v0.26.6

src/proxy/forward/route_cache.rs

@@ -1,30 +1,7 @@
 {
-// Both scopes run before DNS, TCP, TLS or reuse of an existing upstream connection.
-if !snapshot.host_allowed(&host, context.client_ip)
-    || !route
-        .profile_acl
-        .as_ref()
-        .is_none_or(|acl| acl.allows(context.client_ip))
-    || !route
-        .acl
-        .as_ref()
-        .is_none_or(|acl| acl.allows(context.client_ip))
-    || !route
-        .frontend
-        .as_ref()
-        .and_then(|f| f.profile_acl.as_ref())
-        .is_none_or(|acl| acl.allows(context.client_ip))
-    || !route
-        .frontend
-        .as_ref()
-        .and_then(|f| f.acl.as_ref())
-        .is_none_or(|acl| acl.allows(context.client_ip))
-{
-    return error(
-        StatusCode::FORBIDDEN,
-        "RustProxy: denied by access policy\n",
-    );
-}
+// Global host, profile, vhost and location access policies were already enforced
+// before this source/cache path. Do not re-evaluate IP ACLs in isolation here:
+// allow-only country entries and explicit IP allows form one policy scope.
 if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
     *exchange.route.lock().unwrap_or_else(|e| e.into_inner()) = Some(route.id.clone());
     *exchange.source.lock().unwrap_or_else(|e| e.into_inner()) = if route.response.is_some() {