v0.26.6

src/acl/tests.rs

@@ -45,6 +45,118 @@ mod tests {
         assert!(bad.compile().is_err());
     }
     #[test]
+    fn plain_host_addresses_are_valid_acl_rules() {
+        let acl = Acl {
+            default: Action::Deny,
+            rules: vec![
+                Rule { network: "203.0.113.7".into(), action: Action::Allow },
+                Rule { network: "2001:db8::7".into(), action: Action::Allow },
+            ],
+        }
+        .compile()
+        .unwrap();
+        assert!(acl.allows("203.0.113.7".parse().unwrap()));
+        assert!(!acl.allows("203.0.113.8".parse().unwrap()));
+        assert!(acl.allows("2001:db8::7".parse().unwrap()));
+        assert!(!acl.allows("2001:db8::8".parse().unwrap()));
+    }
+
+    #[test]
+    fn country_allow_and_ip_allow_are_alternatives_inside_one_scope() {
+        let acl = Acl {
+            default: Action::Deny,
+            rules: vec![
+                Rule { network: "10.0.0.0/8".into(), action: Action::Allow },
+                Rule { network: "10.66.0.0/16".into(), action: Action::Deny },
+            ],
+        }
+        .compile()
+        .unwrap();
+        let countries = crate::rate_limit::CountryAccess {
+            mode: crate::rate_limit::CountryMode::Allow,
+            countries: vec!["PL".into(), "DE".into()],
+        };
+
+        assert!(allows_with_country(
+            Some(&acl),
+            &countries,
+            "10.1.2.3".parse().unwrap(),
+            None,
+        ));
+        assert!(allows_with_country(
+            Some(&acl),
+            &countries,
+            "198.51.100.10".parse().unwrap(),
+            Some("PL"),
+        ));
+        assert!(!allows_with_country(
+            Some(&acl),
+            &countries,
+            "198.51.100.10".parse().unwrap(),
+            Some("US"),
+        ));
+        assert!(!allows_with_country(
+            Some(&acl),
+            &countries,
+            "10.66.1.2".parse().unwrap(),
+            Some("PL"),
+        ));
+    }
+
+    #[test]
+    fn country_block_and_ip_deny_are_alternatives_inside_one_scope() {
+        let acl = Acl {
+            default: Action::Allow,
+            rules: vec![Rule { network: "203.0.113.7".into(), action: Action::Deny }],
+        }
+        .compile()
+        .unwrap();
+        let countries = crate::rate_limit::CountryAccess {
+            mode: crate::rate_limit::CountryMode::Block,
+            countries: vec!["CN".into()],
+        };
+
+        assert!(!allows_with_country(
+            Some(&acl),
+            &countries,
+            "198.51.100.10".parse().unwrap(),
+            Some("CN"),
+        ));
+        assert!(!allows_with_country(
+            Some(&acl),
+            &countries,
+            "203.0.113.7".parse().unwrap(),
+            Some("PL"),
+        ));
+        assert!(allows_with_country(
+            Some(&acl),
+            &countries,
+            "198.51.100.10".parse().unwrap(),
+            Some("PL"),
+        ));
+    }
+
+    #[test]
+    fn country_allow_still_restricts_an_ip_default_allow_policy() {
+        let acl = Acl { default: Action::Allow, rules: Vec::new() }.compile().unwrap();
+        let countries = crate::rate_limit::CountryAccess {
+            mode: crate::rate_limit::CountryMode::Allow,
+            countries: vec!["PL".into()],
+        };
+        assert!(allows_with_country(
+            Some(&acl),
+            &countries,
+            "198.51.100.10".parse().unwrap(),
+            Some("PL"),
+        ));
+        assert!(!allows_with_country(
+            Some(&acl),
+            &countries,
+            "198.51.100.10".parse().unwrap(),
+            Some("DE"),
+        ));
+    }
+    #[test]
     fn repeated_slashes_are_normalized_for_routing() {
         assert_eq!(
             routing_path("/static/js//events.js").unwrap(),