Act nowcan affect a running system
HTTP state machines settle while Unix socket close stops unlinking servers
This networking-heavy edition completes a broad HTTP client and timeout rewrite, then repairs constructor, proxy, WebSocket and native-backend regressions found along the way. HTTP request framing now distinguishes HEAD response semantics from request bodies, Windows HTTP.sys accepts chunked uploads and repeated authentication or cookie headers, and POSIX clients no longer unlink a Unix-domain server socket when they close.
TL;DR
- POSIX Unix-domain clients no longer unlink the server socket path when they close.
- HTTP.sys now accepts chunked request bodies and preserves repeated Set-Cookie and authentication headers.
- HEAD and OPTIONS handling now follows message framing; redirected 301 POST and 303 requests also discard their old bodies.
- THttpRequestExtendedOptions.GetTimeouts is replaced by ComputeTimeouts, THttpRequest.InternalConnect loses its parameters, and TCrtSocket.ReOpen no longer accepts a timeout.
- TRestHttpClientGeneric connection-definition parsing no longer risks an infinite loop.
- Land on final build 2.4.17433 rather than an intermediate build from this refactor sequence.
Upgrade advice
Land on final build 2.4.17433 rather than an intermediate build from this edition: later commits repair constructor calls, timeout setters, proxy selection, REST definition parsing, redirect bodies and HTTP server state. POSIX Unix-socket deployments and Windows HTTP.sys servers should prioritize the update. Before compiling, grep for THttpRequestExtendedOptions.GetTimeouts, parameterized THttpRequest.InternalConnect overrides and TCrtSocket.ReOpen(timeout).
36 of 36 entries · 37 commits upstream
1
Critical
HTTP option reuse no longer reads past the authentication record
THttpClientSocket.SameOpenOptions passes @aOptions to THttpRequestExtendedOptions.SameAuth instead of @aOptions.Auth, matching the callee’s expected base pointer and eliminating the wrong memory access.
Fixes
mormot.net.client
b466ee53+3-3
net: fixed wrong memory access in THttpClientSocket.SameOpenOptions
Impact
Delphi and FPC HTTP client reuse checks no longer inspect unrelated memory, avoiding incorrect authentication comparisons and a potential access violation.
Upgrade recommended
Do not deploy the immediately preceding intermediate build; retest authenticated keep-alive connection reuse on 2.4.17433.
Units
2
High
Socket timeout storage is simplified and ReOpen loses its parameter
TCrtSocket replaces fallback timeout fields with concrete connect, send and receive values, tracks applied SO_*TIMEO values, copies settings with SetTimeoutsFrom and changes ReOpen(aTimeout) to parameterless ReOpen using stored values.
Breaking changes
mormot.net.sock
7f8a625b+114-155
net: rewritten TCrtSocket timeouts implementation
Impact
Calls passing a timeout to ReOpen no longer compile. Delphi and FPC applications should set ConnectTimeout, SendTimeout and ReceiveTimeout before calling ReOpen; TimeOut now writes all three values.
Migration required
Replace ReOpen(timeout) with timeout-property assignments followed by ReOpen, and retest accepted sockets and proxy/TLS reconnects.
Public API
TCrtSocket.ReOpensignature-changed — The timeout parameter is removed; stored phase timeouts are used.TCrtSocket.SetTimeoutsFromaddedTCrtSocket.TimeOutbehaviour-changed — Writing it now sets all three phase timeouts.
Units
3
High
Extended HTTP options now compute concrete timeout values
THttpRequestExtendedOptions.GetTimeouts is removed and ComputeTimeouts mutates missing phase values to HTTP defaults or CreateTimeoutMS. THttpClientSocket copies those values into TCrtSocket and connection reuse no longer compares timeout settings.
Breaking changes
mormot.net.client
3d81851d+42-45
net: fixed THttpClientSocket timeouts usage
Impact
Direct callers of GetTimeouts stop compiling on Delphi and FPC and must switch to the mutating ComputeTimeouts method. Changing only timeout values no longer forces an HTTP socket reconnect.
