RateLimitingProcessor implements Processor { protected Map<String, ViolationMetaData> filterAndTruncateViolators(LogProcessorLambdaConfig params, RangeSet<Integer> doNotAutoBlockIpRangeSet, Map<String, ViolationMetaData> violators) { Date now = new Date(); return violators.entrySet().stream() .filter(entry -> TimeUnit.MILLISECONDS.toMinutes(now.getTime() - entry.getValue().getDate().getTime()) < params.getBlacklistDurationInMinutes()) .filter(entry -> canAddToAutoBlackList(doNotAutoBlockIpRangeSet, entry.getKey())) .sorted((o1, o2) -> o2.getValue().getMaxRate() - o1.getValue().getMaxRate()) .limit(cidrLimitForIpSet) .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue)); } RateLimitingProcessor(ObjectMapper objectMapper, AWSWAFRegional awsWaf, AmazonS3 amazonS3); void setCidrLimitForIpSetOverride(int limitOverride); @Override void processLogEvents(List<ALBAccessLogEvent> events, LogProcessorLambdaConfig config, String bucketName);  }
@Test public void testThatFilterAndTruncateViolatorsRemoveExpiredBlocks() { when(config.getBlacklistDurationInMinutes()).thenReturn(1); RangeSet<Integer> rangeSet = TreeRangeSet.create(); Map<String, ViolationMetaData> violators = new HashMap<>(); violators.put("50.39.100.194", new ViolationMetaData(new Date(new Date().getTime() - 120000), 2)); Map<String, ViolationMetaData> actual = processor.filterAndTruncateViolators(config, rangeSet, violators); assertTrue("The violators map should be empty after filtering", actual.isEmpty()); }
@Test public void testThatFilterAndTruncateViolatorsDoesNotRemoveNonExpiredBlocks() { when(config.getBlacklistDurationInMinutes()).thenReturn(1); RangeSet<Integer> rangeSet = TreeRangeSet.create(); Map<String, ViolationMetaData> violators = new HashMap<>(); violators.put("50.39.100.193", new ViolationMetaData(new Date(), 2)); Map<String, ViolationMetaData> actual = processor.filterAndTruncateViolators(config, rangeSet, violators); assertTrue("The violators map should still have one entry after filtering", actual.size() == 1); }
@Test public void testThatFilterAndTruncateViolatorsFiltersIPsInDoNotBlockRangeSet() { when(config.getBlacklistDurationInMinutes()).thenReturn(1); RangeSet<Integer> doNotAutoBlockIpRangeSet = TreeRangeSet.create(); SubnetUtils subnetUtils = new SubnetUtils("50.39.100.193/32"); subnetUtils.setInclusiveHostCount(true); SubnetUtils.SubnetInfo subnetInfo = subnetUtils.getInfo(); Integer lowIpAsInt = subnetInfo.asInteger(subnetInfo.getLowAddress()); Integer highIpAsInt = subnetInfo.asInteger(subnetInfo.getHighAddress()); doNotAutoBlockIpRangeSet.add(Range.closed(lowIpAsInt, highIpAsInt)); Map<String, ViolationMetaData> violators = new HashMap<>(); violators.put("50.39.100.193", new ViolationMetaData(new Date(), 2)); Map<String, ViolationMetaData> actual = processor.filterAndTruncateViolators(config, doNotAutoBlockIpRangeSet, violators); assertTrue("The violators map should be empty after filtering", actual.size() == 0); }