put to servewaf as
+// the visitor sent it, and for any other request reads the first part of the
+// body, asks servewaf, and does what the answer says. Once the answer has ended,
+// it writes the request's log line and sends its report.
+func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	rq := h.newRequest(w, r)
+	defer rq.finish(r.Context())
+
+	if r.Method == http.MethodGet && r.URL.Path == proxy.HealthPath {
+		rq.answerHealth()
+
+		return
+	}
+
+	if !slices.Contains(strings.Split(allowedMethods, ", "), r.Method) {
+		rq.out.Header().Set("Allow", allowedMethods)
+		rq.answer(http.StatusMethodNotAllowed)
+
+		return
+	}
+
+	if !canBeAsked(r) {
+		rq.answer(http.StatusBadRequest)
+
+		return
+	}
+
+	if !rq.readFirstPartOfBody() {
+		return
+	}
+
+	answer, err := rq.ask(r.Context())
+	if err != nil {
+		rq.handleNoUsableAnswer(r.Context(), err)
+
+		return
+	}
+
+	rq.noteAnswer(answer)
+
+	switch rq.disposition {
+	case proxy.DispositionAllow:
+		rq.passToApp(r.Context())
+	case proxy.DispositionClose:
+		// This panic has Go's server close the connection without an answer,
+		// and log nothing; the deferred finish still runs.
+		panic(http.ErrAbortHandler)
+	default: // a deny, an error, or an answer without a valid disposition
+		rq.answerWith(answer)
+	}
+}
+
+// passToApp passes the request on to the app, unless a limit or its path keeps
+// it from the app. servewaf answers a path under adminPrefix itself, so such a
+// request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
+// request's own context.
+func (rq *request) passToApp(ctx context.Context) {
+	maxBytes := rq.h.config.MaxRequestSize
+
+	switch {
+	case rq.refused.Load() != 0 || (maxBytes > 0 && rq.in.ContentLength > maxBytes):
+		rq.answer(http.StatusRequestEntityTooLarge)
+	case strings.HasPrefix(rq.in.URL.Path, adminPrefix):
+		rq.answer(http.StatusNotFound)
+	default:
+		rq.forward(ctx)
+	}
+}

internal/rproxy/servewaf.go

@@ -0,0 +1,266 @@
+package rproxy
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+	"strings"
+
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+)
+
+// answerBodyMaxBytes is the most of the body of servewaf's answer that is read.
+// It is far above any answer's.
+const answerBodyMaxBytes = 1 << 20
+
+// reportAnswerMaxBytes is the most of the answer to a report that is read,
+// which has no body when servewaf takes the report.
+const reportAnswerMaxBytes = 4 << 10
+
+var (
+	errCannotPassOn  = errors.New("the answer cannot be passed to the visitor")
+	errReportRefused = errors.New("the report was answered")
+)
+
+// servewafAnswer is what servewaf answered to a question.
+type servewafAnswer struct {
+	status int
+	header http.Header
+	body   []byte
+}
+
+// noteAnswer notes what servewaf answered. An answer without a valid disposition
+// notes nothing, and no report is due for it: servewaf holds no decision to report
+// on.
+func (rq *request) noteAnswer(answer *servewafAnswer) {
+	disposition := answer.header.Get(proxy.DispositionHeader)
+
+	switch disposition {
+	case proxy.DispositionAllow, proxy.DispositionDeny, proxy.DispositionClose:
+		rq.disposition = disposition
+		rq.answered = true
+		rq.asn = answer.header.Get(asnHeader)
+		rq.country = answer.header.Get(countryHeader)
+	}
+}
+
+// handleNoUsableAnswer deals with a request whose question ended in err, which
+// leaves no answer to act on. ctx is the request's own context.
+func (rq *request) handleNoUsableAnswer(ctx context.Context, err error) {
+	switch {
+	case ctx.Err() != nil:
+		// The visitor went away while servewaf was being asked. servewaf has not
+		// failed, and nothing is noted. This panic has Go's server close the
+		// connection without an answer, and log nothing; the deferred finish still
+		// runs.
+		panic(http.ErrAbortHandler)
+	case errors.Is(err, errCannotPassOn):
+		rq.h.processLog.Warn("servewaf's answer is dropped", "error", err.Error())
+		rq.answer(http.StatusBadGateway)
+	default:
+		// servewaf cannot be connected to, does not answer at all, or does not answer
+		// within SWRP_TIMEOUT_MS. A request that keeps servewaf busy past
+		// SWRP_TIMEOUT_MS, like any request while servewaf is overloaded, gets
+		// SWRP_DEFAULT_DISPOSITION here. deny closes this, at the cost of answering 503
+		// whenever servewaf is slow. Making such requests hard to send is
+		// https://git.eeqj.de/sneak/smallwebwaf/issues/182.
+		rq.h.processLog.Warn("servewaf gave no answer", "error", err.Error())
+
+		rq.disposition = rq.h.config.DefaultDisposition
+		rq.byDefault = true
+
+		if rq.disposition == proxy.DispositionAllow {
+			rq.passToApp(ctx)
+		} else {
+			rq.answer(http.StatusServiceUnavailable)
+		}
+	}
+}
+
+// ask sends servewaf the question, and returns its answer, which must have come
+// whole within SWRP_TIMEOUT_MS. It ends when ctx does, as when the visitor goes
+// away.
+func (rq *request) ask(ctx context.Context) (*servewafAnswer, error) {
+	ctx, cancel := context.WithTimeout(ctx, rq.h.config.Timeout)
+	defer cancel()
+
+	question, err := rq.newQuestion(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := rq.h.serveWAFTransport.RoundTrip(question)
+	if err != nil {
+		return nil, fmt.Errorf("send the question: %w", err)
+	}
+
+	defer func() {
+		_ = res.Body.Close()
+	}()
+
+	// The body of a 101 is the connection itself, and the time limit does not end
+	// a read of that. Go's client also takes a status below 100, which Go's server
+	// panics when asked to send.
+	if res.StatusCode < http.StatusOK {
+		return nil, fmt.Errorf("%w: its status is %d", errCannotPassOn, res.StatusCode)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(res.Body, answerBodyMaxBytes+1))
+	if err != nil {
+		return nil, fmt.Errorf("read the answer: %w", err)
+	}
+
+	if len(body) > answerBodyMaxBytes {
+		return nil, fmt.Errorf("%w: its body is over 1 MiB", errCannotPassOn)
+	}
+
+	return &servewafAnswer{res.StatusCode, res.Header, body}, nil
+}
+
+// canBeAsked reports whether Go's client can send servewaf r as the visitor sent
+// it. It cannot send these as they came:
+//   - a target that does not start with /, or that starts with //;
+//   - an empty Host, for which it sends servewaf's own address;
+//   - a Host holding an IPv6 zone, which it removes;
+//   - more than one User-Agent, of which it sends the first;
+//   - an empty User-Agent, which it leaves out, the one case that still goes to
+//     servewaf.
+func canBeAsked(r *http.Request) bool {
+	target, host := r.RequestURI, r.Host
+	hostHasZone := strings.HasPrefix(host, "[") && strings.Contains(host, "%")
+
+	return strings.HasPrefix(target, "/") && !strings.HasPrefix(target, "//") &&
+		host != "" && !hostHasZone && len(r.Header.Values("User-Agent")) <= 1
+}
+
+// newQuestion returns the question about the request, as "The question" in
+// SPEC.md gives it: the visitor's request as the visitor sent it, with the part
+// of the body it holds and rproxy's headers.
+func (rq *request) newQuestion(ctx context.Context) (*http.Request, error) {
+	in := rq.in
+
+	var held []byte
+	if rq.body != nil {
+		held = rq.body.held
+	}
+
+	question, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
+		ctx, in.Method, rq.h.config.WAFBackend.String(), bytes.NewReader(held))
+	if err != nil {
+		return nil, fmt.Errorf("make the question: %w", err)
+	}
+
+	backend := question.URL
+	target := *in.URL
+	target.Scheme = backend.Scheme
+	target.Host = backend.Host
+	setPathAsSent(&target, in)
+	question.URL = &target
+	question.Host = in.Host
+
+	// The length NewRequestWithContext set is that of what is held. This line makes
+	// a body whose length the visitor did not announce go chunked, as "The question"
+	// in SPEC.md requires.
+	question.TransferEncoding = in.TransferEncoding
+
+	question.Header = in.Header.Clone()
+	question.Header.Set(proxy.ClientHeader, rq.client.String())
+	question.Header.Set(proxy.PeerHeader, rq.peer.String())
+	question.Header.Del(proxy.ContentLengthHeader)
+
+	announced := in.Header.Get("Content-Length")
+	if announced != "" {
+		question.Header.Set(proxy.ContentLengthHeader, announced)
+	}
+
+	question.Header.Set(requestIDHeader, rq.id)
+	question.Header.Set("X-Forwarded-Proto", scheme(in, rq.peerTrusted))
+
+	// Go's client adds a User-Agent of its own to a request without the key.
+	_, sent := question.Header["User-Agent"]
+	if !sent {
+		question.Header["User-Agent"] = nil
+	}
+
+	return question, nil
+}
+
+// answerWith gives the visitor servewaf's answer, less its disposition.
+func (rq *request) answerWith(answer *servewafAnswer) {
+	rq.prepareOwnAnswer(rq.requestDeadline())
+
+	header := rq.out.Header()
+	maps.Copy(header, answer.header)
+	header.Del(proxy.DispositionHeader)
+
+	// Go's server adds a Content-Type it guesses from the body to a response whose
+	// headers have no Content-Type key. The key with no value sends none.
+	if header.Get("Content-Type") == "" {
+		header["Content-Type"] = nil
+	}
+
+	rq.send(answer.status, answer.body)
+}
+
+// sendReport sends servewaf report on a goroutine of its own, so that the
+// visitor does not wait for it. The report goes on after ctx, the request's own
+// context, has ended.
+func (h *handler) sendReport(ctx context.Context, report *proxy.Report) {
+	h.reportsMu.Lock()
+	defer h.reportsMu.Unlock()
+
+	if h.reportsStopped {
+		return
+	}
+
+	h.reports.Go(func() {
+		err := h.postReport(context.WithoutCancel(ctx), report)
+		if err != nil {
+			h.processLog.Warn("a report is dropped", "error", err.Error())
+		}
+	})
+}
+
+// postReport posts report to servewaf, and waits for its answer for up to
+// SWRP_TIMEOUT_MS.
+func (h *handler) postReport(ctx context.Context, report *proxy.Report) error {
+	body, err := json.Marshal(report)
+	if err != nil {
+		return fmt.Errorf("encode the report: %w", err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, h.config.Timeout)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext( //nolint:gosec // a setting's URL
+		ctx, http.MethodPost, h.reportURL, bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("make the request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	res, err := h.serveWAFTransport.RoundTrip(req)
+	if err != nil {
+		return fmt.Errorf("send the report: %w", err)
+	}
+
+	// The body of a 101 is the connection itself, and the time limit does not end
+	// a read of that.
+	if res.StatusCode >= http.StatusOK {
+		_, _ = io.Copy(io.Discard, io.LimitReader(res.Body, reportAnswerMaxBytes))
+	}
+
+	_ = res.Body.Close()
+
+	if res.StatusCode != http.StatusNoContent {
+		return fmt.Errorf("%w %s", errReportRefused, res.Status)
+	}
+
+	return nil
+}

internal/smallwebwaf/healthcheck.go

@@ -17,13 +17,16 @@ import (
 // healthCheckTimeout bounds the whole health check.
 const healthCheckTimeout = 5 * time.Second
 
-var errHealthEndpoint = errors.New("smallwebwaf's health endpoint answered")
+var errHealthEndpoint = errors.New("the health endpoint answered")
 
-// HealthCheck is the container's health check. It returns 0 while
-// smallwebwaf answers its health endpoint on 127.0.0.1, at the port in
-// SWWAF_LISTEN_ADDR, and the app accepts connections at the address in
-// SWWAF_UPSTREAM_URL. Otherwise it writes why to stderr and returns 1.
-// It reads no other setting, nor a file that another names, so neither
+// HealthCheck is the container's health check. In servewaf's container, where
+// SMALLWEBWAF_COMMAND is servewaf, it returns 0 while servewaf answers its health
+// endpoint on 127.0.0.1, at the port in SWWAF_LISTEN_ADDR. In rproxy's container,
+// where SMALLWEBWAF_COMMAND is rproxy, unset or empty, it returns 0 while rproxy
+// answers its health endpoint on 127.0.0.1, at the port in SWRP_LISTEN_ADDR, and
+// the app accepts connections at the address in SWRP_UPSTREAM_URL. Otherwise,
+// any other value of SMALLWEBWAF_COMMAND included, it writes why to stderr and
+// returns 1. It reads no other setting, nor a file that another names, so neither
 // can fail it.
 // args are the arguments after `healthcheck`; it takes none, and given
 // one it names it on stderr and returns 1 without checking anything.
@@ -38,7 +41,20 @@ func HealthCheck(
 		return 1
 	}
 
-	err := healthCheck(ctx, lookupEnv)
+	ctx, cancel := context.WithTimeout(ctx, healthCheckTimeout)
+	defer cancel()
+
+	command, err := config.Command(lookupEnv)
+
+	switch {
+	case err != nil:
+		err = fmt.Errorf("invalid setting: %w", err)
+	case command == "servewaf":
+		err = checkServeWAF(ctx, lookupEnv)
+	default:
+		err = checkRProxyAndApp(ctx, lookupEnv)
+	}
+
 	if err != nil {
 		_, _ = fmt.Fprintln(stderr, "unhealthy:", err)
 
@@ -48,16 +64,48 @@ func HealthCheck(
 	return 0
 }
 
-func healthCheck(ctx context.Context, lookupEnv func(string) (string, bool)) error {
-	ctx, cancel := context.WithTimeout(ctx, healthCheckTimeout)
-	defer cancel()
-
-	listenAddr, upstreamURL, err := config.ListenAddrAndUpstreamURL(lookupEnv)
+// checkServeWAF asks servewaf's health endpoint.
+func checkServeWAF(ctx context.Context, lookupEnv func(string) (string, bool)) error {
+	listenAddr, err := config.ServeWAFListenAddr(lookupEnv)
 	if err != nil {
 		return fmt.Errorf("invalid setting: %w", err)
 	}
 
-	// The settings have checked that the address has a port.
+	err = askHealthEndpoint(ctx, listenAddr)
+	if err != nil {
+		return fmt.Errorf("ask servewaf: %w", err)
+	}
+
+	return nil
+}
+
+// checkRProxyAndApp asks rproxy's health endpoint, and connects to the app.
+func checkRProxyAndApp(
+	ctx context.Context, lookupEnv func(string) (string, bool),
+) error {
+	listenAddr, upstreamURL, err := config.RProxyListenAddrAndUpstreamURL(lookupEnv)
+	if err != nil {
+		return fmt.Errorf("invalid setting: %w", err)
+	}
+
+	err = askHealthEndpoint(ctx, listenAddr)
+	if err != nil {
+		return fmt.Errorf("ask rproxy: %w", err)
+	}
+
+	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", appAddress(upstreamURL))
+	if err != nil {
+		return fmt.Errorf("connect to the app: %w", err)
+	}
+
+	_ = conn.Close()
+
+	return nil
+}
+
+// askHealthEndpoint asks the health endpoint on 127.0.0.1 at the port of
+// listenAddr, which the settings have checked has one.
+func askHealthEndpoint(ctx context.Context, listenAddr string) error {
 	_, port, _ := net.SplitHostPort(listenAddr)
 	health := "http://" + net.JoinHostPort("127.0.0.1", port) + proxy.HealthPath
 
@@ -68,7 +116,7 @@ func healthCheck(ctx context.Context, lookupEnv func(string) (string, bool)) err
 
 	res, err := http.DefaultClient.Do(req)
 	if err != nil {
-		return fmt.Errorf("ask smallwebwaf: %w", err)
+		return fmt.Errorf("send the request: %w", err)
 	}
 
 	_ = res.Body.Close()
@@ -77,13 +125,6 @@ func healthCheck(ctx context.Context, lookupEnv func(string) (string, bool)) err
 		return fmt.Errorf("%w %s", errHealthEndpoint, res.Status)
 	}
 
-	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", appAddress(upstreamURL))
-	if err != nil {
-		return fmt.Errorf("connect to the app: %w", err)
-	}
-
-	_ = conn.Close()
-
 	return nil
 }
 

internal/smallwebwaf/healthcheck_test.go

@@ -15,11 +15,16 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
-func TestHealthCheck(t *testing.T) {
-	t.Parallel()
+const (
+	// commandSetting says which command a container runs, and which the health
+	// check checks.
+	commandSetting = "SMALLWEBWAF_COMMAND"
+	// serveWAFCommand is the command that runs servewaf.
+	serveWAFCommand = "servewaf"
+)
 
-	app := httptest.NewServer(http.NotFoundHandler())
-	defer app.Close()
+func TestHealthCheckInServeWAFsContainer(t *testing.T) {
+	t.Parallel()
 
 	ctx, stop := context.WithCancel(t.Context())
 	defer stop()
@@ -27,10 +32,9 @@ func TestHealthCheck(t *testing.T) {
 	out := &output{}
 	exited := make(chan int, 1)
 	settings := map[string]string{
-		listenAddr:  localhost + ":0",
-		upstreamURL: app.URL,
-		stateDir:    t.TempDir(),
-		rulesDir:    t.TempDir(),
+		listenAddr: localhost + ":0",
+		stateDir:   t.TempDir(),
+		rulesDir:   t.TempDir(),
 	}
 
 	go func() {
@@ -39,40 +43,36 @@ func TestHealthCheck(t *testing.T) {
 
 	addr, _ := out.line(t, "msg", "starting")["address"].(string)
 	_, port, _ := net.SplitHostPort(addr)
+
 	// The container's settings: an address to listen on with an empty
 	// host part, which the health check asks at 127.0.0.1.
-	env := map[string]string{listenAddr: ":" + port, upstreamURL: app.URL}
+	wantHealthCheck(t, map[string]string{
+		commandSetting: serveWAFCommand, listenAddr: ":" + port,
+	}, 0, "")
 
-	wantHealthCheck(t, env, 0, "")
-
-	// The health check reads those two settings alone, here given as
-	// files: a removed or invalid token file, or an invalid value of
-	// another setting, does not fail it.
+	// The health check reads that setting alone, here given as a file: a removed
+	// or invalid token file, or an invalid value of another setting, does not
+	// fail it.
 	for _, other := range []struct{ name, value string }{
 		{"SWWAF_METRICS_TOKEN_FILE", filepath.Join(t.TempDir(), "removed")},
 		{"SWWAF_METRICS_TOKEN_FILE", writeFile(t, "too short\n")},
 		{"SWWAF_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
-			listenAddr + "_FILE":  writeFile(t, ":"+port+"\n"),
-			upstreamURL + "_FILE": writeFile(t, app.URL+"\n"),
-			other.name:            other.value,
+			commandSetting:       serveWAFCommand,
+			listenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
+			other.name:           other.value,
 		}, 0, "")
 	}
 
-	// Another test can take a closed server's port at once, so the app's
-	// address here is a multicast address, to which TCP cannot connect.
-	wantHealthCheck(t, map[string]string{
-		listenAddr:  ":" + port,
-		upstreamURL: "http://224.0.0.1",
-	}, 1, "unhealthy: connect to the app: ")
-
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
-	wantHealthCheck(t, map[string]string{listenAddr: ":0"}, 1,
-		"unhealthy: ask smallwebwaf: ")
-	wantHealthCheck(t, map[string]string{listenAddr: "8080"}, 1,
-		"unhealthy: invalid setting: SWWAF_LISTEN_ADDR: ")
+	wantHealthCheck(t, map[string]string{
+		commandSetting: serveWAFCommand, listenAddr: ":0",
+	}, 1, "unhealthy: ask servewaf: ")
+	wantHealthCheck(t, map[string]string{
+		commandSetting: serveWAFCommand, listenAddr: "8080",
+	}, 1, "unhealthy: invalid setting: SWWAF_LISTEN_ADDR: ")
 
 	stop()
 
@@ -83,6 +83,63 @@ func TestHealthCheck(t *testing.T) {
 	}
 }
 
+func TestHealthCheckInRProxysContainer(t *testing.T) {
+	t.Parallel()
+
+	app := httptest.NewServer(http.NotFoundHandler())
+	defer app.Close()
+
+	// Nothing listens at the backend. The health check asks rproxy and the app,
+	// whether or not servewaf answers.
+	site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL)
+	_, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://"))
+	settings := func(more ...string) map[string]string {
+		env := map[string]string{rproxyListenAddr: ":" + port, rproxyUpstreamURL: app.URL}
+		for i := 0; i < len(more); i += 2 {
+			env[more[i]] = more[i+1]
+		}
+
+		return env
+	}
+
+	wantHealthCheck(t, settings(), 0, "")
+	wantHealthCheck(t, settings(commandSetting, ""), 0, "")
+	wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "")
+
+	// SMALLWEBWAF_COMMAND cannot be given as a file.
+	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "servewaf\n")),
+		0, "")
+
+	// Another setting does not fail it, even an invalid one, and neither does
+	// SWRP_WAF_BACKEND being unset.
+	wantHealthCheck(t, settings("SWRP_TIMEOUT_MS", "soon"), 0, "")
+
+	// Another test can take a closed server's port at once, so the app's
+	// address here is a multicast address, to which TCP cannot connect.
+	wantHealthCheck(t, settings(rproxyUpstreamURL, "http://224.0.0.1"), 1,
+		"unhealthy: connect to the app: ")
+
+	// Listening on port 0 takes any free port, so nothing listens on port 0
+	// itself.
+	wantHealthCheck(t, settings(rproxyListenAddr, ":0"), 1, "unhealthy: ask rproxy: ")
+	wantHealthCheck(t, settings(rproxyListenAddr, "8080"), 1,
+		"unhealthy: invalid setting: SWRP_LISTEN_ADDR: ")
+
+	// No setting of rproxy's has a form given as a file.
+	wantHealthCheck(t, map[string]string{
+		rproxyListenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
+		rproxyUpstreamURL:          app.URL,
+	}, 1, "unhealthy: ask rproxy: ")
+}
+
+func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
+	t.Parallel()
+
+	wantHealthCheck(t, map[string]string{commandSetting: "healthcheck"}, 1,
+		"unhealthy: invalid setting: SMALLWEBWAF_COMMAND: "+
+			"\"healthcheck\" is not rproxy or servewaf\n")
+}
+
 func TestHealthCheckRefusesAnArgument(t *testing.T) {
 	t.Parallel()
 

internal/smallwebwaf/rproxy.go

@@ -0,0 +1,99 @@
+package smallwebwaf
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net"
+	"net/http"
+	"os"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rproxy"
+)
+
+// RunRProxy is `smallwebwaf rproxy`: it reads rproxy's settings, then serves
+// requests until ctx is done. Then it gives the requests in progress
+// shutdownTimeout to finish, and the reports being sent SWRP_TIMEOUT_MS. It
+// returns the process's exit status, 1 when rproxy cannot start. Its process
+// messages name the host's name as instance, and it writes those at info or
+// more severe: rproxy has no setting for either.
+func RunRProxy(ctx context.Context, params Params) int {
+	hostname, _ := os.Hostname() // "" when the host has no name to give
+	processLog := requestlog.NewProcessLogger(params.Stdout, hostname, slog.LevelInfo)
+
+	cfg, err := config.RProxyFromEnvironment(params.LookupEnv)
+	if err != nil {
+		processLog.Error("invalid setting", "error", err.Error())
+
+		return 1
+	}
+
+	server := rproxy.New(rproxy.Params{
+		Config:     cfg,
+		RequestLog: params.Stdout,
+		ProcessLog: processLog,
+	})
+
+	listener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", cfg.ListenAddr)
+	if err != nil {
+		processLog.Error("cannot listen on SWRP_LISTEN_ADDR", "error", err.Error())
+
+		return 1
+	}
+
+	processLog.Info("starting",
+		"version", params.Version,
+		"address", listener.Addr().String(),
+		"settings", cfg)
+
+	return serveRProxy(ctx, server, listener, processLog)
+}
+
+// serveRProxy serves requests on listener until ctx is done, and then stops as
+// RunRProxy says.
+func serveRProxy(
+	ctx context.Context, server *rproxy.Server, listener net.Listener,
+	processLog *slog.Logger,
+) int {
+	served := make(chan error, 1)
+
+	go func() {
+		served <- server.Serve(listener)
+	}()
+
+	select {
+	case err := <-served:
+		processLog.Error("serving failed", "error", err.Error())
+
+		return 1
+	case <-ctx.Done():
+	}
+
+	processLog.Info("stopping")
+
+	shutdownCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx),
+		shutdownTimeout)
+	defer cancel()
+
+	err := server.Shutdown(shutdownCtx)
+	if err != nil {
+		processLog.Warn("requests still in progress were cut off",
+			"error", err.Error())
+
+		_ = server.Close()
+	}
+
+	err = <-served
+	if !errors.Is(err, http.ErrServerClosed) {
+		processLog.Error("serving failed", "error", err.Error())
+
+		return 1
+	}
+
+	server.WaitForReports()
+	processLog.Info("stopped")
+
+	return 0
+}

internal/smallwebwaf/rproxy_test.go

@@ -0,0 +1,789 @@
+package smallwebwaf_test
+
+import (
+	"bufio"
+	"context"
+	"encoding/pem"
+	"io"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
+)
+
+const (
+	// wafBackend is the setting that names servewaf to rproxy.
+	wafBackend = "SWRP_WAF_BACKEND"
+	// rproxyListenAddr is the setting that says where rproxy listens.
+	rproxyListenAddr = "SWRP_LISTEN_ADDR"
+	// rproxyUpstreamURL is the setting that says where the app is.
+	rproxyUpstreamURL = "SWRP_UPSTREAM_URL"
+	// rproxyTimeout is the setting that says how long rproxy waits for servewaf.
+	rproxyTimeout = "SWRP_TIMEOUT_MS"
+	// bannedProbe is a path the default rule file bans a client for.
+	bannedProbe = "/.env"
+	// otherClient is a client the tests do not ban.
+	otherClient = "198.51.100.7"
+)
+
+// runRProxy runs `smallwebwaf rproxy` with the settings in env until ctx is
+// done, and returns its exit status.
+func runRProxy(ctx context.Context, env map[string]string, out *output) int {
+	return smallwebwaf.RunRProxy(ctx, smallwebwaf.Params{
+		Version: testVersion,
+		LookupEnv: func(name string) (string, bool) {
+			value, ok := env[name]
+
+			return value, ok
+		},
+		Stdout: out,
+	})
+}
+
+// startRProxy runs rproxy with servewaf at backend and the app at appURL, and
+// returns its URL and what it writes. It believes X-Forwarded-For from the
+// tests. It stops as the test ends, and that it stopped in order is checked.
+func startRProxy(t *testing.T, backend, appURL string) (string, *output) {
+	t.Helper()
+
+	ctx, stop := context.WithCancel(t.Context())
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- runRProxy(ctx, map[string]string{
+			rproxyListenAddr:       localhost + ":0",
+			"SWRP_UPSTREAM_URL":    appURL,
+			"SWRP_TRUSTED_PROXIES": localhost + "/32",
+			wafBackend:             backend,
+		}, out)
+	}()
+
+	t.Cleanup(func() {
+		stop()
+
+		select {
+		case status := <-exited:
+			if status != 0 {
+				t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+			}
+		case <-time.After(waitLimit):
+			t.Error("rproxy still running after being told to stop")
+		}
+
+		out.line(t, "msg", "stopped")
+	})
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+
+	return "http://" + addr, out
+}
+
+// startServeWAF runs servewaf with the settings in env, and returns its address
+// and URL, what it writes, and what stops it, which checks that it stopped in
+// order.
+func startServeWAF(t *testing.T, env map[string]string) (string, *output, func()) {
+	t.Helper()
+
+	ctx, stop := context.WithCancel(t.Context())
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- run(ctx, env, out)
+	}()
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+
+	return addr, out, func() {
+		stop()
+
+		select {
+		case status := <-exited:
+			if status != 0 {
+				t.Fatalf("servewaf's exit status %d, want 0; output:\n%s", status, out.text())
+			}
+		case <-time.After(waitLimit):
+			t.Fatal("servewaf still running after being told to stop")
+		}
+	}
+}
+
+// serveWAFSettings are servewaf's settings with the default rule file, to listen
+// at any free port.
+func serveWAFSettings(t *testing.T) map[string]string {
+	t.Helper()
+
+	return map[string]string{
+		listenAddr: localhost + ":0",
+		stateDir:   t.TempDir(),
+		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
+	}
+}
+
+func TestABanThroughOneSiteRefusesTheClientOnTheOther(t *testing.T) {
+	t.Parallel()
+
+	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
+	defer stop()
+
+	backend := "http://" + addr
+	first, firstOut := startRProxy(t, backend, startApp(t))
+	second, _ := startRProxy(t, backend, startApp(t))
+
+	wantStatus(t, first+"/", placed, http.StatusOK)
+	wantStatus(t, second+"/", placed, http.StatusOK)
+
+	// The default rule file bans a probe for this.
+	wantStatus(t, first+bannedProbe, placed, http.StatusForbidden)
+	wantStatus(t, second+"/", placed, http.StatusForbidden)
+	wantStatus(t, second+"/", otherClient, http.StatusOK)
+
+	// One request's three lines carry one id, rproxy's with servewaf's answer.
+	line := firstOut.line(t, "path", bannedProbe)
+	if line["disposition"] != proxy.DispositionDeny || line["client_ip"] != placed {
+		t.Errorf("rproxy's line is %v", line)
+	}
+
+	id, _ := line["request_id"].(string)
+	decision := serveWAFLine(t, serveWAFOut, id, "decision")
+	report := serveWAFLine(t, serveWAFOut, id, "report")
+
+	if decision["host"] != line["host"] || decision["client_ip"] != placed ||
+		report["status"] != float64(http.StatusForbidden) {
+		t.Errorf("servewaf's lines are %v and %v", decision, report)
+	}
+}
+
+// serveWAFLine waits for servewaf's line with request id and servewaf_line kind.
+func serveWAFLine(t *testing.T, out *output, id, kind string) map[string]any {
+	t.Helper()
+
+	deadline := time.Now().Add(waitLimit)
+	for time.Now().Before(deadline) {
+		line := out.findLine(t, func(fields map[string]any) bool {
+			return fields["request_id"] == id && fields["servewaf_line"] == kind
+		})
+		if line != nil {
+			return line
+		}
+
+		time.Sleep(pollInterval)
+	}
+
+	t.Fatalf("no %s line for %s in:\n%s", kind, id, out.text())
+
+	return nil
+}
+
+func TestTheSiteAnswersWhileServeWAFIsStoppedAndStartedAgain(t *testing.T) {
+	t.Parallel()
+
+	env := serveWAFSettings(t)
+	addr, _, stop := startServeWAF(t, env)
+	site, out := startRProxy(t, "http://"+addr, startApp(t))
+
+	// A visitor who keeps asking throughout, and is never refused.
+	visitorDone := make(chan struct{})
+	visitorStop := make(chan struct{})
+
+	var refused atomic.Int64
+
+	go func() {
+		defer close(visitorDone)
+
+		for {
+			select {
+			case <-visitorStop:
+				return
+			case <-time.After(pollInterval):
+			}
+
+			if !answersNormally(t.Context(), site+"/", otherClient) {
+				refused.Add(1)
+			}
+		}
+	}()
+
+	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
+	wantStatus(t, site+"/", placed, http.StatusForbidden)
+	stop()
+
+	// With servewaf down, the site answers, and rproxy says the default did it.
+	wantStatus(t, site+"/after-stop", placed, http.StatusOK)
+
+	line := out.line(t, "path", "/after-stop")
+	if line["disposition"] != proxy.DispositionAllow ||
+		line["default_disposition"] != true {
+		t.Errorf("rproxy's line is %v", line)
+	}
+
+	// Back at its address, with its state files, it applies the ban again.
+	restarted := maps.Clone(env)
+	restarted[listenAddr] = addr
+	_, _, stop = startServeWAF(t, restarted)
+
+	defer stop()
+
+	wantStatus(t, site+"/", placed, http.StatusForbidden)
+
+	close(visitorStop)
+	<-visitorDone
+
+	if refused.Load() != 0 {
+		t.Errorf("the site refused its visitor %d times", refused.Load())
+	}
+}
+
+// answersNormally reports whether a request to url from the client at from, as
+// X-Forwarded-For names it, gets the app's answer.
+func answersNormally(ctx context.Context, url, from string) bool {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
+	if err != nil {
+		return false
+	}
+
+	req.Header.Set("X-Forwarded-For", from)
+
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+
+	res, err := transport.RoundTrip(req)
+	if err != nil {
+		return false
+	}
+
+	body, err := io.ReadAll(res.Body)
+	_ = res.Body.Close()
+
+	return err == nil && res.StatusCode == http.StatusOK && string(body) == greeting
+}
+
+// sendRaw sends request, as it is, to rproxy at site, and returns the status of
+// the answer.
+func sendRaw(t *testing.T, site, request string) int {
+	t.Helper()
+
+	conn, err := (&net.Dialer{}).DialContext(t.Context(), "tcp",
+		strings.TrimPrefix(site, "http://"))
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+
+	defer func() {
+		_ = conn.Close()
+	}()
+
+	err = conn.SetDeadline(time.Now().Add(waitLimit))
+	if err != nil {
+		t.Fatalf("set the deadline: %v", err)
+	}
+
+	_, err = io.WriteString(conn, request)
+	if err != nil {
+		t.Fatalf("send: %v", err)
+	}
+
+	res, err := http.ReadResponse(bufio.NewReader(conn), nil)
+	if err != nil {
+		t.Fatalf("read the answer: %v", err)
+	}
+
+	_ = res.Body.Close()
+
+	return res.StatusCode
+}
+
+func TestAChunkedBodyStaysABodyAtServeWAF(t *testing.T) {
+	t.Parallel()
+
+	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
+	defer stop()
+
+	site, _ := startRProxy(t, "http://"+addr, startApp(t))
+
+	// Read as a further request, this body would ban otherClient on every site.
+	const smuggledID = "smuggled-request"
+
+	smuggled := "GET " + bannedProbe + " HTTP/1.1\r\nHost: site.example\r\n" +
+		proxy.ClientHeader + ": " + otherClient + "\r\n" +
+		"X-Request-ID: " + smuggledID + "\r\n\r\n"
+
+	status := sendRaw(t, site, "POST /upload HTTP/1.1\r\nHost: site.example\r\n"+
+		"X-Forwarded-For: "+placed+"\r\nTransfer-Encoding: chunked\r\n\r\n"+
+		strconv.FormatInt(int64(len(smuggled)), 16)+"\r\n"+smuggled+"\r\n0\r\n\r\n")
+	if status != http.StatusOK {
+		t.Errorf("status %d, want the app's 200", status)
+	}
+
+	// Read as a further request, it would act straight after the answer.
+	for range 20 {
+		wantStatus(t, site+"/", otherClient, http.StatusOK)
+		time.Sleep(pollInterval)
+	}
+
+	line := serveWAFOut.findLine(t, func(fields map[string]any) bool {
+		return fields["request_id"] == smuggledID
+	})
+	if line != nil {
+		t.Errorf("servewaf read the body as a request: %v", line)
+	}
+}
+
+func TestATargetThatCannotGoToServeWAFIsRefusedForABannedClient(t *testing.T) {
+	t.Parallel()
+
+	addr, _, stop := startServeWAF(t, serveWAFSettings(t))
+	defer stop()
+
+	site, out := startRProxy(t, "http://"+addr, startApp(t))
+
+	wantStatus(t, site+bannedProbe, placed, http.StatusForbidden)
+
+	status := sendRaw(t, site, "GET x:admin HTTP/1.1\r\nHost: site.example\r\n"+
+		"X-Forwarded-For: "+placed+"\r\n\r\n")
+	if status != http.StatusBadRequest {
+		t.Errorf("status %d, want 400", status)
+	}
+
+	line := out.line(t, "path", "admin")
+	if line["disposition"] != nil || line["default_disposition"] != nil {
+		t.Errorf("rproxy's line is %v, want no disposition", line)
+	}
+}
+
+func TestAClientWithAZoneIsTheClientWithout(t *testing.T) {
+	t.Parallel()
+
+	const zoned = "2001:db8::1%eth0"
+
+	addr, _, stop := startServeWAF(t, serveWAFSettings(t))
+	defer stop()
+
+	site, out := startRProxy(t, "http://"+addr, startApp(t))
+
+	wantStatus(t, site+bannedProbe, zoned, http.StatusForbidden)
+	wantStatus(t, site+"/", zoned, http.StatusForbidden)
+	wantStatus(t, site+"/", "2001:db8::1", http.StatusForbidden)
+
+	line := out.line(t, "path", bannedProbe)
+	if line["client_ip"] != "2001:db8::1" || line["default_disposition"] != nil {
+		t.Errorf("rproxy's line is %v", line)
+	}
+}
+
+func TestAStatusServeWAFDoesNotTakeIsReportedAs599(t *testing.T) {
+	t.Parallel()
+
+	const status = 799
+
+	app := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(status)
+		}))
+	t.Cleanup(app.Close)
+
+	addr, serveWAFOut, stop := startServeWAF(t, serveWAFSettings(t))
+	defer stop()
+
+	site, out := startRProxy(t, "http://"+addr, app.URL)
+
+	wantStatus(t, site+"/", placed, status)
+
+	line := out.line(t, "path", "/")
+	if line["status"] != float64(status) {
+		t.Errorf("rproxy's line is %v, want the status the visitor got", line)
+	}
+
+	id, _ := line["request_id"].(string)
+
+	report := serveWAFLine(t, serveWAFOut, id, "report")
+	if report["status"] != 599.0 {
+		t.Errorf("servewaf's line is %v, want status 599", report)
+	}
+}
+
+// startRProxyProcess runs `smallwebwaf rproxy` in a process of its own, with the
+// settings in env, each as NAME=value. It returns where rproxy listens, the
+// process, and what rproxy writes.
+func startRProxyProcess(t *testing.T, env ...string) (string, *exec.Cmd, *output) {
+	t.Helper()
+
+	binary, err := os.Executable()
+	if err != nil {
+		t.Fatalf("find the test binary: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
+	t.Cleanup(cancel)
+
+	out := &output{}
+	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
+	cmd.Stdout = out
+
+	cmd.Env = append(os.Environ(),
+		commandForMain+"=rproxy",
+		"SWRP_LISTEN_ADDR="+localhost+":0")
+	cmd.Env = append(cmd.Env, env...)
+
+	err = cmd.Start()
+	if err != nil {
+		t.Fatalf("start: %v", err)
+	}
+
+	t.Cleanup(func() {
+		_ = cmd.Process.Kill()
+		_ = cmd.Wait()
+	})
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+
+	return addr, cmd, out
+}
+
+func TestRProxyAsksAServeWAFThatSpeaksHTTP2OverHTTP1(t *testing.T) {
+	t.Parallel()
+
+	protocols := make(chan string, 10)
+	backend := httptest.NewUnstartedServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			if r.Header.Get(proxy.ClientHeader) != "" {
+				protocols <- r.Proto
+
+				w.Header().Set(proxy.DispositionHeader, proxy.DispositionDeny)
+				w.WriteHeader(http.StatusForbidden)
+			}
+		}))
+	backend.EnableHTTP2 = true
+	backend.StartTLS()
+	t.Cleanup(backend.Close)
+
+	// rproxy has no setting for the certificates it trusts, so it is told of this
+	// one as Go's client is told of any, in a process of its own.
+	certificates := filepath.Join(t.TempDir(), "servewaf.pem")
+
+	err := os.WriteFile(certificates, pem.EncodeToMemory(&pem.Block{
+		Type: "CERTIFICATE", Bytes: backend.Certificate().Raw,
+	}), 0o600)
+	if err != nil {
+		t.Fatalf("write the certificate: %v", err)
+	}
+
+	addr, _, _ := startRProxyProcess(t,
+		wafBackend+"="+backend.URL,
+		"SWRP_UPSTREAM_URL="+startApp(t),
+		"SSL_CERT_FILE="+certificates)
+
+	for name, headers := range map[string]string{
+		"no such header":      "",
+		"Upgrade":             "Upgrade: anything\r\n",
+		"Connection":          "Connection: anything\r\n",
+		"a WebSocket upgrade": "Connection: Upgrade\r\nUpgrade: websocket\r\n",
+	} {
+		status := sendRaw(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n"+headers+"\r\n")
+		if status != http.StatusForbidden {
+			t.Errorf("with %s: status %d, want servewaf's 403", name, status)
+		}
+
+		select {
+		case protocol := <-protocols:
+			if protocol != "HTTP/1.1" {
+				t.Errorf("with %s: asked over %s, want HTTP/1.1", name, protocol)
+			}
+		case <-time.After(waitLimit):
+			t.Errorf("with %s: servewaf was not asked", name)
+		}
+	}
+}
+
+func TestRProxyProcessLinesNameTheHostAndComeAtInfo(t *testing.T) {
+	t.Parallel()
+
+	hostname, err := os.Hostname()
+	if err != nil {
+		t.Fatalf("the host's name: %v", err)
+	}
+
+	// Nothing listens at the backend's address; no request asks it.
+	_, out := startRProxy(t, "http://127.0.0.1:9", startApp(t))
+
+	line := out.line(t, "msg", "starting")
+	if line["instance"] != hostname || line["level"] != "INFO" {
+		t.Errorf("rproxy's line is %v, want instance %s at INFO", line, hostname)
+	}
+}
+
+func TestRProxyStoppingWaitsForAReportBeingSent(t *testing.T) {
+	t.Parallel()
+
+	reportGotThere := make(chan struct{})
+	release := make(chan struct{})
+	backend := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			if r.Header.Get(proxy.ClientHeader) != "" {
+				w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
+
+				return
+			}
+
+			close(reportGotThere)
+			<-release
+			w.WriteHeader(http.StatusNoContent)
+		}))
+	t.Cleanup(backend.Close)
+
+	ctx, stop := context.WithCancel(t.Context())
+	defer stop()
+
+	env := map[string]string{
+		rproxyListenAddr:    localhost + ":0",
+		"SWRP_UPSTREAM_URL": startApp(t),
+		rproxyTimeout:       "60000",
+		wafBackend:          backend.URL,
+	}
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- runRProxy(ctx, env, out)
+	}()
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+
+	wantStatus(t, "http://"+addr+"/", placed, http.StatusOK)
+
+	select {
+	case <-reportGotThere:
+	case <-time.After(waitLimit):
+		t.Fatal("no report")
+	}
+
+	stop()
+
+	select {
+	case <-exited:
+		t.Error("rproxy stopped with a report on its way")
+		close(release)
+
+		return
+	case <-time.After(10 * pollInterval):
+	}
+
+	close(release)
+
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+		}
+	case <-time.After(waitLimit):
+		t.Error("rproxy still running, the report having been answered")
+	}
+}
+
+// sendAndKeepOpen sends request to rproxy at addr, and returns the connection. A
+// read from it ends with an error once waitLimit is up.
+func sendAndKeepOpen(t *testing.T, addr, request string) net.Conn {
+	t.Helper()
+
+	conn, err := (&net.Dialer{}).DialContext(t.Context(), "tcp", addr)
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+
+	t.Cleanup(func() {
+		_ = conn.Close()
+	})
+
+	err = conn.SetDeadline(time.Now().Add(waitLimit))
+	if err != nil {
+		t.Fatalf("set the deadline: %v", err)
+	}
+
+	_, err = io.WriteString(conn, request)
+	if err != nil {
+		t.Fatalf("send: %v", err)
+	}
+
+	return conn
+}
+
+func TestRProxyStoppingCutsOffARequestAfterFiveSeconds(t *testing.T) {
+	t.Parallel()
+
+	const (
+		cutOffAfter     = 5 * time.Second
+		upstreamSetting = "SWRP_UPSTREAM_URL"
+	)
+
+	asked := make(chan struct{})
+	release := make(chan struct{})
+	app := httptest.NewServer(http.HandlerFunc(
+		func(http.ResponseWriter, *http.Request) {
+			close(asked)
+			<-release
+		}))
+	t.Cleanup(app.Close)
+	t.Cleanup(func() { close(release) })
+
+	backend := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set(proxy.DispositionHeader, proxy.DispositionAllow)
+		}))
+	t.Cleanup(backend.Close)
+
+	ctx, stop := context.WithCancel(t.Context())
+	defer stop()
+
+	env := map[string]string{
+		rproxyListenAddr: localhost + ":0",
+		upstreamSetting:  app.URL,
+		wafBackend:       backend.URL,
+	}
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- runRProxy(ctx, env, out)
+	}()
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	conn := sendAndKeepOpen(t, addr, "GET / HTTP/1.1\r\nHost: site.example\r\n\r\n")
+
+	select {
+	case <-asked:
+	case <-time.After(waitLimit):
+		t.Fatal("the app was not asked")
+	}
+
+	stopped := time.Now()
+
+	stop()
+
+	text, err := io.ReadAll(conn)
+	if err != nil || len(text) != 0 {
+		t.Errorf("read %q (%v), want the connection cut off", text, err)
+	}
+
+	if elapsed := time.Since(stopped); elapsed < cutOffAfter {
+		t.Errorf("cut off after %s, want %s", elapsed, cutOffAfter)
+	}
+
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Errorf("rproxy's exit status %d, want 0; output:\n%s", status, out.text())
+		}
+	case <-time.After(waitLimit):
+		t.Error("rproxy still running after the cut-off")
+	}
+
+	out.line(t, "msg", "requests still in progress were cut off")
+}
+
+func TestRProxyInvalidSettingStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name, setting string
+		env           map[string]string
+	}{
+		{"no backend", wafBackend, nil},
+		{
+			"another invalid", rproxyTimeout,
+			map[string]string{wafBackend: "http://servewaf:8080", rproxyTimeout: "soon"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			out := &output{}
+
+			if status := runRProxy(t.Context(), tc.env, out); status != 1 {
+				t.Errorf("exit status %d, want 1", status)
+			}
+
+			line := out.line(t, "msg", "invalid setting")
+			message, _ := line["error"].(string)
+
+			if !strings.HasPrefix(message, tc.setting+": ") {
+				t.Errorf("start refused with %v, want it to name %s", line, tc.setting)
+			}
+		})
+	}
+}
+
+func TestRProxyAddressInUseStopsTheStart(t *testing.T) {
+	t.Parallel()
+
+	taken, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	defer func() {
+		_ = taken.Close()
+	}()
+
+	out := &output{}
+
+	status := runRProxy(t.Context(), map[string]string{
+		wafBackend:       "http://servewaf:8080",
+		rproxyListenAddr: taken.Addr().String(),
+	}, out)
+	if status != 1 {
+		t.Errorf("exit status %d, want 1", status)
+	}
+
+	out.line(t, "msg", "cannot listen on SWRP_LISTEN_ADDR")
+}
+
+func TestMainRunsRProxy(t *testing.T) {
+	t.Parallel()
+
+	// Nothing listens there; the health check does not ask.
+	addr, cmd, out := startRProxyProcess(t, wafBackend+"=http://127.0.0.1:9")
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
+		"http://"+addr+proxy.HealthPath, http.NoBody)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+
+	res, err := transport.RoundTrip(req)
+	if err != nil {
+		t.Fatalf("health check: %v", err)
+	}
+
+	body, err := io.ReadAll(res.Body)
+	_ = res.Body.Close()
+
+	if err != nil || string(body) != "ok\n" {
+		t.Errorf("health check answered %q (%v)", body, err)
+	}
+
+	err = cmd.Process.Signal(syscall.SIGTERM)
+	if err != nil {
+		t.Fatalf("signal: %v", err)
+	}
+
+	err = cmd.Wait()
+	if err != nil {
+		t.Errorf("exit: %v; output:\n%s", err, out.text())
+	}
+}