Migration required
Replace GetTimeouts calls with ComputeTimeouts, then read ConnectTimeoutMS, SendTimeoutMS and ReceiveTimeoutMS from the record.
Public API
THttpRequestExtendedOptions.GetTimeoutsremovedTHttpRequestExtendedOptions.ComputeTimeoutsadded
Units
4
High
HTTP backend overrides now read connection options from the instance
THttpRequest.InternalConnect drops its three timeout parameters; WinHTTP, WinINet, Curl and Delphi NetHTTP overrides read fExtendedOptions instead. Construction initializes the URI fields and options before calling the parameterless virtual method.
Breaking changes
mormot.net.client
edbd697a+39-43
net: rewritten THttpRequest.InternalConnect method
Impact
Custom THttpRequest descendants overriding InternalConnect will fail to compile on Delphi or FPC until their override signature and timeout reads are updated.
Migration required
Change overrides to procedure InternalConnect; and read fExtendedOptions.ConnectTimeoutMS, SendTimeoutMS and ReceiveTimeoutMS.
Public API
THttpRequest.InternalConnectsignature-changed
Units
5
High
Redirects and 100-Continue now clear or wait for the right body
THttpClientSocket clears Data, DataMimeType and InStream when a 301 POST or eligible 303 becomes GET, emits headers for a supplied stream, and server paths send 100 Continue only when Content-Length or chunked framing declares a body.
Fixes
mormot.net.async+2
bdb952f3+27-23
net: some client/server HTTP state machine fixes
Impact
Redirected Delphi/FPC requests no longer send stale entity data with a rewritten GET, and clients will not be invited to transmit a body that the server has no framing for.
Upgrade recommended
Retest streamed uploads, POST-to-GET redirects, 303 handling and Expect: 100-Continue clients.
6
High
REST connection-definition parsing can no longer loop forever
TRestHttpClientGeneric.RegisteredClassCreateFrom replaces a chain of UrlDecode calls with UrlDecodeNextNameValue, advancing once for every name/value pair before dispatching recognized options.
Fixes
mormot.crypt.secure+1
9292c506+27-20
rest: fixed TRestHttpClientGeneric.RegisteredClassCreateFrom
Impact
Delphi and FPC clients created from TSynConnectionDefinition no longer risk hanging when DatabaseName contains options that the old branch chain did not advance past.
Upgrade recommended
Retest persisted REST connection definitions, including unknown and URI-encoded options.
7
High
OPTIONS may carry content while only HEAD suppresses a response body
HTTP client and server code replaces HttpMethodWithNoBody with explicit IsHead checks for response bodies and message-framing checks for request bodies. Curl no longer enables CURLOPT_NOBODY for OPTIONS.
Fixes
mormot.net.acme+3
f119fd8c+18-19
net: only HEAD has no body - OPTIONS could
Impact
Delphi and FPC servers now read framed OPTIONS request bodies, and clients can receive OPTIONS response content. Applications that assumed OPTIONS was bodyless may observe new data.
Upgrade recommended
Test OPTIONS endpoints with request and response bodies, plus HEAD responses and framed HEAD requests.
8
High
Curl request options reset cleanly and restore TLS verification
TCurlHttp always sets coFollowLocation from RedirectMax and explicitly restores coSSLVerifyPeer and coSSLVerifyHost when certificate errors are not ignored, then applies client certificates or a custom CA file.
Fixes
mormot.net.client
cf40c09d+19-15
net: several fixes to TCurlHttp options usage
Impact
Reused Curl handles no longer retain redirect or relaxed TLS state from a prior request. POSIX FPC/Delphi Curl clients regain certificate verification when configured.
Upgrade recommended
Retest mixed requests that alternate redirect and TLS-verification settings on one Curl client.
