@kensio/yulin 1.22.0 → 1.23.0

package/dist/serve/controller/sim-service-controller.d.ts

@@ -25,6 +25,7 @@ interface SimAwsServiceRequestProperties {
     readonly request: Request;
     readonly caller?: SimAwsRequestCaller | undefined;
     readonly source?: SimAwsRequestSource | undefined;
+    readonly sourceIp?: string | undefined;
     readonly body?: Uint8Array | undefined;
 }
 /**
@@ -49,6 +50,11 @@ export declare class SimAwsServiceRequest {
      * conditioned on, and most requests state none.
      */
     readonly source: SimAwsRequestSource | undefined;
+    /**
+     * The client address the request came from, which is loopback unless the
+     * request stated another with `x-sim-aws-source-ip`.
+     */
+    readonly sourceIp: string;
     readonly body?: Uint8Array | undefined;
     constructor(properties: SimAwsServiceRequestProperties);
 }

package/dist/serve/controller/sim-service-controller.js

@@ -1,3 +1,4 @@
+import { simAwsProxiedSourceIp } from "../http/sim-aws-proxied-connection.js";
 import { SimAwsRequestCaller } from "../../service/iam/request/sim-aws-request-caller.js";
 /**
  * One HTTP request, routed to a simulated service and attributed to a
@@ -21,6 +22,11 @@ export class SimAwsServiceRequest {
      * conditioned on, and most requests state none.
      */
     source;
+    /**
+     * The client address the request came from, which is loopback unless the
+     * request stated another with `x-sim-aws-source-ip`.
+     */
+    sourceIp;
     body;
     constructor(properties) {
         this.target = properties.target;
@@ -28,6 +34,7 @@ export class SimAwsServiceRequest {
         // An unattributed request is anonymous, never the Account root.
         this.caller = properties.caller ?? SimAwsRequestCaller.anonymous();
         this.source = properties.source;
+        this.sourceIp = properties.sourceIp ?? simAwsProxiedSourceIp;
         this.body = properties.body;
     }
 }

package/dist/serve/http/request/sim-aws-request-authenticator.js

@@ -1,6 +1,7 @@
 import { simAwsServiceSigningName } from "../../controller/sim-aws-service-signing-name.js";
 import { SimAwsServiceRequest, } from "../../controller/sim-service-controller.js";
 import { SimAwsRequestSource } from "../../../service/iam/request/sim-aws-request-source.js";
+import { simAwsRequestSourceIp } from "../../../service/iam/request/sim-aws-source-ip-header.js";
 import { SimAwsReceivedRequest } from "./sim-aws-received-request.js";
 /**
  * Turns a received HTTP request into a request a simulated service can serve.
@@ -40,11 +41,13 @@ export class SimAwsRequestAuthenticator {
             },
         });
         const source = SimAwsRequestSource.fromHeaders(request.headers);
+        const sourceIp = simAwsRequestSourceIp(request.headers);
         return new SimAwsServiceRequest({
             target,
             request: received.forService(),
             caller,
             ...(source !== undefined && { source }),
+            sourceIp,
             body: received.body,
         });
     }

package/dist/service/apigateway/serve/sim-api-gateway-controller.js

@@ -77,6 +77,7 @@ export class SimApiGatewayServiceController {
             restApi,
             stageName: restApiRequest.segments[0] ?? "",
             request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         if (inspected.blocked !== undefined) {
             return inspected.blocked;

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.d.ts

@@ -5,6 +5,8 @@ interface SimRestApiInspectionInput {
     /** The first path segment of the request, which names the stage. */
     readonly stageName: string;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
 }
 /**
  * Puts a request to the web ACL in front of the stage it reached.

package/dist/service/apigateway/serve/sim-rest-api-web-acl-inspection.js

@@ -20,6 +20,7 @@ export class SimRestApiWebAclInspection {
             protection: restApi.webAcls,
             resourceArn: restApi.stageArn(input.stageName),
             request,
+            sourceIp: input.sourceIp,
             forwardBody: true,
         });
     }

package/dist/service/cognito/serve/sim-cognito-controller.js

@@ -69,7 +69,7 @@ export class SimCognitoServiceController {
         // The web ACL sits in front of the endpoint rather than behind it, so a
         // request it blocks is answered before the method is judged. A write the
         // rules turned away gets WAF's 403 and never learns the endpoint reads.
-        const blocked = await this.blocked(pool, segment, request);
+        const blocked = await this.blocked(pool, segment, serviceRequest);
         if (blocked !== undefined) {
             return blocked;
         }
@@ -90,14 +90,15 @@ export class SimCognitoServiceController {
      * A blocked request is answered before the document is read, so a verifier
      * the rules turn away gets 403 and no keys.
      */
-    async blocked(pool, segment, request) {
+    async blocked(pool, segment, serviceRequest) {
         if (!simCognitoProtectedSegment(segment)) {
             return undefined;
         }
         const inspected = await this.webAcl.inspect({
             pool,
             cognito: simCognitoPoolScope(this.simAws, pool),
-            request,
+            request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         return inspected.blocked;
     }

package/dist/service/cognito/serve/sim-cognito-domain-controller.js

@@ -44,6 +44,7 @@ export class SimCognitoDomainController {
             pool,
             cognito,
             request: serviceRequest.request,
+            sourceIp: serviceRequest.sourceIp,
         });
         if (inspected.blocked !== undefined) {
             return inspected.blocked;
@@ -95,6 +96,7 @@ function forwarded(serviceRequest, request) {
         request,
         caller: serviceRequest.caller,
         source: serviceRequest.source,
+        sourceIp: serviceRequest.sourceIp,
         body: serviceRequest.body,
     });
 }

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.d.ts

@@ -6,6 +6,8 @@ interface SimCognitoInspectionInput {
     /** The simulated Cognito scope the pool belongs to. */
     readonly cognito: SimCognitoIdentityProvider;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
 }
 /**
  * Puts a request to the web ACL in front of the pool it reached.

