switch from ipnetwork to ipnet

This commit is contained in:
Robin Appelman 2024-11-29 19:43:06 +01:00
commit 86341fa1b7
4 changed files with 14 additions and 75 deletions

66
Cargo.lock generated
View file

@ -38,13 +38,10 @@ dependencies = [
] ]
[[package]] [[package]]
name = "ipnetwork" name = "ipnet"
version = "0.20.0" version = "2.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e" checksum = "ddc24109865250148c2e0f3d25d4f0f479571723792d3802153c60922a4fb708"
dependencies = [
"serde",
]
[[package]] [[package]]
name = "itertools" name = "itertools"
@ -61,31 +58,13 @@ version = "1.0.14"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674" checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
[[package]]
name = "proc-macro2"
version = "1.0.92"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
dependencies = [
"unicode-ident",
]
[[package]]
name = "quote"
version = "1.0.37"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
dependencies = [
"proc-macro2",
]
[[package]] [[package]]
name = "real-ip" name = "real-ip"
version = "0.1.0" version = "0.1.0"
dependencies = [ dependencies = [
"comma-separated", "comma-separated",
"http", "http",
"ipnetwork", "ipnet",
"itertools", "itertools",
"rfc7239", "rfc7239",
] ]
@ -99,37 +78,6 @@ dependencies = [
"uncased", "uncased",
] ]
[[package]]
name = "serde"
version = "1.0.215"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
version = "1.0.215"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "syn"
version = "2.0.89"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "44d46482f1c1c87acd84dea20c1bf5ebff4c757009ed6bf19cfd36fb10e92c4e"
dependencies = [
"proc-macro2",
"quote",
"unicode-ident",
]
[[package]] [[package]]
name = "uncased" name = "uncased"
version = "0.9.10" version = "0.9.10"
@ -139,12 +87,6 @@ dependencies = [
"version_check", "version_check",
] ]
[[package]]
name = "unicode-ident"
version = "1.0.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
[[package]] [[package]]
name = "version_check" name = "version_check"
version = "0.9.5" version = "0.9.5"

View file

@ -10,5 +10,5 @@ rust-version = "1.60.0"
http = "1.1.0" http = "1.1.0"
rfc7239 = "0.1.2" rfc7239 = "0.1.2"
comma-separated = "0.1.0" comma-separated = "0.1.0"
ipnetwork = "0.20.0" ipnet = "2.10.1"
itertools = "0.13.0" itertools = "0.13.0"

