Repository navigation
Conversation
test/modules/http3 runs requests over HTTP/3 with curl --http3-only against a QUIC listener on the https port number. It covers static files, HEAD, 404, a 1 MB response, several requests on one connection, virtual host selection by Host, POST content to CGI up to 1 MB and the CGI environment. The package is skipped when mod_http3, mod_ssl or curl's HTTP3 feature is missing. Generated-by: Claude Code (Claude Opus 5.5)
stream_worker() built the request_rec and went straight to
ap_process_request(), with only ap_update_vhost_from_headers() in
between. It skipped the two steps that HTTP/1.1 (ap_read_request()) and
HTTP/2 (h2_create_request_rec()) run on every request:
* ap_check_request_header(): vhost selection with StrictHostCheck, the
missing Host check and Expect handling.
* ap_post_read_request(): the post_read_request hooks of mod_setenvif,
mod_remoteip, mod_headers ("early"), mod_proxy (forward proxy
detection), mod_md, mod_unique_id and others, plus the core checks on
the complete request. mod_http3's own h3_hook_post_read_request never
ran for its own requests either.
So configuration behaved differently over HTTP/3, including access
control: with "SetEnvIf User-Agent ^evilbot bad_bot" and
"Require not env bad_bot", a request was denied with 403 over HTTP/1.1
but served with 200 over HTTP/3. Both now give 403.
Add test_003_access.py to the mod_http3 tests for this.
Generated-by: Claude Code (Claude Opus 5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mod_http3 went straight from building the
request_rectoap_process_request(), skipping theap_check_request_header()andap_post_read_request()steps that HTTP/1.1 and HTTP/2 run on every request. SoStrictHostCheck, the missing-HostandExpectchecks and everypost_read_requesthook (SetEnvIf,RemoteIPHeader,RequestHeader early, …) were ignored over HTTP/3. WithSetEnvIf User-Agent ^evilbot bad_botandRequire not env bad_bot, a request got 403 over HTTP/1.1 but 200 over HTTP/3.This builds on #943 for the test package; only the last commit is new here.
SECURITY.mdand https://www.apache.org/security/#reporting-a-vulnerability).APLOGNO()tag; numbers are assigned by a committer at merge time (seedocs/log-message-tags/README).changes-entries/*.txtfile is included, following the template inREADME.CHANGES(not needed otherwise).test/modules/xxxdirectory matching themodules/xxxmodule source, ortest/modules/corefor core server changes. On Unix, verify these pass locally with e.g.make check-pytest PYTEST_DIRS=test/modules/xxx.