berkus
/
actix-web
mirror of https://github.com/fafhrd91/actix-web
1
0
Fork 0
Code Issues Releases Wiki Activity

Rename peer/remote to remote_addr/realip_remote_addr 

Change names to avoid naming confusions. I choose this accord to Nginx
variables and
[ngx_http_realip_module](https://nginx.org/en/docs/http/ngx_http_realip_module.html).

Add more specific documentation about security concerns of using Real IP
in logger.
This commit is contained in:
Pando85 2020-05-04 14:30:40 +02:00
parent 069d8e3a5e
commit 6ebfbf0001
No known key found for this signature in database
GPG Key ID: C6CB8A1793CA3F94
2 changed files with 41 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
src/info.rs
View File

@ -12,8 +12,8 @@ const X_FORWARDED_PROTO: &[u8] = b"x-forwarded-proto";
pub struct ConnectionInfo { pub struct ConnectionInfo {
scheme: String, scheme: String,
host: String, host: String,
remote: Option<String>, realip_remote_addr: Option<String>,
peer: Option<String>, remote_addr: Option<String>,
} }
impl ConnectionInfo { impl ConnectionInfo {
@ -29,7 +29,7 @@ impl ConnectionInfo {
fn new(req: &RequestHead, cfg: &AppConfig) -> ConnectionInfo { fn new(req: &RequestHead, cfg: &AppConfig) -> ConnectionInfo {
let mut host = None; let mut host = None;
let mut scheme = None; let mut scheme = None;
let mut remote = None; let mut realip_remote_addr = None;
// load forwarded header // load forwarded header
for hdr in req.headers.get_all(&header::FORWARDED) { for hdr in req.headers.get_all(&header::FORWARDED) {
@ -41,8 +41,8 @@ impl ConnectionInfo {
if let Some(val) = items.next() { if let Some(val) = items.next() {
match &name.to_lowercase() as &str { match &name.to_lowercase() as &str {
"for" => { "for" => {
if remote.is_none() { if realip_remote_addr.is_none() {
remote = Some(val.trim()); realip_remote_addr = Some(val.trim());
} }
} }
"proto" => { "proto" => {
@ -105,26 +105,25 @@ impl ConnectionInfo {
} }
} }
// get peeraddr from socketaddr // get remote_addraddr from socketaddr
let peer = req.peer_addr.map(|addr| format!("{}", addr)); let remote_addr = req.peer_addr.map(|addr| format!("{}", addr));
// remote addr if realip_remote_addr.is_none() {
if remote.is_none() {
if let Some(h) = req if let Some(h) = req
.headers .headers
.get(&HeaderName::from_lowercase(X_FORWARDED_FOR).unwrap()) .get(&HeaderName::from_lowercase(X_FORWARDED_FOR).unwrap())
{ {
if let Ok(h) = h.to_str() { if let Ok(h) = h.to_str() {
remote = h.split(',').next().map(|v| v.trim()); realip_remote_addr = h.split(',').next().map(|v| v.trim());
} }
} }
} }
ConnectionInfo { ConnectionInfo {
peer, remote_addr,
scheme: scheme.unwrap_or("http").to_owned(), scheme: scheme.unwrap_or("http").to_owned(),
host: host.unwrap_or("localhost").to_owned(), host: host.unwrap_or("localhost").to_owned(),
remote: remote.map(|s| s.to_owned()), realip_remote_addr: realip_remote_addr.map(|s| s.to_owned()),
} }
} }
@ -153,23 +152,23 @@ impl ConnectionInfo {
&self.host &self.host
} }
/// Peer address of the request. /// remote_addr address of the request.
/// ///
/// Get peer address from socket address /// Get remote_addr address from socket address
pub fn peer(&self) -> Option<&str> { pub fn remote_addr(&self) -> Option<&str> {
if let Some(ref peer) = self.peer { if let Some(ref remote_addr) = self.remote_addr {
Some(peer) Some(remote_addr)
} else { } else {
None None
} }
} }
/// Remote socket addr of client initiated HTTP request. /// Real ip remote addr of client initiated HTTP request.
/// ///
/// The addr is resolved through the following headers, in this order: /// The addr is resolved through the following headers, in this order:
/// ///
/// - Forwarded /// - Forwarded
/// - X-Forwarded-For /// - X-Forwarded-For
/// - peer name of opened socket /// - remote_addr name of opened socket
/// ///
/// # Security /// # Security
/// Do not use this function for security purposes, unless you can ensure the Forwarded and /// Do not use this function for security purposes, unless you can ensure the Forwarded and
@ -177,11 +176,11 @@ impl ConnectionInfo {
/// address explicitly, use /// address explicitly, use
/// [`HttpRequest::peer_addr()`](../web/struct.HttpRequest.html#method.peer_addr) instead. /// [`HttpRequest::peer_addr()`](../web/struct.HttpRequest.html#method.peer_addr) instead.
#[inline] #[inline]
pub fn remote(&self) -> Option<&str> { pub fn realip_remote_addr(&self) -> Option<&str> {
if let Some(ref r) = self.remote { if let Some(ref r) = self.realip_remote_addr {
Some(r) Some(r)
} else if let Some(ref peer) = self.peer { } else if let Some(ref remote_addr) = self.remote_addr {
Some(peer) Some(remote_addr)
} else { } else {
None None
} }
@ -210,7 +209,7 @@ mod tests {
let info = req.connection_info(); let info = req.connection_info();
assert_eq!(info.scheme(), "https"); assert_eq!(info.scheme(), "https");
assert_eq!(info.host(), "rust-lang.org"); assert_eq!(info.host(), "rust-lang.org");
assert_eq!(info.remote(), Some("192.0.2.60")); assert_eq!(info.realip_remote_addr(), Some("192.0.2.60"));
let req = TestRequest::default() let req = TestRequest::default()
.header(header::HOST, "rust-lang.org") .header(header::HOST, "rust-lang.org")
@ -219,20 +218,20 @@ mod tests {
let info = req.connection_info(); let info = req.connection_info();
assert_eq!(info.scheme(), "http"); assert_eq!(info.scheme(), "http");
assert_eq!(info.host(), "rust-lang.org"); assert_eq!(info.host(), "rust-lang.org");
assert_eq!(info.remote(), None); assert_eq!(info.realip_remote_addr(), None);
let req = TestRequest::default() let req = TestRequest::default()
.header(X_FORWARDED_FOR, "192.0.2.60") .header(X_FORWARDED_FOR, "192.0.2.60")
.to_http_request(); .to_http_request();
let info = req.connection_info(); let info = req.connection_info();
assert_eq!(info.remote(), Some("192.0.2.60")); assert_eq!(info.realip_remote_addr(), Some("192.0.2.60"));
let req = TestRequest::default() let req = TestRequest::default()
.header(X_FORWARDED_HOST, "192.0.2.60") .header(X_FORWARDED_HOST, "192.0.2.60")
.to_http_request(); .to_http_request();
let info = req.connection_info(); let info = req.connection_info();
assert_eq!(info.host(), "192.0.2.60"); assert_eq!(info.host(), "192.0.2.60");
assert_eq!(info.remote(), None); assert_eq!(info.realip_remote_addr(), None);
let req = TestRequest::default() let req = TestRequest::default()
.header(X_FORWARDED_PROTO, "https") .header(X_FORWARDED_PROTO, "https")

