praxis-proxy-filter 0.1.0

Filter pipeline engine and built-in filters for Praxis
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

// SPDX-License-Identifier: LGPL-3.0-only
// Copyright (c) 2024 Shane Utt

//! Shared IP address utilities for HTTP filters.

use std::net::IpAddr;

// -----------------------------------------------------------------------------
// Normalize IPs
// -----------------------------------------------------------------------------

/// Convert IPv4-mapped IPv6 addresses (`::ffff:A.B.C.D`) to plain IPv4.
///
/// All other addresses are returned unchanged. This prevents bypass
/// attacks where a client connects via IPv4-mapped IPv6 to evade rules
/// that only list plain IPv4 addresses.
///
/// ```
/// use std::net::IpAddr;
///
/// // IPv4-mapped IPv6 is normalized to plain IPv4.
/// let mapped: IpAddr = "::ffff:192.168.1.1".parse().unwrap();
/// assert_eq!(
///     praxis_filter::normalize_mapped_ipv4(mapped),
///     "192.168.1.1".parse::<IpAddr>().unwrap(),
/// );
///
/// // Plain IPv4 is unchanged.
/// let v4: IpAddr = "10.0.0.1".parse().unwrap();
/// assert_eq!(praxis_filter::normalize_mapped_ipv4(v4), v4);
///
/// // Non-mapped IPv6 is unchanged.
/// let v6: IpAddr = "2001:db8::1".parse().unwrap();
/// assert_eq!(praxis_filter::normalize_mapped_ipv4(v6), v6);
/// ```
pub fn normalize_mapped_ipv4(ip: IpAddr) -> IpAddr {
    match ip {
        IpAddr::V6(v6) => v6.to_ipv4_mapped().map_or(IpAddr::V6(v6), IpAddr::V4),
        IpAddr::V4(v4) => IpAddr::V4(v4),
    }
}