sneak/smallwebwaf
1
0 Fork 0
Code Issues 18 Pull Requests 5 Actions 92 Packages Projects Releases Wiki Activity

Rename the settings whose names do not say what they control (closes #234)
check / check (push) Waiting to run
Details

Browse Source 
Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5
This commit is contained in:
clawbot committed 2026-11-12 08:22:52 +00:00
1 parent 101cc0aba5
commit 4be0b6e7fc
97 files changed
+2030 -1810
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/sww/sww_test.go
+70 -66
View File
@@ -34,20 +34,20 @@ const (
// testVersion is the version the tests give sww.
testVersion = "test"
// localhost is where the tests listen.
localhost = "127.0.0.1"
listenAddr = "SWW_WAF_LISTEN_ADDR"
stateDir = "SWW_WAF_STATE_DIR"
stateWriteDelay = "SWW_WAF_STATE_WRITE_DELAY"
stateCounterInterval = "SWW_WAF_STATE_COUNTER_INTERVAL"
cacheDir = "SWW_WAF_CACHE_DIR"
rateLimitPerDay = "SWW_WAF_RATE_LIMIT_PER_DAY"
rateLimitExemptNets = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
rulesDir = "SWW_WAF_RULES_DIR"
lookupSource = "SWW_WAF_LOOKUP_SOURCE"
lookupDBPath = "SWW_WAF_LOOKUP_DB_PATH"
instanceName = "SWW_WAF_INSTANCE_NAME"
adminToken = "SWW_WAF_ADMIN_TOKEN" //nolint:gosec // the setting's name
metricsToken = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
localhost = "127.0.0.1"
listenAddr = "SWW_WAF_LISTEN_ADDR"
stateDir = "SWW_WAF_STATE_DIR"
bansWriteDelay = "SWW_WAF_BANS_WRITE_DELAY"
stateWriteInterval = "SWW_WAF_STATE_WRITE_INTERVAL"
cacheDir = "SWW_WAF_CACHE_DIR"
rateLimitPerDay = "SWW_WAF_RATE_LIMIT_PER_DAY"
rateLimitExemptNets = "SWW_WAF_RATE_LIMIT_EXEMPT_NETS"
ruleFilesDir = "SWW_WAF_RULE_FILES_DIR"
lookupSource = "SWW_WAF_LOOKUP_SOURCE"
lookupDBPath = "SWW_WAF_LOOKUP_DB_PATH"
instanceName = "SWW_WAF_INSTANCE_NAME"
adminToken = "SWW_WAF_ADMIN_TOKEN" //nolint:gosec // the setting's name
metricsToken = "SWW_WAF_METRICS_TOKEN" //nolint:gosec // the setting's name
// adminSecret is the SWW_WAF_ADMIN_TOKEN the tests set.
adminSecret = "fedcba9876543210fedcba9876543210"
// instance is the SWW_WAF_INSTANCE_NAME the tests set where they look at
@@ -246,9 +246,9 @@ func TestAddressInUseStopsTheStart(t *testing.T) {
out := &output{}
status := run(t.Context(), map[string]string{
listenAddr: taken.Addr().String(),
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
listenAddr: taken.Addr().String(),
stateDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
}, out)
if status != 1 {
t.Errorf("exit status %d, want 1", status)
@@ -268,9 +268,9 @@ func TestServesUntilToldToStop(t *testing.T) {
go func() {
exited <- run(ctx, map[string]string{
listenAddr: localhost + ":0",
stateDir: dir,
rulesDir: filepath.Join("..", "..", "share", "rules.d"),
listenAddr: localhost + ":0",
stateDir: dir,
ruleFilesDir: filepath.Join("..", "..", "share", "rules.d"),
}, out)
}()
@@ -320,7 +320,7 @@ func TestLogLevelHoldsBackTheLessSevereProcessLines(t *testing.T) {
exited <- run(ctx, map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
"SWW_WAF_BLOCKLIST_URLS": lists.URL + "/tor.txt",
"SWW_WAF_LOG_LEVEL": "warn",
}, out)
@@ -361,7 +361,7 @@ func TestEveryLogLineAndMetricCarriesTheInstanceName(t *testing.T) {
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
metricsToken: token,
instanceName: instance,
}
@@ -398,12 +398,12 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
rateLimitPerDay: "2",
// Neither comes due in the test: the files are written as
// sww stops.
stateWriteDelay: "1h",
stateCounterInterval: "1h",
bansWriteDelay: "1h",
stateWriteInterval: "1h",
}
// The two requests a day allows, and a stop.
