Repository navigation
fix(route): route country rules and the unknown client identity follow the reference - #89
Merged
Merged
Conversation
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #88
fix(route): the routeip_whitelist/ip_blacklistverdict and the routeblocked_countries/whitelist_countriesverdict now go through the engine'sRouteIpGate::evaluate_access, the referencecheck_route_ip_access. A route whitelist match no longer overrides a blocked country,blocked_countriesis asked first, the route country arm has no loopback exemption, and a matching route country whitelist skips the global geo stage.fix(ip): the unknown client identity (no resolvable client address) is denied by a routeip_whitelistorwhitelist_countriesand by a globalwhitelist(IpGateConfig::evaluate_unknown), as in the reference. The global country whitelist already denied it.I added
tests/route_country.rsover 2125 rows generated by running the reference (route, global and route+global compositions, including the unknown identity and loopback). On master 158 of 640 route rows, 2 of 45 global rows and 136 of 1440 combined rows fail. This PR needs the guard-core-rs engine PR (Guard-Core/guard-core-rs#149) first, because it uses the new engine API through the sibling path dependency, so its CI stays red until that PR is merged. Fmt, clippy (default and all features), tests, doc, 100% coverage and the MSRV 1.92 check and test pass locally.