aboutsummaryrefslogtreecommitdiff
path: root/src/net
AgeCommit message (Collapse)Author
2026-02-03all: prealloc slice with possible minimum capabilitiesShulhan
2026-02-02net: don't wait 5 seconds to re-read /etc/resolv.confBrad Fitzpatrick
If a Go process starts up, finds /etc/resolv.conf empty, then the DHCP client writes /etc/resolv.conf, the Go program would find itself broken for up to 5 seconds. We noticed this during integration tests in ephemeral VMs using gokrazy that boot into our application. Change-Id: Ia64c2b5c698a4ee3efc15d8a8f1850c47e531b84 Reviewed-on: https://go-review.googlesource.com/c/go/+/739620 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-02-02net/http: try to drain response body upon closing for better connection re-useNicholas S. Husin
Currently, we have a rather inconsistent behavior in terms of whether a connection can be re-used or not when an HTTP body is not read to completion: - In HTTP/2, not reading bodies to completion is not an issue, since a new HTTP/2 stream can be created on the same TCP connection. - In HTTP/1 server, we discard up to 256 KiB of unconsumed request body, to potentially allow re-use. - In HTTP/1 client, we do not do anything, and fail to re-use a TCP connection if there are any unconsumed response body at all. This has led to some confusion. For example, some users have mistakenly discarded response body for HTTP/2 when doing so is not needed. Manually discarding response body can also be disadvantageous if the body is excessively large or is a never-ending stream. To solve this issue, this CL makes it so that closing a response body will cause any remaining content to be drained, up to a limit of 256 KiB or 50 milliseconds, whichever one is reached first. This allows better connection re-use for HTTP/1, and most users can now avoid having to manually drain their response body. For #77370 Change-Id: I71e1227fc9cf5f901362c8e234320817f6b0be24 Reviewed-on: https://go-review.googlesource.com/c/go/+/737720 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-01-23net: fix some ineffectual assignments reported by ineffassignLin Lin
Updates #35136 Change-Id: I5422a50dde51c0a57f135c83f4963053285a9bc2 GitHub-Last-Rev: 6db1a88da60fce3e4fd6697d5db75d55d53b2b49 GitHub-Pull-Request: golang/go#76704 Reviewed-on: https://go-review.googlesource.com/c/go/+/727080 Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jorropo <jorropo.pgm@gmail.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2026-01-23all: update vendored dependenciesNicholas S. Husin
This CL does the following: 1. Bundles up golang.org/x/net/internal/httpsfv since h2_bundle.go now relies on it. 2. Modifies h2_bundle.go import mapping to account for httpsfv package. 3. Updates all vendored dependencies using golang.org/x/build/cmd/updatestd. For #75500 Change-Id: Ia2f41ad606092fe20b62f946266190502b146977 Reviewed-on: https://go-review.googlesource.com/c/go/+/738621 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-22net/http: Add Server.DisableClientPriority fieldNicholas S. Husin
The DisableClientPriority field is currently still a no-op, and will only take effect once golang.org/x/net is bundled up into h2_bundle.go again. For #75500 Change-Id: I9e2135bed50b7f201aea93467e3f5f5f6c81cb1c Reviewed-on: https://go-review.googlesource.com/c/go/+/738620 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-01-22net/http: use math/rand/v2 instead of math/rand1911860538
math/rand/v2 provides a more modern, performant, and secure random number API. Change-Id: Ic0c30ae40623508e3ed65c435be3c208704b5655 GitHub-Last-Rev: a8fa520b39cb5cc56042b74f6c40163bf8115247 GitHub-Pull-Request: golang/go#76433 Reviewed-on: https://go-review.googlesource.com/c/go/+/723680 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-01-15net/url: add urlmaxqueryparams GODEBUG to limit the number of query parametersDamien Neil
