sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-02 03:29:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[proxy] Apply the upstream HTTP version before cloning transports (#7806)

Browse Source 
createClientEntry and NewMultiTransport clone the secure transport into
its insecure variant before newUpstreamTransport applies the configured
HTTP version. http.Transport.Clone runs the source's one-time protocol
setup, and at that point ForceAttemptHTTP2 is still false while a custom
DialContext is set, so net/http disables HTTP/2 on the source for good.
Setting ForceAttemptHTTP2 afterwards has no effect.

As a result every TLS-verified upstream has been served over HTTP/1.1
since the upstream HTTP version became configurable, whatever
NB_PROXY_UPSTREAM_HTTP_VERSION says, while skip-TLS-verify upstreams
kept HTTP/2. gRPC upstreams break outright: unary calls get a 502 and
streaming calls hang until the client gives up.

Apply the version to the base transport before cloning it, and add a
test that the direct and insecure transports both offer h2.
This commit is contained in:
Brad Ison
2026-09-30 11:05:45 +02:00
committed by GitHub
parent 8edc120370
commit 8ab34fcf8b
3 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/internal/roundtrip/netbird.go
+3
View File
@@ -425,6 +425,9 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
ReadBufferSize: n.transportCfg.readBufferSize,
DisableCompression: n.transportCfg.disableCompression,
}
// Clone runs the transport's one-time protocol setup, so the HTTP
// version must be applied first or the source loses HTTP/2 for good.
applyUpstreamHTTPVersion(transport, n.transportCfg.upstreamHTTPVersion)
insecureTransport := transport.Clone()
insecureTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec