sneak/smallwebwaf
1
0 Fork 0
Code Issues 18 Pull Requests 5 Actions 94 Packages Projects Releases Wiki Activity

Rename the settings whose names do not say what they control (closes #234)
check / check (push) Waiting to run
Details

Browse Source 
Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5
This commit is contained in:
clawbot committed 2026-11-12 08:22:52 +00:00
1 parent 101cc0aba5
commit 4be0b6e7fc
97 files changed
+2030 -1810
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/rproxy/rproxy_test.go
+46 -33
View File
@@ -44,13 +44,13 @@ const (
// The settings the tests set.
const (
timeoutSetting = "SWW_RPROXY_TIMEOUT_MS"
defaultDisposition = "SWW_RPROXY_DEFAULT_DISPOSITION"
trustedProxies = "SWW_RPROXY_TRUSTED_PROXIES"
maxRequestSize = "SWW_RPROXY_MAX_REQUEST_SIZE"
maxResponseSize = "SWW_RPROXY_MAX_RESPONSE_SIZE"
maxRequestTime = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
maxResponseTime = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
timeoutSetting = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
noAnswerSetting = "SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION"
trustedProxies = "SWW_RPROXY_TRUSTED_PROXIES"
maxRequestSize = "SWW_RPROXY_MAX_REQUEST_SIZE"
maxResponseSize = "SWW_RPROXY_MAX_RESPONSE_SIZE"
maxRequestTime = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
maxResponseTime = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
)
// The headers the tests set and look at.
@@ -774,7 +774,7 @@ func TestDenyGivesTheVisitorWAFsAnswer(t *testing.T) {
line := out.requestLine(t)
if line["disposition"] != dispositionDeny ||
line["default_disposition"] != nil {
line["waf_backend_no_answer"] != nil {
t.Errorf("line %v, want waf's deny", line)
}
}
@@ -956,7 +956,8 @@ func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
}
}
// noAnswers are the ways waf can leave the decision to the default.
// noAnswers are the ways waf can leave the decision to
// SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION.
func noAnswers() map[string]func(t *testing.T) string {
return map[string]func(t *testing.T) string{
"no connection": func(*testing.T) string { return nowhere },
@@ -1008,7 +1009,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
{"an unknown disposition", "maybe", "who knows\n", http.StatusOK},
} {
for _, setting := range []string{dispositionAllow, dispositionDeny} {
t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
subtest := tc.name + " with " + noAnswerSetting + "=" + setting
t.Run(subtest, func(t *testing.T) {
t.Parallel()
standIn := startWAF(
@@ -1031,7 +1033,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
standIn.URL,
app.URL,
map[string]string{
defaultDisposition: setting,
noAnswerSetting: setting,
},
)
@@ -1047,9 +1049,9 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
line := out.requestLine(t)
if line["status"] != float64(tc.status) ||
line["default_disposition"] != nil {
line["waf_backend_no_answer"] != nil {
t.Errorf(
"line %v, want status %d and no default",
"line %v, want status %d and no waf_backend_no_answer",
line,
tc.status,
)
@@ -1202,7 +1204,8 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
"a 101 that holds its connection open": answeringWith(switchAndHold),
} {
for _, setting := range []string{dispositionAllow, dispositionDeny} {
t.Run(name+" with the default "+setting, func(t *testing.T) {
subtest := name + " with " + noAnswerSetting + "=" + setting
t.Run(subtest, func(t *testing.T) {
t.Parallel()
app := startApp(t, func(http.ResponseWriter, *http.Request) {
@@ -1213,8 +1216,8 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
backend(t),
app.URL,
map[string]string{
timeoutSetting: "60000",
defaultDisposition: setting,
timeoutSetting: "60000",
noAnswerSetting: setting,
},
)
@@ -1224,7 +1227,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
line := out.requestLine(t)
if line["status"] != float64(http.StatusBadGateway) ||
line["disposition"] != nil || line["default_disposition"] != nil {
line["disposition"] != nil || line["waf_backend_no_answer"] != nil {
t.Errorf(
"line %v, want status 502 and no disposition",
line,
@@ -1253,7 +1256,9 @@ func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
standIn.wantNoReport(t)
}
func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
func TestWithoutAnAnswerTheWAFBackendNoAnswerDispositionDecides(
t *testing.T,
) {
t.Parallel()
for name, backend := range noAnswers() {
@@ -1274,8 +1279,11 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
line := out.requestLine(t)
if line["disposition"] != dispositionAllow ||
line["default_disposition"] != true {
t.Errorf("line %v, want allow by default", line)
line["waf_backend_no_answer"] != true {
t.Errorf(
"line %v, want allow and waf_backend_no_answer",
line,
)
}
})
@@ -1290,8 +1298,8 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
backend(t),
app.URL,
map[string]string{
timeoutSetting: "200",
defaultDisposition: dispositionDeny,
timeoutSetting: "200",
noAnswerSetting: dispositionDeny,
},
)
@@ -1302,18 +1310,21 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
line := out.requestLine(t)
if line["disposition"] != dispositionDeny ||
line["default_disposition"] != true {
t.Errorf("line %v, want deny by default", line)
line["waf_backend_no_answer"] != true {
t.Errorf(
"line %v, want deny and waf_backend_no_answer",
line,
)
}
})
}
}
func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDisposition(t *testing.T) {
t.Parallel()
for _, disposition := range []string{dispositionAllow, dispositionDeny} {
t.Run("with the default "+disposition, func(t *testing.T) {
t.Run(noAnswerSetting+"="+disposition, func(t *testing.T) {
t.Parallel()
standIn := startWAF(
@@ -1330,8 +1341,8 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
standIn.URL,
app.URL,
map[string]string{
timeoutSetting: "60000",
defaultDisposition: disposition,
timeoutSetting: "60000",
noAnswerSetting: disposition,
},
)
@@ -1343,7 +1354,7 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
line := out.requestLine(t)
if line["status"] != 0.0 || line["disposition"] != nil ||
line["default_disposition"] != nil {
line["waf_backend_no_answer"] != nil {
t.Errorf("line %v, want status 0 and no disposition", line)
}
@@ -1356,7 +1367,9 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
}
}
func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
func TestRProxyWarnsWhenTheWAFBackendNoAnswerDispositionDecides(
t *testing.T,
) {
t.Parallel()
app := startApp(t, greet)
@@ -1892,10 +1905,10 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
}
}
if line["default_disposition"] != nil {
if line["waf_backend_no_answer"] != nil {
t.Errorf(
"default_disposition is %v, want it left out",
line["default_disposition"],
"waf_backend_no_answer is %v, want it left out",
line["waf_backend_no_answer"],
)
}