Skip to content

[WIP] Support for HTTP/3 (server side) #20017

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+1,517 −108
Open

[WIP] Support for HTTP/3 (server side) #20017

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
- Support pull-based ingestion message mappers and raw payload support ([#19765](https://github.com/opensearch-project/OpenSearch/pull/19765))
- Add search API tracker ([#18601](https://github.com/opensearch-project/OpenSearch/pull/18601))
- Support dynamic consumer configuration update in pull-based ingestion ([#19963](https://github.com/opensearch-project/OpenSearch/pull/19963))
- Support pull-based ingestion message mappers and raw payload support ([#19765](https://github.com/opensearch-project/OpenSearch/pull/19765)]
- Support for HTTP/3 (server side) ([#20017](https://github.com/opensearch-project/OpenSearch/pull/20017))

### Changed
- Combining filter rewrite and skip list to optimize sub aggregation([#19573](https://github.com/opensearch-project/OpenSearch/pull/19573))
Expand Down
2 changes: 2 additions & 0 deletions gradle/libs.versions.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,8 @@ netty-codec-dns = { group = "io.netty", name = "netty-codec-dns", version.ref =
netty-codec-http = { group = "io.netty", name = "netty-codec-http", version.ref = "netty" }
netty-codec-http2 = { group = "io.netty", name = "netty-codec-http2", version.ref = "netty" }
netty-codec-http3 = { group = "io.netty", name = "netty-codec-http3", version.ref = "netty" }
netty-codec-native-quic = { group = "io.netty", name = "netty-codec-native-quic", version.ref = "netty" }
netty-codec-classes-quic = { group = "io.netty", name = "netty-codec-classes-quic", version.ref = "netty" }
Comment on lines +152 to +153
Copy link

@coderabbitai coderabbitai bot Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the QUIC artifacts exist at the specified Netty version
echo "Checking netty-codec-native-quic..."
RESPONSE1=$(curl -s -o /dev/null -w "%{http_code}" \
  "https://repo1.maven.org/maven2/io/netty/netty-codec-native-quic/4.2.7.Final/netty-codec-native-quic-4.2.7.Final.pom")
echo "Response code: $RESPONSE1"

echo ""
echo "Checking netty-codec-classes-quic..."
RESPONSE2=$(curl -s -o /dev/null -w "%{http_code}" \
  "https://repo1.maven.org/maven2/io/netty/netty-codec-classes-quic/4.2.7.Final/netty-codec-classes-quic-4.2.7.Final.pom")
echo "Response code: $RESPONSE2"

# Summary
echo ""
echo "Summary:"
echo "netty-codec-native-quic: $RESPONSE1"
echo "netty-codec-classes-quic: $RESPONSE2"

Repository: opensearch-project/OpenSearch

Length of output: 202

🌐 Web query:

Netty 4.2.7.Final netty-codec-native-quic netty-codec-classes-quic Maven Central

💡 Result:

  • io.netty:netty-codec-native-quic:4.2.7.Final — available on Maven Central. [1]
  • io.netty:netty-codec-classes-quic:4.2.7.Final — not found on Maven Central; the latest classes-quic release on Central is 4.2.6.Final. [2]

Sources:
[1] repo1.maven.org — io/netty/netty-codec-native-quic/4.2.7.Final.
[2] repo1.maven.org — io/netty/netty-codec-classes-quic/ (latest published: 4.2.6.Final).

Fix netty-codec-classes-quic version to 4.2.6.Final — artifact unavailable at 4.2.7.Final.

Verification shows that netty-codec-native-quic is available at version 4.2.7.Final on Maven Central, but netty-codec-classes-quic is not published at that version. The latest available release of netty-codec-classes-quic on Maven Central is 4.2.6.Final. Update line 153 to use version 4.2.6.Final to avoid dependency resolution failures.

