HTTP/2: Parse request-target path like Vert.x (4.1 backport)#16856
Merged
Conversation
Contributor
Author
|
I manually checked that the production code is identical to the 4.2 PR |
Netty 4.1 CI still runs Linux jobs on old CentOS images whose glibc is too old for Jazzer's native driver. Keep the fuzz oracle available, but require JAZZER_FUZZ=1 so normal CI runs the deterministic regression tests without loading the Jazzer agent. Co-Authored-By: multicode <multicode@yawk.at>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manual backport of #16810 to 4.1.
This is not a literal bot auto-port: the Java source, tests, fuzz test, and microbenchmark changes from the 4.2 PR applied as-is, but the root
pom.xmlneeded a 4.1-specific conflict resolution. The backport keeps 4.1's existingjunit.version(5.12.1) and adds onlyjazzer.version(0.30.0) for the new fuzz test, instead of taking 4.2's newer JUnit/JUnit Platform version lines.Cherry-picked source commit: a42c7fc
Motivation:
HttpConversionUtil.toHttp2Headerscurrently depends onjava.net.URIfor absolute-form request-target parsing. On JDKs that still enforce older URI syntax, path or query characters that appear in real HTTP request-targets can make HTTP/1.x to HTTP/2 conversion fail before:pathis produced.Netty only needs URI parsing for the lower-frequency
scheme://authorityvalidation/extraction path. The hot path/query extraction can follow the same lightweight parsing shape used by Vert.x while avoiding full URI parsing and avoiding a try/catch fallback.Modification:
parsePathandparseQueryhelpers, with comments for Netty-specific differences.URIparsing forscheme://authorityvalidation/extraction only after stripping path/query/fragment data.java.net.URI, authority-only and missing-authority absolute-form targets, empty query/fragment handling, and malformed authority validation.consumeString(128)request-target input and narrow documented compatibility exceptions.4.1 CI note:
The Jazzer test is opt-in via
JAZZER_FUZZ=1on this branch. Netty 4.1 CI still runs Linux jobs on old CentOS images whose glibc is too old for Jazzer's native driver. The initial CI failure was:HttpConversionUtilFuzzTest.currentConversionMatchesOldUriBasedConversion→Failed to run Agent.install→libjazzer_driver_*.so: /lib64/libc.so.6: version 'GLIBC_2.14' not found.The deterministic
HttpConversionUtilTestregression tests still run by default; the fuzz oracle remains available on compatible hosts by settingJAZZER_FUZZ=1.Result:
HTTP/2 conversion no longer relies on full
java.net.URIparsing for request-target path/query extraction, while preserving meaningful existing behavior and continuing to validate/extract scheme and authority through URI where appropriate.Verification performed locally:
./mvnw -pl codec-http2 -am -Drevapi.skip=true -DskipJapicmp -DskipHttp2Testsuite -DskipAutobahn -Dcheckstyle.skip=true -Dforbiddenapis.skip=true -Danimal.sniffer.skip=true -Dsurefire.failIfNoSpecifiedTests=false -Dtest=HttpConversionUtilTest,HttpConversionUtilFuzzTest test— 31 tests, 0 failures, 1 skipped (HttpConversionUtilFuzzTest).JAZZER_FUZZ=1 ./mvnw -pl codec-http2 -am -Drevapi.skip=true -DskipJapicmp -DskipHttp2Testsuite -DskipAutobahn -Dcheckstyle.skip=true -Dforbiddenapis.skip=true -Danimal.sniffer.skip=true -Dsurefire.failIfNoSpecifiedTests=false -Dtest=HttpConversionUtilFuzzTest test— fuzz test ran successfully on the local JDK 21 host../mvnw -pl codec-http2 -am -DskipTests -Drevapi.skip=true -DskipJapicmp -DskipHttp2Testsuite -DskipAutobahn -Dforbiddenapis.skip=true -Danimal.sniffer.skip=true test— build success.Notes:
jdtlsis not installed in the environment.junit.versionand only addsjazzer.version;codec-http2excludes Jazzer's JUnit/JUnit Platform transitives so the branch-managed test stack is used.