rack-attack 2.0.0 → 2.1.0

data/README.md

@@ -4,7 +4,7 @@
 Rack::Attack is a rack middleware to protect your web app from bad clients.
 It allows *whitelisting*, *blacklisting*, *throttling*, and *tracking* based on arbitrary properties of the request.
 
-Throttle state is stored in a configurable cache (e.g. `Rails.cache`), presumably backed by memcached.
+Throttle state is stored in a configurable cache (e.g. `Rails.cache`), presumably backed by memcached or redis.
 
 ## Installation
 
@@ -34,10 +34,27 @@ Note that `Rack::Attack.cache` is only used for throttling; not blacklisting & w
 
 The Rack::Attack middleware compares each request against *whitelists*, *blacklists*, *throttles*, and *tracks* that you define. There are none by default.
 
- * If the request matches any **whitelist**, it is allowed. Blacklists and throttles are not checked.
- * If the request matches any **blacklist**, it is blocked. Throttles are not checked.
- * If the request matches any **throttle**, a counter is incremented in the Rack::Attack.cache. If the throttle limit is exceeded, the request is blocked and further throttles are not checked.
- * If the request was not whitelisted, blacklisted, or throttled; all **tracks** are checked.
+ * If the request matches any **whitelist**, it is allowed.
+ * Otherwise, if the request matches any **blacklist**, it is blocked.
+ * Otherwise, if the request matches any **throttle**, a counter is incremented in the Rack::Attack.cache. If the throttle limit is exceeded, the request is blocked.
+ * Otherwise, all **tracks** are checked, and the request is allowed.
+
+The algorithm is actually more concise in code: See [Rack::Attack.call](https://github.com/kickstarter/rack-attack/blob/master/lib/rack/attack.rb):
+
+    def call(env)
+      req = Rack::Request.new(env)
+
+      if whitelisted?(req)
+        @app.call(env)
+      elsif blacklisted?(req)
+        blacklisted_response[env]
+      elsif throttled?(req)
+        throttled_response[env]
+      else
+        tracked?(req)
+        @app.call(env)
+      end
+    end
 
 ## About Tracks
 
@@ -108,11 +125,11 @@ A [Rack::Request](http://rack.rubyforge.org/doc/classes/Rack/Request.html) objec
 
 Customize the response of blacklisted and throttled requests using an object that adheres to the [Rack app interface](http://rack.rubyforge.org/doc/SPEC.html).
 
-    Rack:Attack.blacklisted_response = lambda do |env|
+    Rack::Attack.blacklisted_response = lambda do |env|
       [ 503, {}, ['Blocked']]
     end
 
-    Rack:Attack.throttled_response = lambda do |env|
+    Rack::Attack.throttled_response = lambda do |env|
       # name and other data about the matched throttle
       body = [
         env['rack.attack.matched'],
@@ -149,8 +166,8 @@ less on short-term, one-off hacks to block a particular attack.
 
 Rack::Attack complements tools like iptables and nginx's [limit_zone module](http://wiki.nginx.org/HttpLimitZoneModule).
 
-[![Travis CI](https://secure.travis-ci.org/ktheory/rack-attack.png)](http://travis-ci.org/ktheory/rack-attack)
-[![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/kickstarter/rack-attack)
+[![Build Status](https://travis-ci.org/kickstarter/rack-attack.png?branch=master)](https://travis-ci.org/kickstarter/rack-attack)
+[![Code Climate](https://codeclimate.com/github/kickstarter/rack-attack.png)](https://codeclimate.com/github/kickstarter/rack-attack)
 
 ## License
 

data/lib/rack/attack.rb

@@ -37,10 +37,10 @@ module Rack::Attack
 
       # Set defaults
       @notifier ||= ActiveSupport::Notifications if defined?(ActiveSupport::Notifications)
-      @blacklisted_response ||= lambda {|env| [503, {}, ['Blocked']] }
+      @blacklisted_response ||= lambda {|env| [503, {}, ["Blocked\n"]] }
       @throttled_response   ||= lambda {|env|
         retry_after = env['rack.attack.match_data'][:period] rescue nil
-        [503, {'Retry-After' => retry_after.to_s}, ['Retry later']]
+        [503, {'Retry-After' => retry_after.to_s}, ["Retry later\n"]]
       }
 
       self
@@ -50,10 +50,8 @@ module Rack::Attack
       req = Rack::Request.new(env)
 
       if whitelisted?(req)
-        return @app.call(env)
-      end
-
-      if blacklisted?(req)
+        @app.call(env)
+      elsif blacklisted?(req)
         blacklisted_response[env]
       elsif throttled?(req)
         throttled_response[env]
@@ -95,7 +93,7 @@ module Rack::Attack
       @cache ||= Cache.new
     end
 
-   def clear!
+    def clear!
       @whitelists, @blacklists, @throttles = {}, {}, {}
     end
 

data/lib/rack/attack/cache.rb

@@ -2,17 +2,43 @@ module Rack
   module Attack
     class Cache
 
-      attr_accessor :store, :prefix
+      attr_accessor :prefix
+
       def initialize
-        @store = ::Rails.cache if defined?(::Rails.cache)
+        self.store = ::Rails.cache if defined?(::Rails.cache)
         @prefix = 'rack::attack'
       end
 
