Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTTP/1.1 Host header replaced when dealing with SRV records in client #5525

Closed
uepoch opened this issue Oct 16, 2018 · 0 comments · Fixed by #8520
Closed

HTTP/1.1 Host header replaced when dealing with SRV records in client #5525

uepoch opened this issue Oct 16, 2018 · 0 comments · Fixed by #8520
Assignees
Labels
bug Used to indicate a potential bug core/api

Comments

@uepoch
Copy link
Contributor

uepoch commented Oct 16, 2018

Describe the bug
HTTP/1.1 RFC2616 specify that Host header should be set as the original input from the user so that virtual servers can be handled
When the hostname you pass in api's Client (affect CLI and golang projects) responds to SRV records, it will replace the Host header with any SRV record that is answered.
Code here

To Reproduce
Define a DNS setup with a name responding on SRV record (like what you could have with consul if you registered it as a service)

vault.consul.example.com 10 IN SRV 1 1 80 loadbalancer213.example.com

Have a loadbalancer configuration matching on Host header to load balance requests
Use the vault CLI to target it

Expected behavior
The Host header of the HTTP request should be vault.consul.example.com, as specified by the URL typed by the user
This would allow loadbalancers behind SRV records to be able to route properly requests to their backend

Environment:

  • Vault Server Version (retrieve with vault status): Any
  • Vault CLI Version (retrieve with vault version): Since 0.8.0
  • Server Operating System/Architecture: Any

Additional context

  • I would be happy to provide more precise traces in PM, to avoid disclosing our internal DNS infra
  • SRV records are sometimes automatically created when dealing with dynamic (mesos,...) infrastructures, consul actually respond A,AAAA,SRV records for each service located inside.
  • afaik, HTTP RFC does not specify how to handle SRV records
  • Most clients honor this behavior when dealing with CNAME records

What do you think ?

@catsby catsby added bug Used to indicate a potential bug core/api labels Nov 12, 2019
spangenberg added a commit to spangenberg/vault that referenced this issue Feb 3, 2020
Fixes hashicorp#5525

SRV lookups override the Host header against the RFC Draft.
@spangenberg spangenberg self-assigned this Feb 10, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Used to indicate a potential bug core/api
Projects
None yet
3 participants