net/url does not currently limit the number of query parameters parsed by url.ParseQuery or URL.Query. When parsing a application/x-www-form-urlencoded form, net/http.Request.ParseForm will parse up to 10 MB of query parameters. An input consisting of a large number of small, unique parameters can cause excessive memory consumption. We now limit the number of query parameters parsed to 10000 by default. The limit can be adjusted by setting GODEBUG=urlmaxqueryparams=<n>. Setting urlmaxqueryparams to 0 disables the limit. Thanks to jub0bs for reporting this issue. Fixes #77101 Fixes CVE-2025-61726 Change-Id: Iee3374c7ee2d8586dbf158536d3ade424203ff66 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3020 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736712 Auto-Submit: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-12net: fix socket duplication error handling on Windowsqmuntal
Calls to dupSocket may fail, but the error is not properly handled because the surrounding code incorrectly checks for nil error instead of non-nil error. I'm not aware of any code paths that would trigger this error, and I haven't been able to create a test case that does so, but this change fixes the error handling to correctly propagate any errors from dupSocket. Change-Id: I5ffd3cbe8ed58a83634f3b97c0878a7c73e0505e Reviewed-on: https://go-review.googlesource.com/c/go/+/734821 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-01-12net: don't ignore getsockname errors in newFileFDqmuntal
newFileFD is called when creating a net FD from an existing socket handle. That socket might not be bound yet, in which case getsockname returns a useful error that is currently ignored and replaced with a potentially misleading EPROTONOSUPPORT error later on. Updates #73696 Updates #74976 Updates #75282 Updates #75279 Updates #76537 Updates #76582 Updates #77038 Change-Id: I2a8b30ffbb037035669f65a95a923edc8b288145 Reviewed-on: https://go-review.googlesource.com/c/go/+/734820 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-01-12net: don't ignore errors in TestUnixUnlinkqmuntal
TestUnixUnlink calls some functions and methods that can fail, but it ignores the returned errors. This test is flaky on Windows, and those errors should be checked to help diagnose the problem. Updates #75282 Updates #76582 Updates #77038 Change-Id: Ia868762a4c0b94a7255d57add63777568caa6cd2 Reviewed-on: https://go-review.googlesource.com/c/go/+/734720 Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2026-01-02net/rpc: correct comment for isExportedOrBuiltinType functionjjpinto
Change to follow the idiomatic Go doc comment style Change-Id: I727801903c8fc1a66c8a71ab5455f12219b469d5 GitHub-Last-Rev: dd608c9cb93d2f9d0358607fab6b58913b499709 GitHub-Pull-Request: golang/go#77015 Reviewed-on: https://go-review.googlesource.com/c/go/+/732902 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Rob Pike <r@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2025-12-05all: fix some comment issuescuishuang
Change-Id: I5dec35b1432705b3a52859c38e758220282226af Reviewed-on: https://go-review.googlesource.com/c/go/+/726700 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2025-12-02net: parse addresses without separators in ParseMacDevon Mar
IEEE EUI guidelines states that "an EUI-48 can be represented in the IEEE RA hexadecimal (hex) form with the octets separated by hyphens, or as a pure base-16 numerical representation without hyphens" (https://standards.ieee.org/wp-content/uploads/import/documents/tutorials/eui.pdf p.9). The latter form is used in Azure Instance Metadata Service (https://github.com/Azure/azure-container-networking/pull/4122) among others. Fixes #66682 Change-Id: Id66c23d50ebb1fed1f3bdb5cf3822a8fd60b886d GitHub-Last-Rev: 77900cc1a68cb535b685a63cf84b5413b480df2c GitHub-Pull-Request: golang/go#76387 Reviewed-on: https://go-review.googlesource.com/c/go/+/722720 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-12-01net/http: deflake TestClientConnReserveAndConsumeDamien Neil
