Skip to content

Add support for HTTPS over UDS #659

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rschmitt merged 1 commit into from
Jun 22, 2025
Merged

Add support for HTTPS over UDS #659

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions ...5-testing/src/test/java/org/apache/hc/client5/testing/async/UdsAsyncIntegrationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,15 @@ public Http1() {
}
}

@Nested
@DisplayName("Fundamentals (HTTP/1.1, TLS)")
class Http1Tls extends TestHttp1Async {
public Http1Tls() {
super(URIScheme.HTTPS, true);
checkForUdsSupport();
}
}

@Nested
@DisplayName("Request re-execution (HTTP/1.1)")
class Http1RequestReExecution extends TestHttp1RequestReExecution {
Expand Down
3 changes: 0 additions & 3 deletions ...client5-testing/src/test/java/org/apache/hc/client5/testing/sync/UdsIntegrationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,6 @@
import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Nested;

import static org.junit.jupiter.api.Assumptions.assumeTrue;

class UdsIntegrationTests {
@Nested
@DisplayName("Request execution (HTTP/1.1)")
Expand All @@ -46,7 +44,6 @@ public RequestExecution() {
class RequestExecutionTls extends TestClientRequestExecution {
public RequestExecutionTls() {
super(URIScheme.HTTPS, true);
assumeTrue(false, "HTTPS is not currently supported over Unix domain sockets");
}
}

Expand Down
21 changes: 17 additions & 4 deletions httpclient5/src/main/java/org/apache/hc/client5/http/HttpRoute.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,9 +109,7 @@ public final class HttpRoute implements RouteInfo, Cloneable {
}

private void validateUdsArguments() {
if (this.secure) {
throw new UnsupportedOperationException("HTTPS is not supported over a UDS connection");
} else if (this.localAddress != null) {
if (this.localAddress != null) {
throw new UnsupportedOperationException("A localAddress cannot be specified for a UDS connection");
} else if (this.proxyChain != null) {
throw new UnsupportedOperationException("Proxies are not supported over a UDS connection");
Expand Down Expand Up @@ -225,7 +223,22 @@ public HttpRoute(final HttpHost target, final NamedEndpoint targetName, final In
* @since 5.6
*/
public HttpRoute(final HttpHost target, final Path unixDomainSocket) {
this(target, null, null, Collections.emptyList(), unixDomainSocket, false, TunnelType.PLAIN, LayerType.PLAIN);
this(target, false, unixDomainSocket);
}

/**
* Creates a new direct route that connects over a Unix domain socket rather than TCP.
*
* @param target the host to which to route
* @param secure {@code true} if the route is (to be) secure,
* {@code false} otherwise
* @param unixDomainSocket the path to the Unix domain socket
*
* @since 5.6
*/
public HttpRoute(final HttpHost target, final boolean secure, final Path unixDomainSocket) {
this(target, null, null, Collections.emptyList(), unixDomainSocket, secure,
TunnelType.PLAIN, LayerType.PLAIN);
}

/**
Expand Down
2 changes: 1 addition & 1 deletion httpclient5/src/main/java/org/apache/hc/client5/http/RouteTracker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,7 @@ public HttpRoute toRoute() {
if (!this.connected) {
return null;
} else if (this.unixDomainSocket != null) {
return new HttpRoute(this.targetHost, this.unixDomainSocket);
return new HttpRoute(this.targetHost, this.secure, this.unixDomainSocket);
} else {
return new HttpRoute(this.targetHost, this.localAddress,
this.proxyChain, this.secure,
Expand Down
40 changes: 26 additions & 14 deletions ...src/main/java/org/apache/hc/client5/http/impl/io/DefaultHttpClientConnectionOperator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
*/
package org.apache.hc.client5.http.impl.io;

import javax.net.ssl.SSLSocket;
import java.io.IOException;
import java.net.InetSocketAddress;
import java.net.Proxy;
Expand All @@ -36,8 +37,6 @@
import java.util.Collections;
import java.util.List;

import javax.net.ssl.SSLSocket;

import org.apache.hc.client5.http.ConnectExceptionSupport;
import org.apache.hc.client5.http.DnsResolver;
import org.apache.hc.client5.http.SchemePortResolver;
Expand Down Expand Up @@ -182,7 +181,7 @@ public void connect(
final SocketAddress socksProxyAddress = socketConfig.getSocksProxyAddress();
final Proxy socksProxy = socksProxyAddress != null ? new Proxy(Proxy.Type.SOCKS, socksProxyAddress) : null;
if (unixDomainSocket != null) {
connectToUnixDomainSocket(conn, endpointHost, unixDomainSocket, connectTimeout, socketConfig, context, soTimeout);
connectToUnixDomainSocket(conn, endpointHost, endpointName, attachment, unixDomainSocket, connectTimeout, socketConfig, context, soTimeout);
return;
}

