From a9cb53eeed4e097c68f6c8a13817c1a5678ff677 Mon Sep 17 00:00:00 2001 From: Jerome Louvel <374450+jlouvel@users.noreply.github.com> Date: Thu, 29 Oct 2026 21:53:47 -0400 Subject: [PATCH 1/2] fix: use HTTP/1.1 for cleartext requests through a forward proxy In the HTTP2 transport mode, the Netty client sent the HTTP/2 connection preface (prior knowledge) to the forward proxy for http:// requests. HTTP proxies generally only speak HTTP/1.1 to clients, so these requests failed. - NettyClientHelper: cleartext connections to a forward proxy use HTTP/1.1 with absolute-form request targets, logged at FINE level. HTTPS requests through CONNECT tunnels still negotiate HTTP/2 with ALPN. - ProxyTestCase: HTTP2 mode request through the forward proxy. Closes #1571. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Jerome Louvel <374450+jlouvel@users.noreply.github.com> --- changes.md | 3 ++ .../engine/netty/NettyClientHelper.java | 37 ++++++++++++------- .../engine/connector/ProxyTestCase.java | 19 ++++++++++ 3 files changed, 46 insertions(+), 13 deletions(-) diff --git a/changes.md b/changes.md index 98d6b9fdde..3a3f5a5880 100644 --- a/changes.md +++ b/changes.md @@ -179,6 +179,9 @@ Changes log - The HTTP client uses the "https.proxyHost" and "https.proxyPort" system properties for HTTPS requests, instead of "http.proxyHost" and "http.proxyPort", like the JDK. The "proxyHost" and "proxyPort" parameters still apply to both. Issue #1570. + - In the "HTTP2" transport mode, the HTTP client uses HTTP/1.1 for cleartext requests + sent through a forward proxy, instead of HTTP/2 with prior knowledge that HTTP proxies + generally refuse. Issue #1571. - The `Max-Age` and `Path` attributes of a cookie setting are no longer quoted. Issue #1334. - `Restlet.handle()` no longer fails with a `NullPointerException` when the Restlet has no context and cannot be started. - `CookieAuthenticator` no longer lets the next restlet overwrite the redirection sent after diff --git a/org.restlet/src/main/java/org/restlet/engine/netty/NettyClientHelper.java b/org.restlet/src/main/java/org/restlet/engine/netty/NettyClientHelper.java index 25f6b3b3bb..7170fd436d 100644 --- a/org.restlet/src/main/java/org/restlet/engine/netty/NettyClientHelper.java +++ b/org.restlet/src/main/java/org/restlet/engine/netty/NettyClientHelper.java @@ -135,7 +135,8 @@ * String * HTTP1_1 * Indicate the HTTP client transport mode among the following options: "HTTP1_1", "HTTP2" - * (HTTP/2 only: negotiated with ALPN over TLS, prior knowledge in cleartext), "DYNAMIC" (HTTP/2 + * (HTTP/2 only: negotiated with ALPN over TLS, prior knowledge in cleartext, except through a + * forward proxy where HTTP/1.1 is used), "DYNAMIC" (HTTP/2 * when negotiated with ALPN over TLS, HTTP/1.1 otherwise), "HTTP3" (experimental: HTTP/3 * over QUIC for HTTPS URIs without proxy, HTTP/1.1 otherwise; requires the optional * {@code io.netty:netty-codec-http3} dependency with its native QUIC library, and the {@link @@ -699,11 +700,7 @@ private Channel connect(final OriginPool pool, final String proxyAuthorization) @Override protected void initChannel(SocketChannel ch) { initConnection( - ch, - pool, - ssl, - pool.secure ? proxy : null, - proxyAuthorization); + ch, pool, ssl, proxy, proxyAuthorization); } }); @@ -808,7 +805,7 @@ private void initConnection( SocketChannel ch, OriginPool pool, SslContext ssl, - InetSocketAddress tunnelProxy, + InetSocketAddress proxy, String proxyAuthorization) { final Promise ready = ch.eventLoop().newPromise(); ch.attr(READY).set(ready); @@ -823,8 +820,8 @@ private void initConnection( } p.addLast("writability", Writability.HANDLER); - if (tunnelProxy == null) { - initProtocols(ch, pool, ssl, ready); + if ((proxy == null) || !pool.secure) { + initProtocols(ch, pool, ssl, ready, proxy != null); return; } @@ -832,7 +829,7 @@ private void initConnection( if (proxyAuthorization != null) { connectHeaders.set(HttpHeaderNames.PROXY_AUTHORIZATION, proxyAuthorization); } - HttpProxyHandler proxyHandler = new HttpProxyHandler(tunnelProxy, connectHeaders); + HttpProxyHandler