This test includes an assertion that a client conn's state hook is called exactly once, but some of the test cases can result in two events occurring: A request completes and a connection closes. Change the assertion to just check that the hook is called at least once. Fixes #76480 Change-Id: Ie1438581b072b10623eb3d5fe443294a639c9853 Reviewed-on: https://go-review.googlesource.com/c/go/+/725601 Commit-Queue: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> TryBot-Bypass: Damien Neil <dneil@google.com>
2025-11-25net/url: fix example of Values.EncodeJosé Joaquín Atria
Calling url.Values.Encode generates a query string with the values sorted by key. However, in the example in the documentation this behaviour is not reflected. This change corrects this. Change-Id: Id95a5d79b57dc20c3bff1f0c6975c76dcd8412b1 Reviewed-on: https://go-review.googlesource.com/c/go/+/723960 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Auto-Submit: Sean Liao <sean@liao.dev>
2025-11-24net/http: add Transport.NewClientConnDamien Neil
For #75772 Change-Id: Iad7607b40636bab1faf8653455e92e9700309003 Reviewed-on: https://go-review.googlesource.com/c/go/+/722223 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-24all: update to x/net@bff14c52567061031b9761881907c39e24792736Damien Neil
This brings in CL 722200 which adds necessary HTTP/2 support for net/http.Transport.NewClientConn. For #75772 Change-Id: I5489232401096982ed21002f293dd0f87fe2fba6 Reviewed-on: https://go-review.googlesource.com/c/go/+/723901 Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2025-11-21net: remove unused linknamesSean Liao
errNoSuchInterface: https://github.com/SagerNet/sing/commit/a33349366d899068145f2d0e3ea0f5b2632fa3f2 defaultNS: https://github.com/MetaCubeX/mihomo/commit/4a16d22398116a88a230071278be536491a8cdce For #67401 Change-Id: I2945bc5edf8a474315283c57259ba6c2a0b85776 Reviewed-on: https://go-review.googlesource.com/c/go/+/721161 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-21net/http: remove unused linknamesSean Liao
These were removed in: https://github.com/gobwas/ws/commit/8e2d520ba2966517f9c339e36dd89fd8a4460446 For #67401 Change-Id: I44898beb6fa3b6867b3d2164fc930724e143cf30 Reviewed-on: https://go-review.googlesource.com/c/go/+/721200 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: populate Response.Request when using NewFileTransportSean Liao
Fixes #51562 Change-Id: Ia6fe4728b1e3e0cf3a6462be99c1044260cadf31 Reviewed-on: https://go-review.googlesource.com/c/go/+/720822 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: preserve original path encoding in redirectsSean Liao
Fixes #70758 Change-Id: I9fc6fe98c194351557c6219513918b7593899bc1 Reviewed-on: https://go-review.googlesource.com/c/go/+/720821 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: use HTTP 307 redirects in ServeMuxSean Liao
Clients receiving an HTTP 301 Moved Permanently may conservatively change the method of a POST request to GET. The newer HTTP 307 Temporary Redirect and 308 Permanent Redirect explicitly allows retrying POST requests after the redirect. These should be safe for ServeMux as this internal redirect is generated before user provided handlers are called. As ServeMux is making the redirect for the user without explicit direction, and clients may cache Permanent Redirects indefinitely, Temporary Redirect is used in case the user adds a handler for a path, that was previously redirected but no longer should. Fixes #50243 Fixes #60769 Change-Id: I6c0b735bab03bb7b50f05457b3b8a8ba813badb2 Reviewed-on: https://go-review.googlesource.com/c/go/+/720820 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: update Response.Request.URL after redirects on GOOS=jsSean Liao
