@kensio/yulin 1.21.34 → 1.23.0

package/dist/service/stepfunctions/task/sim-states-execution-role.js

@@ -46,12 +46,13 @@ const refusals = {
  * rule, which reaches a function as a service principal and is admitted by the
  * function's resource policy.
  */
-export async function assumeSimStatesExecutionRole(target, scope) {
+export async function assumeSimStatesExecutionRole(target, scope, source) {
     return await assumeSimServiceRole({
         target,
         servicePrincipal: simStatesServicePrincipal,
         sessionName,
         scope,
         refusals,
+        source,
     });
 }

package/dist/service/stepfunctions/task/sim-states-task-invocation.d.ts

@@ -15,6 +15,7 @@ export interface SimStatesTaskInvocation {
      * work.
      */
     readonly roleArn: string;
+    readonly stateMachineArn: string;
 }
 /**
  * Where a `Task` state's work is done.

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -75,7 +75,7 @@ export class SimWafAssociations {
         if (association === undefined) {
             return undefined;
         }
-        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body, association.webAcl.bodyInspectionLimitBytes(association.resourceType)));
+        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body, association.webAcl.bodyInspectionLimitBytes(association.resourceType), request.sourceIp));
     }
     /**
      * Forget whatever is in front of one resource.

package/dist/service/wafv2/association/sim-waf-protection.d.ts

@@ -6,6 +6,11 @@ export interface SimWafProtectedRequest {
     /** The resource the request reached, by ARN. */
     readonly resourceArn: string;
     readonly request: Request;
+    /**
+     * The client address the request came from, which is loopback when nothing
+     * says otherwise.
+     */
+    readonly sourceIp?: string | undefined;
     /**
      * The request body, when the rules might inspect it. A request body is a
      * stream that cannot be read twice, so it is passed in already buffered.

package/dist/service/wafv2/association/sim-waf-request-inspection.d.ts

@@ -5,6 +5,8 @@ interface SimWafInspectionInput {
     /** The resource the request reached, by ARN. */
     readonly resourceArn: string;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
     /**
      * Whether the fronting service forwards the request body to AWS WAF.
      *

package/dist/service/wafv2/association/sim-waf-request-inspection.js

@@ -27,12 +27,17 @@ export class SimWafRequestInspection {
      * Put one request to whatever protects the resource it addressed.
      */
     async inspect(input) {
-        const { protection, resourceArn, request } = input;
+        const { protection, resourceArn, request, sourceIp } = input;
         if (!protection.protects(resourceArn)) {
             return new SimWafInspected({ request });
         }
         const body = input.forwardBody ? await inspectedBody(request) : undefined;
-        const decision = protection.decide({ resourceArn, request, body });
+        const decision = protection.decide({
+            resourceArn,
+            request,
+            sourceIp,
+            body,
+        });
         // A decision carries a blocked response when its action was to block, and
         // carries none when the request was allowed. That one reading is what
         // decides the request here.

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.d.ts

@@ -6,6 +6,11 @@ export interface SimWafEvaluationRequest {
     /** The web ACL to evaluate against, by ARN. */
     readonly webAclArn: string;
     readonly request: Request;
+    /**
+     * The client address the request came from. A request naming none comes
+     * from `127.0.0.1`, as every request does that states no other address.
+     */
+    readonly sourceIp?: string | undefined;
     /**
      * The request body, when the rules might inspect it. A request body is a
      * stream that cannot be read twice, so it is passed in already buffered.

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.d.ts

@@ -20,6 +20,14 @@ export interface SimWafInspectedRequest {
      * header with the Yulin-local suffix taken off it.
      */
     readonly host: string;
+    /**
+     * The client address the request came from, which is what the IP-based
+     * rules read.
+     *
+     * Nothing reaches this simulation over a public network, so this is
+     * `127.0.0.1` unless the request said otherwise with `x-sim-aws-source-ip`.
+     */
+    readonly sourceIp: string;
     /** The request body, or nothing when the request carried none. */
     readonly body: Uint8Array | undefined;
     /**
@@ -49,5 +57,8 @@ export interface SimWafInspectedRequest {
  * The body inspection limit defaults to the 16 KB every resource type this
  * simulation protects reads by default. A web ACL raising it with
  * `AssociationConfig` passes the raised figure in.
+ *
+ * The client address defaults to loopback, which is where a request comes from
+ * when it states no other address.
  */
-export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number): SimWafInspectedRequest;
+export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number, sourceIp?: string): SimWafInspectedRequest;

