pub struct IpAcl {
pub allow: Vec<String>,
pub deny: Vec<String>,
pub default: IpAclDefault,
}Expand description
IP access control on the effective client IP (DW-020, feature
analysis 4.15). Entries are IP addresses (e.g. 10.1.2.3) or CIDRs
(e.g. 10.0.0.0/8); anything else fails config validation (the same
parser as gateway.trusted_proxies). Evaluation order: the deny
list first (a match rejects with 403 regardless of the allow list),
then the allow list, then default for IPs matched by neither.
A /0 (all-addresses) entry such as 0.0.0.0/0 or ::/0 is
REJECTED by validation in the allow list: an allow-all entry
filters nothing and is always a mistake — the intended shape is an
empty allow list with default: allow (the ACL’s default mode).
A /0 in the deny list is meaningful (deny-all) and is accepted.
Fields§
§allow: Vec<String>CIDRs/IPs allowed through the gate.
deny: Vec<String>CIDRs/IPs rejected; a deny match wins over any allow match.
default: IpAclDefaultWhat happens to an IP matched by NEITHER list: allow (the
default — the lists are exceptions) or deny (closed mode — only
allow-listed IPs pass).
Trait Implementations§
Source§impl<'de> Deserialize<'de> for IpAcl
impl<'de> Deserialize<'de> for IpAcl
Source§fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>where
__D: Deserializer<'de>,
fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>where
__D: Deserializer<'de>,
Deserialize this value from the given Serde deserializer. Read more
Source§impl JsonSchema for IpAcl
impl JsonSchema for IpAcl
Source§fn schema_id() -> Cow<'static, str>
fn schema_id() -> Cow<'static, str>
Returns a string that uniquely identifies the schema produced by this type. Read more
Source§fn json_schema(generator: &mut SchemaGenerator) -> Schema
fn json_schema(generator: &mut SchemaGenerator) -> Schema
Generates a JSON Schema for this type. Read more
Source§fn inline_schema() -> bool
fn inline_schema() -> bool
Whether JSON Schemas generated for this type should be included directly in parent schemas,
rather than being re-used where possible using the
$ref keyword. Read moreimpl StructuralPartialEq for IpAcl
Auto Trait Implementations§
impl Freeze for IpAcl
impl RefUnwindSafe for IpAcl
impl Send for IpAcl
impl Sync for IpAcl
impl Unpin for IpAcl
impl UnwindSafe for IpAcl
Blanket Implementations§
§impl<T> AnyExt for T
impl<T> AnyExt for T
§fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
Attempts to downcast this to
T behind reference§fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
Attempts to downcast this to
T behind mutable reference§fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
Attempts to downcast this to
T behind Rc pointer§fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
Attempts to downcast this to
T behind Arc pointer§fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
Attempts to downcast this to
T behind Box pointer§fn downcast_move<T>(this: Self) -> Option<T>
fn downcast_move<T>(this: Self) -> Option<T>
Attempts to downcast owned
Self to T,
useful only in generic context as a workaround for specializationSource§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
§impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
fn coerce_rc_to(self: Rc<X>) -> Rc<T>
fn coerce_box_to(self: Box<X>) -> Box<T>
fn coerce_ref_to(&self) -> &T
fn coerce_mut_to(&mut self) -> &mut T
§impl<T> Instrument for T
impl<T> Instrument for T
§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
Converts
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
Converts
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more§impl<T> Pointable for T
impl<T> Pointable for T
§impl<T> ServiceExt for T
impl<T> ServiceExt for T
§fn map_response_body<F>(self, f: F) -> MapResponseBody<Self, F>where
Self: Sized,
fn map_response_body<F>(self, f: F) -> MapResponseBody<Self, F>where
Self: Sized,
Apply a transformation to the response body. Read more
§fn trace_for_http(self) -> Trace<Self, SharedClassifier<ServerErrorsAsFailures>>where
Self: Sized,
fn trace_for_http(self) -> Trace<Self, SharedClassifier<ServerErrorsAsFailures>>where
Self: Sized,
High level tracing that classifies responses using HTTP status codes. Read more
§fn trace_for_grpc(self) -> Trace<Self, SharedClassifier<GrpcErrorsAsFailures>>where
Self: Sized,
fn trace_for_grpc(self) -> Trace<Self, SharedClassifier<GrpcErrorsAsFailures>>where
Self: Sized,
High level tracing that classifies responses using gRPC headers. Read more