rama-http 0.3.0-rc1

rama http layers, services and other utilities
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

use crate::Request;
use rama_core::telemetry::tracing;
use rama_core::{extensions::Extensions, matcher::Matcher};
use rama_net::AuthorityInputExt;
use rama_net::address::{AsDomainRef, DomainTrie};

#[derive(Debug, Clone)]
/// A matcher that matches subdomains.
///
/// Note that a domain is considered also a suddomain of itself.
pub struct SubdomainTrieMatcher {
    trie: DomainTrie<()>,
}

impl SubdomainTrieMatcher {
    /// Create a new [`SubdomainTrieMatcher`].
    ///
    /// Every input domain is registered as a **subtree** entry — it matches
    /// the apex itself plus every descendant. Inputs already in wildcard
    /// form (`"*.foo.bar"`) pass through; bare inputs (`"foo.bar"`) are
    /// promoted to `*.foo.bar` first. Inputs that can't be made into a
    /// valid wildcard (e.g. exceeding the length cap) are silently skipped.
    pub fn new<I, S>(domains: I) -> Self
    where
        I: IntoIterator<Item = S>,
        S: AsDomainRef,
    {
        let mut trie = DomainTrie::new();
        for d in domains {
            if let Ok(w) = d.to_wildcard() {
                trie.insert_domain(w, ());
            }
        }
        Self { trie }
    }

    // Returns true if a domain is a subdomain of any domain lineage in this [`SubdomainTrieMatcher`].
    pub fn is_match(&self, domain: impl AsDomainRef) -> bool {
        self.trie.is_match(domain)
    }
}

impl<Body> Matcher<Request<Body>> for SubdomainTrieMatcher {
    fn matches(&self, _: Option<&Extensions>, req: &Request<Body>) -> bool {
        let Some(authority) = req.authority() else {
            tracing::debug!("SubdomainTrieMatcher: failed to resolve authority");
            return false;
        };

        // IP-first: pct-encoded IP literals (`%31%32%37.0.0.1`) can
        // promote to both Domain and IpAddr (shallow Domain validator
        // accepts digits-and-dots). The Domain match would be wrong for
        // IP hosts. Filter them out first.
        if authority.host.try_as_ip().is_ok() {
            tracing::trace!("SubdomainTrieMatcher: host is an IP — no match");
            return false;
        }
        // Pct-encoded reg-names that decode to a domain participate.
        // Non-promotable hosts (sub-delim, IPvFuture) don't.
        let Ok(domain) = authority.host.try_as_domain() else {
            tracing::trace!("SubdomainTrieMatcher: host is not a domain — no match");
            return false;
        };
        let is_match = self.is_match(domain.as_ref());
        tracing::trace!(
            "SubdomainTrieMatcher: matching domain = {}, matched = {}",
            domain,
            is_match
        );
        is_match
    }
}

impl<S> FromIterator<S> for SubdomainTrieMatcher
where
    S: AsDomainRef,
{
    #[inline]
    fn from_iter<I: IntoIterator<Item = S>>(iter: I) -> Self {
        Self::new(iter)
    }
}

#[cfg(test)]
mod subdomain_trie_tests {
    use super::*;
    use rama_net::uri::Uri;

    #[test]
    fn test_trie_matching() {
        let matcher = SubdomainTrieMatcher::new(vec!["example.com", "sub.domain.org"]);
        assert!(matcher.is_match("example.com"));
        assert!(matcher.is_match(".example.com"));
        assert!(matcher.is_match("sub.domain.org"));
        assert!(matcher.is_match("sub.example.com"));
        assert!(!matcher.is_match("domain.org"));
        assert!(!matcher.is_match("other.com"));
        assert!(!matcher.is_match("localhost"));
    }

    #[test]
    fn test_path_matching_with_trie() {
        let domains = ["example.com", "sub.domain.org"];
        let matcher: SubdomainTrieMatcher = domains.into_iter().collect();

        let path = "sub.example.com";

        let request = Request::builder()
            .uri(Uri::parse_authority_form(path).unwrap())
            .body(())
            .unwrap();
        assert!(matcher.matches(None, &request));
    }

    #[test]
    fn test_non_matching_path() {
        let domains = ["example.com"];
        let matcher: SubdomainTrieMatcher = domains.into_iter().collect();

        let path = "nonmatching.com";

        let request = Request::builder()
            .uri(Uri::parse_authority_form(path).unwrap())
            .body(())
            .unwrap();
        assert!(!matcher.matches(None, &request));
    }

    fn req_with_host(host_header: &str) -> Request<()> {
        Request::builder()
            .uri("/")
            .header("host", host_header)
            .body(())
            .unwrap()
    }

    #[test]
    fn pct_encoded_reg_name_matches_via_bridge() {
        // `exa%6Dple.com` pct-decodes to `example.com` — the subdomain
        // trie includes a `sub.example.com` style entry which should
        // match the bridged domain.
        let matcher: SubdomainTrieMatcher = ["example.com"].into_iter().collect();
        assert!(matcher.matches(None, &req_with_host("exa%6Dple.com")));
    }

    #[test]
    fn ip_host_does_not_match() {
        let matcher: SubdomainTrieMatcher = ["127.0.0.1"].into_iter().collect();
        assert!(!matcher.matches(None, &req_with_host("127.0.0.1")));
        // Regression: pct-encoded IP that bridges to a digits-and-dots
        // string the shallow Domain validator accepts. Must be filtered
        // out by the IP-first check.
        assert!(!matcher.matches(None, &req_with_host("%31%32%37.0.0.1")));
    }
}