edgeguard-native/internal/waf/spoe_test.go

package waf

import "testing"

// Beweist Fix #2: Trusted-Proxy-XFF-Auflösung.
func TestRightmostXFF(t *testing.T) {
	cases := map[string]string{
		"X-Forwarded-For: 203.0.113.7":                       "203.0.113.7",
		"X-Forwarded-For: 203.0.113.7, 10.0.0.1":             "10.0.0.1", // rightmost
		"x-forwarded-for: 1.2.3.4 , 5.6.7.8":                 "5.6.7.8",
		"Host: x\r\nX-Forwarded-For: 2001:db8::1":            "2001:db8::1",
		"X-Forwarded-For: not-an-ip":                         "",
		"User-Agent: foo":                                    "",
		"":                                                   "",
	}
	for raw, want := range cases {
		if got := rightmostXFF(raw); got != want {
			t.Errorf("rightmostXFF(%q) = %q, want %q", raw, got, want)
		}
	}
}

func TestIPMatchesAny(t *testing.T) {
	list := []string{"10.0.0.5", "192.168.0.0/16", "2001:db8::/32"}
	yes := []string{"10.0.0.5", "192.168.4.7", "2001:db8::abcd"}
	no := []string{"10.0.0.6", "172.16.0.1", "2002::1", "garbage"}
	for _, ip := range yes {
		if !ipMatchesAny(ip, list) {
			t.Errorf("ipMatchesAny(%q) = false, want true", ip)
		}
	}
	for _, ip := range no {
		if ipMatchesAny(ip, list) {
			t.Errorf("ipMatchesAny(%q) = true, want false", ip)
		}
	}
}