package/dist/service/cognito/serve/sim-cognito-web-acl-inspection.js

@@ -23,6 +23,7 @@ export class SimCognitoWebAclInspection {
             protection: input.cognito.webAcls(),
             resourceArn: input.pool.arn.value,
             request: input.request,
+            sourceIp: input.sourceIp,
             forwardBody: false,
         });
     }

package/dist/service/iam/index.d.ts

@@ -9,4 +9,5 @@ export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-sc
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { type SimAwsRequestAuthMethod, SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
 export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
+export { simAwsRequestSourceIp, simAwsSourceIpHeaderName, } from "./request/sim-aws-source-ip-header.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, type SimAwsRequestAuthFailure, } from "./request/error/sim-aws-request-auth.error.js";

package/dist/service/iam/index.js

@@ -4,4 +4,5 @@ export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSign
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
 export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
+export { simAwsRequestSourceIp, simAwsSourceIpHeaderName, } from "./request/sim-aws-source-ip-header.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, } from "./request/error/sim-aws-request-auth.error.js";

package/dist/service/iam/request/error/sim-aws-request-auth.error.d.ts

@@ -1,7 +1,7 @@
 import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
 /**
  * Raised when the `x-sim-aws-caller` header does not name a principal the
- * simulator understands.
+ * simulator understands, or `x-sim-aws-source-ip` names no address.
  *
  * This is a simulator control header rather than anything real AWS defines, so
  * a bad value is the caller's mistake in using Yulin, not a failed AWS

package/dist/service/iam/request/error/sim-aws-request-auth.error.js

@@ -1,7 +1,7 @@
 import { SimIamSigV4Error } from "../../sigv4/error/sim-iam-sigv4.error.js";
 /**
  * Raised when the `x-sim-aws-caller` header does not name a principal the
- * simulator understands.
+ * simulator understands, or `x-sim-aws-source-ip` names no address.
  *
  * This is a simulator control header rather than anything real AWS defines, so
  * a bad value is the caller's mistake in using Yulin, not a failed AWS

package/dist/service/iam/request/sim-aws-control-headers.d.ts

@@ -2,7 +2,8 @@
  * Header names that are instructions to the simulator rather than part of the
  * request being simulated.
  *
- * They state who a request is from and what it is for, so anything passing a
+ * They state who a request is from, where it came from and what it is for, so
+ * anything passing a
  * request on to a simulated service has to decide what to do with them rather
  * than forward them by accident: the HTTP boundary strips them once the
  * request has been attributed, and sim CloudFront strips a viewer's before

package/dist/service/iam/request/sim-aws-control-headers.js

@@ -1,10 +1,12 @@
 import { simAwsCallerHeaderName } from "./sim-aws-caller-header.js";
+import { simAwsSourceIpHeaderName } from "./sim-aws-source-ip-header.js";
 import { simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./sim-aws-request-source.js";
 /**
  * Header names that are instructions to the simulator rather than part of the
  * request being simulated.
  *
- * They state who a request is from and what it is for, so anything passing a
+ * They state who a request is from, where it came from and what it is for, so
+ * anything passing a
  * request on to a simulated service has to decide what to do with them rather
  * than forward them by accident: the HTTP boundary strips them once the
  * request has been attributed, and sim CloudFront strips a viewer's before
@@ -14,6 +16,7 @@ export const simAwsControlHeaderNames = [
     simAwsCallerHeaderName,
     simAwsSourceArnHeaderName,
     simAwsSourceAccountHeaderName,
+    simAwsSourceIpHeaderName,
 ];
 /**
  * Remove the simulator's control headers from a set of request headers.

package/dist/service/iam/request/sim-aws-source-ip-header.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The header naming the client address a request into simulated AWS comes
+ * from.
+ *
+ * A request arrives in process or over loopback, so there is no remote address
+ * for the simulation to read. Whatever decides by where a request came from,
+ * such as a web ACL's IP reputation and anonymous IP rules, reads this instead,
+ * and a test sends it to say which client a request stands for.
+ */
+export declare const simAwsSourceIpHeaderName = "x-sim-aws-source-ip";
+/**
+ * Read the client address a request states, or the loopback address when it
+ * states none.
+ *
+ * The header holds one IPv4 or IPv6 address. A value that is neither is
+ * refused rather than read as loopback, since a test that misspelt an address
+ * would otherwise pass for the wrong reason.
+ */
+export declare function simAwsRequestSourceIp(headers: Headers): string;

package/dist/service/iam/request/sim-aws-source-ip-header.js

@@ -0,0 +1,32 @@
+import { isIP } from "node:net";
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
+import { SimAwsInvalidCallerHeader } from "./error/sim-aws-request-auth.error.js";
+/**
+ * The header naming the client address a request into simulated AWS comes
+ * from.
+ *
+ * A request arrives in process or over loopback, so there is no remote address
+ * for the simulation to read. Whatever decides by where a request came from,
+ * such as a web ACL's IP reputation and anonymous IP rules, reads this instead,
+ * and a test sends it to say which client a request stands for.
+ */
+export const simAwsSourceIpHeaderName = "x-sim-aws-source-ip";
+/**
+ * Read the client address a request states, or the loopback address when it
+ * states none.
+ *
+ * The header holds one IPv4 or IPv6 address. A value that is neither is
+ * refused rather than read as loopback, since a test that misspelt an address
+ * would otherwise pass for the wrong reason.
+ */
+export function simAwsRequestSourceIp(headers) {
+    const value = headers.get(simAwsSourceIpHeaderName)?.trim();
+    if (value === undefined || value === "") {
+        return simAwsProxiedSourceIp;
+    }
+    if (isIP(value) === 0) {
+        throw new SimAwsInvalidCallerHeader(`${simAwsSourceIpHeaderName} value ${value} must be one IPv4 or IPv6 ` +
+            `address`);
+    }
+    return value;
+}

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -75,7 +75,7 @@ export class SimWafAssociations {
         if (association === undefined) {
             return undefined;
         }
-        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body, association.webAcl.bodyInspectionLimitBytes(association.resourceType)));
+        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body, association.webAcl.bodyInspectionLimitBytes(association.resourceType), request.sourceIp));
     }
     /**
      * Forget whatever is in front of one resource.

package/dist/service/wafv2/association/sim-waf-protection.d.ts

@@ -6,6 +6,11 @@ export interface SimWafProtectedRequest {
     /** The resource the request reached, by ARN. */
     readonly resourceArn: string;
     readonly request: Request;
+    /**
+     * The client address the request came from, which is loopback when nothing
+     * says otherwise.
+     */
+    readonly sourceIp?: string | undefined;
     /**
      * The request body, when the rules might inspect it. A request body is a
      * stream that cannot be read twice, so it is passed in already buffered.

