.tcp.ngrok.io:\")\n .metadata(\"example tunnel metadata from rust\")\n .listen()\n .await?;\n\n handle_tunnel(tunnel, sess);\n\n futures::future::pending().await\n}\n\nfn handle_tunnel(mut tunnel: impl EndpointInfo + Tunnel, sess: ngrok::Session) {\n info!(\"bound new tunnel: {}\", tunnel.url());\n tokio::spawn(async move {\n loop {\n let stream = if let Some(stream) = tunnel.try_next().await? {\n stream\n } else {\n info!(\"tunnel closed!\");\n break;\n };\n\n let sess = sess.clone();\n let id: String = tunnel.id().into();\n\n tokio::spawn(async move {\n info!(\"accepted connection: {:?}\", stream.remote_addr());\n let (rx, mut tx) = io::split(stream);\n\n let mut lines = BufReader::new(rx);\n\n loop {\n let mut buf = String::new();\n let len = lines.read_line(&mut buf).await?;\n if len == 0 {\n break;\n }\n\n if buf.contains(\"bye!\") {\n info!(\"unbind requested\");\n tx.write_all(\"later!\".as_bytes()).await?;\n sess.close_tunnel(id).await?;\n return Ok(());\n } else if buf.contains(\"another!\") {\n info!(\"another requested\");\n let new_tunnel = sess.tcp_endpoint().listen().await?;\n tx.write_all(new_tunnel.url().as_bytes()).await?;\n handle_tunnel(new_tunnel, sess.clone());\n } else {\n info!(\"read line: {}\", buf);\n tx.write_all(buf.as_bytes()).await?;\n info!(\"echoed line\");\n }\n tx.flush().await?;\n info!(\"flushed\");\n }\n\n Result::<(), anyhow::Error>::Ok(())\n });\n }\n anyhow::Result::<()>::Ok(())\n });\n}\n"
},
{
"path": "ngrok/examples/domain.crt",
"content": "-----BEGIN CERTIFICATE-----\nMIIC+jCCAeICCQDobWtly6PonjANBgkqhkiG9w0BAQsFADA/MQswCQYDVQQGEwJV\nUzERMA8GA1UECgwITm90IFJlYWwxHTAbBgNVBAMMFHJ1c3Qtc2RrLmV4YW1wbGUu\nY29tMB4XDTIyMTIwMjE4MzMxM1oXDTMyMTEyOTE4MzMxM1owPzELMAkGA1UEBhMC\nVVMxETAPBgNVBAoMCE5vdCBSZWFsMR0wGwYDVQQDDBRydXN0LXNkay5leGFtcGxl\nLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKhsx8tZWzaqaz9i\ngnyU9O/dCEX8qgCvU2yoeJBfGhwCnlFNQBUdBGlV+Cjf19ozagYlY6Cunu214AUR\nCDHTZsgTmMhtHkJ3kWD0wgDu+uyUuW6akP1+o39lebDc6CbDV7j1ySBoPMROp5dB\npX+ltpH42CmJM6ciwfTD1uuW5LXJvb9d4HISZp2RWyHqb3a6pI7E+XLqXg/Yy9MY\neqQESZMrYCjC+Sn4blGhcQhjTVU2rM5ChoDtZuL8OJQ0UYmchlch8CNc5Lvj9hAT\nBiafEAscGrdIAZkK50kjpcIOWPPSfjCRqz8elSQqoKFq/uQnHBF5NwmsEqE0sXhw\n4UdngRMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAKieeE6gzuxHGjVT2NKL5BFjL\nXKxdQhI/Tt7ClKu39Ay62fXDRznTBpGRfyWsJ5r3wmsHFogw46a2HYZHyuTMfyPY\nlKhE/9EPMf/faqhIa33nMBASNzuGB5yfcPaod4KJX6DBKZtIpgkm2+S6BivpuSEo\nDJ0lNtlR80mcVPma9KR57A0oh/UIsHXxL0qIKdaxyZYOZ1Zhtm+hzZcZA4wHkqzN\nolNk3SOfhC5vVFudg+5KtxPBZ/efS9sqDUstH8hmE1JnxCF9OBlHdKI4yUMnsEf7\naOy11K5g7Oc3m7EB1twEQkufBAJeYzMOCji17GyJHDojNuOLkrmoLgcgDym5LQ==\n-----END CERTIFICATE-----\n"
},
{
"path": "ngrok/examples/domain.key",
"content": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAqGzHy1lbNqprP2KCfJT0790IRfyqAK9TbKh4kF8aHAKeUU1A\nFR0EaVX4KN/X2jNqBiVjoK6e7bXgBREIMdNmyBOYyG0eQneRYPTCAO767JS5bpqQ\n/X6jf2V5sNzoJsNXuPXJIGg8xE6nl0Glf6W2kfjYKYkzpyLB9MPW65bktcm9v13g\nchJmnZFbIepvdrqkjsT5cupeD9jL0xh6pARJkytgKML5KfhuUaFxCGNNVTaszkKG\ngO1m4vw4lDRRiZyGVyHwI1zku+P2EBMGJp8QCxwat0gBmQrnSSOlwg5Y89J+MJGr\nPx6VJCqgoWr+5CccEXk3CawSoTSxeHDhR2eBEwIDAQABAoIBADKQLc8brWmU8gue\nbGQwZ/RW3DP+rZ71A8ucLE3Tb0g3dQYddf6groFdINpMkUXdp5few7Eqm2Xr8ywy\nN86Vk8a/M2AAelQkB04fTNrw4/4AjEbrOloQGc+WTFlPiJaSkJRjnZUQFiYtIt0j\nBSd0PYJHPcYCfbJQmf/8h1pE+7ajNJlvEWrJ8UjDCjUuPPxq1aCOIA48aN8awDaO\n2R0AeSBws6+6UgyBgy2juat0t8PvS+AiLv4rK3RGMD+x96KoPEoVVgOQLr5YTqRP\nQ+HYrs5cSXx9Jb2cmuJzvPUJmE3HKhoshWrK7fz5Z8wVAqTGhX6dbuHoqMJnAdla\nFFSBEokCgYEA0BAsrDrnSkls1uC54iqzrxPMvITj4UnBR+PK504NrtP2brlcVIDP\ne0dTKPTqjIC0vpDIg2fhPPvKkeoyuL6huiUWL/DdYVphUlwTf2Mu6PUm3o4M1MWN\nS7q09cqUp4HWCUbzN3MIJ8sOPY17Lq+fxi1Wf4mNh+8IIXcJQ4HgUiUCgYEAzzqx\nL7ck6pBUTtpUFYFTCUQDOYdzPE72zOzHK/LpoWJEssQ479srKlmSnRPRZbPZGMGE\nEXvhWROonux96rRrZjiBI4B5G4rzeY0Rs24kClEh+7s5Zw4xmfSJu5oSdLqiy+O+\nIKMVhOm9qq+8+y9LwKyajwR27srLdHSijJoXNNcCgYEAgtc5EJH2MwwbisFFg8mw\nt0+vN3omR91203uXdH/sMN4Qoa6lNmrOj0raK+5gtTyW7SPlRGWGCjCZQctSXEVd\nNM7vtfQ1c2w/uWg3xqsbq9nGuLwBq6gT4+SkudDMTM5kR+87Mcp//W4/JUwcg85j\nnl+Sfp+Exk/1//14cOByrZUCgYEAjrr7HUVEfPbJysHf1iwL2D7rBa3AdhJhNIYF\nLMUTm59Gd+Zk3PeUxIeLTvs+Z5E2/zESWMR9UtASfNugYo6/xlk2wRAU2h6bUeYT\nAgXjduOox2yNvehty389emRFP/boeAw1gN8yzCf+BdkjDdLmlx+LGORXUmOFPIG1\nD6h2QWMCgYA0WysR3XMcRH/8GDAgNVry5JvKoxlVXTPqVScTjMRj3VAzPYPCV+ql\nlNN6yh/TuJwdvNs+uhKd1Wu4cDIb9GqxkBbUTKoKBrVL1YB93IC7QIR5wVjhJF/i\nlrFW1ogr3535UzHzyDD1oXvcnWV/JnTdadHf2oA3Em8n2oTQvXQAog==\n-----END RSA PRIVATE KEY-----\n"
},
{
"path": "ngrok/examples/labeled.rs",
"content": "use std::{\n convert::Infallible,\n error::Error,\n net::SocketAddr,\n};\n\nuse axum::{\n extract::ConnectInfo,\n routing::get,\n BoxError,\n Router,\n};\nuse futures::TryStreamExt;\nuse hyper::{\n body::Incoming,\n Request,\n};\nuse hyper_util::{\n rt::TokioExecutor,\n server,\n};\nuse ngrok::prelude::*;\nuse tower::{\n util::ServiceExt,\n Service,\n};\n\n#[tokio::main]\nasync fn main() -> Result<(), Box> {\n // build our application with a single route\n let app = Router::new().route(\n \"/\",\n get(\n |ConnectInfo(remote_addr): ConnectInfo| async move {\n format!(\"Hello, {remote_addr:?}!\\r\\n\")\n },\n ),\n );\n\n let sess = ngrok::Session::builder()\n .authtoken_from_env()\n .connect()\n .await?;\n\n let mut listener = sess\n .labeled_tunnel()\n // .app_protocol(\"http2\")\n // .verify_upstream_tls(false)\n .label(\"edge\", \"edghts_\")\n .metadata(\"example tunnel metadata from rust\")\n .listen()\n .await?;\n\n println!(\"Labeled listener started!\");\n\n let mut make_service = app.into_make_service_with_connect_info::();\n\n let server = async move {\n while let Some(conn) = listener.try_next().await? {\n let remote_addr = conn.remote_addr();\n let tower_service = unwrap_infallible(make_service.call(remote_addr).await);\n\n tokio::spawn(async move {\n let hyper_service =\n hyper::service::service_fn(move |request: Request| {\n tower_service.clone().oneshot(request)\n });\n\n if let Err(err) = server::conn::auto::Builder::new(TokioExecutor::new())\n .serve_connection_with_upgrades(conn, hyper_service)\n .await\n {\n eprintln!(\"failed to serve connection: {err:#}\");\n }\n });\n }\n Ok::<(), BoxError>(())\n };\n\n server.await?;\n Ok(())\n}\n\nfn unwrap_infallible(result: Result) -> T {\n match result {\n Ok(value) => value,\n Err(err) => match err {},\n }\n}\n"
},
{
"path": "ngrok/examples/mingrok.rs",
"content": "use std::sync::{\n Arc,\n Mutex,\n};\n\nuse anyhow::Error;\nuse futures::{\n prelude::*,\n select,\n};\nuse ngrok::prelude::*;\nuse tokio::sync::oneshot;\nuse tracing::info;\nuse url::Url;\n\n#[tokio::main]\nasync fn main() -> Result<(), Error> {\n tracing_subscriber::fmt()\n .pretty()\n .with_env_filter(std::env::var(\"RUST_LOG\").unwrap_or_else(|_| \"info\".into()))\n .init();\n\n let forwards_to = std::env::args()\n .nth(1)\n .ok_or_else(|| anyhow::anyhow!(\"missing forwarding address\"))\n .and_then(|s| Ok(Url::parse(&s)?))?;\n\n loop {\n let (stop_tx, stop_rx) = oneshot::channel();\n let stop_tx = Arc::new(Mutex::new(Some(stop_tx)));\n\n let (restart_tx, restart_rx) = oneshot::channel();\n let restart_tx = Arc::new(Mutex::new(Some(restart_tx)));\n\n let mut fwd = ngrok::Session::builder()\n .authtoken_from_env()\n .handle_stop_command(move |req| {\n let stop_tx = stop_tx.clone();\n async move {\n info!(?req, \"received stop command\");\n let _ = stop_tx.lock().unwrap().take().unwrap().send(());\n Ok(())\n }\n })\n .handle_restart_command(move |req| {\n let restart_tx = restart_tx.clone();\n async move {\n info!(?req, \"received restart command\");\n let _ = restart_tx.lock().unwrap().take().unwrap().send(());\n Ok(())\n }\n })\n .handle_update_command(|req| async move {\n info!(?req, \"received update command\");\n Err(\"unable to update\".into())\n })\n .connect()\n .await?\n .http_endpoint()\n .listen_and_forward(forwards_to.clone())\n .await?;\n\n info!(url = fwd.url(), %forwards_to, \"started forwarder\");\n\n let mut fut = fwd.join().fuse();\n let mut stop_rx = stop_rx.fuse();\n let mut restart_rx = restart_rx.fuse();\n\n select! {\n res = fut => info!(\"{:?}\", res?),\n _ = stop_rx => return Ok(()),\n _ = restart_rx => {\n drop(fut);\n let _ = fwd.close().await;\n continue\n },\n }\n }\n}\n"
},
{
"path": "ngrok/examples/tls.rs",
"content": "use std::{\n convert::Infallible,\n error::Error,\n net::SocketAddr,\n};\n\nuse axum::{\n extract::ConnectInfo,\n routing::get,\n BoxError,\n Router,\n};\nuse futures::TryStreamExt;\nuse hyper::{\n body::Incoming,\n Request,\n};\nuse hyper_util::{\n rt::TokioExecutor,\n server,\n};\nuse ngrok::prelude::*;\nuse tower::{\n util::ServiceExt,\n Service,\n};\n\nconst CERT: &[u8] = include_bytes!(\"domain.crt\");\nconst KEY: &[u8] = include_bytes!(\"domain.key\");\n// const CA_CERT: &[u8] = include_bytes!(\"ca.crt\");\n\n#[tokio::main]\nasync fn main() -> Result<(), Box> {\n // build our application with a single route\n let app = Router::new().route(\n \"/\",\n get(\n |ConnectInfo(remote_addr): ConnectInfo| async move {\n format!(\"Hello, {remote_addr:?}!\\r\\n\")\n },\n ),\n );\n\n let sess = ngrok::Session::builder()\n .authtoken_from_env()\n .connect()\n .await?;\n\n let mut listener = sess\n .tls_endpoint()\n // .allow_cidr(\"0.0.0.0/0\")\n // .deny_cidr(\"10.1.1.1/32\")\n // .verify_upstream_tls(false)\n // .domain(\".ngrok.io\")\n // .forwards_to(\"example rust\"),\n // .mutual_tlsca(CA_CERT.into())\n // .proxy_proto(ProxyProto::None)\n .termination(CERT.into(), KEY.into())\n .metadata(\"example tunnel metadata from rust\")\n .listen()\n .await?;\n\n let mut make_service = app.into_make_service_with_connect_info::();\n\n let server = async move {\n while let Some(conn) = listener.try_next().await? {\n let remote_addr = conn.remote_addr();\n let tower_service = unwrap_infallible(make_service.call(remote_addr).await);\n\n tokio::spawn(async move {\n let hyper_service =\n hyper::service::service_fn(move |request: Request| {\n tower_service.clone().oneshot(request)\n });\n\n if let Err(err) = server::conn::auto::Builder::new(TokioExecutor::new())\n .serve_connection_with_upgrades(conn, hyper_service)\n .await\n {\n eprintln!(\"failed to serve connection: {err:#}\");\n }\n });\n }\n Ok::<(), BoxError>(())\n };\n\n server.await?;\n\n Ok(())\n}\n\nfn unwrap_infallible(result: Result) -> T {\n match result {\n Ok(value) => value,\n Err(err) => match err {},\n }\n}\n"
},
{
"path": "ngrok/src/config/common.rs",
