itsi-server 0.2.22-aarch64-linux

data/ext/itsi_server/src/server/binds/tls.rs

@@ -0,0 +1,278 @@
+use base64::{engine::general_purpose, Engine as _};
+use itsi_acme::{AcmeAcceptor, AcmeConfig, AcmeState};
+use itsi_error::Result;
+use itsi_tracing::info;
+use locked_dir_cache::LockedDirCache;
+use rcgen::ExtendedKeyUsagePurpose;
+use rcgen::{
+    BasicConstraints, CertificateParams, DistinguishedName, DnType, IsCa, KeyPair, KeyUsagePurpose,
+    SanType,
+};
+use rustls::{
+    pki_types::{CertificateDer, PrivateKeyDer},
+    ClientConfig, RootCertStore,
+};
+use rustls_pemfile::{certs, pkcs8_private_keys};
+use std::{
+    collections::HashMap,
+    fs,
+    io::{BufReader, Error},
+    sync::Arc,
+};
+use tokio::sync::Mutex;
+use tokio_rustls::{rustls::ServerConfig, TlsAcceptor};
+
+use crate::env::{
+    ITSI_ACME_CACHE_DIR, ITSI_ACME_CA_PEM_PATH, ITSI_ACME_CONTACT_EMAIL, ITSI_ACME_DIRECTORY_URL,
+    ITSI_LOCAL_CA_DIR,
+};
+
+mod locked_dir_cache;
+
+#[derive(Clone)]
+pub enum ItsiTlsAcceptor {
+    Manual(TlsAcceptor),
+    Automatic(
+        AcmeAcceptor,
+        Arc<Mutex<AcmeState<Error>>>,
+        Arc<ServerConfig>,
+    ),
+}
+
+/// Generates a TLS configuration based on either :
+/// * Input "cert" and "key" options (either paths or Base64-encoded strings) or
+/// * Performs automatic certificate generation/retrieval. Generated certs use an internal self-signed Isti CA.
+///
+/// If a non-local host or optional domain parameter is provided,
+/// an automated certificate will attempt to be fetched using let's encrypt.
+pub fn configure_tls(
+    host: &str,
+    query_params: &HashMap<String, String>,
+) -> Result<ItsiTlsAcceptor> {
+    let domains = query_params
+        .get("domains")
+        .map(|v| v.split(',').map(String::from).collect::<Vec<_>>())
+        .or_else(|| query_params.get("domain").map(|v| vec![v.to_string()]));
+
+    if query_params.get("cert").is_some_and(|c| c == "acme") {
+        if let Some(domains) = domains {
+            let directory_url = &*ITSI_ACME_DIRECTORY_URL;
+            info!(
+                domains = format!("{:?}", domains),
+                directory_url, "Requesting acme cert"
+            );
+            let acme_contact_email = query_params
+                .get("acme_email")
+                .map(|s| s.to_string())
+                .or_else(|| (*ITSI_ACME_CONTACT_EMAIL).as_ref().ok().map(|s| s.to_string()))
+                .ok_or_else(|| itsi_error::ItsiError::ArgumentError(
+                    "acme_email query param or ITSI_ACME_CONTACT_EMAIL must be set before you can auto-generate let's encrypt certificates".to_string(),
+                ))?;
+
+            let acme_config = AcmeConfig::new(domains)
+                .contact([format!("mailto:{}", acme_contact_email)])
+                .cache(LockedDirCache::new(&*ITSI_ACME_CACHE_DIR))
+                .directory(directory_url);
+
+            let acme_state = if let Ok(ca_pem_path) = &*ITSI_ACME_CA_PEM_PATH {
+                let mut root_cert_store = RootCertStore::empty();
+
+                let ca_pem = fs::read(ca_pem_path).expect("failed to read CA pem file");
+                let mut ca_reader = BufReader::new(&ca_pem[..]);
+                let der_certs: Vec<CertificateDer> = certs(&mut ca_reader)
+                    .collect::<std::result::Result<Vec<CertificateDer>, _>>()
+                    .map_err(|e| {
+                        itsi_error::ItsiError::ArgumentError(format!(
+                            "Invalid ACME CA Pem path {:?}",
+                            e
+                        ))
+                    })?;
+                root_cert_store.add_parsable_certificates(der_certs);
+
+                let client_config = ClientConfig::builder()
