rullst-core 12.2.0

Core runtime, routing engine, and telemetry for the Rullst framework suite.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

//! Bucket retention and peer-keying tests for [`RateLimiter`].

#![allow(clippy::unwrap_used, clippy::expect_used)]

use super::*;
use axum::http::Request;
use std::net::{IpAddr, SocketAddr};

fn peer_request(ip: &str) -> axum::extract::Request {
    let mut request = Request::builder().body(axum::body::Body::empty()).unwrap();
    let address = SocketAddr::new(ip.parse::<IpAddr>().unwrap(), 443);
    request
        .extensions_mut()
        .insert(axum::extract::ConnectInfo(address));
    request
}

#[test]
fn ipv6_peers_share_one_key_per_64_prefix() {
    let first = default_key_extractor(&peer_request("2001:db8:1:2::1"));
    let rotated = default_key_extractor(&peer_request("2001:db8:1:2:ffff:ee:dd:c"));
    let other_subnet = default_key_extractor(&peer_request("2001:db8:1:3::1"));

    assert_eq!(first, "2001:db8:1:2::/64");
    assert_eq!(rotated, first);
    assert_ne!(other_subnet, first);
    assert_eq!(
        default_key_extractor(&peer_request("::ffff:192.0.2.7")),
        "192.0.2.7"
    );
    assert_eq!(
        default_key_extractor(&peer_request("192.0.2.7")),
        "192.0.2.7"
    );
}

#[test]
fn rotating_ipv6_source_addresses_cannot_bypass_the_limit() {
    let limiter = RateLimiter::new(RateLimitConfig::per_hour(2.0));
    let decisions: Vec<bool> = (1..=4)
        .map(|host| {
            let key = default_key_extractor(&peer_request(&format!("2001:db8:7:9::{host:x}")));
            limiter.check_and_consume(&key)
        })
        .collect();

    assert_eq!(decisions, [true, true, false, false]);
}

#[test]
fn distinct_keys_cannot_grow_the_bucket_map_without_bound() {
    let limiter = RateLimiter::new(RateLimitConfig::per_hour(5.0));

    for client in 0..150_000 {
        limiter.check_and_consume(&format!("client-{client}"));
    }

    assert!(
        limiter.buckets.len() <= 100_000,
        "{} buckets retained",
        limiter.buckets.len()
    );
}

#[test]
fn refilled_buckets_are_released() {
    let limiter = RateLimiter::new(RateLimitConfig::per_second(1_000.0));
    for client in 0..5_000 {
        assert!(limiter.check_and_consume(&format!("burst-{client}")));
    }
    // One consumed token refills in a millisecond, after which the bucket is
    // identical to a new one.
    std::thread::sleep(Duration::from_millis(20));
    for client in 0..5_000 {
        assert!(limiter.check_and_consume(&format!("later-{client}")));
    }

    // The sweep at the 8,192nd new key runs after the pause, so every burst
    // bucket has refilled by then. Whether the newest buckets have refilled
    // too depends on how fast the second loop runs, so only the burst
    // buckets are asserted.
    assert!(
        !limiter
            .buckets
            .iter()
            .any(|bucket| bucket.key().starts_with("burst-")),
        "refilled burst buckets were retained"
    );
    assert!(
        limiter.buckets.len() <= 5_000,
        "{} buckets retained",
        limiter.buckets.len()
    );
}

#[test]
fn a_drained_bucket_is_not_reset_by_idle_sweeps() {
    let limiter = RateLimiter::new(RateLimitConfig::per_hour(2.0));
    assert!(limiter.check_and_consume("victim"));
    assert!(limiter.check_and_consume("victim"));

    for client in 0..10_000 {
        limiter.check_and_consume(&format!("client-{client}"));
    }

    assert!(!limiter.check_and_consume("victim"));
}

#[test]
fn a_full_map_evicts_the_least_recently_used_buckets() {
    let limiter = RateLimiter::new(RateLimitConfig::per_hour(1.0)).with_bucket_limit(16);
    for client in 0..16 {
        assert!(limiter.check_and_consume(&format!("client-{client}")));
    }
    std::thread::sleep(Duration::from_millis(2));
    assert!(!limiter.check_and_consume("client-15"));

    assert!(limiter.check_and_consume("newcomer"));

    assert!(limiter.buckets.len() <= 16);
    assert!(!limiter.buckets.contains_key("client-0"));
    assert!(!limiter.check_and_consume("client-15"));
    assert!(!limiter.check_and_consume("newcomer"));
}