fix(h2): downgrade h2 requests to origin-form + Host for h1 backends

An h2 request carries scheme+authority in its URI and `:authority` (not
`Host`); forwarded as-is, hyper's h1 client emits an absolute-form target that
strict backends (e.g. bun) reject with 400. Rewrite to origin-form path +
inject Host before the backend round-trip. The integration test now asserts
the backend sees a Host header so this can't regress.

Verified live: app/console serve 200/303 over h2, passthrough unchanged.

Author: max-lt

Cargo.lock

@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.85"

Cargo.toml

@@ -81,9 +81,8 @@ pub(crate) async fn serve_h2<S>(
     S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
 {
     let io = TokioIo::new(tls_stream);
-    let service = service_fn(move |req| {
-        proxy(req, routes.clone(), sni.clone(), peer, error_502.clone())
-    });
+    let service =
+        service_fn(move |req| proxy(req, routes.clone(), sni.clone(), peer, error_502.clone()));
     let mut builder = hyper::server::conn::http2::Builder::new(TokioExecutor::new());
     builder
         .timer(TokioTimer::new()) // required by keep-alive below
@@ -181,8 +180,10 @@ async fn h1_roundtrip<S>(
 where
     S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
 {
+    let req = downgrade_to_h1(req, sni);
     let handshake = hyper::client::conn::http1::handshake(TokioIo::new(io));
-    let (mut sender, conn) = match tokio::time::timeout(BACKEND_HANDSHAKE_TIMEOUT, handshake).await {
+    let (mut sender, conn) = match tokio::time::timeout(BACKEND_HANDSHAKE_TIMEOUT, handshake).await
+    {
         Ok(Ok(pair)) => pair,
         Ok(Err(e)) => {
             tracing::warn!(peer = %peer, sni = %sni, error = %e, "backend h1 handshake failed");
@@ -208,6 +209,38 @@ where
     }
 }
 
+/// Rewrite an h2 request into the shape an h1 backend expects: an origin-form
+/// request-target (just path-and-query) plus a `Host` header. An h2 request
+/// carries scheme+authority in its URI and `:authority` (not `Host`), which a
+/// strict h1 server rejects as an absolute-form target (→ 400). We take the
+/// authority for `Host` before stripping it from the URI; SNI is the fallback.
+fn downgrade_to_h1(mut req: Request<Incoming>, sni: &str) -> Request<Incoming> {
+    let authority = req
+        .uri()
+        .authority()
+        .map(|a| a.as_str().to_string())
+        .or_else(|| {
+            req.headers()
+                .get(HOST)
+                .and_then(|h| h.to_str().ok())
+                .map(str::to_string)
+        })
+        .unwrap_or_else(|| sni.to_string());
+
+    let origin = req
+        .uri()
+        .path_and_query()
+        .map(|pq| pq.as_str())
+        .unwrap_or("/");
+    if let Ok(uri) = origin.parse::<hyper::Uri>() {
+        *req.uri_mut() = uri;
+    }
+    if let Ok(host) = authority.parse() {
+        req.headers_mut().insert(HOST, host);
+    }
+    req
+}
+
 /// Translate a WebSocket-over-h2 (Extended CONNECT) stream into an HTTP/1.1
 /// `Upgrade: websocket` handshake to the backend, then splice the two byte
 /// streams. Returns the `200` that completes the h2 side (browsers expect 200,
@@ -266,7 +299,8 @@ where
     };
 
     let handshake = hyper::client::conn::http1::handshake(TokioIo::new(backend));
-    let (mut sender, conn) = match tokio::time::timeout(BACKEND_HANDSHAKE_TIMEOUT, handshake).await {
+    let (mut sender, conn) = match tokio::time::timeout(BACKEND_HANDSHAKE_TIMEOUT, handshake).await
+    {
         Ok(Ok(pair)) => pair,
         Ok(Err(e)) => {
             tracing::warn!(peer = %peer, sni = %sni, error = %e, "backend ws handshake failed");
@@ -330,7 +364,9 @@ where
 
 /// An empty boxed body for the WebSocket `200` response.
 fn empty_body() -> ProxyBody {
-    Empty::<Bytes>::new().map_err(|never| match never {}).boxed()
+    Empty::<Bytes>::new()
+        .map_err(|never| match never {})
+        .boxed()
 }
 
