TUN-3863: Consolidate header handling logic in the connection package; move headers definitions from h2mux to packages that manage them; cleanup header conversions

All header transformation code from h2mux has been consolidated in the connection package since it's used by both h2mux and http2 logic.
Exported headers used by proxying between edge and cloudflared so then can be shared by tunnel service on the edge.
Moved access-related headers to corresponding packages that have the code that sets/uses these headers.
Removed tunnel hostname tracking from h2mux since it wasn't used by anything. We will continue to set the tunnel hostname header from the edge for backward compatibilty, but it's no longer used by cloudflared.
Move bastion-related logic into carrier package, untangled dependencies between carrier, origin, and websocket packages.

h2mux/header.go

@@ -1,234 +0,0 @@
-package h2mux
-
-import (
-	"encoding/base64"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-
-	"github.com/pkg/errors"
-)
-
-type Header struct {
-	Name, Value string
-}
-
-var headerEncoding = base64.RawStdEncoding
-
-const (
-	RequestUserHeadersField  = "cf-cloudflared-request-headers"
-	ResponseUserHeadersField = "cf-cloudflared-response-headers"
-
-	CFAccessTokenHeader        = "cf-access-token"
-	CFJumpDestinationHeader    = "CF-Access-Jump-Destination"
-	CFAccessClientIDHeader     = "CF-Access-Client-Id"
-	CFAccessClientSecretHeader = "CF-Access-Client-Secret"
-)
-
-// H2RequestHeadersToH1Request converts the HTTP/2 headers coming from origintunneld
-// to an HTTP/1 Request object destined for the local origin web service.
-// This operation includes conversion of the pseudo-headers into their closest
-// HTTP/1 equivalents. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
-func H2RequestHeadersToH1Request(h2 []Header, h1 *http.Request) error {
-	for _, header := range h2 {
-		name := strings.ToLower(header.Name)
-		if !IsControlHeader(name) {
-			continue
-		}
-
-		switch name {
-		case ":method":
-			h1.Method = header.Value
-		case ":scheme":
-			// noop - use the preexisting scheme from h1.URL
-		case ":authority":
-			// Otherwise the host header will be based on the origin URL
-			h1.Host = header.Value
-		case ":path":
-			// We don't want to be an "opinionated" proxy, so ideally we would use :path as-is.
-			// However, this HTTP/1 Request object belongs to the Go standard library,
-			// whose URL package makes some opinionated decisions about the encoding of
-			// URL characters: see the docs of https://godoc.org/net/url#URL,
-			// in particular the EscapedPath method https://godoc.org/net/url#URL.EscapedPath,
-			// which is always used when computing url.URL.String(), whether we'd like it or not.
-			//
-			// Well, not *always*. We could circumvent this by using url.URL.Opaque. But
-			// that would present unusual difficulties when using an HTTP proxy: url.URL.Opaque
-			// is treated differently when HTTP_PROXY is set!
-			// See https://github.com/golang/go/issues/5684#issuecomment-66080888
-			//
-			// This means we are subject to the behavior of net/url's function `shouldEscape`
-			// (as invoked with mode=encodePath): https://github.com/golang/go/blob/go1.12.7/src/net/url/url.go#L101
-
-			if header.Value == "*" {
-				h1.URL.Path = "*"
-				continue
-			}
-			// Due to the behavior of validation.ValidateUrl, h1.URL may
-			// already have a partial value, with or without a trailing slash.
-			base := h1.URL.String()
-			base = strings.TrimRight(base, "/")
-			// But we know :path begins with '/', because we handled '*' above - see RFC7540
-			requestURL, err := url.Parse(base + header.Value)
-			if err != nil {
-				return errors.Wrap(err, fmt.Sprintf("invalid path '%v'", header.Value))
-			}
-			h1.URL = requestURL
-		case "content-length":
-			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
-			if err != nil {
-				return fmt.Errorf("unparseable content length")
-			}
-			h1.ContentLength = contentLength
-		case RequestUserHeadersField:
-			// Do not forward the serialized headers to the origin -- deserialize them, and ditch the serialized version
-			// Find and parse user headers serialized into a single one
-			userHeaders, err := ParseUserHeaders(RequestUserHeadersField, h2)
-			if err != nil {
-				return errors.Wrap(err, "Unable to parse user headers")
-			}
-			for _, userHeader := range userHeaders {
-				h1.Header.Add(http.CanonicalHeaderKey(userHeader.Name), userHeader.Value)
-			}
-		default:
