frang: http_trailer_split_allowed does not work correctly for http2

[RomanBelozerov]

Tempesta - d665692

For frang_limits:

http_trailer_split_allowed false;
http_strict_host_checking false;

I send request with HEADERS frame:

(":authority", "example.com"),
(":path", "/"),
(":scheme", "https"),
(":method", "POST"),
("trailer", "x-my-hdr"),
("x-my-hdr", "value")

and trailer:

# example with using DeproxyClientH2
tf = HeadersFrame(
    stream_id=client.stream_id,
    data=client.h2_connection.encoder.encode([("x-my-hdr", "value")]),
    flags=["END_STREAM"],
)
cf = ContinuationFrame(
    stream_id=client.stream_id,
    data=client.h2_connection.encoder.encode([("x-my-hdr", "value")]),
    flags=["END_HEADERS"],
)
client.send_bytes(data=tf.serialize() + cf.serialize(), expect_response=True)

AR: Tempesta returns a 400 response (if trailer contains CONTINUATION frame) or a 200 response (if trailer contains only HEADERS frame)
ER: Tempesta returns a 403 response and warning in dmesg

Depends on #1881

Testing

t_frang.test_http_trailer_split_allowed.TestFrangHttpTrailerSplitAllowedH2

[krizhanovsky]

Please also add to the wiki the reason why the option is required, preferably with an attack example. From the brief description on https://tempesta-tech.com/knowledge-base/HTTP-security/ it's unclear why the option is required.