sneak/smallwebwaf
1
0 Fork 0
Code Issues 13 Pull Requests 2 Actions 18 Packages Projects Releases Wiki Activity

Rename the settings whose names do not say what they control (closes #234)
check / check (push) Waiting to run
Details

Browse Source 
Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5
This commit was merged in pull request #370.
This commit is contained in:
clawbot committed 2026-11-12 11:13:27 +01:00
1 parent 94d60358ee
commit 4dad4fff43
100 files changed
+2261 -2019
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/waf/waf_test.go
+19 -16
View File
@@ -454,7 +454,8 @@ func TestReportNeverReachesAQuestionStillBeingHandled(t *testing.T) {
geojsURL, asked, release := startHeldGeoJS(t)
s := startWAF(t, geojsURL, map[string]string{
lookupTimeout: "1h", tagDeny: denyKP, bytesLimitPerMinute: byteLimit,
asnAndCountryLookupTimeout: "3600000", tagDeny: denyKP,
bytesLimitPerMinute: byteLimit,
})
first := s.question(siteA, client, "/")
@@ -563,7 +564,7 @@ func TestContentLengthUnreadableOrNegativeCountsAsAbsent(t *testing.T) {
t.Parallel()
s := startWAF(t, "", map[string]string{
rulesDir: writeRules(
ruleFilesDir: writeRules(
t,
"any-length header:Content-Length block .\n",
),
@@ -755,8 +756,8 @@ func TestBlockRuleIsDeniedWith403AndABanRuleWithTheBanResponse(
t.Parallel()
s := startWAF(t, "", map[string]string{
rulesDir: writeRules(t, testRules),
banResponse: "429",
ruleFilesDir: writeRules(t, testRules),
banResponse: "429",
})
got := s.ask(client, "/blocked")
@@ -810,13 +811,13 @@ func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
wantWouldAction(t, line, requestlog.ActionClientDenied)
}
func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(
func TestObserveModeRefusalAnsweredAllowCountsForTheRefusalLimit(
t *testing.T,
) {
t.Parallel()
s := startWAF(t, "", map[string]string{
mode: observe, rulesDir: writeRules(t, testRules), errorBurstThreshold: "1",
mode: observe, ruleFilesDir: writeRules(t, testRules), refusalsLimitPerMinute: "1",
})
for range 2 {
@@ -836,11 +837,11 @@ func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(
}
}
func TestDeniedQuestionCountsForTheErrorBurst(t *testing.T) {
func TestDeniedQuestionCountsForTheRefusalLimit(t *testing.T) {
t.Parallel()
s := startWAF(t, "", map[string]string{
rulesDir: writeRules(t, testRules), errorBurstThreshold: "1",
ruleFilesDir: writeRules(t, testRules), refusalsLimitPerMinute: "1",
})
for range 2 {
@@ -875,7 +876,9 @@ func TestAllowCarriesTheLookupHeadersWhileTheSettingIsSet(t *testing.T) {
geojsURL, _ := startGeoJS(t)
s := startWAF(t, geojsURL, map[string]string{
addLookupHeaders: tc.setting, lookupTimeout: "1h", tagDeny: denyKP,
addLookupHeaders: tc.setting,
asnAndCountryLookupTimeout: "3600000",
tagDeny: denyKP,
})
got := s.ask(fromDE, "/")
@@ -946,8 +949,8 @@ func TestReportCountsAtThePercentageItsQuestionWasGiven(t *testing.T) {
geojsURL, _ := startGeoJS(t)
// 100 bytes pass half of a limit of 99 and are within a limit of 199.
s := startWAF(t, geojsURL, map[string]string{
bytesLimitPerMinute: "199", countryBytesPercent: countryDEHalf,
lookupTimeout: "1h",
bytesLimitPerMinute: "199", countryBytesLimitPercent: countryDEHalf,
asnAndCountryLookupTimeout: "3600000",
})
s.passedOn(fromKP)
@@ -1421,7 +1424,7 @@ func TestReportWritesTheLastLineWithTheDecisionsAndTheReportsFields(
s := startWAF(t, "", map[string]string{
logRequestHeaders: "accept",
rulesDir: writeRules(t, "seen path log ^/page$\n"),
ruleFilesDir: writeRules(t, "seen path log ^/page$\n"),
})
const (
@@ -1573,7 +1576,7 @@ func TestBanMadeThroughOneHostRefusesTheClientOnAnother(t *testing.T) {
s := startWAF(
t,
"",
map[string]string{rulesDir: writeRules(t, testRules)},
map[string]string{ruleFilesDir: writeRules(t, testRules)},
)
got := do(t, s.question(siteA, client, "/.env"))
@@ -1745,7 +1748,7 @@ func TestChecksSeeTheHeadersTheVisitorSent(t *testing.T) {
t.Parallel()
s := startWAF(t, "", map[string]string{
rulesDir: writeRules(t, `
ruleFilesDir: writeRules(t, `
own-client header:X-Sww-Client block .
own-peer header:X-Sww-Peer block .
own-length header:X-Sww-Content-Length block .
@@ -1779,7 +1782,7 @@ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) {
t.Parallel()
s := startWAF(t, "", map[string]string{
wafMode: block, wafBodyLimit: "64K",
coreRuleSetMode: block, coreRuleSetBodyInspectionSize: "64K",
})
ask := func(contentType, body string) answer {
@@ -1804,7 +1807,7 @@ func TestCoreRuleSetReadsTheBodyAQuestionCarries(t *testing.T) {
func TestCoreRuleSetAlertNamesTheSite(t *testing.T) {
t.Parallel()
s := startWAF(t, "", map[string]string{wafMode: block})
s := startWAF(t, "", map[string]string{coreRuleSetMode: block})
got := s.ask(client, sqlInjection)
wantDisposition(t, got, http.StatusForbidden, waf.DispositionDeny)