-			// All other control headers shall just be proxied transparently
-			h1.Header.Add(http.CanonicalHeaderKey(header.Name), header.Value)
-		}
-	}
-
-	return nil
-}
-
-func ParseUserHeaders(headerNameToParseFrom string, headers []Header) ([]Header, error) {
-	for _, header := range headers {
-		if header.Name == headerNameToParseFrom {
-			return DeserializeHeaders(header.Value)
-		}
-	}
-
-	return nil, fmt.Errorf("%v header not found", RequestUserHeadersField)
-}
-
-func IsControlHeader(headerName string) bool {
-	return headerName == "content-length" ||
-		headerName == "connection" || headerName == "upgrade" || // Websocket headers
-		strings.HasPrefix(headerName, ":") ||
-		strings.HasPrefix(headerName, "cf-")
-}
-
-// isWebsocketClientHeader returns true if the header name is required by the client to upgrade properly
-func IsWebsocketClientHeader(headerName string) bool {
-	return headerName == "sec-websocket-accept" ||
-		headerName == "connection" ||
-		headerName == "upgrade"
-}
-
-func H1ResponseToH2ResponseHeaders(status int, h1 http.Header) (h2 []Header) {
-	h2 = []Header{
-		{Name: ":status", Value: strconv.Itoa(status)},
-	}
-	userHeaders := make(http.Header, len(h1))
-	for header, values := range h1 {
-		h2name := strings.ToLower(header)
-		if h2name == "content-length" {
-			// This header has meaning in HTTP/2 and will be used by the edge,
-			// so it should be sent as an HTTP/2 response header.
-
-			// Since these are http2 headers, they're required to be lowercase
-			h2 = append(h2, Header{Name: "content-length", Value: values[0]})
-		} else if !IsControlHeader(h2name) || IsWebsocketClientHeader(h2name) {
-			// User headers, on the other hand, must all be serialized so that
-			// HTTP/2 header validation won't be applied to HTTP/1 header values
-			userHeaders[header] = values
-		}
-	}
-
-	// Perform user header serialization and set them in the single header
-	h2 = append(h2, Header{ResponseUserHeadersField, SerializeHeaders(userHeaders)})
-	return h2
-}
-
-// Serialize HTTP1.x headers by base64-encoding each header name and value,
-// and then joining them in the format of [key:value;]
-func SerializeHeaders(h1Headers http.Header) string {
-	// compute size of the fully serialized value and largest temp buffer we will need
-	serializedLen := 0
-	maxTempLen := 0
-	for headerName, headerValues := range h1Headers {
-		for _, headerValue := range headerValues {
-			nameLen := headerEncoding.EncodedLen(len(headerName))
-			valueLen := headerEncoding.EncodedLen(len(headerValue))
-			const delims = 2
-			serializedLen += delims + nameLen + valueLen
-			if nameLen > maxTempLen {
-				maxTempLen = nameLen
-			}
-			if valueLen > maxTempLen {
-				maxTempLen = valueLen
-			}
-		}
-	}
-	var buf strings.Builder
-	buf.Grow(serializedLen)
-
-	temp := make([]byte, maxTempLen)
-	writeB64 := func(s string) {
-		n := headerEncoding.EncodedLen(len(s))
-		if n > len(temp) {
-			temp = make([]byte, n)
-		}
-		headerEncoding.Encode(temp[:n], []byte(s))
-		buf.Write(temp[:n])
-	}
-
-	for headerName, headerValues := range h1Headers {
-		for _, headerValue := range headerValues {
-			if buf.Len() > 0 {
-				buf.WriteByte(';')
-			}
-			writeB64(headerName)
-			buf.WriteByte(':')
-			writeB64(headerValue)
-		}
-	}
-
-	return buf.String()
-}
-
-// Deserialize headers serialized by `SerializeHeader`
-func DeserializeHeaders(serializedHeaders string) ([]Header, error) {
-	const unableToDeserializeErr = "Unable to deserialize headers"
-
-	var deserialized []Header
-	for _, serializedPair := range strings.Split(serializedHeaders, ";") {
-		if len(serializedPair) == 0 {
-			continue
-		}
-
-		serializedHeaderParts := strings.Split(serializedPair, ":")
-		if len(serializedHeaderParts) != 2 {
-			return nil, errors.New(unableToDeserializeErr)
-		}
-
-		serializedName := serializedHeaderParts[0]
-		serializedValue := serializedHeaderParts[1]
-		deserializedName := make([]byte, headerEncoding.DecodedLen(len(serializedName)))
-		deserializedValue := make([]byte, headerEncoding.DecodedLen(len(serializedValue)))
-
-		if _, err := headerEncoding.Decode(deserializedName, []byte(serializedName)); err != nil {
-			return nil, errors.Wrap(err, unableToDeserializeErr)
-		}
-		if _, err := headerEncoding.Decode(deserializedValue, []byte(serializedValue)); err != nil {
-			return nil, errors.Wrap(err, unableToDeserializeErr)
-		}
-
-		deserialized = append(deserialized, Header{
-			Name:  string(deserializedName),
-			Value: string(deserializedValue),
-		})
-	}
-
-	return deserialized, nil
-}

