v0.32.4

src/proxy/tests/authority_tests.rs

@@ -32,6 +32,68 @@ mod authority_tests {
             Version::HTTP_2
         );
     }
+    #[test]
+    fn preserve_host_sets_http2_authority_without_changing_network_origin() {
+        use crate::config::UpstreamProtocol;
+        for (protocol, scheme, expected_authority, remove_host) in [
+            (UpstreamProtocol::Http1, "https", "backend.internal:443", false),
+            (UpstreamProtocol::Auto, "https", "unitraklub.pl", false),
+            (UpstreamProtocol::Http2, "https", "unitraklub.pl", false),
+            (UpstreamProtocol::H2, "https", "unitraklub.pl", true),
+            (UpstreamProtocol::Auto, "http", "10.87.20.2:443", false),
+            (UpstreamProtocol::Http2, "http", "unitraklub.pl", true),
+            (UpstreamProtocol::H2, "http", "unitraklub.pl", true),
+        ] {
+            let mut config = crate::config::demo_config("127.0.0.1:9000".parse().unwrap());
+            let member = &mut config.vhosts[0].backends[0];
+            member.url = format!("{scheme}://10.87.20.2:443");
+            member.allow_private = true;
+            member.protocol = protocol;
+            member.preserve_host = true;
+            if scheme == "https" {
+                member.tls_server_name = Some("backend.internal".into());
+            }
+            let snapshot = crate::config::compile(config, 1, &validation_policy()).unwrap();
+            let backend = &snapshot.pools[0].members[0].backend;
+            let uri = upstream_uri(backend, "/block_refresh/block/10").unwrap();
+            let mut headers = HeaderMap::new();
+            headers.insert(HOST, HeaderValue::from_static("unitraklub.pl"));
+            let target = upstream_request_target(&uri, &mut headers, backend, false, false).unwrap();
+            assert_eq!(target.authority().unwrap().as_str(), expected_authority, "{protocol:?}");
+            assert_eq!(target.path(), "/block_refresh/block/10");
+            assert_eq!(headers.contains_key(HOST), !remove_host);
+            assert_eq!(backend.origin, format!("{scheme}://10.87.20.2:443"));
+        }
+    }
+
+    #[test]
+    fn invalid_outgoing_host_is_rejected_instead_of_used_for_dialing() {
+        let mut config = crate::config::demo_config("127.0.0.1:9000".parse().unwrap());
+        config.vhosts[0].backends[0].protocol = crate::config::UpstreamProtocol::H2;
+        config.vhosts[0].backends[0].preserve_host = true;
+        let snapshot = crate::config::compile(config, 1, &validation_policy()).unwrap();
+        let backend = &snapshot.pools[0].members[0].backend;
+        let uri = upstream_uri(backend, "/").unwrap();
+        let mut headers = HeaderMap::new();
+        headers.insert(HOST, HeaderValue::from_static("evil@example.invalid"));
+        assert!(upstream_request_target(&uri, &mut headers, backend, false, false).is_none());
+    }
+
+    #[test]
+    fn retry_prepares_authority_for_the_selected_backend_not_the_previous_one() {
+        let mut config = crate::config::demo_config("127.0.0.1:9000".parse().unwrap());
+        config.vhosts[0].backends[0].protocol = crate::config::UpstreamProtocol::H2;
+        config.vhosts[0].backends[0].preserve_host = true;
+        let snapshot = crate::config::compile(config, 1, &validation_policy()).unwrap();
+        let backend = &snapshot.pools[0].members[0].backend;
+        let mut headers = HeaderMap::new();
+        headers.insert(HOST, HeaderValue::from_static("public.example"));
+        let req = retry_request(&Method::GET, Version::HTTP_2, &headers, backend,
+            &HeaderValue::from_static("public.example"), "/retry", true).unwrap();
+        assert_eq!(req.uri().authority().unwrap().as_str(), "public.example");
+        assert!(req.headers().get(HOST).is_none());
+    }
+
     #[test]
     fn legacy_https_http2_version_is_h1_safe_and_strict_h2_is_required() {
         let mut config = crate::config::demo_config("127.0.0.1:9000".parse().unwrap());