0.34.13_cleaup_code

src/proxy/forward_entry.rs

@@ -106,7 +106,11 @@ async fn forward_request(
     } else {
         snapshot.frontend(&host, local.0, tls)
     };
-    if snapshot.global_security.content_type_policy.blocks(request.headers()) {
+    if snapshot
+        .global_security
+        .content_type_policy
+        .blocks(request.headers())
+    {
         return error(
             StatusCode::FORBIDDEN,
             "RustProxy: request Content-Type denied by global policy\n",
@@ -118,7 +122,10 @@ async fn forward_request(
             "RustProxy: request Content-Type denied by vhost policy\n",
         );
     }
-    if snapshot.global_security.user_agent_blocking.blocks(request.headers())
+    if snapshot
+        .global_security
+        .user_agent_blocking
+        .blocks(request.headers())
         || frontend.is_some_and(|frontend| frontend.user_agent_blocking.blocks(request.headers()))
     {
         return error(
@@ -170,7 +177,9 @@ async fn forward_request(
             "RustProxy: RFC 9220 WebSocket transport is not enabled for this vhost\n",
         );
     }
-    if let Some(response) = method_policy_denial(&snapshot.global_security.method_policy, request.method()) {
+    if let Some(response) =
+        method_policy_denial(&snapshot.global_security.method_policy, request.method())
+    {
         return response;
     }
     if !cache_http_invalidation_method(request.method()) {
@@ -239,11 +248,24 @@ async fn forward_request(
         }
     }
     // Global rules are cumulative: an explicit IP allow cannot bypass a country deny/allowlist.
-    if !snapshot.global_security.country_access.allows(country.as_deref())
-        || !snapshot.global_security.rate_limit.country_allowed(country.as_deref())
-        || snapshot.global_security.acl.as_ref().is_some_and(|acl| !acl.allows(context.client_ip))
+    if !snapshot
+        .global_security
+        .country_access
+        .allows(country.as_deref())
+        || !snapshot
+            .global_security
+            .rate_limit
+            .country_allowed(country.as_deref())
+        || snapshot
+            .global_security
+            .acl
+            .as_ref()
+            .is_some_and(|acl| !acl.allows(context.client_ip))
     {
-        return error(StatusCode::FORBIDDEN, "RustProxy: denied by global access policy\n");
+        return error(
+            StatusCode::FORBIDDEN,
+            "RustProxy: denied by global access policy\n",
+        );
     }
     if internal_dispatch.is_none() {
         if let Err(limited) = state.rate_limiter.check_with_user_agent(
@@ -251,7 +273,10 @@ async fn forward_request(
             "\u{1f}rustproxy-global-security",
             context.client_ip,
             country.as_deref(),
-            request.headers().get(http::header::USER_AGENT).and_then(|value| value.to_str().ok()),
+            request
+                .headers()
+                .get(http::header::USER_AGENT)
+                .and_then(|value| value.to_str().ok()),
             &snapshot.global_security.rate_limit,
         ) {
             let mut response = error(
@@ -265,12 +290,13 @@ async fn forward_request(
         }
     }
     if let Some(frontend) = frontend {
-        if !country_resolved && (capture_country
-            || frontend
-                .profile_policies
-                .iter()
-                .any(|profile| profile.countries.needs_geoip())
-            || frontend.rate_limit.needs_geoip())
+        if !country_resolved
+            && (capture_country
+                || frontend
+                    .profile_policies
+                    .iter()
+                    .any(|profile| profile.countries.needs_geoip())
+                || frontend.rate_limit.needs_geoip())
         {
             country = cloudflare_country
                 .clone()
@@ -331,14 +357,20 @@ async fn forward_request(
         if let Some(mut response) = frontend.and_then(|frontend| {
             canonical_host_redirect(frontend, &host, tls, local.0.port(), request.uri())
         }) {
-            snapshot.global_security.headers.apply(response.headers_mut(), tls);
+            snapshot
+                .global_security
+                .headers
+                .apply(response.headers_mut(), tls);
             return response;
         }
         if !tls {
             if let Some(mut response) =
                 frontend.and_then(|frontend| force_ssl_redirect(frontend, &host, request.uri()))
             {
-                snapshot.global_security.headers.apply(response.headers_mut(), tls);
+                snapshot
+                    .global_security
+                    .headers
+                    .apply(response.headers_mut(), tls);
                 return response;
             }
         }
@@ -364,7 +396,10 @@ async fn forward_request(
                 "RustProxy: redirect target could not be rendered\n",
             );
         };
-        snapshot.global_security.headers.apply(response.headers_mut(), tls);
+        snapshot
+            .global_security
+            .headers
+            .apply(response.headers_mut(), tls);
         response.extensions_mut().insert(RedirectResponse {
             http3_enabled: _redirect.http3_enabled,
         });
@@ -372,7 +407,10 @@ async fn forward_request(
     }
     if let Some(item) = local_host {
         let mut response = item.page.serve(request.method(), StatusCode::NOT_FOUND);
-        snapshot.global_security.headers.apply(response.headers_mut(), tls);
+        snapshot
+            .global_security
+            .headers
+            .apply(response.headers_mut(), tls);
         response.extensions_mut().insert(LocalHostResponse {
             http3_enabled: item.http3_enabled,
         });