+                    .with_root_certificates(root_cert_store)
+                    .with_no_client_auth();
+                acme_config
+                    .client_tls_config(Arc::new(client_config))
+                    .state()
+            } else {
+                acme_config.state()
+            };
+
+            let mut rustls_config = ServerConfig::builder()
+                .with_no_client_auth()
+                .with_cert_resolver(acme_state.resolver());
+
+            rustls_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+
+            let acceptor = acme_state.acceptor();
+            return Ok(ItsiTlsAcceptor::Automatic(
+                acceptor,
+                Arc::new(Mutex::new(acme_state)),
+                Arc::new(rustls_config),
+            ));
+        }
+    }
+    let (certs, key) = if let (Some(cert_path), Some(key_path)) =
+        (query_params.get("cert"), query_params.get("key"))
+    {
+        // Load from file or Base64
+        let certs = load_certs(cert_path);
+        let key = load_private_key(key_path);
+        (certs, key)
+    } else {
+        generate_ca_signed_cert(domains.unwrap_or(vec![host.to_owned()]))?
+    };
+
+    let mut config = ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certs, key)
+        .expect("Failed to build TLS config");
+
+    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+    Ok(ItsiTlsAcceptor::Manual(TlsAcceptor::from(Arc::new(config))))
+}
+
+pub fn load_certs(path: &str) -> Vec<CertificateDer<'static>> {
+    let data = if let Some(stripped) = path.strip_prefix("base64:") {
+        general_purpose::STANDARD
+            .decode(stripped)
+            .expect("Invalid base64 certificate")
+    } else {
+        fs::read(path).expect("Failed to read certificate file")
+    };
+
+    if data.starts_with(b"-----BEGIN ") {
+        let mut reader = BufReader::new(&data[..]);
+        let certs_der: Vec<Vec<u8>> = certs(&mut reader)
+            .map(|r| {
+                r.map(|der| der.as_ref().to_vec())
+                    .map_err(itsi_error::ItsiError::from)
+            })
+            .collect::<Result<_>>()
+            .expect("Failed to parse certificate file");
+        certs_der
+            .into_iter()
+            .map(|vec| {
+                // Convert the owned Vec<u8> into a CertificateDer and force 'static.
+                unsafe { std::mem::transmute(CertificateDer::from(vec)) }
+            })
+            .collect()
+    } else {
+        vec![CertificateDer::from(data)]
+    }
+}
+
+/// Loads a private key from a file or Base64.
+pub fn load_private_key(path: &str) -> PrivateKeyDer<'static> {
+    let key_data = if let Some(stripped) = path.strip_prefix("base64:") {
+        general_purpose::STANDARD
+            .decode(stripped)
+            .expect("Invalid base64 private key")
+    } else {
+        fs::read(path).expect("Failed to read private key file")
+    };
+
+    if key_data.starts_with(b"-----BEGIN ") {
+        let mut reader = BufReader::new(&key_data[..]);
+        let keys: Vec<Vec<u8>> = pkcs8_private_keys(&mut reader)
+            .map(|r| {
+                r.map(|key| key.secret_pkcs8_der().to_vec())
+                    .map_err(itsi_error::ItsiError::from)
+            })
+            .collect::<Result<_>>()
+            .expect("Failed to parse private key");
+        if !keys.is_empty() {
+            return PrivateKeyDer::try_from(keys[0].clone()).unwrap();
+        }
+    }
+    PrivateKeyDer::try_from(key_data).unwrap()
+}
+
+pub fn generate_ca_signed_cert(
+    domains: Vec<String>,
+) -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>)> {
+    info!(
+        domains = format!("{}", domains.join(", ")),
