oidc-test-client/src/remote_ip.rs

use std::net::{IpAddr, Ipv6Addr};

use crate::app_config::AppConfig;
use actix_web::dev::Payload;
use actix_web::{Error, FromRequest, HttpRequest};
use futures_util::future::{ready, Ready};
use std::str::FromStr;

/// Parse an IP address
pub fn parse_ip(ip: &str) -> Option<IpAddr> {
    let mut ip = match IpAddr::from_str(ip) {
        Ok(ip) => ip,
        Err(e) => {
            log::warn!("Failed to parse an IP address: {}", e);
            return None;
        }
    };

    if let IpAddr::V6(ipv6) = &mut ip {
        let mut octets = ipv6.octets();
        for o in octets.iter_mut().skip(8) {
            *o = 0;
        }
        ip = IpAddr::V6(Ipv6Addr::from(octets));
    }

    Some(ip)
}

/// Check if two ips matches
pub fn match_ip(pattern: &str, ip: &str) -> bool {
    if pattern.eq(ip) {
        return true;
    }

    if pattern.ends_with('*') && ip.starts_with(&pattern.replace('*', "")) {
        return true;
    }

    false
}

/// Get the remote IP address
pub fn get_remote_ip(req: &HttpRequest, proxy_ip: Option<&str>) -> IpAddr {
    let mut ip = req.peer_addr().unwrap().ip();

    // We check if the request comes from a trusted reverse proxy
    if let Some(proxy) = proxy_ip.as_ref() {
        if match_ip(proxy, &ip.to_string()) {
            if let Some(header) = req.headers().get("X-Forwarded-For") {
                let header = header.to_str().unwrap();

                let remote_ip = if let Some((upstream_ip, _)) = header.split_once(',') {
                    upstream_ip
                } else {
                    header
                };

                if let Some(upstream_ip) = parse_ip(remote_ip) {
                    ip = upstream_ip;
                }
            }
        }
    }

    ip
}

#[derive(Copy, Clone, Debug, Eq, PartialEq)]
pub struct RemoteIP(pub IpAddr);

impl From<RemoteIP> for IpAddr {
    fn from(i: RemoteIP) -> Self {
        i.0
    }
}

impl FromRequest for RemoteIP {
    type Error = Error;
    type Future = Ready<Result<Self, Error>>;

    #[inline]
    fn from_request(req: &HttpRequest, _: &mut Payload) -> Self::Future {
        ready(Ok(RemoteIP(get_remote_ip(
            req,
            AppConfig::get().proxy_ip.as_deref(),
        ))))
    }
}

#[cfg(test)]
mod test {
    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
    use std::str::FromStr;

    use crate::remote_ip::{get_remote_ip, parse_ip};
    use actix_web::test::TestRequest;

    #[test]
    fn test_get_remote_ip() {
        let req = TestRequest::default()
            .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
            .to_http_request();
        assert_eq!(
            get_remote_ip(&req, None),
            "192.168.1.1".parse::<IpAddr>().unwrap()
        );
    }

    #[test]
    fn test_get_remote_ip_from_proxy() {
        let req = TestRequest::default()
            .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
            .insert_header(("X-Forwarded-For", "1.1.1.1"))
            .to_http_request();
        assert_eq!(
            get_remote_ip(&req, Some("192.168.1.1")),
            "1.1.1.1".parse::<IpAddr>().unwrap()
        );
    }

    #[test]
    fn test_get_remote_ip_from_proxy_2() {
        let req = TestRequest::default()
            .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
            .insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2"))
            .to_http_request();
        assert_eq!(
            get_remote_ip(&req, Some("192.168.1.1")),
            "1.1.1.1".parse::<IpAddr>().unwrap()
        );
    }

    #[test]
    fn test_get_remote_ip_from_proxy_ipv6() {
        let req = TestRequest::default()
            .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
            .insert_header(("X-Forwarded-For", "10::1, 1.2.2.2"))
            .to_http_request();
        assert_eq!(
            get_remote_ip(&req, Some("192.168.1.1")),
            "10::".parse::<IpAddr>().unwrap()
        );
    }

    #[test]
    fn test_get_remote_ip_from_no_proxy() {
        let req = TestRequest::default()
            .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
            .insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2"))
            .to_http_request();
        assert_eq!(
            get_remote_ip(&req, None),
            "192.168.1.1".parse::<IpAddr>().unwrap()
        );
    }

    #[test]
    fn test_get_remote_ip_from_other_proxy() {
        let req = TestRequest::default()
            .peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
            .insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2"))
            .to_http_request();
        assert_eq!(
            get_remote_ip(&req, Some("192.168.1.2")),
            "192.168.1.1".parse::<IpAddr>().unwrap()
        );
    }

    #[test]
    fn parse_bad_ip() {
        let ip = parse_ip("badbad");
        assert_eq!(None, ip);
    }

    #[test]
    fn parse_ip_v4_address() {
        let ip = parse_ip("192.168.1.1").unwrap();
        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(192, 168, 1, 1)));
    }

    #[test]
    fn parse_ip_v6_address() {
        let ip = parse_ip("2a00:1450:4007:813::200e").unwrap();
        assert_eq!(
            ip,
            IpAddr::V6(Ipv6Addr::new(0x2a00, 0x1450, 0x4007, 0x813, 0, 0, 0, 0))
        );
    }

    #[test]
    fn parse_ip_v6_address_2() {
        let ip = parse_ip("::1").unwrap();
        assert_eq!(ip, IpAddr::V6(Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 0)));
    }

    #[test]
    fn parse_ip_v6_address_3() {
        let ip = parse_ip("a::1").unwrap();
        assert_eq!(ip, IpAddr::V6(Ipv6Addr::new(0xa, 0, 0, 0, 0, 0, 0, 0)));
    }
}