Units
9
High
Bulk timeout updates now invoke subclass setters
TCrtSocket.SetTimeouts is restored as a public helper that assigns ConnectTimeout and calls virtual SetSendTimeout and SetReceiveTimeout. SetTimeoutsFrom and DoCreate use that path so WebSocket overrides run.
Fixes
mormot.net.client+1
93002192+18-16
net: fixed TCrtSocket virtual timeout setters call
Impact
THttpClientWebSockets now keeps CallbackAnswerTimeOutMS synchronized when timeouts are assigned through base-class helpers. Delphi and FPC subclasses receive their setter hooks again.
Upgrade recommended
Retest WebSocket callback timeout changes made through TimeOut, SetTimeouts and copied socket options.
10
High
HTTP servers retrieve any framed request body, including on HEAD
Synchronous and asynchronous server paths now trigger body streaming and DownloadBody from Content-Length or Transfer-Encoding state rather than excluding HEAD. Async 100-Continue handling is limited to states awaiting a body.
Fixes
mormot.net.async+1
0e0af8c7+14-19
net: fixed body retrieval on HTTP servers logic
Impact
Framed request bytes are consumed consistently, avoiding protocol desynchronization on keep-alive connections even when the method is HEAD. Both Delphi and FPC server backends benefit.
Upgrade recommended
Include framed HEAD requests in keep-alive and OnBodyDownload regression tests.
11
High
Closing a Unix-domain client no longer removes the server socket
TCrtSocket.Close now calls fpunlink for nlUnix only when fWasBind is set. The regression test opens a client against a bound path and verifies that only freeing the server removes the file.
Fixes
mormot.net.sock+1
5b58dd54+19-2
net: TCrtSocket.Close only deletes a unix socket file it bound itself
Impact
On POSIX Delphi and FPC, a client disconnect no longer makes the live Unix-domain server unreachable to new clients by deleting its filesystem entry.
Upgrade recommended
Prioritize the update for Unix-domain socket users and test that client churn preserves the bound pathname.
Public API
TCrtSocket.Closebehaviour-changed
12
High
WinINet applies timeouts to the session handle
TWinINet.InternalConnect calls InternetSetOption on fSession rather than the not-yet-created fConnection and raises explicit errors if connect, send or receive timeout setup fails.
Fixes
mormot.net.client
94043c0a+11-8
net: fixed TWinINet.InternalConnect timeouts setting
Impact
Windows WinINet clients now actually receive the configured phase timeouts instead of silently calling the API with a nil handle. Failed setup is visible to Delphi callers.
Upgrade recommended
Validate connect, upload and response timeout behavior on the WinINet backend.
Units
13
High
HTTP construction now calls the backend after all fields are ready
THttpRequest.DoInternalConnect assigns fHttps before selecting a default port and restores the missing InternalConnect call after computing options.
Fixes
mormot.net.client
9482ca12+4-3
net: fixed previous THttpRequest commit
Impact
HTTPS again defaults to port 443 and native HTTP backends actually open their sessions. This repairs the immediately preceding constructor refactor for Delphi and FPC.
Upgrade recommended
Skip build 2.4.17413 and use the final build after retesting HTTP and HTTPS constructors.
Units
14
High
HTTP.sys servers now receive chunked request bodies
THttpApiServer.DoExecute now distinguishes known Content-Length from transfer-encoded input, loops HttpReceiveRequestEntityBody into a reusable 128 KB buffer for chunked data, enforces MaximumAllowedContentLength and reports actual received bytes.
New features
mormot.lib.winhttp+1
7baf2887+77-54
net: let http.sys server support chunked input body
Impact
Windows HTTP.sys backends can accept HTTP/1.1 chunked uploads instead of rejecting or truncating them. Oversized unknown-length bodies receive 413 and receive errors are surfaced as 406.
Upgrade recommended
Exercise chunked uploads around MaximumAllowedContentLength and verify application limits and 413 handling.