internal/smallwebwaf/servewaf_test.go

@@ -0,0 +1,204 @@
+package smallwebwaf_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
+	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
+)
+
+// commandForMain, while set in the environment, has this test binary run Main
+// with the command it gives, in place of the tests, so that a test can run
+// Main in a process of its own.
+const commandForMain = "SMALLWEBWAF_TEST_COMMAND"
+
+func TestMain(m *testing.M) {
+	command, set := os.LookupEnv(commandForMain)
+	if !set {
+		os.Exit(m.Run())
+	}
+
+	os.Args = strings.Fields("smallwebwaf " + command)
+
+	os.Exit(smallwebwaf.Main(testVersion))
+}
+
+func TestMainRunsServeWAF(t *testing.T) {
+	t.Parallel()
+
+	binary, err := os.Executable()
+	if err != nil {
+		t.Fatalf("find the test binary: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(t.Context(), 3*waitLimit)
+	defer cancel()
+
+	out := &output{}
+	cmd := exec.CommandContext(ctx, binary) //nolint:gosec // this test binary
+	cmd.Stdout = out
+
+	cmd.Env = append(os.Environ(),
+		commandForMain+"="+serveWAFCommand,
+		listenAddr+"="+localhost+":0",
+		stateDir+"="+t.TempDir(),
+		rulesDir+"="+t.TempDir(),
+		lookupSource+"=off")
+
+	err = cmd.Start()
+	if err != nil {
+		t.Fatalf("start: %v", err)
+	}
+
+	t.Cleanup(func() {
+		_ = cmd.Process.Kill()
+		_ = cmd.Wait()
+	})
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
+
+	err = cmd.Process.Signal(syscall.SIGTERM)
+	if err != nil {
+		t.Fatalf("signal: %v", err)
+	}
+
+	err = cmd.Wait()
+	if err != nil {
+		t.Errorf("exit: %v; output:\n%s", err, out.text())
+	}
+}
+
+func TestMainWithoutACommandItKnowsPrintsTheCommands(t *testing.T) {
+	t.Parallel()
+
+	binary, err := os.Executable()
+	if err != nil {
+		t.Fatalf("find the test binary: %v", err)
+	}
+
+	for _, command := range []string{"", "serve"} {
+		t.Run("command "+command, func(t *testing.T) {
+			t.Parallel()
+
+			ctx, cancel := context.WithTimeout(t.Context(), waitLimit)
+			defer cancel()
+
+			var stdout, stderr bytes.Buffer
+
+			cmd := exec.CommandContext(ctx, binary)
+			cmd.Stdout, cmd.Stderr = &stdout, &stderr
+
+			cmd.Env = append(os.Environ(), commandForMain+"="+command)
+
+			err := cmd.Run()
+
+			if code := cmd.ProcessState.ExitCode(); code != 2 {
+				t.Errorf("exit status %d (%v), want 2", code, err)
+			}
+
+			for _, name := range []string{"rproxy", serveWAFCommand, "healthcheck"} {
+				if !strings.Contains(stderr.String(), name) {
+					t.Errorf("stderr %q does not name %s", stderr.String(), name)
+				}
+			}
+
+			if stdout.Len() != 0 {
+				t.Errorf("stdout %q, want nothing", stdout.String())
+			}
+		})
+	}
+}
+
+// ask sends servewaf at addr rproxy's question about a request for path from
+// placed, checks the answer's status and disposition, and closes it.
+func ask(t *testing.T, addr, path string, status int, disposition string) {
+	t.Helper()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet,
+		"http://"+addr+path, http.NoBody)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+
+	req.Header.Set(proxy.ClientHeader, placed)
+	req.Header.Set("X-Request-ID", rand.Text())
+
+	transport := &http.Transport{}
+	defer transport.CloseIdleConnections()
+
+	res, err := (&http.Client{Transport: transport}).Do(req)
+	if err != nil {
+		t.Fatalf("question: %v", err)
+	}
+
+	_, _ = io.Copy(io.Discard, res.Body)
+	_ = res.Body.Close()
+
+	if res.StatusCode != status ||
+		res.Header.Get(proxy.DispositionHeader) != disposition {
+		t.Errorf("answered %d with disposition %q, want %d with %q", res.StatusCode,
+			res.Header.Get(proxy.DispositionHeader), status, disposition)
+	}
+}
+
+// runServeWAF runs `smallwebwaf servewaf` with the settings in env, has use
+// send it requests at the address it listens on, stops it as SIGTERM does, and
+// checks that it stopped in order.
+func runServeWAF(t *testing.T, env map[string]string, use func(addr string)) {
+	t.Helper()
+
+	ctx, stop := context.WithCancel(t.Context())
+	out := &output{}
+	exited := make(chan int, 1)
+
+	go func() {
+		exited <- run(ctx, env, out)
+	}()
+
+	addr, _ := out.line(t, "msg", "starting")["address"].(string)
+	use(addr)
+	stop()
+
+	select {
+	case status := <-exited:
+		if status != 0 {
+			t.Fatalf("exit status %d, want 0; output:\n%s", status, out.text())
+		}
+	case <-time.After(waitLimit):
+		t.Fatal("still running after being told to stop")
+	}
+
+	out.line(t, "msg", "stopped")
+}
+
+func TestServeWAFKeepsItsBansAcrossARestartAndNeedsNoApp(t *testing.T) {
+	t.Parallel()
+
+	env := map[string]string{
+		listenAddr: localhost + ":0",
+		stateDir:   t.TempDir(),
+		rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
+	}
+
+	runServeWAF(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusOK, proxy.DispositionAllow)
+		// The default rule file bans a probe for this.
+		ask(t, addr, "/.env", http.StatusForbidden, proxy.DispositionDeny)
+	})
+
+	runServeWAF(t, env, func(addr string) {
+		ask(t, addr, "/", http.StatusForbidden, proxy.DispositionDeny)
+	})
+}

internal/smallwebwaf/smallwebwaf.go

@@ -1,12 +1,16 @@
-// Package smallwebwaf runs the smallwebwaf process: it reads the settings,
-// the rule files, the lookup database and the state files, serves requests
-// until it is told to stop, and then stops in an orderly way, writing the
-// state files.
+// Package smallwebwaf runs the smallwebwaf process, as the command it is given.
+// `smallwebwaf servewaf` reads the settings, the rule files, the lookup database
+// and the state files, answers rproxy's questions until it is told to stop, and
+// then stops in an orderly way, writing the state files. `smallwebwaf rproxy`
+// reads rproxy's settings alone, and runs the reverse proxy in front of one app
+// that asks servewaf about each request. `smallwebwaf healthcheck` is the
+// container's health check.
 package smallwebwaf
 
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"log/slog"
 	"net"
@@ -32,12 +36,25 @@ import (
 // runit and docker wait a little longer before they kill the process.
 const shutdownTimeout = 5 * time.Second
 
-// remoteLogStopTimeout is how long, as smallwebwaf stops, the log lines
-// still waiting are sent to SWWAF_LOG_REMOTE_URL before they are given
-// up. stdout has carried them.
+// remoteLogStopTimeout is how long, as servewaf stops, the log lines still
+// waiting are sent to SWWAF_LOG_REMOTE_URL before they are given up. stdout has
+// carried them.
 const remoteLogStopTimeout = 2 * time.Second
 
-// Params are what Run needs from the process.
+// usageStatus is the exit status with no command, or one smallwebwaf does not
+// know.
+const usageStatus = 2
+
+// usage is what smallwebwaf prints then.
+const usage = `usage: smallwebwaf <command>
+
+commands:
+  rproxy       the reverse proxy in front of one app
+  servewaf     decides for rproxy, and keeps bans, counters and history
+  healthcheck  the container's health check
+`
+
+// Params are what RunServeWAF and RunRProxy need from the process.
 type Params struct {
 	// Version is the version of the binary, set when it is built.
 	Version string
@@ -47,29 +64,45 @@ type Params struct {
 	Stdout io.Writer
 }
 
