tree 4c25a923c5109df039b56dba70da3b470cf70246
parent fd5a5e97575a6f6f95c01f22c942a2312f9cf24d
author Christopher Faulet <cfaulet@haproxy.com> 1591112036 +0200
committer Willy Tarreau <w@1wt.eu> 1628863427 +0200
encoding latin1

MINOR: mux-h1/proxy: Add a proxy option to disable clear h2 upgrade

By default, HAProxy is able to implicitly upgrade an H1 client connection to an
H2 connection if the first request it receives from a given HTTP connection
matches the HTTP/2 connection preface. This way, it is possible to support H1
and H2 clients on a non-SSL connections. It could be a problem if for any
reason, the H2 upgrade is not acceptable. "option disable-h2-upgrade" may now be
used to disable it, per proxy. The main puprose of this option is to let an
admin to totally disable the H2 support for security reasons. Recently, a
critical issue in the HPACK decoder was fixed, forcing everyone to upgrade their
HAProxy version to fix the bug. It is possible to disable H2 for SSL
connections, but not on clear ones. This option would have been a viable
workaround.

(cherry picked from commit 89aed32bfffb5f6f51bdab3e7bd5efc44a9927a1)
Signed-off-by: Willy Tarreau <w@1wt.eu>