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.js

@@ -1,4 +1,7 @@
+import { isIP } from "node:net";
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
 import { simAwsRequestHostname } from "../../../serve/http/url/sim-aws-request-hostname.js";
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
 import { simWafBodyInspectionLimitBytes } from "../web-acl/sim-waf-association-config.js";
 import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
 /**
@@ -16,8 +19,15 @@ import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
  * The body inspection limit defaults to the 16 KB every resource type this
  * simulation protects reads by default. A web ACL raising it with
  * `AssociationConfig` passes the raised figure in.
+ *
+ * The client address defaults to loopback, which is where a request comes from
+ * when it states no other address.
  */
-export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes) {
+export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes, sourceIp = simAwsProxiedSourceIp) {
+    if (isIP(sourceIp) === 0) {
+        throw new SimWafDeclarationError(`A request's source address must be one IPv4 or IPv6 address, and ` +
+            `${sourceIp} is neither`);
+    }
     const url = new URL(request.url);
     return {
         method: request.method,
@@ -28,6 +38,7 @@ export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes =
         queryString: url.search.replace(/^\?/u, ""),
         headers: request.headers,
         host: simAwsRequestHostname(request),
+        sourceIp,
         body,
         bodyInspectionLimitBytes,
         labels: new SimWafRequestLabels(),

package/dist/service/wafv2/index.d.ts

@@ -25,13 +25,14 @@ export { SimWafIpSet, type SimWafIpAddressVersion, } from "./ip-set/sim-waf-ip-s
 export { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
 export type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
 export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
-export { SimWafManagedRules, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
+export { SimWafManagedRules, type SimWafManagedAddressDeclaration, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
 export type { SimWafBotDeclaration } from "./managed/sim-waf-bot-declaration.js";
 export type { SimWafManagedRuleReport } from "./managed/sim-waf-managed-rule-report.js";
 export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.js";
 export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";
 export { simWafBlockedHttpResponse, type SimWafBlockedResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { type SimWafInspectedRequest, simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simAwsSourceIpHeaderName } from "../iam/request/sim-aws-source-ip-header.js";
 export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
 export { type SimWafAssociationConfigInput, type SimWafBodyInspectionResourceType, simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export type { SimWafRateBasedStatementInput } from "./statement/sim-waf-rate-based.type.js";

package/dist/service/wafv2/index.js

@@ -20,6 +20,7 @@ export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
 export { SimWafManagedRules, } from "./managed/sim-waf-managed-rules.js";
 export { simWafBlockedHttpResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simAwsSourceIpHeaderName } from "../iam/request/sim-aws-source-ip-header.js";
 export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
 export { simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.d.ts

@@ -3,16 +3,19 @@ import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.t
  * The Amazon IP reputation list, which decides by the address a request came
  * from.
  *
- * Every request in this simulation reports a source address of `127.0.0.1`,
- * so every rule here is declared-only. A test says which requests come from a
- * flagged address with `managedRules().onRequest`, and the group labels and
- * acts on them as AWS documents.
+ * AWS publishes none of the addresses on its lists, so every rule here is
+ * declared-only. A test says which addresses a rule flags with
+ * `managedRules().onAddress`, and sends a request from one of them with the
+ * `x-sim-aws-source-ip` header. The group then labels and acts on it as AWS
+ * documents. `managedRules().onRequest` declares a match by path instead.
  */
 export declare const simWafIpReputationList: SimWafManagedRuleGroupDefinition;
 /**
  * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
  *
  * It decides by source address as the reputation list does, and every rule is
- * declared-only for the same reason.
+ * declared-only for the same reason. `AnonymousIPList` stands for the VPNs,
+ * proxies and Tor nodes, and `HostingProviderIPList` for the hosting and cloud
+ * providers other than AWS.
  */
 export declare const simWafAnonymousIpList: SimWafManagedRuleGroupDefinition;

