clawbot
611ae5c008
check / check (push) Waiting to run
A request whose path, as the client sent it and before the query string, starts with one of the comma-separated prefixes in SWWAF_RATE_LIMIT_EXEMPT_PATHS is neither counted nor refused by the request rate limits; the static lists, bans and the country lists still apply. The setting is empty by default, and a prefix that does not start with / stops the start. README.md documents it. Judgement call: plain prefix on the path as sent, as the issue rules, so /assets/../login matches /assets/; traefik removes such dot segments by default, but a request that reaches smallwebwaf uncleaned is matched as sent. Model: opus-5-5
104 lines
3.3 KiB
Go
104 lines
3.3 KiB
Go
package proxy_test
|
|
|
|
import (
|
|
"net/http"
|
|
"sync/atomic"
|
|
"testing"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
// minute is the window of SWWAF_RATE_LIMIT_PER_MINUTE, as a log line's
|
|
// limit_hit names it.
|
|
const minute = "minute"
|
|
|
|
func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var calls atomic.Int32
|
|
|
|
app := startApp(t, func(http.ResponseWriter, *http.Request) {
|
|
calls.Add(1)
|
|
})
|
|
addr, out := startProxy(t, app.URL, map[string]string{
|
|
trustedProxies: trustLocalhost,
|
|
rateLimitPerMinute: "1",
|
|
})
|
|
|
|
const otherClient = "203.0.113.10"
|
|
|
|
// With a limit of one request a minute, a client's second request is
|
|
// refused, with 403 by default. A client is one IPv4 address, or one
|
|
// IPv6 /64; an IPv4 address in IPv6 form is that IPv4 address.
|
|
requests := []struct {
|
|
client string // as X-Forwarded-For names it
|
|
logged string // as the log line's client_ip names it
|
|
want int
|
|
}{
|
|
{client, client, http.StatusOK},
|
|
{client, client, http.StatusForbidden},
|
|
{otherClient, otherClient, http.StatusOK},
|
|
{"::ffff:" + otherClient, otherClient, http.StatusForbidden},
|
|
{"2001:db8::1", "2001:db8::1", http.StatusOK},
|
|
{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusForbidden},
|
|
{"2001:db8:0:1::1", "2001:db8:0:1::1", http.StatusOK},
|
|
}
|
|
|
|
for i, sent := range requests {
|
|
req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
|
|
req.Header.Set(forwardedFor, sent.client)
|
|
wantStatus(t, do(t, req), sent.want)
|
|
|
|
line := out.requestLines(t, i+1)[i]
|
|
if line.ClientIP != sent.logged {
|
|
t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.logged)
|
|
}
|
|
|
|
if sent.want == http.StatusOK {
|
|
wantLine(t, line, http.StatusOK, requestlog.ActionForward)
|
|
} else {
|
|
wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
|
|
|
|
if line.LimitHit != minute {
|
|
t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
|
|
}
|
|
}
|
|
}
|
|
|
|
if calls.Load() != 4 {
|
|
t.Errorf("the app was called %d times, want 4", calls.Load())
|
|
}
|
|
}
|
|
|
|
func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const denied = "192.0.2.50" // in SWWAF_DENY_NETS
|
|
|
|
s, _, _ := startWithClock(t, "", map[string]string{
|
|
rateLimitPerMinute: "1",
|
|
rateLimitExemptPaths: "/assets/,/favicon.ico",
|
|
denyNets: denied,
|
|
})
|
|
|
|
// With a limit of one request a minute, the requests for paths under a
|
|
// prefix are not counted, so client's first request for / is within
|
|
// the limit; and once client has reached it, they are not refused.
|
|
s.request(client, "/assets/app.js", http.StatusOK, requestlog.ActionForward)
|
|
s.request(client, "/favicon.ico?v=2", http.StatusOK, requestlog.ActionForward)
|
|
s.get(client, http.StatusOK, requestlog.ActionForward)
|
|
|
|
line := s.request(client, "/assets/app.js", http.StatusOK, requestlog.ActionForward)
|
|
if line.LimitHit != "" {
|
|
t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
|
|
}
|
|
|
|
// A path outside every prefix is counted: /assets is not under
|
|
// /assets/, and breaks the limit.
|
|
s.request(client, "/assets", http.StatusForbidden, requestlog.ActionRateLimited)
|
|
|
|
// A ban and SWWAF_DENY_NETS still refuse a path under a prefix.
|
|
s.request(client, "/assets/app.js", http.StatusForbidden, requestlog.ActionBanned)
|
|
s.request(denied, "/assets/app.js", http.StatusForbidden, requestlog.ActionDenied)
|
|
}
|