fix(tests): stabilize CVE-2025-24369 regression test by using invalid proof

Acked-by: Jason Cameron <git@jasoncameron.dev>

cmd/robots2policy/robots2policy_test.go

@@ -22,9 +22,9 @@ type TestCase struct {
 type TestOptions struct {
 	format           string
 	action           string
-	crawlDelayWeight int
 	policyName       string
 	deniedAction     string
+	crawlDelayWeight int
 }
 
 func TestDataFileConversion(t *testing.T) {

decaymap/decaymap.go

@@ -13,13 +13,13 @@ func Zilch[T any]() T {
 // Impl is a lazy key->value map. It's a wrapper around a map and a mutex. If values exceed their time-to-live, they are pruned at Get time.
 type Impl[K comparable, V any] struct {
 	data map[K]decayMapEntry[V]
-	lock sync.RWMutex
 
 	// deleteCh receives decay-deletion requests from readers.
 	deleteCh chan deleteReq[K]
 	// stopCh stops the background cleanup worker.
 	stopCh chan struct{}
 	wg     sync.WaitGroup
+	lock   sync.RWMutex
 }
 
 type decayMapEntry[V any] struct {

docs/docs/CHANGELOG.md

@@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Allow Renovate as an OCI registry client.
 - Properly handle 4in6 addresses so that IP matching works with those addresses.
 - Add support to simple Valkey/Redis cluster mode
+- Stabilize the CVE-2025-24369 regression test by always submitting an invalid proof instead of relying on random POW failures.
 
 ## v1.23.1: Lyse Hext - Echo 1
 

docs/docs/admin/environments/nginx.mdx

@@ -55,8 +55,9 @@ server {
 # proxy all traffic to the target via Anubis.
 server {
   # Listen on TCP port 443 with TLS (https) and HTTP/2
-  listen 443 ssl http2;
-  listen [::]:443 ssl http2;
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  http2 on;
 
   location / {
     proxy_set_header Host $host;
@@ -113,8 +114,9 @@ Then in a server block:
 
 server {
   # Listen on 443 with SSL
-  listen 443 ssl http2;
-  listen [::]:443 ssl http2;
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  http2 on;
 
   # Slipstream via Anubis
   include "conf-anubis.inc";

internal/headers.go

@@ -87,7 +87,7 @@ func XForwardedForToXRealIP(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if xffHeader := r.Header.Get("X-Forwarded-For"); r.Header.Get("X-Real-Ip") == "" && xffHeader != "" {
 			ip := xff.Parse(xffHeader)
-			slog.Debug("setting x-real-ip", "val", ip)
+			slog.Debug("setting X-Real-Ip from X-Forwarded-For", "to", ip, "x-forwarded-for", xffHeader)
 			r.Header.Set("X-Real-Ip", ip)
 		}
 
@@ -129,6 +129,8 @@ func XForwardedForUpdate(stripPrivate bool, next http.Handler) http.Handler {
 		} else {
 			r.Header.Set("X-Forwarded-For", xffHeaderString)
 		}
+
+		slog.Debug("updating X-Forwarded-For", "original", origXFFHeader, "new", xffHeaderString)
 	})
 }
 

internal/ogtags/ogtags.go

@@ -22,9 +22,10 @@ const (
 )
 
 type OGTagCache struct {
-	cache     store.JSON[map[string]string]
-	targetURL *url.URL
-	client    *http.Client
+	targetURL  *url.URL
+	client     *http.Client
+	ogOverride map[string]string
+	cache      store.JSON[map[string]string]
 
