sneak/smallwebwaf
1
0 Fork 0
Code Issues 25 Pull Requests 7 Actions 81 Packages Projects Releases Wiki Activity

Format Go with gofmt, then golines -m 77 (closes #215)
check / check (push) Waiting to run
Details

Browse Source 
script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5
This commit is contained in:
sneak committed 2026-11-11 15:14:58 +00:00
1 parent 63e58e326b
commit 7f8a59de04
118 files changed
+9447 -2670
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/waf/refusallimit_test.go
+99 -27
View File
@@ -97,8 +97,13 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
for i, r := range tc.refusals[:3] {
line := r.send(s, client)
if line.LimitHit != "" || line.Offence != "" {
t.Errorf("refusal %d: log line has limit_hit %q and offence %q, "+
"want none", i+1, line.LimitHit, line.Offence)
t.Errorf(
"refusal %d: log line has limit_hit %q and offence %q, "+
"want none",
i+1,
line.LimitHit,
line.Offence,
)
}
s.get(client, http.StatusOK, requestlog.ActionForward)
@@ -109,8 +114,12 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
line := tc.refusals[3].send(s, client)
if line.LimitHit != requestlog.LimitHitMinuteRefusals ||
line.Offence != requestlog.OffenceLimit {
t.Errorf("log line has limit_hit %q and offence %q, want minute_refusals "+
"and limit", line.LimitHit, line.Offence)
t.Errorf(
"log line has limit_hit %q and offence %q, want minute_refusals "+
"and limit",
line.LimitHit,
line.Offence,
)
}
s.get(client, http.StatusForbidden, tc.nextAction)
@@ -149,7 +158,10 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
expires := start.Add(time.Hour)
if line.BanExpires != requestlog.FormatTime(expires) {
t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
t.Errorf(
"log line has ban_expires %q, want an hour on",
line.BanExpires,
)
}
netblock := netip.MustParsePrefix(client + "/32")
@@ -183,16 +195,30 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
wantOffences := ratelimit.Offences{Limit: 1, BlockedByBlockRule: 3}
if offences := historyOf(t, server, client).Offences; offences != wantOffences {
t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
t.Errorf(
"history counts the offences %+v, want %+v",
offences,
wantOffences,
)
}
metrics := s.scrape()
wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+
`kind="refusals",window="minute"}`, 1)
wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
wantMetric(
t,
metrics,
`sww_offences_total{instance="app",kind="limit"}`,
1,
)
wantMetric(t, metrics,
`sww_offences_total{instance="app",kind="blocked_by_block_rule"}`, 3)
wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 1)
wantMetric(
t,
metrics,
`sww_bans_made_total{cause="limit",instance="app"}`,
1,
)
}
func TestErrorBurstIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
@@ -217,8 +243,12 @@ func TestErrorBurstIsNotLoweredForAClientWithLowerLimits(t *testing.T) {
blockRule.send(s, fromDE)
got := server.Ledger.Bans(netip.MustParsePrefix(fromDE + "/32"))
if len(got) != 1 || got[0].Notes.Limit != 2 || got[0].Notes.LimitPercent != nil {
t.Errorf("bans %+v, want one for the limit of 2, without a limit percentage", got)
if len(got) != 1 || got[0].Notes.Limit != 2 ||
got[0].Notes.LimitPercent != nil {
t.Errorf(
"bans %+v, want one for the limit of 2, without a limit percentage",
got,
)
}
}
@@ -230,9 +260,16 @@ func TestErrorBurstDoesNotCountTheAppsAnswers(t *testing.T) {
"/private": http.StatusUnauthorized,
"/forbidden": http.StatusForbidden,
}
s, _, _, queue := startAppWithAlerts(t, func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(statuses[r.URL.Path])
}, map[string]string{errorBurstThreshold: "1", rulesDir: writeRules(t, testRules)})
s, _, _, queue := startAppWithAlerts(
t,
func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(statuses[r.URL.Path])
},
map[string]string{
errorBurstThreshold: "1",
rulesDir: writeRules(t, testRules),
},
)
for range 2 {
for path, status := range statuses {
@@ -247,7 +284,12 @@ func TestErrorBurstDoesNotCountTheAppsAnswers(t *testing.T) {
}
// No ban was made, nor its alert raised.