"content": "use std::{\n collections::HashMap,\n env,\n process,\n};\n\nuse async_trait::async_trait;\nuse once_cell::sync::OnceCell;\nuse url::Url;\n\npub use crate::internals::proto::ProxyProto;\nuse crate::{\n config::policies::Policy,\n forwarder::Forwarder,\n internals::proto::{\n BindExtra,\n BindOpts,\n IpRestriction,\n MutualTls,\n },\n session::RpcError,\n Session,\n Tunnel,\n};\n\n/// Represents the ingress configuration for an ngrok endpoint.\n///\n/// Bindings determine where and how your endpoint is exposed.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum Binding {\n /// Publicly accessible endpoint (default for most configurations).\n Public,\n /// Internal-only endpoint, not accessible from the public internet.\n Internal,\n /// Kubernetes cluster binding for service mesh integration.\n Kubernetes,\n}\n\nimpl Binding {\n /// Returns the string representation of this binding.\n pub fn as_str(&self) -> &'static str {\n match self {\n Binding::Public => \"public\",\n Binding::Internal => \"internal\",\n Binding::Kubernetes => \"kubernetes\",\n }\n }\n\n /// Validates if a string is a recognized binding value.\n pub(crate) fn validate(s: &str) -> Result<(), String> {\n match s.to_lowercase().as_str() {\n \"public\" | \"internal\" | \"kubernetes\" => Ok(()),\n _ => Err(format!(\n \"Invalid binding value '{}'. Expected 'public', 'internal', or 'kubernetes'\",\n s\n )),\n }\n }\n}\n\nimpl From for String {\n fn from(binding: Binding) -> String {\n binding.as_str().to_string()\n }\n}\n\nimpl std::str::FromStr for Binding {\n type Err = String;\n\n fn from_str(s: &str) -> Result {\n match s.to_lowercase().as_str() {\n \"public\" => Ok(Binding::Public),\n \"internal\" => Ok(Binding::Internal),\n \"kubernetes\" => Ok(Binding::Kubernetes),\n _ => Err(format!(\n \"Invalid binding value '{}'. Expected 'public', 'internal', or 'kubernetes'\",\n s\n )),\n }\n }\n}\n\nimpl std::fmt::Display for Binding {\n fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n write!(f, \"{}\", self.as_str())\n }\n}\n\npub(crate) fn default_forwards_to() -> &'static str {\n static FORWARDS_TO: OnceCell = OnceCell::new();\n\n FORWARDS_TO\n .get_or_init(|| {\n let hostname = hostname::get()\n .unwrap_or(\"\".into())\n .to_string_lossy()\n .into_owned();\n let exe = env::current_exe()\n .unwrap_or(\"\".into())\n .to_string_lossy()\n .into_owned();\n let pid = process::id();\n format!(\"app://{hostname}/{exe}?pid={pid}\")\n })\n .as_str()\n}\n\n/// Trait representing things that can be built into an ngrok tunnel.\n#[async_trait]\npub trait TunnelBuilder: From {\n /// The ngrok tunnel type that this builder produces.\n type Tunnel: Tunnel;\n\n /// Begin listening for new connections on this tunnel.\n async fn listen(&self) -> Result;\n}\n\n/// Trait representing things that can be built into an ngrok tunnel and then\n/// forwarded to a provided URL.\n#[async_trait]\npub trait ForwarderBuilder: TunnelBuilder {\n /// Start listening for new connections on this tunnel and forward all\n /// connections to the provided URL.\n ///\n /// This will also set the `forwards_to` metadata for the tunnel.\n async fn listen_and_forward(&self, to_url: Url) -> Result, RpcError>;\n}\n\nmacro_rules! impl_builder {\n ($(#[$m:meta])* $name:ident, $opts:ty, $tun:ident, $edgepoint:tt) => {\n $(#[$m])*\n #[derive(Clone)]\n pub struct $name {\n options: $opts,\n // Note: This is only optional for testing purposes.\n session: Option,\n }\n\n mod __builder_impl {\n use $crate::forwarder::Forwarder;\n use $crate::config::common::ForwarderBuilder;\n use $crate::config::common::TunnelBuilder;\n use $crate::session::RpcError;\n use async_trait::async_trait;\n use url::Url;\n\n use super::*;\n\n impl From for $name {\n fn from(session: Session) -> Self {\n $name {\n options: Default::default(),\n session: session.into(),\n }\n }\n }\n\n #[async_trait]\n impl TunnelBuilder for $name {\n type Tunnel = $tun;\n\n async fn listen(&self) -> Result<$tun, RpcError> {\n Ok($tun {\n inner: self\n .session\n .as_ref()\n .unwrap()\n .start_tunnel(&self.options)\n .await?,\n })\n }\n }\n\n #[async_trait]\n impl ForwarderBuilder for $name {\n async fn listen_and_forward(&self, to_url: Url) -> Result, RpcError> {\n let mut cfg = self.clone();\n cfg.for_forwarding_to(&to_url).await;\n let tunnel = cfg.listen().await?;\n let info = tunnel.make_info();\n $crate::forwarder::forward(tunnel, info, to_url)\n }\n }\n }\n };\n}\n\n/// Tunnel configuration trait, implemented by our top-level config objects.\npub(crate) trait TunnelConfig {\n /// The \"forwards to\" metadata.\n ///\n /// Only for display/informational purposes.\n fn forwards_to(&self) -> String;\n /// The L7 protocol the upstream service expects\n fn forwards_proto(&self) -> String;\n /// Whether to disable certificate verification for this tunnel.\n fn verify_upstream_tls(&self) -> bool;\n /// Internal-only, extra data sent when binding a tunnel.\n fn extra(&self) -> BindExtra;\n /// The protocol for this tunnel.\n fn proto(&self) -> String;\n /// The middleware and other configuration options for this tunnel.\n fn opts(&self) -> Option;\n /// The labels for this tunnel.\n fn labels(&self) -> HashMap;\n}\n\n// delegate references\nimpl TunnelConfig for &T\nwhere\n T: TunnelConfig,\n{\n fn forwards_to(&self) -> String {\n (**self).forwards_to()\n }\n\n fn forwards_proto(&self) -> String {\n (**self).forwards_proto()\n }\n fn verify_upstream_tls(&self) -> bool {\n (**self).verify_upstream_tls()\n }\n fn extra(&self) -> BindExtra {\n (**self).extra()\n }\n fn proto(&self) -> String {\n (**self).proto()\n }\n fn opts(&self) -> Option {\n (**self).opts()\n }\n fn labels(&self) -> HashMap {\n (**self).labels()\n }\n}\n\n/// Restrictions placed on the origin of incoming connections to the edge.\n#[derive(Clone, Default)]\npub(crate) struct CidrRestrictions {\n /// Rejects connections that do not match the given CIDRs\n pub(crate) allowed: Vec,\n /// Rejects connections that match the given CIDRs and allows all other CIDRs.\n pub(crate) denied: Vec,\n}\n\nimpl CidrRestrictions {\n pub(crate) fn allow(&mut self, cidr: impl Into) {\n self.allowed.push(cidr.into());\n }\n pub(crate) fn deny(&mut self, cidr: impl Into) {\n self.denied.push(cidr.into());\n }\n}\n\n// Common\n#[derive(Default, Clone)]\npub(crate) struct CommonOpts {\n // Restrictions placed on the origin of incoming connections to the edge.\n pub(crate) cidr_restrictions: CidrRestrictions,\n // The version of PROXY protocol to use with this tunnel, zero if not\n // using.\n pub(crate) proxy_proto: ProxyProto,\n // Tunnel-specific opaque metadata. Viewable via the API.\n pub(crate) metadata: Option,\n // Tunnel backend metadata. Viewable via the dashboard and API, but has no\n // bearing on tunnel behavior.\n pub(crate) forwards_to: Option,\n // Tunnel L7 app protocol\n pub(crate) forwards_proto: Option,\n // Whether to disable certificate verification for this tunnel.\n verify_upstream_tls: Option,\n // DEPRECATED: use traffic_policy instead.\n pub(crate) policy: Option,\n // Policy that defines rules that should be applied to incoming or outgoing\n // connections to the edge.\n pub(crate) traffic_policy: Option,\n // Allows the endpoint to pool with other endpoints with the same host/port/binding\n pub(crate) pooling_enabled: Option,\n}\n\nimpl CommonOpts {\n // Get the proto version of cidr restrictions\n pub(crate) fn ip_restriction(&self) -> Option {\n (!self.cidr_restrictions.allowed.is_empty() || !self.cidr_restrictions.denied.is_empty())\n .then_some(self.cidr_restrictions.clone().into())\n }\n\n pub(crate) fn for_forwarding_to(&mut self, to_url: &Url) -> &mut Self {\n self.forwards_to = Some(to_url.as_str().into());\n self\n }\n\n pub(crate) fn set_verify_upstream_tls(&mut self, verify_upstream_tls: bool) {\n self.verify_upstream_tls = Some(verify_upstream_tls)\n }\n\n pub(crate) fn verify_upstream_tls(&self) -> bool {\n self.verify_upstream_tls.unwrap_or(true)\n }\n}\n\n// transform into the wire protocol format\nimpl From for IpRestriction {\n fn from(cr: CidrRestrictions) -> Self {\n IpRestriction {\n allow_cidrs: cr.allowed,\n deny_cidrs: cr.denied,\n }\n }\n}\n\nimpl From<&[bytes::Bytes]> for MutualTls {\n fn from(b: &[bytes::Bytes]) -> Self {\n let mut aggregated = Vec::new();\n b.iter().for_each(|c| aggregated.extend(c));\n MutualTls {\n mutual_tls_ca: aggregated,\n }\n }\n}\n"
},
{
"path": "ngrok/src/config/headers.rs",
"content": "use std::collections::HashMap;\n\nuse crate::internals::proto::Headers as HeaderProto;\n\n/// HTTP Headers to modify at the ngrok edge.\n#[derive(Clone, Default)]\npub(crate) struct Headers {\n /// Headers to add to requests or responses at the ngrok edge.\n added: HashMap,\n /// Header names to remove from requests or responses at the ngrok edge.\n removed: Vec,\n}\n\nimpl Headers {\n pub(crate) fn add(&mut self, name: impl Into, value: impl Into) {\n self.added.insert(name.into().to_lowercase(), value.into());\n }\n pub(crate) fn remove(&mut self, name: impl Into) {\n self.removed.push(name.into().to_lowercase());\n }\n pub(crate) fn has_entries(&self) -> bool {\n !self.added.is_empty() || !self.removed.is_empty()\n }\n}\n\n// transform into the wire protocol format\nimpl From for HeaderProto {\n fn from(headers: Headers) -> Self {\n HeaderProto {\n add: headers\n .added\n .iter()\n .map(|a| format!(\"{}:{}\", a.0, a.1))\n .collect(),\n remove: headers.removed,\n add_parsed: HashMap::new(), // unused in this context\n }\n }\n}\n"
},
{
"path": "ngrok/src/config/http.rs",