h2mux/header_test.go

@@ -1,674 +0,0 @@
-package h2mux
-
-import (
-	"fmt"
-	"math/rand"
-	"net/http"
-	"net/url"
-	"reflect"
-	"regexp"
-	"sort"
-	"strings"
-	"testing"
-	"testing/quick"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type ByName []Header
-
-func (a ByName) Len() int      { return len(a) }
-func (a ByName) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
-func (a ByName) Less(i, j int) bool {
-	if a[i].Name == a[j].Name {
-		return a[i].Value < a[j].Value
-	}
-
-	return a[i].Name < a[j].Name
-}
-
-func TestH2RequestHeadersToH1Request_RegularHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	mockHeaders := http.Header{
-		"Mock header 1": {"Mock value 1"},
-		"Mock header 2": {"Mock value 2"},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(createSerializedHeaders(RequestUserHeadersField, mockHeaders), request)
-
-	assert.True(t, reflect.DeepEqual(mockHeaders, request.Header))
-	assert.NoError(t, headersConversionErr)
-}
-
-func createSerializedHeaders(headersField string, headers http.Header) []Header {
-	return []Header{{
-		headersField,
-		SerializeHeaders(headers),
-	}}
-}
-
-func TestH2RequestHeadersToH1Request_NoHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	headersConversionErr := H2RequestHeadersToH1Request(
-		[]Header{{
-			RequestUserHeadersField,
-			SerializeHeaders(http.Header{}),
-		}},
-		request,
-	)
-
-	assert.True(t, reflect.DeepEqual(http.Header{}, request.Header))
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_InvalidHostPath(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []Header{
-		{Name: ":path", Value: "//bad_path/"},
-		{Name: RequestUserHeadersField, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com//bad_path/", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_HostPathWithQuery(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []Header{
-		{Name: ":path", Value: "/?query=mock%20value"},
-		{Name: RequestUserHeadersField, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com/?query=mock%20value", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_HostPathWithURLEncoding(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []Header{
-		{Name: ":path", Value: "/mock%20path"},
-		{Name: RequestUserHeadersField, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com/mock%20path", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_WeirdURLs(t *testing.T) {
-	type testCase struct {
-		path string
-		want string
-	}
-	testCases := []testCase{
-		{
-			path: "",
-			want: "",
-		},
-		{
-			path: "/",
-			want: "/",
-		},
-		{
-			path: "//",
-			want: "//",
-		},
-		{
-			path: "/test",
-			want: "/test",
-		},
-		{
-			path: "//test",
-			want: "//test",
-		},
-		{
-			// https://github.com/cloudflare/cloudflared/issues/81
-			path: "//test/",
-			want: "//test/",
-		},
-		{
-			path: "/%2Ftest",
-			want: "/%2Ftest",
-		},
-		{
-			path: "//%20test",
-			want: "//%20test",
-		},
-		{
-			// https://github.com/cloudflare/cloudflared/issues/124
-			path: "/test?get=somthing%20a",
-			want: "/test?get=somthing%20a",
-		},
-		{
-			path: "/%20",
-			want: "/%20",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode ' '
-			path: "/ ",
-			want: "/%20",
-		},
-		{
-			path: "/ a ",
-			want: "/%20a%20",
-		},
-		{
-			path: "/a%20b",
-			want: "/a%20b",
-		},
-		{
-			path: "/foo/bar;param?query#frag",
-			want: "/foo/bar;param?query#frag",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode non-ASCII chars
