ironic-inspector/releasenotes/notes/handle_eventlet_wsgi_evil_override-3905c6eef0ad7fa3.yaml
Julia Kreger 55e47c630b Return a content-length on HTTP204 to prevent client failures
It turns out that eventlet has been injecting a
``Transfer-Encoding`` header as of recent into WSGI application
response headers. The result of this ultimately depends on how
the HTTP client which is passing the request to the server is
written to handle data.

Apache, for example, will return that an invalid response was
received. In part because it sees the request end, with an HTTP
204 response code, but also an encoding indicating there is
a multipart body encoding inbound. Which is confusing.

Other C based HTTP clients can have any number of reactions up to
and including disconnecting sessions. Curl, depending on the
headers present either returns success but notes body weirdness
or actually returns return code 18.

Python-Requests kind of has it a little worse, and we see this
with clients. With it, it tries to prepare a respones content
body based upon the presence of the header indicating there is
a body. But it blows up thinking there is more data to read on
the socket when there is not more data to read.

Regardless, all of this is an RFC7230 violation.

Neither Content-Length nor Transfer-Encoding should be on an HTTP
204 response. However, Content-Length is the lesser evil, and we
have a similar endpoing in Ironic which *does* explicitly get
returned with a zero length content-length, and does not
demonstrate such issues.

As such, in the interest of the lesser evils until Eventlet's evil
ways of header injection are remedied, we're explicitly going to
force a Content-Length header to be sent indicating a zero length
response.

For more information, please see: https://github.com/eventlet/eventlet/issues/746

Change-Id: I014cc65c79222f4d4d7c2b6ff11a76e56659340c
2022-01-13 11:55:42 -08:00

20 lines
1003 B
YAML

---
issues:
- |
The response headers for empty body HTTP 204 replies, at present, violate
RFC7230. This was not intentional, but underlying libraries also
make inappropriate changes to the headers, which can cause clients to
experience odd failures. This is anticipated to be corrected once an
underlying issue in
`eventlet <https://github.com/eventlet/eventlet/issues/746>`_ is resolved.
fixes:
- |
Fixes HTTP responses so the Eventlet library, which is used to support
the operation of the WSGI application, does not incorrectly inject
a ``Transfer-Encoding`` header into the HTTP response, even on HTTP 204
replies, which is a violation of RFC7230. This header ultimately can
cause varying client reactions which are not expected and can raise
exceptions. For now, this has been remedied via an explicit return of
a ``Content-Length`` header, which is also an RFC7230 violation, but
it appears to be the lesser of known evils at this time.