DVClientAddress class final

Resolves the client address of a request. See the library documentation for the rule.

Constructors

DVClientAddress({List<DVCidr> trustedProxies = const <DVCidr>[], DVForwardedHeader forwardedHeader = DVForwardedHeader.xForwardedFor, int ipv6SourcePrefix = defaultIpv6SourcePrefix})

const

DVClientAddress.fromConfiguration({Iterable<String> trustedProxies = const <String>[], String? forwardedHeader, int ipv6SourcePrefix = defaultIpv6SourcePrefix, Map<String, String> environment = const <String, String>{}})

What the generated backend starts with: dartvel.server.trustedProxies and dartvel.server.forwardedHeader from the pubspec, plus the ranges in trustedProxiesVariable -- which is how a provisioned host names the proxy it put in front of the process.

factory

DVClientAddress.parse(Iterable<String> trustedProxies, {String? forwardedHeader, int ipv6SourcePrefix = defaultIpv6SourcePrefix})

From configuration text, refusing a range or header name that does not parse. Nothing is skipped: a trusted proxy that silently is not one sends every client into the proxy's bucket.

factory

Properties

forwardedHeader → DVForwardedHeader

final

hashCode → int

The hash code for this object.

no setter, inherited

ipv6SourcePrefix → int

How many leading bits of an IPv6 client address are one source.

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

trustedProxies → List<DVCidr>

final

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

peerIsTrusted(Object? request) → bool

Whether request arrived directly from a trusted proxy, so a header that proxy sets can be believed.

resolve(Object? request) → DVIpAddress?

The client address of request, or null when it has no peer address.

source(Object? request) → String?

The key a per-source limit counts request under, or null when it has no peer address: an IPv4 client's address, or the /ipv6SourcePrefix network an IPv6 client's address is in, written as a range (2001:db8:1:2::/64).

sourceKey(DVIpAddress address) → String

address as a source: itself for IPv4 or a /128, otherwise the network of ipv6SourcePrefix bits it belongs to.

toString() → String

A string representation of this object.

inherited

trusts(DVIpAddress address) → bool

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Properties

current → DVClientAddress

The resolver this process uses. Trusts no proxy until one is installed, which is the only safe default: an unconfigured server behind a proxy counts the proxy, and one without a proxy counts its clients.

no setter

Static Methods

checkIpv6SourcePrefix(int prefix) → int

prefix, or a FormatException when it is not from minIpv6SourcePrefix to 128.

install(DVClientAddress resolver) → void

Makes resolver the one this process uses. A prefix the const constructor could only assert on is refused here, where it takes effect.

peerOf(Object? request) → DVPeerAddress?

The peer address a request carries: Request.peerAddress, or a map's peerAddress. Nothing else is a peer address.

reset() → void

Back to trusting no proxy, for tests.

sourceOf(Object? request) → String

The installed resolver's source for request, or unknownSource.

Constants

defaultIpv6SourcePrefix → const int

A /64 is what a subscriber is routinely given, and every address in it is theirs to use: counted per address, one client is a new source on every request it chooses to make from a new one.

maxHops → const int

The most forwarded hops walked. A longer chain is not a real one.

minIpv6SourcePrefix → const int

Shorter than a /32 -- what a registry allocates a whole provider -- counts a provider's customers as one source.

trustedProxiesVariable → const String

The environment variable a deployment adds trusted proxy ranges with, comma-separated.

unknownSource → const String

The source of a request that has no peer address. One bucket for all of them, rather than any header's say.