fix: use HTTP/1.1 for cleartext requests through a forward proxy

changes.md

@@ -179,6 +179,9 @@ Changes log
         - The HTTP client uses the "https.proxyHost" and "https.proxyPort" system properties for
           HTTPS requests, instead of "http.proxyHost" and "http.proxyPort", like the JDK. The
           "proxyHost" and "proxyPort" parameters still apply to both. Issue #1570.
+        - In the "HTTP2" transport mode, the HTTP client uses HTTP/1.1 for cleartext requests
+          sent through a forward proxy, instead of HTTP/2 with prior knowledge that HTTP proxies
+          generally refuse. Issue #1571.
         - The `Max-Age` and `Path` attributes of a cookie setting are no longer quoted. Issue #1334.
         - `Restlet.handle()` no longer fails with a `NullPointerException` when the Restlet has no context and cannot be started.
         - `CookieAuthenticator` no longer lets the next restlet overwrite the redirection sent after

org.restlet/src/main/java/org/restlet/engine/netty/NettyClientHelper.java

@@ -135,7 +135,8 @@
  * <td>String</td>
  * <td>HTTP1_1</td>
  * <td>Indicate the HTTP client transport mode among the following options: "HTTP1_1", "HTTP2"
- * (HTTP/2 only: negotiated with ALPN over TLS, prior knowledge in cleartext), "DYNAMIC" (HTTP/2
+ * (HTTP/2 only: negotiated with ALPN over TLS, prior knowledge in cleartext, except through a
+ * forward proxy where HTTP/1.1 is used), "DYNAMIC" (HTTP/2
  * when negotiated with ALPN over TLS, HTTP/1.1 otherwise), "HTTP3" (<b>experimental</b>: HTTP/3
  * over QUIC for HTTPS URIs without proxy, HTTP/1.1 otherwise; requires the optional
  * {@code io.netty:netty-codec-http3} dependency with its native QUIC library, and the {@link
@@ -699,11 +700,7 @@
                                         @Override
                                         protected void initChannel(SocketChannel ch) {
                                             initConnection(
-                                                    ch,
-                                                    pool,
-                                                    ssl,
-                                                    pool.secure ? proxy : null,
-                                                    proxyAuthorization);
+                                                    ch, pool, ssl, proxy, proxyAuthorization);
                                         }
                                     });
 
@@ -808,7 +805,7 @@
             SocketChannel ch,
             OriginPool pool,
             SslContext ssl,
-            InetSocketAddress tunnelProxy,
+            InetSocketAddress proxy,
             String proxyAuthorization) {
         final Promise<String> ready = ch.eventLoop().newPromise();
         ch.attr(READY).set(ready);
@@ -823,16 +820,16 @@
         }
         p.addLast("writability", Writability.HANDLER);
 
-        if (tunnelProxy == null) {
-            initProtocols(ch, pool, ssl, ready);
+        if ((proxy == null) || !pool.secure) {
+            initProtocols(ch, pool, ssl, ready, proxy != null);
             return;
         }
 
         HttpHeaders connectHeaders = new DefaultHttpHeaders();
         if (proxyAuthorization != null) {
             connectHeaders.set(HttpHeaderNames.PROXY_AUTHORIZATION, proxyAuthorization);
         }
-        HttpProxyHandler proxyHandler = new HttpProxyHandler(tunnelProxy, connectHeaders);
+        HttpProxyHandler proxyHandler = new HttpProxyHandler(proxy, connectHeaders);
         proxyHandler.setConnectTimeoutMillis(getConnectTimeout());
         p.addLast("proxy", proxyHandler);
         p.addLast(
@@ -853,7 +850,7 @@
                 .addListener(
                         f -> {
                             if (f.isSuccess()) {
-                                initProtocols(ch, pool, ssl, ready);
+                                initProtocols(ch, pool, ssl, ready, false);
                             } else {
                                 ready.tryFailure(f.cause());
                             }
@@ -867,9 +864,14 @@
      * @param pool The connection pool of the origin.
      * @param ssl The SSL context, or null for a cleartext connection.
      * @param ready The promise completed with the negotiated protocol.
+     * @param forwardProxy True for a cleartext connection to a forward proxy.
      */
     private void initProtocols(
-            SocketChannel ch, OriginPool pool, SslContext ssl, Promise<String> ready) {
+            SocketChannel ch,
+            OriginPool pool,
+            SslContext ssl,
+            Promise<String> ready,
+            boolean forwardProxy) {
         ChannelPipeline p = ch.pipeline();
         final TransportMode mode = getTransportMode();
         if (ssl != null) {
@@ -910,10 +912,19 @@
                             ctx.close();
                         }
                     });
-        } else if (mode == TransportMode.HTTP2) {
+        } else if (mode == TransportMode.HTTP2 && !forwardProxy) {
             addHttp2Handlers(p);
             ready.trySuccess(ApplicationProtocolNames.HTTP_2);
         } else {
+            if (mode == TransportMode.HTTP2) {
+                // HTTP proxies generally don't accept HTTP/2 with prior knowledge.
+                getLogger()
+                        .fine(
+                                "Using HTTP/1.1 through the forward proxy to "
+                                        + pool.host
+                                        + ":"
+                                        + pool.port);
+            }
             addHttp1Handlers(p);
             ready.trySuccess(ApplicationProtocolNames.HTTP_1_1);
         }

org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java

@@ -131,6 +131,23 @@ void forwardsHttpRequestsWithAbsoluteUris() throws Exception {
         assertEquals("GET " + uri + " HTTP/1.1", proxy.requestLines.getFirst());
     }
 
+    @Test
+    void forwardsCleartextHttp2RequestsWithHttp1() throws Exception {
+        server = new Server(new Context(), Protocol.HTTP, 0, HELLO);
+        server.start();
+
+        Context context = proxyContext();
+        context.getParameters().add("httpClientTransportMode", "HTTP2");
+        client = new Client(context, Protocol.HTTP);
+        client.start();
+
+        String uri = "http://localhost:" + server.getActualPort() + "/h2";
+        Response response = client.handle(new Request(Method.GET, uri));
+        assertEquals(Status.SUCCESS_OK, response.getStatus());
+        assertEquals("hello /h2", response.getEntityAsText());
+        assertEquals(List.of("GET " + uri + " HTTP/1.1"), proxy.requestLines);
+    }
+
     @Test
     void tunnelsHttpsRequestsWithConnect() throws Exception {
         startHttpsServer(HELLO);