filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix HTTP: Reject requests from blocked IPs when Keep-Alive is enabled

Browse Source
This commit is contained in:
Maurus Decimus
2026-05-28 16:43:53 +02:00
parent ae4f21f6f3
commit 086383a045
2 changed files with 17 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
crates/http/src/request.rs
View File

@@ -699,22 +699,6 @@ async fn handle_session<T: SessionStream>(inner: Arc<Inner>, session: SessionDat
.and_then(|h| h.parse::<IpAddr>().ok())
})
{
// Check if the forwarded IP has been blocked
if server.is_ip_blocked(forwarded_for) {
trc::event!(
Security(trc::SecurityEvent::IpBlocked),
ListenerId = instance.id.clone(),
RemoteIp = forwarded_for,
SpanId = session.session_id,
);
return Ok::<_, hyper::Error>(
JsonProblemResponse(StatusCode::FORBIDDEN)
.into_http_response()
.build(),
);
}
trc::event!(
Http(trc::HttpEvent::RequestUrl),
SpanId = session.session_id,
@@ -731,6 +715,22 @@ async fn handle_session<T: SessionStream>(inner: Arc<Inner>, session: SessionDat
session.remote_ip
};
// Check if the remote IP has been blocked
if server.is_ip_blocked(remote_ip) {
trc::event!(
Security(trc::SecurityEvent::IpBlocked),
ListenerId = instance.id.clone(),
RemoteIp = remote_ip,
SpanId = session.session_id,
);
return Ok::<_, hyper::Error>(
JsonProblemResponse(StatusCode::FORBIDDEN)
.into_http_response()
.build(),
);
}
// Parse HTTP request
let response = match Box::pin(server.parse_http_request(
req,