-// Main runs smallwebwaf until SIGTERM or SIGINT, and returns the
-// process's exit status. Run as `smallwebwaf healthcheck`, it is the
-// container's health check instead.
+// Main runs the command os.Args names, and returns the process's exit status.
+// `smallwebwaf rproxy` and `smallwebwaf servewaf` run until SIGTERM or SIGINT.
+// With no command, or one it does not know, it prints the commands and returns
+// usageStatus.
 func Main(version string) int {
-	if len(os.Args) > 1 && os.Args[1] == "healthcheck" {
-		return HealthCheck(context.Background(), os.Args[2:], os.LookupEnv, os.Stderr)
+	args := os.Args[1:]
+	if len(args) == 0 {
+		return printUsage(os.Stderr)
 	}
 
 	ctx, stop := signal.NotifyContext(context.Background(),
 		syscall.SIGTERM, os.Interrupt)
 	defer stop()
 
-	return Run(ctx, Params{
-		Version:   version,
-		LookupEnv: os.LookupEnv,
-		Stdout:    os.Stdout,
-	})
+	params := Params{Version: version, LookupEnv: os.LookupEnv, Stdout: os.Stdout}
+
+	switch args[0] {
+	case "rproxy":
+		return RunRProxy(ctx, params)
+	case "servewaf":
+		return RunServeWAF(ctx, params)
+	case "healthcheck":
+		return HealthCheck(ctx, args[1:], os.LookupEnv, os.Stderr)
+	default:
+		return printUsage(os.Stderr)
+	}
 }
 
-// Run reads the settings, the rule files, the lookup database and the
-// state files, then serves requests until ctx is done. It returns the
-// process's exit status, 1 when smallwebwaf cannot start.
-func Run(ctx context.Context, params Params) int {
+// printUsage writes the commands to w, and returns usageStatus.
+func printUsage(w io.Writer) int {
+	_, _ = fmt.Fprint(w, usage)
+
+	return usageStatus
+}
+
+// RunServeWAF is `smallwebwaf servewaf`: it reads the settings, the rule files,
+// the lookup database and the state files, then serves requests until ctx is
+// done. It returns the process's exit status, 1 when servewaf cannot start.
+func RunServeWAF(ctx context.Context, params Params) int {
 	// Until the settings are read, the one message is an invalid setting's
 	// error, which every SWWAF_LOG_LEVEL lets through.
 	processLog := requestlog.NewProcessLogger(params.Stdout,
@@ -151,9 +184,9 @@ func Run(ctx context.Context, params Params) int {
 	return serve(ctx, server, listener, files, ruleFiles, alertQueue, processLog)
 }
 
-// newServer returns the server smallwebwaf runs, with the metrics of the
-// alerts, after reading the lookup database while SWWAF_LOOKUP_SOURCE is
-// file. A lookup database that cannot be read is an error.
+// newServer returns the server servewaf runs, with the metrics of the alerts,
+// after reading the lookup database while SWWAF_LOOKUP_SOURCE is file. A lookup
+// database that cannot be read is an error.
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
@@ -174,7 +207,7 @@ func newServer(
 		}
 	}
 
-	server := proxy.New(proxy.Params{
+	server := proxy.NewServeWAF(proxy.Params{
 		Config:       cfg,
 		RequestLog:   stdout,
 		ProcessLog:   processLog,
@@ -338,12 +371,10 @@ func serve(
 
 	// Run and Watch have ended, so nothing else reads or writes the
 	// files, and no alert is being sent, so that alerts.json keeps every
-	// alert not yet sent. Every request has ended too, but for two kinds
-	// that Go's server does not wait for: one cut off because Shutdown
-	// timed out, and one whose connection switched protocols, such as a
-	// WebSocket. Such a request adds to its client's history only as it
-	// ends, which can be after this write, and then that request is
-	// missing from clients.json.
+	// alert not yet sent. Every request has ended too, but for one cut off
+	// because Shutdown timed out, which adds to its client's history only as
+	// it ends. That can be after this write, and then that request is missing
+	// from clients.json.
 	<-written
 	<-watched
 	<-rulesWatched

internal/smallwebwaf/smallwebwaf_test.go

@@ -3,6 +3,7 @@ package smallwebwaf_test
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"encoding/json"
 	"io"
 	"net"
@@ -19,6 +20,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
+	"sneak.berlin/go/smallwebwaf/internal/proxy"
 	"sneak.berlin/go/smallwebwaf/internal/smallwebwaf"
 )
 
@@ -32,8 +34,6 @@ const (
 	// localhost is where the tests listen.
 	localhost            = "127.0.0.1"
 	listenAddr           = "SWWAF_LISTEN_ADDR"
-	upstreamURL          = "SWWAF_UPSTREAM_URL"
-	trustedProxies       = "SWWAF_TRUSTED_PROXIES"
 	stateDir             = "SWWAF_STATE_DIR"
 	stateWriteDelay      = "SWWAF_STATE_WRITE_DELAY"
 	stateCounterInterval = "SWWAF_STATE_COUNTER_INTERVAL"
@@ -76,21 +76,11 @@ func (o *output) line(t *testing.T, key, value string) map[string]any {
 
 	deadline := time.Now().Add(waitLimit)
 	for time.Now().Before(deadline) {
-		o.mu.Lock()
-		text := o.buf.String()
-		o.mu.Unlock()
-
-		for line := range strings.Lines(text) {
-			var fields map[string]any
-
-			err := json.Unmarshal([]byte(line), &fields)
-			if err != nil {
-				t.Fatalf("output line %q is not JSON: %v", line, err)
-			}
-
-			if fields[key] == value {
-				return fields
-			}
+		fields := o.findLine(t, func(fields map[string]any) bool {
+			return fields[key] == value
+		})
+		if fields != nil {
+			return fields
 		}
 
 		time.Sleep(pollInterval)
@@ -101,6 +91,29 @@ func (o *output) line(t *testing.T, key, value string) map[string]any {
 	return nil
 }
 
+// findLine returns the first line written so far for which matches is true, or
+// nil.
+func (o *output) findLine(
+	t *testing.T, matches func(map[string]any) bool,
+) map[string]any {
+	t.Helper()
+
+	for line := range strings.Lines(o.text()) {
+		var fields map[string]any
+
+		err := json.Unmarshal([]byte(line), &fields)
+		if err != nil {
+			t.Fatalf("output line %q is not JSON: %v", line, err)
+		}
+
+		if matches(fields) {
+			return fields
+		}
+	}
+
+	return nil
+}
+
 // text returns everything written so far.
 func (o *output) text() string {
 	o.mu.Lock()
@@ -109,11 +122,11 @@ func (o *output) text() string {
 	return o.buf.String()
 }
 
-// run runs smallwebwaf with the settings in env until ctx is done, and
-// returns its exit status. SWWAF_LOOKUP_SOURCE is off unless env sets it,
+// run runs `smallwebwaf servewaf` with the settings in env until ctx is done,
+// and returns its exit status. SWWAF_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
-	return smallwebwaf.Run(ctx, smallwebwaf.Params{
+	return smallwebwaf.RunServeWAF(ctx, smallwebwaf.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
@@ -133,8 +146,8 @@ func TestInvalidSettingStopsTheStart(t *testing.T) {
 	out := &output{}
 
 	status := run(t.Context(), map[string]string{
-		"SWWAF_REQUEST_MAX_BYTES": "lots",
-		instanceName:              instance,
+		"SWWAF_BYTES_LIMIT_PER_MINUTE": "lots",
+		instanceName:                   instance,
 	}, out)
 	if status != 1 {
 		t.Errorf("exit status %d, want 1", status)
@@ -145,7 +158,7 @@ func TestInvalidSettingStopsTheStart(t *testing.T) {
 
 	if line["type"] != "process" || line["instance"] != instance ||
 		line["level"] != "ERROR" ||
-		!strings.HasPrefix(message, "SWWAF_REQUEST_MAX_BYTES: ") {
+		!strings.HasPrefix(message, "SWWAF_BYTES_LIMIT_PER_MINUTE: ") {
 		t.Errorf("start refused with %v", line)
 	}
 }
@@ -207,7 +220,6 @@ func TestAddressInUseStopsTheStart(t *testing.T) {
 func TestServesUntilToldToStop(t *testing.T) {
 	t.Parallel()
 
-	appURL := startApp(t)
 	dir := t.TempDir()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -216,10 +228,9 @@ func TestServesUntilToldToStop(t *testing.T) {
 
 	go func() {
 		exited <- run(ctx, map[string]string{
-			listenAddr:  localhost + ":0",
-			upstreamURL: appURL,
-			stateDir:    dir,
-			rulesDir:    filepath.Join("..", "..", "share", "rules.d"),
+			listenAddr: localhost + ":0",
+			stateDir:   dir,
+			rulesDir:   filepath.Join("..", "..", "share", "rules.d"),
 		}, out)
 	}()
 
@@ -229,10 +240,10 @@ func TestServesUntilToldToStop(t *testing.T) {
 	}
 
 	starting := out.line(t, "msg", "starting")
-	wantStartingLine(t, starting, appURL, dir)
+	wantStartingLine(t, starting, dir)
 
 	addr, _ := starting["address"].(string)
-	wantGreeting(t, "http://"+addr+"/")
+	wantAllowed(t, "http://"+addr+"/")
 	out.line(t, "type", "request")
 
 	stop()
@@ -304,7 +315,6 @@ func TestEveryLogLineAndMetricCarriesTheInstanceName(t *testing.T) {
 
 	env := map[string]string{
 		listenAddr:   localhost + ":0",
-		upstreamURL:  startApp(t),
 		stateDir:     t.TempDir(),
 		rulesDir:     t.TempDir(),
 		metricsToken: token,
@@ -342,7 +352,6 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 
 	env := map[string]string{
 		listenAddr:      localhost + ":0",
-		upstreamURL:     startApp(t),
 		stateDir:        t.TempDir(),
 		rulesDir:        t.TempDir(),
 		rateLimitPerDay: "2",
@@ -354,8 +363,8 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 
 	// The two requests a day allows, and a stop.
 	runUntilStopped(t, env, func(url string) {
-		wantGreeting(t, url)
-		wantGreeting(t, url)
+		wantAllowed(t, url)
+		wantAllowed(t, url)
 	})
 
 	// After a restart the client has no fresh allowance: its third
@@ -379,10 +388,8 @@ func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
 
 	env := map[string]string{
 		listenAddr:      localhost + ":0",
-		upstreamURL:     startApp(t),
 		stateDir:        t.TempDir(),
 		rulesDir:        t.TempDir(),
-		trustedProxies:  localhost + "/32",
 		rateLimitPerDay: "1",
 		scope:           "24",
 	}
@@ -426,11 +433,9 @@ func TestBanAddedAndLiftedByEditingBansJSON(t *testing.T) {
 
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr:     localhost + ":0",
-		upstreamURL:    startApp(t),
-		stateDir:       dir,
-		rulesDir:       t.TempDir(),
-		trustedProxies: localhost + "/32",
+		listenAddr: localhost + ":0",
+		stateDir:   dir,
+		rulesDir:   t.TempDir(),
 		// No write comes due in the test, so only the watch on the
 		// directory can take the edits in.
 		stateWriteDelay:      "1h",
@@ -451,12 +456,10 @@ func TestBanAddedAndLiftedThroughTheEndpointsKeptInBansJSON(t *testing.T) {
 
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr:     localhost + ":0",
-		upstreamURL:    startApp(t),
-		stateDir:       dir,
-		rulesDir:       t.TempDir(),
-		trustedProxies: localhost + "/32",
-		adminToken:     adminSecret,
+		listenAddr: localhost + ":0",
+		stateDir:   dir,
+		rulesDir:   t.TempDir(),
+		adminToken: adminSecret,
 		// Neither comes due in the test: the files are written as
 		// smallwebwaf stops.
 		stateWriteDelay:      "1h",
@@ -496,17 +499,16 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 
 	dir := t.TempDir()
 	env := map[string]string{
-		listenAddr:  localhost + ":0",
-		upstreamURL: startApp(t),
-		stateDir:    t.TempDir(),
-		rulesDir:    dir,
+		listenAddr: localhost + ":0",
+		stateDir:   t.TempDir(),
+		rulesDir:   dir,
 		// The requests sent until the rule takes effect must not break a
 		// rate limit, whose ban would refuse them too.
 		"SWWAF_RATE_LIMIT_PER_MINUTE": "off",
 	}
 
 	out := runUntilStopped(t, env, func(url string) {
-		wantGreeting(t, url)
+		wantAllowed(t, url)
 
 		// Written once: each change would start the rule files' wait
 		// again. A file written before smallwebwaf watches the directory is
@@ -559,10 +561,8 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 
 	env := map[string]string{
 		listenAddr:               localhost + ":0",
-		upstreamURL:              startApp(t),
 		stateDir:                 t.TempDir(),
 		rulesDir:                 t.TempDir(),
-		trustedProxies:           localhost + "/32",
 		metricsToken:             token,
 		instanceName:             instance,
 		lookupSource:             "file",
@@ -658,10 +658,8 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 	dir := t.TempDir()
 	env := map[string]string{
 		listenAddr:             localhost + ":0",
-		upstreamURL:            startApp(t),
 		stateDir:               dir,
 		rulesDir:               t.TempDir(),
-		trustedProxies:         localhost + "/32",
 		metricsToken:           token,
 		instanceName:           instance,
 		"SWWAF_BLOCKLIST_URLS": torURL,
@@ -742,10 +740,8 @@ func TestCrowdSecDecisionListKeptInReputationJSONAcrossARestart(t *testing.T) {
 	dir := t.TempDir()
 	env := map[string]string{
 		listenAddr:                localhost + ":0",
-		upstreamURL:               startApp(t),
 		stateDir:                  dir,
 		rulesDir:                  t.TempDir(),
-		trustedProxies:            localhost + "/32",
 		"SWWAF_CROWDSEC_LAPI_URL": engine.URL,
 		"SWWAF_CROWDSEC_LAPI_KEY": bouncerKey,
 	}
@@ -843,14 +839,13 @@ func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
 
 	env := map[string]string{
 		listenAddr:             localhost + ":0",
-		upstreamURL:            startApp(t),
 		stateDir:               t.TempDir(),
 		rulesDir:               t.TempDir(),
 		"SWWAF_LOG_REMOTE_URL": "syslog+tcp://" + endpoint.Addr().String(),
 	}
 
 	out := runUntilStopped(t, env, func(url string) {
-		wantGreeting(t, url)
+		wantAllowed(t, url)
 	})
 	out.line(t, "type", "request")
 