"content": "use std::{\n borrow::Borrow,\n collections::HashMap,\n convert::From,\n str::FromStr,\n};\n\nuse bytes::Bytes;\nuse thiserror::Error;\nuse url::Url;\n\nuse super::{\n common::ProxyProto,\n Policy,\n};\n// These are used for doc comment links.\n#[allow(unused_imports)]\nuse crate::config::{\n ForwarderBuilder,\n TunnelBuilder,\n};\nuse crate::{\n config::{\n common::{\n default_forwards_to,\n Binding,\n CommonOpts,\n TunnelConfig,\n },\n headers::Headers,\n oauth::OauthOptions,\n oidc::OidcOptions,\n webhook_verification::WebhookVerification,\n },\n internals::proto::{\n BasicAuth,\n BasicAuthCredential,\n BindExtra,\n BindOpts,\n CircuitBreaker,\n Compression,\n HttpEndpoint,\n UserAgentFilter,\n WebsocketTcpConverter,\n },\n tunnel::HttpTunnel,\n Session,\n};\n\n/// Error representing invalid string for Scheme\n#[derive(Debug, Clone, Error)]\n#[error(\"invalid scheme string: {}\", .0)]\npub struct InvalidSchemeString(String);\n\n/// The URL scheme for this HTTP endpoint.\n///\n/// [Scheme::HTTPS] will enable TLS termination at the ngrok edge.\n#[derive(Clone, Default, Eq, PartialEq)]\npub enum Scheme {\n /// The `http` URL scheme.\n HTTP,\n /// The `https` URL scheme.\n #[default]\n HTTPS,\n}\n\nimpl FromStr for Scheme {\n type Err = InvalidSchemeString;\n fn from_str(s: &str) -> Result {\n use Scheme::*;\n Ok(match s.to_uppercase().as_str() {\n \"HTTP\" => HTTP,\n \"HTTPS\" => HTTPS,\n _ => return Err(InvalidSchemeString(s.into())),\n })\n }\n}\n\n/// Restrictions placed on the origin of incoming connections to the edge.\n#[derive(Clone, Default)]\npub(crate) struct UaFilter {\n /// Rejects connections that do not match the given regular expression\n pub(crate) allow: Vec,\n /// Rejects connections that match the given regular expression and allows\n /// all other regular expressions.\n pub(crate) deny: Vec,\n}\n\nimpl UaFilter {\n pub(crate) fn allow(&mut self, allow: impl Into) {\n self.allow.push(allow.into());\n }\n pub(crate) fn deny(&mut self, deny: impl Into) {\n self.deny.push(deny.into());\n }\n}\n\nimpl From for UserAgentFilter {\n fn from(ua: UaFilter) -> Self {\n UserAgentFilter {\n allow: ua.allow,\n deny: ua.deny,\n }\n }\n}\n\n/// The options for a HTTP edge.\n#[derive(Default, Clone)]\nstruct HttpOptions {\n pub(crate) common_opts: CommonOpts,\n pub(crate) scheme: Scheme,\n pub(crate) domain: Option,\n pub(crate) mutual_tlsca: Vec,\n pub(crate) compression: bool,\n pub(crate) websocket_tcp_conversion: bool,\n pub(crate) circuit_breaker: f64,\n pub(crate) request_headers: Headers,\n pub(crate) response_headers: Headers,\n pub(crate) rewrite_host: bool,\n pub(crate) basic_auth: Vec<(String, String)>,\n pub(crate) oauth: Option,\n pub(crate) oidc: Option,\n pub(crate) webhook_verification: Option,\n // Flitering placed on the origin of incoming connections to the edge.\n pub(crate) user_agent_filter: UaFilter,\n pub(crate) bindings: Vec,\n}\n\nimpl HttpOptions {\n fn user_agent_filter(&self) -> Option {\n (!self.user_agent_filter.allow.is_empty() || !self.user_agent_filter.deny.is_empty())\n .then_some(self.user_agent_filter.clone().into())\n }\n}\n\nimpl TunnelConfig for HttpOptions {\n fn forwards_to(&self) -> String {\n self.common_opts\n .forwards_to\n .clone()\n .unwrap_or(default_forwards_to().into())\n }\n\n fn forwards_proto(&self) -> String {\n self.common_opts.forwards_proto.clone().unwrap_or_default()\n }\n\n fn verify_upstream_tls(&self) -> bool {\n self.common_opts.verify_upstream_tls()\n }\n\n fn extra(&self) -> BindExtra {\n BindExtra {\n token: Default::default(),\n ip_policy_ref: Default::default(),\n metadata: self.common_opts.metadata.clone().unwrap_or_default(),\n bindings: self.bindings.clone(),\n pooling_enabled: self.common_opts.pooling_enabled.unwrap_or(false),\n }\n }\n fn proto(&self) -> String {\n if self.scheme == Scheme::HTTP {\n return \"http\".into();\n }\n \"https\".into()\n }\n fn opts(&self) -> Option {\n let http_endpoint = HttpEndpoint {\n proxy_proto: self.common_opts.proxy_proto,\n domain: self.domain.clone().unwrap_or_default(),\n hostname: String::new(),\n compression: self.compression.then_some(Compression {}),\n circuit_breaker: (self.circuit_breaker != 0f64).then_some(CircuitBreaker {\n error_threshold: self.circuit_breaker,\n }),\n ip_restriction: self.common_opts.ip_restriction(),\n basic_auth: (!self.basic_auth.is_empty()).then_some(self.basic_auth.as_slice().into()),\n oauth: self.oauth.clone().map(From::from),\n oidc: self.oidc.clone().map(From::from),\n webhook_verification: self.webhook_verification.clone().map(From::from),\n mutual_tls_ca: (!self.mutual_tlsca.is_empty())\n .then_some(self.mutual_tlsca.as_slice().into()),\n request_headers: self\n .request_headers\n .has_entries()\n .then_some(self.request_headers.clone().into()),\n response_headers: self\n .response_headers\n .has_entries()\n .then_some(self.response_headers.clone().into()),\n websocket_tcp_converter: self\n .websocket_tcp_conversion\n .then_some(WebsocketTcpConverter {}),\n user_agent_filter: self.user_agent_filter(),\n traffic_policy: if self.common_opts.traffic_policy.is_some() {\n self.common_opts.traffic_policy.clone().map(From::from)\n } else if self.common_opts.policy.is_some() {\n self.common_opts.policy.clone().map(From::from)\n } else {\n None\n },\n ..Default::default()\n };\n\n Some(BindOpts::Http(http_endpoint))\n }\n fn labels(&self) -> HashMap {\n HashMap::new()\n }\n}\n\n// transform into the wire protocol format\nimpl From<&[(String, String)]> for BasicAuth {\n fn from(v: &[(String, String)]) -> Self {\n BasicAuth {\n credentials: v.iter().cloned().map(From::from).collect(),\n }\n }\n}\n\n// transform into the wire protocol format\nimpl From<(String, String)> for BasicAuthCredential {\n fn from(b: (String, String)) -> Self {\n BasicAuthCredential {\n username: b.0,\n cleartext_password: b.1,\n hashed_password: vec![], // unused in this context\n }\n }\n}\n\nimpl_builder! {\n /// A builder for a tunnel backing an HTTP endpoint.\n ///\n /// https://ngrok.com/docs/http/\n HttpTunnelBuilder, HttpOptions, HttpTunnel, endpoint\n}\n\nimpl HttpTunnelBuilder {\n /// Add the provided CIDR to the allowlist.\n ///\n /// https://ngrok.com/docs/http/ip-restrictions/\n pub fn allow_cidr(&mut self, cidr: impl Into) -> &mut Self {\n self.options.common_opts.cidr_restrictions.allow(cidr);\n self\n }\n /// Add the provided CIDR to the denylist.\n ///\n /// https://ngrok.com/docs/http/ip-restrictions/\n pub fn deny_cidr(&mut self, cidr: impl Into) -> &mut Self {\n self.options.common_opts.cidr_restrictions.deny(cidr);\n self\n }\n /// Sets the PROXY protocol version for connections over this tunnel.\n pub fn proxy_proto(&mut self, proxy_proto: ProxyProto) -> &mut Self {\n self.options.common_opts.proxy_proto = proxy_proto;\n self\n }\n /// Sets the opaque metadata string for this tunnel.\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn metadata(&mut self, metadata: impl Into) -> &mut Self {\n self.options.common_opts.metadata = Some(metadata.into());\n self\n }\n\n /// Sets the ingress configuration for this endpoint.\n ///\n /// Valid binding values are:\n /// - `\"public\"` - Publicly accessible endpoint\n /// - `\"internal\"` - Internal-only endpoint\n /// - `\"kubernetes\"` - Kubernetes cluster binding\n ///\n /// If not specified, the ngrok service will use its default binding configuration.\n ///\n /// # Panics\n ///\n /// Panics if called more than once or if an invalid binding value is provided.\n ///\n /// # Examples\n ///\n /// ```no_run\n /// # use ngrok::Session;\n /// # use ngrok::config::TunnelBuilder;\n /// # async fn example() -> Result<(), Box> {\n /// let session = Session::builder().authtoken_from_env().connect().await?;\n ///\n /// // Using string\n /// let tunnel = session.http_endpoint().binding(\"internal\").listen().await?;\n ///\n /// // Using typed enum\n /// use ngrok::config::Binding;\n /// let tunnel = session.http_endpoint().binding(Binding::Public).listen().await?;\n /// # Ok(())\n /// # }\n /// ```\n pub fn binding(&mut self, binding: impl Into) -> &mut Self {\n if !self.options.bindings.is_empty() {\n panic!(\"binding() can only be called once\");\n }\n let binding_str = binding.into();\n if let Err(e) = Binding::validate(&binding_str) {\n panic!(\"{}\", e);\n }\n self.options.bindings.push(binding_str);\n self\n }\n /// Sets the ForwardsTo string for this tunnel. This can be viewed via the\n /// API or dashboard.\n ///\n /// This overrides the default process info if using\n /// [TunnelBuilder::listen], and is in turn overridden by the url provided\n /// to [ForwarderBuilder::listen_and_forward].\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn forwards_to(&mut self, forwards_to: impl Into) -> &mut Self {\n self.options.common_opts.forwards_to = Some(forwards_to.into());\n self\n }\n\n /// Sets the L7 protocol for this tunnel.\n pub fn app_protocol(&mut self, app_protocol: impl Into) -> &mut Self {\n self.options.common_opts.forwards_proto = Some(app_protocol.into());\n self\n }\n\n /// Disables backend TLS certificate verification for forwards from this tunnel.\n pub fn verify_upstream_tls(&mut self, verify_upstream_tls: bool) -> &mut Self {\n self.options\n .common_opts\n .set_verify_upstream_tls(verify_upstream_tls);\n self\n }\n\n /// Sets the scheme for this edge.\n pub fn scheme(&mut self, scheme: Scheme) -> &mut Self {\n self.options.scheme = scheme;\n self\n }\n\n /// Sets the domain to request for this edge.\n ///\n /// https://ngrok.com/docs/network-edge/domains-and-tcp-addresses/#domains\n pub fn domain(&mut self, domain: impl Into) -> &mut Self {\n self.options.domain = Some(domain.into());\n self\n }\n /// Adds a certificate in PEM format to use for mutual TLS authentication.\n ///\n /// These will be used to authenticate client certificates for requests at\n /// the ngrok edge.\n ///\n /// https://ngrok.com/docs/http/mutual-tls/\n pub fn mutual_tlsca(&mut self, mutual_tlsca: Bytes) -> &mut Self {\n self.options.mutual_tlsca.push(mutual_tlsca);\n self\n }\n /// Enables gzip compression.\n ///\n /// https://ngrok.com/docs/http/compression/\n pub fn compression(&mut self) -> &mut Self {\n self.options.compression = true;\n self\n }\n /// Enables the websocket-to-tcp converter.\n ///\n /// https://ngrok.com/docs/http/websocket-tcp-converter/\n pub fn websocket_tcp_conversion(&mut self) -> &mut Self {\n self.options.websocket_tcp_conversion = true;\n self\n }\n /// Sets the 5XX response ratio at which the ngrok edge will stop sending\n /// requests to this tunnel.\n ///\n /// https://ngrok.com/docs/http/circuit-breaker/\n pub fn circuit_breaker(&mut self, circuit_breaker: f64) -> &mut Self {\n self.options.circuit_breaker = circuit_breaker;\n self\n }\n\n /// Automatically rewrite the host header to the one in the provided URL\n /// when calling [ForwarderBuilder::listen_and_forward]. Does nothing if\n /// using [TunnelBuilder::listen]. Defaults to `false`.\n ///\n /// If you need to set the host header to a specific value, use\n /// `cfg.request_header(\"host\", \"some.host.com\")` instead.\n pub fn host_header_rewrite(&mut self, rewrite: bool) -> &mut Self {\n self.options.rewrite_host = rewrite;\n self\n }\n\n /// Adds a header to all requests to this edge.\n ///\n /// https://ngrok.com/docs/http/request-headers/\n pub fn request_header(\n &mut self,\n name: impl Into,\n value: impl Into,\n ) -> &mut Self {\n self.options.request_headers.add(name, value);\n self\n }\n /// Adds a header to all responses coming from this edge.\n ///\n /// https://ngrok.com/docs/http/response-headers/\n pub fn response_header(\n &mut self,\n name: impl Into,\n value: impl Into,\n ) -> &mut Self {\n self.options.response_headers.add(name, value);\n self\n }\n /// Removes a header from requests to this edge.\n ///\n /// https://ngrok.com/docs/http/request-headers/\n pub fn remove_request_header(&mut self, name: impl Into) -> &mut Self {\n self.options.request_headers.remove(name);\n self\n }\n /// Removes a header from responses from this edge.\n ///\n /// https://ngrok.com/docs/http/response-headers/\n pub fn remove_response_header(&mut self, name: impl Into) -> &mut Self {\n self.options.response_headers.remove(name);\n self\n }\n\n /// Adds the provided credentials to the list of basic authentication\n /// credentials.\n ///\n /// https://ngrok.com/docs/http/basic-auth/\n pub fn basic_auth(\n &mut self,\n username: impl Into,\n password: impl Into,\n ) -> &mut Self {\n self.options\n .basic_auth\n .push((username.into(), password.into()));\n self\n }\n\n /// Set the OAuth configuraton for this edge.\n ///\n /// https://ngrok.com/docs/http/oauth/\n pub fn oauth(&mut self, oauth: impl Borrow) -> &mut Self {\n self.options.oauth = Some(oauth.borrow().to_owned());\n self\n }\n\n /// Set the OIDC configuration for this edge.\n ///\n /// https://ngrok.com/docs/http/openid-connect/\n pub fn oidc(&mut self, oidc: impl Borrow) -> &mut Self {\n self.options.oidc = Some(oidc.borrow().to_owned());\n self\n }\n\n /// Configures webhook verification for this edge.\n ///\n /// https://ngrok.com/docs/http/webhook-verification/\n pub fn webhook_verification(\n &mut self,\n provider: impl Into,\n secret: impl Into,\n ) -> &mut Self {\n self.options.webhook_verification = Some(WebhookVerification {\n provider: provider.into(),\n secret: secret.into().into(),\n });\n self\n }\n\n /// Add the provided regex to the allowlist.\n ///\n /// https://ngrok.com/docs/http/user-agent-filter/\n pub fn allow_user_agent(&mut self, regex: impl Into) -> &mut Self {\n self.options.user_agent_filter.allow(regex);\n self\n }\n /// Add the provided regex to the denylist.\n ///\n /// https://ngrok.com/docs/http/user-agent-filter/\n pub fn deny_user_agent(&mut self, regex: impl Into) -> &mut Self {\n self.options.user_agent_filter.deny(regex);\n self\n }\n\n /// DEPRECATED: use traffic_policy instead.\n pub fn policy(&mut self, s: S) -> Result<&mut Self, S::Error>\n where\n S: TryInto,\n {\n self.options.common_opts.policy = Some(s.try_into()?);\n Ok(self)\n }\n\n /// Set policy for this edge.\n pub fn traffic_policy(&mut self, policy_str: impl Into) -> &mut Self {\n self.options.common_opts.traffic_policy = Some(policy_str.into());\n self\n }\n\n pub(crate) async fn for_forwarding_to(&mut self, to_url: &Url) -> &mut Self {\n self.options.common_opts.for_forwarding_to(to_url);\n if let Some(host) = to_url.host_str().filter(|_| self.options.rewrite_host) {\n self.request_header(\"host\", host);\n }\n self\n }\n\n /// Allows the endpoint to pool with other endpoints with the same host/port/binding\n pub fn pooling_enabled(&mut self, pooling_enabled: impl Into) -> &mut Self {\n self.options.common_opts.pooling_enabled = Some(pooling_enabled.into());\n self\n }\n}\n\n#[cfg(test)]\nmod test {\n use super::*;\n use crate::config::policies::test::POLICY_JSON;\n const METADATA: &str = \"testmeta\";\n const TEST_FORWARD: &str = \"testforward\";\n const TEST_FORWARD_PROTO: &str = \"http2\";\n const ALLOW_CIDR: &str = \"0.0.0.0/0\";\n const DENY_CIDR: &str = \"10.1.1.1/32\";\n const CA_CERT: &[u8] = \"test ca cert\".as_bytes();\n const CA_CERT2: &[u8] = \"test ca cert2\".as_bytes();\n const DOMAIN: &str = \"test domain\";\n const ALLOW_AGENT: &str = r\"bar/(\\d)+\";\n const DENY_AGENT: &str = r\"foo/(\\d)+\";\n\n #[test]\n fn test_interface_to_proto() {\n // pass to a function accepting the trait to avoid\n // \"creates a temporary which is freed while still in use\"\n tunnel_test(\n &HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n }\n .allow_user_agent(ALLOW_AGENT)\n .deny_user_agent(DENY_AGENT)\n .allow_cidr(ALLOW_CIDR)\n .deny_cidr(DENY_CIDR)\n .proxy_proto(ProxyProto::V2)\n .metadata(METADATA)\n .scheme(Scheme::from_str(\"hTtPs\").unwrap())\n .domain(DOMAIN)\n .mutual_tlsca(CA_CERT.into())\n .mutual_tlsca(CA_CERT2.into())\n .compression()\n .websocket_tcp_conversion()\n .circuit_breaker(0.5)\n .request_header(\"X-Req-Yup\", \"true\")\n .response_header(\"X-Res-Yup\", \"true\")\n .remove_request_header(\"X-Req-Nope\")\n .remove_response_header(\"X-Res-Nope\")\n .oauth(OauthOptions::new(\"google\"))\n .oauth(\n OauthOptions::new(\"google\")\n .allow_email(\"@\")\n .allow_domain(\"\")\n .scope(\"\"),\n )\n .oidc(OidcOptions::new(\"\", \"\", \"\"))\n .oidc(\n OidcOptions::new(\"\", \"\", \"\")\n .allow_email(\"@\")\n .allow_domain(\"\")\n .scope(\"\"),\n )\n .webhook_verification(\"twilio\", \"asdf\")\n .basic_auth(\"ngrok\", \"online1line\")\n .forwards_to(TEST_FORWARD)\n .app_protocol(\"http2\")\n .policy(POLICY_JSON)\n .unwrap()\n .options,\n );\n }\n\n fn tunnel_test(tunnel_cfg: C)\n where\n C: TunnelConfig,\n {\n assert_eq!(TEST_FORWARD, tunnel_cfg.forwards_to());\n assert_eq!(TEST_FORWARD_PROTO, tunnel_cfg.forwards_proto());\n let extra = tunnel_cfg.extra();\n assert_eq!(String::default(), *extra.token);\n assert_eq!(METADATA, extra.metadata);\n assert_eq!(Vec::::new(), extra.bindings);\n assert_eq!(String::default(), extra.ip_policy_ref);\n\n assert_eq!(\"https\", tunnel_cfg.proto());\n\n let opts = tunnel_cfg.opts().unwrap();\n assert!(matches!(opts, BindOpts::Http { .. }));\n if let BindOpts::Http(endpoint) = opts {\n assert_eq!(DOMAIN, endpoint.domain);\n assert_eq!(String::default(), endpoint.subdomain);\n assert!(matches!(endpoint.proxy_proto, ProxyProto::V2));\n\n let ip_restriction = endpoint.ip_restriction.unwrap();\n assert_eq!(Vec::from([ALLOW_CIDR]), ip_restriction.allow_cidrs);\n assert_eq!(Vec::from([DENY_CIDR]), ip_restriction.deny_cidrs);\n\n let mutual_tls = endpoint.mutual_tls_ca.unwrap();\n let mut agg = CA_CERT.to_vec();\n agg.extend(CA_CERT2.to_vec());\n assert_eq!(agg, mutual_tls.mutual_tls_ca);\n\n assert!(endpoint.compression.is_some());\n assert!(endpoint.websocket_tcp_converter.is_some());\n assert_eq!(0.5f64, endpoint.circuit_breaker.unwrap().error_threshold);\n\n let request_headers = endpoint.request_headers.unwrap();\n assert_eq!([\"x-req-yup:true\"].to_vec(), request_headers.add);\n assert_eq!([\"x-req-nope\"].to_vec(), request_headers.remove);\n\n let response_headers = endpoint.response_headers.unwrap();\n assert_eq!([\"x-res-yup:true\"].to_vec(), response_headers.add);\n assert_eq!([\"x-res-nope\"].to_vec(), response_headers.remove);\n\n let webhook = endpoint.webhook_verification.unwrap();\n assert_eq!(\"twilio\", webhook.provider);\n assert_eq!(\"asdf\", *webhook.secret);\n assert!(webhook.sealed_secret.is_empty());\n\n let creds = endpoint.basic_auth.unwrap().credentials;\n assert_eq!(1, creds.len());\n assert_eq!(\"ngrok\", creds[0].username);\n assert_eq!(\"online1line\", creds[0].cleartext_password);\n assert!(creds[0].hashed_password.is_empty());\n\n let oauth = endpoint.oauth.unwrap();\n assert_eq!(\"google\", oauth.provider);\n assert_eq!([\"@\"].to_vec(), oauth.allow_emails);\n assert_eq!([\"\"].to_vec(), oauth.allow_domains);\n assert_eq!([\"\"].to_vec(), oauth.scopes);\n assert_eq!(String::default(), oauth.client_id);\n assert_eq!(String::default(), *oauth.client_secret);\n assert!(oauth.sealed_client_secret.is_empty());\n\n let oidc = endpoint.oidc.unwrap();\n assert_eq!(\"\", oidc.issuer_url);\n assert_eq!([\"@\"].to_vec(), oidc.allow_emails);\n assert_eq!([\"\"].to_vec(), oidc.allow_domains);\n assert_eq!([\"\"].to_vec(), oidc.scopes);\n assert_eq!(\"\", oidc.client_id);\n assert_eq!(\"\", *oidc.client_secret);\n assert!(oidc.sealed_client_secret.is_empty());\n\n let user_agent_filter = endpoint.user_agent_filter.unwrap();\n assert_eq!(Vec::from([ALLOW_AGENT]), user_agent_filter.allow);\n assert_eq!(Vec::from([DENY_AGENT]), user_agent_filter.deny);\n }\n\n assert_eq!(HashMap::new(), tunnel_cfg.labels());\n }\n\n #[test]\n fn test_binding_valid_values() {\n let mut builder = HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n\n // Test \"public\"\n builder.binding(\"public\");\n assert_eq!(vec![\"public\"], builder.options.bindings);\n\n // Test \"internal\"\n let mut builder = HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"internal\");\n assert_eq!(vec![\"internal\"], builder.options.bindings);\n\n // Test \"kubernetes\"\n let mut builder = HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"kubernetes\");\n assert_eq!(vec![\"kubernetes\"], builder.options.bindings);\n\n // Test with Binding enum\n let mut builder = HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(Binding::Internal);\n assert_eq!(vec![\"internal\"], builder.options.bindings);\n }\n\n #[test]\n #[should_panic(expected = \"Invalid binding value\")]\n fn test_binding_invalid_value() {\n let mut builder = HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"invalid\");\n }\n\n #[test]\n #[should_panic(expected = \"binding() can only be called once\")]\n fn test_binding_called_twice() {\n let mut builder = HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"public\");\n builder.binding(\"internal\");\n }\n\n #[test]\n fn test_binding_with_domain() {\n let mut builder = HttpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"internal\").domain(\"foo.internal\");\n\n // Check that both binding and domain are set\n assert_eq!(vec![\"internal\"], builder.options.bindings);\n assert_eq!(Some(\"foo.internal\".to_string()), builder.options.domain);\n\n // Check that they're properly included in extra() and opts()\n let extra = builder.options.extra();\n assert_eq!(vec![\"internal\"], extra.bindings);\n\n let opts = builder.options.opts().unwrap();\n if let BindOpts::Http(endpoint) = opts {\n assert_eq!(\"foo.internal\", endpoint.domain);\n } else {\n panic!(\"Expected Http endpoint\");\n }\n }\n}\n"
},
{
"path": "ngrok/src/config/labeled.rs",