15
High
HTTP constructors share one initialization path across backends
THttpRequest adds DoInternalConnect to initialize URI fields, user agent and concrete timeouts before the backend virtual call; Curl uses the larger send/receive value for its global transfer timeout and Delphi NetHTTP reads the consolidated proxy option.
Under the hood
mormot.net.client
70951dd7+28-29
net: several fixes to THttpRequest.Create
Impact
All native backends follow one setup sequence, but this intermediate refactor required the next commit to restore the backend call and correct HTTPS port selection.
Worth a look
Units
16
Medium
Socket receives apply the timeout to each receive attempt
TCrtSocket.TrySockRecv computes a deadline for each Recv call, forces zero wait during SockInPending and clamps the remaining value before select or poll.
Fixes
mormot.net.sock
0f8d2fcd+15-13
net: rewritten TCrtSocket.TrySockRecv timeout logic
Impact
Receive waits on Delphi and FPC follow ReceiveTimeout per low-level attempt while pending-buffer probes remain non-blocking.
Worth a look
Units
17
Medium
HTTP redirects preserve methods except for the defined GET conversions
TAcmeLetsEncryptServer uses 301 for GET and HEAD and 308 otherwise. THttpClientSocket converts only POST on 301 and all non-HEAD methods on 303, while request construction no longer suppresses an explicitly supplied HEAD body.
Fixes
mormot.net.acme+2
8a6da8b7+14-12
net: other HTTP HEAD support related fixes
Impact
Delphi and FPC clients retain PUT, DELETE and other methods across 301 while following standard 303 behavior; ACME HTTP-to-HTTPS redirects preserve non-GET methods with 308.
Worth a look
18
Medium
Socket sends use a monotonic per-attempt deadline
TCrtSocket.TrySndLow computes an end tick with GetTickCount64 for each Send attempt and passes the remaining fSendTimeout to WaitFor instead of waiting with the legacy global TimeOut.
Fixes
mormot.net.sock
b05f8522+12-8
net: rewritten TCrtSocket.TrySndLow timeout/wait logic
Impact
Blocked sends on Delphi and FPC honor the send-phase timeout more precisely and do not reset the full wait after time already spent in Send.
Worth a look
Units
19
Medium
Pending buffered reads suppress waits without changing socket timeouts
TCrtSocket adds the internal fSockInPending flag around InputSock; SockInRead and TrySockRecv use it to avoid retry waits while leaving SO_RCVTIMEO and fReceiveTimeout untouched.
Fixes
mormot.net.sock
057aff56+7-9
net: fixed TCrtSocket.SockInPending from InputSock()
Impact
SockInPending remains non-blocking without temporarily corrupting the logical receive timeout, improving consistency for Delphi and FPC buffered sockets.
Worth a look
Units
20
Medium
WebSocket setup moves to the shared socket initialization hook
THttpClientWebSockets replaces its constructor override with DoCreate, calls inherited DoCreate, initializes settings and derives CallbackAnswerTimeOutMS from fReceiveTimeout.
Fixes
mormot.net.ws.client
7ceaa39c+6-8
net: fixed THttpClientWebSockets constructor
Impact
Every inherited constructor now initializes WebSocket settings once through the virtual hook on Delphi and FPC, avoiding missed or duplicate setup.
Worth a look
Units
21
Medium
Curl can explicitly disable inherited proxy settings
When THttpRequestExtendedOptions.Proxy is 'none', TCurlHttp passes a non-nil empty string to CURLOPT_PROXY; an empty option still permits Curl environment defaults and a real value selects that proxy.
Fixes
mormot.net.client
68b62f05+8-5
net: fixed TCurlHttp proper 'none' proxy support
Impact
POSIX Curl requests can reliably bypass HTTP_PROXY and related environment settings. Delphi and FPC callers continue to use the documented 'none' value.
Worth a look
Units
22
Medium
WinINet opens Unicode user-agent and proxy values
TWinINet.InternalConnect converts the user agent, proxy and bypass list from RawUtf8 to SynUnicode and calls InternetOpenW instead of InternetOpenA.
