From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 44544960B1 for ; Wed, 28 Feb 2024 17:21:36 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 1E09310E42 for ; Wed, 28 Feb 2024 17:21:06 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 28 Feb 2024 17:21:04 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 1FC6347B19 for ; Wed, 28 Feb 2024 17:21:04 +0100 (CET) From: Max Carrara To: pbs-devel@lists.proxmox.com Date: Wed, 28 Feb 2024 17:20:59 +0100 Message-Id: <20240228162059.426638-1-m.carrara@proxmox.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.405 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_NUMSUBJECT 0.5 Subject ends in numbers excluding current years POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [ietf.org, proxmox.com, mod.rs] Subject: [pbs-devel] [PATCH proxmox-backup] fix #5217: api: send missing header when upgrading to HTTP/2 X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Feb 2024 16:21:36 -0000 The "Connection: upgrade" header is occasionally, but not strictly, expected to be included in the response sent by the server when an upgrade to a different protocol is requested by the client. A detailed explanation follows below. Neither RFC 9110 (HTTP Semantics) [0] or RFC 7540 (HTTP/2) [1] *explicitly state* that the "Connection: upgrade" header must be included *in the server's response* when a client requests an upgrade to a different protocol. For clients, however, it is specified [2]: > A sender of Upgrade MUST also send an "Upgrade" connection option in > the Connection header field (Section 7.6.1) to inform intermediaries > not to forward this field. Yet, the example for a response provided in RFC 9110 [3] does include the header: > HTTP/1.1 101 Switching Protocols > Connection: upgrade > Upgrade: websocket > > [... data stream switches to websocket with an appropriate response > (as defined by new protocol) to the "GET /hello" request ...] The example in RFC 7540 [4] also includes the header: > HTTP/1.1 101 Switching Protocols > Connection: Upgrade > Upgrade: h2c > > [ HTTP/2 connection ... This would explain why certain reverse proxies (like Caddy) expect the header to be included in the response. Additionally, RFC 9113 [5], which obsoletes RFC 7540 [1], mentions: > The HTTP/1.1 Upgrade mechanism is deprecated and no longer specified > in this document. It was never widely deployed, with plaintext > HTTP/2 users choosing to use the prior-knowledge implementation > instead. Caddy therefore does not deviate from the HTTP/1.1 and HTTP/2 specifications; neither to we. I therefore conclude that it's best to just include the header in this specific response anyway, as no harm is done by doing so. This fixes bug #5217 [6] and allows PBS to be deployed behind Caddy. Also tested with nginx, which still works as expected. [0]: https://datatracker.ietf.org/doc/html/rfc9110 [1]: https://datatracker.ietf.org/doc/html/rfc7540 [2]: https://datatracker.ietf.org/doc/html/rfc9110#section-7.8-14 [3]: https://datatracker.ietf.org/doc/html/rfc9110#section-7.8-13 [4]: https://datatracker.ietf.org/doc/html/rfc7540#section-3.2 [5]: https://datatracker.ietf.org/doc/html/rfc9113#appendix-B-2.3 [6]: https://bugzilla.proxmox.com/show_bug.cgi?id=5217 Signed-off-by: Max Carrara --- src/api2/backup/mod.rs | 3 ++- src/api2/reader/mod.rs | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/api2/backup/mod.rs b/src/api2/backup/mod.rs index 18fad745..013043dd 100644 --- a/src/api2/backup/mod.rs +++ b/src/api2/backup/mod.rs @@ -3,7 +3,7 @@ use anyhow::{bail, format_err, Error}; use futures::*; use hex::FromHex; -use hyper::header::{HeaderValue, UPGRADE}; +use hyper::header::{HeaderValue, CONNECTION, UPGRADE}; use hyper::http::request::Parts; use hyper::{Body, Request, Response, StatusCode}; use serde::Deserialize; @@ -318,6 +318,7 @@ fn upgrade_to_backup_protocol( let response = Response::builder() .status(StatusCode::SWITCHING_PROTOCOLS) + .header(CONNECTION, HeaderValue::from_static("upgrade")) .header( UPGRADE, HeaderValue::from_static(PROXMOX_BACKUP_PROTOCOL_ID_V1!()), diff --git a/src/api2/reader/mod.rs b/src/api2/reader/mod.rs index b1a5612b..42b42838 100644 --- a/src/api2/reader/mod.rs +++ b/src/api2/reader/mod.rs @@ -3,7 +3,7 @@ use anyhow::{bail, format_err, Error}; use futures::*; use hex::FromHex; -use hyper::header::{self, HeaderValue, UPGRADE}; +use hyper::header::{self, HeaderValue, CONNECTION, UPGRADE}; use hyper::http::request::Parts; use hyper::{Body, Request, Response, StatusCode}; use serde::Deserialize; @@ -209,6 +209,7 @@ fn upgrade_to_backup_reader_protocol( let response = Response::builder() .status(StatusCode::SWITCHING_PROTOCOLS) + .header(CONNECTION, HeaderValue::from_static("upgrade")) .header( UPGRADE, HeaderValue::from_static(PROXMOX_BACKUP_READER_PROTOCOL_ID_V1!()), -- 2.39.2