search

dlundquist / sniproxy

Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session.
BSD 2-Clause "Simplified" License
2.57k stars 398 forks source link

Safari often returns 404 #329

Open richfang opened 5 years ago

richfang commented 5 years ago

Safari can open google normally, when you click gmail on the page, it will return a 404 error. Right click on the page gmail, open on the new tab page, it will be normal.

qwqVictor commented 5 years ago

The HTTP/2 multiplexing is to blame. Google uses HTTP/2 to enhance their performance. If there are many resources to be requested which is hosted on single IP, the browser will combine these requests into one connection, which may led SNIProxy to forward the connection to an incorrect server.

richfang commented 5 years ago

Thanks！

Is there a way to solve this problem? Can you increase the number of sniproxy servers?

Victor Huang notifications@github.com 于2019年3月16日周六 下午4:33写道：

The HTTP/2 multiplexing is to blame. Google uses HTTP/2 to enhance their performance. If there are many resources to be requested which is hosted on single IP, the browser will combine these requests into one connection, which may led SNIProxy to forward the connection to an incorrect server.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/dlundquist/sniproxy/issues/329#issuecomment-473511721, or mute the thread https://github.com/notifications/unsubscribe-auth/AjE9g1JBX__CEkOKaEH22lD-9q1ATNbYks5vXKxlgaJpZM4b2Cvh .

qwqVictor commented 5 years ago

Thanks！ Is there a way to solve this problem? Can you increase the number of sniproxy servers? Victor Huang notifications@github.com 于2019年3月16日周六 下午4:33写道： …

Increase the number of SNIProxy servers is OK. But it is truly difficult to implement because Google has a large number of servers.

The only way that I can come up with is disabling HTTP/2.SNIProxy can't do that because it doesn't know what version of HTTP you used, it can only read the SNI header and forward the TCP request to the backend, but the HTTP version negotiation is over TLS. I suggest that you self-sign a certificate for Google and import the root certificate to your device, and use nginx as the reverse proxy instead.

jornane commented 5 years ago

The only way that I can come up with is disabling HTTP/2.SNIProxy can't do that because it doesn't know what version of HTTP you used

In case of HTTP/2, the server actually sends a flag in the Server Hello packet indicating that it supports h2. I have never tested this, but maybe SNIProxy could get a configuration option to drop this flag when proxying the Server Hello? That would mean a lot more code though.

This has been discussed here as well: