Add the ability to blacklist IPs

We're seeing some suspicious traffic that we think is the causing enough
load to be the source of our overall performance problems.

Author: sgrif

src/middleware/blacklist_ips.rs

@@ -0,0 +1,49 @@
+//! Middleware that blocks requests from a list of given IPs
+
+use super::prelude::*;
+
+use std::io::Cursor;
+use std::collections::HashMap;
+use std::net::IpAddr;
+
+// Can't derive debug because of Handler.
+#[allow(missing_debug_implementations)]
+#[derive(Default)]
+pub struct BlockIps {
+    ips: Vec<IpAddr>,
+    handler: Option<Box<Handler>>,
+}
+
+impl BlockIps {
+    pub fn new(ips: Vec<IpAddr>) -> Self {
+        Self { ips, handler: None }
+    }
+}
+
+impl AroundMiddleware for BlockIps {
+    fn with_handler(&mut self, handler: Box<Handler>) {
+        self.handler = Some(handler);
+    }
+}
+
+impl Handler for BlockIps {
+    fn call(&self, req: &mut Request) -> Result<Response, Box<Error + Send>> {
+        if self.ips.contains(&req.remote_addr().ip()) {
+            let body = format!(
+                "We are unable to process your request at this time. \
+                 Please open an issue at https://github.com/rust-lang/crates.io \
+                 and provide the request id {}",
+                req.headers().find("X-Request-Id").unwrap()[0]
+            );
+            let mut headers = HashMap::new();
+            headers.insert("Content-Length".to_string(), vec![body.len().to_string()]);
+            Ok(Response {
+                status: (403, "Forbidden"),
+                headers,
+                body: Box::new(Cursor::new(body.into_bytes())),
+            })
+        } else {
+            self.handler.as_ref().unwrap().call(req)
+        }
+    }
+}

src/middleware/mod.rs

@@ -13,6 +13,7 @@ pub use self::security_headers::SecurityHeaders;
 pub use self::static_or_continue::StaticOrContinue;
 
 pub mod app;
+mod blacklist_ips;
 pub mod current_user;
 mod debug;
 mod ember_index_rewrite;
@@ -79,5 +80,13 @@ pub fn build_middleware(app: Arc<App>, endpoints: R404) -> MiddlewareBuilder {
 
     m.around(Head::default());
 
+    if let Ok(ip_list) = env::var("BLACKLISTED_IPS") {
+        let ips = ip_list
+            .split(',')
+            .map(|s| s.parse().expect("Could not parse IP address"))
+            .collect();
+        m.around(blacklist_ips::BlockIps::new(ips));
+    }
+
     m
 }