 	// Pre-built strings for optimization
 	unixPrefix          string // "http://unix"
@@ -33,7 +34,6 @@ type OGTagCache struct {
 	ogTimeToLive        time.Duration
 	ogCacheConsiderHost bool
 	ogPassthrough       bool
-	ogOverride          map[string]string
 }
 
 func NewOGTagCache(target string, conf config.OpenGraph, backend store.Interface) *OGTagCache {

lib/anubis.go

@@ -68,14 +68,14 @@ var (
 
 type Server struct {
 	next        http.Handler
+	store       store.Interface
 	mux         *http.ServeMux
 	policy      *policy.ParsedConfig
 	OGTags      *ogtags.OGTagCache
+	logger      *slog.Logger
+	opts        Options
 	ed25519Priv ed25519.PrivateKey
 	hs512Secret []byte
-	opts        Options
-	store       store.Interface
-	logger      *slog.Logger
 }
 
 func (s *Server) getTokenKeyfunc() jwt.Keyfunc {

lib/anubis_test.go

@@ -152,10 +152,34 @@ func handleChallengeZeroDifficulty(t *testing.T, ts *httptest.Server, cli *http.
 	return resp
 }
 
+func handleChallengeInvalidProof(t *testing.T, ts *httptest.Server, cli *http.Client, chall challengeResp) *http.Response {
+	t.Helper()
+
+	req, err := http.NewRequest(http.MethodGet, ts.URL+"/.within.website/x/cmd/anubis/api/pass-challenge", nil)
+	if err != nil {
+		t.Fatalf("can't make request: %v", err)
+	}
+
+	q := req.URL.Query()
+	q.Set("response", strings.Repeat("f", 64)) // "hash" that never starts with the nonce
+	q.Set("nonce", "0")
+	q.Set("redir", "/")
+	q.Set("elapsedTime", "0")
+	q.Set("id", chall.ID)
+	req.URL.RawQuery = q.Encode()
+
+	resp, err := cli.Do(req)
+	if err != nil {
+		t.Fatalf("can't do request: %v", err)
+	}
+
+	return resp
+}
+
 type loggingCookieJar struct {
 	t       *testing.T
-	lock    sync.Mutex
 	cookies map[string][]*http.Cookie
+	lock    sync.Mutex
 }
 
 func (lcj *loggingCookieJar) Cookies(u *url.URL) []*http.Cookie {
@@ -247,7 +271,7 @@ func TestCVE2025_24369(t *testing.T) {
 
 	cli := httpClient(t)
 	chall := makeChallenge(t, ts, cli)
-	resp := handleChallengeZeroDifficulty(t, ts, cli, chall)
+	resp := handleChallengeInvalidProof(t, ts, cli, chall)
 
 	if resp.StatusCode == http.StatusFound {
 		t.Log("Regression on CVE-2025-24369")
@@ -747,9 +771,9 @@ func TestStripBasePrefixFromRequest(t *testing.T) {
 	testCases := []struct {
 		name            string
 		basePrefix      string
-		stripBasePrefix bool
 		requestPath     string
 		expectedPath    string
+		stripBasePrefix bool
 	}{
 		{
 			name:            "strip disabled - no change",

lib/challenge/challenge.go

@@ -4,12 +4,12 @@ import "time"
 
 // Challenge is the metadata about a single challenge issuance.
 type Challenge struct {
-	ID             string            `json:"id"`                       // UUID identifying the challenge
-	Method         string            `json:"method"`                   // Challenge method
-	RandomData     string            `json:"randomData"`               // The random data the client processes
-	IssuedAt       time.Time         `json:"issuedAt"`                 // When the challenge was issued
-	Metadata       map[string]string `json:"metadata"`                 // Challenge metadata such as IP address and user agent
-	Spent          bool              `json:"spent"`                    // Has the challenge already been solved?
-	Difficulty     int               `json:"difficulty,omitempty"`     // Difficulty that was in effect when issued
-	PolicyRuleHash string            `json:"policyRuleHash,omitempty"` // Hash of the policy rule that issued this challenge
+	IssuedAt       time.Time         `json:"issuedAt"`
+	Metadata       map[string]string `json:"metadata"`
+	ID             string            `json:"id"`
+	Method         string            `json:"method"`
+	RandomData     string            `json:"randomData"`
+	PolicyRuleHash string            `json:"policyRuleHash,omitempty"`
+	Difficulty     int               `json:"difficulty,omitempty"`
+	Spent          bool              `json:"spent"`
 }