package/dist/service/wafv2/association/sim-waf-request-inspection.d.ts

@@ -5,6 +5,8 @@ interface SimWafInspectionInput {
     /** The resource the request reached, by ARN. */
     readonly resourceArn: string;
     readonly request: Request;
+    /** The client address the request came from. */
+    readonly sourceIp: string;
     /**
      * Whether the fronting service forwards the request body to AWS WAF.
      *

package/dist/service/wafv2/association/sim-waf-request-inspection.js

@@ -27,12 +27,17 @@ export class SimWafRequestInspection {
      * Put one request to whatever protects the resource it addressed.
      */
     async inspect(input) {
-        const { protection, resourceArn, request } = input;
+        const { protection, resourceArn, request, sourceIp } = input;
         if (!protection.protects(resourceArn)) {
             return new SimWafInspected({ request });
         }
         const body = input.forwardBody ? await inspectedBody(request) : undefined;
-        const decision = protection.decide({ resourceArn, request, body });
+        const decision = protection.decide({
+            resourceArn,
+            request,
+            sourceIp,
+            body,
+        });
         // A decision carries a blocked response when its action was to block, and
         // carries none when the request was allowed. That one reading is what
         // decides the request here.

package/dist/service/wafv2/evaluate/sim-waf-evaluation-request.d.ts

@@ -6,6 +6,11 @@ export interface SimWafEvaluationRequest {
     /** The web ACL to evaluate against, by ARN. */
     readonly webAclArn: string;
     readonly request: Request;
+    /**
+     * The client address the request came from. A request naming none comes
+     * from `127.0.0.1`, as every request does that states no other address.
+     */
+    readonly sourceIp?: string | undefined;
     /**
      * The request body, when the rules might inspect it. A request body is a
      * stream that cannot be read twice, so it is passed in already buffered.

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.d.ts

@@ -20,6 +20,14 @@ export interface SimWafInspectedRequest {
      * header with the Yulin-local suffix taken off it.
      */
     readonly host: string;
+    /**
+     * The client address the request came from, which is what the IP-based
+     * rules read.
+     *
+     * Nothing reaches this simulation over a public network, so this is
+     * `127.0.0.1` unless the request said otherwise with `x-sim-aws-source-ip`.
+     */
+    readonly sourceIp: string;
     /** The request body, or nothing when the request carried none. */
     readonly body: Uint8Array | undefined;
     /**
@@ -49,5 +57,8 @@ export interface SimWafInspectedRequest {
  * The body inspection limit defaults to the 16 KB every resource type this
  * simulation protects reads by default. A web ACL raising it with
  * `AssociationConfig` passes the raised figure in.
+ *
+ * The client address defaults to loopback, which is where a request comes from
+ * when it states no other address.
  */
-export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number): SimWafInspectedRequest;
+export declare function simWafInspectedRequest(request: Request, body?: Uint8Array, bodyInspectionLimitBytes?: number, sourceIp?: string): SimWafInspectedRequest;

package/dist/service/wafv2/evaluate/sim-waf-inspected-request.js

@@ -1,4 +1,7 @@
+import { isIP } from "node:net";
+import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
 import { simAwsRequestHostname } from "../../../serve/http/url/sim-aws-request-hostname.js";
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
 import { simWafBodyInspectionLimitBytes } from "../web-acl/sim-waf-association-config.js";
 import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
 /**
@@ -16,8 +19,15 @@ import { SimWafRequestLabels } from "./sim-waf-request-labels.js";
  * The body inspection limit defaults to the 16 KB every resource type this
  * simulation protects reads by default. A web ACL raising it with
  * `AssociationConfig` passes the raised figure in.
+ *
+ * The client address defaults to loopback, which is where a request comes from
+ * when it states no other address.
  */
-export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes) {
+export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes = simWafBodyInspectionLimitBytes, sourceIp = simAwsProxiedSourceIp) {
+    if (isIP(sourceIp) === 0) {
+        throw new SimWafDeclarationError(`A request's source address must be one IPv4 or IPv6 address, and ` +
+            `${sourceIp} is neither`);
+    }
     const url = new URL(request.url);
     return {
         method: request.method,
@@ -28,6 +38,7 @@ export function simWafInspectedRequest(request, body, bodyInspectionLimitBytes =
         queryString: url.search.replace(/^\?/u, ""),
         headers: request.headers,
         host: simAwsRequestHostname(request),
+        sourceIp,
         body,
         bodyInspectionLimitBytes,
         labels: new SimWafRequestLabels(),

package/dist/service/wafv2/index.d.ts

@@ -25,13 +25,14 @@ export { SimWafIpSet, type SimWafIpAddressVersion, } from "./ip-set/sim-waf-ip-s
 export { SimWafRegexPatternSet } from "./regex-pattern-set/sim-waf-regex-pattern-set.js";
 export type { SimWafDecision } from "./evaluate/sim-waf-decision.js";
 export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
-export { SimWafManagedRules, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
+export { SimWafManagedRules, type SimWafManagedAddressDeclaration, type SimWafManagedMatchDeclaration, } from "./managed/sim-waf-managed-rules.js";
 export type { SimWafBotDeclaration } from "./managed/sim-waf-bot-declaration.js";
 export type { SimWafManagedRuleReport } from "./managed/sim-waf-managed-rule-report.js";
 export type { SimWafManagedRuleTier } from "./managed/sim-waf-managed-rule.type.js";
 export type { SimWafManagedRuleGroupStatementInput, SimWafOverrideActionInput, SimWafRuleActionOverrideInput, } from "./managed/sim-waf-managed-group.type.js";
 export { simWafBlockedHttpResponse, type SimWafBlockedResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { type SimWafInspectedRequest, simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simAwsSourceIpHeaderName } from "../iam/request/sim-aws-source-ip-header.js";
 export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
 export { type SimWafAssociationConfigInput, type SimWafBodyInspectionResourceType, simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export type { SimWafRateBasedStatementInput } from "./statement/sim-waf-rate-based.type.js";