@@ -899,7 +894,6 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 
 	env := map[string]string{
 		listenAddr:                localhost + ":0",
-		upstreamURL:               startApp(t),
 		stateDir:                  t.TempDir(),
 		rulesDir:                  t.TempDir(),
 		"SWWAF_LOG_REMOTE_URL":    "syslog+tls://" + endpoint.Addr().String(),
@@ -909,7 +903,7 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 	}
 
 	out := runUntilStopped(t, env, func(url string) {
-		wantGreeting(t, url)
+		wantAllowed(t, url)
 
 		// More than one line has been written, and the buffer holds the
 		// last.
@@ -959,7 +953,6 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 	dir := t.TempDir()
 	env := map[string]string{
 		listenAddr:                    localhost + ":0",
-		upstreamURL:                   startApp(t),
 		stateDir:                      dir,
 		rulesDir:                      rules,
 		"SWWAF_ALERT_WEBHOOK_URL":     webhook.url,
@@ -1044,10 +1037,8 @@ func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
 	slack, ntfy := startDestination(t), startDestination(t)
 	env := map[string]string{
 		listenAddr:      localhost + ":0",
-		upstreamURL:     startApp(t),
 		stateDir:        t.TempDir(),
 		rulesDir:        t.TempDir(),
-		trustedProxies:  localhost + "/32",
 		rateLimitPerDay: "1",
 		// The metrics are read from 127.0.0.1, which no limit counts.
 		"SWWAF_ALLOW_NETS":              localhost + "/32",
@@ -1187,8 +1178,8 @@ func startApp(t *testing.T) string {
 	return app.URL
 }
 
-// runUntilStopped runs smallwebwaf with the settings in env, has use send
-// it requests at url, then stops it as SIGTERM does, checks that it
+// runUntilStopped runs `smallwebwaf servewaf` with the settings in env, has use
+// send it requests at url, then stops it as SIGTERM does, checks that it
 // stopped in order, and returns its output.
 func runUntilStopped(
 	t *testing.T, env map[string]string, use func(url string),
@@ -1221,43 +1212,33 @@ func runUntilStopped(
 
 // wantStartingLine checks that the line at start gives the version and
 // every setting's value.
-func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
+func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 	t.Helper()
 
 	settings, _ := line["settings"].(map[string]any)
 	want := map[string]any{
-		listenAddr:                              localhost + ":0",
-		upstreamURL:                             appURL,
-		stateDir:                                dir,
-		"SWWAF_MODE":                            "enforce",
-		stateWriteDelay:                         "10s",
-		stateCounterInterval:                    "15m",
-		trustedProxies:                          "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16",
-		"SWWAF_CLIENT_REQUEST_TIMEOUT":          "60s",
-		"SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES": "32K",
-		"SWWAF_CLIENT_IDLE_TIMEOUT":             "120s",
-		"SWWAF_CLIENT_RESPONSE_TIMEOUT":         "30m",
-		"SWWAF_UPSTREAM_REQUEST_TIMEOUT":        "60s",
-		"SWWAF_UPSTREAM_RESPONSE_TIMEOUT":       "30m",
-		"SWWAF_REQUEST_MAX_BYTES":               "100M",
-		"SWWAF_RESPONSE_MAX_BYTES":              "1G",
-		"SWWAF_ALLOW_NETS":                      "",
-		rateLimitExemptNets:                     "",
-		"SWWAF_DENY_NETS":                       "",
-		"SWWAF_RATE_LIMIT_PER_MINUTE":           "6000",
-		"SWWAF_RATE_LIMIT_PER_HOUR":             "100000",
-		rateLimitPerDay:                         "1000000",
-		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":         "",
-		"SWWAF_DENIED_COUNTRIES":                "",
-		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES":   "",
-		"SWWAF_BAN_RESPONSE":                    "403",
-		"SWWAF_LIMIT_BAN_DURATION":              "1h",
-		"SWWAF_LIMIT_BAN_REPEAT_WINDOW":         "24h",
-		"SWWAF_MAX_BAN_DURATION":                "7d",
-		"SWWAF_ATTACK_BAN_DURATION":             "7d",
-		"SWWAF_MAX_BANS":                        "5000",
-		"SWWAF_BAN_SCOPE_V4_PREFIX":             "32",
-		"SWWAF_RULES_ENABLED":                   "true",
+		listenAddr:                            localhost + ":0",
+		stateDir:                              dir,
+		"SWWAF_MODE":                          "enforce",
+		stateWriteDelay:                       "10s",
+		stateCounterInterval:                  "15m",
+		"SWWAF_ALLOW_NETS":                    "",
+		rateLimitExemptNets:                   "",
+		"SWWAF_DENY_NETS":                     "",
+		"SWWAF_RATE_LIMIT_PER_MINUTE":         "500",
+		"SWWAF_RATE_LIMIT_PER_HOUR":           "20000",
+		rateLimitPerDay:                       "300000",
+		"SWWAF_RATE_LIMIT_EXEMPT_PATHS":       "",
+		"SWWAF_DENIED_COUNTRIES":              "",
+		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES": "",
+		"SWWAF_BAN_RESPONSE":                  "403",
+		"SWWAF_LIMIT_BAN_DURATION":            "1h",
+		"SWWAF_LIMIT_BAN_REPEAT_WINDOW":       "24h",
+		"SWWAF_MAX_BAN_DURATION":              "7d",
+		"SWWAF_ATTACK_BAN_DURATION":           "7d",
+		"SWWAF_MAX_BANS":                      "5000",
+		"SWWAF_BAN_SCOPE_V4_PREFIX":           "32",
+		"SWWAF_RULES_ENABLED":                 "true",
 	}
 
 	for name, value := range want {
@@ -1271,30 +1252,11 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL, dir string) {
 	}
 }
 
-// wantGreeting checks that a request to url gets the app's answer.
-func wantGreeting(t *testing.T, url string) {
+// wantAllowed checks that servewaf at url allows a request from localhost.
+func wantAllowed(t *testing.T, url string) {
 	t.Helper()
 
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
-		http.NoBody)
-	if err != nil {
-		t.Fatalf("new request: %v", err)
-	}
-
-	transport := &http.Transport{}
-	defer transport.CloseIdleConnections()
-
-	res, err := (&http.Client{Transport: transport}).Do(req)
-	if err != nil {
-		t.Fatalf("request: %v", err)
-	}
-
-	body, err := io.ReadAll(res.Body)
-	_ = res.Body.Close()
-
-	if err != nil || string(body) != greeting {
-		t.Errorf("got %q (%v), want the app's answer", body, err)
-	}
+	wantStatus(t, url, localhost, http.StatusOK)
 }
 
 // messages returns the message of each record in received, octet-counted
@@ -1475,34 +1437,16 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 	return file.Bans[0]
 }
 
-// wantRefused checks that a request to url is refused with 403, the
-// default SWWAF_BAN_RESPONSE.
+// wantRefused checks that servewaf at url refuses a request from localhost with
+// 403, the default SWWAF_BAN_RESPONSE.
 func wantRefused(t *testing.T, url string) {
 	t.Helper()
 
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url,
-		http.NoBody)
-	if err != nil {
-		t.Fatalf("new request: %v", err)
-	}
-
-	transport := &http.Transport{}
-	defer transport.CloseIdleConnections()
-
-	res, err := (&http.Client{Transport: transport}).Do(req)
-	if err != nil {
-		t.Fatalf("request: %v", err)
-	}
-
-	_ = res.Body.Close()
-
-	if res.StatusCode != http.StatusForbidden {
-		t.Errorf("status %d, want %d", res.StatusCode, http.StatusForbidden)
-	}
+	wantStatus(t, url, localhost, http.StatusForbidden)
 }
 
-// wantStatus checks that a request to url from the client at from, as
-// X-Forwarded-For names it, is answered with status.
+// wantStatus checks that a request to url from the client at from, as statusFrom
+// sends it, is answered with status.
 func wantStatus(t *testing.T, url, from string, status int) {
 	t.Helper()
 
@@ -1669,8 +1613,10 @@ func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost
 	}
 }
 
-// statusFrom returns the status a request to url from the client at
-// from, as X-Forwarded-For names it, is answered with.
+// statusFrom returns the status a request to url from the client at from is
+// answered with. The request serves rproxy and servewaf alike. rproxy reads the
+// client from X-Forwarded-For, and replaces the other two headers. To servewaf,
+// they make it a question about that client.
 func statusFrom(t *testing.T, url, from string) int {
 	t.Helper()
 
@@ -1681,6 +1627,8 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 
 	req.Header.Set("X-Forwarded-For", from)
+	req.Header.Set(proxy.ClientHeader, from)
+	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}
 	defer transport.CloseIdleConnections()

internal/state/state_test.go

@@ -648,6 +648,27 @@ func TestClientWithRefusalsInTheMinuteWithoutTheirStartStopsTheStart(t *testing.
 		`: entry 1 has no "minute_refusals.start"`)
 }
 
+func TestClientsJSONFromAnEarlierVersionWithTokenRefusalsLoads(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+
+	err := os.WriteFile(filepath.Join(dir, clientsJSON),
+		[]byte(`{"version": 1, "clients": [{"client": "203.0.113.9/32", `+
+			`"history": {"offences": {"token_refused": 2}}}]}`), 0o600)
+	if err != nil {
+		t.Fatalf("write %s: %v", clientsJSON, err)
+	}
+
+	params := newParams(dir)
+	load(t, params)
+
+	clients := params.Limiter.Snapshot()
+	if len(clients) != 1 || clients[0].History.Offences.TokenRefused != 2 {
+		t.Errorf("clients %+v, want one with its two refusals kept", clients)
+	}
+}
+
 func TestReputationJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 	t.Parallel()
 

internal/waf/waf.go

@@ -212,8 +212,7 @@ type Result struct {
 // method, its URL with the query, and its headers, the Cookie header
 // without the cookies in cookiesNotRead, and on body, r's body as the
 // caller has it, as readBody reads it. It returns what it found, what it
-// read of body, which the app is still to be sent, and the error that
-// ended the reading early, if one did.
+// read of body, and the error that ended the reading early, if one did.
 func (c *CoreRuleSet) Inspect(
 	r *http.Request, client netip.Addr, body io.Reader,
 ) (Result, []byte, error) {

script/example-app

@@ -1,19 +1,28 @@
 #!/bin/sh
 # script/example-app: build the image, and on it the example app in
-# deploy/example-app, then run the app's container with a volume for the
-# state files and check that the health check passes, that a request is
-# served through smallwebwaf, that a second one in a minute bans the
-# client, that a probe for /.env bans another client, which its next
-# request bans for good, that `sv stop` stops smallwebwaf in order, that
-# `docker stop` stops the container without having to kill it, that a
-# new container on the same volume still refuses the banned client, that
-# a container with its state files on a new volume mounted at the
-# directory SWWAF_STATE_DIR_FILE names becomes healthy, and that one whose
-# SWWAF_STATE_DIR does not exist logs smallwebwaf's message about it. The
-# containers run with SWWAF_LOOKUP_SOURCE=off, so that no address is sent
-# to GeoJS. The containers, the volumes and both images are removed
-# however the script ends. Building the app needs network access, for
-# nixpkgs' binary cache. script/check does not run this.
+# deploy/example-app, then run the app's container, with rproxy in it, and
+# servewaf in a container of its own with a volume for the state files. It
+# checks:
+#   - that the health checks pass;
+#   - that a request is served through rproxy, and a second one in a minute
+#     bans the client;
+#   - that a probe for /.env bans another client, which its next request bans
+#     for good;
+#   - that only servewaf's container changes the state directory's owner;
+#   - that the app still answers through rproxy with servewaf stopped, and
+#     that once servewaf has started again, bans apply again;
+#   - that `sv stop` stops rproxy in order, and `docker stop` stops each
+#     container without having to kill it;
+#   - that a new servewaf container on the same volume still refuses the banned
+#     client;
+#   - that a servewaf container with its state files on a new volume mounted at
+#     the directory SWWAF_STATE_DIR_FILE names becomes healthy;
+#   - that one whose SWWAF_STATE_DIR does not exist logs servewaf's message
+#     about it.
+# servewaf runs with SWWAF_LOOKUP_SOURCE=off, so that no address is sent to
+# GeoJS. The containers, the network, the volumes and both images are removed
+# however the script ends. Building the app needs network access, for nixpkgs'
+# binary cache. script/check does not run this.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -24,7 +33,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 NAME="$("$SCRIPT_DIR/projectname")-example-$$"
 IMAGE="$NAME-base"
 APP_IMAGE="$NAME-app"
-CONTAINER="$NAME"
+NETWORK="$NAME"
+APP="$NAME-app-container"
+SERVEWAF="$NAME-servewaf"
 VOLUME="$NAME-state"
 # The volumes of the container whose state directory SWWAF_STATE_DIR_FILE
 # names: its state files, and the file that names their directory.
@@ -32,15 +43,18 @@ MOVED_VOLUME="$NAME-moved-state"
 SETTINGS_VOLUME="$NAME-settings"
 
 cleanup() {
-    docker rm --force "$CONTAINER" >/dev/null 2>&1 || true
+    docker rm --force "$APP" "$SERVEWAF" >/dev/null 2>&1 || true
+    docker network rm "$NETWORK" >/dev/null 2>&1 || true
     docker volume rm --force "$VOLUME" "$MOVED_VOLUME" "$SETTINGS_VOLUME" \
         >/dev/null 2>&1 || true
     docker rmi --force "$APP_IMAGE" "$IMAGE" >/dev/null 2>&1 || true
 }
 
 fail() {
-    echo "example-app: $*; the container's output:" >&2
-    docker logs "$CONTAINER" >&2 || true
+    echo "example-app: $*; the app container's output:" >&2
+    docker logs "$APP" >&2 || true
+    echo "example-app: servewaf's output:" >&2
+    docker logs "$SERVEWAF" >&2 || true
     exit 1
 }
 
