Merge remote-tracking branch 'origin/development' into FIX-ALPN-ABSENT-HTTP1-FALLBACK

# Conflicts:
#	src/main/java/com/blazemeter/jmeter/http2/core/HTTP2JettyClient.java

Co-authored-by: 3dgiordano <797057+3dgiordano@users.noreply.github.com>

Author: Copilot

src/main/java/com/blazemeter/jmeter/http2/core/HTTP2JettyClient.java

@@ -17,6 +17,8 @@
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
 import java.lang.reflect.Method;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
 import java.net.MalformedURLException;
 import java.net.SocketAddress;
 import java.net.URI;
@@ -33,11 +35,13 @@
 import java.nio.file.Paths;
 import java.nio.file.StandardOpenOption;
 import java.time.Duration;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Objects;
@@ -61,6 +65,7 @@
 import java.util.zip.Inflater;
 import java.util.zip.InflaterInputStream;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.conn.DnsResolver;
 import org.apache.jmeter.protocol.http.control.AuthManager;
 import org.apache.jmeter.protocol.http.control.Authorization;
 import org.apache.jmeter.protocol.http.control.Cookie;
@@ -186,6 +191,15 @@ public class HTTP2JettyClient {
   private static final String ATTR_SKIP_H2C_UPGRADE = "bzm.skipH2cUpgrade";
   private static final String ATTR_ORIGIN_KEY = "bzm.http3.origin";
   private static final String ATTR_REQUEST_HEADERS_SERIALIZED = "bzm.request.headers.serialized";
+  /**
+   * JMeter's deprecated "BASIC_DIGEST" Auth Manager mechanism, still selectable in the GUI and
+   * still present in older plans. HC4 keeps honouring it: {@code AuthManager.setupCredentials}
+   * registers the credentials without binding them to a scheme, so they answer either challenge,
+   * and the preemptive auth cache treats the row as Basic. Referenced by name so this file does
+   * not have to carry a deprecation suppression, the same way the surrounding code compares
+   * mechanisms by {@code name()}.
+   */
+  private static final String BASIC_DIGEST_MECHANISM = "BASIC_DIGEST";
   private static final String PROP_SKIP_REDUNDANT_MANUAL_DECODE =
       "blazemeter.http.skipManualDecodeWhenAdvertised";
   private static final Path DEBUG_LOG_PATH = resolveDebugLogPath();
@@ -326,13 +340,30 @@ public class HTTP2JettyClient {
    * protocol variant made it.
    */
   private final ConnectAttemptRecorder connectAttempts = new ConnectAttemptRecorder();
+  /**
+   * Every {@link ClientConnector} this client builds, so {@link #setSourceAddress} can reach the
+   * QUIC one too - no transport {@code doStart} propagates the bind address to it.
+   */
+  private final List<ClientConnector> connectors = new ArrayList<>();
+  /**
+   * The sampler's DNS Cache Manager, or {@code null} when the plan has none. Held so
+   * {@link #configureHttpClient} can install {@link JMeterDnsSocketAddressResolver} on every
+   * protocol-variant client before any of them is started.
+   */
+  private final DnsResolver dnsResolver;
 
   public HTTP2JettyClient(boolean http1UpgradeRequired, String name) {
     this(http1UpgradeRequired, name, null);
   }
 
   public HTTP2JettyClient(boolean http1UpgradeRequired, String name,
                           HTTP2ClientProfileConfig profileConfig) {
+    this(http1UpgradeRequired, name, profileConfig, null);
+  }
+
+  public HTTP2JettyClient(boolean http1UpgradeRequired, String name,
+                          HTTP2ClientProfileConfig profileConfig, DnsResolver dnsResolver) {
+    this.dnsResolver = dnsResolver;
     loadProperties(profileConfig);
     lowLevelDebug(PLUGIN_BUILD_TAG);
 
@@ -3470,6 +3501,7 @@ public Thread newThread(Runnable r) {
 
   private void configureHttpClient(HttpClient client, ClientConnector connector) {
     client.setUserAgentField(null);
+    configureDnsResolution(client);
     connector.setByteBufferPool(this.bufferPool);
     client.setMaxRequestsQueuedPerDestination(maxRequestsQueuedPerDestination);
     client.setMaxConnectionsPerDestination(maxConnectionsPerDestination);
@@ -3488,6 +3520,23 @@ private void configureHttpClient(HttpClient client, ClientConnector connector) {
     }
   }
 
