You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2022/04/22 07:29:34 UTC
[Bug 66023] New: Getting requestbody as inputstream fails when upgrading to h2c
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
Bug ID: 66023
Summary: Getting requestbody as inputstream fails when
upgrading to h2c
Product: Tomcat 9
Version: 9.0.62
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Servlet
Assignee: dev@tomcat.apache.org
Reporter: inaldt@gmail.com
Target Milestone: -----
See here
https://github.com/bclozel/h2c-tomcat/tree/spring-boot-30771
for a sample app demonstrating the issue. (It's a pure Tomcat application - no
Spring Boot)
Summary: when processing a POST request that asks for an h2c-upgrade, reading
the requestbody as an inputstream results in a NullPointerException.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
Remy Maucherat <re...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
--- Comment #1 from Remy Maucherat <re...@apache.org> ---
An upgrade with a request body is clearly not supposed to happen with Tomcat.
It's actually likely not allowed since after sending the 101 back, the request
is supposed to be of the new protocol, so the request "body" will have to be
HTTP/2. Clearly that's not possible (if the upgrade does not happen, for
example) so it is correct that this is not allowed.
The likely solution would be to avoid upgrading when there's a request body.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
My reading of RFC 7230 is that when using upgrade the entire request is sent
via HTTP/1.1, the upgrade happens and then the response is returned via the
upgraded protocol.
This is going to require buffering the request body so it is going to be
subject to the maxSavePostSize limit.
I would have expected this to 'just work' after the fix for bug 65726. I'll
take a look at what is going on.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #8 from Mark Thomas <ma...@apache.org> ---
Fixed in:
- 10.1.x for 10.1.0-M15 onwards
- 10.0.x for 10.0.21 onwards
- 9.0.x for 9.0.63 onwards
- 8.5.x for 8.5.79 onwards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
--- Comment #5 from Remy Maucherat <re...@apache.org> ---
It doesn't work because, although a SavedRequestInputFilter is set using
setInputBuffer on the Request, the available() method uses an action to check
the internal buffer, which now goes to the new processor (for HTTP/2 it's a
StreamProcessor) while only Http11Processor has the correct behavior for the
callback. So some additional "fix" is needed, maybe intercept the callback in
Request.action to provide the correct result for available when a
SavedRequestInputFilter is set (rather than delegate to the hook as usual).
However, I don't like the fix and there might be other similar cases.
Since overall this buffering may be very inefficient, I would prefer choosing
to not upgrade when a request body is present.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
--- Comment #7 from Mark Thomas <ma...@apache.org> ---
I've committed a fix for 10.1.x. I'll give folks a chance to review it before I
think about back-porting it.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
--- Comment #4 from Remy Maucherat <re...@apache.org> ---
Ok, the spec is not as clear as I would expect.
OTOH, upgrading is optional, and this has some resource use and could make some
legitimate POSTs to fail (if they are over maxSavePostSize). Is it really worth
it ? Shouldn't we simply skip upgrading if there's a request body ?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
--- Comment #6 from Mark Thomas <ma...@apache.org> ---
Interesting.
I expanded the current upgrade with request body tests to use GET and POST and
they still passed. Switching to a Reader triggered the issue because that
triggers a call to available() and - as Rémy pointed out - that is where things
go wrong.
I agree with Rémy's comments on efficiency but I want to see what a patch to
fix this would look like before deciding on whether I think we should support
this or not. My starting point is that I would like to support it if practical.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 66023] Getting requestbody as inputstream fails when upgrading to h2c
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66023
--- Comment #2 from bclozel <bc...@vmware.com> ---
Also, see https://bz.apache.org/bugzilla/show_bug.cgi?id=65726 which fixed a
similar issue in the past.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org