+        "Self signed cert",
+    );
+    info!(
+        "Add {} to your system's trusted cert store to resolve certificate errors.",
+        format!("{}/itsi_dev_ca.crt", ITSI_LOCAL_CA_DIR.to_str().unwrap())
+    );
+    info!("Dev CA path can be overridden by setting env var: `ITSI_LOCAL_CA_DIR`.");
+    let (ca_key_pem, ca_cert_pem) = get_or_create_local_dev_ca()?;
+
+    let ca_kp = KeyPair::from_pem(&ca_key_pem).expect("Failed to load CA key");
+    let ca_cert = CertificateParams::from_ca_cert_pem(&ca_cert_pem)
+        .expect("Failed to parse embedded CA certificate")
+        .self_signed(&ca_kp)
+        .expect("Failed to self-sign embedded CA cert");
+
+    let ee_key = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
+    let mut ee_params = CertificateParams::default();
+
+    use std::net::IpAddr;
+
+    ee_params.subject_alt_names = domains
+        .iter()
+        .map(|domain| {
+            if let Ok(ip) = domain.parse::<IpAddr>() {
+                SanType::IpAddress(ip)
+            } else {
+                SanType::DnsName(domain.clone().try_into().unwrap())
+            }
+        })
+        .collect();
+
+    ee_params
+        .distinguished_name
+        .push(DnType::CommonName, domains[0].clone());
+
+    ee_params.use_authority_key_identifier_extension = true;
+    ee_params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
+
+    let ee_cert = ee_params.signed_by(&ee_key, &ca_cert, &ca_kp).unwrap();
+    let ee_cert_der = ee_cert.der().to_vec();
+    let ee_cert = CertificateDer::from(ee_cert_der);
+
+    Ok((
+        vec![ee_cert],
+        PrivateKeyDer::try_from(ee_key.serialize_der()).unwrap(),
+    ))
+}
+
+fn get_or_create_local_dev_ca() -> Result<(String, String)> {
+    let ca_dir = &*ITSI_LOCAL_CA_DIR;
+    fs::create_dir_all(ca_dir)?;
+
+    let key_path = ca_dir.join("itsi_dev_ca.key");
+    let cert_path = ca_dir.join("itsi_dev_ca.crt");
+
+    if key_path.exists() && cert_path.exists() {
+        // Already have a local CA
+        let key_pem = fs::read_to_string(&key_path)?;
+        let cert_pem = fs::read_to_string(&cert_path)?;
+
+        Ok((key_pem, cert_pem))
+    } else {
+        let subject_alt_names = vec!["ca.itsi.fyi".to_string(), "localhost".to_string()];
+        let mut params = CertificateParams::new(subject_alt_names)?;
+        let mut distinguished_name = DistinguishedName::new();
+        distinguished_name.push(DnType::CommonName, "ca.itsi.fyi");
+        params.distinguished_name = distinguished_name;
+        params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+        params.key_usages = vec![
+            KeyUsagePurpose::KeyCertSign,
+            KeyUsagePurpose::CrlSign,
+            KeyUsagePurpose::DigitalSignature, // useful for OCSP/CRL signing
+        ];
+        let key_pair = KeyPair::generate()?;
+        let cert = params.self_signed(&key_pair)?;
+
+        fs::write(&key_path, key_pair.serialize_pem())?;
+        fs::write(&cert_path, cert.pem())?;
+
+        Ok((key_pair.serialize_pem(), cert.pem()))
+    }
+}

data/ext/itsi_server/src/server/byte_frame.rs

@@ -0,0 +1,32 @@
+use std::ops::Deref;
+
+use bytes::Bytes;
+
+#[derive(Debug)]
+pub enum ByteFrame {
+    Data(Bytes),
+    End(Bytes),
+    Empty,
+}
+
+impl Deref for ByteFrame {
+    type Target = Bytes;
+
+    fn deref(&self) -> &Self::Target {
+        match self {
+            ByteFrame::Data(data) => data,
+            ByteFrame::End(data) => data,
+            ByteFrame::Empty => unreachable!(),
+        }
+    }
+}
+
+impl From<ByteFrame> for Bytes {
+    fn from(frame: ByteFrame) -> Self {
+        match frame {
+            ByteFrame::Data(data) => data,
+            ByteFrame::End(data) => data,
+            ByteFrame::Empty => unreachable!(),
+        }
+    }
+}

data/ext/itsi_server/src/server/frame_stream.rs

@@ -0,0 +1,143 @@
+use bytes::{Bytes, BytesMut};
+use futures::Stream;
+use std::convert::Infallible;
+use std::future::Future;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+use std::time::Duration;
+use tokio::sync::mpsc::Receiver;
+use tokio::sync::watch;
+use tokio::time::{sleep, Sleep};
+
+use super::serve_strategy::single_mode::RunningPhase;
+
+#[derive(Debug)]
+pub struct FrameStream {
+    receiver: Receiver<Bytes>,
+    shutdown_rx: watch::Receiver<RunningPhase>,
+    drained: bool,
+}
+
+impl FrameStream {
+    pub fn new(receiver: Receiver<Bytes>, shutdown_rx: watch::Receiver<RunningPhase>) -> Self {
+        Self {
+            receiver,
+            shutdown_rx,
+            drained: false,
+        }
+    }
+}
+
+impl Stream for FrameStream {
+    type Item = Result<Bytes, Infallible>;
+
+    fn poll_next(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        let this = self.get_mut();
+
+        if this.drained {
+            return Poll::Ready(None);
+        }
+
+        match Pin::new(&mut this.receiver).poll_recv(cx) {
+            Poll::Ready(Some(bytes)) => Poll::Ready(Some(Ok(bytes))),
+            Poll::Ready(None) => {
+                this.drained = true;
+                Poll::Ready(None)
+            }
+            Poll::Pending => {
+                if this.shutdown_rx.has_changed().unwrap_or(false)
+                    && *this.shutdown_rx.borrow() == RunningPhase::ShutdownPending
+                {
+                    if let Ok(bytes) = this.receiver.try_recv() {
+                        return Poll::Ready(Some(Ok(bytes)));
+                    }
+
+                    this.drained = true;
+                    return Poll::Ready(None);
+                }
+
+                Poll::Pending
+            }
+        }
+    }
+}
+
+/// BufferedStream wraps a stream of Bytes and coalesces chunks into a larger buffer,
+/// flushing either after `max_flush_bytes` is reached or `max_flush_interval` elapses.
+pub struct BufferedStream<S> {
+    inner: S,
+    buffer: BytesMut,
+    max_flush_bytes: usize,
+    max_flush_interval: Duration,
+    flush_deadline: Option<Pin<Box<Sleep>>>,
+}
+
+impl<S> BufferedStream<S> {
+    pub fn new(inner: S, max_flush_bytes: usize, max_flush_interval: Duration) -> Self {
+        Self {
+            inner,
+            buffer: BytesMut::with_capacity(max_flush_bytes),
+            max_flush_bytes,
+            max_flush_interval,
+            flush_deadline: None,
+        }
+    }
+}
+
+impl<S> Stream for BufferedStream<S>
+where
+    S: Stream<Item = Result<Bytes, Infallible>> + Unpin,
+{
+    type Item = Result<Bytes, Infallible>;
+
+    fn poll_next(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        let this = self.get_mut();
+
+        loop {
+            // Flush on timer if needed
+            if let Some(deadline) = &mut this.flush_deadline {
+                if Pin::new(deadline).poll(cx).is_ready() && !this.buffer.is_empty() {
+                    let flushed = this.buffer.split().freeze();
+                    this.flush_deadline = None;
+                    return Poll::Ready(Some(Ok(flushed)));
+                }
+            }
+
+            match Pin::new(&mut this.inner).poll_next(cx) {
+                Poll::Ready(Some(Ok(bytes))) => {
+                    this.buffer.extend_from_slice(&bytes);
+
+                    if bytes.is_empty() || this.buffer.len() >= this.max_flush_bytes {
+                        let flushed = this.buffer.split().freeze();
+                        this.flush_deadline = None;
+                        return Poll::Ready(Some(Ok(flushed)));
