#include <chrono>

#include "envoy/network/proxy_protocol.h"

#include "test/common/http/conn_manager_impl_test_base.h"

#include "test/mocks/http/early_header_mutation.h"

#include "test/test_common/logging.h"

#include "test/test_common/test_runtime.h"

#include "gmock/gmock.h"

using testing::_;

using testing::An;

using testing::AnyNumber;

using testing::AtLeast;

using testing::Eq;

using testing::HasSubstr;

using testing::InSequence;

using testing::Invoke;

using testing::InvokeWithoutArgs;

using testing::Mock;

using testing::Return;

using testing::ReturnRef;

namespace Envoy {

namespace Http {

TEST_F(HttpConnectionManagerImplTest, HeaderOnlyRequestAndResponse) {

setup(SetupOpts().setTracing(false));

// Store the basic request encoder during filter chain setup.

std::shared_ptr<MockStreamDecoderFilter> filter(new NiceMock<MockStreamDecoderFilter>());

EXPECT_CALL(*filter, decodeHeaders(_, true))

.Times(2)

.WillRepeatedly(Invoke([&](RequestHeaderMap& headers, bool) -> FilterHeadersStatus {

EXPECT_NE(nullptr, headers.ForwardedFor());

EXPECT_EQ("http", headers.getForwardedProtoValue());

if (headers.Path()->value() == "/healthcheck") {

filter->callbacks_->streamInfo().healthCheck(true);

}

return FilterHeadersStatus::StopIteration;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_)).Times(2);

EXPECT_CALL(filter_factory_, createFilterChain(_))

.Times(2)

.WillRepeatedly(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createDecoderFilterFactoryCb(filter);

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(filter_callbacks_.connection_.dispatcher_, deferredDelete_(_)).Times(2);

// When dispatch is called on the codec, we pretend to get a new stream and then fire a headers

// only request into it. Then we respond into the filter.

EXPECT_CALL(*codec_, dispatch(_))

.Times(2)

.WillRepeatedly(Invoke([&](Buffer::Instance& data) -> Http::Status {

EXPECT_CALL(response_encoder_.stream_, codecStreamId()).WillOnce(Return(54321));

decoder_ = &conn_manager_->newStream(response_encoder_);

// Test not charging stats on the second call.

if (data.length() == 4) {

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

} else {

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/healthcheck"}, {":method", "GET"}}};

EXPECT_EQ(54321, decoder_->streamInfo().codecStreamId());

decoder_->decodeHeaders(std::move(headers), true);

}

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

filter->callbacks_->streamInfo().setResponseCodeDetails("");

filter->callbacks_->encodeHeaders(std::move(response_headers), true, "details");

response_encoder_.stream_.codec_callbacks_->onCodecEncodeComplete();

// Drain 2 so that on the 2nd iteration we will hit zero.

data.drain(2);

return Http::okStatus();

}));

// Kick off the incoming data. Use extra data which should cause a redispatch.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

EXPECT_EQ(1U, stats_.named_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, stats_.named_.downstream_rq_completed_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_completed_.value());

}

// Similar to HeaderOnlyRequestAndResponse but uses newStreamHandle and has

// lifetime checks.

TEST_F(HttpConnectionManagerImplTest, HandleLifetime) {

setup(SetupOpts().setTracing(false));

Http::RequestDecoderHandlePtr decoder_handle;

// Store the basic request encoder during filter chain setup.

std::shared_ptr<MockStreamDecoderFilter> filter(new NiceMock<MockStreamDecoderFilter>());

EXPECT_CALL(*filter, decodeHeaders(_, true))

.Times(2)

.WillRepeatedly(Invoke([&](RequestHeaderMap& headers, bool) -> FilterHeadersStatus {

EXPECT_NE(nullptr, headers.ForwardedFor());

EXPECT_EQ("http", headers.getForwardedProtoValue());

if (headers.Path()->value() == "/healthcheck") {

filter->callbacks_->streamInfo().healthCheck(true);

}

return FilterHeadersStatus::StopIteration;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_)).Times(2);

EXPECT_CALL(filter_factory_, createFilterChain(_))

.Times(2)

.WillRepeatedly(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createDecoderFilterFactoryCb(filter);

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(filter_callbacks_.connection_.dispatcher_, deferredDelete_(_)).Times(2);

// When dispatch is called on the codec, we pretend to get a new stream and then fire a headers

// only request into it. Then we respond into the filter.

EXPECT_CALL(*codec_, dispatch(_))

.Times(2)

.WillRepeatedly(Invoke([&](Buffer::Instance& data) -> Http::Status {

decoder_handle = conn_manager_->newStreamHandle(response_encoder_);

EXPECT_TRUE(decoder_handle->get().has_value());

decoder_ = &decoder_handle->get().value().get();

// Test not charging stats on the second call.

if (data.length() == 4) {

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

} else {

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/healthcheck"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

}

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

filter->callbacks_->streamInfo().setResponseCodeDetails("");

filter->callbacks_->encodeHeaders(std::move(response_headers), true, "details");

response_encoder_.stream_.codec_callbacks_->onCodecEncodeComplete();

// Drain 2 so that on the 2nd iteration we will hit zero.

data.drain(2);

return Http::okStatus();

}));

// Kick off the incoming data. Use extra data which should cause a redispatch.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

// At the end of this, the handle is on the deferred delete list but not

// deleted. It should be invalid.