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.js

@@ -2,15 +2,17 @@
  * The Amazon IP reputation list, which decides by the address a request came
  * from.
  *
- * Every request in this simulation reports a source address of `127.0.0.1`,
- * so every rule here is declared-only. A test says which requests come from a
- * flagged address with `managedRules().onRequest`, and the group labels and
- * acts on them as AWS documents.
+ * AWS publishes none of the addresses on its lists, so every rule here is
+ * declared-only. A test says which addresses a rule flags with
+ * `managedRules().onAddress`, and sends a request from one of them with the
+ * `x-sim-aws-source-ip` header. The group then labels and acts on it as AWS
+ * documents. `managedRules().onRequest` declares a match by path instead.
  */
 export const simWafIpReputationList = {
     name: "AWSManagedRulesAmazonIpReputationList",
     labelNamespace: "awswaf:managed:aws:amazon-ip-list",
     capacity: 25,
+    readsSourceAddress: true,
     rules: [
         {
             name: "AWSManagedIPReputationList",
@@ -34,12 +36,15 @@ export const simWafIpReputationList = {
  * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
  *
  * It decides by source address as the reputation list does, and every rule is
- * declared-only for the same reason.
+ * declared-only for the same reason. `AnonymousIPList` stands for the VPNs,
+ * proxies and Tor nodes, and `HostingProviderIPList` for the hosting and cloud
+ * providers other than AWS.
  */
 export const simWafAnonymousIpList = {
     name: "AWSManagedRulesAnonymousIpList",
     labelNamespace: "awswaf:managed:aws:anonymous-ip-list",
     capacity: 50,
+    readsSourceAddress: true,
     rules: [
         { name: "AnonymousIPList", label: "AnonymousIPList", tier: "declared" },
         {

package/dist/service/wafv2/managed/sim-waf-managed-address-declaration.d.ts

@@ -0,0 +1,32 @@
+import type { SimWafDeclared } from "./sim-waf-managed-declaration.js";
+/**
+ * The managed rules a test says flag the requests from some addresses.
+ */
+export interface SimWafManagedAddressDeclaration {
+    /**
+     * The rules that flag the addresses, by the name AWS gives them, such as
+     * `AnonymousIPList` or `HostingProviderIPList`.
+     */
+    readonly matches: readonly string[];
+}
+/**
+ * The address ranges a test declared, each with the rules that flag a request
+ * from inside it.
+ *
+ * Declaring the same range again replaces what it was declared with, and a
+ * request from inside two declared ranges is flagged by the rules of both.
+ */
+export declare class SimWafDeclaredAddresses {
+    #private;
+    /**
+     * Declare the rules that flag the requests from one address or CIDR range.
+     *
+     * Each rule is checked to be one that decides by the client address.
+     */
+    declare(range: string, ruleNames: readonly string[]): void;
+    /**
+     * What was declared for a request's path, joined with what was declared
+     * for the address it came from.
+     */
+    joinedWith(declared: SimWafDeclared, sourceIp: string): SimWafDeclared;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-declaration.js

@@ -0,0 +1,52 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+import { SimWafDeclaredAddressRange } from "./sim-waf-managed-address-range.js";
+import { requiredSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
+/**
+ * The address ranges a test declared, each with the rules that flag a request
+ * from inside it.
+ *
+ * Declaring the same range again replaces what it was declared with, and a
+ * request from inside two declared ranges is flagged by the rules of both.
+ */
+export class SimWafDeclaredAddresses {
+    #byRange = new Map();
+    /**
+     * Declare the rules that flag the requests from one address or CIDR range.
+     *
+     * Each rule is checked to be one that decides by the client address.
+     */
+    declare(range, ruleNames) {
+        const matches = new Set(ruleNames.map((name) => simWafAddressRuleName(requiredSimWafManagedRule(name))));
+        this.#byRange.set(range.trim(), SimWafDeclaredAddressRange.read(range, matches));
+    }
+    /**
+     * What was declared for a request's path, joined with what was declared
+     * for the address it came from.
+     */
+    joinedWith(declared, sourceIp) {
+        const byAddress = this.#byRange
+            .values()
+            .filter((range) => range.holds(sourceIp))
+            .flatMap((range) => range.matches)
+            .toArray();
+        if (byAddress.length === 0) {
+            return declared;
+        }
+        return {
+            matches: new Set([...declared.matches, ...byAddress]),
+            groupLabels: declared.groupLabels,
+        };
+    }
+}
+/**
+ * The name of a rule a test may declare by address, refusing one whose group
+ * reads the request rather than where it came from.
+ */
+function simWafAddressRuleName(entry) {
+    if (entry.group.readsSourceAddress !== true) {
+        throw new SimWafDeclarationError(`${entry.rule.name} belongs to ${entry.group.name}, which does not ` +
+            `decide by the client address, so a match for it is declared by path ` +
+            `with managedRules().onRequest rather than by address.`);
+    }
+    return entry.rule.name;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-range.d.ts

