v0.25.3

src/vhost/validation.rs

@@ -8,7 +8,10 @@ impl Default for PathRoute {
             match_type: PathMatch::Prefix,
             enabled: true,
             cache: None,
+            acl_profile_id: None,
             acl: None,
+            country_access: crate::rate_limit::CountryAccess::default(),
+            method_policy: MethodPolicy::default(),
             headers: HeaderRules::default(),
             rewrite: PathRewrite::default(),
             response: None,
@@ -28,7 +31,11 @@ impl PathRoute {
             && self.source == Source::ReverseProxy
             && self.backend_id.is_none()
             && self.cache.is_none()
+            && self.acl_profile_id.is_none()
             && self.acl.is_none()
+            && self.country_access.mode == crate::rate_limit::CountryMode::Off
+            && self.country_access.countries.is_empty()
+            && self.method_policy == MethodPolicy::default()
             && self.headers.is_empty()
             && self.rewrite.mode == RewriteMode::Preserve
             && self.rewrite.value.is_empty()
@@ -67,6 +74,7 @@ impl Vhost {
         if let Some(id) = &self.acl_profile_id {
             ensure!(crate::config::valid_id(id), "invalid ACL profile id");
         }
+        self.method_policy.validate()?;
         ensure!(
             !self.frontend.listener_ids.is_empty(),
             "vhost requires at least one named listener"
@@ -111,8 +119,13 @@ impl Vhost {
         // Normalize the untouched pre-0.16 synthetic root route out of the custom
         // location list so adding/removing Custom locations cannot delete fallback.
         self.routes.retain(|route| !route.is_legacy_main_fallback());
-        for route in &self.routes {
+        for route in &mut self.routes {
             route.source.validate()?;
+            if let Some(id) = &route.acl_profile_id {
+                ensure!(crate::config::valid_id(id), "invalid location ACL profile id");
+            }
+            route.country_access.validate()?;
+            route.method_policy.validate()?;
             ensure!(
                 route.source.is_reverse_proxy() || route.backend_id.is_none(),
                 "Web Server location cannot pin a reverse-proxy backend"