Refactor trusted-proxies: modernize utils, improve safety, and fix clippy lints (#1693)

Co-authored-by: majinghe <42570491+majinghe@users.noreply.github.com> Co-authored-by: GatewayJ <835269233@qq.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: houseme <4829346+houseme@users.noreply.github.com> Co-authored-by: heihutu <30542132+heihutu@users.noreply.github.com>
2026-09-03 02:38:12 +00:00 · 2026-02-03 01:06:22 +08:00
parent d1a70176a2
commit cb468fb32f
55 changed files with 5145 additions and 93 deletions
@@ -0,0 +1,230 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! IP address utility functions for validation and classification.
+
+use ipnetwork::IpNetwork;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::str::FromStr;
+
+/// Collection of IP-related utility functions.
+pub struct IpUtils;
+
+impl IpUtils {
+    /// Checks if an IP address is valid for general use.
+    ///
+    /// "Valid" here means the address is syntactically valid and not an unspecified or multicast
+    /// address. Classification (private/link-local/documentation/reserved) is handled separately.
+    pub fn is_valid_ip_address(ip: &IpAddr) -> bool {
+        !ip.is_unspecified() && !ip.is_multicast()
+    }
+
+    /// Checks if an IP address belongs to a reserved range.
+    pub fn is_reserved_ip(ip: &IpAddr) -> bool {
+        match ip {
+            IpAddr::V4(ipv4) => Self::is_reserved_ipv4(ipv4),
+            IpAddr::V6(ipv6) => Self::is_reserved_ipv6(ipv6),
+        }
+    }
+
+    /// Checks if an IPv4 address belongs to a reserved range.
+    pub fn is_reserved_ipv4(ip: &Ipv4Addr) -> bool {
+        let octets = ip.octets();
+
+        // Check common reserved IPv4 ranges
+        matches!(
+            octets,
+            [0, _, _, _] |           // 0.0.0.0/8
+            [10, _, _, _] |          // 10.0.0.0/8
+            [100, 64, _, _] |        // 100.64.0.0/10
+            [127, _, _, _] |         // 127.0.0.0/8
+            [169, 254, _, _] |       // 169.254.0.0/16
+            [172, 16..=31, _, _] |   // 172.16.0.0/12
+            [192, 0, 0, _] |         // 192.0.0.0/24
+            [192, 0, 2, _] |         // 192.0.2.0/24
+            [192, 88, 99, _] |       // 192.88.99.0/24
+            [192, 168, _, _] |       // 192.168.0.0/16
+            [198, 18..=19, _, _] |   // 198.18.0.0/15
+            [198, 51, 100, _] |      // 198.51.100.0/24
+            [203, 0, 113, _] |       // 203.0.113.0/24
+            [224..=239, _, _, _] |   // 224.0.0.0/4
+            [240..=255, _, _, _] // 240.0.0.0/4
+        )
+    }
+
+    /// Checks if an IPv6 address belongs to a reserved range.
+    pub fn is_reserved_ipv6(ip: &Ipv6Addr) -> bool {
+        let segments = ip.segments();
+
+        // Check common reserved IPv6 ranges
+        matches!(
+            segments,
+            [0, 0, 0, 0, 0, 0, 0, 0] |                          // ::/128
+            [0, 0, 0, 0, 0, 0, 0, 1] |                          // ::1/128
+            [0x2001, 0xdb8, _, _, _, _, _, _] |                  // 2001:db8::/32
+            [0xfc00..=0xfdff, _, _, _, _, _, _, _] |             // fc00::/7
+            [0xfe80..=0xfebf, _, _, _, _, _, _, _] |             // fe80::/10
+            [0xff00..=0xffff, _, _, _, _, _, _, _] // ff00::/8
+        )
+    }
+
+    /// Checks if an IP address is a private address.
+    pub fn is_private_ip(ip: &IpAddr) -> bool {
+        match ip {
+            IpAddr::V4(ipv4) => Self::is_private_ipv4(ipv4),
+            IpAddr::V6(ipv6) => Self::is_private_ipv6(ipv6),
+        }
+    }
+
+    /// Checks if an IPv4 address is a private address.