+  /**
+   * Routes host name resolution through the plan's DNS Cache Manager, when there is one.
+   *
+   * <p>With no manager configured nothing is set and {@code HttpClient.doStart} installs its own
+   * {@code SocketAddressResolver.Async}, which is the same default {@code HTTPHC4Impl} falls back
+   * to ({@code SystemDefaultDnsResolver}). Under a proxy this still resolves the proxy host rather
+   * than the target host, because Jetty resolves {@code HttpDestination.resolveOrigin()} - again
+   * matching HC4, which connects to the proxy hop of the route.
+   */
+  private void configureDnsResolution(HttpClient client) {
+    if (dnsResolver == null) {
+      return;
+    }
+    client.setSocketAddressResolver(new JMeterDnsSocketAddressResolver(dnsResolver,
+        client::getExecutor, client::getScheduler, client.getAddressResolutionTimeout()));
+  }
+
   private static void addConnectionLogging(HttpClient client) {
     client.addBean(new Connection.Listener() {
       @Override
@@ -3559,6 +3608,29 @@ private static Path resolveAlpnLogPath() {
         .resolve("http2-client-alpn.log");
   }
 
+  /**
+   * Binds every outgoing connection of this client to {@code sourceAddress} (JMeter's "Source
+   * address" field, a.k.a. IP spoofing), or restores the OS default when {@code null}.
+   *
+   * <p>Must be called before {@link #start()}: Jetty reads the bind address in
+   * {@code AbstractConnectorHttpClientTransport.doStart}, which then pushes it onto the transport's
+   * own connector. The QUIC connector used for HTTP/3 is not owned by any transport's
+   * {@code doStart}, so it is set here directly - which is also why the connectors are tracked.
+   *
+   * <p>Unlike HC4 this is per client rather than per request, because that is the granularity Jetty
+   * offers. {@code HTTP2Sampler} compensates by keying its per-thread client cache on the
+   * sampler's source-address configuration, so two samplers spoofing different IPs get their own
+   * client instead of silently sharing one.
+   */
+  public void setSourceAddress(InetAddress sourceAddress) {
+    SocketAddress bindAddress =
+        sourceAddress == null ? null : new InetSocketAddress(sourceAddress, 0);
+    forEachHttpClient(client -> client.setBindAddress(bindAddress));
+    for (ClientConnector connector : connectors) {
+      connector.setBindAddress(bindAddress);
+    }
+  }
+
   /**
    * Attaches every connection failure recorded for {@code url} since {@code sinceMillis} to
    * {@code failure} as suppressed exceptions, recovering the attempts Jetty discarded.
@@ -3569,6 +3641,7 @@ public void attachConnectAttempts(Throwable failure, URL url, long sinceMillis)
 
   private ClientConnector createClientConnector(String name) {
     ClientConnector connector = new ClientConnector();
+    connectors.add(connector);
     if (sharedThreadPoolEnabled) {
       connector.setSelectors(-1);
     } else {
@@ -3778,24 +3851,44 @@ private void setAuthManager(HTTP2Sampler sampler) {
   private boolean isSupportedMechanism(Authorization auth) {
     String authName = auth.getMechanism().name();
     return authName.equals(AuthManager.Mechanism.BASIC.name())
-        || authName.equals(AuthManager.Mechanism.DIGEST.name());
+        || authName.equals(AuthManager.Mechanism.DIGEST.name())
+        || authName.equals(BASIC_DIGEST_MECHANISM);
+  }
+
+  /**
+   * Whether the row may answer a {@code Basic} challenge, which {@code BASIC_DIGEST} rows may.
+   */
+  private static boolean answersBasicChallenge(Authorization auth) {
+    String authName = auth.getMechanism().name();
+    return authName.equals(AuthManager.Mechanism.BASIC.name())
+        || authName.equals(BASIC_DIGEST_MECHANISM);
+  }
+
+  /**
+   * Whether the row may answer a {@code Digest} challenge, which {@code BASIC_DIGEST} rows may.
+   */
+  private static boolean answersDigestChallenge(Authorization auth) {
+    String authName = auth.getMechanism().name();
+    return authName.equals(AuthManager.Mechanism.DIGEST.name())
+        || authName.equals(BASIC_DIGEST_MECHANISM);
   }
 
