Re: Is the response header "Upgrade: h2" allowed when TLS is used?

[Amos Jeffries <[e-mail]>]

On 20/04/2016 4:07 a.m., Cory Benfield wrote:
> 
>> On 19 Apr 2016, at 17:05, Stefan Eissing
>> <[e-mail]> wrote:
>> 
>>> 
>>> Am 19.04.2016 um 17:29 schrieb Cory Benfield
>>> <[e-mail]>:
>>> 
>>> 
>>>> On 19 Apr 2016, at 16:16, Lucas Pardue <[e-mail]>
>>>> wrote:
>>>> 
>>>> Stefan and Daniel point out that the server uses the Upgrade
>>>> header to "advertise support" for h2. RFC 7230 Section 6.7 [5]
>>>> states that the server MAY send the Upgrade header. It seems to
>>>> me like Apache is technically compliant. On an https connection
>>>> this information shouldn't be used to perform an HTTP upgrade
>>>> to h2, since that is invalid (but a client issue not a server
>>>> one). On an http connection the info could be used by the
>>>> client e.g. they decide to negotiate an h2 session using ALPN.
>>> 
>>> I don’t think that’s really a good way to read this section of
>>> RFC 7230. The first sentence in this section is 'The "Upgrade"
>>> header field is intended to provide a simple mechanism for
>>> transitioning from HTTP/1.1 to some other protocol on the same
>>> connection.’. Note that phrase “on the same connection”. I’d
>>> argue, based on that, that the server-sent Upgrade header should
>>> only list protocols that the server is willing to upgrade to *on
>>> that connection*.
>> 
>> The mechanism is there and could be use. I do not know of a client
>> which can though...
>> 
>> And rfc 7540, ch. 3.2 says: "A server MUST ignore an "h2" token in
>> an Upgrade header field. Presence of a token with "h2" implies
>> HTTP/2 over TLS, which is instead negotiated as described in
>> Section 3.3."
>> 
>> Reading that, a server can never support this. So, we are in
>> violation...rebels almost…
> 
> Heh, I missed that. With that note, then, I’d say that Apache should
> stop putting h2 in the Upgrade header on a TLS-using connection
> *unless* it believes that connection is for a HTTP-schemed URL, when
> it should put h2c.
> 
> Cory
> 


I think you are all overlooking the basic details:

* RFC 7540 does not govern HTTP/1.1 connections, even TLS ones.

* RFC 7540 section 3.2 is about negotiating http:// URLs over non-TLS
connections.


When the client has negotiated for HTTP/1.1 over TLS to happen (aka
HTTPS). It is appropriate to Upgrade:h2. Since RFC 723x applies.


But when the client negotiates h2c to happen. It is forbidden from using
Upgrade:h2 to get to h2. Avoiding the issues Upgrade would have with
only one-way encryption for the message pair.

Note that h2c is also forbidden from being used in ALPN by section 3.3.
So there is no valid way to be using TLS for h2c in the first place.

If one is already using h2 it is pointless to Upgrade:h2.

Amos