@@ -57,52 +71,73 @@ wait_for() {
     done
 }
 
+# healthy <container>: docker says the container's health check passes.
 healthy() {
-    status="$(docker inspect --format '{{.State.Health.Status}}' "$CONTAINER")"
+    status="$(docker inspect --format '{{.State.Health.Status}}' "$1")"
     [ "$status" = healthy ]
 }
 
-# logged <text>...: a line of the container's output holds every text,
-# in any order.
+# logged <container> <text>...: a line of the container's output holds every
+# text, in any order.
 logged() {
-    lines="$(docker logs "$CONTAINER" 2>&1)"
+    lines="$(docker logs "$1" 2>&1)"
+    shift
     for text in "$@"; do
         lines="$(printf '%s\n' "$lines" | grep -F "$text")" || return 1
     done
 }
 
-# start_container: run the app's container, with the state files on the
-# volume, a rate limit of one request a minute and no client looked up,
-# and wait until it is healthy.
-start_container() {
-    docker run --detach --name "$CONTAINER" --publish 127.0.0.1::8080 \
+# start_servewaf: run servewaf from the image, with the state files on the
+# volume, a rate limit of one request a minute and no client looked up, and wait
+# until it is healthy.
+start_servewaf() {
+    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
         --volume "$VOLUME:/var/lib/smallwebwaf" \
+        --env SMALLWEBWAF_COMMAND=servewaf \
         --env SWWAF_RATE_LIMIT_PER_MINUTE=1 \
         --env SWWAF_LOOKUP_SOURCE=off \
-        "$APP_IMAGE" >/dev/null
-    wait_for "the health check did not pass" healthy
-    address="$(docker port "$CONTAINER" 8080/tcp)"
+        "$IMAGE" >/dev/null
+    wait_for "servewaf's health check did not pass" healthy "$SERVEWAF"
 }
 
-# start_moved_container: run the app's container with the state files on
-# a new volume at /srv/state, which SWWAF_STATE_DIR_FILE names in a file
-# only the smallwebwaf user can read, as under "Settings given as files"
-# in docs/settings.md, and wait until it is healthy. smallwebwaf can write the
-# new volume only once the run script has given it to that user.
-start_moved_container() {
+# start_app: run the app's container, with rproxy in it, and wait until it is
+# healthy.
+start_app() {
+    docker run --detach --name "$APP" --network "$NETWORK" --publish 127.0.0.1::8080 \
+        --env SWRP_WAF_BACKEND="http://$SERVEWAF:8080" \
+        "$APP_IMAGE" >/dev/null
+    wait_for "the app's health check did not pass" healthy "$APP"
+    address="$(docker port "$APP" 8080/tcp)"
+}
+
+# start_moved_servewaf: run servewaf with the state files on a new volume at
+# /srv/state, which SWWAF_STATE_DIR_FILE names in a file only the smallwebwaf
+# user can read, as under "Settings given as files" in docs/settings.md, and
+# wait until it is healthy. servewaf can write the new volume only once the run
+# script has given it to that user.
+start_moved_servewaf() {
     docker volume create "$MOVED_VOLUME" >/dev/null
     docker volume create "$SETTINGS_VOLUME" >/dev/null
     docker run --rm --volume "$SETTINGS_VOLUME:/settings" \
         --entrypoint bash "$IMAGE" -c 'echo /srv/state > /settings/state-dir &&
             chown smallwebwaf:smallwebwaf /settings/state-dir &&
             chmod 0400 /settings/state-dir'
-    docker run --detach --name "$CONTAINER" \
+    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
         --volume "$MOVED_VOLUME:/srv/state" \
         --volume "$SETTINGS_VOLUME:/etc/smallwebwaf/settings:ro" \
+        --env SMALLWEBWAF_COMMAND=servewaf \
         --env SWWAF_STATE_DIR_FILE=/etc/smallwebwaf/settings/state-dir \
         --env SWWAF_LOOKUP_SOURCE=off \
-        "$APP_IMAGE" >/dev/null
-    wait_for "the health check did not pass" healthy
+        "$IMAGE" >/dev/null
+    wait_for "servewaf's health check did not pass" healthy "$SERVEWAF"
+}
+
+# status_from <client> <path>: print the status a request for path from client,
+# as X-Forwarded-For names it, gets. rproxy believes the header from docker's
+# gateway, a private address.
+status_from() {
+    curl --silent --output /dev/null --write-out '%{http_code}' \
+        --max-time 10 --header "X-Forwarded-For: $1" "http://$address$2" || true
 }
 
 # refused: a request to the container gets 403, SWWAF_BAN_RESPONSE's
@@ -113,13 +148,14 @@ refused() {
     [ "$code" = 403 ]
 }
 
-# refused_from <client> <path>: a request for path from client, as
-# X-Forwarded-For names it, gets 403. smallwebwaf believes the header
-# from docker's gateway, a private address.
+# refused_from <client> <path>: a request for path from client gets 403.
 refused_from() {
-    code="$(curl --silent --output /dev/null --write-out '%{http_code}' \
-        --max-time 10 --header "X-Forwarded-For: $1" "http://$address$2")" || true
-    [ "$code" = 403 ]
+    [ "$(status_from "$1" "$2")" = 403 ]
+}
+
+# owner_of_state_dir <container>: print who owns /var/lib/smallwebwaf there.
+owner_of_state_dir() {
+    docker exec "$1" stat --format '%U' /var/lib/smallwebwaf
 }
 
 main() {
@@ -131,58 +167,88 @@ main() {
     docker build --no-cache --build-arg SMALLWEBWAF_IMAGE="$IMAGE" \
         -t "$APP_IMAGE" deploy/example-app
 
+    docker network create "$NETWORK" >/dev/null
     docker volume create "$VOLUME" >/dev/null
-    start_container
-    echo "example-app: the health check passes"
+    start_servewaf
+    start_app
+    echo "example-app: the health checks pass"
+
+    [ "$(owner_of_state_dir "$SERVEWAF")" = smallwebwaf ] ||
+        fail "servewaf's container did not give the state directory to smallwebwaf"
+    [ "$(owner_of_state_dir "$APP")" = root ] ||
+        fail "the app's container changed the state directory's owner"
+    echo "example-app: only servewaf's container changes the state directory's owner"
 
     page="$(curl --fail --silent --show-error --max-time 10 "http://$address/")" ||
         fail "no answer on port 8080"
     [ "$page" = "hello from the example app" ] || fail "port 8080 answered $page"
-    wait_for "smallwebwaf logged no request it forwarded" logged '"action":"forward"'
-    echo "example-app: smallwebwaf passes a request to the app and its answer back"
+    wait_for "servewaf logged no request it allowed" \
+        logged "$SERVEWAF" '"action":"forward"' '"servewaf_line":"report"'
+    echo "example-app: rproxy passes a request to the app and its answer back"
 
     refused || fail "a second request in a minute was not refused"
-    wait_for "smallwebwaf logged no ban" logged '"action":"rate_limited"'
+    wait_for "servewaf logged no ban" logged "$SERVEWAF" '"action":"rate_limited"'
     echo "example-app: a second request in a minute bans the client"
 
     refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
-    wait_for "smallwebwaf logged no ban for the probe" \
-        logged '"action":"banned"' '"rule_ids":["env-file"]'
+    wait_for "servewaf logged no ban for the probe" \
+        logged "$SERVEWAF" '"action":"banned"' '"rule_ids":["env-file"]'
     refused_from 203.0.113.9 / || fail "the client of the probe was let through"
     wait_for "the client's next request did not make its ban permanent" \
-        logged '"ban_expires":"permanent"'
+        logged "$SERVEWAF" '"ban_expires":"permanent"'
     echo "example-app: a probe for /.env bans the client, its next request for good"
 
-    docker exec "$CONTAINER" sv stop smallwebwaf >/dev/null ||
-        fail "sv stop smallwebwaf failed"
-    wait_for "smallwebwaf did not stop in order" logged '"msg":"stopped"'
-    echo "example-app: sv stop stops smallwebwaf in order"
+    docker exec "$SERVEWAF" sv stop smallwebwaf >/dev/null ||
+        fail "sv stop smallwebwaf failed in servewaf's container"
+    wait_for "servewaf did not stop in order" logged "$SERVEWAF" '"msg":"stopped"'
+    [ "$(status_from 203.0.113.9 /)" = 200 ] ||
+        fail "with servewaf stopped, the app did not answer through rproxy"
+    wait_for "rproxy logged no request SWRP_DEFAULT_DISPOSITION decided" \
+        logged "$APP" '"default_disposition":true'
+    docker exec "$APP" /usr/local/bin/smallwebwaf healthcheck ||
+        fail "with servewaf stopped, the app's health check failed"
+    echo "example-app: with servewaf stopped, the app answers through rproxy"
 
-    docker stop "$CONTAINER" >/dev/null
-    status="$(docker inspect --format '{{.State.ExitCode}}' "$CONTAINER")"
-    [ "$status" = 0 ] || fail "docker stop left exit status $status"
-    echo "example-app: docker stop stops the container in order"
+    docker exec "$SERVEWAF" sv start smallwebwaf >/dev/null ||
+        fail "sv start smallwebwaf failed in servewaf's container"
+    wait_for "once servewaf had started again, the ban did not apply" \
+        refused_from 203.0.113.9 /
+    echo "example-app: once servewaf has started again, bans apply again"
 
-    docker rm "$CONTAINER" >/dev/null
-    start_container
-    refused || fail "the new container let the banned client through"
-    wait_for "smallwebwaf logged no request refused under the ban" \
-        logged '"action":"banned"'
-    echo "example-app: a new container on the same volume keeps the ban"
+    docker exec "$APP" sv stop smallwebwaf >/dev/null ||
+        fail "sv stop smallwebwaf failed in the app's container"
+    wait_for "rproxy did not stop in order" logged "$APP" '"msg":"stopped"'
+    echo "example-app: sv stop stops rproxy in order"
 
-    docker rm --force "$CONTAINER" >/dev/null
-    start_moved_container
+    for container in "$APP" "$SERVEWAF"; do
+        docker stop "$container" >/dev/null
+        status="$(docker inspect --format '{{.State.ExitCode}}' "$container")"
+        [ "$status" = 0 ] || fail "docker stop left exit status $status"
+    done
+    echo "example-app: docker stop stops each container in order"
+
+    docker rm "$APP" "$SERVEWAF" >/dev/null
+    start_servewaf
+    start_app
+    refused || fail "the new servewaf container let the banned client through"
+    wait_for "servewaf logged no request refused under the ban" \
+        logged "$SERVEWAF" '"action":"banned"'
+    echo "example-app: a new servewaf container on the same volume keeps the ban"
+
+    docker rm --force "$SERVEWAF" >/dev/null
+    start_moved_servewaf
     echo "example-app: the run script gives the state files' directory named" \
         "by SWWAF_STATE_DIR_FILE to the smallwebwaf user"
 
-    docker rm --force "$CONTAINER" >/dev/null
-    docker run --detach --name "$CONTAINER" \
+    docker rm --force "$SERVEWAF" >/dev/null
+    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
+        --env SMALLWEBWAF_COMMAND=servewaf \
         --env SWWAF_STATE_DIR=/srv/missing \
         --env SWWAF_LOOKUP_SOURCE=off \
-        "$APP_IMAGE" >/dev/null
-    wait_for "smallwebwaf did not report the missing state directory" \
-        logged "SWWAF_STATE_DIR cannot be written"
-    echo "example-app: smallwebwaf reports a state directory that does not exist"
+        "$IMAGE" >/dev/null
+    wait_for "servewaf did not report the missing state directory" \
+        logged "$SERVEWAF" "SWWAF_STATE_DIR cannot be written"
+    echo "example-app: servewaf reports a state directory that does not exist"
 }
 
 main "$@"

script/gitea-requests

@@ -1,13 +1,14 @@
 #!/bin/sh
-# script/gitea-requests: build the image and run gitea 1.27.3 behind it,
-# with every setting of smallwebwaf at its default but SWWAF_UPSTREAM_URL,
-# which names gitea's container. Then send through it the gitea requests
-# that reading gitea's source found the Core Rule Set refuses, which
-# docs/gitea.md records, and a short sample of gitea's ordinary use:
-# signing in, pages of files and commits, a diff, the API, a push, clone
-# and fetch over HTTP, and two container image pushes. Last, print each
-# request smallwebwaf logged, with what it did with it and the ids of the
-# Core Rule Set's rules that matched it.
+# script/gitea-requests: build the image and run gitea 1.27.3 behind rproxy
+# and servewaf, three containers on one network. Every setting is at its
+# default but these: SWRP_UPSTREAM_URL names gitea's container, SWRP_WAF_BACKEND
+# names servewaf's, and SWWAF_LOG_REQUEST_HEADERS adds the header that labels a
+# request. Then send through rproxy the gitea requests that reading gitea's
+# source found the Core Rule Set refuses, which docs/gitea.md records, and a
+# short sample of gitea's ordinary use: signing in, pages of files and commits,
+# a diff, the API, a push, clone and fetch over HTTP, and two container image
+# pushes. Last, print each request servewaf logged, with what it did with it and
+# the ids of the Core Rule Set's rules that matched it.
 # Every request comes from one client, docker's gateway, so more than
 # SWWAF_ERROR_BURST_THRESHOLD, 30, refusals in a minute would ban it, and
 # the requests after would show as banned. The containers, the network,
@@ -29,7 +30,8 @@ GITEA_IMAGE="gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025
 NAME="$("$SCRIPT_DIR/projectname")-gitea-$$"
 IMAGE="$NAME-image"
 NETWORK="$NAME"
-SMALLWEBWAF="$NAME-smallwebwaf"
+RPROXY="$NAME-rproxy"
+SERVEWAF="$NAME-servewaf"
 GITEA="$NAME-gitea"
 
