Fix HTTP/2 disablement #145
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In commit 4371417 we disabled HTTP/2 by default as a remediation for CVE-2023-39325. An HTTP connection test using curl suggested at the time that the server only accepted HTTP/1.1 even though the client offered h2 and HTTP/1.1: $ curl --http2 https://localhost:8443 2>&1 | grep -i alpn * ALPN: offers h2,http/1.1 * ALPN: server accepted http/1.1 It so happens that the peers can still negotiate h2: $ openssl s_client -connect localhost:8443 -alpn "h2" [...] ALPN protocol: h2 [...] This commit fixes this issue, completely disabling HTTP/2 for good now: $ for PROTO in h3 h2 http/1.1 http/1.0; do openssl s_client -connect localhost:8443 -alpn "${PROTO}" 2>/dev/null | grep -i alpn; done No ALPN negotiated No ALPN negotiated ALPN protocol: http/1.1 No ALPN negotiate Signed-off-by: Carlos Goncalves <[email protected]>
|
@adrianchiris please take a look. |
adrianchiris
approved these changes
Nov 12, 2023
SchSeba
approved these changes
Nov 13, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In commit 4371417 we disabled HTTP/2 by default as a remediation for CVE-2023-39325. An HTTP connection test using curl suggested at the time that the server only accepted HTTP/1.1 even though the client offered h2 and HTTP/1.1:
It so happens that the peers can still negotiate h2:
This commit fixes this issue, completely disabling HTTP/2 for good now: