Mercurial > hg > nginx

changeset 8423:833898b35b24 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Decoupled validation of Host and :authority for HTTP/2 and HTTP/3. Previously an error was triggered for HTTP/2 when host with port was passed by client.
author Roman Arutyunyan <arut@nginx.com>
date Tue, 02 Jun 2020 15:59:14 +0300
parents 90b02ff6b003
children c70446e3d771
files src/http/ngx_http_request.c
diffstat 1 files changed, 11 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2065,10 +2065,18 @@ ngx_http_process_request_header(ngx_http
         return NGX_ERROR;
     }
 
-    if (r->http_version >= NGX_HTTP_VERSION_20) {
+    if (r->headers_in.host == NULL && r->http_version == NGX_HTTP_VERSION_20) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent HTTP/2 request without "
+                      "\":authority\" or \"Host\" header");
+        ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
+        return NGX_ERROR;
+    }
+
+    if (r->http_version == NGX_HTTP_VERSION_30) {
         if (r->headers_in.server.len == 0) {
             ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
-                          "client sent HTTP request without "
+                          "client sent HTTP/3 request without "
                           "\":authority\" or \"Host\" header");
             ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
             return NGX_ERROR;
@@ -2082,7 +2090,7 @@ ngx_http_process_request_header(ngx_http
                    != 0)
             {
                 ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
-                              "client sent HTTP request with different "
+                              "client sent HTTP/3 request with different "
                               "values of \":authority\" and \"Host\" headers");
                 ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
                 return NGX_ERROR;