 # gitea's one user, who owns the repository and the container images.
@@ -37,16 +39,23 @@ PASSWORD="owner-password"
 
 BROWSER="Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0"
 
-# The files the script makes, and smallwebwaf's address once it runs,
-# localhost and the port docker publishes it on: a host name, since the
-# Core Rule Set takes a Host that is an IP address for a warning (920350).
+# The header that labels a request in the report. rproxy makes every request's
+# id itself, so a label cannot be the X-Request-ID.
+LABEL_HEADER="X-Case"
+
+# The default of SWWAF_LOG_REQUEST_HEADERS, and the header above.
+LOGGED_HEADERS="accept,accept-language,accept-encoding,content-type,origin,range,x-case"
+
+# The files the script makes, and rproxy's address once it runs, localhost and
+# the port docker publishes it on: a host name, since the Core Rule Set takes a
+# Host that is an IP address for a warning (920350).
 WORK=""
 address=""
 
 cleanup() {
     # So that a signal cannot stop it partway through.
     trap '' HUP INT TERM
-    docker rm --force --volumes "$SMALLWEBWAF" "$GITEA" >/dev/null 2>&1 || true
+    docker rm --force --volumes "$RPROXY" "$SERVEWAF" "$GITEA" >/dev/null 2>&1 || true
     docker network rm "$NETWORK" >/dev/null 2>&1 || true
     docker rmi --force "$IMAGE" >/dev/null 2>&1 || true
     if [ -n "$address" ]; then
@@ -75,30 +84,30 @@ wait_for() {
     done
 }
 
+# healthy <container>: docker says the container's health check passes.
 healthy() {
-    status="$(docker inspect --format '{{.State.Health.Status}}' "$SMALLWEBWAF")"
+    status="$(docker inspect --format '{{.State.Health.Status}}' "$1")"
     [ "$status" = healthy ]
 }
 
-# logged <text>...: a line of smallwebwaf's output holds every text, in
-# any order.
+# logged <text>...: a line of servewaf's output holds every text, in any order.
 logged() {
-    lines="$(docker logs "$SMALLWEBWAF" 2>&1)"
+    lines="$(docker logs "$SERVEWAF" 2>&1)"
     for text in "$@"; do
         lines="$(printf '%s\n' "$lines" | grep -F "$text")" || return 1
     done
 }
 
-# send <label> <path> <curl option>...: send a request for path to
-# smallwebwaf, with label as its X-Request-ID, which the report gives,
-# and keep the body of the answer in $WORK/answer. The Core Rule Set
-# reads that header too, so a label names no file the cases name.
+# send <label> <path> <curl option>...: send a request for path to rproxy, with
+# label in LABEL_HEADER, which the report gives, and keep the body of the answer
+# in $WORK/answer. The Core Rule Set reads that header too, so a label names no
+# file the cases name.
 send() {
     label="$1"
     path="$2"
     shift 2
     curl --silent --show-error --max-time 30 --output "$WORK/answer" \
-        --header "X-Request-ID: $label" "$@" "http://$address$path"
+        --header "$LABEL_HEADER: $label" "$@" "http://$address$path"
 }
 
 # page <label> <path> <curl option>...: send the request as a browser
@@ -173,7 +182,7 @@ make_repository() {
     echo "line 41" >>"$dir/src/java.base/share/classes/java/lang/Runtime.java"
     repo_git -C "$dir" commit --quiet --all --message "Add a line"
 
-    repo_git -C "$dir" -c "http.extraHeader=X-Request-ID: git-push" push --quiet \
+    repo_git -C "$dir" -c "http.extraHeader=$LABEL_HEADER: git-push" push --quiet \
         "http://owner:$PASSWORD@$address/owner/repo.git" main ||
         fail "the push of the repository failed"
 }
@@ -236,9 +245,8 @@ call_api() {
 # push_images: push a container image to owner/python3-app, then the same
 # image to owner/app. For the second, the case, docker asks gitea to take
 # its layer from owner/python3-app, naming it in the query parameter
-# from. docker sends no X-Request-ID, so its requests have the ids
-# smallwebwaf gives them. The image is one small file, imported rather
-# than built.
+# from. docker sends no label, so the report gives its requests none. The image
+# is one small file, imported rather than built.
 push_images() {
     echo "$NAME" >"$WORK/layer.txt"
     tar -cf - -C "$WORK" layer.txt |
@@ -258,10 +266,10 @@ push_images() {
 
 # clone_and_fetch: the clone and fetch over HTTP of the sample.
 clone_and_fetch() {
-    repo_git -c "http.extraHeader=X-Request-ID: git-clone" clone --quiet \
+    repo_git -c "http.extraHeader=$LABEL_HEADER: git-clone" clone --quiet \
         "http://owner:$PASSWORD@$address/owner/repo.git" "$WORK/clone" ||
         fail "the clone failed"
-    repo_git -C "$WORK/clone" -c "http.extraHeader=X-Request-ID: git-fetch" fetch --quiet ||
+    repo_git -C "$WORK/clone" -c "http.extraHeader=$LABEL_HEADER: git-fetch" fetch --quiet ||
         fail "the fetch failed"
 }
 
@@ -271,19 +279,19 @@ field() {
     printf '%s\n' "$2" | sed -n "s/.*\"$1\":\"\([^\"]*\)\".*/\1/p"
 }
 
-# report: print a line for each request smallwebwaf logged, but its
-# health checks: what it did with the request, the ids of the Core Rule
-# Set's rules that matched it, its X-Request-ID, and the request.
-# waf_blocked is a refusal by the Core Rule Set, and forward a request
-# passed on to gitea, whatever gitea answered.
+# report: print a line for each request rproxy reported to servewaf: what
+# servewaf did with the request, the ids of the Core Rule Set's rules that
+# matched it, its label, and the request. waf_blocked is a refusal by the Core
+# Rule Set, and forward a request passed on to gitea, whatever gitea answered.
 report() {
-    docker logs "$SMALLWEBWAF" 2>/dev/null | grep '"type":"request"' |
-        grep -v '"action":"admin"' | sed 's/\\u0026/\&/g' >"$WORK/requests"
+    docker logs "$SERVEWAF" 2>/dev/null | grep '"servewaf_line":"report"' |
+        sed 's/\\u0026/\&/g' >"$WORK/requests"
     while IFS= read -r line; do
         ids="$(printf '%s\n' "$line" | sed -n 's/.*"waf_rule_ids":\[\([0-9,]*\)\].*/\1/p')"
         query="$(field query "$line")"
+        label="$(field x-case "$line")"
         printf '%-11s %-13s %-17s %s %s%s\n' "$(field action "$line")" "${ids:--}" \
-            "$(field request_id "$line")" "$(field method "$line")" \
+            "${label:--}" "$(field method "$line")" \
             "$(field path "$line")" "${query:+?$query}"
     done <"$WORK/requests"
     echo "gitea-requests: $(grep -c . "$WORK/requests") requests," \
@@ -298,24 +306,30 @@ main() {
 
     docker build --no-cache -t "$IMAGE" .
 
-    # smallwebwaf first, so that gitea can be given the address it is
-    # reached at, and gitea's image pulled before, so that gitea starts
-    # within the minute smallwebwaf's health check waits for it.
+    # rproxy first, so that gitea can be given the address it is reached at,
+    # and gitea's image pulled before, so that gitea starts within the minute
+    # rproxy's health check waits for it.
     docker pull --quiet "$GITEA_IMAGE" >/dev/null
     docker network create "$NETWORK" >/dev/null
-    docker run --detach --name "$SMALLWEBWAF" --network "$NETWORK" \
-        --publish 127.0.0.1::8080 \
-        --env SWWAF_UPSTREAM_URL="http://$GITEA:3000" \
+    docker run --detach --name "$SERVEWAF" --network "$NETWORK" \
+        --env SMALLWEBWAF_COMMAND=servewaf \
+        --env SWWAF_LOG_REQUEST_HEADERS="$LOGGED_HEADERS" \
         "$IMAGE" >/dev/null
-    published="$(docker port "$SMALLWEBWAF" 8080/tcp)"
+    wait_for "servewaf's health check did not pass" healthy "$SERVEWAF"
+    docker run --detach --name "$RPROXY" --network "$NETWORK" \
+        --publish 127.0.0.1::8080 \
+        --env SWRP_UPSTREAM_URL="http://$GITEA:3000" \
+        --env SWRP_WAF_BACKEND="http://$SERVEWAF:8080" \
+        "$IMAGE" >/dev/null
+    published="$(docker port "$RPROXY" 8080/tcp)"
     address="localhost:${published##*:}"
 
     docker run --detach --name "$GITEA" --network "$NETWORK" \
         --env GITEA__security__INSTALL_LOCK=true \
         --env GITEA__server__ROOT_URL="http://$address/" \
         "$GITEA_IMAGE" >/dev/null
-    # smallwebwaf's health check passes once gitea takes connections.
-    wait_for "the health check did not pass" healthy
+    # rproxy's health check passes once gitea takes connections.
+    wait_for "rproxy's health check did not pass" healthy "$RPROXY"
     docker exec --user git "$GITEA" gitea admin user create --admin \
         --username owner --password "$PASSWORD" --email owner@example.invalid \
         --must-change-password=false >/dev/null
@@ -328,8 +342,8 @@ main() {
 
     # The fetch's last request is the last of all; once it is logged, so
     # is every other.
-    wait_for "smallwebwaf logged no line for the fetch" \
-        logged '"request_id":"git-fetch"' '"method":"POST"'
+    wait_for "servewaf logged no report of the fetch" \
+        logged '"x-case":"git-fetch"' '"method":"POST"' '"servewaf_line":"report"'
     report
 }
 

script/run

@@ -1,14 +1,29 @@
 #!/bin/sh
-# script/run: build bin/smallwebwaf with script/build and run it, with
-# the settings in the environment. Unless SWWAF_STATE_DIR is set, the
-# state files go in bin/state, beside the binary, and unless
-# SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
+# script/run: build bin/smallwebwaf with script/build and run servewaf and
+# rproxy on the host, with the settings in the environment, until rproxy
+# exits or the script is told to stop. rproxy listens on port 8080 unless
+# SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
+# servewaf listens on port 8090 unless SWWAF_LISTEN_ADDR says otherwise, and
+# rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
+# SWWAF_STATE_DIR is set, the state files go in bin/state, beside the binary,
+# and unless SWWAF_RULES_DIR is set, the rule files are those of share/rules.d,
 # which the image ships.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
+SERVEWAF=""
+RPROXY=""
+
+# stop_both: stop what runs, and wait for it, so that servewaf writes its state
+# files.
+stop_both() {
+    trap '' HUP INT TERM
+    kill $SERVEWAF $RPROXY 2>/dev/null || true
+    wait || true
+}
+
 main() {
     "$SCRIPT_DIR/build"
     if [ -z "${SWWAF_STATE_DIR+set}" ]; then
@@ -20,7 +35,18 @@ main() {
         SWWAF_RULES_DIR="$ROOT/share/rules.d"
         export SWWAF_RULES_DIR
     fi
-    exec "$ROOT/bin/smallwebwaf"
+    SWWAF_LISTEN_ADDR="${SWWAF_LISTEN_ADDR:-:8090}"
+    SWRP_WAF_BACKEND="${SWRP_WAF_BACKEND:-http://127.0.0.1:${SWWAF_LISTEN_ADDR##*:}}"
+    export SWWAF_LISTEN_ADDR SWRP_WAF_BACKEND
+
+    trap stop_both EXIT
+    trap 'exit 1' HUP INT TERM
+
+    "$ROOT/bin/smallwebwaf" servewaf &
+    SERVEWAF=$!
+    "$ROOT/bin/smallwebwaf" rproxy &
+    RPROXY=$!
+    wait "$RPROXY"
 }
 
 main "$@"

share/smallwebwaf.run

@@ -2,22 +2,38 @@
 set -euo pipefail
 
 # runit's run script for smallwebwaf, run again whenever smallwebwaf
-# exits; the wait spaces out the restarts. The state directory and every
-# file in it are given to the smallwebwaf user, so that a volume mounted
-# there needs no change of owner; chown -R changes a symbolic link itself,
-# never what it points to. When SWWAF_STATE_DIR, in either form, cannot be
-# read or is not the absolute path of a directory, no owner is changed,
-# and smallwebwaf starts and stops with a message naming the setting. A
-# change of owner that fails, as on a volume mounted read-only, does not
-# end the script either: smallwebwaf reports a directory it cannot write.
+# exits; the wait spaces out the restarts. SMALLWEBWAF_COMMAND names the
+# command to run: rproxy when it is unset or empty, or servewaf. With any
+# other value the script starts nothing and stops with a message naming it.
 # exec, so that the signal `sv stop` sends reaches smallwebwaf itself.
 main() {
     sleep 1
+    local command="${SMALLWEBWAF_COMMAND:-rproxy}"
+    case "$command" in
+        rproxy) ;;
+        servewaf) give_state_dir_to_smallwebwaf ;;
+        *)
+            printf 'SMALLWEBWAF_COMMAND: "%s" is not rproxy or servewaf\n' \
+                "$command" >&2
+            exit 1
+            ;;
+    esac
+    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf "$command"
+}
+
+# give_state_dir_to_smallwebwaf gives the state directory and every file in
+# it to the smallwebwaf user, so that a volume mounted there needs no change
+# of owner; chown -R changes a symbolic link itself, never what it points
+# to. When SWWAF_STATE_DIR, in either form, cannot be read or is not the
+# absolute path of a directory, no owner is changed, and servewaf starts and
+# stops with a message naming the setting. A change of owner that fails, as
+# on a volume mounted read-only, does not end the script either: servewaf
+# reports a directory it cannot write.
+give_state_dir_to_smallwebwaf() {
     local dir
     if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
         chown -R smallwebwaf:smallwebwaf "$dir" || true
     fi
-    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf
 }
 
 # state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,