+      attr_reader :store
+      def store=(store)
+        # RedisStore#increment needs different behavior, so detect that
+        # (method has an arity of 2; must call #expire seperately
+        if defined?(::ActiveSupport::Cache::RedisStore) && store.is_a?(::ActiveSupport::Cache::RedisStore)
+          # ActiveSupport::Cache::RedisStore doesn't expose any way to set an expiry,
+          # so use the raw Redis::Store instead
+          @store = store.instance_variable_get(:@data)
+        else
+          @redis_store = false
+          @store = store
+        end
+      end
+
       def count(unprefixed_key, period)
         epoch_time = Time.now.to_i
         expires_in = period - (epoch_time % period)
         key = "#{prefix}:#{(epoch_time/period).to_i}:#{unprefixed_key}"
-        result = store.increment(key, 1, :expires_in => expires_in)
+        do_count(key, expires_in)
+      end
+
+      private
+      def do_count(key, expires_in)
+        # Workaround Redis::Store's interface
+        if defined?(::Redis::Store) && store.is_a?(::Redis::Store)
+          result = store.incr(key)
+          store.expire(key, expires_in)
+        else
+          result = store.increment(key, 1, :expires_in => expires_in)
+        end
         # NB: Some stores return nil when incrementing uninitialized values
         if result.nil?
           store.write(key, 1, :expires_in => expires_in)

data/lib/rack/attack/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module Attack
-    VERSION = '2.0.0'
+    VERSION = '2.1.0'
   end
 end

data/spec/rack_attack_cache_spec.rb

@@ -0,0 +1,61 @@
+require_relative 'spec_helper'
+
+if ENV['TEST_INTEGRATION']
+  describe Rack::Attack::Cache do
+    def delete(key)
+      if @cache.store.respond_to?(:delete)
+        @cache.store.delete(key)
+      else
+        @cache.store.del(key)
+      end
+    end
+
+    require 'active_support/cache/dalli_store'
+    require 'active_support/cache/redis_store'
+    cache_stores = [
+      ActiveSupport::Cache::MemoryStore.new,
+      ActiveSupport::Cache::DalliStore.new("localhost"),
+      ActiveSupport::Cache::RedisStore.new("localhost"),
+      Redis::Store.new
+    ]
+
+    cache_stores.each do |store|
+      describe "with #{store.class}" do
+
+        before {
+          @cache ||= Rack::Attack::Cache.new
+          @key = "rack::attack:cache-test-key"
+          @expires_in = 1
+          @cache.store = store
+          delete(@key)
+        }
+
+        after { delete(@key) }
+
+        describe "do_count once" do
+          it "should be 1" do
+            @cache.send(:do_count, @key, @expires_in).must_equal 1
+          end
+        end
+
+        describe "do_count twice" do
+          it "must be 2" do
+            @cache.send(:do_count, @key, @expires_in)
+            @cache.send(:do_count, @key, @expires_in).must_equal 2
+          end
+        end
+        describe "do_count after expires_in" do
+          it "must be 1" do
+            @cache.send(:do_count, @key, @expires_in)
+            sleep @expires_in # sigh
+            @cache.send(:do_count, @key, @expires_in).must_equal 1
+          end
+        end
+      end
+
+    end
+
+  end
+else
+  puts 'Skipping cache store integration tests (set ENV["TEST_INTEGRATION"] to enable)'
+end

data/spec/rack_attack_throttle_spec.rb

@@ -1,4 +1,3 @@
-
 require_relative 'spec_helper'
 describe 'Rack::Attack.throttle' do
   before do

data/spec/spec_helper.rb

@@ -2,6 +2,7 @@ require "rubygems"
 require "bundler/setup"
 
 require "minitest/autorun"
+require "minitest/pride"
 require "rack/test"
 require 'debugger'
 require 'active_support'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-attack
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-01-11 00:00:00.000000000 Z
+date: 2013-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -107,6 +107,38 @@ dependencies:
     - - ~>
       - !ruby/object:Gem::Version
         version: 1.1.3
+- !ruby/object:Gem::Dependency
+  name: redis-activesupport
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: dalli
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: A rack middleware for throttling and blocking abusive requests
 email: aaron@ktheory.com
 executables: []
@@ -123,6 +155,7 @@ files:
 - lib/rack/attack.rb
 - Rakefile
 - README.md
+- spec/rack_attack_cache_spec.rb
 - spec/rack_attack_spec.rb
 - spec/rack_attack_throttle_spec.rb
 - spec/rack_attack_track_spec.rb
@@ -153,6 +186,7 @@ signing_key:
 specification_version: 3
 summary: Block & throttle abusive requests
 test_files:
+- spec/rack_attack_cache_spec.rb
 - spec/rack_attack_spec.rb
 - spec/rack_attack_throttle_spec.rb
 - spec/rack_attack_track_spec.rb