Rework Gun connection pooling #7934

Merged

lambadalambda merged 6 commits from issue-2263-gun-validation into develop 2026-07-25 05:44:40 +00:00

Conversation 5 Commits 6 Files changed 27 +2384 -197

lambadalambda commented 2026-07-17 16:42:11 +00:00

Owner

Copy link

Summary

• allow bounded sibling Gun connections for concurrent HTTP/1 requests while multiplexing HTTP/2
• isolate pool routes by origin, proxy, authentication, and TLS profile, with race-safe startup and reclamation
• support authenticated CONNECT and SOCKS5 tunnels, request-ready tunnel negotiation, redirects, multipart uploads, and streamed bodies
• track stream ownership so completion, cancellation, client death, reverse proxy rejection, and rich-media failures clean up safely
• update Gun to 2.4.1 and Cowlib to 2.17.1 for current HTTP client security fixes
• reject SOCKS4 explicitly because Gun does not support it

Closes #2263
Relates #7834

Gun 2.4 review

• bounds HTTP/1 response header and trailer buffering
• rejects CR/LF request headers by default; the adapter now releases its lease when validation rejects a request before stream creation
• rejects unsolicited HTTP/1.1 101 upgrades and cross-authority HTTP/2 pushes
• fixes the Gun advisories affecting 2.2/2.3; 2.4.1 also includes Cowlib 2.17.1 for corrected HTTP/2 HPACK decoding
• does not replace the route-aware, globally bounded pool or caller/stream lifecycle tracking implemented here

Testing

• OTP 26: mix test --seed 0 (4881 tests, 0 failures, 2 excluded, 4 skipped)
• OTP 27: mix test --seed 0 (4881 tests, 0 failures, 2 excluded, 4 skipped)
• focused real TLS/CONNECT/SOCKS5, invalid-header, and pool lifecycle tests (22 tests, 0 failures)
• scoped mix format --check-formatted
• git diff --check
• tools/check-changelog with CI_COMMIT_TARGET_BRANCH=develop
• mix credo --strict completes; the repository has an existing strict backlog and reports non-blocking style/complexity advisories in touched files
• dependency resolution reports an existing project-wide advisory backlog outside the Gun/Cowlib update

## Summary - allow bounded sibling Gun connections for concurrent HTTP/1 requests while multiplexing HTTP/2 - isolate pool routes by origin, proxy, authentication, and TLS profile, with race-safe startup and reclamation - support authenticated CONNECT and SOCKS5 tunnels, request-ready tunnel negotiation, redirects, multipart uploads, and streamed bodies - track stream ownership so completion, cancellation, client death, reverse proxy rejection, and rich-media failures clean up safely - update Gun to 2.4.1 and Cowlib to 2.17.1 for current HTTP client security fixes - reject SOCKS4 explicitly because Gun does not support it Closes #2263 Relates #7834 ## Gun 2.4 review - bounds HTTP/1 response header and trailer buffering - rejects CR/LF request headers by default; the adapter now releases its lease when validation rejects a request before stream creation - rejects unsolicited HTTP/1.1 101 upgrades and cross-authority HTTP/2 pushes - fixes the Gun advisories affecting 2.2/2.3; 2.4.1 also includes Cowlib 2.17.1 for corrected HTTP/2 HPACK decoding - does not replace the route-aware, globally bounded pool or caller/stream lifecycle tracking implemented here ## Testing - OTP 26: `mix test --seed 0` (`4881 tests, 0 failures, 2 excluded, 4 skipped`) - OTP 27: `mix test --seed 0` (`4881 tests, 0 failures, 2 excluded, 4 skipped`) - focused real TLS/CONNECT/SOCKS5, invalid-header, and pool lifecycle tests (`22 tests, 0 failures`) - scoped `mix format --check-formatted` - `git diff --check` - `tools/check-changelog` with `CI_COMMIT_TARGET_BRANCH=develop` - `mix credo --strict` completes; the repository has an existing strict backlog and reports non-blocking style/complexity advisories in touched files - dependency resolution reports an existing project-wide advisory backlog outside the Gun/Cowlib update

lambadalambda added 2 commits 2026-07-17 16:42:11 +00:00

feat(http): rework Gun connection pooling f11ffca7f5

docs(http): document Gun pool behavior d0d6c986f4

lambadalambda added 1 commit 2026-07-17 17:10:29 +00:00

fix(deps): update Gun to 2.4.1 b862254889

phnt commented 2026-07-22 13:22:33 +00:00

Owner

Copy link

All of these configs are broken likely due to some auth bug:

config :pleroma, :http, proxy_url: "127.0.0.1:3128"
config :pleroma, :http, proxy_url: {:socks5, "127.0.0.1", 9050}
config :pleroma, :http, proxy_url: {:socks5, :localhost, 9050}

The string representation uses Squid as a forwarding proxy without any authentication and all plain HTTP requests (non-TLS) result in {:error, :unauthorized} being returned and this in Squid access logs:

22/Jul/2026:13:14:16 +0000.210 - TCP_DENIED/403 3501 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion:80 HTTP/1.1 HIER_NONE/-

The socks5 tuple representations always returns {:error, :eacces}.