Fixes #71346 Change-Id: Id4053626e621faf50bb88a10ca0d540f393c8e01 Reviewed-on: https://go-review.googlesource.com/c/go/+/720860 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http/cookiejar: treat localhost as secure originSean Liao
For development purposes, browsers treat localhost as a secure origin regardless of protocol. Fixes #60997 https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#restrict_access_to_cookies https://bugzilla.mozilla.org/show_bug.cgi?id=1618113 https://issues.chromium.org/issues/40120372 Change-Id: I6d31df4e055f2872c4b93571c53ae5160923852b Reviewed-on: https://go-review.googlesource.com/c/go/+/717860 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Mark Freeman <markfreeman@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-11-21net/url: warn that JoinPath arguments should be escapedSean Liao
Fixes #75799 Change-Id: I483f7b1129799d8dd7f359a04e6ebc1b6a5d0b08 Reviewed-on: https://go-review.googlesource.com/c/go/+/719000 Reviewed-by: Mark Freeman <markfreeman@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-21net/http: fix typo in Transport docsVictor
Change-Id: Ifeb8d6d2e3fd4c8b0e27da62bec5cf28fe71db34 GitHub-Last-Rev: 5760fb106f58bf77817b9813f029d47be4ca7e3b GitHub-Pull-Request: golang/go#76316 Reviewed-on: https://go-review.googlesource.com/c/go/+/720800 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Sean Liao <sean@liao.dev>
2025-11-21net: remove unnecessary loop variable copies in testsPlamerdi Makela
Similar to CL 711640. Change-Id: I5cd9470138c80094eeb497cf4652d6a29cd795a6 GitHub-Last-Rev: 603fb5f4d55a12a773f2cb08b295578fb45ad14e GitHub-Pull-Request: golang/go#76253 Reviewed-on: https://go-review.googlesource.com/c/go/+/719600 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-11-20net/http/httputil: wrap ReverseProxy's outbound request body so Close is a noopNicholas S. Husin
Within ReverseProxy, we are currently sending a clone of our inbound request (from client) as our outbound request (to upstream). However, the clone of the request has a shallow copy of the request body. As a result, when the outbound request body is closed, the inbound request body (i.e. the outbound request body of the client) will also be closed. This causes an unfortunate effect where we would infinitely hang when a client sends a request with a 100-continue header via a ReverseProxy, but the ReverseProxy fails to make a connection to the upstream server. When this happens, the ReverseProxy's outbound request body would be closed, which in turns also closes the client's request body. Internally, when we close a request body, we would try to consume and discard the content. Since the client has yet to actually send the body content (due to 100-continue header) though, an infinite hang occurs. To prevent this, we make sure that closing an outbound request body from a ReverseProxy is a noop. For #75933 Change-Id: I52dc7247f689f35a6e93d1f32b2d003d90e9d2c6 Reviewed-on: https://go-review.googlesource.com/c/go/+/722160 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-20net/url: permit colons in the host of postgresql:// URLsDamien Neil
PostgreSQL's postgresql:// URL scheme permits a comma-separated list of host:ports to appear in the host subcomponent: https://www.postgresql.org/docs/11/libpq-connect.html#LIBPQ-MULTIPLE-HOSTS While this is not compliant with RFC 3986, it's something we've accepted for a long time. Continue to accept colons in the host when the URL scheme is "postgresql". Fixes #75859 Change-Id: Iaa2e82b0be11d8e034e10dd7f4d6070039acfa2c Reviewed-on: https://go-review.googlesource.com/c/go/+/722300 Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev>
2025-11-20net/http: drop unused "broken" field from persistConnDamien Neil