-			path: "/a␠b",
-			want: "/a%E2%90%A0b",
-		},
-		{
-			path: "/a-umlaut-ä",
-			want: "/a-umlaut-%C3%A4",
-		},
-		{
-			path: "/a-umlaut-%C3%A4",
-			want: "/a-umlaut-%C3%A4",
-		},
-		{
-			path: "/a-umlaut-%c3%a4",
-			want: "/a-umlaut-%c3%a4",
-		},
-		{
-			// here the second '#' is treated as part of the fragment
-			path: "/a#b#c",
-			want: "/a#b%23c",
-		},
-		{
-			path: "/a#b␠c",
-			want: "/a#b%E2%90%A0c",
-		},
-		{
-			path: "/a#b%20c",
-			want: "/a#b%20c",
-		},
-		{
-			path: "/a#b c",
-			want: "/a#b%20c",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode '\'
-			path: "/\\",
-			want: "/%5C",
-		},
-		{
-			path: "/a\\",
-			want: "/a%5C",
-		},
-		{
-			path: "/a,b.c.",
-			want: "/a,b.c.",
-		},
-		{
-			path: "/.",
-			want: "/.",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode '`'
-			path: "/a`",
-			want: "/a%60",
-		},
-		{
-			path: "/a[0]",
-			want: "/a[0]",
-		},
-		{
-			path: "/?a[0]=5 &b[]=",
-			want: "/?a[0]=5 &b[]=",
-		},
-		{
-			path: "/?a=%22b%20%22",
-			want: "/?a=%22b%20%22",
-		},
-	}
-
-	for index, testCase := range testCases {
-		requestURL := "https://example.com"
-
-		request, err := http.NewRequest(http.MethodGet, requestURL, nil)
-		assert.NoError(t, err)
-
-		mockRequestHeaders := []Header{
-			{Name: ":path", Value: testCase.path},
-			{Name: RequestUserHeadersField, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-		}
-
-		headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-		assert.NoError(t, headersConversionErr)
-
-		assert.Equal(t,
-			http.Header{
-				"Mock header": []string{"Mock value"},
-			},
-			request.Header)
-
-		assert.Equal(t,
-			"https://example.com"+testCase.want,
-			request.URL.String(),
-			"Failed URL index: %v %#v", index, testCase)
-	}
-}
-
-func TestH2RequestHeadersToH1Request_QuickCheck(t *testing.T) {
-	config := &quick.Config{
-		Values: func(args []reflect.Value, rand *rand.Rand) {
-			args[0] = reflect.ValueOf(randomHTTP2Path(t, rand))
-		},
-	}
-
-	type testOrigin struct {
-		url string
-
-		expectedScheme   string
-		expectedBasePath string
-	}
-	testOrigins := []testOrigin{
-		{
-			url:              "http://origin.hostname.example.com:8080",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/api",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080/api",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/api/",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080/api",
-		},
-		{
-			url:              "https://origin.hostname.example.com:8080/api",
-			expectedScheme:   "https",
-			expectedBasePath: "https://origin.hostname.example.com:8080/api",
-		},
-	}
-
-	// use multiple schemes to demonstrate that the URL is based on the
-	// origin's scheme, not the :scheme header
-	for _, testScheme := range []string{"http", "https"} {
-		for _, testOrigin := range testOrigins {
-			assertion := func(testPath string) bool {
-				const expectedMethod = "POST"
-				const expectedHostname = "request.hostname.example.com"
-
-				h2 := []Header{
-					{Name: ":method", Value: expectedMethod},
-					{Name: ":scheme", Value: testScheme},
-					{Name: ":authority", Value: expectedHostname},
-					{Name: ":path", Value: testPath},
-					{Name: RequestUserHeadersField, Value: ""},
-				}
-				h1, err := http.NewRequest("GET", testOrigin.url, nil)
-				require.NoError(t, err)
-
-				err = H2RequestHeadersToH1Request(h2, h1)
-				return assert.NoError(t, err) &&