package/dist/service/wafv2/index.js

@@ -20,6 +20,7 @@ export { SimWafRequestLabels } from "./evaluate/sim-waf-request-labels.js";
 export { SimWafManagedRules, } from "./managed/sim-waf-managed-rules.js";
 export { simWafBlockedHttpResponse, simWafDefaultBlockedResponse, } from "./evaluate/sim-waf-blocked-response.js";
 export { simWafInspectedRequest, } from "./evaluate/sim-waf-inspected-request.js";
+export { simAwsSourceIpHeaderName } from "../iam/request/sim-aws-source-ip-header.js";
 export { simWafHeaderInspectionLimitBytes } from "./statement/sim-waf-field-content.js";
 export { simWafBodyInspectionLimitBytes, } from "./web-acl/sim-waf-association-config.js";
 export { SimWafAssociatedItemException, SimWafDeclarationError, SimWafDuplicateItemException, SimWafError, SimWafInvalidParameterException, SimWafNonexistentItemException, SimWafOptimisticLockException, SimWafUnavailableEntityException, SimWafUnsimulatedInputException, } from "./error/sim-wafv2.error.js";

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.d.ts

@@ -3,16 +3,19 @@ import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.t
  * The Amazon IP reputation list, which decides by the address a request came
  * from.
  *
- * Every request in this simulation reports a source address of `127.0.0.1`,
- * so every rule here is declared-only. A test says which requests come from a
- * flagged address with `managedRules().onRequest`, and the group labels and
- * acts on them as AWS documents.
+ * AWS publishes none of the addresses on its lists, so every rule here is
+ * declared-only. A test says which addresses a rule flags with
+ * `managedRules().onAddress`, and sends a request from one of them with the
+ * `x-sim-aws-source-ip` header. The group then labels and acts on it as AWS
+ * documents. `managedRules().onRequest` declares a match by path instead.
  */
 export declare const simWafIpReputationList: SimWafManagedRuleGroupDefinition;
 /**
  * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
  *
  * It decides by source address as the reputation list does, and every rule is
- * declared-only for the same reason.
+ * declared-only for the same reason. `AnonymousIPList` stands for the VPNs,
+ * proxies and Tor nodes, and `HostingProviderIPList` for the hosting and cloud
+ * providers other than AWS.
  */
 export declare const simWafAnonymousIpList: SimWafManagedRuleGroupDefinition;

package/dist/service/wafv2/managed/group/sim-waf-ip-reputation.js

@@ -2,15 +2,17 @@
  * The Amazon IP reputation list, which decides by the address a request came
  * from.
  *
- * Every request in this simulation reports a source address of `127.0.0.1`,
- * so every rule here is declared-only. A test says which requests come from a
- * flagged address with `managedRules().onRequest`, and the group labels and
- * acts on them as AWS documents.
+ * AWS publishes none of the addresses on its lists, so every rule here is
+ * declared-only. A test says which addresses a rule flags with
+ * `managedRules().onAddress`, and sends a request from one of them with the
+ * `x-sim-aws-source-ip` header. The group then labels and acts on it as AWS
+ * documents. `managedRules().onRequest` declares a match by path instead.
  */
 export const simWafIpReputationList = {
     name: "AWSManagedRulesAmazonIpReputationList",
     labelNamespace: "awswaf:managed:aws:amazon-ip-list",
     capacity: 25,
+    readsSourceAddress: true,
     rules: [
         {
             name: "AWSManagedIPReputationList",
@@ -34,12 +36,15 @@ export const simWafIpReputationList = {
  * The anonymous IP list, for VPNs, proxies, Tor nodes and hosting providers.
  *
  * It decides by source address as the reputation list does, and every rule is
- * declared-only for the same reason.
+ * declared-only for the same reason. `AnonymousIPList` stands for the VPNs,
+ * proxies and Tor nodes, and `HostingProviderIPList` for the hosting and cloud
+ * providers other than AWS.
  */
 export const simWafAnonymousIpList = {
     name: "AWSManagedRulesAnonymousIpList",
     labelNamespace: "awswaf:managed:aws:anonymous-ip-list",
     capacity: 50,
+    readsSourceAddress: true,
     rules: [
         { name: "AnonymousIPList", label: "AnonymousIPList", tier: "declared" },
         {

package/dist/service/wafv2/managed/sim-waf-managed-address-declaration.d.ts

@@ -0,0 +1,32 @@
+import type { SimWafDeclared } from "./sim-waf-managed-declaration.js";
+/**
+ * The managed rules a test says flag the requests from some addresses.
+ */
+export interface SimWafManagedAddressDeclaration {
+    /**
+     * The rules that flag the addresses, by the name AWS gives them, such as
+     * `AnonymousIPList` or `HostingProviderIPList`.
+     */
+    readonly matches: readonly string[];
+}
+/**
+ * The address ranges a test declared, each with the rules that flag a request
+ * from inside it.
+ *
+ * Declaring the same range again replaces what it was declared with, and a
+ * request from inside two declared ranges is flagged by the rules of both.
+ */
+export declare class SimWafDeclaredAddresses {
+    #private;
+    /**
+     * Declare the rules that flag the requests from one address or CIDR range.
+     *
+     * Each rule is checked to be one that decides by the client address.
+     */
+    declare(range: string, ruleNames: readonly string[]): void;
+    /**
+     * What was declared for a request's path, joined with what was declared
+     * for the address it came from.
+     */
+    joinedWith(declared: SimWafDeclared, sourceIp: string): SimWafDeclared;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-declaration.js

