From a5bec187aa1b03efd7d4a026bcb0363d47e01faa Mon Sep 17 00:00:00 2001
From: mdecimus <mauro@stalw.art>
Date: Sun, 29 Dec 2024 12:26:29 +0100
Subject: [PATCH] Check whether the X-Forwarded IP has been blocked

---
 crates/jmap/src/api/http.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/crates/jmap/src/api/http.rs b/crates/jmap/src/api/http.rs
index 5340794e..3ac8ff9f 100644
--- a/crates/jmap/src/api/http.rs
+++ b/crates/jmap/src/api/http.rs
@@ -650,6 +650,20 @@ async fn handle_session<T: SessionStream>(inner: Arc<Inner>, session: SessionDat
                                 .and_then(|h| h.parse::<IpAddr>().ok())
                         })
                     {
+                        // Check if the forwarded IP has been blocked
+                        if server.is_ip_blocked(&forwarded_for) {
+                            trc::event!(
+                                Security(trc::SecurityEvent::IpBlocked),
+                                ListenerId = instance.id.clone(),
+                                RemoteIp = forwarded_for,
+                                SpanId = session.session_id,
+                            );
+
+                            return Ok::<_, hyper::Error>(
+                                StatusCode::FORBIDDEN.into_http_response().build(),
+                            );
+                        }
+
                         trc::event!(
                             Http(trc::HttpEvent::RequestUrl),
                             SpanId = session.session_id,