"content": "use std::collections::HashMap;\n\nuse url::Url;\n\n// These are used for doc comment links.\n#[allow(unused_imports)]\nuse crate::config::{\n ForwarderBuilder,\n TunnelBuilder,\n};\nuse crate::{\n config::common::{\n default_forwards_to,\n CommonOpts,\n TunnelConfig,\n },\n internals::proto::{\n BindExtra,\n BindOpts,\n },\n tunnel::LabeledTunnel,\n Session,\n};\n\n/// Options for labeled tunnels.\n#[derive(Default, Clone)]\nstruct LabeledOptions {\n pub(crate) common_opts: CommonOpts,\n pub(crate) labels: HashMap,\n}\n\nimpl TunnelConfig for LabeledOptions {\n fn forwards_to(&self) -> String {\n self.common_opts\n .forwards_to\n .clone()\n .unwrap_or(default_forwards_to().into())\n }\n\n fn forwards_proto(&self) -> String {\n self.common_opts.forwards_proto.clone().unwrap_or_default()\n }\n\n fn verify_upstream_tls(&self) -> bool {\n self.common_opts.verify_upstream_tls()\n }\n\n fn extra(&self) -> BindExtra {\n BindExtra {\n token: Default::default(),\n ip_policy_ref: Default::default(),\n metadata: self.common_opts.metadata.clone().unwrap_or_default(),\n bindings: Vec::new(),\n pooling_enabled: self.common_opts.pooling_enabled.unwrap_or(false),\n }\n }\n fn proto(&self) -> String {\n \"\".into()\n }\n fn opts(&self) -> Option {\n None\n }\n fn labels(&self) -> HashMap {\n self.labels.clone()\n }\n}\n\nimpl_builder! {\n /// A builder for a labeled tunnel.\n LabeledTunnelBuilder, LabeledOptions, LabeledTunnel, edge\n}\n\nimpl LabeledTunnelBuilder {\n /// Sets the opaque metadata string for this tunnel.\n /// Viewable via the API.\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn metadata(&mut self, metadata: impl Into) -> &mut Self {\n self.options.common_opts.metadata = Some(metadata.into());\n self\n }\n\n /// Add a label, value pair for this tunnel.\n ///\n /// https://ngrok.com/docs/network-edge/edges/#tunnel-group\n pub fn label(&mut self, label: impl Into, value: impl Into) -> &mut Self {\n self.options.labels.insert(label.into(), value.into());\n self\n }\n\n /// Sets the ForwardsTo string for this tunnel. This can be viewed via the\n /// API or dashboard.\n ///\n /// This overrides the default process info if using\n /// [TunnelBuilder::listen], and is in turn overridden by the url provided\n /// to [ForwarderBuilder::listen_and_forward].\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn forwards_to(&mut self, forwards_to: impl Into) -> &mut Self {\n self.options.common_opts.forwards_to = forwards_to.into().into();\n self\n }\n\n /// Sets the L7 protocol string for this tunnel.\n pub fn app_protocol(&mut self, app_protocol: impl Into) -> &mut Self {\n self.options.common_opts.forwards_proto = Some(app_protocol.into());\n self\n }\n\n /// Disables backend TLS certificate verification for forwards from this tunnel.\n pub fn verify_upstream_tls(&mut self, verify_upstream_tls: bool) -> &mut Self {\n self.options\n .common_opts\n .set_verify_upstream_tls(verify_upstream_tls);\n self\n }\n\n pub(crate) async fn for_forwarding_to(&mut self, to_url: &Url) -> &mut Self {\n self.options.common_opts.for_forwarding_to(to_url);\n self\n }\n}\n\n#[cfg(test)]\nmod test {\n use super::*;\n\n const METADATA: &str = \"testmeta\";\n const LABEL_KEY: &str = \"edge\";\n const LABEL_VAL: &str = \"edghts_2IC6RJ6CQnuh7waciWyaGKc50Nt\";\n\n #[test]\n fn test_interface_to_proto() {\n // pass to a function accepting the trait to avoid\n // \"creates a temporary which is freed while still in use\"\n tunnel_test(\n &LabeledTunnelBuilder {\n session: None,\n options: Default::default(),\n }\n .metadata(METADATA)\n .label(LABEL_KEY, LABEL_VAL)\n .options,\n );\n }\n\n fn tunnel_test(tunnel_cfg: &C)\n where\n C: TunnelConfig,\n {\n assert_eq!(default_forwards_to(), tunnel_cfg.forwards_to());\n\n let extra = tunnel_cfg.extra();\n assert_eq!(String::default(), *extra.token);\n assert_eq!(METADATA, extra.metadata);\n assert_eq!(String::default(), extra.ip_policy_ref);\n\n assert_eq!(\"\", tunnel_cfg.proto());\n\n assert!(tunnel_cfg.opts().is_none());\n\n let mut labels: HashMap = HashMap::new();\n labels.insert(LABEL_KEY.into(), LABEL_VAL.into());\n assert_eq!(labels, tunnel_cfg.labels());\n }\n}\n"
},
{
"path": "ngrok/src/config/oauth.rs",
"content": "use crate::internals::proto::{\n Oauth,\n SecretString,\n};\n\n/// Oauth Options configuration\n///\n/// https://ngrok.com/docs/http/oauth/\n#[derive(Clone, Default)]\npub struct OauthOptions {\n /// The OAuth provider to use\n provider: String,\n\n /// The client ID, if a custom one is being used\n client_id: String,\n /// The client secret, if a custom one is being used\n client_secret: SecretString,\n\n /// Email addresses of users to authorize.\n allow_emails: Vec,\n /// Email domains of users to authorize.\n allow_domains: Vec,\n /// OAuth scopes to request from the provider.\n scopes: Vec,\n}\n\nimpl OauthOptions {\n /// Create a new [OauthOptions] for the given provider.\n pub fn new(provider: impl Into) -> Self {\n OauthOptions {\n provider: provider.into(),\n ..Default::default()\n }\n }\n\n /// Provide an OAuth client ID for custom apps.\n pub fn client_id(&mut self, id: impl Into) -> &mut Self {\n self.client_id = id.into();\n self\n }\n\n /// Provide an OAuth client secret for custom apps.\n pub fn client_secret(&mut self, secret: impl Into) -> &mut Self {\n self.client_secret = SecretString::from(secret.into());\n self\n }\n\n /// Append an email address to the list of allowed emails.\n pub fn allow_email(&mut self, email: impl Into) -> &mut Self {\n self.allow_emails.push(email.into());\n self\n }\n /// Append an email domain to the list of allowed domains.\n pub fn allow_domain(&mut self, domain: impl Into) -> &mut Self {\n self.allow_domains.push(domain.into());\n self\n }\n /// Append a scope to the list of scopes to request.\n pub fn scope(&mut self, scope: impl Into) -> &mut Self {\n self.scopes.push(scope.into());\n self\n }\n}\n\n// transform into the wire protocol format\nimpl From for Oauth {\n fn from(o: OauthOptions) -> Self {\n Oauth {\n provider: o.provider,\n client_id: o.client_id,\n client_secret: o.client_secret,\n sealed_client_secret: Default::default(), // unused in this context\n allow_emails: o.allow_emails,\n allow_domains: o.allow_domains,\n scopes: o.scopes,\n }\n }\n}\n"
},
{
"path": "ngrok/src/config/oidc.rs",
"content": "use crate::internals::proto::{\n Oidc,\n SecretString,\n};\n\n/// Oidc Options configuration\n///\n/// https://ngrok.com/docs/http/openid-connect/\n#[derive(Clone, Default)]\npub struct OidcOptions {\n issuer_url: String,\n client_id: String,\n client_secret: SecretString,\n allow_emails: Vec,\n allow_domains: Vec,\n scopes: Vec,\n}\n\nimpl OidcOptions {\n /// Create a new [OidcOptions] with the given issuer and client information.\n pub fn new(\n issuer_url: impl Into,\n client_id: impl Into,\n client_secret: impl Into,\n ) -> Self {\n OidcOptions {\n issuer_url: issuer_url.into(),\n client_id: client_id.into(),\n client_secret: client_secret.into().into(),\n ..Default::default()\n }\n }\n\n /// Allow the oidc user with the given email to access the tunnel.\n pub fn allow_email(&mut self, email: impl Into) -> &mut Self {\n self.allow_emails.push(email.into());\n self\n }\n /// Allow the oidc user with the given email domain to access the tunnel.\n pub fn allow_domain(&mut self, domain: impl Into) -> &mut Self {\n self.allow_domains.push(domain.into());\n self\n }\n /// Request the given scope from the oidc provider.\n pub fn scope(&mut self, scope: impl Into) -> &mut Self {\n self.scopes.push(scope.into());\n self\n }\n}\n\n// transform into the wire protocol format\nimpl From for Oidc {\n fn from(o: OidcOptions) -> Self {\n Oidc {\n issuer_url: o.issuer_url,\n client_id: o.client_id,\n client_secret: o.client_secret,\n sealed_client_secret: Default::default(), // unused in this context\n allow_emails: o.allow_emails,\n allow_domains: o.allow_domains,\n scopes: o.scopes,\n }\n }\n}\n"
},
{
"path": "ngrok/src/config/policies.rs",
"content": "use std::{\n fs::read_to_string,\n io,\n};\n\nuse serde::{\n Deserialize,\n Serialize,\n};\nuse thiserror::Error;\n\nuse crate::internals::proto;\n\n/// A policy that defines rules that should be applied to incoming or outgoing\n/// connections to the edge.\n#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq)]\n#[serde(default)]\npub struct Policy {\n inbound: Vec,\n outbound: Vec,\n}\n\n/// A policy rule that should be applied\n#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq)]\n#[serde(default)]\npub struct Rule {\n name: String,\n expressions: Vec,\n actions: Vec,\n}\n\n/// An action that should be taken if the rule matches\n#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq)]\n#[serde(default)]\npub struct Action {\n #[serde(rename = \"type\")]\n type_: String,\n config: Option,\n}\n\n/// Errors in creating or serializing Policies\n#[derive(Debug, Error)]\npub enum InvalidPolicy {\n /// Error representing an invalid string for a Policy\n #[error(\"failure to parse or generate policy\")]\n SerializationError(#[from] serde_json::Error),\n /// An error loading a Policy from a file\n #[error(\"failure to read policy file '{}'\", .1)]\n FileReadError(#[source] io::Error, String),\n}\n\nimpl Policy {\n /// Create a new empty [Policy] struct\n pub fn new() -> Self {\n Policy {\n ..Default::default()\n }\n }\n\n /// Create a new [Policy] from a json string\n fn from_json(json: impl AsRef) -> Result {\n serde_json::from_str(json.as_ref()).map_err(InvalidPolicy::SerializationError)\n }\n\n /// Create a new [Policy] from a json file\n pub fn from_file(json_file_path: impl AsRef) -> Result {\n Policy::from_json(\n read_to_string(json_file_path.as_ref()).map_err(|e| {\n InvalidPolicy::FileReadError(e, json_file_path.as_ref().to_string())\n })?,\n )\n }\n\n /// Convert [Policy] to json string\n pub fn to_json(&self) -> Result {\n serde_json::to_string(&self).map_err(InvalidPolicy::SerializationError)\n }\n\n /// Add an inbound policy\n pub fn add_inbound(&mut self, rule: impl Into) -> &mut Self {\n self.inbound.push(rule.into());\n self\n }\n\n /// Add an outbound policy\n pub fn add_outbound(&mut self, rule: impl Into) -> &mut Self {\n self.outbound.push(rule.into());\n self\n }\n}\n\nimpl TryFrom<&Policy> for Policy {\n type Error = InvalidPolicy;\n\n fn try_from(other: &Policy) -> Result {\n Ok(other.clone())\n }\n}\n\nimpl TryFrom> for Policy {\n type Error = InvalidPolicy;\n\n fn try_from(other: Result) -> Result {\n other\n }\n}\n\nimpl TryFrom<&str> for Policy {\n type Error = InvalidPolicy;\n\n fn try_from(other: &str) -> Result {\n Policy::from_json(other)\n }\n}\n\nimpl Rule {\n /// Create a new [Rule]\n pub fn new(name: impl Into) -> Self {\n Rule {\n name: name.into(),\n ..Default::default()\n }\n }\n\n /// Convert [Rule] to json string\n pub fn to_json(&self) -> Result {\n serde_json::to_string(&self).map_err(InvalidPolicy::SerializationError)\n }\n\n /// Add an expression\n pub fn add_expression(&mut self, expression: impl Into) -> &mut Self {\n self.expressions.push(expression.into());\n self\n }\n\n /// Add an action\n pub fn add_action(&mut self, action: Action) -> &mut Self {\n self.actions.push(action);\n self\n }\n}\n\nimpl From<&mut Rule> for Rule {\n fn from(other: &mut Rule) -> Self {\n other.to_owned()\n }\n}\n\nimpl Action {\n /// Create a new [Action]\n pub fn new(type_: impl Into, config: Option<&str>) -> Result {\n Ok(Action {\n type_: type_.into(),\n config: config\n .map(|c| serde_json::from_str(c).map_err(InvalidPolicy::SerializationError))\n .transpose()?,\n })\n }\n\n /// Convert [Action] to json string\n pub fn to_json(&self) -> Result {\n serde_json::to_string(&self).map_err(InvalidPolicy::SerializationError)\n }\n}\n\nimpl From for proto::PolicyWrapper {\n fn from(value: Policy) -> Self {\n proto::PolicyWrapper::Policy(value.into())\n }\n}\n\n// transform into the wire protocol format\nimpl From for proto::Policy {\n fn from(o: Policy) -> Self {\n proto::Policy {\n inbound: o.inbound.into_iter().map(|p| p.into()).collect(),\n outbound: o.outbound.into_iter().map(|p| p.into()).collect(),\n }\n }\n}\n\nimpl From for proto::Rule {\n fn from(p: Rule) -> Self {\n proto::Rule {\n name: p.name,\n expressions: p.expressions,\n actions: p.actions.into_iter().map(|a| a.into()).collect(),\n }\n }\n}\n\nimpl From for proto::Action {\n fn from(a: Action) -> Self {\n proto::Action {\n type_: a.type_,\n config: a\n .config\n .map(|c| c.to_string().into_bytes())\n .unwrap_or_default(),\n }\n }\n}\n\n#[cfg(test)]\npub(crate) mod test {\n use super::*;\n\n pub(crate) const POLICY_JSON: &str = r###\"\n {\"inbound\": [\n {\n \"name\": \"test_in\",\n \"expressions\": [\"req.Method == 'PUT'\"],\n \"actions\": [{\"type\": \"deny\"}]\n }\n ],\n \"outbound\": [\n {\n \"name\": \"test_out\",\n \"expressions\": [\"res.StatusCode == '200'\"],\n \"actions\": [{\"type\": \"custom-response\", \"config\": {\"status_code\":201}}]\n }\n ]}\n \"###;\n\n #[test]\n fn test_json_to_policy() {\n let policy: Policy = Policy::from_json(POLICY_JSON).unwrap();\n assert_eq!