h2_session_shutdown() passed its reason, an APR or nghttp2 status, as the
error code of the GOAWAY frame. A connection timeout was sent as 70007
(APR_TIMEUP), an inadequate TLS connection as 22 (APR_EINVAL).
Give h2_session_shutdown() the HTTP/2 error code as a separate argument.
Timeouts and graceful shutdowns send NO_ERROR, failures INTERNAL_ERROR
and inadequate TLS parameters INADEQUATE_SECURITY.
PR: 70212
GitHub: closes#799
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939156 13f79535-47bb-0310-9956-ffa450edef68
* modules/http2/h2_stream.c (h2_stream_create_input): do not reject a
':path' of '*' with a ':scheme' present when the method is OPTIONS
over http/https; pass the asterisk-form through as is.
* test/modules/http2/test_203_rfc9113.py (test_h2_203_03_options_asterisk,
test_h2_203_04_invalid_path): Add tests.
Submitted by: Arturo Bernal <abernal apache.org>
PR: 70195
GitHub: closes#788
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938821 13f79535-47bb-0310-9956-ffa450edef68
* modules/http2/h2_stream.c (h2_stream_add_header): Guard the AH10178,
AH10180 and AH10181 log messages on stream->request_headers_failed
rather than h2_stream_is_ready().
(h2_stream_end_headers): Likewise for AH10230.
Submitted by: Michael Kaufmann <mail michael-kaufmann.ch>
* test/modules/http2/test_111_header_limit_log.py: New test, checking
that AH10181 is logged exactly once for a request with many headers
over LimitRequestFields.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: closes#765, closes#666
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938328 13f79535-47bb-0310-9956-ffa450edef68
Done with the help of Claude Code Opus 4.6
this closes#731
M test/modules/http1/env.py
M test/modules/http2/env.py
M test/modules/http2/test_006_assets.py
M test/modules/http2/test_103_upgrade.py
M test/modules/http2/test_104_padding.py
M test/modules/http2/test_107_frame_lengths.py
M test/modules/http2/test_202_trailer.py
M test/modules/http2/test_400_push.py
M test/modules/http2/test_401_early_hints.py
M test/modules/http2/test_710_load_post_static.py
M test/modules/http2/test_711_load_post_cgi.py
M test/pyhttpd/certs.py
M test/pyhttpd/conf/httpd.conf.template
M test/pyhttpd/env.py
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937863 13f79535-47bb-0310-9956-ffa450edef68
test_h2_203_02 intentionally triggers AH02430 (illegal response header
char). Over HTTP/2 the error is logged late during stream teardown and
can produce several lines, so the per-case ignore_recent() raced them
and they leaked into a later test's check_error_log(). Move the ignore
to an autouse class fixture (as conftest.py does for AH10400/AH00045)
and add HttpdErrorLog.remove_ignored_lognos() to restore on teardown.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934891 13f79535-47bb-0310-9956-ffa450edef68
Performance:
- Accept drain loop: motorz_io_accept now drains the kernel accept queue
in one poll wakeup (do/while until EAGAIN, admission-disabled, or die_now)
instead of one connection per round-trip through apr_pollset_poll. Eliminates
O(N) poll wakeups for N burst connections.
- Hot-path log levels: 25 APLOG_DEBUG calls on the per-request path demoted to
APLOG_TRACE6/TRACE7/TRACE8, matching event MPM practice. Error and admission-
control events remain at DEBUG.
- Redundant pollset_remove removed: the defensive apr_pollset_remove in
motorz_io_process is gone from the common dispatch path (connection is already
claimed before reaching here); isolated to the clogging-filter branch where it
is actually needed.
- Admission control: added active-thread saturation check (active >= threads_per_child)
alongside the existing idle==0 and pending>=hi checks, catching slow-client /
keep-alive-heavy saturation where the task queue appears empty but all workers
are blocked in I/O. apr_size_t underflow fix: read total before idle, clamp
active = (total > idle) ? total - idle : 0, preventing spurious disable during
graceful restart.
- Hysteresis low-water mark tightened from 50% to 75% of ThreadsPerChild, so
the listener re-enables sooner after a burst subsides.
