From 039057b8dbbb02412f629bd5eded393c08d3b617 Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@limpet.net>
Date: Fri, 22 May 2020 08:05:14 -0700
Subject: [PATCH] Improve request parsing

---
 README.md   |  4 ++--
 src/main.rs | 36 ++++++++++++++++++++++++------------
 2 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/README.md b/README.md
index bd018a3..efe88c4 100644
--- a/README.md
+++ b/README.md
@@ -23,10 +23,10 @@ openssl req -x509 -newkey rsa:4096 -keyout key.rsa -out cert.pem \
     -days 3650 -nodes -subj "/CN=example.com"
 ```
 
-4. Run the server. The command line arguments are `agate <host:port> <content_dir> <cert_file> <key_file>`.  For example, to listen on the standard Gemini port (1965) on localhost:
+4. Run the server. The command line arguments are `agate <addr:port> <content_dir> <cert_file> <key_file>`.  For example, to listen on the standard Gemini port (1965) on all interfaces:
 
 ```
-agate localhost:1965 path/to/content/ cert.pem key.rsa
+agate 0.0.0.0:1965 path/to/content/ cert.pem key.rsa
 ```
 
 When a client requests the URL `gemini://example.com/foo/bar`, Agate will respond with the file at `path/to/content/foo/bar`.  If there is a directory at that path, Agate will look for a file named `index.gemini` inside that directory.
diff --git a/src/main.rs b/src/main.rs
index 5e4dc54..0eb75c0 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -8,7 +8,7 @@ use {
     },
     async_tls::{TlsAcceptor, server::TlsStream},
     lazy_static::lazy_static,
-    std::{error::Error, ffi::OsStr, fs::File, io::BufReader, sync::Arc},
+    std::{error::Error, ffi::OsStr, fs::File, io::BufReader, str, sync::Arc},
     url::Url,
 };
 
@@ -40,7 +40,6 @@ lazy_static! {
     static ref ARGS: Args = args()
         .expect("usage: agate <addr:port> <dir> <cert> <key>");
     static ref ACCEPTOR: TlsAcceptor = acceptor().unwrap();
-    static ref BASE: Url = Url::parse(&format!("gemini://{}", ARGS.sock_addr)).unwrap();
 }
 
 fn args() -> Option<Args> {
@@ -71,7 +70,10 @@ async fn connection(stream: TcpStream) -> Result {
     use async_std::io::prelude::*;
     let mut stream = ACCEPTOR.accept(stream).await?;
     match parse_request(&mut stream).await {
-        Ok(url) => get(&url, &mut stream).await,
+        Ok(url) => {
+            eprintln!("Got request for {:?}", url);
+            get(&url, &mut stream).await
+        }
         Err(e) => {
             stream.write_all(b"59 Invalid request.\r\n").await?;
             Err(e)
@@ -81,19 +83,29 @@ async fn connection(stream: TcpStream) -> Result {
 
 async fn parse_request(stream: &mut TlsStream<TcpStream>) -> Result<Url> {
     let mut stream = async_std::io::BufReader::new(stream);
-    let mut request = String::new();
-    stream.read_line(&mut request).await?;
-    let request = request.trim();
-    eprintln!("Got request for {:?}", request);
+    let mut request = Vec::new();
+    stream.read_until(b'\r', &mut request).await?;
 
-    let url = if request.starts_with("//") {
-        BASE.join(request.trim())?
-    } else {
-        Url::parse(request)?
-    };
+    // Check line ending.
+    let eol = &mut [0];
+    stream.read_exact(eol).await?;
+    if eol != b"\n" {
+        Err("CR without LF")?
+    }
+    // Check request length.
+    if request.len() > 1026 {
+        Err("Too long")?
+    }
+    // Handle scheme-relative URLs.
+    if request.starts_with(b"//") {
+        request.splice(..0, "gemini:".bytes());
+    }
+    // Parse URL.
+    let url = Url::parse(str::from_utf8(&request)?.trim_end())?;
     if url.scheme() != "gemini" {
         Err("unsupported URL scheme")?
     }
+    // TODO: Validate hostname and port.
     Ok(url)
 }