envoyproxy / envoyproxy/nighthawk

Make HTTP/3 Quic skip certificate verification

Open
#727 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C++
Stars
414
Forks
95
Avg merge
2d 9h
Merged PRs (30d)
11

Description

The current implementation of HTTP/3 Quic in Nighthawk reuses Envoy's `Http3::ConnectionPool` which has a hardcoded Quic's `EnvoyQuicProofVerifier`. This means that a Quic connection can only be established if the requested hostname matches the one in the leaf server certificate.

This is different from how Nighthawk handles HTTPs with H1/H2 where certificate verification is skipped. The simplest solution might be to create our own instance of the H3 connection pool with the `TestProofVerifier` from [here](https://github.com/envoyproxy/envoy/blob/e85a7f408c7baee8e1ed4af39a647c98ee5f2215/test/common/quic/test_proof_verifier.h#L9).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.