sneak
b1eb2466f6
All checks were successful
check / check (push) Successful in 3m20s
The 64-hop cap bounded the walk but not the allocation: the chain was split before it was capped, so a padded header cost a []string proportional to its whole length on every request to the unauthenticated receiver. Cut hops off the right end of each header value in place with strings.LastIndexByte instead, and walk multiple header values in reverse rather than joining them. Bucket assignment is unchanged: the walk still counts every comma-separated entry against the cap, skips empty ones, stops at the first hop that is not a trusted proxy, and falls back to the peer on an unreadable hop or an exhausted cap. Measured over a 1 MB chain: 1,606,043 bytes allocated per call before, 16 bytes after.
44 lines
1.1 KiB
Go
44 lines
1.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
)
|
|
|
|
// NewLoggingResponseWriterForTest wraps newLoggingResponseWriter
|
|
// for use in external test packages.
|
|
func NewLoggingResponseWriterForTest(
|
|
w http.ResponseWriter,
|
|
) *loggingResponseWriter {
|
|
return newLoggingResponseWriter(w)
|
|
}
|
|
|
|
// LoggingResponseWriterStatusCode returns the status code
|
|
// captured by the loggingResponseWriter.
|
|
func LoggingResponseWriterStatusCode(
|
|
lrw *loggingResponseWriter,
|
|
) int {
|
|
return lrw.statusCode
|
|
}
|
|
|
|
// IPFromHostPort exposes ipFromHostPort for testing.
|
|
func IPFromHostPort(hp string) string {
|
|
return ipFromHostPort(hp)
|
|
}
|
|
|
|
// ClientKeyForTest exposes clientKey for testing.
|
|
func ClientKeyForTest(m *Middleware, r *http.Request) string {
|
|
return m.clientKey(r)
|
|
}
|
|
|
|
// IsClientTLS exposes isClientTLS for testing.
|
|
func IsClientTLS(r *http.Request) bool {
|
|
return isClientTLS(r)
|
|
}
|
|
|
|
// LoginRateLimitConst exposes the loginRateLimit constant.
|
|
const LoginRateLimitConst = loginRateLimit
|
|
|
|
// PasswordChangeRateLimitConst exposes the
|
|
// passwordChangeRateLimit constant.
|
|
const PasswordChangeRateLimitConst = passwordChangeRateLimit
|