From 8577bd7c355e23496e7120cd94db418d86171b7b Mon Sep 17 00:00:00 2001 From: Hector Sanjuan Date: Mon, 10 Mar 2025 15:58:11 +0100 Subject: [PATCH 1/2] bitswap/httpnet: do not follow redirects Avoid following redirects. We treat them as an incorrect provider record. We don't want to be coerced into opening new connections to new hosts and we prefer provider records to be up to date rather than them relying in redirects being followed. There are also problems with potential loops etc. https://github.com/ipfs/boxo/issues/862 --- bitswap/network/httpnet/httpnet.go | 6 ++++++ bitswap/network/httpnet/msg_sender.go | 7 ++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/bitswap/network/httpnet/httpnet.go b/bitswap/network/httpnet/httpnet.go index 0a201523e..7b16d6058 100644 --- a/bitswap/network/httpnet/httpnet.go +++ b/bitswap/network/httpnet/httpnet.go @@ -267,6 +267,12 @@ func New(host host.Host, opts ...Option) network.BitSwapNetwork { c := &http.Client{ Transport: t, + CheckRedirect: func(req *http.Request, via []*http.Request) error { + // we do not follow redirects. Providers should keep + // announcements up to + // date. https://github.com/boxo/issues/862. + return http.ErrUseLastResponse + }, } htnet.client = c diff --git a/bitswap/network/httpnet/msg_sender.go b/bitswap/network/httpnet/msg_sender.go index 1864ae3c8..b017eba73 100644 --- a/bitswap/network/httpnet/msg_sender.go +++ b/bitswap/network/httpnet/msg_sender.go @@ -302,7 +302,12 @@ func (sender *httpMsgSender) tryURL(ctx context.Context, u *senderURL, entry bsm case http.StatusNotFound, http.StatusGone, http.StatusForbidden, - http.StatusUnavailableForLegalReasons: + http.StatusUnavailableForLegalReasons, + http.StatusMovedPermanently, + http.StatusFound, + http.StatusSeeOther, + http.StatusTemporaryRedirect, + http.StatusPermanentRedirect: err := fmt.Errorf("%s %q -> %d: %q", req.Method, req.URL, statusCode, string(body)) log.Debug(err) From cafa7e2474545a07e490f02b759a89e0da21f2ac Mon Sep 17 00:00:00 2001 From: Hector Sanjuan Date: Tue, 11 Mar 2025 17:32:15 +0100 Subject: [PATCH 2/2] bitswap/httpnet: close response bodies "The default HTTP client's Transport may not reuse HTTP/1.x "keep-alive" TCP connections if the Body is not read to completion and closed." --- bitswap/network/httpnet/msg_sender.go | 1 + 1 file changed, 1 insertion(+) diff --git a/bitswap/network/httpnet/msg_sender.go b/bitswap/network/httpnet/msg_sender.go index b017eba73..7980c69a0 100644 --- a/bitswap/network/httpnet/msg_sender.go +++ b/bitswap/network/httpnet/msg_sender.go @@ -247,6 +247,7 @@ func (sender *httpMsgSender) tryURL(ctx context.Context, u *senderURL, entry bsm return nil, serr } + defer resp.Body.Close() // Record request size var buf bytes.Buffer