* Issue #4247 SameSite Session Cookie
Allows sameSite cookie settings to be configured in SessionCookieConfig comments
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4247 SameSite Session Cookies
Use non versioned cookie
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4247 SameSite Session Cookies
Added test and fixed getCommentWithAttributes
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4247 - Updating unit tests for HttpCookie
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4247 SameSite Session Cookie
While it may be best practise to always use Secure cookies when SameSite is None, there is nothing in the RFC that mandates it and thus I don't believe we should prevent such a configuration. If browsers enforce this, then users will find out soon enough... and if browsers change, then we are not required to do a new release to match.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4247 SameSite Session Cookie
For cookie comments with multiple SameSite attributes, the most strict
value is used. So `Strict` has precedence over `Lax` which has
precedence over `None`.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Avoid creating listener list for rarely used requestAttributeListener
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3964
Keep a list of EventListeners in the AbstractConnector to make it
more efficient to add and iterate over them.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
Use addEventListener rather than bespoke listener methods.
Support getEventListenerBeans at Container level for fast lookup
improve javadoc
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
fixed test
more javadoc
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
fixed tests
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3964
Don't use null for empty lists of listeners
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* fix merge
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
Resolve differences between eventListeners added as beans and beans
added as EventListeners. The behaviour should now be the same
regardless of how they listener is added and all listeners are now
beans.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
Add only SelectorManager listeners to manager from connector
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
Fixed javadoc
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
removed old TODO
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
connector cannot be null
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
javadoc
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3964
AbstractConnector keeps a specific list of HttpChannel.Listeners
to avoid Connection.Listeners and MBean listeners being added to
the HttpChannel listener list.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
fixed merge
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* fixed javadoc
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #2578 EventListener
removed the ability to set/clear context listeners
Instead just remove non-durable ones.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3964 Listeners
Simplified listener handling by avoiding null connector, previously
only needed for testing.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* fixed bad merge
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3964 Listeners
Fixed test that assumed HttpChannel listeners were not cleared by a recycle
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3964 Listeners
Separated out durable vs cyclic HttpChannel.Listeners, so as to
simplify handling.
Deprecated cyclic HttpChannel.Listeners, as I'm not sure the channel is
the right place for them.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* removed deprecated cyclic HttpChannel listeners
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* removed deprecated cyclic HttpChannel listeners - import
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4003 Cleanup quickstart
* Fixed tests that scan for "Started" on console
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* updates from review
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4161 - TestCase that can replicate problem on OSX
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4161 - Naming Server threadpool (to help with debugging)
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4161 - bumping up test file size to 10 MB
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4161 Write LifeCycleViolation
Do not callback on write completion until after state has been changed and notifications made.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4161 Write LifeCycleViolation
Added a unit test that replicated the problem.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4161 - `EofException: request lifecycle violation` in stderr.
Moved notifications of commit and content listeners back to succeeded().
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
* Issue #4161 - Improved Logging for test-integration
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4161 - Reducing size of test file
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #3863 - Enforce use of SNI.
Introduced SslContextFactory.rejectUnmatchedSNIHost (default false)
so that if no SNI is sent, or SNI does not match a certificate,
then the TLS handshake is aborted.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
* Issue #3863 - Enforce use of SNI.
Updates after review.
Introduced SslContextFactory.SNISelector to allow application to write
their custom logic to select a certificate based on SNI information.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
* Issue #3863 Enforce SNI
Added two sniRequired fields - one at SslContextLevel and the other at the SecureRequestCustomizer. This allows rejection either at TLS handshake or by 400 response.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3863 Enforce SNI
cleanups from review
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3863 Enforce SNI
improved comments
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3863 Enforce SNI
syntax sugar
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #3863 SNI
Updates from review. Extra test for sniSelector function
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4265 Remove doError
The doError method and the ErrorDispatchHandler class were
hang overs from when we needed to dispatch into a context to get sendError called, which would then generate the error page.
Now sendError doesn't do any generation, rather it changes state that arranges either for a minimal error page to be generated or an ERROR dispatch to a real handler/servlet to generate the error page.
Thus the ErrorDispatchHandler and doError methods can now be removed.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4265 Remove doError
Moved the error page dispatching logic back to the ErrorHandler class to assist with backwards compatibility
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4265 Remove doError
Moved the error page dispatching logic back to the ErrorHandler class to assist with backwards compatibility
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4265 doError
Updates from review.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4203 - Updating test to verify report on Transfer-Encoding
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Fixes#4203 - Transfer-Encoding + Content-Length is 400 Bad Request
+ Fixing validation to not be header order dependent.
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4203 - Fixing hasTransferEncoding reset and testcase assumption
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4204 - Transfer-Encoding RFC7230 behaviors
+ More test cases and implementation.
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4204 - Transfer-Encoding RFC7230 behaviors
+ Adjusting HttpParser to handle the case where we have multiple
Transfer-Encoding headers and none declare the 'chunked' token.
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4204 - Transfer-Encoding RFC7230 behaviors
+ Making changes from PR review
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4203 Transfer Encoding
request with TE and no chunking is a Bad Request
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* issue exclude/include con name InetAccesHandler - add better unit test
this logic:
String name =
baseRequest.getHttpChannel().getConnector().getName();
return _names.test(name) && _addrs.test(addr);
Is not correct. it's treating the connector name exactly like the
filter. But that's not what it's intended to do. It's supposed to tell
what connectors are applicable to this filter. And what connectors are
not affected.
For example in the unit test there exists 2 connectors:
http
tls
We want to restrict the http connector, but we want to leave tls
connector alone.
So we would specify:
include = 192.168.1.1-192.168.1.254
includeConnector = http
The way the logic is above, it is treating the connector name as if it's
the filter itself. Which is not what I intended.
What i need in psuedo-code is this:
if (there are no "include connectors" OR if this connector is
included) AND (if this connector is not in the excluded list)
---> Then apply the IP filter.
Signed-off-by: Nicholas DiPiazza <nicholas.dipiazza@lucidworks.com>
* exclude should take precedence over include
Signed-off-by: Nicholas DiPiazza <nicholas.dipiazza@lucidworks.com>
* Issue #4193 InetAccessHandler
reverted changes to IncludeExcludeSet
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4193 InetAccessHandler
updates from review
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4208 Content-Length in 304
Added tests for RFC7230 section 3.3.2 for 304 and HEAD responses with content length.
Fixed HttpGenerator to set content-length in 304 response
Fixed insufficient content written check for 304
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4208 Content-Length in 304
Use contentLengthField
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4188 Spin in close of GzipHandler
Cleanup and simplify code
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4188 Spin in close of GzipHandler
Fix slice code. Added unit test for it.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4188 Spin in close of GzipHandler
Fixed last slice.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* cleanup from review
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4156 - Adding test to replicate issue
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Issue #4156 Session already in cache
+ check validity of sessions in getSession(SessionHandler)
+ do not replace session in doScope if SessionHandler is the same.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4176 setHeader after sendError
SendError now makes the response immutable for headers and status.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4176 setHeader after sendError
cleanup after review
better names
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4176 setHeader after sendError
better name
Signed-off-by: Greg Wilkins <gregw@webtide.com>
* Issue #4176 setHeader after sendError
even better name
Signed-off-by: Greg Wilkins <gregw@webtide.com>
The HttpConnection.SendCallback nulls it's reference to buffers and callbacks after completion to assist with easy GC, since the connection callback is a long lived instance.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
The connection upgrade check is necessary both after the parsing and
after the handling. After the parsing covers HTTP/2 prior knowledge
"PRI * HTTP/2" case; after the handling covers the WebSocket case.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Added test to reproduce issue
Fixed bug from #2772 where output was shutdown on DONE without checking for END.
Fixed aggregation logic to aggregate last write if aggregation already started
Improved comments and clarify conditions
Signed-off-by: Greg Wilkins <gregw@webtide.com>
Introduced module `jdbc` and made other modules that require JDBC depend on it.
Modified demo.ini to enable the `jdbc` module because some webapp descriptor
of the demo requires JDBC classes.
Now the demo can be run fine on the module-path just by adding --jpms.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
olivier lamy
Lachlan Roberts
Jan Bartel
Joakim Erdfelt
Simone Bordet
Greg Wilkins