Bug fixes:
- Clogging-filter timer race (use-after-free): the SSL/clogging path in
motorz_io_process bypassed motorz_conn_claim(). A pending timer could fire
concurrently while the worker was inside ap_run_process_connection(), dispatching
a timeout worker on the same scon. Fixed by replacing the bare pollset_remove
with motorz_conn_claim(), which atomically disarms both the pollset entry and
the timer under poller->mtx.
- motorz_resume_suspended: restore c->sbh before ap_run_resume_connection().
motorz_suspend_connection() NULLs c->sbh (matching event's notify_suspend);
without this fix any module calling ap_update_child_status(c->sbh) after
resume dereferenced NULL.
- SERVER_BUSY_READ scoreboard update: add ap_update_child_status(scon->sbh,
SERVER_BUSY_READ, NULL) before ap_run_process_connection(), matching event MPM
and fixing misleading mod_status output where motorz connections showed as
SERVER_READY throughout the read/process phase.
- requests_this_child data race: written by the accepting poller thread, read
by the supervisor main thread. Declared volatile to prevent stale cached reads
across threads.
- conn_id always zero: every connection was created with conn_id=0, breaking
%{connection} log formats and any module keying state on c->id. Now derived
as ID_FROM_CHILD_THREAD(my_child_num, atomic_seq), matching worker/event MPM
formula for globally unique IDs across children and connections.
- ap_create_sb_handle hardcoded child 0: all connections reported as child 0
in the scoreboard, making mod_status show all activity in slot [0][0].
Now passes my_child_num so each child's activity appears in the correct slot.
- Worker threads not drained on exit: apr_thread_pool_destroy() is now called
in clean_child_exit() before apr_pool_destroy(pchild), joining all workers
and preventing use-after-free in ap_log_error / apr_pool_clear after the
pool is torn down.
- ThreadsPerChild 1 throughput collapse: the hysteresis low-water mark becomes
(1*3)/4=0, so listeners only re-enable when the task queue is completely
empty. Added startup/runtime warnings (APLOGNO 10555/10556) advising
ThreadsPerChild >= 4. next-number advanced to 10557.
Multi-poller scale-out (PollersPerChild):
- motorz_core_t no longer holds a single pollset/timeout_ring/mtx/recycle-list;
these are moved to per-poller motorz_poller_t contexts.
- Each poller owns its pollset, skiplist timer ring, ring mutex, and lock-free
MPSC transaction-pool recycle list, so pollers never contend with each other.
- Connections are sharded round-robin to pollers at accept time (scon->poller);
pool recycling returns to the accepting poller's free-list (scon->pool_poller).
- PollersPerChild directive added (0 = auto from online CPUs, capped at 8).
- Listener admission control and the pipe-of-death/generation supervision are
isolated to poller 0 and the main-thread supervisor respectively.
- AP_MPMQ_CAN_SUSPEND / motorz_resume_suspended hook wired in for full
async-suspend support (fix for CONN_STATE_SUSPENDED lifecycle).
- Non-blocking lingering close: replaced blocking ap_lingering_close() with
motorz_start_lingering_close() / motorz_lingering_close() that hand the
draining socket back to the poll loop with a bounded linger timeout.
- Pool cleanup (motorz_conn_pool_cleanup) cancels the timer under poller->mtx
so pool destruction never leaves a dangling skiplist entry.
Async HTTP/2 handoff -- ENABLED (MOTORZ_ENABLE_ASYNC 1):
- motorz reports AP_MPMQ_IS_ASYNC=1 / AP_MPMQ_CAN_WAITIO=1. motorz_io_process()
implements CONN_STATE_ASYNC_WAITIO: arm the pollset for read/write per
c->cs->sense under Timeout and re-dispatch into PROCESSING, mirroring event.
New APLOGNOs 10557-10559.
- Clogging-filter branch honors the hook-returned connection state
(WRITE_COMPLETION / ASYNC_WAITIO / SUSPENDED) and maps KEEPALIVE to
WRITE_COMPLETION instead of force-closing to LINGER. h2 c2 connections set
clogging_input_filters unconditionally, so the old behavior collapsed h2
keep-alive into one-shot connections.
- Forward-declare motorz_update_listeners() (called from motorz_io_accept
before its definition; an implicit declaration is a hard error under strict
C). Replaced a dead duplicate clean_child_exit prototype.