EXPECT_FALSE(decoder_handle->get().has_value());

filter_callbacks_.connection_.dispatcher_.clearDeferredDeleteList();

EXPECT_FALSE(decoder_handle->get().has_value());

EXPECT_EQ(1U, stats_.named_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, stats_.named_.downstream_rq_completed_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_completed_.value());

}

TEST_F(HttpConnectionManagerImplTest, HeaderOnlyRequestAndResponseWithEarlyHeaderMutation) {

setup(SetupOpts().setTracing(false));

auto mock_early_header_mutation_1 = std::make_unique<NiceMock<Http::MockEarlyHeaderMutation>>();

auto mock_early_header_mutation_2 = std::make_unique<NiceMock<Http::MockEarlyHeaderMutation>>();

auto raw_mock_early_header_mutation_1 = mock_early_header_mutation_1.get();

auto raw_mock_early_header_mutation_2 = mock_early_header_mutation_2.get();

// Set early header mutations.

early_header_mutations_.push_back(std::move(mock_early_header_mutation_1));

early_header_mutations_.push_back(std::move(mock_early_header_mutation_2));

EXPECT_CALL(*raw_mock_early_header_mutation_1, mutate(_, _))

.Times(2)

.WillRepeatedly(Invoke([](RequestHeaderMap& headers, const StreamInfo::StreamInfo&) -> bool {

headers.addCopy(Http::LowerCaseString("x-early-mutation"), "true");

return false;

}));

// This should not be called because the first extension returns false.

EXPECT_CALL(*raw_mock_early_header_mutation_2, mutate(_, _)).Times(0);

// Store the basic request encoder during filter chain setup.

std::shared_ptr<MockStreamDecoderFilter> filter(new NiceMock<MockStreamDecoderFilter>());

EXPECT_CALL(*filter, decodeHeaders(_, true))

.Times(2)

.WillRepeatedly(Invoke([&](RequestHeaderMap& headers, bool) -> FilterHeadersStatus {

EXPECT_EQ(

"true",

headers.get(Http::LowerCaseString("x-early-mutation"))[0]->value().getStringView());

EXPECT_NE(nullptr, headers.ForwardedFor());

EXPECT_EQ("http", headers.getForwardedProtoValue());

if (headers.Path()->value() == "/healthcheck") {

filter->callbacks_->streamInfo().healthCheck(true);

}

return FilterHeadersStatus::StopIteration;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_)).Times(2);

EXPECT_CALL(filter_factory_, createFilterChain(_))

.Times(2)

.WillRepeatedly(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createDecoderFilterFactoryCb(filter);

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(filter_callbacks_.connection_.dispatcher_, deferredDelete_(_)).Times(2);

// When dispatch is called on the codec, we pretend to get a new stream and then fire a headers

// only request into it. Then we respond into the filter.

EXPECT_CALL(*codec_, dispatch(_))

.Times(2)

.WillRepeatedly(Invoke([&](Buffer::Instance& data) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

// Test not charging stats on the second call.

if (data.length() == 4) {

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

} else {

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/healthcheck"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

}

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

filter->callbacks_->streamInfo().setResponseCodeDetails("");

filter->callbacks_->encodeHeaders(std::move(response_headers), true, "details");

response_encoder_.stream_.codec_callbacks_->onCodecEncodeComplete();

// Drain 2 so that on the 2nd iteration we will hit zero.

data.drain(2);

return Http::okStatus();

}));

// Kick off the incoming data. Use extra data which should cause a redispatch.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

EXPECT_EQ(1U, stats_.named_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, stats_.named_.downstream_rq_completed_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_completed_.value());

}

TEST_F(HttpConnectionManagerImplTest, 1xxResponse) {

proxy_100_continue_ = true;

setup(SetupOpts().setTracing(false));

// Store the basic request encoder during filter chain setup.

std::shared_ptr<MockStreamDecoderFilter> filter(new NiceMock<MockStreamDecoderFilter>());

EXPECT_CALL(*filter, decodeHeaders(_, true))

.WillRepeatedly(Invoke([&](RequestHeaderMap& headers, bool) -> FilterHeadersStatus {

EXPECT_NE(nullptr, headers.ForwardedFor());

EXPECT_EQ("http", headers.getForwardedProtoValue());

return FilterHeadersStatus::StopIteration;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_));

EXPECT_CALL(filter_factory_, createFilterChain(_))

.WillRepeatedly(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createDecoderFilterFactoryCb(filter);

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(filter_callbacks_.connection_.dispatcher_, deferredDelete_(_));

// When dispatch is called on the codec, we pretend to get a new stream and then fire a headers

// only request into it. Then we respond into the filter.

EXPECT_CALL(*codec_, dispatch(_))

.WillRepeatedly(Invoke([&](Buffer::Instance& data) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

// Test not charging stats on the second call.

