cloudflare / cloudflare/pingora

Full pipelining support

Open
#673 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
27.4k
Forks
1.7k
Avg merge
6h 22m
Merged PRs (30d)
3

Description

## What is the problem your feature solves, or the need it fulfills?

Pingora currently does not support pipelining. This is problematic because it means that Pingora’s behavior is different than that of a correct HTTP/1.1 server. My understanding is that this was exploited in a desync attack. While that was fixed, full pipelining support would have prevented the bug.

## Describe the solution you'd like

Pingora should support pipelining if possible. If this is not possible, it should immediately close the connection if any data is received from the client prior to the full response body being sent, but this does not conform to the HTTP/1.1 standard.

## Describe alternatives you've considered

Continue to use _ad hoc_ desync prevention measures.

## Additional context

- https://http1mustdie.com — Pingora had an exploitable desync bug.
- https://www.rfc-editor.org/rfc/rfc9112

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.