proxyHandler = new HttpProxyHandler(proxy, connectHeaders); proxyHandler.setConnectTimeoutMillis(getConnectTimeout()); p.addLast("proxy", proxyHandler); p.addLast( @@ -853,7 +850,7 @@ public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) { .addListener( f -> { if (f.isSuccess()) { - initProtocols(ch, pool, ssl, ready); + initProtocols(ch, pool, ssl, ready, false); } else { ready.tryFailure(f.cause()); } @@ -867,9 +864,14 @@ public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) { * @param pool The connection pool of the origin. * @param ssl The SSL context, or null for a cleartext connection. * @param ready The promise completed with the negotiated protocol. + * @param forwardProxy True for a cleartext connection to a forward proxy. */ private void initProtocols( - SocketChannel ch, OriginPool pool, SslContext ssl, Promise ready) { + SocketChannel ch, + OriginPool pool, + SslContext ssl, + Promise ready, + boolean forwardProxy) { ChannelPipeline p = ch.pipeline(); final TransportMode mode = getTransportMode(); if (ssl != null) { @@ -910,10 +912,19 @@ protected void handshakeFailure( ctx.close(); } }); - } else if (mode == TransportMode.HTTP2) { + } else if (mode == TransportMode.HTTP2 && !forwardProxy) { addHttp2Handlers(p); ready.trySuccess(ApplicationProtocolNames.HTTP_2); } else { + if (mode == TransportMode.HTTP2) { + // HTTP proxies generally don't accept HTTP/2 with prior knowledge. + getLogger() + .fine( + "Using HTTP/1.1 through the forward proxy to " + + pool.host + + ":" + + pool.port); + } addHttp1Handlers(p); ready.trySuccess(ApplicationProtocolNames.HTTP_1_1); } diff --git a/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java b/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java index abde490bbc..dbe02011ec 100644 --- a/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java +++ b/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java @@ -131,6 +131,25 @@ void forwardsHttpRequestsWithAbsoluteUris() throws Exception { assertEquals("GET " + uri + " HTTP/1.1", proxy.requestLines.getFirst()); } + @Test + void forwardsCleartextHttp2RequestsWithHttp1() throws Exception { + server = new Server(new Context(), Protocol.HTTP, 0, HELLO); + server.start(); + + Context context = new Context(); + context.getParameters().add("proxyHost", "localhost"); + context.getParameters().add("proxyPort", proxyPort()); + context.getParameters().add("httpClientTransportMode", "HTTP2"); + client = new Client(context, Protocol.HTTP); + client.start(); + + String uri = "http://localhost:" + server.getActualPort() + "/h2"; + Response response = client.handle(new Request(Method.GET, uri)); + assertEquals(Status.SUCCESS_OK, response.getStatus()); + assertEquals("hello /h2", response.getEntityAsText()); + assertEquals(List.of("GET " + uri + " HTTP/1.1"), proxy.requestLines); + } + @Test void tunnelsHttpsRequestsWithConnect() throws Exception { startHttpsServer(HELLO); From e46e56b5692416eabf5617faed872b353ddd4294 Mon Sep 17 00:00:00 2001 From: Jerome Louvel <374450+jlouvel@users.noreply.github.com> Date: Fri, 30 Oct 2026 09:40:23 -0400 Subject: [PATCH 2/2] Use the test proxy for localhost in the HTTP/2 forward proxy test Co-Authored-By: Claude Opus 5.5 --- .../test/java/org/restlet/engine/connector/ProxyTestCase.java | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java b/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java index dbe02011ec..25ae39907c 100644 --- a/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java +++ b/org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java @@ -136,9 +136,7 @@ void forwardsCleartextHttp2RequestsWithHttp1() throws Exception { server = new Server(new Context(), Protocol.HTTP, 0, HELLO); server.start(); - Context context = new Context(); - context.getParameters().add("proxyHost", "localhost"); - context.getParameters().add("proxyPort", proxyPort()); + Context context = proxyContext(); context.getParameters().add("httpClientTransportMode", "HTTP2"); client = new Client(context, Protocol.HTTP); client.start();