   private void addAuthenticationToJettyClient(Authorization auth) {
     String authName = auth.getMechanism().name();
-    if (authName.equals(AuthManager.Mechanism.BASIC.name())
-        && BzmHttpPluginProperties.getPropDefault("httpJettyClient.auth.preemptive", false)) {
+    boolean preemptive =
+        BzmHttpPluginProperties.getPropDefault("httpJettyClient.auth.preemptive", false);
+    if (preemptive && answersBasicChallenge(auth)) {
       BasicAuthentication.BasicResult result =
           new BasicAuthentication.BasicResult(URI.create(auth.getURL()), auth.getUser(),
               auth.getPass());
       // Results are keyed by URI (Map.put replaces); safe to re-register every sample.
       forEachAuthenticationStore(store -> store.addAuthenticationResult(result));
-      return;
-    }
-
-    String fingerprint = authFingerprint(auth);
-    if (!registeredAuthFingerprints.add(fingerprint)) {
-      return;
+      if (authName.equals(AuthManager.Mechanism.BASIC.name())) {
+        return;
+      }
+      // A BASIC_DIGEST row falls through: sending Basic up front is what HC4's auth cache does,
+      // but the credentials must still be able to answer whichever challenge the server sends
+      // back, which is the whole point of the mechanism.
     }
 
     URI uri = URI.create(auth.getURL());
@@ -3804,10 +3897,26 @@ private void addAuthenticationToJettyClient(Authorization auth) {
       // Blank JMeter realm must match any challenge realm; "" would only match "".
       realm = Authentication.ANY_REALM;
     }
-    AbstractAuthentication authentication =
-        authName.equals(AuthManager.Mechanism.BASIC.name())
-            ? new BasicAuthentication(uri, realm, auth.getUser(), auth.getPass())
-            : new DigestAuthentication(uri, realm, auth.getUser(), auth.getPass());
+    if (answersBasicChallenge(auth)) {
+      registerAuthentication(auth,
+          new BasicAuthentication(uri, realm, auth.getUser(), auth.getPass()));
+    }
+    if (answersDigestChallenge(auth)) {
+      registerAuthentication(auth,
+          new DigestAuthentication(uri, realm, auth.getUser(), auth.getPass()));
+    }
+  }
+
+  /**
+   * Adds one Jetty authentication to every protocol-variant store, once per distinct row.
+   *
+   * <p>The fingerprint carries the Jetty authentication type because a single {@code BASIC_DIGEST}
+   * row produces two of them, and both have to get through.
+   */
+  private void registerAuthentication(Authorization auth, AbstractAuthentication authentication) {
+    if (!registeredAuthFingerprints.add(authFingerprint(auth) + '|' + authentication.getType())) {
+      return;
+    }
     forEachAuthenticationStore(store -> store.addAuthentication(authentication));
   }
 
@@ -4130,7 +4239,7 @@ private void addPreemptiveAuthorizationHeader(Request request, URL url,
     StreamSupport.stream(authManager.getAuthObjects().spliterator(), false)
         .map(j -> (Authorization) j.getObjectValue())
         .filter(auth -> auth != null
-            && AuthManager.Mechanism.BASIC.equals(auth.getMechanism())
+            && answersBasicChallenge(auth)
             && !StringUtils.isEmpty(auth.getURL()))
         .filter(auth -> url.toString().startsWith(auth.getURL()))
         .findFirst()
@@ -5093,4 +5202,3 @@ private void copy(InputStream input, ByteArrayOutputStream output) throws IOExce
     }
   }
 }
-

src/main/java/com/blazemeter/jmeter/http2/core/JMeterDnsSocketAddressResolver.java