@@ -0,0 +1,52 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+import { SimWafDeclaredAddressRange } from "./sim-waf-managed-address-range.js";
+import { requiredSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
+/**
+ * The address ranges a test declared, each with the rules that flag a request
+ * from inside it.
+ *
+ * Declaring the same range again replaces what it was declared with, and a
+ * request from inside two declared ranges is flagged by the rules of both.
+ */
+export class SimWafDeclaredAddresses {
+    #byRange = new Map();
+    /**
+     * Declare the rules that flag the requests from one address or CIDR range.
+     *
+     * Each rule is checked to be one that decides by the client address.
+     */
+    declare(range, ruleNames) {
+        const matches = new Set(ruleNames.map((name) => simWafAddressRuleName(requiredSimWafManagedRule(name))));
+        this.#byRange.set(range.trim(), SimWafDeclaredAddressRange.read(range, matches));
+    }
+    /**
+     * What was declared for a request's path, joined with what was declared
+     * for the address it came from.
+     */
+    joinedWith(declared, sourceIp) {
+        const byAddress = this.#byRange
+            .values()
+            .filter((range) => range.holds(sourceIp))
+            .flatMap((range) => range.matches)
+            .toArray();
+        if (byAddress.length === 0) {
+            return declared;
+        }
+        return {
+            matches: new Set([...declared.matches, ...byAddress]),
+            groupLabels: declared.groupLabels,
+        };
+    }
+}
+/**
+ * The name of a rule a test may declare by address, refusing one whose group
+ * reads the request rather than where it came from.
+ */
+function simWafAddressRuleName(entry) {
+    if (entry.group.readsSourceAddress !== true) {
+        throw new SimWafDeclarationError(`${entry.rule.name} belongs to ${entry.group.name}, which does not ` +
+            `decide by the client address, so a match for it is declared by path ` +
+            `with managedRules().onRequest rather than by address.`);
+    }
+    return entry.rule.name;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-range.d.ts

@@ -0,0 +1,21 @@
+/**
+ * One address or range of addresses, and the rules that flag a request from
+ * inside it.
+ */
+export declare class SimWafDeclaredAddressRange {
+    #private;
+    readonly matches: ReadonlySet<string>;
+    private constructor();
+    /**
+     * Read one range a test declared, refusing what is not an address or a CIDR
+     * range.
+     */
+    static read(range: string, matches: ReadonlySet<string>): SimWafDeclaredAddressRange;
+    /**
+     * Whether one client address falls inside this range.
+     *
+     * An IPv4 address is never inside an IPv6 range, nor the reverse, which is
+     * how an AWS IP set holding one kind treats the other.
+     */
+    holds(sourceIp: string): boolean;
+}

package/dist/service/wafv2/managed/sim-waf-managed-address-range.js

@@ -0,0 +1,73 @@
+import { BlockList, isIP } from "node:net";
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
+/**
+ * One address or range of addresses, and the rules that flag a request from
+ * inside it.
+ */
+export class SimWafDeclaredAddressRange {
+    matches;
+    #addresses = new BlockList();
+    constructor(range, matches) {
+        this.matches = matches;
+        if (range.prefix === undefined) {
+            this.#addresses.addAddress(range.address, range.family);
+        }
+        else {
+            this.#addresses.addSubnet(range.address, range.prefix, range.family);
+        }
+    }
+    /**
+     * Read one range a test declared, refusing what is not an address or a CIDR
+     * range.
+     */
+    static read(range, matches) {
+        return new SimWafDeclaredAddressRange(checkedRange(range), matches);
+    }
+    /**
+     * Whether one client address falls inside this range.
+     *
+     * An IPv4 address is never inside an IPv6 range, nor the reverse, which is
+     * how an AWS IP set holding one kind treats the other.
+     */
+    holds(sourceIp) {
+        const family = familyOf(sourceIp);
+        return family !== undefined && this.#addresses.check(sourceIp, family);
+    }
+}
+/**
+ * Read an address or a CIDR range into the address, the prefix length and the
+ * family.
+ */
+function checkedRange(range) {
+    const [address = "", prefixText, ...rest] = range.trim().split("/");
+    const family = familyOf(address);
+    if (family === undefined || rest.length > 0) {
+        throw invalidRange(range);
+    }
+    if (prefixText === undefined) {
+        return { address, prefix: undefined, family };
+    }
+    const prefix = Number(prefixText);
+    const widest = family === "ipv4" ? 32 : 128;
+    if (!/^\d+$/u.test(prefixText) || prefix > widest) {
+        throw invalidRange(range);
+    }
+    return { address, prefix, family };
+}
+function familyOf(address) {
+    switch (isIP(address)) {
+        case 4: {
+            return "ipv4";
+        }
+        case 6: {
+            return "ipv6";
+        }
+        default: {
+            return undefined;
+        }
+    }
+}
+function invalidRange(range) {
+    return new SimWafDeclarationError(`A declared address match needs one IPv4 or IPv6 address, or a CIDR ` +
+        `range such as 185.220.101.0/24, and ${range} is neither`);
+}

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.d.ts

@@ -30,6 +30,13 @@ export declare function simWafManagedRuleGroupNames(): readonly string[];
  * declared match and an action override name a rule and nothing else.
  */
 export declare function findSimWafManagedRule(name: string): SimWafManagedRuleEntry | undefined;
+/**
+ * Find one managed rule by name, refusing a name no simulated group holds.
+ *
+ * A declaration naming a rule that is absent is refused where it is made,
+ * since it would otherwise sit there matching nothing.
+ */
+export declare function requiredSimWafManagedRule(name: string): SimWafManagedRuleEntry;
 /**
  * Every rule of every simulated group, in the order the groups evaluate them.
  */

package/dist/service/wafv2/managed/sim-waf-managed-rule-groups.js

@@ -1,3 +1,4 @@
+import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
 import { simWafAdminProtectionRuleSet } from "./group/sim-waf-admin-protection.js";
 import { simWafBotControlRuleSet } from "./group/sim-waf-bot-control.js";
 import { simWafCommonRuleSet } from "./group/sim-waf-common-rule-set.js";
@@ -45,6 +46,20 @@ export function simWafManagedRuleGroupNames() {
 export function findSimWafManagedRule(name) {
     return rulesByName.get(name);
 }
+/**
+ * Find one managed rule by name, refusing a name no simulated group holds.
+ *
+ * A declaration naming a rule that is absent is refused where it is made,
+ * since it would otherwise sit there matching nothing.
+ */
+export function requiredSimWafManagedRule(name) {
+    const entry = rulesByName.get(name);
+    if (entry === undefined) {
+        throw new SimWafDeclarationError(`No simulated AWS managed rule group holds a rule named ${name}. The ` +
+            `rules that are simulated are reported by managedRules().rules().`);
+    }
+    return entry;
+}
 /**
  * Every rule of every simulated group, in the order the groups evaluate them.
  */