+                    }
+
+                    if this.flush_deadline.is_none() {
+                        this.flush_deadline = Some(Box::pin(sleep(this.max_flush_interval)));
+                    }
+                }
+                Poll::Ready(None) => {
+                    if this.buffer.is_empty() {
+                        return Poll::Ready(None);
+                    } else {
+                        let flushed = this.buffer.split().freeze();
+                        this.flush_deadline = None;
+                        return Poll::Ready(Some(Ok(flushed)));
+                    }
+                }
+                Poll::Pending => {
+                    if let Some(deadline) = &mut this.flush_deadline {
+                        let deadline = deadline.as_mut();
+                        if deadline.poll(cx).is_ready() && !this.buffer.is_empty() {
+                            let flushed = this.buffer.split().freeze();
+                            this.flush_deadline = None;
+                            return Poll::Ready(Some(Ok(flushed)));
+                        }
+                    }
+                    return Poll::Pending;
+                }
+            }
+        }
+    }
+}

data/ext/itsi_server/src/server/http_message_types.rs

@@ -0,0 +1,230 @@
+use bytes::Bytes;
+use core::fmt;
+use futures::Stream;
+use futures_util::TryStreamExt;
+use http::Request;
+use http_body_util::{combinators::WithTrailers, BodyExt, Either, Empty, Full, StreamBody};
+use hyper::body::{Body, Frame, Incoming, SizeHint};
+use std::{
+    convert::Infallible,
+    pin::Pin,
+    task::{Context, Poll},
+};
+
+use super::size_limited_incoming::SizeLimitedIncoming;
+
+type Inner = Either<Full<Bytes>, Empty<Bytes>>;
+
+type BoxStream =
+    Pin<Box<dyn Stream<Item = Result<Frame<Bytes>, Infallible>> + Send + Sync + 'static>>;
+
+pub struct PlainBody(Either<StreamBody<BoxStream>, Inner>);
+
+impl fmt::Debug for PlainBody {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.0 {
+            Either::Left(_) => f.write_str("PlainBody::Stream(..)"),
+            Either::Right(inner) => match inner {
+                Either::Left(full) => f.debug_tuple("PlainBody::Full").field(full).finish(),
+                Either::Right(_) => f.write_str("PlainBody::Empty"),
+            },
+        }
+    }
+}
+type DynErr = Box<dyn std::error::Error + Send + Sync>;
+
+impl Body for PlainBody {
+    type Data = Bytes;
+    type Error = DynErr;
+
+    fn poll_frame(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Self::Data>, Self::Error>>> {
+        unsafe { self.map_unchecked_mut(|s| &mut s.0) }.poll_frame(cx)
+    }
+
+    fn size_hint(&self) -> SizeHint {
+        self.0.size_hint()
+    }
+}
+
+impl PlainBody {
+    fn stream<S>(s: S) -> Self
+    where
+        S: Stream<Item = Result<Bytes, Infallible>> + Send + Sync + 'static,
+    {
+        let boxed: BoxStream = Box::pin(s.map_ok(Frame::data));
+        Self(Either::Left(StreamBody::new(boxed)))
+    }
+
+    fn full(bytes: Bytes) -> Self {
+        Self(Either::Right(Either::Left(Full::new(bytes))))
+    }
+
+    fn empty() -> Self {
+        Self(Either::Right(Either::Right(Empty::new())))
+    }
+}
+
+type BoxTrailers = Pin<
+    Box<dyn std::future::Future<Output = Option<Result<http::HeaderMap, DynErr>>> + Send + Sync>,
+>;
+
+pub enum HttpBody {
+    Plain(PlainBody),
+    WithT(WithTrailers<PlainBody, BoxTrailers>),
+}
+
+impl fmt::Debug for HttpBody {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            HttpBody::Plain(b) => f.debug_tuple("HttpBody::Plain").field(b).finish(),
+            HttpBody::WithT(_) => f.write_str("HttpBody::WithT(..)"),
+        }
+    }
+}
+
+impl Body for HttpBody {
