Wrong filter_chain_match'ing for HTTP/2 #37810
Comments
|
I faced with the same problem. But It seems that envoy doesn't use header HOST for choose correct config section, only use SNI for this. But modern browsers don't send sni on every request if both site on the same IP and use the same certificate. |
|
I can't seem to repro using cURL on the same Envoy version listed in the description (v1.32.3). Here are the requests I made and the responses I got, Request: curl -vvv https://lol.zvlb.io:443 --resolve lol.zvlb.io:443:127.0.0.1 --http2 -kResponse: * Using Stream ID: 1 (easy handle 0x5639f07964f0)
> GET / HTTP/2
> Host: lol.zvlb.io
> user-agent: curl/7.68.0
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 2147483647)!
< HTTP/2 200
< content-length: 3
< content-type: text/plain
< date: Tue, 31 Dec 2024 00:58:16 GMT
< server: envoy
<
* Connection #0 to host lol.zvlb.io left intact
lolRequest: curl -vvv https://kek.zvlb.io:443 --resolve kek.zvlb.io:443:127.0.0.1 --http2 -kResponse: * Using Stream ID: 1 (easy handle 0x564676514260)
> GET / HTTP/2
> Host: kek.zvlb.io
> user-agent: curl/7.68.0
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 2147483647)!
< HTTP/2 200
< content-length: 3
< content-type: text/plain
< date: Tue, 31 Dec 2024 00:59:15 GMT
< server: envoy
<
* Connection #0 to host kek.zvlb.io left intact
kek |
|
@agrawroh yes, you are right. Because curl send SNI on every request. It affected only modern browsers especially chrome and firefox. |
|
@agrawroh
|
|
I think this is probably the same issue described in #6767. @zvlb you can work around this by either using a single network filter chain and matching on vhost in the http connection manager, or keeping two filter chains and configuring the http connection manager to respond with a 421 when the wrong vhost is received. |
I can’t use a single filterChain because I may have completely different httpFilters (applied at the filterChain level) for different domains using the same certificate. Perhaps I could resolve this somehow using typed-per-filter-config, but it seems… terrible to me. Regarding the 421 response code. How can I determine that the vhost is incorrect? Do you have an example of such a configuration? Can this be configured using some kind of httpFilter? |
|
Here's a rough example (this probably isn't quite a valid config, but you get the idea): |
Title: Wrong filter_chain_matching for HTTP/2
Description:
Repro steps:
If you delete
alpn_protocolsfrom config (use http1.1) - all works goodConfig:
The text was updated successfully, but these errors were encountered: