sneak
4a2d57dca2
check / check (push) Waiting to run
`smallwebwaf servewaf` runs today's checks on the visitor's request each question carries, answers rproxy, and passes nothing to an app. rproxy reports every request servewaf answered. A report counts an allowed request's bytes and writes servewaf's second log line. The table holds a copy of what a report needs, never the request, so a report cannot reach a request being handled. Judgement call: a question's body is read before any check; over 64 KiB gets 400. Judgement call: a report's bytes and durations have ceilings, so they cannot overflow. Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close. Model: opus-5-5
33 lines
781 B
Go
33 lines
781 B
Go
package proxy
|
|
|
|
import (
|
|
"net/netip"
|
|
"testing"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/config"
|
|
)
|
|
|
|
func TestWithEveryAnomalyThresholdOffARequestIsNotCounted(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// A request from a client looked up through GeoJS, with every anomaly
|
|
// threshold off. Its handler has neither GeoJS's answers nor the
|
|
// anomaly counters, nor a clock, and the request no response: reading
|
|
// any of them to count the request panics.
|
|
rq := &request{
|
|
decision: decision{
|
|
client: netip.MustParseAddr("203.0.113.9"),
|
|
lookedUp: true,
|
|
},
|
|
h: &handler{config: &config.Config{LookupSource: "geojs"}},
|
|
}
|
|
|
|
defer func() {
|
|
if r := recover(); r != nil {
|
|
t.Errorf("counting the request did work, with every threshold off: %v", r)
|
|
}
|
|
}()
|
|
|
|
rq.countAnomalies()
|
|
}
|