(1, policy.inbound.len());\n assert_eq!(1, policy.outbound.len());\n let inbound = &policy.inbound[0];\n let outbound = &policy.outbound[0];\n\n assert_eq!(\"test_in\", inbound.name);\n assert_eq!(1, inbound.expressions.len());\n assert_eq!(1, inbound.actions.len());\n assert_eq!(\"req.Method == 'PUT'\", inbound.expressions[0]);\n assert_eq!(\"deny\", inbound.actions[0].type_);\n assert_eq!(None, inbound.actions[0].config);\n\n assert_eq!(\"test_out\", outbound.name);\n assert_eq!(1, outbound.expressions.len());\n assert_eq!(1, outbound.actions.len());\n assert_eq!(\"res.StatusCode == '200'\", outbound.expressions[0]);\n assert_eq!(\"custom-response\", outbound.actions[0].type_);\n assert_eq!(\n \"{\\\"status_code\\\":201}\",\n outbound.actions[0].config.as_ref().unwrap().to_string()\n );\n }\n\n #[test]\n fn test_empty_json_to_policy() {\n let policy: Policy = Policy::from_json(\"{}\").unwrap();\n assert_eq!(0, policy.inbound.len());\n assert_eq!(0, policy.outbound.len());\n }\n\n #[test]\n fn test_policy_to_json() {\n let policy = Policy::from_json(POLICY_JSON).unwrap();\n let json = policy.to_json().unwrap();\n let policy2 = Policy::from_json(json).unwrap();\n assert_eq!(policy, policy2);\n }\n\n #[test]\n fn test_policy_to_json_error() {\n let error = Policy::from_json(\"asdf\").err().unwrap();\n assert!(matches!(error, InvalidPolicy::SerializationError { .. }));\n }\n\n #[test]\n fn test_rule_to_json() {\n let policy = Policy::from_json(POLICY_JSON).unwrap();\n let rule = &policy.outbound[0];\n let json = rule.to_json().unwrap();\n let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();\n let rule_map = parsed.as_object().unwrap();\n assert_eq!(\"test_out\", rule_map[\"name\"]);\n\n // expressions\n let expressions = rule_map[\"expressions\"].as_array().unwrap();\n assert_eq!(1, expressions.len());\n assert_eq!(\"res.StatusCode == '200'\", expressions[0]);\n\n // actions\n let actions = rule_map[\"actions\"].as_array().unwrap();\n assert_eq!(1, actions.len());\n assert_eq!(\"custom-response\", actions[0][\"type\"]);\n assert_eq!(201, actions[0][\"config\"][\"status_code\"]);\n }\n\n #[test]\n fn test_action_to_json() {\n let policy = Policy::from_json(POLICY_JSON).unwrap();\n let action = &policy.outbound[0].actions[0];\n let json = action.to_json().unwrap();\n let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();\n let action_map = parsed.as_object().unwrap();\n assert_eq!(\"custom-response\", action_map[\"type\"]);\n assert_eq!(201, action_map[\"config\"][\"status_code\"]);\n }\n\n #[test]\n fn test_builders() {\n let policy = Policy::from_json(POLICY_JSON).unwrap();\n let policy2 = Policy::new()\n .add_inbound(\n Rule::new(\"test_in\")\n .add_expression(\"req.Method == 'PUT'\")\n .add_action(Action::new(\"deny\", None).unwrap()),\n )\n .add_outbound(\n Rule::new(\"test_out\")\n .add_expression(\"res.StatusCode == '200'\")\n // .add_action(Action::new(\"deny\", \"\"))\n .add_action(\n Action::new(\"custom-response\", Some(\"{\\\"status_code\\\":201}\")).unwrap(),\n ),\n )\n .to_owned();\n assert_eq!(policy, policy2);\n }\n\n #[test]\n fn test_load_file() {\n let policy = Policy::from_json(POLICY_JSON).unwrap();\n let policy2 = Policy::from_file(\"assets/policy.json\").unwrap();\n assert_eq!(\"test_in\", policy2.inbound[0].name);\n assert_eq!(\"test_out\", policy2.outbound[0].name);\n assert_eq!(policy, policy2);\n }\n\n #[test]\n fn test_load_inbound_file() {\n let policy = Policy::from_file(\"assets/policy-inbound.json\").unwrap();\n assert_eq!(\"test_in\", policy.inbound[0].name);\n assert_eq!(0, policy.outbound.len());\n }\n\n #[test]\n fn test_load_file_error() {\n let error = Policy::from_file(\"assets/absent.json\").err().unwrap();\n assert!(matches!(error, InvalidPolicy::FileReadError { .. }));\n }\n}\n"
},
{
"path": "ngrok/src/config/tcp.rs",
"content": "use std::{\n collections::HashMap,\n convert::From,\n};\n\nuse url::Url;\n\nuse super::{\n common::ProxyProto,\n Policy,\n};\n// These are used for doc comment links.\n#[allow(unused_imports)]\nuse crate::config::{\n ForwarderBuilder,\n TunnelBuilder,\n};\nuse crate::{\n config::common::{\n default_forwards_to,\n Binding,\n CommonOpts,\n TunnelConfig,\n },\n internals::proto::{\n self,\n BindExtra,\n BindOpts,\n },\n tunnel::TcpTunnel,\n Session,\n};\n\n/// The options for a TCP edge.\n#[derive(Default, Clone)]\nstruct TcpOptions {\n pub(crate) common_opts: CommonOpts,\n pub(crate) remote_addr: Option,\n pub(crate) bindings: Vec,\n}\n\nimpl TunnelConfig for TcpOptions {\n fn forwards_to(&self) -> String {\n self.common_opts\n .forwards_to\n .clone()\n .unwrap_or(default_forwards_to().into())\n }\n fn extra(&self) -> BindExtra {\n BindExtra {\n token: Default::default(),\n ip_policy_ref: Default::default(),\n metadata: self.common_opts.metadata.clone().unwrap_or_default(),\n bindings: self.bindings.clone(),\n pooling_enabled: self.common_opts.pooling_enabled.unwrap_or(false),\n }\n }\n fn proto(&self) -> String {\n \"tcp\".into()\n }\n\n fn forwards_proto(&self) -> String {\n // not supported\n String::new()\n }\n\n fn verify_upstream_tls(&self) -> bool {\n self.common_opts.verify_upstream_tls()\n }\n\n fn opts(&self) -> Option {\n // fill out all the options, translating to proto here\n let mut tcp_endpoint = proto::TcpEndpoint::default();\n\n if let Some(remote_addr) = self.remote_addr.as_ref() {\n tcp_endpoint.addr = remote_addr.clone();\n }\n tcp_endpoint.proxy_proto = self.common_opts.proxy_proto;\n\n tcp_endpoint.ip_restriction = self.common_opts.ip_restriction();\n\n tcp_endpoint.traffic_policy = if self.common_opts.traffic_policy.is_some() {\n self.common_opts.traffic_policy.clone().map(From::from)\n } else if self.common_opts.policy.is_some() {\n self.common_opts.policy.clone().map(From::from)\n } else {\n None\n };\n Some(BindOpts::Tcp(tcp_endpoint))\n }\n fn labels(&self) -> HashMap {\n HashMap::new()\n }\n}\n\nimpl_builder! {\n /// A builder for a tunnel backing a TCP endpoint.\n ///\n /// https://ngrok.com/docs/tcp/\n TcpTunnelBuilder, TcpOptions, TcpTunnel, endpoint\n}\n\n/// The options for a TCP edge.\nimpl TcpTunnelBuilder {\n /// Add the provided CIDR to the allowlist.\n ///\n /// https://ngrok.com/docs/tcp/ip-restrictions/\n pub fn allow_cidr(&mut self, cidr: impl Into) -> &mut Self {\n self.options.common_opts.cidr_restrictions.allow(cidr);\n self\n }\n /// Add the provided CIDR to the denylist.\n ///\n /// https://ngrok.com/docs/tcp/ip-restrictions/\n pub fn deny_cidr(&mut self, cidr: impl Into) -> &mut Self {\n self.options.common_opts.cidr_restrictions.deny(cidr);\n self\n }\n /// Sets the PROXY protocol version for connections over this tunnel.\n pub fn proxy_proto(&mut self, proxy_proto: ProxyProto) -> &mut Self {\n self.options.common_opts.proxy_proto = proxy_proto;\n self\n }\n /// Sets the opaque metadata string for this tunnel.\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn metadata(&mut self, metadata: impl Into) -> &mut Self {\n self.options.common_opts.metadata = Some(metadata.into());\n self\n }\n\n /// Sets the ingress configuration for this endpoint.\n ///\n /// Valid binding values are:\n /// - `\"public\"` - Publicly accessible endpoint\n /// - `\"internal\"` - Internal-only endpoint\n /// - `\"kubernetes\"` - Kubernetes cluster binding\n ///\n /// If not specified, the ngrok service will use its default binding configuration.\n ///\n /// # Panics\n ///\n /// Panics if called more than once or if an invalid binding value is provided.\n ///\n /// # Examples\n ///\n /// ```no_run\n /// # use ngrok::Session;\n /// # use ngrok::config::TunnelBuilder;\n /// # async fn example() -> Result<(), Box> {\n /// let session = Session::builder().authtoken_from_env().connect().await?;\n ///\n /// // Using string\n /// let tunnel = session.tcp_endpoint().binding(\"internal\").listen().await?;\n ///\n /// // Using typed enum\n /// use ngrok::config::Binding;\n /// let tunnel = session.tcp_endpoint().binding(Binding::Public).listen().await?;\n /// # Ok(())\n /// # }\n /// ```\n pub fn binding(&mut self, binding: impl Into) -> &mut Self {\n if !self.options.bindings.is_empty() {\n panic!(\"binding() can only be called once\");\n }\n let binding_str = binding.into();\n if let Err(e) = Binding::validate(&binding_str) {\n panic!(\"{}\", e);\n }\n self.options.bindings.push(binding_str);\n self\n }\n /// Sets the ForwardsTo string for this tunnel. This can be viewed via the\n /// API or dashboard.\n ///\n /// This overrides the default process info if using\n /// [TunnelBuilder::listen], and is in turn overridden by the url provided\n /// to [ForwarderBuilder::listen_and_forward].\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn forwards_to(&mut self, forwards_to: impl Into) -> &mut Self {\n self.options.common_opts.forwards_to = Some(forwards_to.into());\n self\n }\n\n /// Disables backend TLS certificate verification for forwards from this tunnel.\n pub fn verify_upstream_tls(&mut self, verify_upstream_tls: bool) -> &mut Self {\n self.options\n .common_opts\n .set_verify_upstream_tls(verify_upstream_tls);\n self\n }\n\n /// Sets the TCP address to request for this edge.\n ///\n /// https://ngrok.com/docs/network-edge/domains-and-tcp-addresses/#tcp-addresses\n pub fn remote_addr(&mut self, remote_addr: impl Into) -> &mut Self {\n self.options.remote_addr = Some(remote_addr.into());\n self\n }\n\n /// DEPRECATED: use traffic_policy instead.\n pub fn policy(&mut self, s: S) -> Result<&mut Self, S::Error>\n where\n S: TryInto,\n {\n self.options.common_opts.policy = Some(s.try_into()?);\n Ok(self)\n }\n\n /// Set policy for this edge.