Skip to content

Log malformed HTTP/2 requests#13059

Open
bneradt wants to merge 1 commit intoapache:masterfrom
bneradt:h2-malformed-request-txn-logging
Open

Log malformed HTTP/2 requests#13059
bneradt wants to merge 1 commit intoapache:masterfrom
bneradt:h2-malformed-request-txn-logging

Conversation

@bneradt
Copy link
Copy Markdown
Contributor

@bneradt bneradt commented Apr 4, 2026

Unlike HTTP/1 transactions, malformed HTTP/2 requests are rejected before HttpSM creation, so they bypassed the normal transaction logging path. That left malformed h2 traffic out of squid.log even when similar h1 failures were visible.

This adds a pre-transaction LogAccess path for malformed h2 request headers and emits a best-effort access log entry before resetting the stream.

@bneradt bneradt added this to the 11.0.0 milestone Apr 4, 2026
@bneradt bneradt requested review from Copilot and maskit April 4, 2026 17:44
@bneradt bneradt self-assigned this Apr 4, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds a “pre-transaction” access logging path for malformed HTTP/2 request headers that are rejected before HttpSM is created, so these failures can still be recorded in squid.log (similar to HTTP/1 behavior).

Changes:

  • Add LogAccess::PreTransactionLogData and extend LogAccess to support access log marshaling without an HttpSM.
  • Emit a best-effort access log entry from the HTTP/2 layer when rejecting malformed HEADERS/CONTINUATION input.
  • Add gold and unit tests validating both malformed and valid HTTP/2 request logging.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
tests/gold_tests/connect/replays/h2_malformed_request_logging.replay.yaml Adds replay traffic for valid HTTP/2 GET and CONNECT cases used by the gold test.
tests/gold_tests/connect/malformed_h2_request_client.py Adds a low-level client to send deliberately malformed HTTP/2 requests on the wire.
tests/gold_tests/connect/h2_malformed_request_logging.test.py Adds an integration test that asserts malformed HTTP/2 requests are access logged and do not reach origin.
src/proxy/logging/unit-tests/test_LogAccess.cc Adds Catch2 unit tests covering pre-transaction LogAccess marshaling behavior.
src/proxy/logging/LogAccess.cc Implements pre-transaction initialization and adds guards/fallbacks for marshaling without HttpSM.
src/proxy/logging/CMakeLists.txt Registers the new test_LogAccess executable in CMake when testing is enabled.
src/proxy/http2/Http2ConnectionState.cc Logs malformed decoded request headers via Log::access() before stream reset/GOAWAY.
include/proxy/logging/LogAccess.h Defines PreTransactionLogData and adds support helpers for pre-transaction logging mode.
include/proxy/http2/Http2Stream.h Exposes a const accessor for the decoded receive header (get_receive_header()).

@bneradt bneradt force-pushed the h2-malformed-request-txn-logging branch from 13273fb to 93a7fba Compare April 4, 2026 23:15
Unlike HTTP/1 transactions, malformed HTTP/2 requests are rejected
before HttpSM creation, so they bypassed the normal transaction logging
path. That left malformed h2 traffic out of squid.log even when similar
h1 failures were visible.

This adds a pre-transaction LogAccess path for malformed h2 request
headers and emits a best-effort access log entry before resetting the
stream.
@bneradt bneradt force-pushed the h2-malformed-request-txn-logging branch from 93a7fba to fa9178b Compare April 4, 2026 23:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

2 participants