sneak/smallwebwaf
1
0 Fork 0
Code Issues 18 Pull Requests 5 Actions 87 Packages Projects Releases Wiki Activity

Rename the settings whose names do not say what they control (closes #234)
check / check (push) Waiting to run
Details

Browse Source 
Applies the setting renames of the naming audit under the SWW_WAF_ and
SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache
time and the two time limits, which now take milliseconds. The rproxy
log field default_disposition becomes waf_backend_no_answer, and
config.Config and config.FromEnvironment become config.WAF and
config.WAFFromEnvironment. Go fields, test names and prose follow. No
aliases; nothing reads the old names.

Model: opus-5-5
This commit is contained in:
clawbot committed 2026-11-12 09:08:49 +00:00
1 parent 101cc0aba5
commit a18926ec4d
100 files changed
+2181 -1935
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/rproxy/rproxy_test.go
+54 -41
View File
@@ -44,13 +44,13 @@ const (
// The settings the tests set.
const (
timeoutSetting = "SWW_RPROXY_TIMEOUT_MS"
defaultDisposition = "SWW_RPROXY_DEFAULT_DISPOSITION"
trustedProxies = "SWW_RPROXY_TRUSTED_PROXIES"
maxRequestSize = "SWW_RPROXY_MAX_REQUEST_SIZE"
maxResponseSize = "SWW_RPROXY_MAX_RESPONSE_SIZE"
maxRequestTime = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
maxResponseTime = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
wafBackendTimeout = "SWW_RPROXY_WAF_BACKEND_TIMEOUT_MS"
noAnswerSetting = "SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION"
trustedProxies = "SWW_RPROXY_TRUSTED_PROXIES"
maxRequestSize = "SWW_RPROXY_MAX_REQUEST_SIZE"
maxResponseSize = "SWW_RPROXY_MAX_RESPONSE_SIZE"
maxRequestTime = "SWW_RPROXY_MAX_REQUEST_TIME_MS"
maxResponseTime = "SWW_RPROXY_MAX_RESPONSE_TIME_MS"
)
// The headers the tests set and look at.
@@ -774,7 +774,7 @@ func TestDenyGivesTheVisitorWAFsAnswer(t *testing.T) {
line := out.requestLine(t)
if line["disposition"] != dispositionDeny ||
line["default_disposition"] != nil {
line["waf_backend_no_answer"] != nil {
t.Errorf("line %v, want waf's deny", line)
}
}
@@ -956,7 +956,8 @@ func answeringWith(answer http.HandlerFunc) func(t *testing.T) string {
}
}
// noAnswers are the ways waf can leave the decision to the default.
// noAnswers are the ways waf can leave the decision to
// SWW_RPROXY_WAF_BACKEND_NO_ANSWER_DISPOSITION.
func noAnswers() map[string]func(t *testing.T) string {
return map[string]func(t *testing.T) string{
"no connection": func(*testing.T) string { return nowhere },
@@ -1008,7 +1009,8 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
{"an unknown disposition", "maybe", "who knows\n", http.StatusOK},
} {
for _, setting := range []string{dispositionAllow, dispositionDeny} {
t.Run(tc.name+" with the default "+setting, func(t *testing.T) {
subtest := tc.name + " with " + noAnswerSetting + "=" + setting
t.Run(subtest, func(t *testing.T) {
t.Parallel()
standIn := startWAF(
@@ -1031,7 +1033,7 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
standIn.URL,
app.URL,
map[string]string{
defaultDisposition: setting,
noAnswerSetting: setting,
},
)
@@ -1047,9 +1049,9 @@ func TestAnAnswerOtherThanAllowGoesToTheVisitorAsWAFGaveIt(t *testing.T) {
line := out.requestLine(t)
if line["status"] != float64(tc.status) ||
line["default_disposition"] != nil {
line["waf_backend_no_answer"] != nil {
t.Errorf(
"line %v, want status %d and no default",
"line %v, want status %d and no waf_backend_no_answer",
line,
tc.status,
)
@@ -1109,7 +1111,7 @@ func TestAnAnswerOf1MiBGoesToTheVisitor(t *testing.T) {
_, _ = w.Write(make([]byte, size))
})
addr, _ := startRProxy(t, standIn.URL, nowhere, map[string]string{
timeoutSetting: "60000",
wafBackendTimeout: "60000",
})
got := get(t, addr, "/")
@@ -1202,7 +1204,8 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
"a 101 that holds its connection open": answeringWith(switchAndHold),
} {
for _, setting := range []string{dispositionAllow, dispositionDeny} {
t.Run(name+" with the default "+setting, func(t *testing.T) {
subtest := name + " with " + noAnswerSetting + "=" + setting
t.Run(subtest, func(t *testing.T) {
t.Parallel()
app := startApp(t, func(http.ResponseWriter, *http.Request) {
@@ -1213,8 +1216,8 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
backend(t),
app.URL,
map[string]string{
timeoutSetting: "60000",
defaultDisposition: setting,
wafBackendTimeout: "60000",
noAnswerSetting: setting,
},
)
@@ -1224,7 +1227,7 @@ func TestAnAnswerThatCannotBePassedOnIsAnswered502(t *testing.T) {
line := out.requestLine(t)
if line["status"] != float64(http.StatusBadGateway) ||
line["disposition"] != nil || line["default_disposition"] != nil {
line["disposition"] != nil || line["waf_backend_no_answer"] != nil {
