Envoy does not adhere to HTTP/2 RFC 7540
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 428
Description
*Title*: Envoy does not adhere to HTTP/2 RFC 7540
*Description*:
>RFC 7540 Section 9.1.1 and 9.1.2 specifies when a request coming in through a re-used HTTP/2 connection is accidentally sent to a non-origin but authoritative server that a 421 response should be returned. This can happen if two servers one with a wildcard certificate (e.g., a.example.com) and another server (b.example.com) with a non-wildcard on the same IP address using SNI responds to requests those meant for server b.example.com will accidentally be forwarded down the re-used HTTP/2 connection for a.example.com. In this situation a.example.com should send back a 421 to indicate the request was destined for b.example.com. This forces browsers to re-establish a new connection, re-negotiate the SNI, and thus the backing server and subsequently route to the correct origin.
[optional *Relevant Links*:]
* https://tools.ietf.org/html/rfc7540#section-9.1.1 - section describing connection re-use
* https://tools.ietf.org/html/rfc7540#section-9.1.2 - section describing misdirected response
* https://bugs.chromium.org/p/chromium/issues/detail?id=954160#c5 - The bug was originally filed against Chromium however they indicated Istio was the issue.
* https://github.com/istio/istio/issues/13589 - The bug was then filed against istio who indicated envoy was the issue.
Contributor guide
Assessment
This issue has not been assessed yet.