v0.34.0_4

src/forwarding.rs

@@ -217,11 +217,34 @@ impl Compiled {
     ) -> Result<Context> {
         let peer_ip = canonical(peer.ip());
         let trusted_peer = self.trusted(peer_ip);
-        let mut ips = if trusted_peer {
-            chain(incoming).unwrap_or_default()
-        } else {
-            Vec::new()
-        };
+        if !trusted_peer {
+            let scheme = if tls { "https" } else { "http" };
+            let authority_text = authority.to_str()?;
+            crate::config::request_host(authority_text)?;
+            let target = uri.path_and_query().map(|v| v.as_str()).unwrap_or("/");
+            let original_url = format!("{scheme}://{authority_text}{target}");
+            let peer_text = peer_ip.to_string();
+            let peer_header = HeaderValue::from_str(&peer_text)?;
+            let forwarded = format!(
+                "for={};by={};proto={scheme};host=\"{authority_text}\"",
+                node(peer_ip), node(canonical(local.ip()))
+            );
+            let mut values = HeaderMap::with_capacity(7);
+            values.insert("forwarded", forwarded.parse()?);
+            values.insert("x-forwarded-for", peer_header.clone());
+            values.insert("x-real-ip", peer_header);
+            values.insert("x-forwarded-host", authority.clone());
+            values.insert("x-forwarded-proto", HeaderValue::from_static(scheme));
+            values.insert("x-forwarded-port", local.port().to_string().parse()?);
+            values.insert("x-forwarded-uri", target.parse()?);
+            return Ok(Context {
+                client_ip: peer_ip,
+                scheme,
+                original_url,
+                values,
+            });
+        }
+        let mut ips = chain(incoming).unwrap_or_default();
         ips.push(peer_ip);
         // Discard everything left of the first untrusted hop walking from us.
         let first = ips.iter().rposition(|ip| !self.trusted(*ip)).unwrap_or(0);