TLS configuration doesn't work with HTTP/2 #341

New issue

Closed

opened 2024-03-27 15:14:23 +00:00 by alexvanin · 0 comments

alexvanin commented

2024-03-27 15:14:23 +00:00

Owner

Expected Behavior

HTTP/2 requests are processed correctly when TLS is enabled.

Current Behavior

HTTP/2 requests are failed.

$ curl -k --aws-sigv4 aws:amz:us-east-1:iam --user <access>:<secret> \
  --head --http2-prior-knowledge -v https://<endpoint>/bucket-name

curl: (56) Remote peer returned unexpected data while we expected SETTINGS frame.  Perhaps, peer does not support HTTP/2 properly.

Meanwhile log contains reques information, but it fails to authenticate request due to missing headers

info        request start        {"request_id": "111bfe7a-cff8-4ff2-949f-9b61fc37a7ed", "host": "", "remote_host": "...", "namespace": ""}                                                                                                                          
error        policy validation failed        {"request_id": "111bfe7a-cff8-4ff2-949f-9b61fc37a7ed", "error": "nns: couldn't resolve container '*': contract invocation: invocation failed: at instruction 5394 (THROW): unhandled exception: \"invalid domain name format\""}

Possible Solution

http.Server documentation says

HTTP/2 support is only enabled if the Listener returns *tls.Conn connections and they were configured with "h2" in the TLS Config.NextProtos.

This fix works fine for HTTP/2 and HTTP/1 requests.

Steps to Reproduce (for bugs)

Configure TLS on S3 endpoint
Send curl request with --http2-prior-knowledge flag

Regression

No.

Your Environment

v0.29.0-rc.3

## Expected Behavior HTTP/2 requests are processed correctly when TLS is enabled. ## Current Behavior HTTP/2 requests are failed. ``` $ curl -k --aws-sigv4 aws:amz:us-east-1:iam --user <access>:<secret> \ --head --http2-prior-knowledge -v https://<endpoint>/bucket-name curl: (56) Remote peer returned unexpected data while we expected SETTINGS frame. Perhaps, peer does not support HTTP/2 properly. ``` Meanwhile log contains reques information, but it fails to authenticate request due to missing headers ``` info request start {"request_id": "111bfe7a-cff8-4ff2-949f-9b61fc37a7ed", "host": "", "remote_host": "...", "namespace": ""} error policy validation failed {"request_id": "111bfe7a-cff8-4ff2-949f-9b61fc37a7ed", "error": "nns: couldn't resolve container '*': contract invocation: invocation failed: at instruction 5394 (THROW): unhandled exception: \"invalid domain name format\""} ``` ## Possible Solution `http.Server` documentation [says](https://pkg.go.dev/net/http#Server.Serve) > HTTP/2 support is only enabled if the Listener returns *tls.Conn connections and they were configured with "h2" in the TLS Config.NextProtos. This fix works fine for HTTP/2 and HTTP/1 requests. ## Steps to Reproduce (for bugs) 1. Configure TLS on S3 endpoint 2. Send curl request with `--http2-prior-knowledge` flag ## Regression No. ## Your Environment v0.29.0-rc.3