Add log on suspicious X-Forwarded-Proto and Port

Signed-off-by: Eloi DEMOLIS <eloi.demolis@clever-cloud.com>
sozu-proxy · Oct 27, 2023 · 8854576 · 8854576
1 parent 71cf51d
commit 8854576
Showing 1 changed file with 19 additions and 0 deletions.
diff --git a/lib/src/protocol/kawa_h1/editor.rs b/lib/src/protocol/kawa_h1/editor.rs
@@ -142,9 +142,28 @@ impl HttpContext {
                     } else if compare_no_case(key, b"X-Forwarded-Proto") {
                         has_x_proto = true;
                         // header.val = kawa::Store::Static(proto.as_bytes());
+                        incr!("http.trusting.x_proto");
+                        let val = header.val.data(buf);
+                        if !compare_no_case(val, proto.as_bytes()) {
+                            incr!("http.trusting.x_proto.diff");
+                            debug!(
+                                "Trusting X-Forwarded-Proto for {:?} even though {:?} != {}",
+                                self.authority, val, proto
+                            );
+                        }
                     } else if compare_no_case(key, b"X-Forwarded-Port") {
                         has_x_port = true;
                         // header.val = kawa::Store::from_string(public_port.to_string());
+                        incr!("http.trusting.x_port");
+                        let val = header.val.data(buf);
+                        let expected = public_port.to_string();
+                        if !compare_no_case(val, expected.as_bytes()) {
+                            incr!("http.trusting.x_port.diff");
+                            debug!(
+                                "Trusting X-Forwarded-Port for {:?} even though {:?} != {}",
+                                self.authority, val, expected
+                            );
+                        }
                     } else if compare_no_case(key, b"X-Forwarded-For") {
                         x_for = Some(header);
                     } else if compare_no_case(key, b"Forwarded") {