aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/internal/http2
AgeCommit message (Collapse)Author
7 daysnet/http/internal/http2: prevent alloc when writing status code for responsesNicholas S. Husin
Previously, writing responses with non-200 and non-404 status code requires an allocation. Now that CL 762040 prevents header names and values from escaping, we can modify writeFrame to not allocate status codes on the heap. Change-Id: I230bed1b83627c1fb389c0507106d8e16a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/762140 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-31net/http/internal/http2: prevent hanging Transport due to bad SETTINGS frameNicholas S. Husin
When processing SETTINGS frame, Transport currently only checks if the frame is valid for SETTINGS_ENABLE_CONNECT_PROTOCOL. As a result, a SETTINGS_MAX_FRAME_SIZE with the invalid value of 0 is erroneously accepted. This will then result in Transport being stuck in an infinite loop writing CONTINUATION frames. This CL fixes the issue by ensuring that SETTINGS frame are always validated, regardless of the SETTINGS parameter. Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue. Fixes #78476 Fixes CVE-2026-33814 Change-Id: I8b6219431e87454d34bca738fbcb59b66a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/761581 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-30net/http/internal/http2: don't reuse ClientRequest streamsDamien Neil
The ClientRequest type (unlike http.Request) is not reusable across RoundTrip attempts because it includes a single-use clientStream. (It's possible for RoundTrip to return while some goroutines are still accessing the clientStream.) Always clone the ClientRequest on retries. Fixes #78202 Fixes #78187 Change-Id: I4012bb4e017a9516278c873ec5a589086a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/761301 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2026-03-24net/http/internal/http2: use fake net for TestTransportBlockingRequestWriteDamien Neil
This test has been intermittently flaky. Exact cause isn't clear, but switch it to use a fake network to eliminate local network flakiness as a cause. Fixes #78209 Fixes #78213 Fixes #78263 Change-Id: I481553107e8557fda0707069856bafcc6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/758063 Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-23net/http/internal/http2: remove inaccessible write schedulersNicholas S. Husin
RFC 7540 and random write schedulers are not accessible from std, and are essentially dead code at this point. Change-Id: Ib1e9e6e9ae7962b451bc36c0dad3c503f56dc1c0 Reviewed-on: https://go-review.googlesource.com/c/go/+/757380 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-23net/http/internal/http2: modernize the packageqiulaidongfeng
This CL is mostly generated by running go fix. Manual edits have also been selectively done to modernize the package where doing so is straightforward; for example, using slices.Contains in lieu of strSliceContains. Change-Id: Ie2942481672c56c370e2df0f172cf3e480a12bc5 Reviewed-on: https://go-review.googlesource.com/c/go/+/757220 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-16net/http/internal/http2: deflake TestServer_Rejects_Too_Many_StreamsDamien Neil
This test contains a race condition in the server handler: inHandler <- streamID <-leaveHandler We assume that all requests queue reading from leaveHandler in order, but it is possible for the second request (stream id 3) to arrive at leaveHandler before the first (stream id 1). We could fix the race with a judicious synctest.Wait, but rewrite the test to use serverHandlerCall to manipulate server handlers, which permits us to precisely pick which request to unblock. Fixes #78117 Change-Id: Icd393c81e019a0b5176976a6b50145a26a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/755320 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http/internal/http2: drop benchmarks which use synctestDamien Neil
Drop a number of low-level benchmarks which use internal test APIs that now use synctest. Synctest and benchmarks don't really mix; we don't necessarily expect bubbled code to perform in the same fashion as unbubbled code. Fixes #78114 Change-Id: I23f0a5d296ffeabc836f3865e08778eb6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/754940 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http: use net/http/internal/http2 rather than h2_bundle.goDamien Neil
Rework net/http/internal/http2 to use internally-defined types rather than net/http types (to avoid an import cycle). Remove h2_bundle.go, and replace it with calls into net/http/internal/http2 instead. For #67810 Change-Id: I56a1b28dbd0e302ab15a30f819dd46256a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751304 Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-12net/http/internal/http2: skip TestTransportNewClientConnCloseOnWriteErrorDamien Neil
Rewrote this test to use newTestClientConn, discovered that the assertion that it's supposed to make (if a write to a conn fails, the conn is closed) doesn't hold for all writes. Skip the amended test for now. For #67810 Change-Id: I1b696afcd2ba86ed631ee5f32c48b2366a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/753842 Reviewed-by: Mark Freeman <markfreeman@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http/internal/http2: remove fake connection autowaitDamien Neil