Change-Id: Ic65cf98c090c73299b5e88e642e91139315d8e52 Reviewed-on: https://go-review.googlesource.com/c/go/+/722221 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2025-11-20net/http: correctly close fake net.ConnsDamien Neil
Fix an inverted test in fakeNetConn.Close that caused closing a connection to not break the other half of the connection. Change-Id: I4e53f78402f8e503c749d57f294a4524abdccfb5 Reviewed-on: https://go-review.googlesource.com/c/go/+/722220 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-18Revert "net/http: do not discard body content when closing it within request ↵Nicholas S. Husin
handlers" This reverts commit cb0d9980f5721715ebb73dd2e580eaa11c2ddee2. Reason for revert: the old behavior seems to be relied on by current users, e.g. https://github.com/connectrpc/connect-go/blob/cb2e11fb88c9a61804043355a619c12d4a30a1a5/protocol_connect.go#L837. For #75933 Change-Id: I996280238e5c70a8d760a0b31e3a13c6a44b8616 Reviewed-on: https://go-review.googlesource.com/c/go/+/721761 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2025-11-14net/http: do not discard body content when closing it within request handlersNicholas S. Husin
(*body).Close() internally tries to discard the content of a request body up to 256 KB. We rely on this behavior to allow connection re-use, by calling (*body).Close() when our request handler exits. Unfortunately, this causes an unfortunate side-effect where we would prematurely try to discard a body content when (*body).Close() is called from within a request handler. There should not be a good reason for (*body).Close() to do this when called from within a request handler. As such, this CL modifies (*body).Close() to not discard body contents when called from within a request handler. Note that when a request handler exits, it will still try to discard the body content for connection re-use. For #75933 Change-Id: I71d2431a540579184066dd35d3da49d6c85c3daf Reviewed-on: https://go-review.googlesource.com/c/go/+/720380 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-11-13net/http: remove unused isLitOrSingle and isNotToken1911860538
isLitOrSingle and isNotToken are private and unused. Change-Id: I07718d4496e92d5f75ed74986e174a8aa1f70a88 GitHub-Last-Rev: 722c4dccd85dca5d28a52e95a4f9efbab2b11807 GitHub-Pull-Request: golang/go#76216 Reviewed-on: https://go-review.googlesource.com/c/go/+/718700 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-13net/http/cgi: accept INCLUDED as protocol for server side includesPeter Beard
The existing protocol check for fcgi/cgi requests did not properly account for Apache SSI (Server-Side Includes) SERVER_PROTOCOL value of INCLUDED. Added check for well-known INCLUDED value for proper implementation of the CGI Spec as specified in RFC 3875 - section 4.1.16. The SERVER_PROTOCOL section of the specification is outlined at https://www.rfc-editor.org/rfc/rfc3875.html#section-4.1.16 Fixes #70416 Change-Id: I129e606147e16d1daefb49ed6c13a561a88ddeb6 Reviewed-on: https://go-review.googlesource.com/c/go/+/715680 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Sean Liao <sean@liao.dev>
2025-11-12net/url: disallow raw IPv6 addresses in hostSean Liao
RFC 3986 requires square brackets around IPv6 addresses. Parse's acceptance of raw IPv6 addresses is non compliant, and complicates splitting out a port. This is a resubmission of CL 710176 after the revert in CL 711800, this time with a new urlstrictipv6 godebug to control the behavior. Fixes #31024 Fixes #75223 Change-Id: I4cbe5bb84266b3efe9c98cf4300421ddf1df7291 Reviewed-on: https://go-review.googlesource.com/c/go/+/712840 Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-29internal/itoa, internal/runtime/strconv: deleteRuss Cox
Replaced by internal/strconv. Change-Id: I0656a9ad5075e60339e963fbae7d194d2f3e16be Reviewed-on: https://go-review.googlesource.com/c/go/+/716001 Reviewed-by: David Chase <drchase@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-27net/url: further speed up escape and unescapeJulien Cretel