+    pub fn is_private_ipv4(ip: &Ipv4Addr) -> bool {
+        let octets = ip.octets();
+
+        matches!(
+            octets,
+            [10, _, _, _] |          // 10.0.0.0/8
+            [172, 16..=31, _, _] |   // 172.16.0.0/12
+            [192, 168, _, _] // 192.168.0.0/16
+        )
+    }
+
+    /// Checks if an IPv6 address is a private address.
+    pub fn is_private_ipv6(ip: &Ipv6Addr) -> bool {
+        let segments = ip.segments();
+
+        matches!(
+            segments,
+            [0xfc00..=0xfdff, _, _, _, _, _, _, _] // fc00::/7
+        )
+    }
+
+    /// Checks if an IP address is a loopback address.
+    pub fn is_loopback_ip(ip: &IpAddr) -> bool {
+        match ip {
+            IpAddr::V4(ipv4) => ipv4.is_loopback(),
+            IpAddr::V6(ipv6) => ipv6.is_loopback(),
+        }
+    }
+
+    /// Checks if an IP address is a link-local address.
+    pub fn is_link_local_ip(ip: &IpAddr) -> bool {
+        match ip {
+            IpAddr::V4(ipv4) => ipv4.is_link_local(),
+            IpAddr::V6(ipv6) => ipv6.is_unicast_link_local(),
+        }
+    }
+
+    /// Checks if an IP address is a documentation address (TEST-NET).
+    pub fn is_documentation_ip(ip: &IpAddr) -> bool {
+        match ip {
+            IpAddr::V4(ipv4) => {
+                let octets = ipv4.octets();
+                matches!(
+                    octets,
+                    [192, 0, 2, _] |      // 192.0.2.0/24
+                    [198, 51, 100, _] |   // 198.51.100.0/24
+                    [203, 0, 113, _] // 203.0.113.0/24
+                )
+            }
+            IpAddr::V6(ipv6) => {
+                let segments = ipv6.segments();
+                matches!(segments, [0x2001, 0xdb8, _, _, _, _, _, _]) // 2001:db8::/32
+            }
+        }
+    }
+
+    /// Parses an IP address or CIDR range from a string.
+    pub fn parse_ip_or_cidr(s: &str) -> Result<IpNetwork, String> {
+        IpNetwork::from_str(s).map_err(|e| format!("Failed to parse IP/CIDR '{}': {}", s, e))
+    }
+
+    /// Parses a comma-separated list of IP addresses.
+    pub fn parse_ip_list(s: &str) -> Result<Vec<IpAddr>, String> {
+        let mut ips = Vec::new();
+
+        for part in s.split(',') {
+            let part = part.trim();
+            if part.is_empty() {
+                continue;
+            }
+
+            match IpAddr::from_str(part) {
+                Ok(ip) => ips.push(ip),
+                Err(e) => return Err(format!("Failed to parse IP '{}': {}", part, e)),
+            }
+        }
+
+        Ok(ips)
+    }
+
+    /// Parses a comma-separated list of IP networks (CIDR).
+    pub fn parse_network_list(s: &str) -> Result<Vec<IpNetwork>, String> {
+        let mut networks = Vec::new();
+
+        for part in s.split(',') {
+            let part = part.trim();
+            if part.is_empty() {
+                continue;
+            }
+
+            match Self::parse_ip_or_cidr(part) {
+                Ok(network) => networks.push(network),
+                Err(e) => return Err(e),
+            }
+        }
+
+        Ok(networks)
+    }
+
+    /// Checks if an IP address is contained within any of the given networks.
+    pub fn ip_in_networks(ip: &IpAddr, networks: &[IpNetwork]) -> bool {
+        networks.iter().any(|network| network.contains(*ip))
+    }
+
+    /// Returns a string description of the IP address type.
