Request with HttpVersion > 3 and RequestVersionOrHigher policy sent as H/3 request

[greenEkatherine]

Description

Request message with HttpVersion higher than currently supported 3.0 is not checked on the HttpVersionPolicy. In case when it is set to RequestVersionOrHigher we get unexpected behavior -- request is treated as H/3 request.

Reproduction Steps

var requestMessage = new HttpRequestMessage(HttpMethod.Get, uri)
{
    Version = new Version(4, 0),
    VersionPolicy = HttpVersionPolicy.RequestVersionOrHigher
};

Expected behavior

Throw request version cannot establish

Actual behavior

No exception from HttpConnection pool and sent via H/3 connection

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Request message with HttpVersion higher than currently supported 3.0 is not checked on the HttpVersionPolicy. In case when it is set to RequestVersionOrHigher we get unexpected behavior -- request is treated as H/3 request.

Reproduction Steps

var requestMessage = new HttpRequestMessage(HttpMethod.Get, uri)
{
Version = new Version(4, 0),
VersionPolicy = HttpVersionPolicy.RequestVersionOrHigher
};

Expected behavior

Throw request version cannot establish

Actual behavior

No exception from HttpConnection pool and sent via H/3 connection

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

Author:	greenEkatherine
Assignees:	-
Labels:	area-System.Net.Http
Milestone:	-

[karelz]

Low priority, not big impact on customers, moving to 8.0 due to time restrictions.

[ManickaP]

Should we check the request version against known versions and allow only that? I.e.:

runtime/src/libraries/System.Net.Primitives/src/System/Net/HttpVersion.cs

Lines 10 to 17 in 69045ad

	/// <summary>Defines a <see cref="Version"/> instance for HTTP 1.0.</summary>
	public static readonly Version Version10 = new Version(1, 0);
	/// <summary>Defines a <see cref="Version"/> instance for HTTP 1.1.</summary>
	public static readonly Version Version11 = new Version(1, 1);
	/// <summary>Defines a <see cref="Version"/> instance for HTTP 2.0.</summary>
	public static readonly Version Version20 = new Version(2, 0);
	/// <summary>Defines a <see cref="Version"/> instance for HTTP 3.0.</summary>
	public static readonly Version Version30 = new Version(3, 0);

Question is whether that could break someone. For instance, someone asking for 2.5 and getting HTTP/2.

If we'd chose to go the strict way, we should probably get it in early in the release to see if someone gets borked by it.