package/dist/service/wafv2/managed/sim-waf-managed-rule.type.d.ts

@@ -52,5 +52,10 @@ export interface SimWafManagedRuleGroupDefinition {
     readonly labelNamespace: string;
     /** The WCUs the group costs, which `DescribeManagedRuleGroup` reports. */
     readonly capacity: number;
+    /**
+     * Whether the group decides by the client address alone, which is what lets
+     * a test declare its matches by address with `managedRules().onAddress`.
+     */
+    readonly readsSourceAddress?: boolean | undefined;
     readonly rules: readonly SimWafManagedRuleDefinition[];
 }

package/dist/service/wafv2/managed/sim-waf-managed-rules.d.ts

@@ -1,8 +1,10 @@
 import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
 import { type SimWafManagedRuleReport } from "./sim-waf-managed-rule-report.js";
 import type { SimWafManagedRuleTier } from "./sim-waf-managed-rule.type.js";
+import { type SimWafManagedAddressDeclaration } from "./sim-waf-managed-address-declaration.js";
 import { type SimWafDeclared, type SimWafManagedMatchDeclaration } from "./sim-waf-managed-declaration.js";
 export type { SimWafDeclared, SimWafManagedMatchDeclaration, } from "./sim-waf-managed-declaration.js";
+export type { SimWafManagedAddressDeclaration } from "./sim-waf-managed-address-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
  * covers of each rule.
@@ -28,6 +30,16 @@ export type { SimWafDeclared, SimWafManagedMatchDeclaration, } from "./sim-waf-m
  * });
  * ```
  *
+ * The IP reputation and anonymous IP groups decide by the client address, so
+ * their matches can be declared by address instead, for a request that states
+ * where it came from with the `x-sim-aws-source-ip` header:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onAddress("185.220.101.0/24", {
+ *   matches: ["AnonymousIPList"],
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
@@ -42,9 +54,24 @@ export declare class SimWafManagedRules {
      * is refused here rather than matching nothing later.
      */
     onRequest(uriPath: string, declaration: SimWafManagedMatchDeclaration): void;
+    /**
+     * Declare which managed rules flag the requests from one address or one
+     * CIDR range of addresses.
+     *
+     * Only the rules of a group that decides by the client address can be
+     * declared this way, which is the IP reputation list and the anonymous IP
+     * list. A request states its address with the `x-sim-aws-source-ip` header,
+     * and one that states none comes from `127.0.0.1`.
+     *
+     * Declaring the same range again replaces it.
+     */
+    onAddress(range: string, declaration: SimWafManagedAddressDeclaration): void;
     /**
      * What a test declared about one request: the rules that claim it, and the
      * labels a group adds to it whatever its rules decide.
+     *
+     * A request is claimed by what was declared for its path and for its
+     * address together.
      */
     declared(request: SimWafInspectedRequest): SimWafDeclared;
     /**
@@ -59,5 +86,4 @@ export declare class SimWafManagedRules {
      * AWS rule they stand for.
      */
     rules(): readonly SimWafManagedRuleReport[];
-    private requiredRule;
 }

package/dist/service/wafv2/managed/sim-waf-managed-rules.js

@@ -1,6 +1,7 @@
 import { SimWafDeclarationError } from "../error/sim-wafv2.error.js";
-import { findSimWafManagedRule, } from "./sim-waf-managed-rule-groups.js";
+import { requiredSimWafManagedRule } from "./sim-waf-managed-rule-groups.js";
 import { simWafManagedRuleReports, } from "./sim-waf-managed-rule-report.js";
+import { SimWafDeclaredAddresses, } from "./sim-waf-managed-address-declaration.js";
 import { simWafNothingDeclared, simWafReadDeclaration, } from "./sim-waf-managed-declaration.js";
 /**
  * The managed rule matches this simulated WAFv2 answers with, and what it
@@ -27,12 +28,23 @@ import { simWafNothingDeclared, simWafReadDeclaration, } from "./sim-waf-managed
  * });
  * ```
  *
+ * The IP reputation and anonymous IP groups decide by the client address, so
+ * their matches can be declared by address instead, for a request that states
+ * where it came from with the `x-sim-aws-source-ip` header:
+ *
+ * ```typescript
+ * simAws.wafV2().managedRules().onAddress("185.220.101.0/24", {
+ *   matches: ["AnonymousIPList"],
+ * });
+ * ```
+ *
  * A declared match is a match, and everything after it is what the group would
  * have done anyway: the rule adds its label, an action override applies to it,
  * and the group blocks by that rule.
  */
 export class SimWafManagedRules {
     #byUriPath = new Map();
+    #byAddress = new SimWafDeclaredAddresses();
     /**
      * Declare which managed rules claim a request to one URI path.
      *
@@ -45,20 +57,37 @@ export class SimWafManagedRules {
             throw new SimWafDeclarationError("A declared managed rule match needs the URI path of the request it " +
                 "is declared for");
         }
-        this.#byUriPath.set(uriPath, simWafReadDeclaration(declaration, (name) => this.requiredRule(name).rule.name));
+        this.#byUriPath.set(uriPath, simWafReadDeclaration(declaration, (name) => requiredSimWafManagedRule(name).rule.name));
+    }
+    /**
+     * Declare which managed rules flag the requests from one address or one
+     * CIDR range of addresses.
+     *
+     * Only the rules of a group that decides by the client address can be
+     * declared this way, which is the IP reputation list and the anonymous IP
+     * list. A request states its address with the `x-sim-aws-source-ip` header,
+     * and one that states none comes from `127.0.0.1`.
+     *
+     * Declaring the same range again replaces it.
+     */
+    onAddress(range, declaration) {
+        this.#byAddress.declare(range, declaration.matches);
     }
     /**
      * What a test declared about one request: the rules that claim it, and the
      * labels a group adds to it whatever its rules decide.
+     *
+     * A request is claimed by what was declared for its path and for its
+     * address together.
      */
     declared(request) {
-        return this.#byUriPath.get(request.uriPath) ?? simWafNothingDeclared;
+        return this.#byAddress.joinedWith(this.#byUriPath.get(request.uriPath) ?? simWafNothingDeclared, request.sourceIp);
     }
     /**
      * What this simulation covers of one managed rule.
      */
     tierOf(ruleName) {
-        return this.requiredRule(ruleName).rule.tier;
+        return requiredSimWafManagedRule(ruleName).rule.tier;
     }
     /**
      * What this simulation covers of every managed rule it carries.
@@ -70,13 +99,4 @@ export class SimWafManagedRules {
     rules() {
         return simWafManagedRuleReports();
     }
-    requiredRule(ruleName) {
-        const entry = findSimWafManagedRule(ruleName);
-        if (entry === undefined) {
-            throw new SimWafDeclarationError(`No simulated AWS managed rule group holds a rule named ` +
-                `${ruleName}. The rules that are simulated are reported by ` +
-                `managedRules().rules().`);
-        }
-        return entry;
-    }
 }

