Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

🐛 QUIC Hijack() skips the status-written check that HTTP/2 enforces

Aperta Adatta ai principianti
  • Qualcosa non va?
#1,747 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go
Ambito
backend, networking

Direzione di ricerca

Compare http2RespWriter.Hijack in connection/http2.go with httpResponseAdapter.Hijack in connection/quic_connection.go, focusing on statusWritten and connectResponseSent. Reproduce the differing behavior with the described HTTP/2 and QUIC protocols, then verify that QUIC enforces the same precondition and no longer permits raw writes before a connect response is sent.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Priority: Normal Type: Bug

Describe the bug

Hijack() has different preconditions on the two transports.

HTTP/2, http2RespWriter.Hijack in connection/http2.go, refuses when no status was written yet:

if !rp.statusWritten {
	return nil, nil, fmt.Errorf("status not yet written before attempting to hijack connection")
}

QUIC, httpResponseAdapter.Hijack in connection/quic_connection.go, has no such check. It always returns a localProxyConnection, even when connectResponseSent is still false, so the caller can write raw bytes to the stream before any connect response went out.

Same caller, different outcome depending on the transport: on HTTP/2 it gets an error, on QUIC it gets a conn.

To Reproduce

Stock cloudflared writes the status before it hijacks, so the built-in ingress path does not hit this. I hit it in a fork that replaces the OriginProxy, with code that hijacks first. net/http/httputil.ReverseProxy does exactly that on a 101: handleUpgradeResponse calls Hijack() and then writes the status line onto the conn itself.

  1. ProxyHTTP serves the request through httputil.ReverseProxy to a backend that answers 101.
  2. With --protocol http2, Hijack fails and the client gets a 502.
  3. With --protocol quic, Hijack succeeds and the caller can write to the stream before any connect response was sent.

Expected behavior

Both transports enforce the same precondition. The HTTP/2 check looks like the right one, so QUIC could refuse the same way while connectResponseSent is false.

Environment and versions

  • OS: Linux
  • Architecture: AMD64
  • Version: 2026.9.1, and the Hijack bodies are unchanged on master as of 2026.9.3

Logs and errors

HTTP/2: status not yet written before attempting to hijack connection. QUIC: no error.

Additional context

I worked around it on my side, so it does not block me. Filing it because the two transports disagree on the ResponseWriter contract, and that is easy to miss.

Lingua principale
Go
Stelle
15.8k
Fork
1.4k
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di cloudflare/cloudflared

Tutte le issue di cloudflare/cloudflared

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.