async def prevent_denial_of_service(request, max_requests=300):
"""This function checks that the maximum number of requests per minute set in the configuration is not exceeded"""
if 'authenticate' not in request.path:
global current_time, request_counter
if not current_time:
current_time = time()
if time() - 60 <= current_time:
request_counter += 1
else:
request_counter = 0
current_time = time()
if request_counter > max_requests:
logger.debug(
f'Request rejected due to high request per minute: Source IP: {request.remote}'
)
user = None
payload = dict(request.raw_headers)
if b'Authorization' in payload.keys():
payload = dict(
request.raw_headers)[b'Authorization'].decode().split(
'.')[1]
elif b'authorization' in payload.keys():
payload = dict(
request.raw_headers)[b'authorization'].decode().split(
'.')[1]
else:
user = '******'
payload += "=" * ((4 - len(payload) % 4) % 4)
request['user'] = loads(
b64decode(payload).decode())['sub'] if not user else user
raise_if_exc(WazuhTooManyRequests(6001))
async def test_middlewares_prevent_denial_of_service(current_time,
max_requests):
"""Test if the DOS mechanism triggers when the `max_requests` are reached."""
with patch("api.middlewares.current_time", new=current_time):
with patch("api.middlewares.raise_if_exc") as raise_mock:
await prevent_denial_of_service(DummyRequest({'remote': 'ip'}),
max_requests=max_requests)
if max_requests == 0:
raise_mock.assert_called_once_with(WazuhTooManyRequests(6001))
async def prevent_denial_of_service(request, max_requests=300):
"""This function checks that the maximum number of requests per minute set in the configuration is not exceeded"""
global current_time, request_counter
if not current_time:
current_time = time()
if time() - 60 <= current_time:
request_counter += 1
else:
request_counter = 0
current_time = time()
if request_counter > max_requests:
logger.debug(f'Request rejected due to high request per minute: Source IP: {request.remote}')
raise_if_exc(WazuhTooManyRequests(6001))