v0.28.0

src/proxy/forward_entry.rs

@@ -197,7 +197,7 @@ async fn forward(
         {
             country = cloudflare_country
                 .clone()
-                .or_else(|| state.geoip.country(context.client_ip));
+                .or_else(|| state.geoip.load().country(context.client_ip));
             country_resolved = true;
         }
         if capture_country {
@@ -277,7 +277,7 @@ async fn forward(
         {
             country = cloudflare_country
                 .clone()
-                .or_else(|| state.geoip.country(context.client_ip));
+                .or_else(|| state.geoip.load().country(context.client_ip));
             if capture_country {
                 if let Some(exchange) = request.extensions().get::<Arc<Exchange>>() {
                     *exchange.country.lock().unwrap_or_else(|e| e.into_inner()) = country.clone();

src/proxy/websocket/handshake.rs

@@ -283,8 +283,15 @@ pub fn validate_response(
             "invalid upstream upgrade"
         );
         ensure!(
-            !headers.contains_key("transfer-encoding") && !headers.contains_key("content-length"),
-            "101 response must not include body framing"
+            !headers.contains_key("transfer-encoding"),
+            "101 response must not use Transfer-Encoding"
+        );
+        ensure!(
+            headers.get_all("content-length").iter().count() <= 1
+                && headers
+                    .get("content-length")
+                    .is_none_or(|value| value.to_str().is_ok_and(|value| value.trim() == "0")),
+            "101 response Content-Length must be 0 when present"
         );
         for value in headers.get_all("connection").iter() {
             for field in value.to_str()?.split(',') {

src/proxy/websocket/tests.rs

@@ -200,6 +200,29 @@ mod tests {
         assert!(validate_response(&headers, &expected, true).is_err());
     }
 
+    #[test]
+    fn strict_upstream_101_body_framing_matrix() {
+        let expected = validate(&request()).unwrap();
+        let base = || {
+            let mut headers = HeaderMap::new();
+            headers.insert("connection", "Upgrade".parse().unwrap());
+            headers.insert("upgrade", "websocket".parse().unwrap());
+            headers.insert("sec-websocket-accept", expected.accept.parse().unwrap());
+            headers
+        };
+
+        assert!(validate_response(&base(), &expected, false).is_ok());
+        let mut content_length_zero = base();
+        content_length_zero.insert("content-length", "0".parse().unwrap());
+        assert!(validate_response(&content_length_zero, &expected, false).is_ok());
+        let mut content_length_body = base();
+        content_length_body.insert("content-length", "1".parse().unwrap());
+        assert!(validate_response(&content_length_body, &expected, false).is_err());
+        let mut transfer_encoding = base();
+        transfer_encoding.insert("transfer-encoding", "chunked".parse().unwrap());
+        assert!(validate_response(&transfer_encoding, &expected, false).is_err());
+    }
+
     #[test]
     fn normal_tcp_close_is_not_a_websocket_proxy_error() {
         for kind in [