Changed the base64 pattern to only accept token68 pattern from rfc7235#appendix-C
Add limit to recusion depth of multiple challange matching to stop any vulnerablilties related to malicious server overflowing client stack
Regex no longer allows trailing whitespace
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
- Multiple challanges in the same header can now be parsed successfully.
- Will now allow a base64 value after the auth-scheme instead of parameters. Which can be used for the Negotiate auth-scheme.
- Added more in depth testing for tricky cases.
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
Removed the regex to separate out the realm parameter and instead parse it with the other parameters into HeaderInfo.
Changed HeaderInfo to store the parsed parameters as a Map instead of the un-parsed parameters in a string.
The parsing of the parameters is now done in AuthenticationProtocolHandler.newHeaderInfo(String) and then passed into the HeaderInfo instead of Parsing it in DigestAuthentication.
Replaced the usage of splitParams(String) with QuotedCSV used to parse the parameters.
Added test to check the ordering of parameters doesn't matter.
Allow not to have a realm parameter, changed DigestAuthentication.matches() to not match if realm is null, so that Digest Authentication requires realm parameter but any Basic Authentication can be done without it. There is currently no tests for this.
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
Regex will now look for comma and spaces before realm. Preventing issues accepting params with realm as a suffix like blahrealm.
Stops adding double commas when extracting realm param.
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
Fixed method, added Javadocs and cleaned up code with a few renamings
to better comply with AtomicLong naming.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Introduced ConnectionPool.Multiplexable for connection pools that support multiplexing.
Reworked RoundRobinConnectionPool to support multiplexing.
Moved tests to test RoundRobinConnectionPool with both HTTP/1.1 and HTTP/2.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Now exiting the parse loop when the response is complete; if there
are bytes remaining in the buffer, then it's cleared out.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Changed the signature of HttpParser.Listener.onBadMessage()
to take a BadMessageException and updated dependent code.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Introduced property connectBlocking in HTTP2Client so that it can
be forwarded by HttpClient and then used for HTTP/2 connects.
Also introduced HTTP2Client.bindAddress, again forwarded from HttpClient.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Issue #2293 Pending Multiplexed Connections
Added a AtomicBiInteger to allow both total connections and pending connections to be encoded in the
same atomic int.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
Modified uri value in Authorized header as per discussion in #2160.
Signed-off-by: Alex Bleasdale <ableasdale@marklogic.com>
Reviewed-by: Simone Bordet <simone.bordet@gmail.com>
There are still problems with this impl (some client tests ignored) and there is still a work around for the JNR bug 50, however this impl is already much better than the unix socket support that is already in the release. So will merge for now and put more effort in once there is a JNR fix.
* WIP add unix domain sockets support in HttpClient
* move unix socket client part to unix socket module #2014
* some cleanup #2014
* add missing headers #2014
* add TODO
* UnixSocket client refactor
* cleanup test and pom
* minor changes, use LOG.isDebugEnabled() before using debug method
* add UNIX SOCKET http client test with all other tests, push this to see what happen on Jenkins
* fix some unit tests
* fix more tests
* fix load test
* UnixSocket client
* Demonstrate JNR bug
* Worked around JNR bug 50
* close channel on client side as well
* more details in log
* log file path as well
* #2014 disable test per default as doesn't work on some environement
* Revert "#2014 disable test per default as doesn't work on some environement"
* test only on unix
* Allow test of specific transport(s)
* Move unix socket to /tmp
* move test socket to /tmp
* move test socket to /tmp
* ignore failing tests for now
* fix bean name and possible to use sys prop org.eclipse.jetty.http.client.AbstractTest.Transports with mvn cli
* test isBlank as surefire props is not null
* correctly create tmp file with @Before
* do not delete file
* use /tmp as build directory doesn't seem to work within docker...
* do not delete sock file on client as it is own by the server
* file must not exist when binding unix socket
* #2014 fix license header
* network specific tests assumed
* Fixed to handle null selector keys
* add assume for tests that assume a network connector
Signed-off-by: olivier lamy <olamy@webtide.com>
Signed-off-by: Greg Wilkins <gregw@webtide.com>
Fixed destroy of HttpChannel for HTTP/1.1: not at release()
because the connection and therefore the channel will be reused,
but at close(), when we're sure the connection will not be reused.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
* Scalable scheduler changes for #1918
* Added HttpChannel.destroy to destroy CyclicTimer
* fixed rebase with HttpConnectionOverFCGI
* renamed to acquire
* Destroying the HttpChannel consistently in all transports.
* updated headers
* cleanup after final review
Signed-off-by: Greg Wilkins <gregw@webtide.com>
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
* Clean up of actions (now updates) prior to #2046 fix
* prevent exceptions from termincating lifecycle doStop or destroy
* Refactored ManagedSelector stop to always close endpoints
* Fixed NPE if SelectorManager is already stopped
* refactored after review
* further simplifications after review
* Wait only for oshut endpoints
* Cleanup from review
Signed-off-by: Greg Wilkins <gregw@webtide.com>
Lachlan Roberts
Simone Bordet
Joakim Erdfelt
WalkerWatch
Greg Wilkins
olivier lamy
Jesse McConnell
Alex Bleasdale
Jan Bartel