Struct TrustedProxiesBuilder 

pub struct TrustedProxiesBuilder { /* private fields */ }

Builder for a config that trusts proxies by CIDR.

A request is resolved from headers only when its socket peer IP matches one of the added CIDRs.

Implementations

impl TrustedProxiesBuilder

pub fn new() -> Self

Create a builder with the default chain header order.

pub fn proxy(self, cidr: IpCidr) -> Self

Add a trusted proxy CIDR without a client IP header.

Requests from this CIDR are resolved from the chain headers.

pub fn proxy_with_client_ip_header( self, cidr: IpCidr, header: Uncased<'static>, ) -> Self

Add a trusted proxy CIDR with a client IP header.

Use this when the proxy writes the client address into one header that holds a single IP. Common examples are X-Real-IP, CF-Connecting-IP, and True-Client-IP.

The header is read only when the socket peer IP is inside this CIDR. If it is missing or unusable, the chain headers are still tried, so the proxy should also clear or overwrite the chain headers it does not set itself.

pub fn proxy_with_x_real_ip(self, cidr: IpCidr) -> Self

Add a trusted proxy CIDR that sends the X-Real-IP header.

This is a shortcut for Self::proxy_with_client_ip_header, and it fits Nginx-like setups that pass one client address in X-Real-IP.

pub fn proxy_rule(self, rule: TrustedProxyRule) -> Self

Add one prepared trusted proxy rule.

pub fn proxies(self, rules: impl IntoIterator<Item = TrustedProxyRule>) -> Self

Add several prepared trusted proxy rules.

Use this when the rules come from a config file or another runtime source.

pub fn chain_header_order( self, order: impl IntoIterator<Item = ChainHeader>, ) -> Self

Set the chain headers, and the order they are tried in.

Use ChainHeader::new for a custom comma-separated IP list header, and an empty iterator to read no chain header at all.

pub fn disable_chain_headers(self) -> Self

Read no chain header at all.

Use this when the proxy sets a client IP header and cannot clear the chain headers a client may send.

pub fn build(self) -> Result<ClientIpConfig, ClientIpConfigBuildError>

Build an immutable config.

CIDRs that use the same client IP header are merged into as few rules as possible. CIDRs that use different client IP headers must not overlap, because one socket peer IP would then mean two policies.

An IPv4-mapped IPv6 CIDR, such as ::ffff:10.0.0.0/120, is rewritten to its IPv4 form first, so TrustedProxyRule::cidr may report a different CIDR than the one that was added.

Errors

Returns ClientIpConfigBuildError::OverlappingTrustedProxyRules when two rules cover a common address but do not agree on the client IP header.

Trait Implementations

impl Clone for TrustedProxiesBuilder

fn clone(&self) -> TrustedProxiesBuilder

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrustedProxiesBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TrustedProxiesBuilder

fn default() -> Self

Returns the “default value” for a type.

impl Eq for TrustedProxiesBuilder

impl Hash for TrustedProxiesBuilder

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for TrustedProxiesBuilder

fn eq(&self, other: &TrustedProxiesBuilder) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TrustedProxiesBuilder