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

ResponseHeaderMapPtr continue_headers{new TestResponseHeaderMapImpl{{":status", "100"}}};

filter->callbacks_->encode1xxHeaders(std::move(continue_headers));

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

filter->callbacks_->streamInfo().setResponseCodeDetails("");

filter->callbacks_->encodeHeaders(std::move(response_headers), true, "details");

data.drain(4);

return Http::okStatus();

}));

// Kick off the incoming data.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

EXPECT_EQ(1U, stats_.named_.downstream_rq_1xx_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_1xx_.value());

EXPECT_EQ(1U, stats_.named_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_2xx_.value());

EXPECT_EQ(2U, stats_.named_.downstream_rq_completed_.value());

EXPECT_EQ(2U, listener_stats_.downstream_rq_completed_.value());

}

TEST_F(HttpConnectionManagerImplTest, 1xxResponseWithEncoderFiltersProxyingDisabled) {

proxy_100_continue_ = false;

setup(SetupOpts().setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

// Akin to 1xxResponseWithEncoderFilters below, but with

// proxy_100_continue_ false. Verify the filters do not get the 100 continue

// headers.

EXPECT_CALL(*encoder_filters_[0], encode1xxHeaders(_)).Times(0);

EXPECT_CALL(*encoder_filters_[1], encode1xxHeaders(_)).Times(0);

EXPECT_CALL(response_encoder_, encode1xxHeaders(_)).Times(0);

ResponseHeaderMapPtr continue_headers{new TestResponseHeaderMapImpl{{":status", "100"}}};

decoder_filters_[0]->callbacks_->encode1xxHeaders(std::move(continue_headers));

EXPECT_CALL(*encoder_filters_[0], encodeHeaders(_, false))

.WillOnce(Return(FilterHeadersStatus::Continue));

EXPECT_CALL(*encoder_filters_[1], encodeHeaders(_, false))

.WillOnce(Return(FilterHeadersStatus::Continue));

EXPECT_CALL(response_encoder_, encodeHeaders(_, false));

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

decoder_filters_[0]->callbacks_->streamInfo().setResponseCodeDetails("");

decoder_filters_[0]->callbacks_->encodeHeaders(std::move(response_headers), false, "details");

doRemoteClose();

}

TEST_F(HttpConnectionManagerImplTest, 1xxResponseWithEncoderFilters) {

proxy_100_continue_ = true;

setup(SetupOpts().setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

EXPECT_CALL(*encoder_filters_[0], encode1xxHeaders(_))

.WillOnce(Return(Filter1xxHeadersStatus::Continue));

EXPECT_CALL(*encoder_filters_[1], encode1xxHeaders(_))

.WillOnce(Return(Filter1xxHeadersStatus::Continue));

EXPECT_CALL(response_encoder_, encode1xxHeaders(_));

ResponseHeaderMapPtr continue_headers{new TestResponseHeaderMapImpl{{":status", "100"}}};

decoder_filters_[0]->callbacks_->encode1xxHeaders(std::move(continue_headers));

EXPECT_CALL(*encoder_filters_[0], encodeHeaders(_, false))

.WillOnce(Return(FilterHeadersStatus::Continue));

EXPECT_CALL(*encoder_filters_[1], encodeHeaders(_, false))

.WillOnce(Return(FilterHeadersStatus::Continue));

EXPECT_CALL(response_encoder_, encodeHeaders(_, false));

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

decoder_filters_[0]->callbacks_->streamInfo().setResponseCodeDetails("");

decoder_filters_[0]->callbacks_->encodeHeaders(std::move(response_headers), false, "details");

doRemoteClose();

}

TEST_F(HttpConnectionManagerImplTest, PauseResume1xx) {

proxy_100_continue_ = true;

setup(SetupOpts().setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

// Stop the 100-Continue at encoder filter 1. Encoder filter 0 should not yet receive the

// 100-Continue

EXPECT_CALL(*encoder_filters_[1], encode1xxHeaders(_))

.WillOnce(Return(Filter1xxHeadersStatus::StopIteration));

EXPECT_CALL(*encoder_filters_[0], encode1xxHeaders(_)).Times(0);

EXPECT_CALL(response_encoder_, encode1xxHeaders(_)).Times(0);

ResponseHeaderMapPtr continue_headers{new TestResponseHeaderMapImpl{{":status", "100"}}};

decoder_filters_[1]->callbacks_->encode1xxHeaders(std::move(continue_headers));

// Have the encoder filter 1 continue. Make sure the 100-Continue is resumed as expected.

EXPECT_CALL(*encoder_filters_[0], encode1xxHeaders(_))

.WillOnce(Return(Filter1xxHeadersStatus::Continue));

EXPECT_CALL(response_encoder_, encode1xxHeaders(_));

encoder_filters_[1]->callbacks_->continueEncoding();

EXPECT_CALL(*encoder_filters_[1], encodeHeaders(_, false))

.WillOnce(Return(FilterHeadersStatus::Continue));

EXPECT_CALL(*encoder_filters_[0], encodeHeaders(_, false))

.WillOnce(Return(FilterHeadersStatus::Continue));

EXPECT_CALL(response_encoder_, encodeHeaders(_, false));

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

decoder_filters_[1]->callbacks_->streamInfo().setResponseCodeDetails("");

decoder_filters_[1]->callbacks_->encodeHeaders(std::move(response_headers), false, "details");

doRemoteClose();

}

// Regression test for https://github.com/envoyproxy/envoy/issues/10923.

