Bans for broken rate limits, in memory (work in progress)

internal/proxy/ratelimits_test.go

@@ -8,7 +8,11 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
+// minute is the window of SWWAF_RATE_LIMIT_PER_MINUTE, as a log line's
+// limit_hit names it.
+const minute = "minute"
+
+func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 	t.Parallel()
 
 	var calls atomic.Int32
@@ -24,19 +28,19 @@ func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
 	const otherClient = "203.0.113.10"
 
 	// With a limit of one request a minute, a client's second request is
-	// refused. A client is one IPv4 address, or one IPv6 /64; an IPv4
-	// address in IPv6 form is that IPv4 address.
+	// refused, with 403 by default. A client is one IPv4 address, or one
+	// IPv6 /64; an IPv4 address in IPv6 form is that IPv4 address.
 	requests := []struct {
 		client string // as X-Forwarded-For names it
 		logged string // as the log line's client_ip names it
 		want   int
 	}{
 		{client, client, http.StatusOK},
-		{client, client, http.StatusTooManyRequests},
+		{client, client, http.StatusForbidden},
 		{otherClient, otherClient, http.StatusOK},
-		{"::ffff:" + otherClient, otherClient, http.StatusTooManyRequests},
+		{"::ffff:" + otherClient, otherClient, http.StatusForbidden},
 		{"2001:db8::1", "2001:db8::1", http.StatusOK},
-		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusTooManyRequests},
+		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusForbidden},
 		{"2001:db8:0:1::1", "2001:db8:0:1::1", http.StatusOK},
 	}
 
@@ -53,9 +57,9 @@ func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
 		if sent.want == http.StatusOK {
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 		} else {
-			wantLine(t, line, http.StatusTooManyRequests, requestlog.ActionRateLimited)
+			wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
 
-			if line.LimitHit != "minute" {
+			if line.LimitHit != minute {
 				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
 			}
 		}