HTTP2 push does not work due to incorrect scheme in proxy_protocol mode

[Roel van Duijnhoven]

I use the proxy_protocol because I send the tcp traffic via HaProxy to nginX. However HTTP2 push does not work with this set-up.

When I debug the difference between non-proxy and proxy mode using nghttp I get the following difference:

The resource *is* pushed, but has the wrong scheme.

Sample of configuration used:

    http {
        # This is the one I would like to use
        server {
            listen       8002 http2 proxy_protocol;

            server_name  _;
            root         /usr/share/nginx/html;

            location / {
                http2_push /image.jpg;
            }
        }

        # This one can be accessed directly; and *does* work
        server {
            listen       8004 http2 ssl;

            ssl_certificate certificate.pem;
            ssl_certificate_key private.key;

            server_name  _;
            root         /usr/share/nginx/html;

            location / {
                http2_push /image.jpg;
            }
        }
    }

I could not find a way to overwrite the scheme in nginX in a way that would solve this issue.

I first placed this issue on StackOverflow. That can be found here: ​https://stackoverflow.com/questions/50022621/using-http2-push-with-nginx-in-conjunction-with-haproxy-does-not-work

Thanks!

[Ruslan Ermilov]

Please try the attached patch.

[Roel van Duijnhoven]

I can verify that this fixes the problem! Thank you very much :).

---

On a related note: there is also the problem that the $scheme variable is incorrect when using proxy_protocol. So I quickly verified if this patch also mitigates that situation: that is however not the case.

I tested that by adding:

add_header X-scheme $scheme;

The $scheme variable is http; although the incoming request is definitely https.

---

Ps: I had some trouble getting a clean Vagrant CentOs/7 working using ​https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source. Would it be worth creating an issue for this as well (with steps taken to make it work)? But finally got it working :).

---

Thanks again for your work!

[Roel van Duijnhoven]

Patch that sets https scheme correctly when using proxy protocol

[Roel van Duijnhoven]

An update.

I did an attempt to update the source code myself. And after compiling found it to work! It now correctly reports the HTTPS scheme only when the actual request has that set as its scheme.

You can find the patch attached!

Note: I am a mere n00b to the nginx code-base. So please review before merging.

[Ruslan Ermilov]

See also #711.

[Ruslan Ermilov]

Replying to roelvanduijnhoven@…:

An update.

I did an attempt to update the source code myself. And after compiling found it to work! It now correctly reports the HTTPS scheme only when the actual request has that set as its scheme.

You can find the patch attached!

Note: I am a mere n00b to the nginx code-base. So please review before merging.

While in HTTP/2 the scheme is required, in HTTP/1 it is generally not present (​https://tools.ietf.org/html/rfc7230#section-5.3.1) so your patch won't work for HTTP/1.

The original request scheme can be obtained either from the X-Forwarded-Proto header, or derived from the PROXY protocol v2 PP2_TYPE_SSL TLV, but nginx currently lacks support of the latter.

We've also discussed about adding support for XFP and PP2_TYPE_SSL to the ​realip module with the effect that the $scheme and $https variables will match the original request.

[Roel van Duijnhoven]

.. duplicate content

[Roel van Duijnhoven]

@ru It is hard for me to contribute in this discussion in a meaningful way. But I think the use case I describe is not _that_ special. I'll drop some thoughts in the other issue.
Regarding the original issue: you can fix that issue with the patch you gave earlier. I verified that it worked!

Replying to ru:

Replying to roelvanduijnhoven@…:

An update.

I did an attempt to update the source code myself. And after compiling found it to work! It now correctly reports the HTTPS scheme only when the actual request has that set as its scheme.

You can find the patch attached!

Note: I am a mere n00b to the nginx code-base. So please review before merging.

While in HTTP/2 the scheme is required, in HTTP/1 it is generally not present (​https://tools.ietf.org/html/rfc7230#section-5.3.1) so your patch won't work for HTTP/1.

The original request scheme can be obtained either from the X-Forwarded-Proto header, or derived from the PROXY protocol v2 PP2_TYPE_SSL TLV, but nginx currently lacks support of the latter.

We've also discussed about adding support for XFP and PP2_TYPE_SSL to the ​realip module with the effect that the $scheme and $https variables will match the original request.

[Ruslan Ermilov <ru@…>]

In 7296:8e6bb4e6045f/nginx:

HTTP/2: use scheme from original request for pushes (closes #1549).

Instead of the connection scheme, use scheme from the original request.
This fixes pushes when SSL is terminated by a proxy server in front of
nginx.