proxy: Clarify Outbound::recognize

proxy/src/outbound.rs

@@ -54,6 +54,74 @@ impl<B> Outbound<B> {
             bind_timeout,
         }
     }
+
+
+    /// TODO: Return error when `HostAndPort::normalize()` fails.
+    /// TODO: Use scheme-appropriate default port.
+    fn normalize(authority: &http::uri::Authority) -> Option<HostAndPort> {
+        const DEFAULT_PORT: Option<u16> = Some(80);
+        HostAndPort::normalize(authority, DEFAULT_PORT)
+            .inspect_err(|e| error!("invalid authority=\"{}\": {:?}", authority, e))
+    }
+
+    /// Determines the logical host:port of the request.
+    ///
+    /// If the parsed URI includes an authority, use that. Otherwise, try to load the
+    /// authority from the `Host` header.
+    ///
+    /// The port is either parsed from the authority or a default of 80 is used.
+    fn host_port(req: &http::Request<B>) -> Option<HostAndPort> {
+        // Note: Calls to `normalize` cannot be deduped without cloning `authority`.
+        req.uri()
+            .authority_part()
+            .and_then(Self::normalize)
+            .or_else(|| {
+                h1::authority_from_host(req)
+                    .and_then(|h| Self::normalize(&h))
+            })
+    }
+
+    /// Determines the destination to use in the router.
+    ///
+    /// A Destination is determined for each request as follows:
+    ///
+    /// 1. If the request includes a logical authority, it is routed by the hostname and
+    ///    port. If an explicit port is not provided, a default is assumed.
+    ///
+    /// 2. If the request authority contains a concrete IP address, it is routed directly
+    ///    to that IP address.
+    ///
+    /// 3. If no authority is present on the request, the client's original destination,
+    ///    as determined by the SO_ORIGINAL_DST socket option, is used as the request's
+    ///    destination.
+    ///
+    ///    The SO_ORIGINAL_DST socket option is typically set by iptables(8) in
+    ///    containerized environments like Kubernetes (as configured by the proxy-init
+    ///    program).
+    ///
+    /// 4. If the request has no authority and the SO_ORIGINAL_DST socket option has not
+    ///    been set (or is unavailable on the current platform), no destination is
+    ///    determined.
+    fn destination(req: &http::Request<B>) -> Option<Destination> {
+        match Self::host_port(req) {
+            Some(HostAndPort { host: Host::DnsName(host), port }) => {
+                let dst = DnsNameAndPort { host, port };
+                Some(Destination::Hostname(dst))
+            }
+
+            Some(HostAndPort { host: Host::Ip(ip), port }) => {
+                let dst = SocketAddr::from((ip, port));
+                Some(Destination::ImplicitOriginalDst(dst))
+            }
+
+            None => {
+                req.extensions()
+                    .get::<Arc<ctx::transport::Server>>()
+                    .and_then(|ctx| ctx.orig_dst_if_not_local())
+                    .map(Destination::ImplicitOriginalDst)
+            }
+        }
+    }
 }
 
 impl<B> Clone for Outbound<B>
@@ -88,45 +156,11 @@ where
         choose::PowerOfTwoChoices,
     >>>>;
 
+    // Route the request by its destination AND PROTOCOL. This prevents HTTP/1
+    // requests from being routed to HTTP/2 servers, and vice versa.
     fn recognize(&self, req: &Self::Request) -> Option<Self::Key> {
+        let dest = Self::destination(req)?;
         let proto = bind::Protocol::detect(req);
-
-        // The request URI and Host: header have not yet been normalized
-        // by `NormalizeUri`, as we need to know whether the request will
-        // be routed by Host/authority or by SO_ORIGINAL_DST, in order to
-        // determine whether the service is reusable.
-        let authority = req.uri().authority_part()
-            .cloned()
-        // Therefore, we need to check the host header as well as the URI
-        // for a valid authority, before we fall back to SO_ORIGINAL_DST.
-            .or_else(|| h1::authority_from_host(req));
-
-        // TODO: Return error when `HostAndPort::normalize()` fails.
-        let mut dest = match authority.as_ref()
-            .and_then(|auth| HostAndPort::normalize(auth, Some(80)).ok()) {
-            Some(HostAndPort { host: Host::DnsName(dns_name), port }) =>
-                Some(Destination::Hostname(DnsNameAndPort { host: dns_name, port })),
-            Some(HostAndPort { host: Host::Ip(_), .. }) |
-            None => None,
-        };
-
-        if dest.is_none() {
-            dest = req.extensions()
-                .get::<Arc<ctx::transport::Server>>()
-                .and_then(|ctx| {
-                    ctx.orig_dst_if_not_local()
-                })
-                .map(Destination::ImplicitOriginalDst)
-        };
-
-        // If there is no authority in the request URI or in the Host header,
-        // and there is no original dst, then we have nothing! In that case,
-        // return `None`, which results an "unrecognized" error. In practice,
-        // this shouldn't ever happen, since we expect the proxy to be run on
-        // Linux servers, with iptables setup, so there should always be an
-        // original destination.
-        let dest = dest?;
-
         Some((dest, proto))
     }