TEST_F(HttpConnectionManagerImplTest, 1xxResponseWithDecoderPause) {

proxy_100_continue_ = true;

setup(SetupOpts().setTracing(false));

std::shared_ptr<MockStreamDecoderFilter> filter(new NiceMock<MockStreamDecoderFilter>());

// Allow headers to pass.

EXPECT_CALL(*filter, decodeHeaders(_, false))

.WillRepeatedly(

InvokeWithoutArgs([]() -> FilterHeadersStatus { return FilterHeadersStatus::Continue; }));

// Pause and then resume the decode pipeline, this is key to triggering #10923.

EXPECT_CALL(*filter, decodeData(_, false)).WillOnce(InvokeWithoutArgs([]() -> FilterDataStatus {

return FilterDataStatus::StopIterationAndBuffer;

}));

EXPECT_CALL(*filter, decodeData(_, true))

.WillRepeatedly(

InvokeWithoutArgs([]() -> FilterDataStatus { return FilterDataStatus::Continue; }));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_));

EXPECT_CALL(filter_factory_, createFilterChain(_))

.WillRepeatedly(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createDecoderFilterFactoryCb(filter);

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(filter_callbacks_.connection_.dispatcher_, deferredDelete_(_));

EXPECT_CALL(*codec_, dispatch(_))

.WillRepeatedly(Invoke([&](Buffer::Instance& data) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

// Test not charging stats on the second call.

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "/"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), false);

// Allow the decode pipeline to pause.

decoder_->decodeData(data, false);

ResponseHeaderMapPtr continue_headers{new TestResponseHeaderMapImpl{{":status", "100"}}};

filter->callbacks_->encode1xxHeaders(std::move(continue_headers));

// Resume decode pipeline after encoding 100 continue headers, we're now

// ready to trigger #10923.

decoder_->decodeData(data, true);

ResponseHeaderMapPtr response_headers{new TestResponseHeaderMapImpl{{":status", "200"}}};

filter->callbacks_->streamInfo().setResponseCodeDetails("");

filter->callbacks_->encodeHeaders(std::move(response_headers), true, "details");

data.drain(4);

return Http::okStatus();

}));

// Kick off the incoming data.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

EXPECT_EQ(1U, stats_.named_.downstream_rq_1xx_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_1xx_.value());

EXPECT_EQ(1U, stats_.named_.downstream_rq_2xx_.value());

EXPECT_EQ(1U, listener_stats_.downstream_rq_2xx_.value());

EXPECT_EQ(2U, stats_.named_.downstream_rq_completed_.value());

EXPECT_EQ(2U, listener_stats_.downstream_rq_completed_.value());

}

// When create new stream, the stream info will be populated from the connection.

TEST_F(HttpConnectionManagerImplTest, PopulateStreamInfo) {

setup(SetupOpts().setSsl(true).setTracing(false));

// Set up the codec.

Buffer::OwnedImpl fake_input("input");

conn_manager_->createCodec(fake_input);

startRequest(false);

EXPECT_NE(absl::nullopt, decoder_->streamInfo().getStreamIdProvider());

EXPECT_NE(absl::nullopt, decoder_->streamInfo().getStreamIdProvider()->toInteger());

EXPECT_NE(absl::nullopt, decoder_->streamInfo().getStreamIdProvider()->toStringView());

EXPECT_EQ(ssl_connection_, decoder_->streamInfo().downstreamAddressProvider().sslConnection());

EXPECT_EQ(filter_callbacks_.connection_.id_,

decoder_->streamInfo().downstreamAddressProvider().connectionID().value());

EXPECT_EQ(server_name_, decoder_->streamInfo().downstreamAddressProvider().requestedServerName());

EXPECT_TRUE(decoder_->streamInfo().filterState()->hasDataWithName(

Network::ProxyProtocolFilterState::key()));

const auto& proxy_proto_data = decoder_->streamInfo()

.filterState()

->getDataReadOnly<Network::ProxyProtocolFilterState>(

Network::ProxyProtocolFilterState::key())

->value();

EXPECT_EQ(proxy_proto_data.version_, absl::nullopt);

// Clean up.

filter_callbacks_.connection_.raiseEvent(Network::ConnectionEvent::RemoteClose);

}

// By default, Envoy will set the server header to the server name, here "custom-value"

TEST_F(HttpConnectionManagerImplTest, ServerHeaderOverwritten) {

setup(SetupOpts().setServerName("custom-value").setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

const ResponseHeaderMap* altered_headers = sendResponseHeaders(

ResponseHeaderMapPtr{new TestResponseHeaderMapImpl{{":status", "200"}, {"server", "foo"}}});

EXPECT_EQ("custom-value", altered_headers->getServerValue());

doRemoteClose();

}

// When configured APPEND_IF_ABSENT if the server header is present it will be retained.