@@ -434,7 +434,7 @@ func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
rateLimitPerDay: "1",
scope: "24",
}
@@ -478,13 +478,13 @@ func TestBanAddedAndLiftedByEditingBansJSON(t *testing.T) {
dir := t.TempDir()
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: dir,
rulesDir: t.TempDir(),
listenAddr: localhost + ":0",
stateDir: dir,
ruleFilesDir: t.TempDir(),
// No write comes due in the test, so only the watch on the
// directory can take the edits in.
stateWriteDelay: "1h",
stateCounterInterval: "1h",
bansWriteDelay: "1h",
stateWriteInterval: "1h",
}
runUntilStopped(t, env, func(url string) {
@@ -508,14 +508,14 @@ func TestBanAddedAndLiftedThroughTheEndpointsKeptInBansJSON(t *testing.T) {
dir := t.TempDir()
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: dir,
rulesDir: t.TempDir(),
adminToken: adminSecret,
listenAddr: localhost + ":0",
stateDir: dir,
ruleFilesDir: t.TempDir(),
adminToken: adminSecret,
// Neither comes due in the test: the files are written as
// sww stops.
stateWriteDelay: "1h",
stateCounterInterval: "1h",
bansWriteDelay: "1h",
stateWriteInterval: "1h",
}
runUntilStopped(t, env, func(url string) {
@@ -551,9 +551,9 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
dir := t.TempDir()
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: dir,
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
ruleFilesDir: dir,
// The requests sent until the rule takes effect must not break a
// rate limit, whose ban would refuse them too.
"SWW_WAF_RATE_LIMIT_PER_MINUTE": "off",
@@ -602,13 +602,17 @@ func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
)
}
func TestRulesDirThatDoesNotExistStopsTheStart(t *testing.T) {
func TestRuleFilesDirThatDoesNotExistStopsTheStart(t *testing.T) {
t.Parallel()
dir := filepath.Join(t.TempDir(), "rules.d")
wantRulesRefused(t, dir, "SWW_WAF_RULES_DIR cannot be read: open "+dir+
": no such file or directory")
wantRulesRefused(
t,
dir,
"SWW_WAF_RULE_FILES_DIR cannot be read: open "+dir+
": no such file or directory",
)
}
func TestCoreRuleSetExclusionsFileThatCannotBeReadStopsTheStart(
@@ -620,7 +624,7 @@ func TestCoreRuleSetExclusionsFileThatCannotBeReadStopsTheStart(
out := &output{}
status := run(t.Context(), map[string]string{
listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
listenAddr: localhost + ":0", stateDir: t.TempDir(), ruleFilesDir: t.TempDir(),
"SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE": path,
}, out)
if status != 1 {
@@ -652,8 +656,8 @@ func TestCoreRuleSetExclusionsFileThatCannotBeUsedStopsTheStartWhileTheCoreRuleS
out := &output{}
status := run(t.Context(), map[string]string{
listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
"SWW_WAF_CORE_RULE_SET_MODE": config.WAFModeOff,
listenAddr: localhost + ":0", stateDir: t.TempDir(), ruleFilesDir: t.TempDir(),
"SWW_WAF_CORE_RULE_SET_MODE": config.CoreRuleSetModeOff,
"SWW_WAF_CORE_RULE_SET_EXCLUSIONS_FILE": path,
}, out)
if status != 1 {
@@ -675,7 +679,7 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
metricsToken: token,
instanceName: instance,
lookupSource: "file",
@@ -788,7 +792,7 @@ func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
cacheDir: cache,
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
metricsToken: token,
instanceName: instance,
"SWW_WAF_BLOCKLIST_URLS": torURL,
@@ -874,7 +878,7 @@ func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
listenAddr: localhost + ":0",
stateDir: dir,
cacheDir: cache,
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
"SWW_WAF_CROWDSEC_LAPI_URL": engine.URL,
"SWW_WAF_CROWDSEC_LAPI_KEY": bouncerKey,
}
@@ -957,7 +961,7 @@ func TestLookupDatabaseThatCannotBeReadStopsTheStart(t *testing.T) {
out := &output{}
status := run(ctx, map[string]string{
listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
listenAddr: localhost + ":0", stateDir: t.TempDir(), ruleFilesDir: t.TempDir(),
lookupSource: "file", lookupDBPath: path,
}, out)
if status != 1 {
@@ -992,7 +996,7 @@ func TestEveryLineIsAlsoSentToTheRemoteLogEndpoint(t *testing.T) {
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
"SWW_WAF_LOG_REMOTE_URL": "syslog+tcp://" + endpoint.Addr().String(),
}
@@ -1049,14 +1053,14 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
}()
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
"SWW_WAF_LOG_REMOTE_URL": "syslog+tls://" + endpoint.Addr().
