[OT] Secure Websocket with proxy - connection closed
I'm having trouble using lighttpd as proxy for secure websocket. I'm not too confident with SSL nor lighttpd so I really don't know where to look for the error. Please advice.
My setup:
I have a backend running HTTP and websocket on port 9000.
I've installed lighttpd with mod_proxy in front of my server for handling SSL and forwarding all traffic to the backend. Ordinary https works fine!
But wss:// doesn't work. It seems the connection is closed as soon as it is established. Apparently the backend server is unaware of this, as it keeps trying to send messages to the client.
(If I access the backend directly on port 9000 both http and ws works as expected)
When testing in Chrome, I don't get any error messages. Actually, it's doesn't even tell that the connection is closed. Using Postman I get a '1006 abnormal closure'
https is working fine, so I reckon that SSL is installed correctly.
Version: lighttpd/1.4.59
lighttpd.conf:
server.modules = (
"mod_indexfile",
"mod_access",
"mod_alias",
"mod_redirect",
"mod_proxy",
"mod_accesslog",
"mod_openssl"
)
server.document-root = "/var/www/html"
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )
server.errorlog = "/var/log/lighttpd/error.log"
server.pid-file = "/run/lighttpd.pid"
server.username = "www-data"
server.groupname = "www-data"
server.port = 80
debug.log-request-handling = "enable"
debug.log-ssl-noise = "enable"
# redirect all http to https
$HTTP["scheme"] == "http" {
url.redirect = ("" => "https://${url.authority}${url.path}${qsa}")
}
# setup ssl/tsl
$SERVER["socket"] == "xxxxxxxx.com:443" {
ssl.engine = "enable"
ssl.pemfile = "/etc/lighttpd/ssl/www_xxxxxxxx_com.pem"
ssl.ca-file = "/etc/lighttpd/ssl/USERTrust_RSA_Certification_Authority.crt"
server.name = "xxxxxxxx.com"
server.errorlog = "/var/log/lighttpd/www_xxxxxx_com/serror.log"
accesslog.filename = "/var/log/lighttpd/www_xxxxxx_com/saccess.log"
}
# proxy everything to backend except phpmyadmin
$HTTP["url"] !~ "^/phpmyadmin" {
proxy.server = ( "" => ( # proxy all file extensions / prefixes
"" => # optional label to identify requests in logs
( "host" => "localhost",
"port" => 9000
)
)
)
proxy.header = ( "upgrade" => "enable" )
}
# strict parsing and normalization of URL for consistency and security
# https://redmine.lighttpd.net/projects/lighttpd/wiki/Server_http-parseoptsDetails
# (might need to explicitly set "url-path-2f-decode" = "disable"
# if a specific application is encoding URLs inside url-path)
server.http-parseopts = (
"header-strict" => "enable",# default
"host-strict" => "enable",# default
"host-normalize" => "enable",# default
"url-normalize-unreserved"=> "enable",# recommended highly
"url-normalize-required" => "enable",# recommended
"url-ctrls-reject" => "enable",# recommended
"url-path-2f-decode" => "enable",# recommended highly (unless breaks app)
#"url-path-2f-reject" => "enable",
"url-path-dotseg-remove" => "enable",# recommended highly (unless breaks app)
#"url-path-dotseg-reject" => "enable",
#"url-query-20-plus" => "enable",# consistency in query string
)
index-file.names = ( "index.php", "index.html" )
url.access-deny = ( "~", ".inc" )
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
deflate.cache-dir = "/var/cache/lighttpd/compress/"
#deflate.filetype = ( "application/javascript", "text/css", "text/html", "text/plain" )
# default listening port for IPv6 falls back to the IPv4 port
## Use ipv6 if available
#include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
include_shell "/usr/share/lighttpd/create-mime.conf.pl"
include "/etc/lighttpd/conf-enabled/*.conf"
#server.compat-module-load = "disable"
server.modules += (
"mod_deflate",
"mod_dirlisting",
"mod_staticfile",
)
I've attached two screenshots from Chrome and Postman that show that the connections is established. But Postman also reveals that the connection is closed with an error.
Here is a bit of output from serror.log
2021-07-12 10:12:33: mod_access.c.139) -- mod_access_uri_handler called
2021-07-12 10:12:33: gw_backend.c.2571) handling it in mod_gw
2021-07-12 10:12:33: response.c.519) -- before doc_root
2021-07-12 10:12:33: response.c.521) Doc-Root : /var/www/html
2021-07-12 10:12:33: response.c.523) Rel-Path : /chart/245
2021-07-12 10:12:33: response.c.525) Path : /var/www/html/assets/js/jstree/jstree.min.js
2021-07-12 10:12:33: response.c.558) -- after doc_root
2021-07-12 10:12:33: response.c.560) Doc-Root : /var/www/html
2021-07-12 10:12:33: response.c.562) Rel-Path : /chart/245
2021-07-12 10:12:33: response.c.564) Path : /var/www/html/chart/245
2021-07-12 10:12:33: response.c.579) -- logical -> physical
2021-07-12 10:12:33: response.c.581) Doc-Root : /var/www/html
2021-07-12 10:12:33: response.c.583) Basedir : /var/www/html
2021-07-12 10:12:33: response.c.585) Rel-Path : /chart/245
2021-07-12 10:12:33: response.c.587) Path : /var/www/html/chart/245
2021-07-12 10:12:33: response.c.398) -- parsed Request-URI
2021-07-12 10:12:33: response.c.400) Request-URI : /ws
2021-07-12 10:12:33: response.c.402) URI-scheme : https
2021-07-12 10:12:33: response.c.404) URI-authority : xxxxxxx.com
2021-07-12 10:12:33: response.c.406) URI-path (clean): /ws
2021-07-12 10:12:33: response.c.408) URI-query :
2021-07-12 10:12:33: mod_access.c.139) -- mod_access_uri_handler called
2021-07-12 10:12:33: gw_backend.c.2571) handling it in mod_gw
2021-07-12 10:12:33: response.c.519) -- before doc_root
2021-07-12 10:12:33: response.c.521) Doc-Root : /var/www/html
2021-07-12 10:12:33: response.c.523) Rel-Path : /ws
2021-07-12 10:12:33: response.c.525) Path : /var/www/html/ws
2021-07-12 10:12:33: response.c.558) -- after doc_root
2021-07-12 10:12:33: response.c.560) Doc-Root : /var/www/html
2021-07-12 10:12:33: response.c.562) Rel-Path : /ws
2021-07-12 10:12:33: response.c.564) Path : /var/www/html/ws
2021-07-12 10:12:33: response.c.579) -- logical -> physical
2021-07-12 10:12:33: response.c.581) Doc-Root : /var/www/html
2021-07-12 10:12:33: response.c.583) Basedir : /var/www/html
2021-07-12 10:12:33: response.c.585) Rel-Path : /ws
2021-07-12 10:12:33: response.c.587) Path : /var/www/html/ws
