Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http: configurable ignore of HTTP/1.1 upgrades #37642

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

tedgeat
Copy link

@tedgeat tedgeat commented Dec 12, 2024

Fixes #36305

Add configuration to ignore HTTP/1.1 Upgrade headers . See https://datatracker.ietf.org/doc/html/rfc7230#section-6.7:

Risk Level: Medium
Testing: new unit tests
Docs Changes: in with APIs
Release Notes: inline

Co-authored-by: Greg Greenway <[email protected]>

Signed-off-by: Tom Edge <[email protected]>
Copy link

Hi @tedgeat, welcome and thank you for your contribution.

We will try to review your Pull Request as quickly as possible.

In the meantime, please take a look at the contribution guidelines if you have not done so already.

🐱

Caused by: #37642 was opened by tedgeat.

see: more, trace.

Copy link

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @wbpcode
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #37642 was opened by tedgeat.

see: more, trace.

@ipoval
Copy link

ipoval commented Dec 15, 2024

@tedgeat 👋 , is it going to work for http2 upstreams too?

Copy link
Member

@wbpcode wbpcode left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think remove the unsupported upgrade type and treat the upgrade request as a normal http request is good choice. If clients ask envoy to upgrade but envoy cannot support, rejection would be best choice.

This change brings a new option to our core API and only for a special (or incorrect) hack.

cc @alyssawilk @envoyproxy/senior-maintainers for more input.

/wait

Comment on lines +420 to +422

// Ignore HTTP/1.1 upgrade headers rather than default rejection
bool ignore_http_11_upgrade = 11;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the naming, the options will ignore all upgrade. But actually the implementation didn't works at that way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

HTTP/1.1 TLS Upgrade (RFC-2817) causes upgrade_failed
4 participants