-					assert.Equal(t, expectedMethod, h1.Method) &&
-					assert.Equal(t, expectedHostname, h1.Host) &&
-					assert.Equal(t, testOrigin.expectedScheme, h1.URL.Scheme) &&
-					assert.Equal(t, testOrigin.expectedBasePath+testPath, h1.URL.String())
-			}
-			err := quick.Check(assertion, config)
-			assert.NoError(t, err)
-		}
-	}
-}
-
-func randomASCIIPrintableChar(rand *rand.Rand) int {
-	// smallest printable ASCII char is 32, largest is 126
-	const startPrintable = 32
-	const endPrintable = 127
-	return startPrintable + rand.Intn(endPrintable-startPrintable)
-}
-
-// randomASCIIText generates an ASCII string, some of whose characters may be
-// percent-encoded. Its "logical length" (ignoring percent-encoding) is
-// between 1 and `maxLength`.
-func randomASCIIText(rand *rand.Rand, minLength int, maxLength int) string {
-	length := minLength + rand.Intn(maxLength)
-	var result strings.Builder
-	for i := 0; i < length; i++ {
-		c := randomASCIIPrintableChar(rand)
-
-		// 1/4 chance of using percent encoding when not necessary
-		if c == '%' || rand.Intn(4) == 0 {
-			result.WriteString(fmt.Sprintf("%%%02X", c))
-		} else {
-			result.WriteByte(byte(c))
-		}
-	}
-	return result.String()
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL path,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Path(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	re, err := regexp.Compile("[^/;,]*")
-	require.NoError(t, err)
-	return "/" + re.ReplaceAllStringFunc(text, url.PathEscape)
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL query,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Query(rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	return "?" + strings.ReplaceAll(text, "#", "%23")
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL fragment,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Fragment(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	u, err := url.Parse("#" + text)
-	require.NoError(t, err)
-	return u.String()
-}
-
-// Assemble a random :path pseudoheader that is legal by Go stdlib standards
-// (i.e. all characters will satisfy "net/url".shouldEscape for their respective locations)
-func randomHTTP2Path(t *testing.T, rand *rand.Rand) string {
-	result := randomHTTP1Path(t, rand, 1, 64)
-	if rand.Intn(2) == 1 {
-		result += randomHTTP1Query(rand, 1, 32)
-	}
-	if rand.Intn(2) == 1 {
-		result += randomHTTP1Fragment(t, rand, 1, 16)
-	}
-	return result
-}
-
-func stdlibHeaderToH2muxHeader(headers http.Header) (h2muxHeaders []Header) {
-	for name, values := range headers {
-		for _, value := range values {
-			h2muxHeaders = append(h2muxHeaders, Header{name, value})
-		}
-	}
-
-	return h2muxHeaders
-}
-
-func TestSerializeHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	mockHeaders := http.Header{
-		"Mock-Header-One":        {"Mock header one value", "three"},
-		"Mock-Header-Two-Long":   {"Mock header two value\nlong"},
-		":;":                     {":;", ";:"},
-		":":                      {":"},
-		";":                      {";"},
-		";;":                     {";;"},
-		"Empty values":           {"", ""},
-		"":                       {"Empty key"},
-		"control\tcharacter\b\n": {"value\n\b\t"},
-		";\v:":                   {":\v;"},
-	}
-
-	for header, values := range mockHeaders {
-		for _, value := range values {
-			// Note that Golang's http library is opinionated;
-			// at this point every header name will be title-cased in order to comply with the HTTP RFC
