v0.25.5

src/forwarding.rs

@@ -88,14 +88,17 @@ static CLOUDFLARE_NETWORKS: LazyLock<Vec<IpNet>> = LazyLock::new(|| {
         .collect()
 });
 
+fn cloudflare_peer(peer: SocketAddr) -> bool {
+    let peer = canonical(peer.ip());
+    CLOUDFLARE_NETWORKS
+        .iter()
+        .any(|network| network.contains(&peer))
+}
+
 /// Return CF-Connecting-IP only when the TCP peer itself is in Cloudflare's
 /// published edge ranges. The header is otherwise untrusted user input.
 pub fn cloudflare_client_ip(headers: &HeaderMap, peer: SocketAddr) -> Option<IpAddr> {
-    let peer = canonical(peer.ip());
-    if !CLOUDFLARE_NETWORKS
-        .iter()
-        .any(|network| network.contains(&peer))
-    {
+    if !cloudflare_peer(peer) {
         return None;
     }
     let mut values = headers.get_all("cf-connecting-ip").iter();
@@ -111,6 +114,25 @@ pub fn cloudflare_client_ip(headers: &HeaderMap, peer: SocketAddr) -> Option<IpA
         .ok()
         .map(canonical)
 }
+
+/// Return a trusted ISO country code supplied by Cloudflare. `CF-IPCountry` is
+/// accepted only from a Cloudflare edge and only as one two-letter code.
+pub fn cloudflare_country(headers: &HeaderMap, peer: SocketAddr) -> Option<String> {
+    if !cloudflare_peer(peer) {
+        return None;
+    }
+    let mut values = headers.get_all("cf-ipcountry").iter();
+    let value = values.next()?;
+    if values.next().is_some() {
+        return None;
+    }
+    let value = value.to_str().ok()?.trim();
+    if value.len() != 2 || !value.bytes().all(|byte| byte.is_ascii_alphabetic()) {
+        return None;
+    }
+    let country = value.to_ascii_uppercase();
+    (country != "XX").then_some(country)
+}
 fn parse_node(value: &str) -> Option<IpAddr> {
     let value = value.trim();
     let value = if value.starts_with('"') {