v0.34.0_11

src/forwarding/tests.rs

@@ -63,6 +63,74 @@ mod tests {
         }
     }
 
+    #[test]
+    fn untrusted_socket_header_cache_respects_host_uri_scheme_and_trust() {
+        for (peer, local) in [
+            ("192.0.2.51:32000", "127.0.0.1:8080"),
+            ("[2001:db8::8]:32100", "[2001:db8::1]:8443"),
+        ] {
+            let peer: SocketAddr = peer.parse().unwrap();
+            let local: SocketAddr = local.parse().unwrap();
+            let formatter = PeerFormatting::new(peer, local);
+            let compiled = Settings::default().compile().unwrap();
+            let mut incoming = HeaderMap::new();
+            incoming.append("x-forwarded-for", "203.0.113.11".parse().unwrap());
+            incoming.append("forwarded", "for=203.0.113.12".parse().unwrap());
+            for (host, tls, path) in [
+                ("app.example:8080", false, "/small.html"),
+                ("app.example:8080", false, "/small.html"),
+                ("app.example:8080", false, "/other?x=1"),
+                ("other.example:8080", false, "/small.html"),
+                ("other.example:8080", true, "/small.html"),
+                ("app.example:8080", true, "/last?x=1&y=2"),
+            ] {
+                let host = HeaderValue::from_str(host).unwrap();
+                let uri: Uri = path.parse().unwrap();
+                for original_url in [false, true] {
+                    let direct = compiled.context_with_original_url(
+                        &incoming, peer, local, tls, &host, &uri, original_url,
+                    ).unwrap();
+                    let cached = compiled.context_with_peer(
+                        &incoming, peer, local, tls, &host, &uri, original_url,
+                        Some(&formatter), false,
+                    ).unwrap();
+                    assert_eq!(cached.client_ip, direct.client_ip);
+                    assert_eq!(cached.scheme, direct.scheme);
+                    assert_eq!(cached.original_url, direct.original_url);
+                    assert_eq!(cached.values, direct.values);
+                    let mut direct_headers = incoming.clone();
+                    let mut cached_headers = incoming.clone();
+                    direct.apply_upstream(&mut direct_headers, true);
+                    cached.apply_upstream(&mut cached_headers, true);
+                    assert_eq!(direct_headers, cached_headers);
+                }
+            }
+            // When the peer becomes trusted after a config swap, the single-entry
+            // untrusted cache must never override the incoming proxy chain.
+            if peer.is_ipv4() {
+                let trusted = Settings {
+                    trusted_proxies: vec!["192.0.2.0/24".to_owned()],
+                    trust_forwarded_proto: true,
+                }.compile().unwrap();
+                let mut forwarded = HeaderMap::new();
+                forwarded.insert("x-forwarded-for", "198.51.100.9".parse().unwrap());
+                forwarded.insert("x-forwarded-proto", "https".parse().unwrap());
+                let host = HeaderValue::from_static("app.example");
+                let uri: Uri = "/trusted".parse().unwrap();
+                let direct = trusted.context_with_original_url(
+                    &forwarded, peer, local, false, &host, &uri, false,
+                ).unwrap();
+                let cached = trusted.context_with_peer(
+                    &forwarded, peer, local, false, &host, &uri, false,
+                    Some(&formatter), false,
+                ).unwrap();
+                assert_eq!(cached.client_ip, "198.51.100.9".parse::<IpAddr>().unwrap());
+                assert_eq!(cached.scheme, "https");
+                assert_eq!(cached.values, direct.values);
+            }
+        }
+    }
+
     #[test]
     fn canonical_forwarding_headers_replace_duplicate_untrusted_values() {
         let compiled = Settings::default().compile().unwrap();