Only the string representation works in Hackney as well.

All of these configs are broken likely due to some auth bug: ``` config :pleroma, :http, proxy_url: "127.0.0.1:3128" config :pleroma, :http, proxy_url: {:socks5, "127.0.0.1", 9050} config :pleroma, :http, proxy_url: {:socks5, :localhost, 9050} ``` The string representation uses Squid as a forwarding proxy without any authentication and all plain HTTP requests (non-TLS) result in `{:error, :unauthorized}` being returned and this in Squid access logs: ``` 22/Jul/2026:13:14:16 +0000.210 - TCP_DENIED/403 3501 2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion:80 HTTP/1.1 HIER_NONE/- ``` The socks5 tuple representations always returns `{:error, :eacces}`. Only the string representation works in Hackney as well.

lambadalambda commented 2026-07-22 16:06:54 +00:00

Author

Owner

Copy link

Did you run this standalone or on top of the other MR? can't reproduce the non-squid issues.

Did you run this standalone or on top of the other MR? can't reproduce the non-squid issues.

lambadalambda added 1 commit 2026-07-22 16:36:12 +00:00

fix(http): forward plain HTTP proxy requests d090aeb2bb

phnt commented 2026-07-23 19:37:30 +00:00

Owner

Copy link

They are merged on top of each other (this one last). I'm able to reproduce the issue only on my main instance using OTP builds, but test instance running a source install works fine with all three config options. Weird.

EDIT: Gah, nevermind. The tuple issue was caused by SELinux denying access to the Tor port. Sorry, all three work fine now for the HTTP client.

They are merged on top of each other (this one last). I'm able to reproduce the issue only on my main instance using OTP builds, but test instance running a source install works fine with all three config options. Weird. EDIT: Gah, nevermind. The tuple issue was caused by SELinux denying access to the Tor port. Sorry, all three work fine now for the HTTP client.

👍 1

lambadalambda changed title from WIP: Rework Gun connection pooling to Rework Gun connection pooling 2026-07-24 09:13:53 +00:00

lambadalambda commented 2026-07-24 09:14:24 +00:00

Author

Owner

Copy link

Running this on lain.com, so far seems to work normally. If you don't see anything bad, I'd merge it soon.

Running this on lain.com, so far seems to work normally. If you don't see anything bad, I'd merge it soon.

phnt added 1 commit 2026-07-24 14:45:16 +00:00

ReverseProxy Tesla: Explicitly reformat proxy ce4e1d4287

phnt reviewed 2026-07-24 21:36:22 +00:00

phnt left a comment

Copy link

I've made a few small nitpicky notes, but haven't found anything wrong per-se. Better not to monkey with something that works at this time.

Drop the DEVLOG.md from history and feel free to merge.

I've made a few small nitpicky notes, but haven't found anything wrong per-se. Better not to monkey with something that works at this time. Drop the `DEVLOG.md` from history and feel free to merge.

lambadalambda added 1 commit 2026-07-25 05:26:38 +00:00

chore: remove development log 5ddd337045

lambadalambda merged commit cc1b95c88e into develop 2026-07-25 05:44:40 +00:00

lambadalambda referenced this pull request from a commit 2026-07-25 05:44:40 +00:00

Merge pull request 'Rework Gun connection pooling' (#7934) from issue-2263-gun-validation into develop

lambadalambda referenced this pull request 2026-07-26 15:29:23 +00:00

Consolidate on one HTTP client stack #7944

phnt referenced this pull request 2026-07-26 18:26:39 +00:00

Consolidate on one HTTP client stack #7944

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

AP C2S

  

AdminAPI

  

Breaking API

Affects clients

  

Breaks existing config

  

Check if still valid

  

Data Protection

  

Do not merge

  

Document in the changelog

  

Doing

  

Feature Request / Enhancement

  

MastoAPI

  

NL2

Improved Mobile Experience

  

NL4

Improved instance customization and QoL options

  

OStatus

  

OTP Releases

  

Refactor

  

Security

  

To Do

  

TwitterAPI

  

bug

  

complicated

  

confirmed

  

deps

  

discussion

  

documentation

  

easy

  

feature: to be merged in stable

  

fix: to be merged in stable

  

incident

Denotes a disruption to IT services and the associated issues require immediate attention

  

needs to be backported to maint

  

needs-changes

  

needs-info

  

needs-review

  

performance

  

regression

  

unclear

No labels

AP C2S

AdminAPI

Breaking API

Breaks existing config

Check if still valid

Data Protection

Do not merge

Document in the changelog

Doing

Feature Request / Enhancement

MastoAPI

NL2

NL4

OStatus

OTP Releases

Refactor

Security

To Do

TwitterAPI

bug

complicated

confirmed

deps

discussion

documentation

easy

feature: to be merged in stable

fix: to be merged in stable

incident

needs to be backported to maint

needs-changes

needs-info

needs-review

performance

regression

unclear

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pleroma/pleroma!7934

No description provided.