Fixes
mormot.net.client
3851e090+8-5
net: fixed TWinINet Unicode options support
Impact
Windows Delphi clients preserve non-ASCII user-agent and proxy configuration instead of encoding it through the active ANSI code page. FPC non-Windows paths are unaffected.
Worth a look
Units
23
Medium
Windows basic Kerberos authentication uses the full server context
TBasicAuthServerKerberos limits the single-pass onlypass credential shortcut to POSIX GSSAPI; Windows now follows the ServerSspiAuth context path needed for SSPI and optional group SID checks.
Fixes
mormot.net.ldap+1
8fc28980+7-6
net: fixed TBasicAuthServerKerberos on Windows
Impact
Windows Delphi servers no longer take a GSSAPI-only shortcut during basic Kerberos password validation. POSIX FPC behavior is retained.
Upgrade recommended
Retest Windows basic Kerberos logins with and without configured group SID restrictions.
24
Medium
System proxy selection now checks the destination host
GetSystemProxyUri uses TUri.Server rather than Address when rejecting empty, loopback or plain IPv4 destinations from proxying.
Fixes
mormot.net.client+1
d8e97dc6+5-6
net: fixed GetSystemProxyUri()
Impact
HTTP clients no longer make proxy decisions from the URL path component. Localhost and configured direct-IPv4 traffic should bypass the proxy as intended on Delphi and FPC.
Upgrade recommended
Retest localhost, literal IPv4 and normal hostname requests with automatic proxy discovery enabled.
25
Medium
ACME GET redirects use 301 instead of 308
TAcmeLetsEncryptServer.Redirect upgrades GET alongside HEAD to the 301 Moved Permanently branch, leaving method-preserving 308 for other methods.
Fixes
mormot.net.acme
9cd6ccba+5-4
net: fixed GET redirection on TAcmeLetsEncryptServer
Impact
Standard browser and ACME GET traffic receives the conventional permanent redirect. Existing Delphi/FPC application code needs no change.
Units
26
Medium
HTTP.sys keeps repeated authentication challenges separate
HTTP_RESPONSE.AddCustomHeader treats WWW-Authenticate and Proxy-Authenticate like Set-Cookie and Connection, routing each occurrence through unknown headers instead of collapsing it into one known-header slot.
Fixes
mormot.lib.winhttp
37898a45+6-3
net: http.sys respWwwAuthenticate + respProxyAuthenticate multiple headers
Impact
Windows HTTP.sys responses can advertise multiple authentication schemes without silently losing later values. No Delphi or FPC caller change is required.
Worth a look
Units
27
Medium
HTTP.sys preserves every Set-Cookie header
HTTP_RESPONSE.AddCustomHeader sends respSetCookie through the unknown-header array so repeated Set-Cookie lines are retained rather than overwritten in the single known-header field.
Fixes
mormot.lib.winhttp
ed828cab+5-4
net: fixed several respSetCookie / Set-Cookie: values in http.sys
Impact
Windows HTTP.sys applications setting several cookies in one response now deliver all of them. Other Delphi/FPC HTTP server backends are unaffected.
Upgrade recommended
Retest login and session responses that emit more than one Set-Cookie line.
Units
28
Medium
WebSocket callback waits track the effective receive timeout
THttpClientWebSockets initializes through DoCreate and SetReceiveTimeout assigns CallbackAnswerTimeOutMS from the stored fReceiveTimeout after the inherited setter runs.
Fixes
mormot.net.ws.client
881d1c4e+4-4
net: fixed THttpClientWebSockets with new timeouts
Impact
WebSocket callback waits now match the effective receive timeout after normalization on Delphi and FPC clients.
Worth a look
Units
29
Medium
Proxy bypass lists survive option serialization
THttpRequestExtendedOptions.Save adds ProxyByPass under key pb and Load restores it, alongside the existing proxy, authentication, TLS and timeout fields.