String(),
"SWW_WAF_LOG_REMOTE_BUFFER": "1",
metricsToken: token,
instanceName: instance,
"SWW_WAF_LOG_REMOTE_BUFFER_LINES": "1",
metricsToken: token,
instanceName: instance,
}
out := runUntilStopped(t, env, func(url string) {
@@ -1127,7 +1131,7 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: dir,
rulesDir: rules,
ruleFilesDir: rules,
"SWW_WAF_ALERT_WEBHOOK_URL": webhook.url,
"SWW_WAF_ALERT_WEBHOOK_HEADERS": "Authorization:Bearer " + adminSecret,
instanceName: instance,
@@ -1233,7 +1237,7 @@ func TestBanIsAlertedToSlackAndNtfy(t *testing.T) {
env := map[string]string{
listenAddr: localhost + ":0",
stateDir: t.TempDir(),
rulesDir: t.TempDir(),
ruleFilesDir: t.TempDir(),
rateLimitPerDay: "1",
// The metrics are read from 127.0.0.1, which no limit counts.
"SWW_WAF_ALLOW_NETS": localhost + "/32",
@@ -1327,7 +1331,7 @@ func TestUnwritableCacheDirStopsTheStart(t *testing.T) {
out := &output{}
status := run(ctx, map[string]string{
listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: t.TempDir(),
listenAddr: localhost + ":0", stateDir: t.TempDir(), ruleFilesDir: t.TempDir(),
cacheDir: filepath.Join(t.TempDir(), "missing"),
}, out)
if status != 1 {
@@ -1356,7 +1360,7 @@ func wantStartRefused(t *testing.T, dir, want string) {
out := &output{}
status := run(ctx, map[string]string{
listenAddr: localhost + ":0", stateDir: dir, rulesDir: t.TempDir(),
listenAddr: localhost + ":0", stateDir: dir, ruleFilesDir: t.TempDir(),
}, out)
if status != 1 {
t.Fatalf("exit status %d, want 1", status)
@@ -1386,7 +1390,7 @@ func wantRulesRefused(t *testing.T, dir, want string) {
out := &output{}
status := run(ctx, map[string]string{
listenAddr: localhost + ":0", stateDir: t.TempDir(), rulesDir: dir,
listenAddr: localhost + ":0", stateDir: t.TempDir(), ruleFilesDir: dir,
}, out)
if status != 1 {
t.Fatalf("exit status %d, want 1", status)
@@ -1458,8 +1462,8 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
listenAddr: localhost + ":0",
stateDir: dir,
"SWW_WAF_MODE": "enforce",
stateWriteDelay: "10s",
stateCounterInterval: "15m",
bansWriteDelay: "10s",
stateWriteInterval: "15m",
"SWW_WAF_ALLOW_NETS": "",
rateLimitExemptNets: "",
"SWW_WAF_DENY_NETS": "",
@@ -1472,11 +1476,11 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
"SWW_WAF_BAN_RESPONSE": "403",
"SWW_WAF_LIMIT_BAN_DURATION": "1h",
"SWW_WAF_LIMIT_BAN_REPEAT_WINDOW": "24h",
"SWW_WAF_MAX_BAN_DURATION": "7d",
"SWW_WAF_LIMIT_BAN_PERMANENT_ABOVE": "7d",
"SWW_WAF_ATTACK_BAN_DURATION": "7d",
"SWW_WAF_MAX_BANS": "5000",
"SWW_WAF_BAN_SCOPE_V4_PREFIX": "32",
"SWW_WAF_RULES_ENABLED": "true",
"SWW_WAF_RULE_FILES_ENABLED": "true",
}
for name, value := range want {