Ambiguous HTTP version parsing

[zzzevaka]

Hello! The HTTP protocol version can be read differently by a frontend server (e.g. nginx) and gunicorn

Example of a raw HTTP request:

import socket
target_host = "127.0.0.1"
target_port = 88
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_host, target_port))
req = f'GET /\x0bHTTP/2.0 HTTP/1.1\r\nHost: {target_host}\r\n\r\n'.encode()
response = s.recv(32)
print(response)

Output: b'HTTP/2.0 200 OK\r\nServer: gunicor'
Nginx access log: 172.20.0.1 - - [27/Feb/2021:11:10:35 +0000] "GET /\x0BHTTP/2.0 HTTP/1.1" 009 1520 "-" "-" "-"

A simplified version of parsing of the request (full version here):

from gunicorn.http.message import VERSION_RE
from gunicorn._compat import bytes_to_str
from gunicorn.http.errors import InvalidHTTPVersion

line_bytes = b'GET /\x0bHTTP/2.0 HTTP/1.1'
bits = [bytes_to_str(bit) for bit in line_bytes.split(None, 2)] # [['GET', '/', 'HTTP/2.0 HTTP/1.1']]
match = VERSION_RE.match(bits[2])
if match is None:
    raise InvalidHTTPVersion(bits[2])
version = (int(match.group(1)), int(match.group(2))) # (2, 0)

I guess gunicorn should raise the error because the version of HTTP protocol is invalid.
I suggest to change VERSION_RE to r"^HTTP/(\d+)\.(\d+)$"