lib/config.go

@@ -29,24 +29,24 @@ import (
 type Options struct {
 	Next                 http.Handler
 	Policy               *policy.ParsedConfig
-	Target               string
-	CookieDynamicDomain  bool
+	Logger               *slog.Logger
+	OpenGraph            config.OpenGraph
+	PublicUrl            string
 	CookieDomain         string
-	CookieExpiration     time.Duration
-	CookiePartitioned    bool
+	JWTRestrictionHeader string
 	BasePrefix           string
 	WebmasterEmail       string
+	Target               string
 	RedirectDomains      []string
 	ED25519PrivateKey    ed25519.PrivateKey
 	HS512Secret          []byte
-	StripBasePrefix      bool
-	OpenGraph            config.OpenGraph
+	CookieExpiration     time.Duration
+	CookieSameSite       http.SameSite
 	ServeRobotsTXT       bool
 	CookieSecure         bool
-	CookieSameSite       http.SameSite
-	Logger               *slog.Logger
-	PublicUrl            string
-	JWTRestrictionHeader string
+	StripBasePrefix      bool
+	CookiePartitioned    bool
+	CookieDynamicDomain  bool
 	DifficultyInJWT      bool
 }
 

lib/http_test.go

@@ -13,9 +13,9 @@ import (
 func TestSetCookie(t *testing.T) {
 	for _, tt := range []struct {
 		name       string
-		options    Options
 		host       string
 		cookieName string
+		options    Options
 	}{
 		{
 			name:       "basic",

lib/policy/config/asn_test.go

@@ -8,9 +8,9 @@ import (
 
 func TestASNsValid(t *testing.T) {
 	for _, tt := range []struct {
-		name  string
-		input *ASNs
 		err   error
+		input *ASNs
+		name  string
 	}{
 		{
 			name: "basic valid",

lib/policy/config/config.go

@@ -62,13 +62,11 @@ type BotConfig struct {
 	Expression     *ExpressionOrList `json:"expression,omitempty" yaml:"expression,omitempty"`
 	Challenge      *ChallengeRules   `json:"challenge,omitempty" yaml:"challenge,omitempty"`
 	Weight         *Weight           `json:"weight,omitempty" yaml:"weight,omitempty"`
+	GeoIP          *GeoIP            `json:"geoip,omitempty"`
+	ASNs           *ASNs             `json:"asns,omitempty"`
 	Name           string            `json:"name" yaml:"name"`
 	Action         Rule              `json:"action" yaml:"action"`
 	RemoteAddr     []string          `json:"remote_addresses,omitempty" yaml:"remote_addresses,omitempty"`
-
-	// Thoth features
-	GeoIP *GeoIP `json:"geoip,omitempty"`
-	ASNs  *ASNs  `json:"asns,omitempty"`
 }
 
 func (b BotConfig) Zero() bool {
@@ -324,13 +322,13 @@ func (sc StatusCodes) Valid() error {
 }
 
 type fileConfig struct {
-	Bots        []BotOrImport       `json:"bots"`
-	DNSBL       bool                `json:"dnsbl"`
 	OpenGraph   openGraphFileConfig `json:"openGraph,omitempty"`
 	Impressum   *Impressum          `json:"impressum,omitempty"`
-	StatusCodes StatusCodes         `json:"status_codes"`
 	Store       *Store              `json:"store"`
+	Bots        []BotOrImport       `json:"bots"`
 	Thresholds  []Threshold         `json:"thresholds"`
+	StatusCodes StatusCodes         `json:"status_codes"`
+	DNSBL       bool                `json:"dnsbl"`
 }
 
 func (c *fileConfig) Valid() error {
@@ -462,13 +460,13 @@ func Load(fin io.Reader, fname string) (*Config, error) {
 }
 
