all the changes

internal/honeypot/honeypot_test.go

@@ -10,8 +10,8 @@ import (
 
 func TestPromotesAfterThresholdAndExpires(t *testing.T) {
 	tracker := New(Config{Threshold: 2, Window: time.Minute, TTL: time.Millisecond, Token: "secret"})
-	for i := 0; i < 3; i++ {
-		req := httptest.NewRequest(http.MethodGet, "https://example.test/.env", nil)
+	for _, path := range []string{"/.env", "/.git/config", "/wp-login.php"} {
+		req := httptest.NewRequest(http.MethodGet, "https://example.test"+path, nil)
 		req.RemoteAddr = "192.0.2.10:1234"
 		tracker.Middleware(http.HandlerFunc(http.NotFound)).ServeHTTP(httptest.NewRecorder(), req)
 	}
@@ -56,3 +56,29 @@ func TestRecordTelemetryPromotesTheObservedSourceIP(t *testing.T) {
 		t.Fatalf("unexpected promoted IPs: %+v", ips)
 	}
 }
+
+func TestNeverTracksInternalAddresses(t *testing.T) {
+	tracker := New(Config{Threshold: 1, TTL: time.Minute})
+	for _, ip := range []string{"127.0.0.1", "::1", "10.244.4.1", "192.168.1.5", "169.254.1.1", "100.64.0.1", "100.127.255.254", "198.18.0.1", "240.0.0.1", "255.255.255.255", "::ffff:10.1.2.3", "not-an-ip", ""} {
+		if tracker.RecordTelemetry(ip, "/.env") {
+			t.Fatalf("%q must never be promoted", ip)
+		}
+	}
+	if got := len(tracker.PromotedIPs()); got != 0 {
+		t.Fatalf("promoted %d internal addresses", got)
+	}
+}
+
+func TestMinPathsRequiresBreadth(t *testing.T) {
+	tracker := New(Config{Threshold: 2, TTL: time.Minute, MinPaths: 3})
+	for i := 0; i < 5; i++ {
+		tracker.RecordTelemetry("203.0.113.9", "/manifest.json")
+	}
+	if len(tracker.PromotedIPs()) != 0 {
+		t.Fatal("one repeated path must not promote")
+	}
+	tracker.RecordTelemetry("203.0.113.9", "/.env")
+	if !tracker.RecordTelemetry("203.0.113.9", "/wp-login.php") {
+		t.Fatal("three distinct paths must promote")
+	}
+}