@@ -0,0 +1,21 @@
+/**
+ * One address or range of addresses, and the rules that flag a request from
+ * inside it.
+ */
+export declare class SimWafDeclaredAddressRange {
+    #private;
+    readonly matches: ReadonlySet<string>;
+    private constructor();
+    /**
+     * Read one range a test declared, refusing what is not an address or a CIDR
+     * range.
+     */
+    static read(range: string, matches: ReadonlySet<string>): SimWafDeclaredAddressRange;
+    /**
+     * Whether one client address falls inside this range.
+     *
+     * An IPv4 address is never inside an IPv6 range, nor the reverse, which is
+     * how an AWS IP set holding one kind treats the other.
+     */
+    holds(sourceIp: string): boolean;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-range.js

@@ -0,0 +1,73 @@
+import { BlockList, isIP } from "node:net";
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+/**
+ * One address or range of addresses, and the rules that flag a request from
+ * inside it.
+ */
+export class SimWafDeclaredAddressRange {
+    matches;
+    #addresses = new BlockList();
+    constructor(range, matches) {
+        this.matches = matches;
+        if (range.prefix === undefined) {
+            this.#addresses.addAddress(range.address, range.family);
+        }
+        else {
+            this.#addresses.addSubnet(range.address, range.prefix, range.family);
+        }
+    }
+    /**
+     * Read one range a test declared, refusing what is not an address or a CIDR
+     * range.
+     */
+    static read(range, matches) {
+        return new SimWafDeclaredAddressRange(checkedRange(range), matches);
+    }
+    /**
+     * Whether one client address falls inside this range.
+     *
+     * An IPv4 address is never inside an IPv6 range, nor the reverse, which is
+     * how an AWS IP set holding one kind treats the other.
+     */
+    holds(sourceIp) {
+        const family = familyOf(sourceIp);
+        return family !== undefined && this.#addresses.check(sourceIp, family);
+    }
+}
+/**
+ * Read an address or a CIDR range into the address, the prefix length and the
+ * family.
+ */
+function checkedRange(range) {
+    const [address = "", prefixText, ...rest] = range.trim().split("/");
+    const family = familyOf(address);
+    if (family === undefined || rest.length > 0) {
+        throw invalidRange(range);
+    }
+    if (prefixText === undefined) {
+        return { address, prefix: undefined, family };
+    }
+    const prefix = Number(prefixText);
+    const widest = family === "ipv4" ? 32 : 128;
+    if (!/^\d+$/u.test(prefixText) || prefix > widest) {
+        throw invalidRange(range);
+    }
+    return { address, prefix, family };
+}
+function familyOf(address) {
+    switch (isIP(address)) {
+        case 4: {
+            return "ipv4";
+        }
+        case 6: {
+            return "ipv6";
+        }
+        default: {
+            return undefined;
+        }
+    }
+}
+function invalidRange(range) {
+    return new SimWafDeclarationError(`A declared address match needs one IPv4 or IPv6 address, or a CIDR ` +
+        `range such as 185.220.101.0/24, and ${range} is neither`);
+}

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.d.ts

@@ -30,6 +30,13 @@ export declare function simWafManagedRuleGroupNames(): readonly string[];
  * declared match and an action override name a rule and nothing else.
  */
 export declare function findSimWafManagedRule(name: string): SimWafManagedRuleEntry | undefined;
+/**
+ * Find one managed rule by name, refusing a name no simulated group holds.
+ *
+ * A declaration naming a rule that is absent is refused where it is made,
+ * since it would otherwise sit there matching nothing.
+ */
+export declare function requiredSimWafManagedRule(name: string): SimWafManagedRuleEntry;
 /**
  * Every rule of every simulated group, in the order the groups evaluate them.
  */

