HTTP/2 (h2c) upgrade in clear-text problem

[tk-xiong]

I did this

I use curl and Golang HttpClient to call my service.
Golang's HttpClient is working fine.

curl:
This does not work if --http2 is used.
This works if use --http2-prior-knowledge.

I expected the following

both use --http2 and --http2-prior-knowledge working fine.

curl/libcurl version

Windows:
curl 7.78.0 (x86_64-pc-win32) libcurl/7.78.0 OpenSSL/1.1.1l (Schannel) zlib/1.2.11 brotli/1.0.9 zstd/1.5.0 libidn2/2.3.2 libssh2/1.9.0 nghttp2/1.44.0 libgsasl/1.10.0
Release-Date: 2021-07-21
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli gsasl HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz MultiSSL NTLM SPNEGO SSL SSPI TLS-SRP UnixSockets zstd

Linux:
curl 7.78.0 (x86_64-pc-linux-gnu) libcurl/7.78.0 zlib/1.2.7 nghttp2/1.44.0
Release-Date: 2021-07-21
Protocols: dict file ftp gopher http imap mqtt pop3 rtsp smtp telnet tftp
Features: alt-svc AsynchDNS HTTP2 IPv6 Largefile libz UnixSockets

[curl -V output]

*   Trying 192.168.0.11:10001...
* Connected to 192.168.0.11 (192.168.0.11) port 10001 (#0)
> Get /hello/ HTTP/1.1
> Host: 192.168.0.11:10001
> User-Agent: curl/7.78.0
> Accept: */*
> Connection: Upgrade, HTTP2-Settings
> Upgrade: h2c
> HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 101 Switching Protocols
HTTP/1.1 101 Switching Protocols
< Connection: Upgrade
Connection: Upgrade
< Upgrade: h2c
Upgrade: h2c
* Received 101
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0

operating system

Linux 3.10.0-1160.15.2.el7.x86_64 #1 SMP Wed Feb 3 15:06:38 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

[tk-xiong]

Upon receiving the 101 response, the client MUST send a connection
preface (Section 3.5), which includes a SETTINGS frame.

[tk-xiong]

Use Wireshark，i can't find connection preface

[tk-xiong]

and read golang src, golang.org/x/net/http2/h2c/h2c.go line 192.

	// A conforming client will now send an H2 client preface which need to drain
	// since we already sent this.
	if err := drainClientPreface(rw); err != nil {
		return nil, err
	}

[bagder]

$ curl --http2 localhost -v
*   Trying ::1:80...
* Connected to localhost (::1) port 80 (#0)
> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/7.74.0
> Accept: */*
> Connection: Upgrade, HTTP2-Settings
> Upgrade: h2c
> HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 101 Switching Protocols
< Upgrade: h2c
< Connection: Upgrade
* Received 101
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200 
< date: Thu, 01 Jan 1970 00:00:00 GMT
< server: Apache/2.4.48 (Debian)
< last-modified: Sat, 31 May 2014 22:05:33 GMT
< etag: W/"d-4fab95c704b1c"
< accept-ranges: bytes
< content-length: 13
< content-type: text/html
< 
inken tinken
* Connection #0 to host localhost left intact

[tk-xiong]

Can you use some tools to capture the package into file and show it to me.

i use wireshark on windows and not find client send this -> " PRI *HTTP/2.0\r\n\r\nSM\r\n\r\n"

maybe nghttp2 is not Compatible with golang server.

[tk-xiong]

Please teach me whether the client should send a Connection preface message after receiving the Upgrade message.

i think client need, and read golang server, it also drainClientPreface.

but i use wireshark, i can't find package Client Preface(this -> " PRI *HTTP/2.0\r\n\r\nSM\r\n\r\n").

[tk-xiong]

Yes! I Found!
If annotation this code， it run：

golang.org/x/net/http2/h2c/h2c.go line 192 to line 196.

// A conforming client will now send an H2 client preface which need to drain
// since we already sent this.
if err := drainClientPreface(rw); err != nil {
return nil, err
}

[tk-xiong]

But I don't think it was Golang's fault.

In RFC7540 (Section 3.2):
Upon receiving the 101 response, the client MUST send a connection
preface (Section 3.5), which includes a SETTINGS frame.

I think Curl or NGHTTP2 does not follow the RFC specification.

[bagder]

I've failed to reproduce this problem myself, so can I ask you to provide us with more details on how to go ahead and repeat this. Preferably with a command line or a stand-alone program we can run from our ends against a public URL to trigger the problem?

[tk-xiong]

I Send e-mail to you. Please do not disclose this IP address, thank you.

[bagder]

You then assume that nobody else than me wants and can debug or help out here?

[tk-xiong]

I'm Sorry，My server is not secure, so I dare not expose the public network.
please try this url:
curl -v --http2 http://121.37.5.232:10000/hello/

[bagder]

Reverting 455a63c fixes this problem for me. Presumably it would however reopen #7036...

@starrify, any ideas?

[tk-xiong]

I try revert 455a63c
Maybe I think too little, I can't understand #7036

$ ./curl -vI --http2 http://192.168.0.11:10001/hello/
*   Trying 192.168.0.11:10001...
* Connected to 192.168.0.11 (192.168.0.11) port 10001 (#0)
> HEAD /hello/ HTTP/1.1
> Host: 192.168.0.11:10001
> User-Agent: curl/7.78.0
> Accept: */*
> Connection: Upgrade, HTTP2-Settings
> Upgrade: h2c
> HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 101 Switching Protocols
HTTP/1.1 101 Switching Protocols
< Connection: Upgrade
Connection: Upgrade
< Upgrade: h2c
Upgrade: h2c
* Received 101
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0

* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
* HTTP/2 stream 0 was not closed cleanly: PROTOCOL_ERROR (err 1)
* stopped the pause stream!
* Connection #0 to host 192.168.0.11 left intact
curl: (92) HTTP/2 stream 0 was not closed cleanly: PROTOCOL_ERROR (err 1)