rack-attack 5.1.0 → 5.2.0

data/lib/rack/attack/cache.rb

@@ -20,6 +20,9 @@ module Rack
       end
 
       def read(unprefixed_key)
+        enforce_store_presence!
+        enforce_store_method_presence!(:read)
+
         store.read("#{prefix}:#{unprefixed_key}")
       end
 
@@ -46,18 +49,29 @@ module Rack
       end
 
       def do_count(key, expires_in)
+        enforce_store_presence!
+        enforce_store_method_presence!(:increment)
+
+        result = store.increment(key, 1, :expires_in => expires_in)
+
+        # NB: Some stores return nil when incrementing uninitialized values
+        if result.nil?
+          enforce_store_method_presence!(:write)
+
+          store.write(key, 1, :expires_in => expires_in)
+        end
+        result || 1
+      end
+
+      def enforce_store_presence!
         if store.nil?
           raise Rack::Attack::MissingStoreError
-        elsif !store.respond_to?(:increment)
-          raise Rack::Attack::MisconfiguredStoreError, "Store needs to respond to #increment"
-        else
-          result = store.increment(key, 1, :expires_in => expires_in)
-
-          # NB: Some stores return nil when incrementing uninitialized values
-          if result.nil?
-            store.write(key, 1, :expires_in => expires_in)
-          end
-          result || 1
+        end
+      end
+
+      def enforce_store_method_presence!(method_name)
+        if !store.respond_to?(method_name)
+          raise Rack::Attack::MisconfiguredStoreError, "Store needs to respond to ##{method_name}"
         end
       end
     end

data/lib/rack/attack/check.rb

@@ -17,6 +17,7 @@ module Rack
         }
       end
 
+      alias_method :match?, :[]
     end
   end
 end

data/lib/rack/attack/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Attack
-    VERSION = '5.1.0'
+    VERSION = '5.2.0'
   end
 end

data/spec/acceptance/allow2ban_spec.rb

@@ -0,0 +1,71 @@
+require_relative "../spec_helper"
+require "timecop"
+
+describe "allow2ban" do
+  before do
+    Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
+
+    Rack::Attack.blocklist("allow2ban pentesters") do |request|
+      Rack::Attack::Allow2Ban.filter(request.ip, maxretry: 2, findtime: 30, bantime: 60) do
+        request.path.include?("scarce-resource")
+      end
+    end
+  end
+
+  it "returns OK for many requests that doesn't match the filter" do
+    get "/"
+    assert_equal 200, last_response.status
+
+    get "/"
+    assert_equal 200, last_response.status
+  end
+
+  it "returns OK for first request that matches the filter" do
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+  end
+
+  it "forbids all access after reaching maxretry limit" do
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+
+    get "/scarce-resource"
+    assert_equal 403, last_response.status
+
+    get "/"
+    assert_equal 403, last_response.status
+  end
+
+  it "restores access after bantime elapsed" do
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+
+    get "/"
+    assert_equal 403, last_response.status
+
+    Timecop.travel(60) do
+      get "/"
+
+      assert_equal 200, last_response.status
+    end
+  end
+
+  it "does not forbid all access if maxrety condition is met but not within the findtime timespan" do
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+
+    Timecop.travel(31) do
+      get "/scarce-resource"
+      assert_equal 200, last_response.status
+
+      get "/"
+      assert_equal 200, last_response.status
+    end
+  end
+end

data/spec/acceptance/blocking_ip_spec.rb

@@ -0,0 +1,38 @@
+require_relative "../spec_helper"
+
+describe "Blocking an IP" do
+  before do
+    Rack::Attack.blocklist_ip("1.2.3.4")
+  end
+
+  it "forbids request if IP matches" do
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 403, last_response.status
+  end
+
+  it "succeeds if IP doesn't match" do
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "notifies when the request is blocked" do
+    notified = false
+    notification_type = nil
+
+    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
+      notified = true
+      notification_type = request.env["rack.attack.match_type"]
+    end
+
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    refute notified
+
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert notified
+    assert_equal :blocklist, notification_type
+  end
+end

data/spec/acceptance/blocking_spec.rb

@@ -18,4 +18,24 @@ describe "#blocklist" do
 
     assert_equal 200, last_response.status
   end
+
+  it "notifies when the request is blocked" do
+    notification_matched = nil
+    notification_type = nil
+
+    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
+      notification_matched = request.env["rack.attack.matched"]
+      notification_type = request.env["rack.attack.match_type"]
+    end
+
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    assert_nil notification_matched
+    assert_nil notification_type
+
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal "block 1.2.3.4", notification_matched
+    assert_equal :blocklist, notification_type
+  end
 end

data/spec/acceptance/blocking_subnet_spec.rb

@@ -0,0 +1,44 @@
+require_relative "../spec_helper"
+
+describe "Blocking an IP subnet" do
+  before do
+    Rack::Attack.blocklist_ip("1.2.3.4/31")
+  end
+
+  it "forbids request if IP is inside the subnet" do
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert_equal 403, last_response.status
+  end
+
+  it "forbids request for another IP in the subnet" do
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.5"
+
+    assert_equal 403, last_response.status
+  end
+
+  it "succeeds if IP is outside the subnet" do
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.6"
+
+    assert_equal 200, last_response.status
+  end
+
+  it "notifies when the request is blocked" do
+    notified = false
+    notification_type = nil
+
+    ActiveSupport::Notifications.subscribe("rack.attack") do |_name, _start, _finish, _id, request|
+      notified = true
+      notification_type = request.env["rack.attack.match_type"]
+    end
+
+    get "/", {}, "REMOTE_ADDR" => "5.6.7.8"
+
+    refute notified
+
+    get "/", {}, "REMOTE_ADDR" => "1.2.3.4"
+
+    assert notified
+    assert_equal :blocklist, notification_type
+  end
+end

data/spec/acceptance/cache_store_config_for_allow2ban_spec.rb

@@ -0,0 +1,111 @@
+require_relative "../spec_helper"
+
+describe "Cache store config when using allow2ban" do
+  before do
+    Rack::Attack.blocklist("allow2ban pentesters") do |request|
+      Rack::Attack::Allow2Ban.filter(request.ip, maxretry: 2, findtime: 30, bantime: 60) do
+        request.path.include?("scarce-resource")
+      end
+    end
+  end
+
+  it "gives semantic error if no store was configured" do
+    assert_raises(Rack::Attack::MissingStoreError) do
+      get "/scarce-resource"
+    end
+  end
+
+  it "gives semantic error if store is missing #read method" do
+    basic_store_class = Class.new do
+      def write(key, value)
+      end
+
+      def increment(key, count, options = {})
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    raised_exception = assert_raises(Rack::Attack::MisconfiguredStoreError) do
+      get "/scarce-resource"
+    end
+
+    assert_equal "Store needs to respond to #read", raised_exception.message
+  end
+
+  it "gives semantic error if store is missing #write method" do
+    basic_store_class = Class.new do
+      def read(key)
+      end
+
+      def increment(key, count, options = {})
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    raised_exception = assert_raises(Rack::Attack::MisconfiguredStoreError) do
+      get "/scarce-resource"
+    end
+
+    assert_equal "Store needs to respond to #write", raised_exception.message
+  end
+
+  it "gives semantic error if store is missing #increment method" do
+    basic_store_class = Class.new do
+      def read(key)
+      end
+
+      def write(key, value)
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    raised_exception = assert_raises(Rack::Attack::MisconfiguredStoreError) do
+      get "/scarce-resource"
+    end
+
+    assert_equal "Store needs to respond to #increment", raised_exception.message
+  end
+
+  it "works with any object that responds to #read, #write and #increment" do
+    basic_store_class = Class.new do
+      attr_accessor :backend
+
+      def initialize
+        @backend = {}
+      end
+
+      def read(key)
+        @backend[key]
+      end
+
+      def write(key, value, options = {})
+        @backend[key] = value
+      end
+
+      def increment(key, count, options = {})
+        @backend[key] ||= 0
+        @backend[key] += 1
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    get "/"
+    assert_equal 200, last_response.status
+
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+
+    get "/scarce-resource"
+    assert_equal 200, last_response.status
+
+    get "/scarce-resource"
+    assert_equal 403, last_response.status
+
+    get "/"
+    assert_equal 403, last_response.status
+  end
+end

data/spec/acceptance/cache_store_config_for_fail2ban_spec.rb

@@ -0,0 +1,108 @@
+require_relative "../spec_helper"
+
+describe "Cache store config when using fail2ban" do
+  before do
+    Rack::Attack.blocklist("fail2ban pentesters") do |request|
+      Rack::Attack::Fail2Ban.filter(request.ip, maxretry: 2, findtime: 30, bantime: 60) do
+        request.path.include?("private-place")
+      end
+    end
+  end
+
+  it "gives semantic error if no store was configured" do
+    assert_raises(Rack::Attack::MissingStoreError) do
+      get "/private-place"
+    end
+  end
+
+  it "gives semantic error if store is missing #read method" do
+    basic_store_class = Class.new do
+      def write(key, value)
+      end
+
+      def increment(key, count, options = {})
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    raised_exception = assert_raises(Rack::Attack::MisconfiguredStoreError) do
+      get "/private-place"
+    end
+
+    assert_equal "Store needs to respond to #read", raised_exception.message
+  end
+
+  it "gives semantic error if store is missing #write method" do
+    basic_store_class = Class.new do
+      def read(key)
+      end
+
+      def increment(key, count, options = {})
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    raised_exception = assert_raises(Rack::Attack::MisconfiguredStoreError) do
+      get "/private-place"
+    end
+
+    assert_equal "Store needs to respond to #write", raised_exception.message
+  end
+
+  it "gives semantic error if store is missing #increment method" do
+    basic_store_class = Class.new do
+      def read(key)
+      end
+
+      def write(key, value)
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    raised_exception = assert_raises(Rack::Attack::MisconfiguredStoreError) do
+      get "/private-place"
+    end
+
+    assert_equal "Store needs to respond to #increment", raised_exception.message
+  end
+
+  it "works with any object that responds to #read, #write and #increment" do
+    basic_store_class = Class.new do
+      attr_accessor :backend
+
+      def initialize
+        @backend = {}
+      end
+
+      def read(key)
+        @backend[key]
+      end
+
+      def write(key, value, options = {})
+        @backend[key] = value
+      end
+
+      def increment(key, count, options = {})
+        @backend[key] ||= 0
+        @backend[key] += 1
+      end
+    end
+
+    Rack::Attack.cache.store = basic_store_class.new
+
+    get "/"
+    assert_equal 200, last_response.status
+
+    get "/private-place"
+    assert_equal 403, last_response.status
+
+    get "/private-place"
+    assert_equal 403, last_response.status
+
+    get "/"
+    assert_equal 403, last_response.status
+  end
+end