Fake connections have an option to "autowait", where the connection calls synctest.Wait before a read or after a write. This causes some confusing problems in cases when a connection might be used elsewhere than the main test goroutine, possibly resulting in two synctest.Wait calls at the same time. Drop the autowait feature, and add some more explicit Waits as required. For #67810 Change-Id: I3ba96b2af3b3a2f171c44bfe47be1d7f6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/753841 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-12net/http/internal/http2: make server write errors stickyDamien Neil
After encountering a write error on a server's connection, remember the error and reuse it for future writes. Fixes a rare flakiness in TestServerWriteByteTimeout, where we can sometimes attempt to flush the write buffer after encountering a write timeout. Change-Id: I01649ae41185d6109180e222d4e8f8426a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/753720 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-12net/http/internal/http2: remove ServeConnOpts.UpgradeRequestDamien Neil
UpgradeRequest is used by the x/net/http2/h2c package for upgrading HTTP/1.1 requests to unencrypted HTTP/2. net/http only supports unencrypted HTTP/2 "with prior knowledge", not upgrade. Drop the field. For #67810 Change-Id: Iae48386e2e299dbf3b433954b87b6eb86a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/753320 Reviewed-by: Nicholas Husin <nsh@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http/internal/http2: remove TestClientConnPingDamien Neil
Ping is no longer a public API. For #67810 Change-Id: I7df19d443634ada23cf4137b96cb25676a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751311 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-12net/http/internal/http2: remove TestConfigureTransportDamien Neil
ConfigureTransport is no longer a public API. For #67810 Change-Id: I8dae19bc0635c77bafa202841ef468356a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751310 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2026-03-12net/http/internal/http2: remove TestTransportGroupsPendingDialsDamien Neil
This test exercises dials in the client connection pool inside http2.Transport, but in the merged-into-std world dials are always handled by the net/http.Transport. For #67810 Change-Id: Ic047ec3628c48116f1eda3c145bf5a566a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751309 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com>
2026-03-12net/http/internal/http2: remove TestServerUpgradeRequestPrefaceFailureDamien Neil
This test exercises the h2c upgrade path, where a client sends an HTTP/1 requests and receives an HTTP/2 response. We don't support this path any more, so drop the test. For #67810 Change-Id: Ib100c3afb18a98f613c19023cb2d5a026a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751308 Reviewed-by: Nicholas Husin <nsh@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http/internal/http2: remove TestServerHandleCustomConnDamien Neil
This test exercises the ability to provide a non-*tls.Conn to the HTTP/2 server. This is not currently supported by net/http.Server (although it would be nice to have), so drop the test. For #67810 Change-Id: Ica5b0bcceddbb75dcc2b4d5f69fad8676a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751307 Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-12net/http/internal/http2: use newServerTester in TestIssue53Damien Neil
Replace older test infrastructure with the new shiny. Simplifies keeping this test post merge into std. For #67810 Change-Id: Idd876af67265ae8b6ab5b82f9ac376d26a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751306 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2026-03-12net/http/internal/http2: remove TestServeConnNilOptsDamien Neil
ServeConn is no longer a public API, so there is no need to test this path. For #67810 Change-Id: I2f740ebf95777d5d44ea26f27aa812f46a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751305 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http/internal/http2: use net/http Transport and Server in testsDamien Neil
Update http2 tests to use a net/http Transport or Server where possible, rather than the http2 versions of these types. This changes tests which exercised configuring the http2 package types to now exercise the net/http configuration path. For example, tests which set http2.Transport.DisableCompression will now set http.Transport.DisableCompression. We don't care about the old http2-internal configuration paths, since they aren't accessible to users. For #67810 Change-Id: I942c6812321fbd24c94b8aa7215dc60d6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751302 Reviewed-by: Nicholas Husin <nsh@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http/internal/http2: make tests passDamien Neil
Remove the "//go:build ignore" lines from the initial import and make the minimal changes required for tests to pass in the new package location. For #67810 Change-Id: I243f4d4a2e269266786a22a7eb8fb17d6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751700 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2026-03-12net/http/internal/http2: initial importDamien Neil
This copies the contents of golang.org/x/net/http2 at 38019a2dbc2645a4c06a1e983681eefb041171c8 into net/http/internal/http2. Files which are not built at go1.27 (e.g., config_go125.go) are not included. A "//go:build ignore" comment has been added to each file. For #67810 Change-Id: If3e52767eea31adf4e2fdcff0dfa67e46a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751300 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 15:49:07 +0000