v0.25.5

src/proxy/forward_entry.rs

@@ -95,8 +95,8 @@ async fn forward(
         );
     };
     let frontend = snapshot.frontend(&host, local.0, tls);
-    let websocket_legacy_support = handshake.is_some()
-        && frontend.is_some_and(|frontend| frontend.websocket_legacy_support);
+    let websocket_legacy_support =
+        handshake.is_some() && frontend.is_some_and(|frontend| frontend.websocket_legacy_support);
     let redirect = snapshot.redirect_on(&host, &path, local.0, tls);
     let local_host = snapshot.not_found_host_on(&host, local.0, tls);
     // TLS ALPN normally prevents HTTP/2 from reaching a frontend that disabled it.
@@ -147,7 +147,9 @@ async fn forward(
         return response;
     }
     if !tls {
-        if let Some(response) = frontend.and_then(|frontend| force_ssl_redirect(frontend, &host, request.uri())) {
+        if let Some(response) =
+            frontend.and_then(|frontend| force_ssl_redirect(frontend, &host, request.uri()))
+        {
             return response;
         }
     }
@@ -167,6 +169,7 @@ async fn forward(
             )
         }
     };
+    let mut cloudflare_country = None;
     if frontend.is_some_and(|frontend| frontend.cloudflare_client_ip) {
         if let Some(client) = crate::forwarding::cloudflare_client_ip(request.headers(), peer.0) {
             if context.override_client_ip(client).is_err() {
@@ -175,10 +178,12 @@ async fn forward(
                     "RustProxy: invalid Cloudflare client address\n",
                 );
             }
+            cloudflare_country = crate::forwarding::cloudflare_country(request.headers(), peer.0);
         }
     }
     if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
-        *exchange.client_ip.lock().unwrap_or_else(|e| e.into_inner()) = Some(context.client_ip.to_string());
+        *exchange.client_ip.lock().unwrap_or_else(|e| e.into_inner()) =
+            Some(context.client_ip.to_string());
     }
     // GeoIP stays off the normal request path. Resolve lazily for any vhost or
     // location policy that actually needs a country code, or for log capture.
@@ -190,7 +195,9 @@ async fn forward(
             || frontend.profile_country_access.needs_geoip()
             || frontend.rate_limit.needs_geoip()
         {
-            country = state.geoip.country(context.client_ip);
+            country = cloudflare_country
+                .clone()
+                .or_else(|| state.geoip.country(context.client_ip));
             country_resolved = true;
         }
         if capture_country {
@@ -245,12 +252,16 @@ async fn forward(
                 "RustProxy: redirect target could not be rendered\n",
             );
         };
-        response.extensions_mut().insert(RedirectResponse { http3_enabled: _redirect.http3_enabled });
+        response.extensions_mut().insert(RedirectResponse {
+            http3_enabled: _redirect.http3_enabled,
+        });
         return response;
     }
     if let Some(item) = local_host {
         let mut response = item.page.serve(request.method(), StatusCode::NOT_FOUND);
-        response.extensions_mut().insert(LocalHostResponse { http3_enabled: item.http3_enabled });
+        response.extensions_mut().insert(LocalHostResponse {
+            http3_enabled: item.http3_enabled,
+        });
         return response;
     }
     let selected = snapshot.select_on(&host, &path, local.0, tls);
@@ -275,7 +286,9 @@ async fn forward(
         if (route.profile_country_access.needs_geoip() || route.country_access.needs_geoip())
             && !country_resolved
         {
-            country = state.geoip.country(context.client_ip);
+            country = cloudflare_country
+                .clone()
+                .or_else(|| state.geoip.country(context.client_ip));
             if capture_country {
                 if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
                     *exchange.country.lock().unwrap_or_else(|e| e.into_inner()) = country.clone();
@@ -360,20 +373,51 @@ async fn forward(
             });
     };
     let (
-        backend, backend_lease, affinity_cookie, admin_control_plane, cache_settings,
-        transform_settings, scope, ignore_static_cookie, only_cached, public_suffix,
-        origin_suffix, uri, exchange, lease, stop, downstream, mut h2_downstream,
-        range_selection, if_range, range_requested, effective_reason, revalidation_reason,
-        cache_ticket, client_conditionals, cached_revalidation, freshness_revalidation_reason,
-        pending_revalidation, mut miss_recorded,
+        backend,
+        backend_lease,
+        affinity_cookie,
+        admin_control_plane,
+        cache_settings,
+        transform_settings,
+        scope,
+        ignore_static_cookie,
+        only_cached,
+        public_suffix,
+        origin_suffix,
+        uri,
+        exchange,
+        lease,
+        stop,
+        downstream,
+        mut h2_downstream,
+        range_selection,
+        if_range,
+        range_requested,
+        effective_reason,
+        revalidation_reason,
+        cache_ticket,
+        client_conditionals,
+        cached_revalidation,
+        freshness_revalidation_reason,
+        pending_revalidation,
+        mut miss_recorded,
     ) = include!("forward/route_cache.rs");
 
     let (serve_stale, mut fill_leader) = include!("forward/cache_lookup.rs");
 
     let (
-        websocket_upstream_h2, revalidation_sent, mut h2_direct_session, request_body_empty,
-        proactive_base_headers, upstream_started, active_backend,
-        active_lease, active_affinity_cookie, active_uri, retries, upstream_result,
+        websocket_upstream_h2,
+        revalidation_sent,
+        mut h2_direct_session,
+        request_body_empty,
+        proactive_base_headers,
+        upstream_started,
+        active_backend,
+        active_lease,
+        active_affinity_cookie,
+        active_uri,
+        retries,
+        upstream_result,
         final_attempt_elapsed,
     ) = include!("forward/upstream.rs");