tests

Cargo.lock

@@ -983,6 +983,18 @@ dependencies = [
  "mio",
  "pin-project-lite 0.1.11",
  "slab",
+ "tokio-macros",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e44da00bfc73a25f814cd8d7e57a68a5c31b74b3152a0a1d1f590c97ed06265a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -1194,6 +1206,7 @@ dependencies = [
 name = "warp-real-ip"
 version = "0.1.0"
 dependencies = [
+ "tokio",
  "warp",
 ]
 

Cargo.toml

@@ -8,3 +8,6 @@ categories = ["web-programming::http-server"]
 
 [dependencies]
 warp = { version = "0.2" }
+
+[dev-dependencies]
+tokio = { version = "0.2", features = ["macros"] }

src/lib.rs

@@ -4,10 +4,13 @@ use warp::filters::addr::remote;
 use warp::Filter;
 
 /// Creates a `Filter` that provides the "real ip" of the connected client.
-pub fn real_ip<'a>(
-    trusted_proxies: &'a [IpAddr],
-) -> impl Filter<Extract = (Option<IpAddr>,), Error = Infallible> + Clone + 'a {
-    let forwarded_for = warp::header::<IpAddr>("X-FORWARDED-FOR")
+///
+/// This uses the "x-forwarded-for" or "x-real-ip" headers set by reverse proxies.
+/// To stop clients from abusing these headers, only headers set by trusted remotes will be accepted.
+pub fn real_ip(
+    trusted_proxies: Vec<IpAddr>,
+) -> impl Filter<Extract = (Option<IpAddr>,), Error = Infallible> + Clone {
+    let forwarded_for = warp::header::<IpAddr>("x-forwarded-for")
         .or(warp::header("x-real-ip"))
         .unify()
         .map(Some)

tests/tests.rs

@@ -0,0 +1,41 @@
+use std::net::IpAddr;
+use warp::Filter;
+use warp_real_ip::real_ip;
+
+fn serve<'a>(trusted: Vec<IpAddr>) -> impl Filter<Extract = (String,)> + 'a {
+    warp::any()
+        .and(real_ip(trusted))
+        .map(|addr: Option<IpAddr>| addr.unwrap().to_string())
+}
+
+#[tokio::test]
+async fn test_not_forwarded() {
+    let remote: IpAddr = [1, 2, 3, 4].into();
+    let res = warp::test::request()
+        .remote_addr((remote, 80).into())
+        .reply(&serve(vec![]))
+        .await;
+    assert_eq!(res.body(), "1.2.3.4");
+}
+
+#[tokio::test]
+async fn test_not_trusted() {
+    let remote: IpAddr = [1, 2, 3, 4].into();
+    let res = warp::test::request()
+        .remote_addr((remote, 80).into())
+        .header("x-forwarded-for", "10.10.10.10")
+        .reply(&serve(vec![]))
+        .await;
+    assert_eq!(res.body(), "1.2.3.4");
+}
+
+#[tokio::test]
+async fn test_trusted() {
+    let remote: IpAddr = [1, 2, 3, 4].into();
+    let res = warp::test::request()
+        .remote_addr((remote, 80).into())
+        .header("x-forwarded-for", "10.10.10.10")
+        .reply(&serve(vec![remote]))
+        .await;
+    assert_eq!(res.body(), "10.10.10.10");
+}