TEST_F(HttpConnectionManagerImplTest, ServerHeaderAppendPresent) {

server_transformation_ = HttpConnectionManagerProto::APPEND_IF_ABSENT;

setup(SetupOpts().setServerName("custom-value").setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

const ResponseHeaderMap* altered_headers = sendResponseHeaders(

ResponseHeaderMapPtr{new TestResponseHeaderMapImpl{{":status", "200"}, {"server", "foo"}}});

EXPECT_EQ("foo", altered_headers->getServerValue());

doRemoteClose();

}

// When configured APPEND_IF_ABSENT if the server header is absent the server name will be set.

TEST_F(HttpConnectionManagerImplTest, ServerHeaderAppendAbsent) {

server_transformation_ = HttpConnectionManagerProto::APPEND_IF_ABSENT;

setup(SetupOpts().setServerName("custom-value").setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

const ResponseHeaderMap* altered_headers =

sendResponseHeaders(ResponseHeaderMapPtr{new TestResponseHeaderMapImpl{{":status", "200"}}});

EXPECT_EQ("custom-value", altered_headers->getServerValue());

doRemoteClose();

}

// When configured PASS_THROUGH, the server name will pass through.

TEST_F(HttpConnectionManagerImplTest, ServerHeaderPassthroughPresent) {

server_transformation_ = HttpConnectionManagerProto::PASS_THROUGH;

setup(SetupOpts().setServerName("custom-value").setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

const ResponseHeaderMap* altered_headers = sendResponseHeaders(

ResponseHeaderMapPtr{new TestResponseHeaderMapImpl{{":status", "200"}, {"server", "foo"}}});

EXPECT_EQ("foo", altered_headers->getServerValue());

doRemoteClose();

}

// When configured PASS_THROUGH, the server header will not be added if absent.

TEST_F(HttpConnectionManagerImplTest, ServerHeaderPassthroughAbsent) {

server_transformation_ = HttpConnectionManagerProto::PASS_THROUGH;

setup(SetupOpts().setServerName("custom-value").setTracing(false));

setUpEncoderAndDecoder(false, false);

sendRequestHeadersAndData();

const ResponseHeaderMap* altered_headers =

sendResponseHeaders(ResponseHeaderMapPtr{new TestResponseHeaderMapImpl{{":status", "200"}}});

EXPECT_TRUE(altered_headers->Server() == nullptr);

doRemoteClose();

}

TEST_F(HttpConnectionManagerImplTest, InvalidPathWithDualFilter) {

InSequence s;

setup();

EXPECT_CALL(*codec_, dispatch(_)).WillOnce(Invoke([&](Buffer::Instance& data) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", "http://api.lyft.com/"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

data.drain(4);

return Http::okStatus();

}));

// This test also verifies that decoder/encoder filters have onDestroy() called only once.

auto* filter = new MockStreamFilter();

EXPECT_CALL(filter_factory_, createFilterChain(_))

.WillOnce(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createStreamFilterFactoryCb(StreamFilterSharedPtr{filter});

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_));

EXPECT_CALL(*filter, setEncoderFilterCallbacks(_));

EXPECT_CALL(*filter, encodeHeaders(_, true));

EXPECT_CALL(*filter, encodeComplete());

EXPECT_CALL(response_encoder_, encodeHeaders(_, true))

.WillOnce(Invoke([&](const ResponseHeaderMap& headers, bool) -> void {

EXPECT_EQ("404", headers.getStatusValue());

EXPECT_EQ("absolute_path_rejected",

filter->decoder_callbacks_->streamInfo().responseCodeDetails().value());

}));

EXPECT_CALL(*filter, onStreamComplete());

EXPECT_CALL(*filter, onDestroy());

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

}

// Invalid paths are rejected with 400.

TEST_F(HttpConnectionManagerImplTest, PathFailedtoSanitize) {

setup();

// Enable path sanitizer

normalize_path_ = true;

EXPECT_CALL(*codec_, dispatch(_)).WillOnce(Invoke([&](Buffer::Instance& data) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"},

{":path", "/ab%00c"}, // "%00" is not valid in path according to RFC

{":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

data.drain(4);

return Http::okStatus();

}));

#ifdef ENVOY_ENABLE_UHV

expectCheckWithDefaultUhv();

#endif

EXPECT_CALL(response_encoder_, streamErrorOnInvalidHttpMessage()).WillRepeatedly(Return(true));

// This test also verifies that decoder/encoder filters have onDestroy() called only once.

auto* filter = new MockStreamFilter();

EXPECT_CALL(filter_factory_, createFilterChain(_))

.WillOnce(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createStreamFilterFactoryCb(StreamFilterSharedPtr{filter});

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_));

EXPECT_CALL(*filter, setEncoderFilterCallbacks(_));

EXPECT_CALL(*filter, encodeHeaders(_, true));

EXPECT_CALL(*filter, encodeComplete());

EXPECT_CALL(response_encoder_, encodeHeaders(_, true))

.WillOnce(Invoke([&](const ResponseHeaderMap& headers, bool) -> void {

EXPECT_EQ("400", headers.getStatusValue());

// Error details are different in UHV and legacy modes

EXPECT_THAT(filter->decoder_callbacks_->streamInfo().responseCodeDetails().value(),

HasSubstr("path"));

}));

EXPECT_CALL(*filter, onStreamComplete());

EXPECT_CALL(*filter, onDestroy());

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

}

// Filters observe normalized paths, not the original path, when path

// normalization is configured.