-			// This means our proxy is not completely transparent when it comes to proxying headers
-			request.Header.Add(header, value)
-		}
-	}
-
-	serializedHeaders := SerializeHeaders(request.Header)
-
-	// Sanity check: the headers serialized to something that's not an empty string
-	assert.NotEqual(t, "", serializedHeaders)
-
-	// Deserialize back, and ensure we get the same set of headers
-	deserializedHeaders, err := DeserializeHeaders(serializedHeaders)
-	assert.NoError(t, err)
-
-	assert.Equal(t, 13, len(deserializedHeaders))
-	h2muxExpectedHeaders := stdlibHeaderToH2muxHeader(mockHeaders)
-
-	sort.Sort(ByName(deserializedHeaders))
-	sort.Sort(ByName(h2muxExpectedHeaders))
-
-	assert.True(
-		t,
-		reflect.DeepEqual(h2muxExpectedHeaders, deserializedHeaders),
-		fmt.Sprintf("got = %#v, want = %#v\n", deserializedHeaders, h2muxExpectedHeaders),
-	)
-}
-
-func TestSerializeNoHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	serializedHeaders := SerializeHeaders(request.Header)
-	deserializedHeaders, err := DeserializeHeaders(serializedHeaders)
-	assert.NoError(t, err)
-	assert.Equal(t, 0, len(deserializedHeaders))
-}
-
-func TestDeserializeMalformed(t *testing.T) {
-	var err error
-
-	malformedData := []string{
-		"malformed data",
-		"bW9jawo=",                   // "mock"
-		"bW9jawo=:ZGF0YQo=:bW9jawo=", // "mock:data:mock"
-		"::",
-	}
-
-	for _, malformedValue := range malformedData {
-		_, err = DeserializeHeaders(malformedValue)
-		assert.Error(t, err)
-	}
-}
-
-func TestParseHeaders(t *testing.T) {
-	mockUserHeadersToSerialize := http.Header{
-		"Mock-Header-One":   {"1", "1.5"},
-		"Mock-Header-Two":   {"2"},
-		"Mock-Header-Three": {"3"},
-	}
-
-	mockHeaders := []Header{
-		{Name: "One", Value: "1"}, // will be dropped
-		{Name: "Cf-Two", Value: "cf-value-1"},
-		{Name: "Cf-Two", Value: "cf-value-2"},
-		{Name: RequestUserHeadersField, Value: SerializeHeaders(mockUserHeadersToSerialize)},
-	}
-
-	expectedHeaders := []Header{
-		{Name: "Cf-Two", Value: "cf-value-1"},
-		{Name: "Cf-Two", Value: "cf-value-2"},
-		{Name: "Mock-Header-One", Value: "1"},
-		{Name: "Mock-Header-One", Value: "1.5"},
-		{Name: "Mock-Header-Two", Value: "2"},
-		{Name: "Mock-Header-Three", Value: "3"},
-	}
-	h1 := &http.Request{
-		Header: make(http.Header),
-	}
-	err := H2RequestHeadersToH1Request(mockHeaders, h1)
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expectedHeaders, stdlibHeaderToH2muxHeader(h1.Header))
-}
-
-func TestIsControlHeader(t *testing.T) {
-	controlHeaders := []string{
-		// Anything that begins with cf-
-		"cf-sample-header",
-
-		// Any http2 pseudoheader
-		":sample-pseudo-header",
-
-		// content-length is a special case, it has to be there
-		// for some requests to work (per the HTTP2 spec)
-		"content-length",
-	}
-
-	for _, header := range controlHeaders {
-		assert.True(t, IsControlHeader(header))
-	}
-}
-
-func TestIsNotControlHeader(t *testing.T) {
-	notControlHeaders := []string{
-		"mock-header",
-		"another-sample-header",
-	}
-
-	for _, header := range notControlHeaders {
-		assert.False(t, IsControlHeader(header))
-	}
-}
-
-func TestH1ResponseToH2ResponseHeaders(t *testing.T) {
-	mockHeaders := http.Header{
-		"User-header-one": {""},
-		"User-header-two": {"1", "2"},
-		"cf-header":       {"cf-value"},
-		"Content-Length":  {"123"},
-	}
-	mockResponse := http.Response{
-		StatusCode: 200,
-		Header:     mockHeaders,
-	}
-
-	headers := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