27
src/middleware/logger.rs
View File

@ -55,7 +55,7 @@ use crate::HttpResponse;
/// ///
/// `%%` The percent sign /// `%%` The percent sign
/// ///
/// `%a` Client IP-address /// `%a` Remote IP-address (IP-address of proxy if using reverse proxy)
/// ///
/// `%t` Time when the request was started to process (in rfc3339 format) /// `%t` Time when the request was started to process (in rfc3339 format)
/// ///
@ -72,7 +72,7 @@ use crate::HttpResponse;
/// ///
/// `%U` Request URL /// `%U` Request URL
/// ///
/// `%{r}a` Remote IP-address (IP-address of proxy if using reverse proxy) **\*** /// `%{r}a` Real IP remote address **\***
/// ///
/// `%{FOO}i` request.headers['FOO'] /// `%{FOO}i` request.headers['FOO']
/// ///
@ -80,9 +80,12 @@ use crate::HttpResponse;
/// ///
/// `%{FOO}e` os.environ['FOO'] /// `%{FOO}e` os.environ['FOO']
/// ///
/// > **\* warning** It is critical to only use this value from intermediate /// ### **\* security warning**
/// > hosts(proxies, etc) which are trusted by this server, since it is trivial /// It is calculated using
/// > for the remote client to simulate another client. /// [`ConnectionInfo::realip_remote_addr()`](../dev/struct.ConnectionInfo.html#method.realip_remote_addr)
///
/// If you use this value ensure that all requests come from trusted hosts, since it is trivial
/// for the remote client to simulate been another client.
/// ///
pub struct Logger(Rc<Inner>); pub struct Logger(Rc<Inner>);
@ -322,7 +325,7 @@ impl Format {
if let Some(key) = cap.get(2) { if let Some(key) = cap.get(2) {
results.push(match cap.get(3).unwrap().as_str() { results.push(match cap.get(3).unwrap().as_str() {
"a" => if key.as_str() == "r" { "a" => if key.as_str() == "r" {
FormatText::RemoteAddr FormatText::RealIPRemoteAddr
} else { } else {
unreachable!() unreachable!()
}, },
@ -339,7 +342,7 @@ impl Format {
let m = cap.get(1).unwrap(); let m = cap.get(1).unwrap();
results.push(match m.as_str() { results.push(match m.as_str() {
"%" => FormatText::Percent, "%" => FormatText::Percent,
"a" => FormatText::ClientIP, "a" => FormatText::RemoteAddr,
"t" => FormatText::RequestTime, "t" => FormatText::RequestTime,
"r" => FormatText::RequestLine, "r" => FormatText::RequestLine,
"s" => FormatText::ResponseStatus, "s" => FormatText::ResponseStatus,
@ -372,8 +375,8 @@ pub enum FormatText {
ResponseSize, ResponseSize,
Time, Time,
TimeMillis, TimeMillis,
ClientIP,
RemoteAddr, RemoteAddr,
RealIPRemoteAddr,
UrlPath, UrlPath,
RequestHeader(HeaderName), RequestHeader(HeaderName),
ResponseHeader(HeaderName), ResponseHeader(HeaderName),
@ -469,16 +472,16 @@ impl FormatText {
}; };
*self = FormatText::Str(s.to_string()); *self = FormatText::Str(s.to_string());
} }
FormatText::ClientIP => { FormatText::RemoteAddr => {
let s = if let Some(ref peer) = req.connection_info().peer() { let s = if let Some(ref peer) = req.connection_info().remote_addr() {
FormatText::Str(peer.to_string()) FormatText::Str(peer.to_string())
} else { } else {
FormatText::Str("-".to_string()) FormatText::Str("-".to_string())
}; };
*self = s; *self = s;
} }
FormatText::RemoteAddr => { FormatText::RealIPRemoteAddr => {
let s = if let Some(remote) = req.connection_info().remote() { let s = if let Some(remote) = req.connection_info().realip_remote_addr() {
FormatText::Str(remote.to_string()) FormatText::Str(remote.to_string())
} else { } else {
FormatText::Str("-".to_string()) FormatText::Str("-".to_string())