apache / apache/trafficserver

Turning on PROXY Protocol forces clients to perform ALPN, otherwise connections are dropped

Open
#5,974 2 comments 0 reactions 1 assignee Claimed by @SolidWallOfCode View on GitHub
Network PROXY Protocol TLS
Dominant language
C++
Stars
2k
Forks
874
Avg merge
6d 15h
Merged PRs (30d)
46

Description

ATS: 8.0.5
OpenSSL: 1.0.2r

```
CONFIG proxy.config.http.server_ports STRING 8080:pp:proto=http 8443:ssl:pp:proto=http
```

Running Nginx on localhost, proxying TCP connections on 80/443 to 8080/8443 with PROXY protocol:
```
stream {
upstream internal {
server 127.0.0.1:8443;
}
server {
listen 443;
proxy_protocol on;
proxy_pass internal;
}
}
```

Working via cURL:
```bash
$ curl https://localhost -I
HTTP/1.1 200 OK
Server: ATS/8.0.5
Date: Tue, 01 Oct 2019 00:09:30 GMT
Content-Type: text/html
Age: 0
Connection: keep-alive
```

Not working via cURL with ALPN disabled:
```bash
$ curl https://localhost -I --no-alpn
curl: (52) Empty reply from server
```

Not working via Python `requests`:
```python
import requests
requests.get('https://localhost')
#
# urllib3.exceptions.ProtocolError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))
```

Working via Python `requests` after forcing ALPN:
```python
from requests import Session
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.util.ssl_ import create_urllib3_context

class HTTP11ALPNAdapter(HTTPAdapter):
def init_poolmanager(self, *args, **kwargs):
ctx = create_urllib3_context()
ctx.set_alpn_protocols(['http/1.1'])
kwargs['ssl_context'] = ctx
return super().init_poolmanager(*args, **kwargs)

s = requests.Session()
s.mount('https://localhost', HTTP11ALPNAdapter())
s.get('https://localhost')
#
```

@masaori335 was able to reproduce this and track down that it was the `pp` in the `server_ports` config line that was triggering this behavior. When `pp` was not specified, clients received successful responses even when not performing ALPN

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.