+    pub fn get_ip_type(ip: &IpAddr) -> &'static str {
+        if Self::is_private_ip(ip) {
+            "private"
+        } else if Self::is_loopback_ip(ip) {
+            "loopback"
+        } else if Self::is_link_local_ip(ip) {
+            "link_local"
+        } else if Self::is_documentation_ip(ip) {
+            "documentation"
+        } else if Self::is_reserved_ip(ip) {
+            "reserved"
+        } else {
+            "public"
+        }
+    }
+
+    /// Returns the canonical string representation of an IP address.
+    pub fn canonical_ip(ip: &IpAddr) -> String {
+        match ip {
+            IpAddr::V4(ipv4) => ipv4.to_string(),
+            IpAddr::V6(ipv6) => {
+                // Use the standard library's Display implementation for canonical representation
+                ipv6.to_string()
+            }
+        }
+    }
+}
+
+/// Checks if an IP address is valid for general use.
+///
+/// "Valid" here means the address is syntactically valid and not an unspecified or multicast
+/// address. Classification (private/link-local/documentation/reserved) is handled separately.
+pub fn is_valid_ip_address(ip: &IpAddr) -> bool {
+    !ip.is_unspecified() && !ip.is_multicast()
+}
@@ -0,0 +1,21 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Utility functions and helpers for the trusted proxy system.
+
+mod ip;
+mod validation;
+
+pub use ip::*;
+pub use validation::*;
@@ -0,0 +1,223 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Validation utility functions for various data types.
+
+use http::HeaderMap;
+use regex::Regex;
+use std::net::IpAddr;
+use std::str::FromStr;
+use std::sync::OnceLock;
+
+static EMAIL_REGEX: OnceLock<Regex> = OnceLock::new();
+static URL_REGEX: OnceLock<Regex> = OnceLock::new();
+static SAFE_REGEX: OnceLock<Regex> = OnceLock::new();
+
+/// Collection of validation utility functions.
+pub struct ValidationUtils;
+
+impl ValidationUtils {
+    /// Validates an email address format.
+    pub fn is_valid_email(email: &str) -> bool {
+        EMAIL_REGEX
+            .get_or_init(|| Regex::new(r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$").expect("Invalid email regex"))
+            .is_match(email)
+    }
+
+    /// Validates a URL format.
+    pub fn is_valid_url(url: &str) -> bool {
+        URL_REGEX
+            .get_or_init(|| {
+                Regex::new(r"^(https?://)?([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}(/.*)?$")
+                    .expect("Invalid URL regex")
+            })
+            .is_match(url)
+    }
+
+    /// Validates the format of an X-Forwarded-For header value.
+    pub fn validate_x_forwarded_for(header_value: &str) -> bool {
+        if header_value.is_empty() {
+            return false;
+        }
+
+        let ips: Vec<&str> = header_value.split(',').map(|s| s.trim()).collect();
+
+        for ip_str in ips {
+            if ip_str.is_empty() {
+                return false;
+            }
+
+            if let Some(ip_part) = Self::extract_ip_part(ip_str) {
+                if IpAddr::from_str(ip_part).is_err() {
+                    return false;
+                }
+            } else {
+                continue;
+            }
+        }
+
+        true
+    }
+
+    /// Extracts the IP part from a string, handling brackets for IPv6.
+    pub fn extract_ip_part(ip_str: &str) -> Option<&str> {
+        if ip_str.starts_with('[') {
+            if let Some(end) = ip_str.find(']') {
+                Some(&ip_str[1..end])
+            } else {
+                None
+            }
+        } else {
+            // For IPv4 or IPv6 without brackets, take the part before the first colon.
+            Some(ip_str.split(':').next().unwrap_or(ip_str))
+        }
+    }
+
+    /// Validates the format of an RFC 7239 Forwarded header value.