package/dist/service/wafv2/sim-wafv2.js

@@ -98,7 +98,8 @@ export class SimWafV2 extends SimWafSets {
     evaluateRequest(evaluation) {
         const webAcl = this.requireWebAcl(evaluation.webAclArn);
         const limitBytes = webAcl.bodyInspectionLimitBytes(evaluation.resourceType);
-        return webAcl.evaluate(simWafInspectedRequest(evaluation.request, evaluation.body, limitBytes));
+        const { request, body, sourceIp } = evaluation;
+        return webAcl.evaluate(simWafInspectedRequest(request, body, limitBytes, sourceIp));
     }
     /**
      * What the AWS managed rule groups do here, and what a test declares of

package/dist/service/wafv2/statement/sim-waf-rate-based-input.d.ts

@@ -36,10 +36,11 @@ export declare function simWafRateWindowMilliseconds(statement: SimWafRateBasedS
 /**
  * Read how a rate-based statement groups the requests it counts.
  *
- * `IP` counts each client address on its own. Every request in this simulation
- * reports `simAwsProxiedSourceIp`, leaving one client for the whole
- * simulation. A rate limiting test sends its requests from one client and
- * expects the rule to trip, so that is the case anybody would write.
+ * `IP` counts each client address on its own. A request comes from
+ * `127.0.0.1` unless it states another address with `x-sim-aws-source-ip`, so
+ * a test that states none has one client for the whole simulation. That is
+ * the case a rate limiting test is usually written about: one client, sending
+ * until the rule trips.
  *
  * `CONSTANT` counts every request the statement sees together, and AWS asks
  * for a scope-down statement alongside it to say which requests those are. A

package/dist/service/wafv2/statement/sim-waf-rate-based-input.js

@@ -1,4 +1,3 @@
-import { simAwsProxiedSourceIp } from "../../../serve/http/sim-aws-proxied-connection.js";
 import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
 import { refuseUnsimulatedSimWafRateKeyType } from "./sim-waf-unsimulated-rate-based.js";
 /**
@@ -66,10 +65,11 @@ export function simWafRateWindowMilliseconds(statement, ruleName) {
 /**
  * Read how a rate-based statement groups the requests it counts.
  *
- * `IP` counts each client address on its own. Every request in this simulation
- * reports `simAwsProxiedSourceIp`, leaving one client for the whole
- * simulation. A rate limiting test sends its requests from one client and
- * expects the rule to trip, so that is the case anybody would write.
+ * `IP` counts each client address on its own. A request comes from
+ * `127.0.0.1` unless it states another address with `x-sim-aws-source-ip`, so
+ * a test that states none has one client for the whole simulation. That is
+ * the case a rate limiting test is usually written about: one client, sending
+ * until the rule trips.
  *
  * `CONSTANT` counts every request the statement sees together, and AWS asks
  * for a scope-down statement alongside it to say which requests those are. A
@@ -79,7 +79,7 @@ export function simWafRateAggregation(statement, ruleName) {
     const keyType = statement.AggregateKeyType;
     refuseUnsimulatedSimWafRateKeyType(keyType, ruleName);
     if (keyType === "IP") {
-        return () => simAwsProxiedSourceIp;
+        return (request) => request.sourceIp;
     }
     if (keyType === "CONSTANT") {
         if (statement.ScopeDownStatement === undefined) {

package/docs/services/iam/README.md

@@ -771,6 +771,12 @@ was created, exactly as `runAs` behaves. The header is stripped before the reque
 simulated service. A Lambda handler echoing `event.headers` sees none of the simulator's control
 metadata.
 
