v0.32.4

src/upstream.rs

@@ -196,6 +196,9 @@ pub struct TimedConnector {
     inner: InnerConnector,
     policy: AddressPolicy,
     timeout: Duration,
+    /// The configured backend/TLS identity, never the forwarded HTTP Host.
+    /// The resolver separately pins DNS to the configured backend URL.
+    destination: Uri,
 }
 impl Service<Uri> for TimedConnector {
     type Response = <InnerConnector as Service<Uri>>::Response;
@@ -205,7 +208,10 @@ impl Service<Uri> for TimedConnector {
     fn poll_ready(&mut self, cx: &mut TaskContext<'_>) -> Poll<std::result::Result<(), BoxError>> {
         self.inner.poll_ready(cx).map_err(Into::into)
     }
-    fn call(&mut self, uri: Uri) -> Self::Future {
+    fn call(&mut self, _request_uri: Uri) -> Self::Future {
+        // A preserved HTTP/2 :authority can be a public vhost name. Never
+        // resolve or dial it: all sockets must target the configured origin.
+        let uri = self.destination.clone();
         if let Some(ip) = uri.host().and_then(|host| {
             host.trim_start_matches('[')
                 .trim_end_matches(']')