TEST_F(HttpConnectionManagerImplTest, FilterShouldUseSantizedPath) {

setup();

// Enable path sanitizer

normalize_path_ = true;

const std::string original_path = "/x/%2E%2e/z";

const std::string normalized_path = "/z";

#ifdef ENVOY_ENABLE_UHV

expectCheckWithDefaultUhv();

#endif

auto* filter = new MockStreamFilter();

EXPECT_CALL(filter_factory_, createFilterChain(_))

.WillOnce(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createDecoderFilterFactoryCb(StreamDecoderFilterSharedPtr{filter});

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(*filter, decodeComplete());

EXPECT_CALL(*filter, decodeHeaders(_, true))

.WillRepeatedly(Invoke([&](RequestHeaderMap& header_map, bool) -> FilterHeadersStatus {

EXPECT_EQ(normalized_path, header_map.getPathValue());

return FilterHeadersStatus::StopIteration;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_));

EXPECT_CALL(*codec_, dispatch(_)).WillOnce(Invoke([&](Buffer::Instance&) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", original_path}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

return Http::okStatus();

}));

// Kick off the incoming data.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

EXPECT_CALL(*filter, onStreamComplete());

EXPECT_CALL(*filter, onDestroy());

filter_callbacks_.connection_.raiseEvent(Network::ConnectionEvent::RemoteClose);

}

// The router observes normalized paths, not the original path, when path

// normalization is configured.

TEST_F(HttpConnectionManagerImplTest, RouteShouldUseSantizedPath) {

setup();

// Enable path sanitizer

normalize_path_ = true;

const std::string original_path = "/x/%2E%2e/z";

const std::string normalized_path = "/z";

#ifdef ENVOY_ENABLE_UHV

expectCheckWithDefaultUhv();

#endif

EXPECT_CALL(*codec_, dispatch(_)).WillOnce(Invoke([&](Buffer::Instance&) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", original_path}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

return Http::okStatus();

}));

const std::string fake_cluster_name = "fake_cluster";

std::shared_ptr<Upstream::MockThreadLocalCluster> fake_cluster =

std::make_shared<NiceMock<Upstream::MockThreadLocalCluster>>();

std::shared_ptr<Router::MockRoute> route = std::make_shared<NiceMock<Router::MockRoute>>();

EXPECT_CALL(route->route_entry_, clusterName()).WillRepeatedly(ReturnRef(fake_cluster_name));

EXPECT_CALL(*route_config_provider_.route_config_, route(_, _, _, _))

.WillOnce(Invoke([&](const Router::RouteCallback&, const Http::RequestHeaderMap& header_map,

const StreamInfo::StreamInfo&, uint64_t) {

EXPECT_EQ(normalized_path, header_map.getPathValue());

return Router::VirtualHostRoute{route->virtual_host_, route};

}));

EXPECT_CALL(filter_factory_, createFilterChain(_))

.WillOnce(Invoke([&](FilterChainFactoryCallbacks&) -> bool { return false; }));

// Kick off the incoming data.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

// Clean up.

filter_callbacks_.connection_.raiseEvent(Network::ConnectionEvent::RemoteClose);

}

// Paths with escaped slashes rejected with 400 when configured.

TEST_F(HttpConnectionManagerImplTest, PathWithEscapedSlashesRejected) {

path_with_escaped_slashes_action_ = envoy::extensions::filters::network::http_connection_manager::

v3::HttpConnectionManager::REJECT_REQUEST;

testPathNormalization(

TestRequestHeaderMapImpl{{":authority", "host"}, {":path", "/abc%5c../"}, {":method", "GET"}},

TestResponseHeaderMapImpl{{":status", "400"}, {"connection", "close"}});

EXPECT_EQ(1U, stats_.named_.downstream_rq_failed_path_normalization_.value());

}

// Paths with escaped slashes redirected when configured.

TEST_F(HttpConnectionManagerImplTest, PathWithEscapedSlashesRedirected) {

path_with_escaped_slashes_action_ = envoy::extensions::filters::network::http_connection_manager::

v3::HttpConnectionManager::UNESCAPE_AND_REDIRECT;

testPathNormalization(

TestRequestHeaderMapImpl{{":authority", "host"}, {":path", "/abc%2f../"}, {":method", "GET"}},

TestResponseHeaderMapImpl{{":status", "307"}, {"location", "/abc/../"}});

EXPECT_EQ(1U, stats_.named_.downstream_rq_redirected_with_normalized_path_.value());

}

// Paths with escaped slashes rejected with 400 instead of redirected for gRPC request.