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.js

@@ -1,3 +1,4 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
 import { simWafAdminProtectionRuleSet } from "./group/sim-waf-admin-protection.js";
 import { simWafBotControlRuleSet } from "./group/sim-waf-bot-control.js";
 import { simWafCommonRuleSet } from "./group/sim-waf-common-rule-set.js";
@@ -45,6 +46,20 @@ export function simWafManagedRuleGroupNames() {
 export function findSimWafManagedRule(name) {
     return rulesByName.get(name);
 }
+/**
+ * Find one managed rule by name, refusing a name no simulated group holds.
+ *
+ * A declaration naming a rule that is absent is refused where it is made,
+ * since it would otherwise sit there matching nothing.
+ */
+export function requiredSimWafManagedRule(name) {
+    const entry = rulesByName.get(name);
+    if (entry === undefined) {
+        throw new SimWafDeclarationError(`No simulated AWS managed rule group holds a rule named ${name}. The ` +
+            `rules that are simulated are reported by managedRules().rules().`);
+    }
+    return entry;
+}
 /**
  * Every rule of every simulated group, in the order the groups evaluate them.
  */

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts

@@ -52,5 +52,10 @@ export interface SimWafManagedRuleGroupDefinition {
     readonly labelNamespace: string;
     /** The WCUs the group costs, which `DescribeManagedRuleGroup` reports. */
     readonly capacity: number;
+    /**
+     * Whether the group decides by the client address alone, which is what lets
+     * a test declare its matches by address with `managedRules().onAddress`.
+     */
+    readonly readsSourceAddress?: boolean | undefined;
     readonly rules: readonly SimWafManagedRuleDefinition[];
 }

package/dist/service/wafv2/managed/sim-waf-managed-rules.d.ts

@@ -1,8 +1,10 @@
 import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
 import { type SimWafManagedRuleReport } from "./sim-waf-managed-rule-report.js";
 import type { SimWafManagedRuleTier } from "./sim-waf-managed-rule.type.js";
+import { type SimWafManagedAddressDeclaration } from "./sim-waf-managed-address-declaration.js";
 import { type SimWafDeclared, type SimWafManagedMatchDeclaration } from "./sim-waf-managed-declaration.js";
 export type { SimWafDeclared, SimWafManagedMatchDeclaration, } from "./sim-waf-managed-declaration.js";
+export type { SimWafManagedAddressDeclaration } from "./sim-waf-managed-address-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
  * covers of each rule.
@@ -28,6 +30,16 @@ export type { SimWafDeclared, SimWafManagedMatchDeclaration, } from "./sim-waf-m
  * });
  * ```
  *
+ * The IP reputation and anonymous IP groups decide by the client address, so
+ * their matches can be declared by address instead, for a request that states
+ * where it came from with the `x-sim-aws-source-ip` header:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onAddress("185.220.101.0/24", {
+ *   matches: ["AnonymousIPList"],
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
@@ -42,9 +54,24 @@ export declare class SimWafManagedRules {
      * is refused here rather than matching nothing later.
      */
     onRequest(uriPath: string, declaration: SimWafManagedMatchDeclaration): void;
+    /**
+     * Declare which managed rules flag the requests from one address or one
+     * CIDR range of addresses.
+     *
+     * Only the rules of a group that decides by the client address can be
+     * declared this way, which is the IP reputation list and the anonymous IP
+     * list. A request states its address with the `x-sim-aws-source-ip` header,
+     * and one that states none comes from `127.0.0.1`.
+     *
+     * Declaring the same range again replaces it.
+     */
+    onAddress(range: string, declaration: SimWafManagedAddressDeclaration): void;
     /**
      * What a test declared about one request: the rules that claim it, and the
      * labels a group adds to it whatever its rules decide.
+     *
+     * A request is claimed by what was declared for its path and for its
+     * address together.
      */
     declared(request: SimWafInspectedRequest): SimWafDeclared;
     /**
@@ -59,5 +86,4 @@ export declare class SimWafManagedRules {
      * AWS rule they stand for.
      */
     rules(): readonly SimWafManagedRuleReport[];
-    private requiredRule;
 }

package/dist/service/wafv2/managed/sim-waf-managed-rules.js

@@ -1,6 +1,7 @@
 import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
-import { findSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
+import { requiredSimWafManagedRule } from "./sim-waf-managed-rule-groups.js";
 import { simWafManagedRuleReports, } from "./sim-waf-managed-rule-report.js";
+import { SimWafDeclaredAddresses, } from "./sim-waf-managed-address-declaration.js";
 import { simWafNothingDeclared, simWafReadDeclaration, } from "./sim-waf-managed-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
@@ -27,12 +28,23 @@ import { simWafNothingDeclared, simWafReadDeclaration, } from "./sim-waf-managed
  * });
  * ```
  *
+ * The IP reputation and anonymous IP groups decide by the client address, so
+ * their matches can be declared by address instead, for a request that states
+ * where it came from with the `x-sim-aws-source-ip` header:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onAddress("185.220.101.0/24", {
+ *   matches: ["AnonymousIPList"],
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
  */
 export class SimWafManagedRules {
     #byUriPath = new Map();
+    #byAddress = new SimWafDeclaredAddresses();
     /**
      * Declare which managed rules claim a request to one URI path.
      *
@@ -45,20 +57,37 @@ export class SimWafManagedRules {
             throw new SimWafDeclarationError("A declared managed rule match needs the URI path of the request it " +
                 "is declared for");
         }
-        this.#byUriPath.set(uriPath, simWafReadDeclaration(declaration, (name) => this.requiredRule(name).rule.name));
+        this.#byUriPath.set(uriPath, simWafReadDeclaration(declaration, (name) => requiredSimWafManagedRule(name).rule.name));
+    }
+    /**
+     * Declare which managed rules flag the requests from one address or one
+     * CIDR range of addresses.
+     *
+     * Only the rules of a group that decides by the client address can be
+     * declared this way, which is the IP reputation list and the anonymous IP
+     * list. A request states its address with the `x-sim-aws-source-ip` header,
+     * and one that states none comes from `127.0.0.1`.
+     *
+     * Declaring the same range again replaces it.
+     */
+    onAddress(range, declaration) {
+        this.#byAddress.declare(range, declaration.matches);
     }
     /**
      * What a test declared about one request: the rules that claim it, and the
      * labels a group adds to it whatever its rules decide.
+     *
+     * A request is claimed by what was declared for its path and for its
+     * address together.
      */
     declared(request) {
-        return this.#byUriPath.get(request.uriPath) ?? simWafNothingDeclared;
+        return this.#byAddress.joinedWith(this.#byUriPath.get(request.uriPath) ?? simWafNothingDeclared, request.sourceIp);
     }
     /**
      * What this simulation covers of one managed rule.
      */
     tierOf(ruleName) {
-        return this.requiredRule(ruleName).rule.tier;
+        return requiredSimWafManagedRule(ruleName).rule.tier;
     }
     /**
      * What this simulation covers of every managed rule it carries.
@@ -70,13 +99,4 @@ export class SimWafManagedRules {
     rules() {
         return simWafManagedRuleReports();
     }
-    requiredRule(ruleName) {
-        const entry = findSimWafManagedRule(ruleName);
-        if (entry === undefined) {
-            throw new SimWafDeclarationError(`No simulated AWS managed rule group holds a rule named ` +
-                `${ruleName}. The rules that are simulated are reported by ` +
-                `managedRules().rules().`);
-        }
-        return entry;
-    }
 }

