v0.34.4

src/proxy/forward_entry.rs

@@ -88,10 +88,7 @@ async fn forward_request(
         .get::<Arc<crate::config::Snapshot>>()
         .cloned()
         .unwrap_or_else(|| state.config.load_full());
-    let internal_dispatch = request
-        .extensions()
-        .get::<InternalFallbackRoute>()
-        .cloned();
+    let internal_dispatch = request.extensions().get::<InternalFallbackRoute>().cloned();
     // Retain the original URI's shared backing bytes independently of `request`.
     // A normalized, already-safe path can then be borrowed for the entire
     // forwarding operation, even after the request URI/headers are rewritten.
@@ -181,9 +178,9 @@ async fn forward_request(
             return response;
         }
         if !tls {
-            if let Some(response) = frontend.and_then(|frontend| {
-                force_ssl_redirect(frontend, &host, request.uri())
-            }) {
+            if let Some(response) =
+                frontend.and_then(|frontend| force_ssl_redirect(frontend, &host, request.uri()))
+            {
                 return response;
             }
         }
@@ -196,7 +193,9 @@ async fn forward_request(
         &original_host,
         request.uri(),
         frontend.is_some_and(|frontend| frontend.tinyauth.is_some()),
-        request.extensions().get::<Arc<crate::forwarding::PeerFormatting>>()
+        request
+            .extensions()
+            .get::<Arc<crate::forwarding::PeerFormatting>>()
             .map(Arc::as_ref),
         host_already_validated,
     ) {
@@ -237,7 +236,10 @@ async fn forward_request(
     let mut country: Option<String> = None;
     if let Some(frontend) = frontend {
         if capture_country
-            || frontend.profile_country_access.needs_geoip()
+            || frontend
+                .profile_policies
+                .iter()
+                .any(|profile| profile.countries.needs_geoip())
             || frontend.rate_limit.needs_geoip()
         {
             country = cloudflare_country
@@ -250,9 +252,8 @@ async fn forward_request(
                 *exchange.country.lock().unwrap_or_else(|e| e.into_inner()) = country.clone();
             }
         }
-        if !crate::acl::allows_with_country(
-            frontend.profile_acl.as_ref(),
-            &frontend.profile_country_access,
+        if !crate::acl::allows_profiles_with_country(
+            &frontend.profile_policies,
             context.client_ip,
             country.as_deref(),
         ) || !crate::acl::allows_with_country(
@@ -272,7 +273,10 @@ async fn forward_request(
                 &frontend.id,
                 context.client_ip,
                 country.as_deref(),
-                request.headers().get(http::header::USER_AGENT).and_then(|value| value.to_str().ok()),
+                request
+                    .headers()
+                    .get(http::header::USER_AGENT)
+                    .and_then(|value| value.to_str().ok()),
                 &frontend.rate_limit,
             ) {
                 let mut response = error(
@@ -296,7 +300,17 @@ async fn forward_request(
         );
     }
     if cache_http_invalidation_method(request.method()) {
-        return cache_http_invalidation(&state, &snapshot, frontend, &host, request, context.client_ip, peer.0.ip(), context.scheme).await;
+        return cache_http_invalidation(
+            &state,
+            &snapshot,
+            frontend,
+            &host,
+            request,
+            context.client_ip,
+            peer.0.ip(),
+            context.scheme,
+        )
+        .await;
     }
     if let Some((_redirect, rule)) = redirect {
         let authority = original_host.to_str().unwrap_or(&host);
@@ -435,10 +449,11 @@ async fn forward_request(
                 )
             });
     };
-    let fallback_body = match prepare_error_fallback_body(&mut request, route.error_fallback.is_some()).await {
-        Ok(body) => body,
-        Err(response) => return response,
-    };
+    let fallback_body =
+        match prepare_error_fallback_body(&mut request, route.error_fallback.is_some()).await {
+            Ok(body) => body,
+            Err(response) => return response,
+        };
     let (
         backend,
         backend_lease,