fix: SSL string cipher intersection

integration-tests/js-compute/fixtures/module-mode/src/dynamic-backend.js

@@ -1105,6 +1105,55 @@ routes.set('/backend/timeout', async () => {
           );
         },
       );
+      // AND (+) operator: intersection of two cipher groups
+      routes.set(
+        '/backend/constructor/parameter-ciphers-property-and-operator',
+        async () => {
+          assertDoesNotThrow(() => {
+            new Backend({
+              name: 'and-sha1-aes128',
+              target: 'a',
+              ciphers: 'SHA1+AES128',
+            });
+          });
+          assertDoesNotThrow(() => {
+            new Backend({
+              name: 'and-sha1-aes256',
+              target: 'a',
+              ciphers: 'SHA1+AES256',
+            });
+          });
+          assertDoesNotThrow(() => {
+            new Backend({
+              name: 'and-sha1-ecdhe',
+              target: 'a',
+              ciphers: 'SHA1+ECDHE',
+            });
+          });
+          assertThrows(
+            () => {
+              new Backend({
+                name: 'and-sha1-aesgcm',
+                target: 'a',
+                ciphers: 'SHA1+AESGCM',
+              });
+            },
+            TypeError,
+            `Backend constructor: none of the provided ciphers are supported by Fastly. The list of supported ciphers is available on https://developer.fastly.com/learning/concepts/routing-traffic-to-fastly/#use-a-tls-configuration`,
+          );
+          assertThrows(
+            () => {
+              new Backend({
+                name: 'and-sha1-chacha20',
+                target: 'a',
+                ciphers: 'SHA1+CHACHA20',
+              });
+            },
+            TypeError,
+            `Backend constructor: none of the provided ciphers are supported by Fastly. The list of supported ciphers is available on https://developer.fastly.com/learning/concepts/routing-traffic-to-fastly/#use-a-tls-configuration`,
+          );
+        },
+      );
     }
 
     // hostOverride property

integration-tests/js-compute/fixtures/module-mode/tests.json

@@ -32,6 +32,7 @@
   "GET /backend/constructor/parameter-ciphers-property-valid-cipherlist-strings-supported-by-fastly": {},
   "GET /backend/constructor/parameter-ciphers-property-valid-cipherlist-strings-but-not-supported-by-fastly": {},
   "GET /backend/constructor/parameter-ciphers-property-calls-7.1.17-ToString": {},
+  "GET /backend/constructor/parameter-ciphers-property-and-operator": {},
   "GET /backend/constructor/parameter-hostOverride-property-empty-string": {},
   "GET /backend/constructor/parameter-hostOverride-property-calls-7.1.17-ToString": {},
   "GET /backend/constructor/parameter-hostOverride-property-valid-string": {},

runtime/fastly/builtins/backend.cpp

@@ -4,6 +4,7 @@
 #include <charconv>
 #include <iostream>
 #include <optional>
+#include <ranges>
 #include <set>
 #include <string>
 #include <string_view>
@@ -359,21 +360,6 @@ class OpenSSLCipherConfigurationParser {
     return [val](auto &c) { return c.mac == val; };
   }
 
-  std::vector<std::string_view> split(std::string_view s, std::string_view delimiter) const {
-    size_t pos_start = 0, pos_end, delim_len = delimiter.length();
-    std::string token;
-    std::vector<std::string_view> res;
-
-    while ((pos_end = s.find(delimiter, pos_start)) != std::string::npos) {
-      token = s.substr(pos_start, pos_end - pos_start);
-      pos_start = pos_end + delim_len;
-      res.push_back(token);
-    }
-
-    res.push_back(s.substr(pos_start));
-    return res;
-  }
-
   std::pair<std::string_view, std::string_view> split_on(std::string_view str, char c) const {
     auto ix = str.find(c);
     if (ix == str.npos) {
@@ -583,20 +569,22 @@ class OpenSSLCipherConfigurationParser {
       } else if (aliases.find(element) != aliases.end()) {
         this->add(aliases, ciphers, element);
       } else if (element.find(AND) != std::string::npos) {
-        auto intersections = this->split(element, "+\\");
+        std::vector<std::string_view> intersections;
+        for (auto r : element | std::views::split(AND))
+          intersections.emplace_back(r.begin(), r.end());
         if (intersections.size() > 0) {
           auto found = aliases.find(intersections[0]);
           if (found != aliases.end()) {
             auto result{found.operator->()->second};
             for (int i = 1; i < intersections.size(); i++) {
               auto alias = aliases.find(intersections[i]);
               if (alias != aliases.end()) {
-                // make `result` only contain the aliases from `alias`
+                // make `result` only contain the ciphers also present in `alias`
                 result.erase(std::remove_if(result.begin(), result.end(),
                                             [&](auto x) {
                                               return std::find(alias->second.begin(),
                                                                alias->second.end(),
-                                                               x) != alias->second.end();
+                                                               x) == alias->second.end();
                                             }),
                              result.end());
               }
@@ -618,19 +606,6 @@ class OpenSSLCipherConfigurationParser {
   }
 };
 
-std::vector<std::string_view> split(std::string_view string, char delimiter) {
-  auto start = 0;
-  auto end = string.find(delimiter, start);
-  std::vector<std::string_view> result;
-  while (end != std::string::npos) {
-    result.push_back(string.substr(start, end - start));
-    start = end + 1;
-    end = string.find(delimiter, start);
-  }
-  result.push_back(string.substr(start));
-  return result;
-}
-
 bool is_valid_ip(std::string_view ip) {
   int format = AF_INET;
   if (ip.find(':') != std::string::npos) {
@@ -677,9 +652,8 @@ bool is_valid_host(std::string_view host) {
     return false;
   }
 
-  auto labels = split(hostname, '.');
-
-  for (auto &label : labels) {
+  for (auto r : hostname | std::views::split('.')) {
+    auto label = std::string_view(r.begin(), r.end());
     // Each label in a hostname can not be longer than 63 characters
     // https://www.rfc-editor.org/rfc/rfc2181#section-11
     if (label.length() > 63) {