This change is a follow-up to CL 712200. It further simplifies and speeds up functions escape and unescape. Here are some benchmark results (no change to allocations): goos: darwin goarch: amd64 pkg: net/url cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz │ go/src/old │ go/src/new │ │ sec/op │ sec/op vs base │ QueryEscape/#00-8 34.58n ± 1% 31.97n ± 1% -7.55% (p=0.000 n=20) QueryEscape/#01-8 92.92n ± 0% 94.63n ± 0% +1.84% (p=0.000 n=20) QueryEscape/#02-8 75.44n ± 0% 73.32n ± 0% -2.80% (p=0.000 n=20) QueryEscape/#03-8 143.4n ± 0% 136.6n ± 0% -4.71% (p=0.000 n=20) QueryEscape/#04-8 918.8n ± 1% 838.3n ± 0% -8.76% (p=0.000 n=20) PathEscape/#00-8 43.93n ± 0% 42.86n ± 0% -2.44% (p=0.000 n=20) PathEscape/#01-8 94.99n ± 0% 95.86n ± 0% +0.91% (p=0.000 n=20) PathEscape/#02-8 75.40n ± 1% 71.50n ± 1% -5.18% (p=0.000 n=20) PathEscape/#03-8 143.4n ± 0% 136.2n ± 0% -4.99% (p=0.000 n=20) PathEscape/#04-8 871.8n ± 0% 822.7n ± 0% -5.63% (p=0.000 n=20) QueryUnescape/#00-8 52.64n ± 1% 51.19n ± 0% -2.75% (p=0.000 n=20) QueryUnescape/#01-8 137.4n ± 1% 137.9n ± 1% ~ (p=0.297 n=20) QueryUnescape/#02-8 114.0n ± 0% 122.3n ± 1% +7.24% (p=0.000 n=20) QueryUnescape/#03-8 271.8n ± 0% 260.7n ± 1% -4.08% (p=0.000 n=20) QueryUnescape/#04-8 1.390µ ± 1% 1.355µ ± 0% -2.52% (p=0.000 n=20) PathUnescape/#00-8 52.45n ± 1% 53.03n ± 1% +1.10% (p=0.008 n=20) PathUnescape/#01-8 138.5n ± 1% 141.3n ± 0% +2.06% (p=0.000 n=20) PathUnescape/#02-8 114.0n ± 0% 121.5n ± 0% +6.62% (p=0.000 n=20) PathUnescape/#03-8 273.1n ± 1% 260.1n ± 0% -4.76% (p=0.000 n=20) PathUnescape/#04-8 1.431µ ± 1% 1.359µ ± 0% -5.07% (p=0.000 n=20) geomean 160.4n 156.9n -2.14% Updates #17860 Change-Id: If64ac3e9c62c41f672db06cfd7eab7357e934e6d GitHub-Last-Rev: 1da047ac75f9a710baf75a45d105db4dc7b81810 GitHub-Pull-Request: golang/go#76048 Reviewed-on: https://go-review.googlesource.com/c/go/+/714900 Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com>
2025-10-23net/url: speed up escape and unescapeJulien Cretel
This change adds a generated 8-bit bitmask for use in functions shouldEscape and ishex. Function shouldEscape is now inlineable. Function escape is now much faster; function unescape is a bit faster. Here are some benchmark results (no change to allocations): goos: darwin goarch: amd64 pkg: net/url cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz │ old │ new │ │ sec/op │ sec/op vs base │ QueryEscape/#00-8 58.38n ± 1% 35.98n ± 1% -38.38% (p=0.000 n=20) QueryEscape/#01-8 303.50n ± 0% 94.77n ± 0% -68.77% (p=0.000 n=20) QueryEscape/#02-8 202.90n ± 0% 78.66n ± 1% -61.23% (p=0.000 n=20) QueryEscape/#03-8 444.5n ± 0% 145.9n ± 0% -67.17% (p=0.000 n=20) QueryEscape/#04-8 2678.0n ± 0% 913.7n ± 0% -65.88% (p=0.000 n=20) PathEscape/#00-8 81.34n ± 0% 44.64n ± 1% -45.12% (p=0.000 n=20) PathEscape/#01-8 307.65n ± 0% 96.71n ± 1% -68.56% (p=0.000 n=20) PathEscape/#02-8 200.80n ± 1% 78.25n ± 0% -61.03% (p=0.000 n=20) PathEscape/#03-8 450.1n ± 1% 145.5n ± 0% -67.67% (p=0.000 n=20) PathEscape/#04-8 2663.5n ± 0% 876.5n ± 0% -67.09% (p=0.000 n=20) QueryUnescape/#00-8 53.32n ± 1% 51.67n ± 1% -3.09% (p=0.000 n=20) QueryUnescape/#01-8 161.0n ± 1% 136.2n ± 1% -15.40% (p=0.000 n=20) QueryUnescape/#02-8 126.1n ± 1% 118.3n ± 1% -6.23% (p=0.000 n=20) QueryUnescape/#03-8 294.6n ± 0% 273.1n ± 0% -7.30% (p=0.000 n=20) QueryUnescape/#04-8 1.511µ ± 0% 1.411µ ± 0% -6.62% (p=0.000 n=20) PathUnescape/#00-8 63.84n ± 1% 53.59n ± 1% -16.05% (p=0.000 n=20) PathUnescape/#01-8 163.6n ± 3% 137.9n ± 1% -15.71% (p=0.000 n=20) PathUnescape/#02-8 126.4n ± 1% 119.1n ± 1% -5.78% (p=0.000 n=20) PathUnescape/#03-8 294.2n ± 0% 273.3n ± 0% -7.12% (p=0.000 n=20) PathUnescape/#04-8 1.554µ ± 0% 1.417µ ± 0% -8.78% (p=0.000 n=20) geomean 277.8n 162.7n -41.44% This change draws heavy inspiration from CL 174998, which showed promise but stalled years ago. Updates #17860 Change-Id: Idcbb1696608998b9e2fc91e1f2a488d8f1f6028c GitHub-Last-Rev: ff360c2f1b51b1e725d10c0864a6b698d3a5ffc3 GitHub-Pull-Request: golang/go#75914 Reviewed-on: https://go-review.googlesource.com/c/go/+/712200 Reviewed-by: David Chase <drchase@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Jorropo <jorropo.pgm@gmail.com> Reviewed-by: Takuto Nagami <logica0419@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2025-10-21all: eliminate unnecessary type conversionsJes Cok
Found by github.com/mdempsky/unconvert Change-Id: I88ce10390a49ba768a4deaa0df9057c93c1164de GitHub-Last-Rev: 3b0f7e8f74f58340637f33287c238765856b2483 GitHub-Pull-Request: golang/go#75974 Reviewed-on: https://go-review.googlesource.com/c/go/+/712940 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Keith Randall <khr@golang.org> Auto-Submit: Keith Randall <khr@golang.org> Reviewed-by: Keith Randall <khr@google.com> Reviewed-by: David Chase <drchase@google.com>
2025-10-20net/url: reduce allocs in EncodeJulien Cretel
This change adds benchmarks for Encode and reverts what CL 617356 did in this package. At the moment, using maps.Keys in conjunction with slices.Sorted indeed causes a bunch of closures to escape to heap. Moreover, all other things being equal, pre-sizing the slice in which we collect the keys is beneficial to performance when they are "many" (>8) keys because it results in fewer allocations than if we don't pre-size the slice. Here are some benchmark results: goos: darwin goarch: amd64 pkg: net/url cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz │ old │ new │ │ sec/op │ sec/op vs base │ EncodeQuery/#00-8 2.051n ± 1% 2.343n ± 1% +14.24% (p=0.000 n=20) EncodeQuery/#01-8 2.337n ± 1% 2.458n ± 4% +5.16% (p=0.000 n=20) EncodeQuery/oe=utf8&q=puppies-8 489.6n ± 0% 284.5n ± 0% -41.88% (p=0.000 n=20) EncodeQuery/q=dogs&q=%26&q=7-8 397.2n ± 1% 231.7n ± 1% -41.66% (p=0.000 n=20) EncodeQuery/a=a1&a=a2&a=a3&b=b1&b=b2&b=b3&c=c1&c=c2&c=c3-8 743.1n ± 0% 519.0n ± 0% -30.16% (p=0.000 n=20) EncodeQuery/a=a&b=b&c=c&d=d&e=e&f=f&g=g&h=h&i=i-8 1324.0n ± 0% 931.0n ± 0% -29.68% (p=0.000 n=20) geomean 98.57n 75.38n -23.53% │ old │ new │ │ B/op │ B/op vs base │ EncodeQuery/#00-8 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=20) ¹ EncodeQuery/#01-8 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=20) ¹ EncodeQuery/oe=utf8&q=puppies-8 168.00 ± 0% 56.00 ± 0% -66.67% (p=0.000 n=20) EncodeQuery/q=dogs&q=%26&q=7-8 112.00 ± 0% 32.00 ± 0% -71.43% (p=0.000 n=20) EncodeQuery/a=a1&a=a2&a=a3&b=b1&b=b2&b=b3&c=c1&c=c2&c=c3-8 296.0 ± 0% 168.0 ± 0% -43.24% (p=0.000 n=20) EncodeQuery/a=a&b=b&c=c&d=d&e=e&f=f&g=g&h=h&i=i-8 680.0 ± 0% 264.0 ± 0% -61.18% (p=0.000 n=20) geomean ² -47.48% ² ¹ all samples are equal ² summaries must be >0 to compute geomean │ old │ new │ │ allocs/op │ allocs/op vs base │ EncodeQuery/#00-8 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=20) ¹ EncodeQuery/#01-8 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=20) ¹ EncodeQuery/oe=utf8&q=puppies-8 8.000 ± 0% 3.000 ± 0% -62.50% (p=0.000 n=20) EncodeQuery/q=dogs&q=%26&q=7-8 7.000 ± 0% 3.000 ± 0% -57.14% (p=0.000 n=20) EncodeQuery/a=a1&a=a2&a=a3&b=b1&b=b2&b=b3&c=c1&c=c2&c=c3-8 10.000 ± 0% 5.000 ± 0% -50.00% (p=0.000 n=20) EncodeQuery/a=a&b=b&c=c&d=d&e=e&f=f&g=g&h=h&i=i-8 12.000 ± 0% 5.000 ± 0% -58.33% (p=0.000 n=20) geomean ² -43.23% ² ¹ all samples are equal ² summaries must be >0 to compute geomean Change-Id: Ia0d7579f90434f0546d93b680ab18b47a1ffbdac GitHub-Last-Rev: f25be71e070c2c2f3a2587eea872ca52f3533c40 GitHub-Pull-Request: golang/go#75874 Reviewed-on: https://go-review.googlesource.com/c/go/+/711280 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Keith Randall <khr@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: t hepudds <thepudds1460@gmail.com>
