envoyproxy / envoyproxy/envoy

Envoy does not adhere to HTTP/2 RFC 7540

Open
#6,767 60 comments 43 reactions 1 assignee Assigned to @lambdai View on GitHub
area/http area/tls design proposal help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
428

Description

*Title*: Envoy does not adhere to HTTP/2 RFC 7540

*Description*:
>RFC 7540 Section 9.1.1 and 9.1.2 specifies when a request coming in through a re-used HTTP/2 connection is accidentally sent to a non-origin but authoritative server that a 421 response should be returned. This can happen if two servers one with a wildcard certificate (e.g., a.example.com) and another server (b.example.com) with a non-wildcard on the same IP address using SNI responds to requests those meant for server b.example.com will accidentally be forwarded down the re-used HTTP/2 connection for a.example.com. In this situation a.example.com should send back a 421 to indicate the request was destined for b.example.com. This forces browsers to re-establish a new connection, re-negotiate the SNI, and thus the backing server and subsequently route to the correct origin.

[optional *Relevant Links*:]
* https://tools.ietf.org/html/rfc7540#section-9.1.1 - section describing connection re-use
* https://tools.ietf.org/html/rfc7540#section-9.1.2 - section describing misdirected response
* https://bugs.chromium.org/p/chromium/issues/detail?id=954160#c5 - The bug was originally filed against Chromium however they indicated Istio was the issue.
* https://github.com/istio/istio/issues/13589 - The bug was then filed against istio who indicated envoy was the issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.