Fixes
mormot.net.client
ac6bc5d6+5-2
net: fixed THttpRequestExtendedOptions.ProxyByPass serialization
Impact
Delphi and FPC code persisting HTTP connection options no longer loses its proxy bypass list after reload. Existing serialized data remains readable without the new key.
Worth a look
Units
30
Medium
Extended HTTP options gain a proxy bypass list
THttpRequestExtendedOptions adds public ProxyByPass and THttpRequest removes duplicate storage, routing WinHTTP, WinINet and Curl proxy reads through the options record.
New features
mormot.net.client
2febb8e3+19-19
net: introducing THttpRequestExtendedOptions.ProxyBypass field
Impact
Delphi and FPC callers using the extended-options constructor can now supply a native proxy bypass list directly. Existing constructor parameters remain available.
Worth a look
Public API
THttpRequestExtendedOptions.ProxyByPassadded
Units
31
Medium
Chunked HTTP.sys uploads grow their buffer geometrically
The chunked-body path stores the first block directly and grows InContent with NextGrow before copying subsequent blocks, instead of appending and reallocating the string for every receive.
Performance
mormot.net.server
c8d7648a+11-5
net: optimized memory allocation for http.sys #637 chunked input body
Impact
Large or fragmented chunked uploads on Windows HTTP.sys allocate and copy less memory. Delphi and FPC application interfaces are unchanged.
Units
32
Medium
The ambiguous bodyless-method helper is deprecated
HttpMethodWithNoBody is marked deprecated and its documentation directs response decisions to IsHead while request-body presence must be determined from message framing.
Deprecations
mormot.net.http
a65a05fa+6-8
net: marked HttpMethodWithNoBody() as deprecated
Impact
Delphi and FPC callers receive a deprecation warning. Keeping the helper may preserve the old incorrect assumption that OPTIONS has no body.
Worth a look
Public API
HttpMethodWithNoBodydeprecated
Units
33
Medium
REST HTTP clients adopt the consolidated timeout record
TRestHttpClientGeneric assigns connect, send and receive values to fExtendedOptions and calls ComputeTimeouts in constructors and definition loading, while proxy strings remain RawUtf8 instead of passing through ANSI conversion.
Under the hood
mormot.rest.http.client
f54c3e10+17-37
rest: rewritten TRestHttpClient with latest changes
Impact
REST HTTP clients share the same timeout defaults as native clients and preserve non-ASCII proxy text. Public Delphi/FPC construction syntax is unchanged.
Worth a look
34
Medium
REST HTTP clients store proxy data only in extended options
TRestHttpClientRequest removes duplicate fProxyName and fProxyByPass fields, serializes the values from fExtendedOptions and constructs THttpRequest through the TUri plus options overload.
Under the hood
mormot.rest.http.client
bdfe38d5+16-14
rest: removed TRestHttpClientRequest fProxyName/fProxyPass fields
Impact
Proxy settings now have one source of truth in Delphi and FPC REST clients. Existing public constructors and connection definitions retain their surface.
Worth a look
35
Low
Async connections honor the configured loopback-address policy
TAsyncConnection.Create and Recycle pass RemoteIPLocalHostAsVoidInServers to TNetAddr.IP instead of always converting loopback to an empty RemoteIP string.
Fixes
mormot.net.async+1
16543664+7-7
net: TAsynConnection follow RemoteIPLocalHostAsVoidInServers
Impact
Delphi and FPC async servers can now report 127.0.0.1 when the global policy is false, matching synchronous server behavior. No code migration is needed.
36
Low
Method tests now cover the concrete predicates used by HTTP code
test.core.base removes HttpMethodWithNoBody assertions and adds explicit positive and negative cases for IsGet, IsPost, IsPut, IsDelete, IsHead and IsOptions.
Tests
test.core.base
a166d116+31-15
tests: remove HttpMethodWithNoBody() but use really used methods
Impact
This is test-only coverage for the method-semantics change; it does not alter Delphi or FPC application code by itself.