v0.34.0_4

src/proxy/forward_entry.rs

@@ -101,7 +101,12 @@ async fn forward_request(
         .extensions()
         .get::<InternalFallbackRoute>()
         .cloned();
-    let Ok(path) = crate::acl::routing_path(request.uri().path()) else {
+    // Retain the original URI's shared backing bytes independently of `request`.
+    // A normalized, already-safe path can then be borrowed for the entire
+    // forwarding operation, even after the request URI/headers are rewritten.
+    // Encoded/slash-folded paths still allocate via the strict decoder.
+    let routing_uri = request.uri().clone();
+    let Ok(path) = crate::acl::routing_path_view(routing_uri.path()) else {
         return error(
             StatusCode::BAD_REQUEST,
             "RustProxy: ambiguous request path\n",
@@ -216,9 +221,15 @@ async fn forward_request(
             cloudflare_country = crate::forwarding::cloudflare_country(request.headers(), peer.0);
         }
     }
-    if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
-        *exchange.client_ip.lock().unwrap_or_else(|e| e.into_inner()) =
-            Some(context.client_ip.to_string());
+    // `observe` already stored the actual transport peer.  Most requests
+    // don't use a trusted forwarding hop, so avoid formatting the same IP
+    // and taking the per-request mutex a second time.  IPv4-mapped peers
+    // still take this path so their canonical form is correctly logged.
+    if context.client_ip != peer.0.ip() {
+        if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
+            *exchange.client_ip.lock().unwrap_or_else(|e| e.into_inner()) =
+                Some(context.client_ip.to_string());
+        }
     }
     // GeoIP stays off the normal request path. Resolve lazily for any vhost or
     // location policy that actually needs a country code, or for log capture.