+    type Data = Bytes;
+    type Error = DynErr;
+
+    fn poll_frame(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Self::Data>, Self::Error>>> {
+        unsafe {
+            match self.get_unchecked_mut() {
+                HttpBody::Plain(b) => Pin::new_unchecked(b).poll_frame(cx),
+                HttpBody::WithT(b) => Pin::new_unchecked(b).poll_frame(cx),
+            }
+        }
+    }
+
+    fn size_hint(&self) -> SizeHint {
+        match self {
+            HttpBody::Plain(b) => b.size_hint(),
+            HttpBody::WithT(b) => b.size_hint(),
+        }
+    }
+}
+
+impl HttpBody {
+    pub fn stream<S>(s: S) -> Self
+    where
+        S: Stream<Item = Result<Bytes, Infallible>> + Send + Sync + 'static,
+    {
+        HttpBody::Plain(PlainBody::stream(s))
+    }
+
+    pub fn full(bytes: Bytes) -> Self {
+        HttpBody::Plain(PlainBody::full(bytes))
+    }
+
+    pub fn empty() -> Self {
+        HttpBody::Plain(PlainBody::empty())
+    }
+
+    pub fn with_trailers<Fut>(self, fut: Fut) -> Self
+    where
+        Fut: std::future::Future<Output = Option<Result<http::HeaderMap, DynErr>>>
+            + Send
+            + Sync
+            + 'static,
+    {
+        let boxed: BoxTrailers = Box::pin(fut);
+        match self {
+            HttpBody::Plain(p) => HttpBody::WithT(p.with_trailers(boxed)),
+            already @ HttpBody::WithT(_) => already,
+        }
+    }
+}
+
+pub type HttpResponse = http::Response<HttpBody>;
+pub type HttpRequest = Request<SizeLimitedIncoming<Incoming>>;
+
+pub trait ConversionExt {
+    fn limit(self) -> HttpRequest;
+}
+
+impl ConversionExt for Request<Incoming> {
+    fn limit(self) -> HttpRequest {
+        let (parts, body) = self.into_parts();
+        Request::from_parts(parts, SizeLimitedIncoming::new(body))
+    }
+}
+
+pub trait RequestExt {
+    fn content_type(&self) -> Option<&str>;
+    fn accept(&self) -> Option<&str>;
+    fn header(&self, header_name: &str) -> Option<&str>;
+    fn query_param(&self, query_name: &str) -> Option<&str>;
+}
+
+pub trait PathExt {
+    fn no_trailing_slash(&self) -> &str;
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum ResponseFormat {
+    JSON,
+    HTML,
+    TEXT,
+    UNKNOWN,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct SupportedEncodingSet {
+    pub zstd: bool,
+    pub br: bool,
+    pub deflate: bool,
+    pub gzip: bool,
+}
+
+impl From<Option<&str>> for ResponseFormat {
+    fn from(value: Option<&str>) -> Self {
+        match value {
+            Some("application/json") => ResponseFormat::JSON,
+            Some("text/html") => ResponseFormat::HTML,
+            Some("text/plain") => ResponseFormat::TEXT,
+            _ => ResponseFormat::UNKNOWN,
+        }
+    }
+}
+
+impl PathExt for str {
+    fn no_trailing_slash(&self) -> &str {
+        if self == "/" {
+            self
+        } else {
+            self.trim_end_matches('/')
+        }
+    }
+}
+
+impl RequestExt for HttpRequest {
+    fn content_type(&self) -> Option<&str> {
+        self.headers()
+            .get("content-type")
+            .map(|hv| hv.to_str().unwrap_or(""))
+    }
+
+    fn accept(&self) -> Option<&str> {
+        self.headers()
+            .get("accept")
+            .map(|hv| hv.to_str().unwrap_or(""))
+    }
+
+    fn header(&self, header_name: &str) -> Option<&str> {
+        self.headers()
+            .get(header_name)
+            .map(|hv| hv.to_str().unwrap_or(""))
+    }
+
+    fn query_param(&self, query_name: &str) -> Option<&str> {
+        self.uri()
+            .query()
+            .and_then(|q| q.split('&').find(|p| p.starts_with(query_name)))
+            .map(|p| p.split('=').nth(1).unwrap_or(""))
+    }
+}