2025-10-17all: remove unnecessary loop variable copies in testsTobias Klauser
Copying the loop variable is no longer necessary since Go 1.22. Change-Id: Iebb21dac44a20ec200567f1d786f105a4ee4999d Reviewed-on: https://go-review.googlesource.com/c/go/+/711640 Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-16cmd: update to x/tools@7d9453ccAlan Donovan
go get golang.org/x/tools@master go mod tidy go mod vendor in both cmd and src, for (enforced) consistency. Also: GOWORK=off go generate -run=bundle std This will enable use of modernize and inline. Change-Id: I6348dd97ec2c41437b3ca899ed91f10815f2fe26 Reviewed-on: https://go-review.googlesource.com/c/go/+/707135 Reviewed-by: Michael Matloob <matloob@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Alan Donovan <adonovan@google.com> Reviewed-by: Michael Matloob <matloob@golang.org>
2025-10-15net/http/httptest: record failed ResponseWriter writesDamien Neil
CL 709335 changed ResponseWriter.Write to return an error when trying to write to a response with a status code which doesn't permit a body, such as 304. Continue to return an error, but still record the write in ResponseWriter.Body. This maintains the documented property that "the data in buf is written to rw.Body". For #75471 Change-Id: I69139797559fe09d6580c5d25b4458f04263c60e Reviewed-on: https://go-review.googlesource.com/c/go/+/711940 Reviewed-by: Sean Liao <sean@liao.dev> TryBot-Bypass: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2025-10-14Revert "net/url: disallow raw IPv6 addresses in host"Damien Neil
This reverts commit e3be2d1b2b68d960398a343805f77052d5decb22. Reason for revert: Causes extensive failures in Google-internal testing. Change-Id: I232f547fc326dff7df959d25f3a89777ea33b201 Reviewed-on: https://go-review.googlesource.com/c/go/+/711800 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2025-10-13all: replace calls to errors.As with errors.AsTypeJulien Cretel
This change replaces most occurrences (in code as well as in comments) of errors.As with errors.AsType. It leaves the errors package and vendored code untouched. Change-Id: I3bde73f318a0b408bdb8f5a251494af15a13118a GitHub-Last-Rev: 8aaaa36a5a12d2a6a90c6d51680464e1a3115139 GitHub-Pull-Request: golang/go#75698 Reviewed-on: https://go-review.googlesource.com/c/go/+/708495 Auto-Submit: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Alan Donovan <adonovan@google.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2025-10-10net/url: disallow raw IPv6 addresses in hostSean Liao
RFC 3986 requires square brackets around IPv6 addresses. Parse's acceptance of raw IPv6 addresses is non compliant, and complicates splitting out a port. Fixes #31024 Fixes #75223 Change-Id: I477dc420a7441cb33156627dbd5e46d88c677f1e Reviewed-on: https://go-review.googlesource.com/c/go/+/710176 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2025-10-10net/http: strip request body headers on POST to GET redirectsSean Liao
According to WHATWG Fetch, when the body is dropped in a redirect, headers that describe the body should also be dropped. https://fetch.spec.whatwg.org/#http-redirect-fetch Fixes #57273 Change-Id: I84598f69608e95c1b556ea0ce5953ed43bf2d824 Reviewed-on: https://go-review.googlesource.com/c/go/+/710395 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-10net/http: set cookie host to Request.Host when availableSean Liao
When both Request.URL and Request.Host are set, the host in URL is used for connecting at the transport level, while Host is used for the request host line. Cookies should be set for the request, not the underlying connection destination. Fixes #38988 Change-Id: I09053b87ccac67081f6038d205837d9763701526 Reviewed-on: https://go-review.googlesource.com/c/go/+/710335 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 06:09:24 +0000