t.Errorf(
"line %v, want status 502 and no disposition",
line,
@@ -1242,7 +1245,7 @@ func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
standIn := startWAF(t, overOneMiB(dispositionDeny))
addr, out := startRProxy(t, standIn.URL, nowhere, map[string]string{
timeoutSetting: "60000",
wafBackendTimeout: "60000",
})
if got := get(t, addr, "/"); got.status != http.StatusBadGateway {
@@ -1253,7 +1256,9 @@ func TestAnAnswerThatCannotBePassedOnGetsNoReport(t *testing.T) {
standIn.wantNoReport(t)
}
func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
func TestWithoutAnAnswerTheWAFBackendNoAnswerDispositionDecides(
t *testing.T,
) {
t.Parallel()
for name, backend := range noAnswers() {
@@ -1266,7 +1271,7 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
backend(t),
app.URL,
map[string]string{
timeoutSetting: "200",
wafBackendTimeout: "200",
},
)
@@ -1274,8 +1279,11 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
line := out.requestLine(t)
if line["disposition"] != dispositionAllow ||
line["default_disposition"] != true {
t.Errorf("line %v, want allow by default", line)
line["waf_backend_no_answer"] != true {
t.Errorf(
"line %v, want allow and waf_backend_no_answer",
line,
)
}
})
@@ -1290,8 +1298,8 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
backend(t),
app.URL,
map[string]string{
timeoutSetting: "200",
defaultDisposition: dispositionDeny,
wafBackendTimeout: "200",
noAnswerSetting: dispositionDeny,
},
)
@@ -1302,18 +1310,21 @@ func TestWithoutAnAnswerTheDefaultDispositionDecides(t *testing.T) {
line := out.requestLine(t)
if line["disposition"] != dispositionDeny ||
line["default_disposition"] != true {
t.Errorf("line %v, want deny by default", line)
line["waf_backend_no_answer"] != true {
t.Errorf(
"line %v, want deny and waf_backend_no_answer",
line,
)
}
})
}
}
func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDisposition(t *testing.T) {
t.Parallel()
for _, disposition := range []string{dispositionAllow, dispositionDeny} {
t.Run("with the default "+disposition, func(t *testing.T) {
t.Run(noAnswerSetting+"="+disposition, func(t *testing.T) {
t.Parallel()
standIn := startWAF(
@@ -1330,8 +1341,8 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
standIn.URL,
app.URL,
map[string]string{
timeoutSetting: "60000",
defaultDisposition: disposition,
wafBackendTimeout: "60000",
noAnswerSetting: disposition,
},
)
@@ -1343,7 +1354,7 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
line := out.requestLine(t)
if line["status"] != 0.0 || line["disposition"] != nil ||
line["default_disposition"] != nil {
line["waf_backend_no_answer"] != nil {
t.Errorf("line %v, want status 0 and no disposition", line)
}
@@ -1356,7 +1367,9 @@ func TestAVisitorThatGoesAwayWhileWAFIsAskedGetsNoDefault(t *testing.T) {
}
}
func TestRProxyWarnsWhenTheDefaultDecides(t *testing.T) {
func TestRProxyWarnsWhenTheWAFBackendNoAnswerDispositionDecides(
t *testing.T,
) {
t.Parallel()
app := startApp(t, greet)
@@ -1374,7 +1387,7 @@ func TestSendsNoReportWithoutAnAnswer(t *testing.T) {
})
app := startApp(t, greet)
addr, out := startRProxy(t, standIn.URL, app.URL, map[string]string{
timeoutSetting: "200",
wafBackendTimeout: "200",
})
wantGreeting(t, get(t, addr, "/"))
@@ -1438,7 +1451,7 @@ func TestTheVisitorDoesNotWaitForTheReport(t *testing.T) {
app := startApp(t, greet)
addr, _ := startRProxy(t, backend, app.URL, map[string]string{
timeoutSetting: "60000",
wafBackendTimeout: "60000",
})
t.Cleanup(func() { close(release) })
@@ -1481,7 +1494,7 @@ func TestAReportWAFLeavesUnansweredIsDroppedAtTheTimeLimit(t *testing.T) {
// The time limit is long enough for a loaded host to answer the question before
// it runs out.
addr, out := startRProxy(t, backend, app.URL, map[string]string{
timeoutSetting: "3000",
wafBackendTimeout: "3000",
})
t.Cleanup(func() { close(release) })
@@ -1511,7 +1524,7 @@ func TestAReportAnswered101IsDroppedAtOnce(t *testing.T) {
backend := startWAFAnsweringReports(t, allow, switchAndHold)
app := startApp(t, greet)
addr, out := startRProxy(t, backend, app.URL, map[string]string{
timeoutSetting: "60000",
wafBackendTimeout: "60000",
})
wantGreeting(t, get(t, addr, "/"))
@@ -1599,7 +1612,7 @@ func TestWaitForReportsWaitsForAReportBeingSent(t *testing.T) {
backend.URL,
app.URL,
map[string]string{
timeoutSetting: "5000",
wafBackendTimeout: "5000",
},
)
@@ -1892,10 +1905,10 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
}
}
if line["default_disposition"] != nil {
if line["waf_backend_no_answer"] != nil {
t.Errorf(
"default_disposition is %v, want it left out",
line["default_disposition"],
"waf_backend_no_answer is %v, want it left out",
line["waf_backend_no_answer"],
)
}