use std::net::{IpAddr, Ipv6Addr}; use std::str::FromStr; use actix_web::HttpRequest; /// Check if two ips matches pub fn match_ip(pattern: &str, ip: &str) -> bool { if pattern.eq(ip) { return true; } if pattern.ends_with('*') && ip.starts_with(&pattern.replace('*', "")) { return true; } false } /// Get the remote IP address pub fn get_remote_ip(req: &HttpRequest, proxy_ip: Option<&str>) -> String { let mut ip = req.peer_addr().unwrap().ip().to_string(); // We check if the request comes from a trusted reverse proxy if let Some(proxy) = proxy_ip.as_ref() { if match_ip(proxy, &ip) { if let Some(header) = req.headers().get("X-Forwarded-For") { let header = header.to_str().unwrap(); if let Some((upstream_ip, _)) = header.split_once(',') { ip = upstream_ip.to_string(); } else { ip = header.to_string(); } } } } ip } /// Parse an IP address pub fn parse_ip(ip: &str) -> Option { let mut ip = match IpAddr::from_str(ip) { Ok(ip) => ip, Err(e) => { log::warn!("Failed to parse an IP address: {}", e); return None; } }; if let IpAddr::V6(ipv6) = &mut ip { let mut octets = ipv6.octets(); for o in octets.iter_mut().skip(8) { *o = 0; } ip = IpAddr::V6(Ipv6Addr::from(octets)); } Some(ip) } #[cfg(test)] mod test { use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr}; use std::str::FromStr; use actix_web::test::TestRequest; use crate::utils::network_utils::{get_remote_ip, parse_ip}; #[test] fn test_get_remote_ip() { let req = TestRequest::default() .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap()) .to_http_request(); assert_eq!(get_remote_ip(&req, None), "192.168.1.1"); } #[test] fn test_get_remote_ip_from_proxy() { let req = TestRequest::default() .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap()) .insert_header(("X-Forwarded-For", "1.1.1.1")) .to_http_request(); assert_eq!(get_remote_ip(&req, Some("192.168.1.1")), "1.1.1.1"); } #[test] fn test_get_remote_ip_from_proxy_2() { let req = TestRequest::default() .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap()) .insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2")) .to_http_request(); assert_eq!(get_remote_ip(&req, Some("192.168.1.1")), "1.1.1.1"); } #[test] fn test_get_remote_ip_from_no_proxy() { let req = TestRequest::default() .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap()) .insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2")) .to_http_request(); assert_eq!(get_remote_ip(&req, None), "192.168.1.1"); } #[test] fn test_get_remote_ip_from_other_proxy() { let req = TestRequest::default() .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap()) .insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2")) .to_http_request(); assert_eq!(get_remote_ip(&req, Some("192.168.1.2")), "192.168.1.1"); } #[test] fn parse_bad_ip() { let ip = parse_ip("badbad"); assert_eq!(None, ip); } #[test] fn parse_ip_v4_address() { let ip = parse_ip("192.168.1.1").unwrap(); assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(192, 168, 1, 1))); } #[test] fn parse_ip_v6_address() { let ip = parse_ip("2a00:1450:4007:813::200e").unwrap(); assert_eq!(ip, IpAddr::V6(Ipv6Addr::new(0x2a00, 0x1450, 0x4007, 0x813, 0, 0, 0, 0))); } #[test] fn parse_ip_v6_address_2() { let ip = parse_ip("::1").unwrap(); assert_eq!(ip, IpAddr::V6(Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 0))); } #[test] fn parse_ip_v6_address_3() { let ip = parse_ip("a::1").unwrap(); assert_eq!(ip, IpAddr::V6(Ipv6Addr::new(0xa, 0, 0, 0, 0, 0, 0, 0))); } }