Envoy always got remote_reset on HTTP/2 with Microsoft-IIS/10.0 about envoy HOT 4 OPEN

cc @alyssawilk @RyanTheOptimist

from envoy.

if Envoy is getting a remote reset, IIS is resetting and you need to look at logs there. The most common failure mode here AFIK is having scheme not match crypto (e.g. https scheme over cleartext.

from envoy.

But when I try to curl to IIS everything look good, even when open on Chrome, Safari browser good as well.

I don't know why that happen and I request partner to turn HTTP2 off.

from envoy.

Tangentially related but I'm currently having issues where when Envoy upgrades plaintext connections to https. Envoy seems to use the downstream :scheme/xff/downstream connection to infer the scheme. This can cause problems with HTTP2 servers that validate whether the scheme pseudo-header matches the transport layer protocol (example).

Stuff I haven't verified but looked into while digging (still personally looking for ways to address this in the VHDS service in a per-route basis):

• If your operation applies globally to the HttpConnectionManager, the scheme header transformation configuration might work?
• Otherwise, header mutation rules enabling allow_all_routing might work? Seems like this is only for the ExternalProcessor filter

from envoy.