nodejs/node

http2: cannot negotiate ALPN besides http/1.1

已關閉

#26,835 建立於 2019年3月21日

 (10 則留言) (0 個反應) (0 位負責人)JavaScript (35,535 個分叉)batch import
help wantedhttp2stale

倉庫指標

星標
 (117,218 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

The documentation for 'unknownProtocol' says this:

The 'unknownProtocol' event is emitted when a connecting client fails to negotiate an allowed protocol (i.e. HTTP/2 or HTTP/1.1). The event handler receives the socket for handling. If no listener is registered for this event, the connection is terminated.

The logic seems wrong though. It only passes through nothing (no protocol negotiated) or http/1.1, everything else is ignored:

https://github.com/nodejs/node/blob/11f8024d992c385d3db196ab64678311bfdabd84/lib/internal/http2/core.js#L2614-L2634

Caveat: if the check is loosened, care should be taken not to introduce an information leak.

For an attacker it should not be possible to deduce whether the server has { allowHTTP1: true } and an 'unknownProtocol' listener installed by sending messages with the ALPN proto set to http/1.1 and e.g. hax/13.37, and then comparing the responses he gets back.

貢獻者指南