Hello,
I have a simple go application which sends HTTP GET requests and also serves them. When I target this app to itself I see it uses HTTP/2 protocol. However when I try to use linkerd as https_proxy, the request fails on linkerd side with:
E 0803 11:52:44.591 UTC THREAD24: [S L:/172.17.0.11:4240 R:/172.17.0.6:48958] dispatcher failed
java.lang.ClassCastException: Transport.cast failed. Expected type io.netty.handler.codec.http2.Http2Frame but found io.netty.handler.codec.http.DefaultHttpRequest
So my client is indeed contacting the right port (4240), but with https_proxy it makes it http/1.1 by some reason. I don’t see any debug output of my application with GODEBUG=http2debug=2, which means it fails to establish http/2 connection from the very beginning.
It looks like a bug either in go or in linkerd. Please help.
I’m using the linkerd:latest image and go 1.8. TLS setup for linkerd is like that:
- protocol: h2
experimental: true
label: outgoing-h2
dstPrefix: /svcs
interpreter:
kind: io.l5d.namerd
dst: /$/inet/namerd.test.svc.cluster.local/4100
namespace: internal_out
transformers:
- kind: io.l5d.k8s.daemonset
namespace: test
port: incoming-h2
service: l5d
servers:
- port: 4240
ip: 0.0.0.0
tls:
certPath: /certificates/certificate.pem
keyPath: /certificates/key.pem
caCertPath: /certificates/cacert.pem
client:
tls:
commonName: l5d
trustCerts:
- /certificates/cacert.pem
clientAuth:
certPath: /certificates/certificate.pem
keyPath: /certificates/key.pem
When I try to call my app behind linkerd with curl -vv I get this:
- Trying 127.0.0.1…
- TCP_NODELAY set
- Connected to l5d (127.0.0.1) port 31412 (#0)
- ALPN, offering h2
- ALPN, offering http/1.1
- Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
- successfully set certificate verify locations:
- CAfile: …/mesh/certificates/cacertificate.pem
CApath: none - TLSv1.2 (OUT), TLS header, Certificate Status (22):
- TLSv1.2 (OUT), TLS handshake, Client hello (1):
- TLSv1.2 (IN), TLS handshake, Server hello (2):
- TLSv1.2 (IN), TLS handshake, Certificate (11):
- TLSv1.2 (IN), TLS handshake, Server key exchange (12):
- TLSv1.2 (IN), TLS handshake, Server finished (14):
- TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
- TLSv1.2 (OUT), TLS change cipher, Client hello (1):
- TLSv1.2 (OUT), TLS handshake, Finished (20):
- TLSv1.2 (IN), TLS change cipher, Client hello (1):
- TLSv1.2 (IN), TLS handshake, Finished (20):
- SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
- ALPN, server accepted to use h2
- Proxy certificate:
- subject: CN=l5d; C=US
- start date: Jul 24 15:04:33 2017 GMT
- expire date: Jun 30 15:04:33 2117 GMT
- common name: l5d (matched)
- issuer: C=FR; CN=l5d CA
- SSL certificate verify ok.
- Establish HTTP proxy tunnel to a200:443
CONNECT a200:443 HTTP/1.1
Host: a200:443
User-Agent: curl/7.54.1
Proxy-Connection: Keep-Alive
- TLSv1.2 (IN), TLS alert, Client hello (1):
- Proxy CONNECT aborted
- Connection #0 to host l5d left intact
curl: (56) Proxy CONNECT aborted
So curl manages to establish a connection with the proxy, but then it fails and I see in the linkerd logs that it complains with Transport.cast failed.