+`x-sim-aws-source-ip` is a control header of the same kind. It names the client address a request
+comes from (one IPv4 or IPv6 address), and a request naming none comes from `127.0.0.1`. A web ACL
+reads it (see
+[where a request comes from](https://yulinsim.dev/services/wafv2/#where-a-request-comes-from)). IAM
+policy evaluation does not read it.
+
 ```typescript sim-iam-served-request-caller
 /**
  * Naming the caller of an HTTP request into simulated AWS.

package/docs/services/wafv2/README.md

@@ -282,10 +282,11 @@ lets evaluation continue, the way it does for every other statement kind.
 window is measured against [simulated time](https://yulinsim.dev/time/), so `advanceBy` past it drops
 what the rule counted.
 
-`AggregateKeyType` is `IP` or `CONSTANT`. `IP` counts each client address on its own. Every request
-in this simulation reports `127.0.0.1`, leaving a web ACL with one client for the whole simulation.
-That is the case a rate limiting test is written about anyway (one client, sending until the rule
-trips), and it behaves here as it does on AWS. `CONSTANT` counts every request the statement sees
+`AggregateKeyType` is `IP` or `CONSTANT`. `IP` counts each client address on its own. A request
+comes from `127.0.0.1` unless it names another address (see
+[Where a request comes from](#where-a-request-comes-from)). A test that names none has one client for
+the whole simulation. That is the case a rate limiting test is usually written about (one client,
+sending until the rule trips). `CONSTANT` counts every request the statement sees
 together, and AWS requires a `ScopeDownStatement` alongside it to say which requests those are.
 
 A `ScopeDownStatement` narrows what the rule counts. Every statement kind in
@@ -463,17 +464,103 @@ are.
 
 ### Groups that read the caller
 
-The IP reputation, anonymous IP and Bot Control groups decide by who sent a request, and every
-request in this simulation comes from `127.0.0.1`. Each of their rules is declared-only. The group
-labels the request, takes the rule's documented action and honours overrides, as the groups that
-read the request do.
+The IP reputation, anonymous IP and Bot Control groups decide by who sent a request. AWS publishes
+their rule names, actions and labels, and none of the address lists or bot signatures behind them.
+Each of their rules is declared-only. The group labels the request, takes the rule's documented
+action and honours overrides, as the groups that read the request do.
 
 `AWSManagedRulesAmazonIpReputationList` holds `AWSManagedIPReputationList` and
 `AWSManagedReconnaissanceList`, which block, and `AWSManagedIPDDoSList`, which counts as AWS ships
 it. `AWSManagedRulesAnonymousIpList` holds `AnonymousIPList` (VPNs, proxies and Tor) and
 `HostingProviderIPList` (hosting and cloud providers other than AWS), which both block. A test
-declares a match by rule name, as above, and says which requests come from a flagged address that
-way.
+declares which addresses those five rules flag, and sends requests from them.
+
+#### Where a request comes from
+
+A request reaches this simulation in process or over loopback, and comes from `127.0.0.1`. The
+`x-sim-aws-source-ip` header names another client address (one IPv4 or IPv6 address). It works
+through `SimAwsHttp` and `serveSimAws` alike, and it is stripped before the request reaches the
+simulated service, as `x-sim-aws-caller` is. A value that is no address is refused with a 400 and
+`InvalidRequestCaller`. `evaluateRequest` takes the address as `sourceIp`.
+
+The address reaches the web ACL in front of a Cognito user pool or a REST API stage. The IP
+reputation and anonymous IP rules read it, and so does a rate limit aggregating on `IP`.
+
+`managedRules().onAddress` says which of those rules flag one address or a CIDR range. Only the
+rules of the IP reputation and anonymous IP groups can be declared by address, and a rule of any
+other group is refused. Declaring the same range again replaces it. An address inside two declared
+ranges is flagged by the rules of both, and a match declared for the request's path with
+`onRequest` applies beside them.
+
+```typescript sim-wafv2-anonymous-ip-list
+/**
+ * Blocking sign-ups from a Tor exit range with the anonymous IP list.
+ */
+
+import { CreateWebACLCommand } from "@aws-sdk/client-wafv2";
+
+import { SimAws } from "@kensio/yulin";
+
+const waf = new SimAws().wafV2();
+
+const visibility = {
+  SampledRequestsEnabled: false,
+  CloudWatchMetricsEnabled: false,
+  MetricName: "pool",
+};
+
+const created = await waf.createWebAcl(
+  new CreateWebACLCommand({
+    Name: "pool-acl",
+    Scope: "REGIONAL",
+    DefaultAction: { Allow: {} },
+    VisibilityConfig: visibility,
+    Rules: [
+      {
+        Name: "anonymous-ip",
+        Priority: 0,
+        OverrideAction: { None: {} },
+        Statement: {
+          ManagedRuleGroupStatement: {
+            VendorName: "AWS",
+            Name: "AWSManagedRulesAnonymousIpList",
+          },
+        },
+        VisibilityConfig: { ...visibility, MetricName: "anonymous-ip" },
+      },
+    ],
+  }),
+);
+
+waf.managedRules().onAddress("185.220.101.0/24", {
+  matches: ["AnonymousIPList"],
+});
+
+const signUp = (sourceIp: string): string =>
+  waf.evaluateRequest({
+    webAclArn: created.Summary!.ARN,
+    request: new Request("https://myapp-login.example.com/signup", {
+      headers: { "user-agent": "Mozilla/5.0" },
+    }),
+    sourceIp,
+  }).action;
+
+// "BLOCK"
+console.log(signUp("185.220.101.7"));
+
+// "ALLOW"
+console.log(signUp("203.0.113.9"));
+```
+
+A request over HTTP names its address in the header instead:
+
+```text
+POST /signup HTTP/1.1
+Host: myapp-login.auth.eu-west-2.amazoncognito.com
+x-sim-aws-source-ip: 185.220.101.7
+```
+
+The other kinds of statement that read the address are still held (see [Held input](#held-input)).
 
 Bot Control labels a request by the bot that sent it, and a verified bot is labelled and matches no
 rule. A test declares the bot.
@@ -865,6 +952,9 @@ and records no message.
 
 The pages are usually the point. `/signup`, `/confirm` and `/forgotPassword` are the ones that
 create an account or send an email, and a real web ACL on a user pool is usually written for them.
+A request to them can name the client it comes from in the `x-sim-aws-source-ip` header, for the
+anonymous IP list and the IP reputation list to decide on (see
+[Where a request comes from](#where-a-request-comes-from)).
 
 ```typescript sim-wafv2-cognito-user-pool
 /**
@@ -1537,9 +1627,10 @@ where AWS blocks every address outside the list and the simulation blocks none.
 
 A rule is held for any of these statement kinds:
 
-- `IPSetReferenceStatement`, `GeoMatchStatement` and `AsnMatchStatement`. Every request in this
-  simulation reports a source address of `127.0.0.1`, and a rule on where a request came from would
-  see one client for the whole simulation.
+- `IPSetReferenceStatement`, `GeoMatchStatement` and `AsnMatchStatement`. A request has a client
+  address (see [Where a request comes from](#where-a-request-comes-from)), and these statements are
+  not yet written to read it. A country or an ASN would also need an address database the simulation
+  does not have.
 - `SqliMatchStatement` and `XssMatchStatement`. AWS publishes no description of the detection they
   run.
 - `RuleGroupReferenceStatement`. A rule group of your own is a resource in its own right, and none
@@ -1551,7 +1642,7 @@ A rule is held for any of these statement kinds:
 
 A `RateBasedStatement` is evaluated (see [Rate limiting](#rate-limiting)). A rule using two of its
 aggregation key types is held. `FORWARDED_IP` and `ForwardedIPConfig` read the address from a
-forwarding header, which needs the source address variety an IP set is waiting on. `CUSTOM_KEYS` and
+forwarding header, and are held along with the IP set statement. `CUSTOM_KEYS` and
 `CustomKeys` aggregate on headers, cookies and query arguments, and are feasible and not part of
 this yet. `GetRateBasedStatementManagedKeys` is not simulated.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -298,9 +298,9 @@
     "execa": "^10.0.0",
     "fta-cli": "^3.0.0",
     "hyparquet": "^1.29.2",
-    "hyparquet-writer": "^0.17.0",
+    "hyparquet-writer": "^0.18.0",
     "node-sql-parser": "^5.4.0",
-    "oxfmt": "^0.74.0",
+    "oxfmt": "^0.75.0",
     "oxlint": "^1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "semantic-release": "25.0.9",