Expand Down Expand Up @@ -218,17 +217,7 @@ public void connect(
conn.setSocketTimeout(soTimeout);
final TlsSocketStrategy tlsSocketStrategy = tlsSocketStrategyLookup != null ? tlsSocketStrategyLookup.lookup(endpointHost.getSchemeName()) : null;
if (tlsSocketStrategy != null) {
final NamedEndpoint tlsName = endpointName != null ? endpointName : endpointHost;
onBeforeTlsHandshake(context, endpointHost);
if (LOG.isDebugEnabled()) {
LOG.debug("{} {} upgrading to TLS", ConnPoolSupport.getId(conn), tlsName);
}
final SSLSocket sslSocket = tlsSocketStrategy.upgrade(socket, tlsName.getHostName(), tlsName.getPort(), attachment, context);
conn.bind(sslSocket, socket);
onAfterTlsHandshake(context, endpointHost);
if (LOG.isDebugEnabled()) {
LOG.debug("{} {} upgraded to TLS", ConnPoolSupport.getId(conn), tlsName);
}
upgradeToTls(conn, endpointHost, endpointName, attachment, context, tlsSocketStrategy, socket);
}
return;
} catch (final RuntimeException ex) {
Expand All @@ -249,9 +238,27 @@ public void connect(
}
}

private void upgradeToTls(final ManagedHttpClientConnection conn, final HttpHost endpointHost,
final NamedEndpoint endpointName, final Object attachment, final HttpContext context,
final TlsSocketStrategy tlsSocketStrategy, final Socket socket) throws IOException {
final NamedEndpoint tlsName = endpointName != null ? endpointName : endpointHost;
onBeforeTlsHandshake(context, endpointHost);
if (LOG.isDebugEnabled()) {
LOG.debug("{} {} upgrading to TLS", ConnPoolSupport.getId(conn), tlsName);
}
final SSLSocket sslSocket = tlsSocketStrategy.upgrade(socket, tlsName.getHostName(), tlsName.getPort(), attachment, context);
conn.bind(sslSocket, socket);
onAfterTlsHandshake(context, endpointHost);
if (LOG.isDebugEnabled()) {
LOG.debug("{} {} upgraded to TLS", ConnPoolSupport.getId(conn), tlsName);
}
}

private void connectToUnixDomainSocket(
final ManagedHttpClientConnection conn,
final HttpHost endpointHost,
final NamedEndpoint endpointName,
final Object attachment,
final Path unixDomainSocket,
final Timeout connectTimeout,
final SocketConfig socketConfig,
Expand All @@ -273,6 +280,11 @@ private void connectToUnixDomainSocket(
LOG.debug("{} {} connected to {}", ConnPoolSupport.getId(conn), endpointHost, unixDomainSocket);
}
conn.setSocketTimeout(soTimeout);

final TlsSocketStrategy tlsSocketStrategy = tlsSocketStrategyLookup != null ? tlsSocketStrategyLookup.lookup(endpointHost.getSchemeName()) : null;
if (tlsSocketStrategy != null) {
upgradeToTls(conn, endpointHost, endpointName, attachment, context, tlsSocketStrategy, socket);
}
} catch (final RuntimeException ex) {
Closer.closeQuietly(newSocket);
throw ex;
Expand Down
4 changes: 1 addition & 3 deletions httpclient5/src/main/java/org/apache/hc/client5/http/impl/routing/DefaultRoutePlanner.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,10 +100,8 @@ public final HttpRoute determineRoute(final HttpHost host, final HttpRequest req
if (unixDomainSocket != null) {
if (proxy != null) {
throw new UnsupportedOperationException("Proxies are not supported over Unix domain sockets");
} else if (secure) {
throw new UnsupportedOperationException("HTTPS is not supported over Unix domain sockets");
}
return new HttpRoute(target, unixDomainSocket);
return new HttpRoute(target, secure, unixDomainSocket);
}
final InetAddress inetAddress = determineLocalAddress(target, context);
if (proxy == null) {
Expand Down
3 changes: 1 addition & 2 deletions httpclient5/src/test/java/org/apache/hc/client5/http/TestHttpRoute.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,8 +487,7 @@ void testUnixDomainSocketValidation() {
final List<HttpHost> noProxies = Collections.emptyList();
final List<HttpHost> oneProxy = Collections.singletonList(PROXY1);
new HttpRoute(TARGET1, null, null, noProxies, uds, false, TunnelType.PLAIN, LayerType.PLAIN);
Assertions.assertThrows(RuntimeException.class, () ->
new HttpRoute(TARGET1, null, null, noProxies, uds, true, TunnelType.PLAIN, LayerType.PLAIN));
new HttpRoute(TARGET1, null, null, null, uds, true, TunnelType.PLAIN, LayerType.PLAIN);
Assertions.assertThrows(RuntimeException.class, () ->
new HttpRoute(TARGET1, null, LOCAL41, noProxies, uds, false, TunnelType.PLAIN, LayerType.PLAIN));
Assertions.assertThrows(RuntimeException.class, () ->
Expand Down