Function parse_http_request

crates/openshell-supervisor-network/src/l7/rest.rs:138–246

Parse one HTTP/1.1 request from the stream. Reads one byte at a time to stop exactly at the `\r\n\r\n` header terminator. A multi-byte read could consume bytes belonging to a subsequent pipelined request, and those overflow bytes would be forwarded upstream without L7 policy evaluation -- a request smuggling vulnerability. Byte-at-a-time overhead is negligible for the typical 200-800 byte heade

(
    client: &mut C,
    canonicalize_options: &crate::l7::path::CanonicalizeOptions,
)

/// smuggling vulnerability.  Byte-at-a-time overhead is negligible for
/// the typical 200-800 byte headers on L7-inspected REST endpoints.
async fn parse_http_request<C: AsyncRead + Unpin>(
    client: &mut C,
    canonicalize_options: &crate::l7::path::CanonicalizeOptions,
) -> Result<Option<L7Request>> {
    let mut buf = Vec::with_capacity(4096);

    loop {
        if buf.len() > MAX_HEADER_BYTES {
            return Err(miette!(
                "HTTP request headers exceed {MAX_HEADER_BYTES} bytes"
            ));
        }

        let byte = match client.read_u8().await {
            Ok(b) => b,
            Err(e) if buf.is_empty() && is_benign_close(&e) => return Ok(None),
            Err(e) if buf.is_empty() && e.kind() == std::io::ErrorKind::UnexpectedEof => {
                return Ok(None); // Clean close before any data
            }
            Err(e) => return Err(miette::miette!("{e}")),
        };
        buf.push(byte);

        // Check for end of headers -- `ends_with` is sufficient because
        // we append exactly one byte per iteration.
        if buf.ends_with(b"\r\n\r\n") {
            break;
        }
    }

    // Parse request line
    let header_end = buf.windows(4).position(|w| w == b"\r\n\r\n").unwrap() + 4;

    // Reject bare LF in headers (must use \r\n line endings per RFC 7230).
    // Bare LF can cause parsing discrepancies between this proxy and upstream
    // servers, enabling request smuggling via header injection.
    for i in 0..header_end {
        if buf[i] == b'\n' && (i == 0 || buf[i - 1] != b'\r') {
            return Err(miette!(
                "HTTP headers contain bare LF (line feed without carriage return)"
            ));
        }
    }

    // Strict UTF-8 validation. from_utf8_lossy would silently replace invalid
    // bytes with U+FFFD, creating an interpretation gap between this proxy
    // (which parses the lossy string) and upstream servers (which receive the
    // raw bytes). This gap enables request smuggling via mutated header names.
    let header_str = std::str::from_utf8(&buf[..header_end])
        .map_err(|_| miette!("HTTP headers contain invalid UTF-8"))?;

    let request_line = header_str
        .lines()
        .next()
        .ok_or_else(|| miette!("Empty HTTP request"))?;

    let mut parts = request_line.split_whitespace();
    let method = parts