View file

@ -9,8 +9,7 @@ See the [crate documentation](https://docs.rs/real-ip) for more details and exam
```rust ```rust
use http::Request; use http::Request;
use std::net::IpAddr; use std::net::IpAddr;
use ipnetwork::IpNetwork; use real_ip::{real_ip, IpNet};
use real_ip::real_ip;
// in a real program this info would of course come from the http server // in a real program this info would of course come from the http server
let incoming_ip = IpAddr::from([10, 0, 0, 1]); let incoming_ip = IpAddr::from([10, 0, 0, 1]);

View file

@ -7,7 +7,7 @@
//! To stop clients from being able to spoof the remote ip, you are required to configure the trusted proxies //! To stop clients from being able to spoof the remote ip, you are required to configure the trusted proxies
//! which are allowed to set the forwarded headers. //! which are allowed to set the forwarded headers.
//! //!
//! Trusted proxies are configured as a list of [`IpNetwork`]s, which can be a single ip or an ip range. //! Trusted proxies are configured as a list of [`IpNet`]s, which can be a single ip or an ip range.
//! //!
//! Note that if multiple forwarded-for addresses are present, which can be the case when using nested reverse proxies, //! Note that if multiple forwarded-for addresses are present, which can be the case when using nested reverse proxies,
//! all proxies in the chain have to be within the list of trusted proxies. //! all proxies in the chain have to be within the list of trusted proxies.
@ -19,8 +19,7 @@
//! ``` //! ```
//! # use http::Request; //! # use http::Request;
//! # use std::net::IpAddr; //! # use std::net::IpAddr;
//! # use ipnetwork::IpNetwork; //! # use real_ip::{real_ip, IpNet};
//! # use real_ip::real_ip;
//! # //! #
//! // in a real program this info would of course come from the http server //! // in a real program this info would of course come from the http server
//! let incoming_ip = IpAddr::from([10, 0, 0, 1]); //! let incoming_ip = IpAddr::from([10, 0, 0, 1]);
@ -29,7 +28,7 @@
//! // the reverse-proxies in our network that we trust //! // the reverse-proxies in our network that we trust
//! let trusted_proxies = [ //! let trusted_proxies = [
//! IpAddr::from([10, 0, 0, 1]).into(), //! IpAddr::from([10, 0, 0, 1]).into(),
//! IpNetwork::new(IpAddr::from([10, 10, 10, 0]), 24).unwrap(), // 10.10.10.0/24 //! IpNet::new_assert(IpAddr::from([10, 10, 10, 0]), 24), // 10.10.10.0/24
//! ]; //! ];
//! let client_ip = real_ip(request.headers(), incoming_ip, &trusted_proxies); //! let client_ip = real_ip(request.headers(), incoming_ip, &trusted_proxies);
//! assert_eq!(Some(IpAddr::from([192, 0, 2, 1])), client_ip); //! assert_eq!(Some(IpAddr::from([192, 0, 2, 1])), client_ip);
@ -41,15 +40,14 @@
//! ``` //! ```
//! # use http::Request; //! # use http::Request;
//! # use std::net::IpAddr; //! # use std::net::IpAddr;
//! # use ipnetwork::IpNetwork; //! # use real_ip::{real_ip, IpNet};
//! # use real_ip::real_ip;
//! # //! #
//! let incoming_ip = IpAddr::from([10, 0, 0, 1]); //! let incoming_ip = IpAddr::from([10, 0, 0, 1]);
//! let request = Request::builder().header("forwarded", "for=192.0.2.1, for=203.0.113.10;proto=https").body(()).unwrap(); //! let request = Request::builder().header("forwarded", "for=192.0.2.1, for=203.0.113.10;proto=https").body(()).unwrap();
//! //!
//! let trusted_proxies = [ //! let trusted_proxies = [
//! IpAddr::from([10, 0, 0, 1]).into(), //! IpAddr::from([10, 0, 0, 1]).into(),
//! IpNetwork::new(IpAddr::from([10, 10, 10, 0]), 24).unwrap(), //! IpNet::new_assert(IpAddr::from([10, 10, 10, 0]), 24),
//! ]; //! ];
//! let client_ip = real_ip(request.headers(), incoming_ip, &trusted_proxies); //! let client_ip = real_ip(request.headers(), incoming_ip, &trusted_proxies);
//! assert_eq!(Some(IpAddr::from([203, 0, 113, 10])), client_ip); //! assert_eq!(Some(IpAddr::from([203, 0, 113, 10])), client_ip);
@ -58,11 +56,11 @@
pub mod headers; pub mod headers;
use http::HeaderMap; use http::HeaderMap;
use ipnetwork::IpNetwork;
use itertools::Either; use itertools::Either;
use std::iter::{empty, once}; use std::iter::{empty, once};
use std::net::IpAddr; use std::net::IpAddr;
use crate::headers::{extract_forwarded_header, extract_real_ip_header, extract_x_forwarded_for_header}; use crate::headers::{extract_forwarded_header, extract_real_ip_header, extract_x_forwarded_for_header};
pub use ipnet::IpNet;
/// Get the "real-ip" of an incoming request. /// Get the "real-ip" of an incoming request.
/// ///
@ -70,7 +68,7 @@ use crate::headers::{extract_forwarded_header, extract_real_ip_header, extract_x
pub fn real_ip( pub fn real_ip(
headers: &HeaderMap, headers: &HeaderMap,
remote: IpAddr, remote: IpAddr,
trusted_proxies: &[IpNetwork], trusted_proxies: &[IpNet],
) -> Option<IpAddr> { ) -> Option<IpAddr> {
let mut hops = get_forwarded_for(headers).chain(once(remote)); let mut hops = get_forwarded_for(headers).chain(once(remote));
let first = hops.next(); let first = hops.next();
@ -78,7 +76,7 @@ pub fn real_ip(
'outer: for hop in hops.rev() { 'outer: for hop in hops.rev() {
for proxy in trusted_proxies { for proxy in trusted_proxies {
if proxy.contains(hop) { if proxy.contains(&hop) {
continue 'outer; continue 'outer;
} }
} }