 type Config struct {
+	Impressum   *Impressum
+	Store       *Store
+	OpenGraph   OpenGraph
 	Bots        []BotConfig
 	Thresholds  []Threshold
-	DNSBL       bool
-	Impressum   *Impressum
-	OpenGraph   OpenGraph
 	StatusCodes StatusCodes
-	Store       *Store
+	DNSBL       bool
 }
 
 func (c Config) Valid() error {

lib/policy/config/config_test.go

@@ -15,9 +15,9 @@ func p[V any](v V) *V { return &v }
 
 func TestBotValid(t *testing.T) {
 	var tests = []struct {
+		bot  BotConfig
 		err  error
 		name string
-		bot  BotConfig
 	}{
 		{
 			name: "simple user agent",

lib/policy/config/expressionorlist_test.go

@@ -11,10 +11,10 @@ import (
 
 func TestExpressionOrListMarshalJSON(t *testing.T) {
 	for _, tt := range []struct {
-		name   string
-		input  *ExpressionOrList
-		output []byte
 		err    error
+		input  *ExpressionOrList
+		name   string
+		output []byte
 	}{
 		{
 			name: "single expression",
@@ -74,10 +74,10 @@ func TestExpressionOrListMarshalJSON(t *testing.T) {
 
 func TestExpressionOrListMarshalYAML(t *testing.T) {
 	for _, tt := range []struct {
-		name   string
-		input  *ExpressionOrList
-		output []byte
 		err    error
+		input  *ExpressionOrList
+		name   string
+		output []byte
 	}{
 		{
 			name: "single expression",
@@ -217,8 +217,8 @@ func TestExpressionOrListUnmarshalJSON(t *testing.T) {
 func TestExpressionOrListString(t *testing.T) {
 	for _, tt := range []struct {
 		name string
-		in   ExpressionOrList
 		out  string
+		in   ExpressionOrList
 	}{
 		{
 			name: "single expression",

lib/policy/config/geoip_test.go

@@ -7,9 +7,9 @@ import (
 
 func TestGeoIPValid(t *testing.T) {
 	for _, tt := range []struct {
-		name  string
-		input *GeoIP
 		err   error
+		input *GeoIP
+		name  string
 	}{
 		{
 			name: "basic valid",

lib/policy/config/impressum_test.go

@@ -8,9 +8,9 @@ import (
 
 func TestImpressumValid(t *testing.T) {
 	for _, cs := range []struct {
-		name string
-		inp  Impressum
 		err  error
+		inp  Impressum
+		name string
 	}{
 		{
 			name: "basic happy path",

lib/policy/config/opengraph.go

@@ -13,17 +13,17 @@ var (
 )
 
 type openGraphFileConfig struct {
+	Override     map[string]string `json:"override,omitempty" yaml:"override,omitempty"`
+	TimeToLive   string            `json:"ttl" yaml:"ttl"`
 	Enabled      bool              `json:"enabled" yaml:"enabled"`
 	ConsiderHost bool              `json:"considerHost" yaml:"enabled"`
-	TimeToLive   string            `json:"ttl" yaml:"ttl"`
-	Override     map[string]string `json:"override,omitempty" yaml:"override,omitempty"`
 }
 
 type OpenGraph struct {
-	Enabled      bool              `json:"enabled" yaml:"enabled"`
-	ConsiderHost bool              `json:"considerHost" yaml:"enabled"`
 	Override     map[string]string `json:"override,omitempty" yaml:"override,omitempty"`
 	TimeToLive   time.Duration     `json:"ttl" yaml:"ttl"`
+	Enabled      bool              `json:"enabled" yaml:"enabled"`
+	ConsiderHost bool              `json:"considerHost" yaml:"enabled"`
 }
 
 func (og *openGraphFileConfig) Valid() error {

lib/policy/config/opengraph_test.go

@@ -7,9 +7,9 @@ import (
 
 func TestOpenGraphFileConfigValid(t *testing.T) {
 	for _, tt := range []struct {
-		name  string
-		input *openGraphFileConfig
 		err   error
+		input *openGraphFileConfig
+		name  string
 	}{
 		{
 			name: "basic happy path",