TEST_F(HttpConnectionManagerImplTest, PathWithEscapedSlashesRejectedIfGRPC) {

// This test is slightly weird as it sends gRPC "request" over H/1 client of the

// HttpConnectionManagerImplTest. However it is sufficient to test the behavior of path

// normalization as it is determined by the content type only.

path_with_escaped_slashes_action_ = envoy::extensions::filters::network::http_connection_manager::

v3::HttpConnectionManager::UNESCAPE_AND_REDIRECT;

testPathNormalization(TestRequestHeaderMapImpl{{":authority", "host"},

{":path", "/abc%2fdef"},

{":method", "GET"},

{"content-type", "application/grpc"}},

TestResponseHeaderMapImpl{{":status", "200"},

{"connection", "close"},

{"grpc-status", "13"},

{"content-type", "application/grpc"}});

EXPECT_EQ(1U, stats_.named_.downstream_rq_failed_path_normalization_.value());

}

// Test that requests with escaped slashes are redirected when configured. Redirection

// occurs after Chromium URL normalization or merge slashes operations.

TEST_F(HttpConnectionManagerImplTest, EscapedSlashesRedirectedAfterOtherNormalizations) {

normalize_path_ = true;

merge_slashes_ = true;

path_with_escaped_slashes_action_ = envoy::extensions::filters::network::http_connection_manager::

v3::HttpConnectionManager::UNESCAPE_AND_REDIRECT;

// Both Chromium URL normalization and merge slashes should happen if request is redirected

// due to escaped slash sequences.

testPathNormalization(TestRequestHeaderMapImpl{{":authority", "host"},

{":path", "/abc%2f../%5cdef//"},

{":method", "GET"}},

TestResponseHeaderMapImpl{{":status", "307"}, {"location", "/def/"}});

EXPECT_EQ(1U, stats_.named_.downstream_rq_redirected_with_normalized_path_.value());

}

TEST_F(HttpConnectionManagerImplTest, AllNormalizationsWithEscapedSlashesForwarded) {

setup();

// Enable path sanitizer

normalize_path_ = true;

merge_slashes_ = true;

path_with_escaped_slashes_action_ = envoy::extensions::filters::network::http_connection_manager::

v3::HttpConnectionManager::UNESCAPE_AND_FORWARD;

const std::string original_path = "/x/%2E%2e/z%2f%2Fabc%5C../def";

const std::string normalized_path = "/z/def";

#ifdef ENVOY_ENABLE_UHV

expectCheckWithDefaultUhv();

#endif

auto* filter = new MockStreamFilter();

EXPECT_CALL(filter_factory_, createFilterChain(_))

.WillOnce(Invoke([&](FilterChainFactoryCallbacks& callbacks) -> bool {

auto factory = createDecoderFilterFactoryCb(StreamDecoderFilterSharedPtr{filter});

callbacks.setFilterConfigName("");

factory(callbacks);

return true;

}));

EXPECT_CALL(*filter, decodeComplete());

EXPECT_CALL(*filter, decodeHeaders(_, true))

.WillRepeatedly(Invoke([&](RequestHeaderMap& header_map, bool) -> FilterHeadersStatus {

EXPECT_EQ(normalized_path, header_map.getPathValue());

return FilterHeadersStatus::StopIteration;

}));

EXPECT_CALL(*filter, setDecoderFilterCallbacks(_));

EXPECT_CALL(*codec_, dispatch(_)).WillOnce(Invoke([&](Buffer::Instance&) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{

{":authority", "host"}, {":path", original_path}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

return Http::okStatus();

}));

// Kick off the incoming data.

Buffer::OwnedImpl fake_input("1234");

conn_manager_->onData(fake_input, false);

EXPECT_CALL(*filter, onStreamComplete());

EXPECT_CALL(*filter, onDestroy());

filter_callbacks_.connection_.raiseEvent(Network::ConnectionEvent::RemoteClose);

}

TEST_F(HttpConnectionManagerImplTest, RouteOverride) {

setup();

EXPECT_CALL(*codec_, dispatch(_)).WillOnce(Invoke([&](Buffer::Instance&) -> Http::Status {

decoder_ = &conn_manager_->newStream(response_encoder_);

RequestHeaderMapPtr headers{

new TestRequestHeaderMapImpl{{":authority", "host"}, {":path", "/"}, {":method", "GET"}}};

decoder_->decodeHeaders(std::move(headers), true);

return Http::okStatus();

}));

setupFilterChain(2, 0);

const std::string foo_bar_baz_cluster_name = "foo_bar_baz";

const std::string foo_bar_cluster_name = "foo_bar";

const std::string foo_cluster_name = "foo";

const std::string default_cluster_name = "default";

std::shared_ptr<Upstream::MockThreadLocalCluster> foo_bar_baz_cluster =

std::make_shared<NiceMock<Upstream::MockThreadLocalCluster>>();

std::shared_ptr<Upstream::MockThreadLocalCluster> foo_bar_cluster =

std::make_shared<NiceMock<Upstream::MockThreadLocalCluster>>();

EXPECT_CALL(cluster_manager_, getThreadLocalCluster(absl::string_view{foo_bar_cluster_name}))

.WillOnce(Return(foo_bar_cluster.get()));

std::shared_ptr<Upstream::MockThreadLocalCluster> foo_cluster =

std::make_shared<NiceMock<Upstream::MockThreadLocalCluster>>();

std::shared_ptr<Upstream::MockThreadLocalCluster> default_cluster =

std::make_shared<NiceMock<Upstream::MockThreadLocalCluster>>();

