doc: clarify usage for ratelimit's excludedIPs
This commit is contained in:
parent
c10c7619d3
commit
2560626419
4 changed files with 62 additions and 28 deletions
|
@ -241,7 +241,7 @@ type IPStrategy struct {
|
|||
|
||||
// Get an IP selection strategy.
|
||||
// If nil return the RemoteAddr strategy
|
||||
// else return a strategy base on the configuration using the X-Forwarded-For Header.
|
||||
// else return a strategy based on the configuration using the X-Forwarded-For Header.
|
||||
// Depth override the ExcludedIPs.
|
||||
func (s *IPStrategy) Get() (ip.Strategy, error) {
|
||||
if s == nil {
|
||||
|
@ -259,7 +259,7 @@ func (s *IPStrategy) Get() (ip.Strategy, error) {
|
|||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ip.CheckerStrategy{
|
||||
return &ip.PoolStrategy{
|
||||
Checker: checker,
|
||||
}, nil
|
||||
}
|
||||
|
|
|
@ -43,14 +43,16 @@ func (s *DepthStrategy) GetIP(req *http.Request) string {
|
|||
return strings.TrimSpace(xffs[len(xffs)-s.Depth])
|
||||
}
|
||||
|
||||
// CheckerStrategy a strategy based on an IP Checker
|
||||
// allows to check that addresses are in a trusted IPs.
|
||||
type CheckerStrategy struct {
|
||||
// PoolStrategy is a strategy based on an IP Checker.
|
||||
// It allows to check whether addresses are in a given pool of IPs.
|
||||
type PoolStrategy struct {
|
||||
Checker *Checker
|
||||
}
|
||||
|
||||
// GetIP return the selected IP.
|
||||
func (s *CheckerStrategy) GetIP(req *http.Request) string {
|
||||
// GetIP checks the list of Forwarded IPs (most recent first) against the
|
||||
// Checker pool of IPs. It returns the first IP that is not in the pool, or the
|
||||
// empty string otherwise.
|
||||
func (s *PoolStrategy) GetIP(req *http.Request) string {
|
||||
if s.Checker == nil {
|
||||
return ""
|
||||
}
|
||||
|
@ -60,9 +62,13 @@ func (s *CheckerStrategy) GetIP(req *http.Request) string {
|
|||
|
||||
for i := len(xffs) - 1; i >= 0; i-- {
|
||||
xffTrimmed := strings.TrimSpace(xffs[i])
|
||||
if len(xffTrimmed) == 0 {
|
||||
continue
|
||||
}
|
||||
if contain, _ := s.Checker.Contains(xffTrimmed); !contain {
|
||||
return xffTrimmed
|
||||
}
|
||||
}
|
||||
|
||||
return ""
|
||||
}
|
||||
|
|
|
@ -74,34 +74,35 @@ func TestDepthStrategy_GetIP(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestExcludedIPsStrategy_GetIP(t *testing.T) {
|
||||
func TestTrustedIPsStrategy_GetIP(t *testing.T) {
|
||||
testCases := []struct {
|
||||
desc string
|
||||
excludedIPs []string
|
||||
trustedIPs []string
|
||||
xForwardedFor string
|
||||
expected string
|
||||
useRemote bool
|
||||
}{
|
||||
{
|
||||
desc: "Use excluded all IPs",
|
||||
excludedIPs: []string{"10.0.0.4", "10.0.0.3", "10.0.0.2", "10.0.0.1"},
|
||||
desc: "Trust all IPs",
|
||||
trustedIPs: []string{"10.0.0.4", "10.0.0.3", "10.0.0.2", "10.0.0.1"},
|
||||
xForwardedFor: "10.0.0.4,10.0.0.3,10.0.0.2,10.0.0.1",
|
||||
expected: "",
|
||||
},
|
||||
{
|
||||
desc: "Use excluded IPs",
|
||||
excludedIPs: []string{"10.0.0.2", "10.0.0.1"},
|
||||
desc: "Do not trust all IPs",
|
||||
trustedIPs: []string{"10.0.0.2", "10.0.0.1"},
|
||||
xForwardedFor: "10.0.0.4,10.0.0.3,10.0.0.2,10.0.0.1",
|
||||
expected: "10.0.0.3",
|
||||
},
|
||||
{
|
||||
desc: "Use excluded IPs CIDR",
|
||||
excludedIPs: []string{"10.0.0.1/24"},
|
||||
desc: "Do not trust all IPs with CIDR",
|
||||
trustedIPs: []string{"10.0.0.1/24"},
|
||||
xForwardedFor: "127.0.0.1,10.0.0.4,10.0.0.3,10.0.0.2,10.0.0.1",
|
||||
expected: "127.0.0.1",
|
||||
},
|
||||
{
|
||||
desc: "Use excluded all IPs CIDR",
|
||||
excludedIPs: []string{"10.0.0.1/24"},
|
||||
desc: "Trust all IPs with CIDR",
|
||||
trustedIPs: []string{"10.0.0.1/24"},
|
||||
xForwardedFor: "10.0.0.4,10.0.0.3,10.0.0.2,10.0.0.1",
|
||||
expected: "",
|
||||
},
|
||||
|
@ -112,10 +113,10 @@ func TestExcludedIPsStrategy_GetIP(t *testing.T) {
|
|||
t.Run(test.desc, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
checker, err := NewChecker(test.excludedIPs)
|
||||
checker, err := NewChecker(test.trustedIPs)
|
||||
require.NoError(t, err)
|
||||
|
||||
strategy := CheckerStrategy{Checker: checker}
|
||||
strategy := PoolStrategy{Checker: checker}
|
||||
req := httptest.NewRequest(http.MethodGet, "http://127.0.0.1", nil)
|
||||
req.Header.Set(xForwardedFor, test.xForwardedFor)
|
||||
actual := strategy.GetIP(req)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue