Struct TrustedProxies 

pub struct TrustedProxies { /* private fields */ }

Allowlist of reverse-proxy peer addresses whose X-Forwarded-Client-Cert headers the audit middleware will trust.

Threat model

XFCC is a header an upstream Envoy / Istio sidecar sets after performing mTLS termination on behalf of the gateway. Because it is a plain HTTP header, anything that can open a TCP connection to the gateway can also claim a Subject=... value. If the gateway forwards that claim into the audit log unchecked, an attacker on the same L3 segment (or with access to a misconfigured ingress) can write arbitrary identities into the audit stream — defeating non-repudiation, poisoning downstream SIEM tooling, and providing cover for malicious activity attributed to a fabricated certificate Subject.

The mitigation is layered: only consult XFCC when the immediate TCP peer (the L4 source IP axum’s listener observed via ConnectInfo) is in an operator-curated allowlist of proxies known to terminate mTLS. Everything else has its XFCC header silently dropped. The allowlist is empty by default so a fresh deployment cannot accidentally trust an attacker.

Configuration

Operators populate the allowlist via ENV_TRUSTED_XFCC_PROXIES: a comma-separated list of IPv4 / IPv6 addresses (127.0.0.1, ::1) or CIDR ranges (10.0.0.0/8, fd00::/8). Parse failures on individual entries are logged at warn and the entry is dropped; a fully empty list (the default) means no peer is trusted.

Sharing

Clone is intentionally cheap: the inner CIDR list is small and the per-peer warn-dedup DashSet is wrapped in Arc, so cloning into each request’s extensions does not duplicate state.

Implementations

impl TrustedProxies

pub fn empty() -> Self

Construct an empty allowlist (the safe default — trusts nobody).

pub fn from_env() -> Self

Load from ENV_TRUSTED_XFCC_PROXIES.

Unset / empty → empty allowlist (no peer is trusted, every inbound X-Forwarded-Client-Cert header is dropped). Malformed individual entries are skipped with a startup tracing::warn! so a typo in one entry does not poison the whole allowlist.

pub fn parse(s: &str) -> Self

Parse a comma-separated list of IPs / CIDR ranges into an allowlist.

Bare IPs (127.0.0.1, ::1) are normalised into /32 (IPv4) or /128 (IPv6) host routes so the membership test is uniform across shapes. Whitespace around individual entries is tolerated.

pub fn is_empty(&self) -> bool

true when no peer is trusted (the safe default). When this is true, Self::contains returns false for every input.

pub fn contains(&self, ip: IpAddr) -> bool

Membership test: is ip in any of the configured ranges?

pub fn warn_once_untrusted(&self, peer: IpAddr) -> bool

Record a warn-level diagnostic exactly once per unique peer that tried to send X-Forwarded-Client-Cert from outside the allowlist. Subsequent requests from the same peer are silent. Returns true if the warn was emitted (the peer was previously unseen).

Trait Implementations

impl Clone for TrustedProxies

fn clone(&self) -> TrustedProxies

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrustedProxies

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TrustedProxies

fn default() -> TrustedProxies

Returns the “default value” for a type.