 /// A 502 response carrying the (branded) error page, mirroring the byte-pipe's

crates/tuyau-server/src/h2proxy.rs

@@ -307,7 +307,14 @@ async fn handle_public(
         // and reverse-proxy each request to the backend as h1.
         if alpn == Some(b"h2".as_slice()) {
             tracing::info!(peer = %peer, sni = %sni, "public connection routed (terminated, h2→h1)");
-            crate::h2proxy::serve_h2(tls_stream, routes.clone(), sni.clone(), peer, error_502.clone()).await;
+            crate::h2proxy::serve_h2(
+                tls_stream,
+                routes.clone(),
+                sni.clone(),
+                peer,
+                error_502.clone(),
+            )
+            .await;
             return Ok(());
         }
 
@@ -374,7 +381,11 @@ where
 }
 
 /// Dial a local upstream over TCP, with a timeout. `None` on failure (logged).
-pub(crate) async fn connect_tcp(addr: SocketAddr, sni: &str, peer: SocketAddr) -> Option<TcpStream> {
+pub(crate) async fn connect_tcp(
+    addr: SocketAddr,
+    sni: &str,
+    peer: SocketAddr,
+) -> Option<TcpStream> {
     match tokio::time::timeout(UPSTREAM_CONNECT_TIMEOUT, TcpStream::connect(addr)).await {
         Ok(Ok(s)) => Some(s),
         Ok(Err(e)) => {

crates/tuyau-server/src/public.rs

@@ -28,7 +28,20 @@ async fn spawn_h1_backend() -> std::net::SocketAddr {
             };
             tokio::spawn(async move {
                 let service = service_fn(|req: Request<hyper::body::Incoming>| async move {
-                    let body = format!("hello from backend: {} {}", req.method(), req.uri().path());
+                    // Echo method, path and Host so the test can assert the h2
+                    // request was downgraded to a well-formed h1 one (origin-form
+                    // target + Host header, not absolute-form / :authority).
+                    let host = req
+                        .headers()
+                        .get(hyper::header::HOST)
+                        .and_then(|h| h.to_str().ok())
+                        .unwrap_or("<none>");
+                    let body = format!(
+                        "hello from backend: {} {} host={}",
+                        req.method(),
+                        req.uri().path(),
+                        host
+                    );
                     Ok::<_, hyper::Error>(Response::new(body))
                 });
                 let _ = hyper::server::conn::http1::Builder::new()
@@ -184,12 +197,10 @@ async fn h2_browser_reaches_h1_backend() {
     );
 
     // Speak HTTP/2 to tuyau.
-    let (mut sender, conn) = hyper::client::conn::http2::handshake(
-        TokioExecutor::new(),
-        TokioIo::new(tls_stream),
-    )
-    .await
-    .unwrap();
+    let (mut sender, conn) =
+        hyper::client::conn::http2::handshake(TokioExecutor::new(), TokioIo::new(tls_stream))
+            .await
+            .unwrap();
     tokio::spawn(async move {
         let _ = conn.await;
     });
@@ -203,16 +214,18 @@ async fn h2_browser_reaches_h1_backend() {
     let body = resp.into_body().collect().await.unwrap().to_bytes();
     let text = String::from_utf8_lossy(&body);
     assert_eq!(
-        text, "hello from backend: GET /hello",
-        "backend saw the request as h1 GET, proxied from the h2 client"
+        text, "hello from backend: GET /hello host=front.example.com",
+        "backend saw a well-formed h1 GET (origin-form + Host), proxied from h2"
     );
 
     server.shutdown().await;
 }
 
 /// Start a terminated public listener whose only route is a local upstream to
 /// `backend`. Returns the running server and its public address.
-async fn start_terminated_to(backend: std::net::SocketAddr) -> (TunnelServer, std::net::SocketAddr) {
+async fn start_terminated_to(
+    backend: std::net::SocketAddr,
+) -> (TunnelServer, std::net::SocketAddr) {
     let dir = tempfile::TempDir::new().unwrap();
     let cfg = ServerConfig {
         listen_addr: "127.0.0.1:0".parse().unwrap(),
@@ -276,7 +289,8 @@ async fn websocket_over_h2_bridges_to_h1_upgrade() {
         .uri("https://front.example.com/ws")
         .body(Empty::<Bytes>::new())
         .unwrap();
-    req.extensions_mut().insert(Protocol::from_static("websocket"));
+    req.extensions_mut()
+        .insert(Protocol::from_static("websocket"));
 
     let resp = sender.send_request(req).await.unwrap();
     assert_eq!(resp.status(), 200, "RFC 8441 success is 200, not 101");