s.request(client, "/missing", http.StatusNotFound, requestlog.ActionForward)
s.request(
client,
"/missing",
http.StatusNotFound,
requestlog.ActionForward,
)
wantAlerts(t, queue)
}
@@ -279,8 +321,11 @@ func TestErrorBurstOffOrAtItsDefault(t *testing.T) {
broken := line.LimitHit == requestlog.LimitHitMinuteRefusals
if broken != tc.broken {
t.Errorf("the 31st refusal broke the error burst: %t, want %t",
broken, tc.broken)
t.Errorf(
"the 31st refusal broke the error burst: %t, want %t",
broken,
tc.broken,
)
}
})
}
@@ -300,7 +345,12 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
// A client in SWW_ALLOW_NETS is not refused, and so not counted.
for range 3 {
s.request(allowed, blockedPath, http.StatusOK, requestlog.ActionForward)
s.request(
allowed,
blockedPath,
http.StatusOK,
requestlog.ActionForward,
)
}
// One the rate limits do not apply to is.
@@ -308,7 +358,10 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
line := blockRule.send(s, exempt)
if line.LimitHit != requestlog.LimitHitMinuteRefusals {
t.Errorf("log line has limit_hit %q, want minute_refusals", line.LimitHit)
t.Errorf(
"log line has limit_hit %q, want minute_refusals",
line.LimitHit,
)
}
s.get(exempt, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
@@ -317,7 +370,11 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
func TestErrorBurstBanSetsTheRefusalsBackToZero(t *testing.T) {
t.Parallel()
s, clk, _ := startForErrorBurst(t, "1", map[string]string{limitBanDuration: "1s"})
s, clk, _ := startForErrorBurst(
t,
"1",
map[string]string{limitBanDuration: "1s"},
)
blockRule.send(s, client)
blockRule.send(s, client)
@@ -365,15 +422,26 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
// is the second of the client's, and would have banned it.
s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
line := s.request(
client,
blockedPath,
http.StatusOK,
requestlog.ActionForward,
)
wantWouldAction(t, line, requestlog.ActionBlockedByBlockRule)
if line.LimitHit != requestlog.LimitHitMinuteRefusals || line.BanExpires != "" {
t.Errorf("log line has limit_hit %q and ban_expires %q, want minute_refusals "+
"and none", line.LimitHit, line.BanExpires)
if line.LimitHit != requestlog.LimitHitMinuteRefusals ||
line.BanExpires != "" {
t.Errorf(
"log line has limit_hit %q and ban_expires %q, want minute_refusals "+
"and none",
line.LimitHit,
line.BanExpires,
)
}
if got := server.Ledger.Snapshot(); len(got) != 1 || !reflect.DeepEqual(got[0], held) {
if got := server.Ledger.Snapshot(); len(got) != 1 ||
!reflect.DeepEqual(got[0], held) {
t.Errorf("bans %+v, want only the one held", got)
}
@@ -385,12 +453,16 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
notes, _ := waiting[0].Detail["notes"].(bans.Notes)
if notes.Kind != ratelimit.KindRefusals || notes.Count != 2 ||
notes.Request.Status != http.StatusForbidden {
t.Errorf("the alert's notes are %+v, want two refusals, the last answered 403",
notes)
t.Errorf(
"the alert's notes are %+v, want two refusals, the last answered 403",
notes,
)
}
alert := banAlert(alerts.EventBan, start, client, bans.Ban{
Netblock: netip.MustParsePrefix(client + "/32"), Cause: bans.CauseLimit,
Netblock: netip.MustParsePrefix(
client + "/32",
), Cause: bans.CauseLimit,
Reason: "refusals per minute over the limit of 1", Notes: notes,
}, requestlog.FormatTime(start.Add(time.Hour)))
alert.Detail["mode"] = observe