package/dist/service/wafv2/sim-wafv2.js

@@ -98,7 +98,8 @@ export class SimWafV2 extends SimWafSets {
     evaluateRequest(evaluation) {
         const webAcl = this.requireWebAcl(evaluation.webAclArn);
         const limitBytes = webAcl.bodyInspectionLimitBytes(evaluation.resourceType);
-        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body, limitBytes));
+        const { request, body, sourceIp } = evaluation;
+        return webAcl.evaluate(simWafInspectedRequest(request, body, limitBytes, sourceIp));
     }
     /**
      * What the AWS managed rule groups do here, and what a test declares of

package/dist/service/wafv2/statement/sim-waf-rate-based-input.d.ts

@@ -36,10 +36,11 @@ export declare function simWafRateWindowMilliseconds(statement: SimWafRateBasedS
 /**
  * Read how a rate-based statement groups the requests it counts.
  *
- * `IP` counts each client address on its own. Every request in this simulation
- * reports `simAwsProxiedSourceIp`, leaving one client for the whole
- * simulation. A rate limiting test sends its requests from one client and
- * expects the rule to trip, so that is the case anybody would write.
+ * `IP` counts each client address on its own. A request comes from
+ * `127.0.0.1` unless it states another address with `x-sim-aws-source-ip`, so
+ * a test that states none has one client for the whole simulation. That is
+ * the case a rate limiting test is usually written about: one client, sending
+ * until the rule trips.
  *
  * `CONSTANT` counts every request the statement sees together, and AWS asks
  * for a scope-down statement alongside it to say which requests those are. A