v0.25.5

src/forwarding/tests.rs

@@ -167,6 +167,29 @@ mod tests {
         assert!(cloudflare_client_ip(&headers, "192.0.2.2:443".parse().unwrap()).is_none());
     }
     #[test]
+    fn cloudflare_country_requires_trusted_peer_and_iso_code() {
+        let mut headers = HeaderMap::new();
+        headers.insert("cf-ipcountry", "pl".parse().unwrap());
+        assert_eq!(
+            cloudflare_country(&headers, "104.16.1.2:443".parse().unwrap()),
+            Some("PL".into())
+        );
+        assert!(cloudflare_country(&headers, "192.0.2.2:443".parse().unwrap()).is_none());
+        headers.insert("cf-ipcountry", "XX".parse().unwrap());
+        assert!(cloudflare_country(&headers, "104.16.1.2:443".parse().unwrap()).is_none());
+        headers.insert("cf-ipcountry", "T1".parse().unwrap());
+        assert!(cloudflare_country(&headers, "104.16.1.2:443".parse().unwrap()).is_none());
+        headers.insert("cf-ipcountry", "POL".parse().unwrap());
+        assert!(cloudflare_country(&headers, "104.16.1.2:443".parse().unwrap()).is_none());
+    }
+    #[test]
+    fn cloudflare_country_rejects_duplicate_headers() {
+        let mut headers = HeaderMap::new();
+        headers.append("cf-ipcountry", "PL".parse().unwrap());
+        headers.append("cf-ipcountry", "DE".parse().unwrap());
+        assert!(cloudflare_country(&headers, "104.16.1.2:443".parse().unwrap()).is_none());
+    }
+    #[test]
     fn authenticated_client_override_prepends_chain_once() {
         let mut c = context(Settings::default(), HeaderMap::new(), "104.16.1.2:443");
         c.override_client_ip("203.0.113.8".parse().unwrap())