1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
package acceptance_test
import (
"fmt"
"net/http"
"testing"
"time"
"github.com/stretchr/testify/require"
"gitlab.com/gitlab-org/gitlab-pages/internal/feature"
"gitlab.com/gitlab-org/gitlab-pages/internal/testhelpers"
)
var ratelimitedListeners = map[string]struct {
listener ListenSpec
header http.Header
clientIP string
// We perform requests to server while we're waiting for it to boot up,
// successful request gets counted in IP rate limit
includeWaitRequest bool
}{
"http_listener": {
listener: httpListener,
clientIP: "127.0.0.1",
includeWaitRequest: true,
},
"https_listener": {
listener: httpsListener,
clientIP: "127.0.0.1",
includeWaitRequest: true,
},
"proxy_listener": {
listener: proxyListener,
header: http.Header{
"X-Forwarded-For": []string{"172.16.123.1"},
"X-Forwarded-Host": []string{"group.gitlab-example.com"},
},
clientIP: "172.16.123.1",
},
"proxyv2_listener": {
listener: httpsProxyv2Listener,
clientIP: "10.1.1.1",
includeWaitRequest: true,
},
}
func TestIPRateLimits(t *testing.T) {
testhelpers.StubFeatureFlagValue(t, feature.EnforceIPRateLimits.EnvVariable, true)
for name, tc := range ratelimitedListeners {
t.Run(name, func(t *testing.T) {
rateLimit := 5
logBuf := RunPagesProcess(t,
withListeners([]ListenSpec{tc.listener}),
withExtraArgument("rate-limit-source-ip", fmt.Sprint(rateLimit)),
withExtraArgument("rate-limit-source-ip-burst", fmt.Sprint(rateLimit)),
)
if tc.includeWaitRequest {
rateLimit-- // we've already used one of requests while checking if server is up
}
for i := 0; i < 10; i++ {
rsp, err := GetPageFromListenerWithHeaders(t, tc.listener, "group.gitlab-example.com", "project/", tc.header)
require.NoError(t, err)
require.NoError(t, rsp.Body.Close())
if i >= rateLimit {
require.Equal(t, http.StatusTooManyRequests, rsp.StatusCode, "group.gitlab-example.com request: %d failed", i)
assertLogFound(t, logBuf, []string{"request hit rate limit", "\"source_ip\":\"" + tc.clientIP + "\""})
} else {
require.Equal(t, http.StatusOK, rsp.StatusCode, "request: %d failed", i)
}
}
})
}
}
func TestDomainateLimits(t *testing.T) {
testhelpers.StubFeatureFlagValue(t, feature.EnforceDomainRateLimits.EnvVariable, true)
for name, tc := range ratelimitedListeners {
t.Run(name, func(t *testing.T) {
rateLimit := 5
logBuf := RunPagesProcess(t,
withListeners([]ListenSpec{tc.listener}),
withExtraArgument("rate-limit-domain", fmt.Sprint(rateLimit)),
withExtraArgument("rate-limit-domain-burst", fmt.Sprint(rateLimit)),
)
for i := 0; i < 10; i++ {
rsp, err := GetPageFromListenerWithHeaders(t, tc.listener, "group.gitlab-example.com", "project/", tc.header)
require.NoError(t, err)
require.NoError(t, rsp.Body.Close())
if i >= rateLimit {
require.Equal(t, http.StatusTooManyRequests, rsp.StatusCode, "group.gitlab-example.com request: %d failed", i)
assertLogFound(t, logBuf, []string{"request hit rate limit", "\"source_ip\":\"" + tc.clientIP + "\""})
} else {
require.Equal(t, http.StatusOK, rsp.StatusCode, "request: %d failed", i)
}
}
// make sure that requests to other domains are passing
rsp, err := GetPageFromListener(t, tc.listener, "CapitalGroup.gitlab-example.com", "project/")
require.NoError(t, err)
require.NoError(t, rsp.Body.Close())
require.Equal(t, http.StatusOK, rsp.StatusCode, "request to unrelated domain failed")
})
}
}
func assertLogFound(t *testing.T, logBuf *LogCaptureBuffer, expectedLogs []string) {
t.Helper()
// give the process enough time to write the log message
require.Eventually(t, func() bool {
for _, e := range expectedLogs {
require.Contains(t, logBuf.String(), e, "log mismatch")
}
return true
}, 100*time.Millisecond, 10*time.Millisecond)
}
|