The async-handoff churn bug -- FIXED in mod_http2 (h2_session.c):
Under async handoff mod_http2 hands the master (c1) connection back to the MPM
between requests; motorz re-dispatches it on a fresh worker. Under rapid HTTP/2
connection churn this raced mod_http2's stream lifecycle: a client's graceful
GOAWAY drove the c1 session straight to DONE -> CONN_STATE_LINGER, and the MPM
close ran m_stream_cleanup()/h2_c2_abort() on any stream whose secondary
connection (c2) had emitted its response but not yet called c2_prod_done() --
silently dropping that response (~0.2-3% under h2load -n.. -c50 -m1).
The fix establishes the invariant "a c1 connection is closed only after every
stream's c2 has finished and flushed", in two points in h2_session.c:
* h2_session_ev_remote_goaway(): a graceful GOAWAY (error code 0) with
streams still in flight no longer transits to H2_SESSION_ST_DONE. It RSTs
only the unprocessed streams and keeps the session running so the in-flight
streams complete and their c2 output is written. (An error GOAWAY, or one
with no open streams, still goes to DONE immediately.) This also matches
RFC 9113: a peer GOAWAY stops new streams, it does not abort streams at or
below its last-stream-id.
* H2_SESSION_ST_IDLE handling: once those streams drain (open_streams == 0)
and the remote has shut down, send our GOAWAY and go to DONE from IDLE.
Reaching DONE only here -- after the c2s are done and flushed -- keeps the
close from racing an in-flight c2.
This benefits mpm_event too and is a conformance improvement, not just a
motorz workaround. MOTORZ_ENABLE_ASYNC remains a single flip point (set 0 to
fall back to advertising IS_ASYNC=0) should a regression ever reappear.
Hardening of the fix (this change):
- motorz.c, smoke.sh: corrected stale "async DISABLED" comments that still
described the old workaround while the code already enabled async.
- h2_session.c: documented the liveness bound -- keeping the session alive on a
graceful GOAWAY cannot pin c1 open indefinitely, since a wedged c2 is bounded
by its own request Timeout, which drops open_streams and lets c1 reach IDLE.
- h2_session.h: documented the open_streams threading invariant the fix now
relies on (c1-thread only; async re-dispatch is successive not concurrent, so
no atomics/volatile needed; decrements to 0 only after each c2 has flushed).
Tests (server/mpm/motorz/test/): setup.sh configures+builds httpd; run-all.sh
runs the smoke, HTTP/1.1, and HTTP/2-over-TLS suites; bench.sh compares motorz
vs event throughput. The async assertions expect async ON
(CONN_STATE_ASYNC_WAITIO arms / "returning to mpm c1 monitoring" appears).
The churn regression measures the fix correctly (two pitfalls, documented in
MOTORZ.README and encoded in the tests):
* Assert on RESPONSE LOSS (started - succeeded), NOT on h2load's "failed"
total. "failed" also counts connection-establishment errors (ephemeral
port / accept-queue pressure on busy loopback) which are environmental and
appear with and without the fix; only started > succeeded is this bug.
* Measure at LogLevel info, NOT trace8. The bug is a Heisenbug; trace8 slows
the hot path enough to hide it, so a churn assertion run under trace8
passes even with the fix removed (vacuous). The load-bearing churn
regression is in run-http2.sh at info; smoke.sh runs at trace8 for its
state-machine traces, so its churn check is a gross-sanity pass only.
Full analysis, reproduction recipe, and the fix are in
server/mpm/motorz/MOTORZ.README ("HTTP/2 async handoff").
Official mod_http2 pytest suite (test/modules/http2/): test_h2_106_02 now
skips on MPMs that do not register ServerLimit (i.e. mpm_motorz, whose static
fixed-size process pool makes StartServers the hard daemon limit, so ServerLimit
is meaningless and unregistered). The test's ServerLimit/MaxConnectionsPerChild
config is a syntax error there; prefork/worker/event still run it unchanged.
MaxConnectionsPerChild itself IS supported by motorz (a core directive honored by
the supervisor). Validated: full http2 suite green on both event and motorz
(only known flaky proxy-backend tests aside), and the motorz custom suite
(smoke/http1/http2) passes with 0 churn response-loss.
