envoyproxy/envoy

Unify header validation across all codecs (H1, H2 and H3)

Open

#10,646 opened on Apr 3, 2020

View on GitHub
 (27 comments) (0 reactions) (1 assignee)C++ (5,373 forks)batch import
area/httparea/quicarea/securityhelp wantedtech debt

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Presently H1 and H2 codecs use header validation which is a mix of the codec specific and some checks from nghttp2 library on top of it. This leads to inconsistencies in header validation across codecs and makes header validation hard to audit.

For more information see design specifications.

This change will include:

  1. Adding header validation according to the HTTP spec.
  2. Converting codecs to use unified header validation facility. This will only be applied for Balsa and oghttp2 codecs.

Deployment plan:

  1. Add opt-in for universal header validation for Balsa and oghttp2 in compatibility mode (fully compatible with the http-parser and nghttp2)
  2. After bake-in interval (i.e. one full release cycle) change the feature to opt-out
  3. Turn-off compatibility features to bring HTTP validation to RFC compliance one by one.

Contributor guide

Research direction
Examine the design document and identify the specific inconsistencies in header validation across H1, H2, and H3 codecs. Then, implement the unified validation facility and migrate Balsa and oghttp2 codecs as outlined.
Tech stack
cpp
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C++HTTPGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30