lib/policy/config/store_test.go

@@ -12,9 +12,9 @@ import (
 
 func TestStoreValid(t *testing.T) {
 	for _, tt := range []struct {
+		err   error
 		name  string
 		input config.Store
-		err   error
 	}{
 		{
 			name:  "no backend",

lib/policy/config/threshold.go

@@ -31,10 +31,10 @@ var (
 )
 
 type Threshold struct {
-	Name       string            `json:"name" yaml:"name"`
 	Expression *ExpressionOrList `json:"expression" yaml:"expression"`
-	Action     Rule              `json:"action" yaml:"action"`
 	Challenge  *ChallengeRules   `json:"challenge" yaml:"challenge"`
+	Name       string            `json:"name" yaml:"name"`
+	Action     Rule              `json:"action" yaml:"action"`
 }
 
 func (t Threshold) Valid() error {

lib/policy/config/threshold_test.go

@@ -10,9 +10,9 @@ import (
 
 func TestThresholdValid(t *testing.T) {
 	for _, tt := range []struct {
-		name  string
-		input *Threshold
 		err   error
+		input *Threshold
+		name  string
 	}{
 		{
 			name: "basic allow",

lib/policy/expressions/environment_test.go

@@ -14,11 +14,11 @@ func TestBotEnvironment(t *testing.T) {
 
 	t.Run("missingHeader", func(t *testing.T) {
 		tests := []struct {
+			headers     map[string]string
 			name        string
 			expression  string
-			headers     map[string]string
-			expected    types.Bool
 			description string
+			expected    types.Bool
 		}{
 			{
 				name:       "missing-header",
@@ -167,10 +167,10 @@ func TestBotEnvironment(t *testing.T) {
 
 		t.Run("invalid", func(t *testing.T) {
 			for _, tt := range []struct {
+				env             any
 				name            string
 				description     string
 				expression      string
-				env             any
 				wantFailCompile bool
 				wantFailEval    bool
 			}{
@@ -244,11 +244,11 @@ func TestThresholdEnvironment(t *testing.T) {
 	}
 
 	tests := []struct {
+		variables     map[string]interface{}
 		name          string
 		expression    string
-		variables     map[string]interface{}
-		expected      types.Bool
 		description   string
+		expected      types.Bool
 		shouldCompile bool
 	}{
 		{

lib/policy/expressions/loadavg.go

@@ -10,8 +10,8 @@ import (
 )
 
 type loadAvg struct {
-	lock sync.RWMutex
 	data *load.AvgStat
+	lock sync.RWMutex
 }
 
 func (l *loadAvg) updateThread(ctx context.Context) {

lib/policy/policy.go

@@ -29,16 +29,15 @@ var (
 )
 
 type ParsedConfig struct {
-	orig *config.Config
-
-	Bots              []Bot
-	Thresholds        []*Threshold
-	DNSBL             bool
+	Store             store.Interface
+	orig              *config.Config
 	Impressum         *config.Impressum
 	OpenGraph         config.OpenGraph
-	DefaultDifficulty int
+	Bots              []Bot
+	Thresholds        []*Threshold
 	StatusCodes       config.StatusCodes
-	Store             store.Interface
+	DefaultDifficulty int
+	DNSBL             bool
 }
 
 func newParsedConfig(orig *config.Config) *ParsedConfig {

lib/redirect_security_test.go

@@ -13,7 +13,7 @@ import (
 
 func TestRedirectSecurity(t *testing.T) {
 	tests := []struct {
-		name     string
+		reqHost  string
 		testType string // "constructRedirectURL", "serveHTTPNext", "renderIndex"
 
 		// For constructRedirectURL tests
@@ -23,17 +23,16 @@ func TestRedirectSecurity(t *testing.T) {
 
 		// For serveHTTPNext tests
 		redirParam string
-		reqHost    string
+		name       string
+
+		errorContains  string
+		expectedStatus int
 