Docs and packaging: add the mpm_motorz manual page (docs/manual/mod/motorz.xml
+ .meta, registered in allmodules.xml) documenting the threading model, async
handling, admission control, and the PollersPerChild directive; add a CHANGES
entry; and insert motorz into the default-MPM fallback chain (server/mpm/
config2.m4) between event and worker.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934868 13f79535-47bb-0310-9956-ffa450edef68
- rename hook parameter, because python thought this is a super good idea
- change call property to method because it no longer worked
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1933904 13f79535-47bb-0310-9956-ffa450edef68
older and newer curl versions. Only a change in logging,
no function module change.
Newer curl send a GOAWAY on connection shutdown which
triggers another code path that the test did not expect.
Thanks to Rainer Jung for tracking this down.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1923187 13f79535-47bb-0310-9956-ffa450edef68
Count failed requests that are RST'ed, so that the
connection enters keepalive timeout instead of the
regular timeout if the first request fails.
Add tests to verify.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1921805 13f79535-47bb-0310-9956-ffa450edef68
- shutdown server at end of h2 tests
- adapt minimum httpd versions for some tests
- add test_700_20 for load on blocked connections,
disabled for now until mpm_event improves
- build websocket client automatically
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1919087 13f79535-47bb-0310-9956-ffa450edef68
in modules/http2/test_800_websockets.py
(test_h2_800_03_not_found and
test_h2_800_05_non_ws_delay_resource) due to
additional RST messages.
Maybe we should allow RST after EOF in all websocket tests?
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1916830 13f79535-47bb-0310-9956-ffa450edef68
in modules/http2/test_800_websockets.py
(test_h2_800_04_non_ws_resource and
test_h2_800_09b_unsupported) due to
additional RST messages.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1916808 13f79535-47bb-0310-9956-ffa450edef68
It's easier to control errors at the function scope and it avoids ignored
errors/warnings to propagate to the following tests (i.e. mask further
unexpected errors).
github: closes#371
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1910844 13f79535-47bb-0310-9956-ffa450edef68
of HTTP/2 requests in a forward proxy configuration.
General forward proxying is enabled via `ProxyRequests`. If the
HTTP/2 protocol is also enabled for such a server/host, this new
directive is needed in addition.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1910656 13f79535-47bb-0310-9956-ffa450edef68
server versions. Give error message accordingly when trying to
enable websockets in unsupported configurations.
Add test and code to check the, finally selected, server of
a request_rec for websocket support or 501 the request.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1910535 13f79535-47bb-0310-9956-ffa450edef68
described in RFC 8441. A new directive 'H2WebSockets on|off' has been
added. The feature is by default not enabled.
As also discussed in the manual, this feature should work for setups
using "ProxyPass backend-url upgrade=websocket" without further changes.
Special server modules for WebSockets will have to be adapted,
most likely, as the handling if IO events is different with HTTP/2.
HTTP/2 WebSockets are supported on platforms with native pipes. This
excludes Windows.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1910507 13f79535-47bb-0310-9956-ffa450edef68
ap_die() to judge if it can send out a response. Bump mmn.
Enable test cases that check errors during response body to
appear as error on client side.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1910161 13f79535-47bb-0310-9956-ffa450edef68
On detecting that that an existing connection was shutdown by the other
side, a 503 response leaked even though the request was retried on a
fresh connection.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1909989 13f79535-47bb-0310-9956-ffa450edef68
- New directive 'H2EarlyHint name value' to add headers to a response,
picked up already when a "103 Early Hints" response is sent. 'name' and
'value' must comply to the HTTP field restrictions.
This directive can be repeated several times and header fields of the
same names add. Sending a 'Link' header with 'preload' relation will
also cause a HTTP/2 PUSH if enabled and supported by the client.
- Fixed an issue where requests were not logged and accounted in a timely
fashion when the connection returns to "keepalive" handling, e.g. when
the request served was the last outstanding one.
This led to late appearance in access logs with wrong duration times
reported.
- Accurately report the bytes sent for a request in the '%O' Log format.
This addresses #203, a long outstanding issue where mod_h2 has reported
numbers over-eagerly from internal buffering and not what has actually
been placed on the connection.
The numbers are now the same with and without H2CopyFiles enabled.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1909769 13f79535-47bb-0310-9956-ffa450edef68
Use one curl exec with multiple URLs instead of separate
curl calls, so that we make sure we use the same
connection to the web server ending up in the same
httpd child process.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1908230 13f79535-47bb-0310-9956-ffa450edef68