-
-	serializedHeadersIndex := -1
-	for i, header := range headers {
-		if header.Name == ResponseUserHeadersField {
-			serializedHeadersIndex = i
-			break
-		}
-	}
-	assert.NotEqual(t, -1, serializedHeadersIndex)
-	actualControlHeaders := append(
-		headers[:serializedHeadersIndex],
-		headers[serializedHeadersIndex+1:]...,
-	)
-	expectedControlHeaders := []Header{
-		{Name: ":status", Value: "200"},
-		{Name: "content-length", Value: "123"},
-	}
-
-	assert.ElementsMatch(t, expectedControlHeaders, actualControlHeaders)
-
-	actualUserHeaders, err := DeserializeHeaders(headers[serializedHeadersIndex].Value)
-	expectedUserHeaders := []Header{
-		{Name: "User-header-one", Value: ""},
-		{Name: "User-header-two", Value: "1"},
-		{Name: "User-header-two", Value: "2"},
-	}
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expectedUserHeaders, actualUserHeaders)
-}
-
-// The purpose of this test is to check that our code and the http.Header
-// implementation don't throw validation errors about header size
-func TestHeaderSize(t *testing.T) {
-	largeValue := randSeq(5 * 1024 * 1024) // 5Mb
-	largeHeaders := http.Header{
-		"User-header": {largeValue},
-	}
-	mockResponse := http.Response{
-		StatusCode: 200,
-		Header:     largeHeaders,
-	}
-
-	serializedHeaders := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
-	request, err := http.NewRequest(http.MethodGet, "https://example.com/", nil)
-	assert.NoError(t, err)
-	for _, header := range serializedHeaders {
-		request.Header.Set(header.Name, header.Value)
-	}
-
-	for _, header := range serializedHeaders {
-		if header.Name != ResponseUserHeadersField {
-			continue
-		}
-
-		deserializedHeaders, err := DeserializeHeaders(header.Value)
-		assert.NoError(t, err)
-		assert.Equal(t, largeValue, deserializedHeaders[0].Value)
-	}
-}
-
-func randSeq(n int) string {
-	randomizer := rand.New(rand.NewSource(17))
-	var letters = []rune(":;,+/=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
-	b := make([]rune, n)
-	for i := range b {
-		b[i] = letters[randomizer.Intn(len(letters))]
-	}
-	return string(b)
-}
-
-func BenchmarkH1ResponseToH2ResponseHeaders(b *testing.B) {
-	ser := "eC1mb3J3YXJkZWQtcHJvdG8:aHR0cHM;dXBncmFkZS1pbnNlY3VyZS1yZXF1ZXN0cw:MQ;YWNjZXB0LWxhbmd1YWdl:ZW4tVVMsZW47cT0wLjkscnU7cT0wLjg;YWNjZXB0LWVuY29kaW5n:Z3ppcA;eC1mb3J3YXJkZWQtZm9y:MTczLjI0NS42MC42;dXNlci1hZ2VudA:TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNikgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg0LjAuNDE0Ny44OSBTYWZhcmkvNTM3LjM2;c2VjLWZldGNoLW1vZGU:bmF2aWdhdGU;Y2RuLWxvb3A:Y2xvdWRmbGFyZQ;c2VjLWZldGNoLWRlc3Q:ZG9jdW1lbnQ;c2VjLWZldGNoLXVzZXI:PzE;c2VjLWZldGNoLXNpdGU:bm9uZQ;Y29va2ll:X19jZmR1aWQ9ZGNkOWZjOGNjNWMxMzE0NTMyYTFkMjhlZDEyOWRhOTYwMTU2OTk1MTYzNDsgX19jZl9ibT1mYzY2MzMzYzAzZmM0MWFiZTZmOWEyYzI2ZDUwOTA0YzIxYzZhMTQ2LTE1OTU2MjIzNDEtMTgwMC1BZTVzS2pIU2NiWGVFM05mMUhrTlNQMG1tMHBLc2pQWkloVnM1Z2g1SkNHQkFhS1UxVDB2b003alBGN3FjMHVSR2NjZGcrWHdhL1EzbTJhQzdDVU4xZ2M9;YWNjZXB0:dGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuOQ"
-	h2, _ := DeserializeHeaders(ser)
-	h1 := make(http.Header)
-	for _, header := range h2 {
-		h1.Add(header.Name, header.Value)
-	}
-	h1.Add("Content-Length", "200")
-	h1.Add("Cf-Something", "Else")
-	h1.Add("Upgrade", "websocket")
-
-	h1resp := &http.Response{
-		StatusCode: 200,
-		Header:     h1,
-	}
-
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_ = H1ResponseToH2ResponseHeaders(h1resp.StatusCode, h1resp.Header)
-	}
-}

