v0.26.6

src/proxy/forward_entry.rs

@@ -205,12 +205,20 @@ async fn forward(
                 *exchange.country.lock().unwrap_or_else(|e| e.into_inner()) = country.clone();
             }
         }
-        if !frontend.profile_country_access.allows(country.as_deref())
-            || !frontend.rate_limit.country_allowed(country.as_deref())
-        {
+        if !crate::acl::allows_with_country(
+            frontend.profile_acl.as_ref(),
+            &frontend.profile_country_access,
+            context.client_ip,
+            country.as_deref(),
+        ) || !crate::acl::allows_with_country(
+            frontend.acl.as_ref(),
+            &frontend.rate_limit.country_access,
+            context.client_ip,
+            country.as_deref(),
+        ) {
             return error(
                 StatusCode::FORBIDDEN,
-                "RustProxy: country access policy denied this request\n",
+                "RustProxy: denied by access policy\n",
             );
         }
         if let Err(limited) = state.rate_limiter.check(
@@ -230,15 +238,10 @@ async fn forward(
             return response;
         }
     }
-    // Enforce host ACLs even for maintenance/fallback/direct-IP responses.
-    if !snapshot.host_allowed(&host, context.client_ip)
-        || !frontend
-            .and_then(|f| f.profile_acl.as_ref())
-            .is_none_or(|acl| acl.allows(context.client_ip))
-        || !frontend
-            .and_then(|f| f.acl.as_ref())
-            .is_none_or(|acl| acl.allows(context.client_ip))
-    {
+    // Global host ACLs remain an independent restrictive scope and also apply to
+    // maintenance/fallback/direct-IP responses. Profile/vhost IP+country policy
+    // was evaluated above as one scope each.
+    if !snapshot.host_allowed(&host, context.client_ip) {
         return error(
             StatusCode::FORBIDDEN,
             "RustProxy: denied by access policy\n",
@@ -269,20 +272,6 @@ async fn forward(
         if let Some(response) = method_policy_denial(&route.method_policy, request.method()) {
             return response;
         }
-        if !route
-            .profile_acl
-            .as_ref()
-            .is_none_or(|acl| acl.allows(context.client_ip))
-            || !route
-                .acl
-                .as_ref()
-                .is_none_or(|acl| acl.allows(context.client_ip))
-        {
-            return error(
-                StatusCode::FORBIDDEN,
-                "RustProxy: denied by access policy\n",
-            );
-        }
         if (route.profile_country_access.needs_geoip() || route.country_access.needs_geoip())
             && !country_resolved
         {
@@ -295,12 +284,20 @@ async fn forward(
                 }
             }
         }
-        if !route.profile_country_access.allows(country.as_deref())
-            || !route.country_access.allows(country.as_deref())
-        {
+        if !crate::acl::allows_with_country(
+            route.profile_acl.as_ref(),
+            &route.profile_country_access,
+            context.client_ip,
+            country.as_deref(),
+        ) || !crate::acl::allows_with_country(
+            route.acl.as_ref(),
+            &route.country_access,
+            context.client_ip,
+            country.as_deref(),
+        ) {
             return error(
                 StatusCode::FORBIDDEN,
-                "RustProxy: location country access policy denied this request\n",
+                "RustProxy: denied by location access policy\n",
             );
         }
     }