glm-5.1
f9d7b8112b
Break down findings from review #002 into dependency-ordered fix tasks: Critical/High: - fix/acme-contact-and-challenge (C1+C2): Add acme_contact field, wire to ACME, remove unused challenge_config, add validation rule 19 - fix/remove-health-and-hardcode-https (W5+W14+ADR-022): Remove /health from main listener, hardcode X-Forwarded-Proto to https - fix/config-reload-static-drift (C4): Use ArcSwap<StaticConfig> so reload diffs against last config, not startup config - fix/access-logging (W13): Wire up log_request! macro for every proxied request with client_ip, host, method, path, status, upstream, duration_ms Medium: - fix/graceful-shutdown (W1+W7): Join HTTPS tasks with timeout instead of abort, add shutdown signal to admin socket and eviction task - fix/connect-timeout (W4): Wire upstream_connect_timeout_secs to enforce separate connect timeout Low/Independent: - fix/token-bucket-nanosecond (W6): Use as_nanos() instead of as_millis() - fix/normalize-host-ipv6 (S3): Handle IPv6 bracket notation in normalize_host - fix/http-port-validation (S1): Validate http_port in range 0 or 1-65535 - fix/integration-test-toml (S10): Fix double-nested listeners.listeners.sites - fix/logging-test-global-subscriber (W9): Use try_init() to avoid test conflicts - fix/fragile-error-detection (W3): Add typed error matching or documented string match - fix/add-code-comments (C3,W8,W10,W11,S9): Document correct-but-non-obvious behaviors - fix/request-timeout-scope (S8): Document full-request timeout scope - fix/clean-dead-code (S4+S2): Remove dead_code annotations, add #[non_exhaustive] Review gate: - review/post-fix-review: Verify all fixes against architecture spec
2.1 KiB
2.1 KiB
id, name, status, depends_on, scope, risk, impact, level, review_findings
| id | name | status | depends_on | scope | risk | impact | level | review_findings | |
|---|---|---|---|---|---|---|---|---|---|
| fix/normalize-host-ipv6 | Fix normalize_host to handle IPv6 bracket notation | pending | single | low | isolated | implementation |
|
Description
normalize_host in src/config/dynamic_config.rs uses split(':').next() to strip ports, but this fails for IPv6 addresses in brackets (e.g., [::1]:443 would normalize to [::1] instead of ::1). The strip_port_from_host function in src/tls/redirect.rs correctly handles this case.
Changes Required
src/config/dynamic_config.rs:
- Replace the
normalize_hostimplementation with a port-stripping function that handles IPv6 bracket notation - Either extract a shared utility function from
strip_port_from_hostinredirect.rs, or makenormalize_hostuse the same logic - The function should:
- If host starts with
[, find the closing]and strip the port after it - Otherwise, use the existing
split(':').next()logic - Convert to lowercase
- If host starts with
src/tls/redirect.rs:
- Consider extracting
strip_port_from_hostinto a shared module (e.g.,src/utils.rsor inline in both places) to avoid code duplication
Tests
- Add test cases for
normalize_hostwith IPv6:[::1]:443→::1(or[::1]depending on convention — check what the routing table expects)[2001:db8::1]:8080→2001:db8::1- Plain hostname with port:
example.com:443→example.com - Plain hostname without port:
example.com→example.com
Acceptance Criteria
normalize_hostcorrectly strips ports from IPv6 bracket notation- Either a shared utility function is extracted, or both implementations use the same logic
- New test cases for IPv6 host normalization
- Existing routing tests pass
cargo clippypasses with no warnings
References
- docs/reviews/002-implementation-review.md — S3 finding
- src/config/dynamic_config.rs —
normalize_hostfunction - src/tls/redirect.rs —
strip_port_from_hostfunction (correct implementation)
Notes
To be filled by implementation agent
Summary
To be filled on completion