\n pub fn traffic_policy(&mut self, policy_str: impl Into) -> &mut Self {\n self.options.common_opts.traffic_policy = Some(policy_str.into());\n self\n }\n\n pub(crate) async fn for_forwarding_to(&mut self, to_url: &Url) -> &mut Self {\n self.options.common_opts.for_forwarding_to(to_url);\n self\n }\n\n /// Allows the endpoint to pool with other endpoints with the same host/port/binding\n pub fn pooling_enabled(&mut self, pooling_enabled: impl Into) -> &mut Self {\n self.options.common_opts.pooling_enabled = Some(pooling_enabled.into());\n self\n }\n}\n\n#[cfg(test)]\nmod test {\n use super::*;\n use crate::config::policies::test::POLICY_JSON;\n const METADATA: &str = \"testmeta\";\n const TEST_FORWARD: &str = \"testforward\";\n const REMOTE_ADDR: &str = \"4.tcp.ngrok.io:1337\";\n const ALLOW_CIDR: &str = \"0.0.0.0/0\";\n const DENY_CIDR: &str = \"10.1.1.1/32\";\n\n #[test]\n fn test_interface_to_proto() {\n // pass to a function accepting the trait to avoid\n // \"creates a temporary which is freed while still in use\"\n tunnel_test(\n &TcpTunnelBuilder {\n session: None,\n options: Default::default(),\n }\n .allow_cidr(ALLOW_CIDR)\n .deny_cidr(DENY_CIDR)\n .proxy_proto(ProxyProto::V2)\n .metadata(METADATA)\n .remote_addr(REMOTE_ADDR)\n .forwards_to(TEST_FORWARD)\n .policy(POLICY_JSON)\n .unwrap()\n .options,\n );\n }\n\n fn tunnel_test(tunnel_cfg: &C)\n where\n C: TunnelConfig,\n {\n assert_eq!(TEST_FORWARD, tunnel_cfg.forwards_to());\n\n let extra = tunnel_cfg.extra();\n assert_eq!(String::default(), *extra.token);\n assert_eq!(METADATA, extra.metadata);\n assert_eq!(Vec::::new(), extra.bindings);\n assert_eq!(String::default(), extra.ip_policy_ref);\n\n assert_eq!(\"tcp\", tunnel_cfg.proto());\n\n let opts = tunnel_cfg.opts().unwrap();\n assert!(matches!(opts, BindOpts::Tcp { .. }));\n if let BindOpts::Tcp(endpoint) = opts {\n assert_eq!(REMOTE_ADDR, endpoint.addr);\n assert!(matches!(endpoint.proxy_proto, ProxyProto::V2));\n\n let ip_restriction = endpoint.ip_restriction.unwrap();\n assert_eq!(Vec::from([ALLOW_CIDR]), ip_restriction.allow_cidrs);\n assert_eq!(Vec::from([DENY_CIDR]), ip_restriction.deny_cidrs);\n }\n\n assert_eq!(HashMap::new(), tunnel_cfg.labels());\n }\n\n #[test]\n fn test_binding_valid_values() {\n let mut builder = TcpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n\n // Test \"public\"\n builder.binding(\"public\");\n assert_eq!(vec![\"public\"], builder.options.bindings);\n\n // Test \"internal\"\n let mut builder = TcpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"internal\");\n assert_eq!(vec![\"internal\"], builder.options.bindings);\n\n // Test \"kubernetes\"\n let mut builder = TcpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"kubernetes\");\n assert_eq!(vec![\"kubernetes\"], builder.options.bindings);\n\n // Test with Binding enum\n let mut builder = TcpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(Binding::Public);\n assert_eq!(vec![\"public\"], builder.options.bindings);\n }\n\n #[test]\n #[should_panic(expected = \"Invalid binding value\")]\n fn test_binding_invalid_value() {\n let mut builder = TcpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"invalid\");\n }\n\n #[test]\n #[should_panic(expected = \"binding() can only be called once\")]\n fn test_binding_called_twice() {\n let mut builder = TcpTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"public\");\n builder.binding(\"internal\");\n }\n}\n"
},
{
"path": "ngrok/src/config/tls.rs",
"content": "use std::collections::HashMap;\n\nuse bytes::Bytes;\nuse url::Url;\n\nuse super::{\n common::ProxyProto,\n Policy,\n};\n// These are used for doc comment links.\n#[allow(unused_imports)]\nuse crate::config::{\n ForwarderBuilder,\n TunnelBuilder,\n};\nuse crate::{\n config::common::{\n default_forwards_to,\n Binding,\n CommonOpts,\n TunnelConfig,\n },\n internals::proto::{\n self,\n BindExtra,\n BindOpts,\n TlsTermination,\n },\n tunnel::TlsTunnel,\n Session,\n};\n\n/// The options for TLS edges.\n#[derive(Default, Clone)]\nstruct TlsOptions {\n pub(crate) common_opts: CommonOpts,\n pub(crate) domain: Option,\n pub(crate) mutual_tlsca: Vec,\n pub(crate) key_pem: Option,\n pub(crate) cert_pem: Option,\n pub(crate) bindings: Vec,\n}\n\nimpl TunnelConfig for TlsOptions {\n fn forwards_to(&self) -> String {\n self.common_opts\n .forwards_to\n .clone()\n .unwrap_or(default_forwards_to().into())\n }\n\n fn forwards_proto(&self) -> String {\n // not supported\n String::new()\n }\n\n fn verify_upstream_tls(&self) -> bool {\n self.common_opts.verify_upstream_tls()\n }\n\n fn extra(&self) -> BindExtra {\n BindExtra {\n token: Default::default(),\n ip_policy_ref: Default::default(),\n metadata: self.common_opts.metadata.clone().unwrap_or_default(),\n bindings: self.bindings.clone(),\n pooling_enabled: self.common_opts.pooling_enabled.unwrap_or(false),\n }\n }\n fn proto(&self) -> String {\n \"tls\".into()\n }\n\n fn opts(&self) -> Option {\n // fill out all the options, translating to proto here\n let mut tls_endpoint = proto::TlsEndpoint::default();\n\n if let Some(domain) = self.domain.as_ref() {\n tls_endpoint.domain = domain.clone();\n }\n tls_endpoint.proxy_proto = self.common_opts.proxy_proto;\n\n // doing some backflips to check both cert_pem and key_pem are set, and avoid unwrapping\n let tls_termination = self\n .cert_pem\n .as_ref()\n .zip(self.key_pem.as_ref())\n .map(|(c, k)| TlsTermination {\n cert: c.to_vec(),\n key: k.to_vec().into(),\n sealed_key: Vec::new(),\n });\n\n tls_endpoint.ip_restriction = self.common_opts.ip_restriction();\n tls_endpoint.mutual_tls_at_edge =\n (!self.mutual_tlsca.is_empty()).then_some(self.mutual_tlsca.as_slice().into());\n tls_endpoint.tls_termination = tls_termination;\n tls_endpoint.traffic_policy = if self.common_opts.traffic_policy.is_some() {\n self.common_opts.traffic_policy.clone().map(From::from)\n } else if self.common_opts.policy.is_some() {\n self.common_opts.policy.clone().map(From::from)\n } else {\n None\n };\n Some(BindOpts::Tls(tls_endpoint))\n }\n fn labels(&self) -> HashMap {\n HashMap::new()\n }\n}\n\nimpl_builder! {\n /// A builder for a tunnel backing a TCP endpoint.\n ///\n /// https://ngrok.com/docs/tls/\n TlsTunnelBuilder, TlsOptions, TlsTunnel, endpoint\n}\n\nimpl TlsTunnelBuilder {\n /// Add the provided CIDR to the allowlist.\n ///\n /// https://ngrok.com/docs/tls/ip-restrictions/\n pub fn allow_cidr(&mut self, cidr: impl Into) -> &mut Self {\n self.options.common_opts.cidr_restrictions.allow(cidr);\n self\n }\n /// Add the provided CIDR to the denylist.\n ///\n /// https://ngrok.com/docs/tls/ip-restrictions/\n pub fn deny_cidr(&mut self, cidr: impl Into) -> &mut Self {\n self.options.common_opts.cidr_restrictions.deny(cidr);\n self\n }\n /// Sets the PROXY protocol version for connections over this tunnel.\n pub fn proxy_proto(&mut self, proxy_proto: ProxyProto) -> &mut Self {\n self.options.common_opts.proxy_proto = proxy_proto;\n self\n }\n /// Sets the opaque metadata string for this tunnel.\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn metadata(&mut self, metadata: impl Into) -> &mut Self {\n self.options.common_opts.metadata = Some(metadata.into());\n self\n }\n\n /// Sets the ingress configuration for this endpoint.\n ///\n /// Valid binding values are:\n /// - `\"public\"` - Publicly accessible endpoint\n /// - `\"internal\"` - Internal-only endpoint\n /// - `\"kubernetes\"` - Kubernetes cluster binding\n ///\n /// If not specified, the ngrok service will use its default binding configuration.\n ///\n /// # Panics\n ///\n /// Panics if called more than once or if an invalid binding value is provided.\n ///\n /// # Examples\n ///\n /// ```no_run\n /// # use ngrok::Session;\n /// # use ngrok::config::TunnelBuilder;\n /// # async fn example() -> Result<(), Box> {\n /// let session = Session::builder().authtoken_from_env().connect().await?;\n ///\n /// // Using string\n /// let tunnel = session.tls_endpoint().binding(\"internal\").listen().await?;\n ///\n /// // Using typed enum\n /// use ngrok::config::Binding;\n /// let tunnel = session.tls_endpoint().binding(Binding::Public).listen().await?;\n /// # Ok(())\n /// # }\n /// ```\n pub fn binding(&mut self, binding: impl Into) -> &mut Self {\n if !self.options.bindings.is_empty() {\n panic!(\"binding() can only be called once\");\n }\n let binding_str = binding.into();\n if let Err(e) = Binding::validate(&binding_str) {\n panic!(\"{}\", e);\n }\n self.options.bindings.push(binding_str);\n self\n }\n /// Sets the ForwardsTo string for this tunnel. This can be viewed via the\n /// API or dashboard.\n ///\n /// This overrides the default process info if using\n /// [TunnelBuilder::listen], and is in turn overridden by the url provided\n /// to [ForwarderBuilder::listen_and_forward].\n ///\n /// https://ngrok.com/docs/api/resources/tunnels/#tunnel-fields\n pub fn forwards_to(&mut self, forwards_to: impl Into) -> &mut Self {\n self.options.common_opts.forwards_to = Some(forwards_to.into());\n self\n }\n\n /// Disables backend TLS certificate verification for forwards from this tunnel.\n pub fn verify_upstream_tls(&mut self, verify_upstream_tls: bool) -> &mut Self {\n self.options\n .common_opts\n .set_verify_upstream_tls(verify_upstream_tls);\n self\n }\n\n /// Sets the domain to request for this edge.\n ///\n /// https://ngrok.com/docs/network-edge/domains-and-tcp-addresses/#domains\n pub fn domain(&mut self, domain: impl Into) -> &mut Self {\n self.options.domain = Some(domain.into());\n self\n }\n\n /// Adds a certificate in PEM format to use for mutual TLS authentication.\n ///\n /// These will be used to authenticate client certificates for requests at\n /// the ngrok edge.\n ///\n /// https://ngrok.com/docs/tls/mutual-tls/\n pub fn mutual_tlsca(&mut self, mutual_tlsca: Bytes) -> &mut Self {\n self.options.mutual_tlsca.push(mutual_tlsca);\n self\n }\n\n /// Sets the key and certificate in PEM format for TLS termination at the\n /// ngrok edge.\n ///\n /// https://ngrok.com/docs/tls/tls-termination/\n pub fn termination(&mut self, cert_pem: Bytes, key_pem: Bytes) -> &mut Self {\n self.options.key_pem = Some(key_pem);\n self.options.cert_pem = Some(cert_pem);\n self\n }\n\n /// DEPRECATED: use traffic_policy instead.\n pub fn policy(&mut self, s: S) -> Result<&mut Self, S::Error>\n where\n S: TryInto,\n {\n self.options.common_opts.policy = Some(s.try_into()?);\n Ok(self)\n }\n\n /// Set policy for this edge.