 		// For renderIndex tests
 		returnHTTPStatusOnly bool
-
-		// Expected results
-		expectedStatus    int
-		shouldError       bool
-		shouldNotRedirect bool
-		shouldBlock       bool
-		errorContains     string
+		shouldError          bool
+		shouldNotRedirect    bool
+		shouldBlock          bool
 	}{
 		// constructRedirectURL tests - X-Forwarded-Proto validation
 		{

lib/store/bbolt/factory_test.go

@@ -17,9 +17,9 @@ func TestFactoryValid(t *testing.T) {
 
 	t.Run("invalid config", func(t *testing.T) {
 		for _, tt := range []struct {
+			err  error
 			name string
 			cfg  Config
-			err  error
 		}{
 			{
 				name: "missing path",

lib/store/s3api/factory.go

@@ -88,8 +88,8 @@ func (Factory) Valid(data json.RawMessage) error {
 }
 
 type Config struct {
-	PathStyle  bool   `json:"pathStyle"`
 	BucketName string `json:"bucketName"`
+	PathStyle  bool   `json:"pathStyle"`
 }
 
 func (c Config) Valid() error {

lib/store/s3api/s3api_test.go

@@ -17,10 +17,10 @@ import (
 
 // mockS3 is an in-memory mock of the methods we use.
 type mockS3 struct {
-	mu     sync.RWMutex
-	bucket string
 	data   map[string][]byte
 	meta   map[string]map[string]string
+	bucket string
+	mu     sync.RWMutex
 }
 
 func (m *mockS3) PutObject(ctx context.Context, in *s3.PutObjectInput, _ ...func(*s3.Options)) (*s3.PutObjectOutput, error) {

lib/store/storetest/storetest.go

@@ -21,9 +21,9 @@ func Common(t *testing.T, f store.Factory, config json.RawMessage) {
 	}
 
 	for _, tt := range []struct {
-		name string
-		doer func(t *testing.T, s store.Interface) error
 		err  error
+		doer func(t *testing.T, s store.Interface) error
+		name string
 	}{
 		{
 			name: "basic get set delete",

lib/store/valkey/valkey_test.go

@@ -2,20 +2,14 @@ package valkey
 
 import (
 	"encoding/json"
-	"fmt"
 	"os"
 	"testing"
 
-	"github.com/TecharoHQ/anubis/internal"
 	"github.com/TecharoHQ/anubis/lib/store/storetest"
 	"github.com/testcontainers/testcontainers-go"
 	"github.com/testcontainers/testcontainers-go/wait"
 )
 
-func init() {
-	internal.UnbreakDocker()
-}
-
 func TestImpl(t *testing.T) {
 	if os.Getenv("DONT_USE_NETWORK") != "" {
 		t.Skip("test requires network egress")
@@ -24,26 +18,26 @@ func TestImpl(t *testing.T) {
 
 	testcontainers.SkipIfProviderIsNotHealthy(t)
 
-	req := testcontainers.ContainerRequest{
-		Image:      "valkey/valkey:8",
-		WaitingFor: wait.ForLog("Ready to accept connections"),
-	}
-	valkeyC, err := testcontainers.GenericContainer(t.Context(), testcontainers.GenericContainerRequest{
-		ContainerRequest: req,
-		Started:          true,
-	})
+	valkeyC, err := testcontainers.Run(
+		t.Context(), "valkey/valkey:8",
+		testcontainers.WithExposedPorts("6379/tcp"),
+		testcontainers.WithWaitStrategy(
+			wait.ForListeningPort("6379/tcp"),
+			wait.ForLog("Ready to accept connections"),
+		),
+	)
 	testcontainers.CleanupContainer(t, valkeyC)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	containerIP, err := valkeyC.ContainerIP(t.Context())
+	endpoint, err := valkeyC.PortEndpoint(t.Context(), "6379/tcp", "redis")
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	data, err := json.Marshal(Config{
-		URL: fmt.Sprintf("redis://%s:6379/0", containerIP),
+		URL: endpoint,
 	})
 	if err != nil {
 		t.Fatal(err)