EXPECT_CALL(cluster_manager_, getThreadLocalCluster(absl::string_view{default_cluster_name}))

.Times(2)

.WillRepeatedly(Return(default_cluster.get()));

std::shared_ptr<Router::MockRoute> foo_bar_baz_route =

std::make_shared<NiceMock<Router::MockRoute>>();

std::shared_ptr<Router::MockRoute> foo_bar_route =

std::make_shared<NiceMock<Router::MockRoute>>();

EXPECT_CALL(foo_bar_route->route_entry_, clusterName()).WillOnce(ReturnRef(foo_bar_cluster_name));

std::shared_ptr<Router::MockRoute> foo_route = std::make_shared<NiceMock<Router::MockRoute>>();

std::shared_ptr<Router::MockRoute> default_route =

std::make_shared<NiceMock<Router::MockRoute>>();

EXPECT_CALL(default_route->route_entry_, clusterName())

.Times(2)

.WillRepeatedly(ReturnRef(default_cluster_name));

using ::testing::InSequence;

{

InSequence seq;

EXPECT_CALL(*route_config_provider_.route_config_, route(_, _, _, _))

.WillOnce(Return(Router::VirtualHostRoute{default_route->virtual_host_, default_route}));

// This filter iterates through all possible route matches and choose the last matched route

EXPECT_CALL(*decoder_filters_[0], decodeHeaders(_, true))

.WillOnce(InvokeWithoutArgs([&]() -> FilterHeadersStatus {

EXPECT_EQ(default_route.get(), decoder_filters_[0]->callbacks_->route().ptr());

EXPECT_EQ(default_cluster->info().get(),

decoder_filters_[0]->callbacks_->clusterInfo().ptr());

EXPECT_EQ(default_route.get(),

decoder_filters_[0]->callbacks_->streamInfo().route().ptr());

EXPECT_EQ(default_route->virtual_host_.get(),

decoder_filters_[0]->callbacks_->streamInfo().virtualHost().ptr());

// Not clearing cached route returns cached route and doesn't invoke cb.

Router::RouteConstSharedPtr route =

decoder_filters_[0]->callbacks_->downstreamCallbacks()->routeSharedPtr(

[](Router::RouteConstSharedPtr,

Router::RouteEvalStatus) -> Router::RouteMatchStatus {

ADD_FAILURE() << "When route cache is not cleared CB should not be invoked";

return Router::RouteMatchStatus::Accept;

});

EXPECT_EQ(default_route, route);

int ctr = 0;

const Router::RouteCallback& cb =

[&](Router::RouteConstSharedPtr route,

Router::RouteEvalStatus route_eval_status) -> Router::RouteMatchStatus {

EXPECT_LE(ctr, 3);

if (ctr == 0) {

++ctr;

EXPECT_EQ(foo_bar_baz_route, route);

EXPECT_EQ(route_eval_status, Router::RouteEvalStatus::HasMoreRoutes);

return Router::RouteMatchStatus::Continue;

}

if (ctr == 1) {

++ctr;

EXPECT_EQ(foo_bar_route, route);

EXPECT_EQ(route_eval_status, Router::RouteEvalStatus::HasMoreRoutes);

return Router::RouteMatchStatus::Continue;

}

if (ctr == 2) {

++ctr;

EXPECT_EQ(foo_route, route);

EXPECT_EQ(route_eval_status, Router::RouteEvalStatus::HasMoreRoutes);

return Router::RouteMatchStatus::Continue;

}

if (ctr == 3) {

++ctr;

EXPECT_EQ(default_route, route);

EXPECT_EQ(route_eval_status, Router::RouteEvalStatus::NoMoreRoutes);

return Router::RouteMatchStatus::Accept;

}

return Router::RouteMatchStatus::Accept;

};

decoder_filters_[0]->callbacks_->downstreamCallbacks()->clearRouteCache();

route = decoder_filters_[0]->callbacks_->downstreamCallbacks()->routeSharedPtr(cb);

EXPECT_EQ(default_route, route);

EXPECT_EQ(default_route.get(), decoder_filters_[0]->callbacks_->route().ptr());

EXPECT_EQ(default_cluster->info().get(),

decoder_filters_[0]->callbacks_->clusterInfo().ptr());

EXPECT_EQ(default_route.get(),

decoder_filters_[0]->callbacks_->streamInfo().route().ptr());

EXPECT_EQ(default_route->virtual_host_.get(),

decoder_filters_[0]->callbacks_->streamInfo().virtualHost().ptr());

return FilterHeadersStatus::Continue;

}));

// This route config expected to be invoked for all matching routes

EXPECT_CALL(*route_config_provider_.route_config_, route(_, _, _, _))

.WillOnce(

Invoke([&](const Router::RouteCallback& cb, const Http::RequestHeaderMap&,

const Envoy::StreamInfo::StreamInfo&, uint64_t) -> Router::VirtualHostRoute {

EXPECT_EQ(cb(foo_bar_baz_route, Router::RouteEvalStatus::HasMoreRoutes),