🤖 Prompt for AI Agents 
In gradle/libs.versions.toml around lines 152 to 153, the
netty-codec-classes-quic entry is pointing to version.ref "netty" (4.2.7.Final)
which is not published; change the netty-codec-classes-quic version to the
concrete value 4.2.6.Final so it matches the latest available artifact on Maven
Central while leaving netty-codec-native-quic at 4.2.7.Final or the referenced
netty version as-is.

netty-common = { group = "io.netty", name = "netty-common", version.ref = "netty" }
netty-handler = { group = "io.netty", name = "netty-handler", version.ref = "netty" }
netty-resolver-dns = { group = "io.netty", name = "netty-resolver-dns", version.ref = "netty" }
Expand Down
15 changes: 14 additions & 1 deletion modules/transport-netty4/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,14 +63,25 @@ dependencies {
api "io.netty:netty-codec:${versions.netty}"
api "io.netty:netty-codec-http:${versions.netty}"
api "io.netty:netty-codec-http2:${versions.netty}"
api "io.netty:netty-codec-http3:${versions.netty}"
api "io.netty:netty-codec-classes-quic:${versions.netty}"
api "io.netty:netty-codec-native-quic:${versions.netty}"
api "io.netty:netty-common:${versions.netty}"
api "io.netty:netty-handler:${versions.netty}"
api "io.netty:netty-resolver:${versions.netty}"
api "io.netty:netty-transport:${versions.netty}"
api "io.netty:netty-transport-native-unix-common:${versions.netty}"

testFipsRuntimeOnly "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
testFipsRuntimeOnly "org.bouncycastle:bctls-fips:${versions.bouncycastle_tls}"
testFipsRuntimeOnly "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}"

// Bundle all supported OSes and Archs
runtimeOnly "io.netty:netty-codec-native-quic:${versions.netty}:linux-x86_64"
runtimeOnly "io.netty:netty-codec-native-quic:${versions.netty}:linux-aarch_64"
runtimeOnly "io.netty:netty-codec-native-quic:${versions.netty}:osx-x86_64"
runtimeOnly "io.netty:netty-codec-native-quic:${versions.netty}:osx-aarch_64"
runtimeOnly "io.netty:netty-codec-native-quic:${versions.netty}:windows-x86_64"
}

restResources {
Expand Down Expand Up @@ -205,7 +216,9 @@ thirdPartyAudit {

'io.netty.pkitesting.CertificateBuilder',
'io.netty.pkitesting.CertificateBuilder$Algorithm',
'io.netty.pkitesting.X509Bundle'
'io.netty.pkitesting.X509Bundle',

'io.netty.channel.epoll.SegmentedDatagramPacket'
)

ignoreViolations(
Expand Down
1 change: 1 addition & 0 deletions modules/transport-netty4/licenses/netty-codec-classes-quic-4.2.7.Final.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
98e80e8a575aa5cacd0db278a91fc4b34e4721fe
1 change: 1 addition & 0 deletions modules/transport-netty4/licenses/netty-codec-http3-4.2.7.Final.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
c9b6155713d6017a21e71dea3e041c4143facf5c
1 change: 1 addition & 0 deletions ...les/transport-netty4/licenses/netty-codec-native-quic-4.2.7.Final-linux-aarch_64.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
7ecd8d1de6b3eb7eeb3dcdb1034780826e141f1c
1 change: 1 addition & 0 deletions modules/transport-netty4/licenses/netty-codec-native-quic-4.2.7.Final-linux-x86_64.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
6a3e4398852f926c4b22f381d89dae2388446ae8
Copy link

@coderabbitai coderabbitai bot Dec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch the actual SHA-1 from Maven Central for the specified artifact
echo "Fetching SHA-1 from Maven Central..."
curl -s "https://repo1.maven.org/maven2/io/netty/incubator/netty-incubator-codec-native-quic/4.2.7.Final/netty-incubator-codec-native-quic-4.2.7.Final-linux-x86_64.jar.sha1"
echo ""

# Try to find latest versions available
echo "Checking available versions..."
curl -s "https://search.maven.org/solrsearch/select?q=g:io.netty.incubator+AND+a:netty-incubator-codec-native-quic&core=gav&rows=50&wt=json" | jq -r '.response.docs[] | .v' | sort -V | tail -10

Repository: opensearch-project/OpenSearch

Length of output: 202

🌐 Web query:

netty-incubator-codec-native-quic 4.2.7.Final security vulnerabilities CVE

💡 Result:

Short answer: There is no CVE that specifically names the artifact netty-incubator-codec-native-quic 4.2.7.Final. However, Netty 4.2.7.Final (the 4.2.x release line) includes security fixes — notably it addresses CVE-2025-59419 (SMTP command‑injection) and earlier 4.2.x releases fixed CVE-2025-58056 and CVE-2025-55163. If you rely on any Netty 4.2.x modules (including the incubator/native-quic artifact), use 4.2.7.Final or later to get those fixes. [1][2][3]

Sources

🌐 Web query:

netty-incubator-codec-native-quic latest version 2025

💡 Result:

The latest released version is 0.0.74.Final (released Aug 18, 2025). [1][2]

Sources:

  • Netty release announcement. [1]
  • Maven Central listing for the artifact. [2]

Update netty-incubator-codec-native-quic to the latest version 0.0.74.Final.

Version 4.2.7.Final is significantly outdated; the latest released version is 0.0.74.Final (August 2025). While 4.2.7.Final includes security fixes for CVE-2025-59419 and earlier vulnerabilities (CVE-2025-58056, CVE-2025-55163), it should be upgraded to 0.0.74.Final to obtain the most recent security patches and improvements.

1 change: 1 addition & 0 deletions modules/transport-netty4/licenses/netty-codec-native-quic-4.2.7.Final-osx-aarch_64.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
c30d746bd588c07bac4ac04abde576c05a3c0a28
1 change: 1 addition & 0 deletions modules/transport-netty4/licenses/netty-codec-native-quic-4.2.7.Final-osx-x86_64.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
f3679a6cc103292931098b1dc835ffb831e27368
1 change: 1 addition & 0 deletions ...les/transport-netty4/licenses/netty-codec-native-quic-4.2.7.Final-windows-x86_64.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
c4f177d2a99668c209acc31b8b85df58e9166218
1 change: 1 addition & 0 deletions modules/transport-netty4/licenses/netty-codec-native-quic-4.2.7.Final.jar.sha1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
d6a7141d5fab45c8d2f6c646965f2dd53a43b41e
2 changes: 2 additions & 0 deletions modules/transport-netty4/src/main/java/org/opensearch/http/netty4/Netty4HttpRequest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,8 @@ public HttpVersion protocolVersion() {
return HttpRequest.HttpVersion.HTTP_1_1;
} else if (request.protocolVersion().equals("HTTP/2.0")) {
return HttpRequest.HttpVersion.HTTP_2_0;
} else if (request.protocolVersion().equals("HTTP/3.0")) {
return HttpRequest.HttpVersion.HTTP_3_0;
} else {
throw new IllegalArgumentException("Unexpected http protocol version: " + request.protocolVersion());
}
Expand Down
5 changes: 3 additions & 2 deletions ...s/transport-netty4/src/main/java/org/opensearch/http/netty4/Netty4HttpRequestHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
package org.opensearch.http.netty4;

import org.opensearch.ExceptionsHelper;
import org.opensearch.http.AbstractHttpServerTransport;
import org.opensearch.http.HttpPipelinedRequest;

import io.netty.channel.ChannelHandler;
Expand All @@ -42,9 +43,9 @@
@ChannelHandler.Sharable
class Netty4HttpRequestHandler extends SimpleChannelInboundHandler<HttpPipelinedRequest> {

private final Netty4HttpServerTransport serverTransport;
private final AbstractHttpServerTransport serverTransport;

Netty4HttpRequestHandler(Netty4HttpServerTransport serverTransport) {
Netty4HttpRequestHandler(AbstractHttpServerTransport serverTransport) {
this.serverTransport = serverTransport;
}

Expand Down
2 changes: 1 addition & 1 deletion .../transport-netty4/src/main/java/org/opensearch/http/netty4/Netty4HttpServerTransport.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,7 @@ public class Netty4HttpServerTransport extends AbstractHttpServerTransport {

/**
* Creates new HTTP transport implementations based on Netty 4
* @param settings seetings
* @param settings settings
* @param networkService network service
* @param bigArrays big array allocator
* @param threadPool thread pool instance
Expand Down
Loading
Loading