clawbot
a2aba8f48a
check / check (push) Successful in 3m32s
Each client, one IPv4 address or one IPv6 /64, has its requests counted in two buckets per window, the earlier weighted by how much of it the window still covers, in a table of at most 20,000 clients that drops the least recently seen. A request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or _DAY (1000, 10000, 50000, or off) gets 429 before anything reaches the app, and refused requests count. The log line gains limit_hit and the action rate_limited. The rate limits run before the announced-size check, so a request refused with 413 is counted too. Deviation from SPEC.md, per the issue: the 20,000 bound and the /64 are fixed, not settings. Judgement call: golang-lru/v2 holds the table; httprate is not used, as it reads the wall clock and does not count refused requests. Deviation: go.mod and go.sum were written by hand from the Go checksum database, as no make target runs go mod tidy. Model: opus-5-5
63 lines
1.5 KiB
Go
63 lines
1.5 KiB
Go
package proxy_test
|
|
|
|
import (
|
|
"net/http"
|
|
"sync/atomic"
|
|
"testing"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/requestlog"
|
|
)
|
|
|
|
func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var calls atomic.Int32
|
|
|
|
app := startApp(t, func(http.ResponseWriter, *http.Request) {
|
|
calls.Add(1)
|
|
})
|
|
addr, out := startProxy(t, app.URL, map[string]string{
|
|
trustedProxies: trustLocalhost,
|
|
rateLimitPerMinute: "1",
|
|
})
|
|
|
|
// With a limit of one request a minute, a client's second request is
|
|
// refused. A client is one IPv4 address, or one IPv6 /64.
|
|
requests := []struct {
|
|
client string
|
|
want int
|
|
}{
|
|
{client, http.StatusOK},
|
|
{client, http.StatusTooManyRequests},
|
|
{"203.0.113.10", http.StatusOK},
|
|
{"2001:db8::1", http.StatusOK},
|
|
{"2001:db8::ffff:2", http.StatusTooManyRequests},
|
|
{"2001:db8:0:1::1", http.StatusOK},
|
|
}
|
|
|
|
for i, sent := range requests {
|
|
req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
|
|
req.Header.Set(forwardedFor, sent.client)
|
|
wantStatus(t, do(t, req), sent.want)
|
|
|
|
line := out.requestLines(t, i+1)[i]
|
|
if line.ClientIP != sent.client {
|
|
t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.client)
|
|
}
|
|
|
|
if sent.want == http.StatusOK {
|
|
wantLine(t, line, http.StatusOK, requestlog.ActionForward)
|
|
} else {
|
|
wantLine(t, line, http.StatusTooManyRequests, requestlog.ActionRateLimited)
|
|
|
|
if line.LimitHit != "minute" {
|
|
t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
|
|
}
|
|
}
|
|
}
|
|
|
|
if calls.Load() != 4 {
|
|
t.Errorf("the app was called %d times, want 4", calls.Load())
|
|
}
|
|
}
|