+    pub fn validate_forwarded_header(header_value: &str) -> bool {
+        if header_value.is_empty() {
+            return false;
+        }
+
+        let parts: Vec<&str> = header_value.split(';').collect();
+
+        if parts.is_empty() {
+            return false;
+        }
+
+        for part in parts {
+            let part = part.trim();
+            if !part.contains('=') {
+                return false;
+            }
+        }
+
+        true
+    }
+
+    /// Checks if an IP address is within any of the specified CIDR ranges.
+    pub fn validate_ip_in_range(ip: &IpAddr, cidr_ranges: &[String]) -> bool {
+        for cidr in cidr_ranges {
+            if let Ok(network) = ipnetwork::IpNetwork::from_str(cidr)
+                && network.contains(*ip)
+            {
+                return true;
+            }
+        }
+
+        false
+    }
+
+    /// Validates a header value for security (length and control characters).
+    pub fn validate_header_value(value: &str) -> bool {
+        for c in value.chars() {
+            if c.is_control() && c != '\t' {
+                return false;
+            }
+        }
+
+        if value.len() > 8192 {
+            return false;
+        }
+
+        true
+    }
+
+    /// Validates an entire HeaderMap for security.
+    pub fn validate_headers(headers: &HeaderMap) -> bool {
+        for (name, value) in headers {
+            let name_str = name.as_str();
+            if name_str.len() > 256 {
+                return false;
+            }
+
+            if let Ok(value_str) = value.to_str() {
+                if !Self::validate_header_value(value_str) {
+                    return false;
+                }
+            } else if value.len() > 8192 {
+                return false;
+            }
+        }
+
+        true
+    }
+
+    /// Validates a port number.
+    pub fn validate_port(port: u16) -> bool {
+        port > 0
+    }
+
+    /// Validates a CIDR notation string.
+    pub fn validate_cidr(cidr: &str) -> bool {
+        ipnetwork::IpNetwork::from_str(cidr).is_ok()
+    }
+
+    /// Validates the length of a proxy chain.
+    pub fn validate_proxy_chain_length(chain: &[IpAddr], max_length: usize) -> bool {
+        chain.len() <= max_length
+    }
+
+    /// Validates that a proxy chain does not contain duplicate adjacent IPs.
+    pub fn validate_proxy_chain_continuity(chain: &[IpAddr]) -> bool {
+        if chain.len() < 2 {
+            return true;
+        }
+
+        for i in 1..chain.len() {
+            if chain[i] == chain[i - 1] {
+                return false;
+            }
+        }
+
+        true
+    }
+
+    /// Checks if a string contains only safe characters for use in URLs or headers.
+    pub fn is_safe_string(s: &str) -> bool {
+        SAFE_REGEX
+            .get_or_init(|| Regex::new(r"^[a-zA-Z0-9\-._~:/?#\[\]@!$&'()*+,;=]+$").expect("Invalid safe string regex"))
+            .is_match(s)
+    }
+
+    /// Validates rate limiting parameters.
+    pub fn validate_rate_limit_params(requests: u32, period_seconds: u64) -> bool {
+        requests > 0 && requests <= 10000 && period_seconds > 0 && period_seconds <= 86400
+    }
+
+    /// Validates cache configuration parameters.
+    pub fn validate_cache_params(capacity: usize, ttl_seconds: u64) -> bool {
+        capacity > 0 && capacity <= 1000000 && ttl_seconds > 0 && ttl_seconds <= 86400
+    }
+
+    /// Redacts sensitive information from a string based on provided patterns.
+    pub fn mask_sensitive_data(data: &str, sensitive_patterns: &[&str]) -> String {
+        let mut result = data.to_string();
+
+        for pattern in sensitive_patterns {
+            match Regex::new(&format!(r#"(?i)({})[:=]\s*([^&\s]+)"#, pattern)) {
+                Ok(regex) => {
+                    result = regex
+                        .replace_all(&result, |caps: &regex::Captures| format!("{}:[REDACTED]", &caps[1]))
+                        .to_string();
+                }
+                Err(e) => {
+                    tracing::warn!("Invalid sensitive pattern '{}': {}", pattern, e);
+                }
+            }
+        }
+
+        result
+    }
+}