h2mux/muxedstream.go

@@ -23,6 +23,10 @@ type MuxedStreamDataSignaller interface {
 	Signal(ID uint32)
 }
 
+type Header struct {
+	Name, Value string
+}
+
 // MuxedStream is logically an HTTP/2 stream, with an additional buffer for outgoing data.
 type MuxedStream struct {
 	streamID uint32
@@ -74,8 +78,6 @@ type MuxedStream struct {
 	sentEOF bool
 	// true if the peer sent us an EOF
 	receivedEOF bool
-	// If valid, tunnelHostname is used to identify which origin service is the intended recipient of the request
-	tunnelHostname TunnelHostname
 	// Compression-related fields
 	receivedUseDict bool
 	method          string
@@ -252,10 +254,6 @@ func (s *MuxedStream) IsRPCStream() bool {
 	return true
 }
 
-func (s *MuxedStream) TunnelHostname() TunnelHostname {
-	return s.tunnelHostname
-}
-
 // Block until a value is sent on writeBufferHasSpace.
 // Must be called while holding writeLock
 func (s *MuxedStream) awaitWriteBufferHasSpace() {

h2mux/muxreader.go

@@ -12,10 +12,6 @@ import (
 	"golang.org/x/net/http2"
 )
 
-const (
-	CloudflaredProxyTunnelHostnameHeader = "cf-cloudflared-proxy-tunnel-hostname"
-)
-
 type MuxReader struct {
 	// f is used to read HTTP2 frames.
 	f *http2.Framer
@@ -252,8 +248,6 @@ func (r *MuxReader) receiveHeaderData(frame *http2.MetaHeadersFrame) error {
 			if r.dictionaries.write != nil {
 				continue
 			}
-		case CloudflaredProxyTunnelHostnameHeader:
-			stream.tunnelHostname = TunnelHostname(header.Value)
 		}
 		headers = append(headers, Header{Name: header.Name, Value: header.Value})
 	}

h2mux/muxreader_test.go

@@ -21,10 +21,6 @@ var (
 		Name:  ":path",
 		Value: "/api/tunnels",
 	}
-	tunnelHostnameHeader = Header{
-		Name:  CloudflaredProxyTunnelHostnameHeader,
-		Value: "tunnel.example.com",
-	}
 	respStatusHeader = Header{
 		Name:  ":status",
 		Value: "200",
@@ -42,15 +38,6 @@ func (mosh *mockOriginStreamHandler) ServeStream(stream *MuxedStream) error {
 	return nil
 }
 
-func getCloudflaredProxyTunnelHostnameHeader(stream *MuxedStream) string {
-	for _, header := range stream.Headers {
-		if header.Name == CloudflaredProxyTunnelHostnameHeader {
-			return header.Value
-		}
-	}
-	return ""
-}
-
 func assertOpenStreamSucceed(t *testing.T, stream *MuxedStream, err error) {
 	assert.NoError(t, err)
 	assert.Len(t, stream.Headers, 1)
@@ -72,13 +59,11 @@ func TestMissingHeaders(t *testing.T) {
 		},
 	}
 
-	// Request doesn't contain CloudflaredProxyTunnelHostnameHeader
 	stream, err := muxPair.EdgeMux.OpenStream(ctx, reqHeaders, nil)
 	assertOpenStreamSucceed(t, stream, err)
 
 	assert.Empty(t, originHandler.stream.method)
 	assert.Empty(t, originHandler.stream.path)
-	assert.False(t, originHandler.stream.TunnelHostname().IsSet())
 }
 
 func TestReceiveHeaderData(t *testing.T) {
@@ -90,18 +75,14 @@ func TestReceiveHeaderData(t *testing.T) {
 		methodHeader,
 		schemeHeader,
 		pathHeader,
-		tunnelHostnameHeader,
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
 
-	reqHeaders = append(reqHeaders, tunnelHostnameHeader)
 	stream, err := muxPair.EdgeMux.OpenStream(ctx, reqHeaders, nil)
 	assertOpenStreamSucceed(t, stream, err)
 
 	assert.Equal(t, methodHeader.Value, originHandler.stream.method)
 	assert.Equal(t, pathHeader.Value, originHandler.stream.path)
-	assert.True(t, originHandler.stream.TunnelHostname().IsSet())
-	assert.Equal(t, tunnelHostnameHeader.Value, originHandler.stream.TunnelHostname().String())
 }