@@ -0,0 +1,136 @@
+package com.blazemeter.jmeter.http2.core;
+
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executor;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.Supplier;
+import org.apache.http.conn.DnsResolver;
+import org.eclipse.jetty.util.Promise;
+import org.eclipse.jetty.util.SocketAddressResolver;
+import org.eclipse.jetty.util.thread.Scheduler;
+
+/**
+ * Resolves host names through JMeter's DNS Cache Manager instead of {@code InetAddress}, so a test
+ * plan's custom DNS servers, static host entries and per-thread DNS cache apply to this plugin
+ * exactly as they do to {@code HTTPHC4Impl}.
+ *
+ * <p>{@code DNSCacheManager} is an {@code org.apache.http.conn.DnsResolver}, which is what
+ * {@code HTTPHC4Impl} hands to its connection operator on the one-time client init. This class is
+ * the Jetty-side equivalent: {@code HttpClient} resolves through a {@link SocketAddressResolver},
+ * and installing one is enough to cover every protocol, because HTTP/1.1, h2, h2c and HTTP/3 all
+ * reach the network through {@code HttpClient.newConnection}.
+ *
+ * <p>Deliberately modelled on {@link SocketAddressResolver.Async}, which it replaces: the lookup
+ * runs on the client executor rather than on the caller (which may be a selector thread), and a
+ * scheduled task fails the promise if the lookup outlives the timeout. The guard is not optional
+ * here - JMeter never calls {@code DNSCacheManager.setTimeoutMs}, so a custom resolver inherits
+ * dnsjava's own retry behaviour and a black-holed DNS server would otherwise pin an executor
+ * thread with nothing failing the request.
+ *
+ * <p>The executor and scheduler are read lazily because the resolver is installed while the
+ * {@code HttpClient} is still being built: {@code HttpClient.doStart} only creates its default
+ * {@code Async} resolver when none was set, so ours has to be in place before {@code start()},
+ * at which point {@code getExecutor()} and {@code getScheduler()} are still {@code null}.
+ */
+public class JMeterDnsSocketAddressResolver implements SocketAddressResolver {
+
+  private final DnsResolver dnsResolver;
+  private final Supplier<Executor> executorSupplier;
+  private final Supplier<Scheduler> schedulerSupplier;
+  private final long timeoutMs;
+
+  public JMeterDnsSocketAddressResolver(DnsResolver dnsResolver,
+                                        Supplier<Executor> executorSupplier,
+                                        Supplier<Scheduler> schedulerSupplier,
+                                        long timeoutMs) {
+    this.dnsResolver = dnsResolver;
+    this.executorSupplier = executorSupplier;
+    this.schedulerSupplier = schedulerSupplier;
+    this.timeoutMs = timeoutMs;
+  }
+
+  @Override
+  public void resolve(String host, int port, Map<String, Object> context,
+                      Promise<List<InetSocketAddress>> promise) {
+    Executor executor = executorSupplier.get();
+    if (executor == null) {
+      // Only reachable if a caller resolves before the client is started; resolving inline is
+      // still better than dropping the request on the floor.
+      resolveAndComplete(host, port, promise, new AtomicBoolean());
+      return;
+    }
+    executor.execute(() -> {
+      AtomicBoolean complete = new AtomicBoolean();
+      Scheduler.Task timeoutTask = scheduleTimeout(host, Thread.currentThread(), complete, promise);
+      try {
+        resolveAndComplete(host, port, promise, complete);
+      } finally {
+        if (timeoutTask != null) {
+          timeoutTask.cancel();
+        }
+        // The timeout task interrupts this thread to unblock the lookup; clear the flag so the
+        // pooled thread does not carry it into unrelated work.
+        Thread.interrupted();
+      }
+    });
+  }
+
+  private Scheduler.Task scheduleTimeout(String host, Thread resolvingThread,
+                                         AtomicBoolean complete,
+                                         Promise<List<InetSocketAddress>> promise) {
+    Scheduler scheduler = schedulerSupplier.get();
+    if (timeoutMs <= 0 || scheduler == null) {
+      return null;
+    }
+    return scheduler.schedule(() -> {
+      if (complete.compareAndSet(false, true)) {
+        promise.failed(new TimeoutException(
+            "DNS timeout " + timeoutMs + " ms resolving " + host));
+        resolvingThread.interrupt();
+      }
+    }, timeoutMs, TimeUnit.MILLISECONDS);
+  }
+
+  private void resolveAndComplete(String host, int port,
+                                  Promise<List<InetSocketAddress>> promise,
+                                  AtomicBoolean complete) {
+    try {
+      InetAddress[] addresses = resolveAddresses(host);
+      // DNSCacheManager returns null when a custom lookup cannot parse the name, and an empty
+      // array when a static host entry is matched case-insensitively by isStaticHost but read
+      // case-sensitively by fromStaticHost (a JMeter bug still present on master). Neither may
+      // reach Jetty as a success: HttpClient indexes straight into the returned list.
+      if (addresses == null || addresses.length == 0) {
+        throw new UnknownHostException(host);
+      }
+      List<InetSocketAddress> result = new ArrayList<>(addresses.length);
+      for (InetAddress address : addresses) {
+        result.add(new InetSocketAddress(address, port));
+      }
+      if (complete.compareAndSet(false, true)) {
+        promise.succeeded(result);
+      }
+    } catch (Throwable failure) {
+      if (complete.compareAndSet(false, true)) {
+        promise.failed(failure);
+      }
+    }
+  }
+
+  private InetAddress[] resolveAddresses(String host) throws UnknownHostException {
+    // DNSCacheManager keeps its cache in a plain LinkedHashMap and JMeter clones one instance per
+    // thread, but a single JMeter thread resolves concurrently here (embedded resources, and the
+    // HTTP/3 vs HTTP/2 race, run on plugin executors). Serializing keeps that map consistent;
+    // cache hits make the critical section negligible.
+    synchronized (dnsResolver) {
+      return dnsResolver.resolve(host);
+    }
+  }
+}