\n pub fn traffic_policy(&mut self, policy_str: impl Into) -> &mut Self {\n self.options.common_opts.traffic_policy = Some(policy_str.into());\n self\n }\n\n pub(crate) async fn for_forwarding_to(&mut self, to_url: &Url) -> &mut Self {\n self.options.common_opts.for_forwarding_to(to_url);\n self\n }\n\n /// Allows the endpoint to pool with other endpoints with the same host/port/binding\n pub fn pooling_enabled(&mut self, pooling_enabled: impl Into) -> &mut Self {\n self.options.common_opts.pooling_enabled = Some(pooling_enabled.into());\n self\n }\n}\n\n#[cfg(test)]\nmod test {\n use super::*;\n use crate::config::policies::test::POLICY_JSON;\n\n const METADATA: &str = \"testmeta\";\n const TEST_FORWARD: &str = \"testforward\";\n const ALLOW_CIDR: &str = \"0.0.0.0/0\";\n const DENY_CIDR: &str = \"10.1.1.1/32\";\n const CA_CERT: &[u8] = \"test ca cert\".as_bytes();\n const CA_CERT2: &[u8] = \"test ca cert2\".as_bytes();\n const KEY: &[u8] = \"test cert\".as_bytes();\n const CERT: &[u8] = \"test cert\".as_bytes();\n const DOMAIN: &str = \"test domain\";\n\n #[test]\n fn test_interface_to_proto() {\n // pass to a function accepting the trait to avoid\n // \"creates a temporary which is freed while still in use\"\n tunnel_test(\n &TlsTunnelBuilder {\n session: None,\n options: Default::default(),\n }\n .allow_cidr(ALLOW_CIDR)\n .deny_cidr(DENY_CIDR)\n .proxy_proto(ProxyProto::V2)\n .metadata(METADATA)\n .domain(DOMAIN)\n .mutual_tlsca(CA_CERT.into())\n .mutual_tlsca(CA_CERT2.into())\n .termination(CERT.into(), KEY.into())\n .forwards_to(TEST_FORWARD)\n .policy(POLICY_JSON)\n .unwrap()\n .options,\n );\n }\n\n fn tunnel_test(tunnel_cfg: C)\n where\n C: TunnelConfig,\n {\n assert_eq!(TEST_FORWARD, tunnel_cfg.forwards_to());\n\n let extra = tunnel_cfg.extra();\n assert_eq!(String::default(), *extra.token);\n assert_eq!(METADATA, extra.metadata);\n assert_eq!(Vec::::new(), extra.bindings);\n assert_eq!(String::default(), extra.ip_policy_ref);\n\n assert_eq!(\"tls\", tunnel_cfg.proto());\n\n let opts = tunnel_cfg.opts().unwrap();\n assert!(matches!(opts, BindOpts::Tls { .. }));\n if let BindOpts::Tls(endpoint) = opts {\n assert_eq!(DOMAIN, endpoint.domain);\n assert_eq!(String::default(), endpoint.subdomain);\n assert!(matches!(endpoint.proxy_proto, ProxyProto::V2));\n assert!(!endpoint.mutual_tls_at_agent);\n\n let ip_restriction = endpoint.ip_restriction.unwrap();\n assert_eq!(Vec::from([ALLOW_CIDR]), ip_restriction.allow_cidrs);\n assert_eq!(Vec::from([DENY_CIDR]), ip_restriction.deny_cidrs);\n\n let tls_termination = endpoint.tls_termination.unwrap();\n assert_eq!(CERT, tls_termination.cert);\n assert_eq!(KEY, *tls_termination.key);\n assert!(tls_termination.sealed_key.is_empty());\n\n let mutual_tls = endpoint.mutual_tls_at_edge.unwrap();\n let mut agg = CA_CERT.to_vec();\n agg.extend(CA_CERT2.to_vec());\n assert_eq!(agg, mutual_tls.mutual_tls_ca);\n }\n\n assert_eq!(HashMap::new(), tunnel_cfg.labels());\n }\n\n #[test]\n fn test_binding_valid_values() {\n let mut builder = TlsTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n\n // Test \"public\"\n builder.binding(\"public\");\n assert_eq!(vec![\"public\"], builder.options.bindings);\n\n // Test \"internal\"\n let mut builder = TlsTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"internal\");\n assert_eq!(vec![\"internal\"], builder.options.bindings);\n\n // Test \"kubernetes\"\n let mut builder = TlsTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"kubernetes\");\n assert_eq!(vec![\"kubernetes\"], builder.options.bindings);\n\n // Test with Binding enum\n let mut builder = TlsTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(Binding::Kubernetes);\n assert_eq!(vec![\"kubernetes\"], builder.options.bindings);\n }\n\n #[test]\n #[should_panic(expected = \"Invalid binding value\")]\n fn test_binding_invalid_value() {\n let mut builder = TlsTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"invalid\");\n }\n\n #[test]\n #[should_panic(expected = \"binding() can only be called once\")]\n fn test_binding_called_twice() {\n let mut builder = TlsTunnelBuilder {\n session: None,\n options: Default::default(),\n };\n builder.binding(\"public\");\n builder.binding(\"internal\");\n }\n}\n"
},
{
"path": "ngrok/src/config/webhook_verification.rs",
"content": "use crate::internals::proto::{\n SecretString,\n WebhookVerification as WebhookProto,\n};\n\n/// Configuration for webhook verification.\n#[derive(Clone)]\npub(crate) struct WebhookVerification {\n /// The webhook provider\n pub(crate) provider: String,\n /// The secret for verifying webhooks from this provider.\n pub(crate) secret: SecretString,\n}\n\nimpl WebhookVerification {}\n\n// transform into the wire protocol format\nimpl From for WebhookProto {\n fn from(wv: WebhookVerification) -> Self {\n WebhookProto {\n provider: wv.provider,\n secret: wv.secret,\n sealed_secret: vec![], // unused in this context\n }\n }\n}\n"
},
{
"path": "ngrok/src/conn.rs",
"content": "use std::{\n net::SocketAddr,\n pin::Pin,\n task::{\n Context,\n Poll,\n },\n};\n\n// Support for axum's connection info trait.\n#[cfg(feature = \"axum\")]\nuse axum::extract::connect_info::Connected;\n#[cfg(feature = \"hyper\")]\nuse hyper::rt::{\n Read as HyperRead,\n Write as HyperWrite,\n};\nuse muxado::typed::TypedStream;\nuse tokio::io::{\n AsyncRead,\n AsyncWrite,\n};\n\nuse crate::{\n config::ProxyProto,\n internals::proto::{\n EdgeType,\n ProxyHeader,\n },\n};\n/// A connection from an ngrok tunnel.\n///\n/// This implements [AsyncRead]/[AsyncWrite], as well as providing access to the\n/// address from which the connection to the ngrok edge originated.\npub(crate) struct ConnInner {\n pub(crate) info: Info,\n pub(crate) stream: TypedStream,\n}\n\n#[derive(Clone)]\npub(crate) struct Info {\n pub(crate) header: ProxyHeader,\n pub(crate) remote_addr: SocketAddr,\n pub(crate) proxy_proto: ProxyProto,\n pub(crate) app_protocol: Option,\n pub(crate) verify_upstream_tls: bool,\n}\n\nimpl ConnInfo for Info {\n fn remote_addr(&self) -> SocketAddr {\n self.remote_addr\n }\n}\n\nimpl EdgeConnInfo for Info {\n fn edge_type(&self) -> EdgeType {\n self.header.edge_type\n }\n fn passthrough_tls(&self) -> bool {\n self.header.passthrough_tls\n }\n}\n\nimpl EndpointConnInfo for Info {\n fn proto(&self) -> &str {\n self.header.proto.as_str()\n }\n}\n\n// This codgen indirect is required to make the hyper io trait bounds\n// dependent on the hyper feature. You can't put a #[cfg] on a single bound, so\n// we're putting the whole trait def in a macro. Gross, but gets the job done.\nmacro_rules! conn_trait {\n ($($hyper_bound:tt)*) => {\n\t\t/// An incoming connection over an ngrok tunnel.\n\t\t/// Effectively a trait alias for async read+write, plus connection info.\n\t\tpub trait Conn: ConnInfo + AsyncRead + AsyncWrite $($hyper_bound)* + Unpin + Send + 'static {}\n\t}\n}\n\n#[cfg(not(feature = \"hyper\"))]\nconn_trait!();\n\n#[cfg(feature = \"hyper\")]\nconn_trait! {\n + hyper::rt::Read + hyper::rt::Write\n}\n\n/// Information common to all ngrok connections.\npub trait ConnInfo {\n /// Returns the client address that initiated the connection to the ngrok\n /// edge.\n fn remote_addr(&self) -> SocketAddr;\n}\n\n/// Information about connections via ngrok edges.\npub trait EdgeConnInfo {\n /// Returns the edge type for this connection.\n fn edge_type(&self) -> EdgeType;\n /// Returns whether the connection includes the tls handshake and encrypted\n /// stream.\n fn passthrough_tls(&self) -> bool;\n}\n\n/// Information about connections via ngrok endpoints.\npub trait EndpointConnInfo {\n /// Returns the endpoint protocol.\n fn proto(&self) -> &str;\n}\n\nmacro_rules! make_conn_type {\n\t(info EdgeConnInfo, $wrapper:tt) => {\n\t\timpl EdgeConnInfo for $wrapper {\n\t\t\tfn edge_type(&self) -> EdgeType {\n\t\t\t\tself.inner.info.edge_type()\n\t\t\t}\n\t\t\tfn passthrough_tls(&self) -> bool {\n\t\t\t\tself.inner.info.passthrough_tls()\n\t\t\t}\n\t\t}\n\t};\n\t(info EndpointConnInfo, $wrapper:tt) => {\n\t\timpl EndpointConnInfo for $wrapper {\n\t\t\tfn proto(&self) -> &str {\n\t\t\t\tself.inner.info.proto()\n\t\t\t}\n\t\t}\n\t};\n ($(#[$outer:meta])* $wrapper:ident, $($m:tt),*) => {\n $(#[$outer])*\n pub struct $wrapper {\n pub(crate) inner: ConnInner,\n }\n\n impl Conn for $wrapper {}\n\n impl ConnInfo for $wrapper {\n\t\t\tfn remote_addr(&self) -> SocketAddr {\n\t\t\t\tself.inner.info.remote_addr()\n\t\t\t}\n }\n\n\t\timpl AsyncRead for $wrapper {\n\t\t\tfn poll_read(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t\tbuf: &mut tokio::io::ReadBuf<'_>,\n\t\t\t) -> Poll> {\n\t\t\t\tPin::new(&mut *self.inner.stream).poll_read(cx, buf)\n\t\t\t}\n\t\t}\n\n\t\t#[cfg(feature = \"hyper\")]\n\t\timpl HyperRead for $wrapper {\n\t\t\tfn poll_read(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t\tmut buf: hyper::rt::ReadBufCursor<'_>,\n\t\t\t) -> Poll> {\n\t\t\t\tlet mut tokio_buf = tokio::io::ReadBuf::uninit(unsafe{ buf.as_mut() });\n\t\t\t\tlet res = std::task::ready!(Pin::new(&mut *self.inner.stream).poll_read(cx, &mut tokio_buf));\n\t\t\t\tlet filled = tokio_buf.filled().len();\n\t\t\t\tunsafe { buf.advance(filled) };\n\t\t\t\tPoll::Ready(res)\n\t\t\t}\n\t\t}\n\n\t\t#[cfg(feature = \"hyper\")]\n\t\timpl HyperWrite for $wrapper {\n\t\t\tfn poll_write(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t\tbuf: &[u8],\n\t\t\t) -> Poll> {\n\t\t\t\tPin::new(&mut *self.inner.stream).poll_write(cx, buf)\n\t\t\t}\n\t\t\tfn poll_flush(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t) -> Poll> {\n\t\t\t\tPin::new(&mut *self.inner.stream).poll_flush(cx)\n\t\t\t}\n\t\t\tfn poll_shutdown(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t) -> Poll> {\n\t\t\t\tPin::new(&mut *self.inner.stream).poll_shutdown(cx)\n\t\t\t}\n\t\t}\n\n\t\timpl AsyncWrite for $wrapper {\n\t\t\tfn poll_write(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t\tbuf: &[u8],\n\t\t\t) -> Poll> {\n\t\t\t\tPin::new(&mut *self.inner.stream).poll_write(cx, buf)\n\t\t\t}\n\t\t\tfn poll_flush(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t) -> Poll> {\n\t\t\t\tPin::new(&mut *self.inner.stream).poll_flush(cx)\n\t\t\t}\n\t\t\tfn poll_shutdown(\n\t\t\t\tmut self: Pin<&mut Self>,\n\t\t\t\tcx: &mut Context<'_>,\n\t\t\t) -> Poll> {\n\t\t\t\tPin::new(&mut *self.inner.stream).poll_shutdown(cx)\n\t\t\t}\n\t\t}\n\n\t\t#[cfg_attr(docsrs, doc(cfg(feature = \"axum\")))]\n\t\t#[cfg(feature = \"axum\")]\n\t\timpl Connected<&$wrapper> for SocketAddr {\n\t\t\tfn connect_info(target: &$wrapper) -> Self {\n\t\t\t\ttarget.inner.info.remote_addr()\n\t\t\t}\n\t\t}\n\n\t\t$(\n\t\t\tmake_conn_type!(info $m, $wrapper);\n\t\t)*\n };\n}\n\nmake_conn_type! {\n /// A connection via an ngrok Edge.\n EdgeConn, EdgeConnInfo\n}\n\nmake_conn_type! {\n /// A connection via an ngrok Endpoint.\n EndpointConn, EndpointConnInfo\n}\n"
},
{
"path": "ngrok/src/forwarder.rs",
"content": "use std::{\n collections::HashMap,\n error::Error as StdError,\n};\n\nuse async_trait::async_trait;\nuse tokio::task::JoinHandle;\nuse url::Url;\n\nuse crate::{\n prelude::{\n EdgeInfo,\n EndpointInfo,\n TunnelCloser,\n TunnelInfo,\n },\n session::RpcError,\n Tunnel,\n};\n\n/// An ngrok forwarder.\n///\n/// Represents a tunnel that is being forwarded to a URL.\npub struct Forwarder