v0.34.0_10

src/forwarding/tests.rs

@@ -14,6 +14,105 @@ mod tests {
             )
             .unwrap()
     }
+    #[test]
+    fn socket_cached_forwarding_matches_uncached_for_ipv4_ipv6_and_trusted_hops() {
+        for (peer, local, networks) in [
+            ("192.0.2.51:32000", "127.0.0.1:8080", Vec::<String>::new()),
+            ("[2001:db8::8]:32100", "[2001:db8::1]:8443", Vec::new()),
+            ("10.2.3.4:4123", "10.0.0.1:8443", vec!["10.0.0.0/8".to_owned()]),
+        ] {
+            let peer: SocketAddr = peer.parse().unwrap();
+            let local: SocketAddr = local.parse().unwrap();
+            let formatter = PeerFormatting::new(peer, local);
+            let compiled = Settings {
+                trusted_proxies: networks,
+                trust_forwarded_proto: true,
+            }.compile().unwrap();
+            let mut incoming = HeaderMap::new();
+            incoming.insert("x-forwarded-for", "198.51.100.8, 10.3.2.1".parse().unwrap());
+            incoming.insert("x-forwarded-proto", "https".parse().unwrap());
+            let authority = HeaderValue::from_static("app.example:8443");
+            let uri: Uri = "/some%20file?q=4".parse().unwrap();
+            let plain = compiled.context_with_original_url(
+                &incoming, peer, local, true, &authority, &uri, false
+            ).unwrap();
+            let cached = compiled.context_with_peer(
+                &incoming, peer, local, true, &authority, &uri, false,
+                Some(&formatter), true,
+            ).unwrap();
+            assert_eq!(cached.client_ip, plain.client_ip);
+            assert_eq!(cached.scheme, plain.scheme);
+            assert_eq!(cached.original_url, plain.original_url);
+            assert_eq!(cached.values, plain.values);
+            assert_eq!(formatter.peer_header().to_str().unwrap(),
+                crate::vhost::canonical_ip(peer.ip()).to_string());
+            for include_ip in [false, true] {
+                let mut a = incoming.clone();
+                let mut b = incoming.clone();
+                a.insert("x-forwarded-evil", "spoofed".parse().unwrap());
+                b.insert("x-forwarded-evil", "spoofed".parse().unwrap());
+                a.append("x-forwarded-for", "1.2.3.4".parse().unwrap());
+                b.append("x-forwarded-for", "1.2.3.4".parse().unwrap());
+                plain.apply_upstream(&mut a, include_ip);
+                cached.apply_upstream(&mut b, include_ip);
+                assert_eq!(a, b);
+                assert!(!b.contains_key("x-forwarded-evil"));
+                assert_eq!(b.contains_key("x-real-ip"), include_ip);
+                assert_eq!(b.contains_key("forwarded"), include_ip);
+            }
+        }
+    }
+
+    #[test]
+    fn canonical_forwarding_headers_replace_duplicate_untrusted_values() {
+        let compiled = Settings::default().compile().unwrap();
+        let peer: SocketAddr = "192.0.2.9:4000".parse().unwrap();
+        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
+        let value = compiled.context_with_peer(
+            &HeaderMap::new(), peer, local, false,
+            &HeaderValue::from_static("app.example"),
+            &"/".parse().unwrap(), false,
+            Some(&PeerFormatting::new(peer, local)), false,
+        ).unwrap();
+        let mut headers = HeaderMap::new();
+        for (name, val) in [
+            ("forwarded", "for=203.0.113.1"),
+            ("forwarded", "for=203.0.113.2"),
+            ("x-forwarded-for", "203.0.113.3"),
+            ("x-forwarded-for", "203.0.113.4"),
+            ("x-real-ip", "203.0.113.5"),
+            ("x-forwarded-privilege", "admin"),
+            ("x-original-method", "DELETE"),
+        ] {
+            headers.append(name, val.parse().unwrap());
+        }
+        value.apply(&mut headers);
+        assert_eq!(headers.get_all("forwarded").iter().count(), 1);
+        assert_eq!(headers.get_all("x-forwarded-for").iter().count(), 1);
+        assert_eq!(headers["x-forwarded-for"], "192.0.2.9");
+        assert!(!headers.contains_key("x-forwarded-privilege"));
+        assert!(!headers.contains_key("x-original-method"));
+    }
+
+    #[test]
+    fn peer_cache_can_never_override_the_actual_socket() {
+        let compiled = Settings::default().compile().unwrap();
+        let different = PeerFormatting::new(
+            "192.0.2.1:9001".parse().unwrap(),
+            "192.0.2.2:8080".parse().unwrap(),
+        );
+        let actual: SocketAddr = "198.51.100.6:4000".parse().unwrap();
+        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
+        let authority = HeaderValue::from_static("app.example");
+        let uri: Uri = "/safe".parse().unwrap();
+        let value = compiled.context_with_peer(
+            &HeaderMap::new(), actual, local, false,
+            &authority, &uri, false, Some(&different), false,
+        ).unwrap();
+        assert_eq!(value.client_ip, actual.ip());
+        assert_eq!(value.values["x-forwarded-for"], "198.51.100.6");
+    }
+
     #[test]
     fn untrusted_headers_are_rebuilt_not_appended() {
         let mut headers = HeaderMap::new();