Fix HTTP/2 server side switching.

arangodb · jsteemann · Mar 20, 2020 · Mar 3, 2020 · Mar 4, 2020 · Mar 4, 2020
commit b56ee2b692967a47a7b099a228029981684e41de
diff --git a/arangod/GeneralServer/SslServerFeature.cpp b/arangod/GeneralServer/SslServerFeature.cpp
@@ -74,7 +74,7 @@ SslServerFeature::SslServerFeature(application_features::ApplicationServer& serv
       _sslOptions(asio_ns::ssl::context::default_workarounds |
                   asio_ns::ssl::context::single_dh_use),
       _ecdhCurve("prime256v1"),
-      _allowHttpProtocolNegotiation(true) {
+      _preferHttp11InAlpn(false) {
   setOptional(true);
   startsAfter<application_features::AqlFeaturePhase>();
 }
@@ -118,10 +118,9 @@ void SslServerFeature::collectOptions(std::shared_ptr<ProgramOptions> options) {
       "SSL ECDH Curve, see the output of \"openssl ecparam -list_curves\"",
       new StringParameter(&_ecdhCurve));
 
-  options->addOption(
-      "--ssl.allow-http-protocol-negotiation",
-      "Allows that the TLS handshake negotiates the HTTP protocol version",
-      new BooleanParameter(&_allowHttpProtocolNegotiation));
+  options->addOption("--ssl.prefer-http1-in-alpn",
+                     "Allows to let the server prefer HTTP/1.1 over HTTP/2 in ALPN protocol negotiations",
+                     new BooleanParameter(&_preferHttp11InAlpn));
 }
 
 void SslServerFeature::validateOptions(std::shared_ptr<ProgramOptions> options) {
@@ -207,12 +206,38 @@ class BIOGuard {
 };
 }  // namespace
 
+static inline bool searchForProtocol(const unsigned char** out, unsigned char* outlen,
+                                     const unsigned char* in, unsigned int inlen,
+                                     const char* proto) {
+  size_t len = strlen(proto);
+  size_t i = 0;
+  while (i + len <= inlen) {
+    if (memcmp(in + i, proto, len) == 0) {
+      *out = (const unsigned char *)(in + i + 1);
+      *outlen = proto[0];
+      return true;
+    }
+    i += in[i] + 1;
+  }
+  return false;
+}
+
 static int alpn_select_proto_cb(SSL *ssl, const unsigned char **out,
                                 unsigned char *outlen, const unsigned char *in,
                                 unsigned int inlen, void *arg) {
-  int rv = nghttp2_select_next_protocol((unsigned char **)out, outlen, in, inlen);
+  int rv = 0;
+  bool const* preferHttp11InAlpn = (bool*) arg;
+  if (*preferHttp11InAlpn) {
+    if (!searchForProtocol(out, outlen, in, inlen, "\x8http/1.1")) {
+      if (!searchForProtocol(out, outlen, in, inlen, "\x2h2")) {
+        rv = -1;
+      }
+    }
+  } else {
+    rv = nghttp2_select_next_protocol((unsigned char **)out, outlen, in, inlen);
+  }
 
-  if (rv != 1) {
+  if (rv < 0) {
     return SSL_TLSEXT_ERR_NOACK;
   }
 
@@ -350,9 +375,7 @@ asio_ns::ssl::context SslServerFeature::createSslContextInternal(
 
     sslContext.set_verify_mode(SSL_VERIFY_NONE);
 
-    if (_allowHttpProtocolNegotiation) {
-      SSL_CTX_set_alpn_select_cb(sslContext.native_handle(), alpn_select_proto_cb, NULL);
-    }
+    SSL_CTX_set_alpn_select_cb(sslContext.native_handle(), alpn_select_proto_cb, (void*) (&_preferHttp11InAlpn));
 
     return sslContext;
   } catch (std::exception const& ex) {

diff --git a/arangod/GeneralServer/SslServerFeature.h b/arangod/GeneralServer/SslServerFeature.h
@@ -90,7 +90,7 @@ class SslServerFeature : public application_features::ApplicationFeature {
   uint64_t _sslProtocol;
   uint64_t _sslOptions;
   std::string _ecdhCurve;
-  bool _allowHttpProtocolNegotiation;
+  bool _preferHttp11InAlpn;
 
  private:
   asio_ns::ssl::context createSslContextInternal(std::string keyfileName,