Unable to front butterfly with an ssl proxy

[mingfang]

I've tried fronting butterfly using both nginx and haproxy. In both causes, http works but https does not. Using https, butterfly says "closed". Here is the haproxy server log 0000002a:https-in.clireq[0009:ffffffff]: GET /ws/ HTTP/1.1 0000002a:https-in.clihdr[0009:ffffffff]: Host: cloud1 0000002a:https-in.clihdr[0009:ffffffff]: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:28.0) Gecko/20100101 Firefox/28.0 0000002a:https-in.clihdr[0009:ffffffff]: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 0000002a:https-in.clihdr[0009:ffffffff]: Accept-Language: en-US,en;q=0.5 0000002a:https-in.clihdr[0009:ffffffff]: Accept-Encoding: gzip, deflate 0000002a:https-in.clihdr[0009:ffffffff]: Sec-WebSocket-Version: 13 0000002a:https-in.clihdr[0009:ffffffff]: Origin: https://cloud1 0000002a:https-in.clihdr[0009:ffffffff]: Sec-WebSocket-Key: vf6ujpm1kHdKvPiLnZ4/pw== 0000002a:https-in.clihdr[0009:ffffffff]: Connection: keep-alive, Upgrade 0000002a:https-in.clihdr[0009:ffffffff]: Pragma: no-cache 0000002a:https-in.clihdr[0009:ffffffff]: Cache-Control: no-cache 0000002a:https-in.clihdr[0009:ffffffff]: Upgrade: websocket 0000002a:butterfly.srvrep[0009:000a]: HTTP/1.1 101 Switching Protocols 0000002a:butterfly.srvhdr[0009:000a]: Upgrade: websocket 0000002a:butterfly.srvhdr[0009:000a]: Connection: Upgrade 0000002a:butterfly.srvhdr[0009:000a]: Sec-WebSocket-Accept: 1RqIMKyS1J/e61gr4iKF4LMJ5I0= 0000002a:butterfly.srvcls[0009:000a] 0000002a:butterfly.clicls[0009:000a] 0000002a:butterfly.closed[0009:000a]

[mingfang]

The problem goes away when I remove from routes.py lines 203 to 211. Also because I'm using a self signed cert, it only works with Chrome.

[oldgregg-zz]

I'd highly recommend you leave lines 203 through 211 in, as they prevent a number of security issues. Could you perhaps include your use-case, so we could:

A) come up with a solution given the existing code B) make code changes to better support this setup if deemed necessary?

[mingfang]

My use case is this. I want to front butterfly http using a https reverse proxy. I have tried nginx and haproxy.

[paradoxxxzero]

I'll push a fix monday for this, meanwhile you can change the test in these lines to match the host without the protocol.

[boccato]

@mingfang While the change is not up, you can put this on your nginx config's location block: proxy_set_header Origin http://$host; That way, the check at line 203 will work. Yeah, its a hack and I don't recommend (though I don't really know why... :))

[paradoxxxzero]

This should be fixed in git version. Could you please try it ?

[mingfang]

Hmm, I’m now getting a different error on the server logs

2014-05-05_11:14:05.83074 [E 140505 11:14:05 websocket:325] Uncaught exception in /ws/ 2014-05-05_11:14:05.83077 Traceback (most recent call last): 2014-05-05_11:14:05.83077 File "/usr/local/lib/python2.7/dist-packages/tornado-3.2-py2.7-linux-x86_64.egg/tornado/websocket.py", line 322, in wrapper 2014-05-05_11:14:05.83078 return callback(_args, _kwargs) 2014-05-05_11:14:05.83079 File "/usr/local/lib/python2.7/dist-packages/butterfly-1.5.0-py2.7.egg/butterfly/routes.py", line 295, in on_message 2014-05-05_11:14:05.83079 fcntl.ioctl(self.fd, termios.TIOCSWINSZ, s) 2014-05-05_11:14:05.83079 IOError: [Errno 9] Bad file descriptor 2014-05-05_11:14:10.54359 [E 140505 11:14:10 websocket:325] Uncaught exception in /ws/ 2014-05-05_11:14:10.54361 Traceback (most recent call last): 2014-05-05_11:14:10.54361 File "/usr/local/lib/python2.7/dist-packages/tornado-3.2-py2.7-linux-x86_64.egg/tornado/websocket.py", line 322, in wrapper 2014-05-05_11:14:10.54362 return callback(_args, _kwargs) 2014-05-05_11:14:10.54363 File "/usr/local/lib/python2.7/dist-packages/butterfly-1.5.0-py2.7.egg/butterfly/routes.py", line 295, in on_message 2014-05-05_11:14:10.54363 fcntl.ioctl(self.fd, termios.TIOCSWINSZ, s) 2014-05-05_11:14:10.54364 IOError: [Errno 9] Bad file descriptor

On May 5, 2014, at 6:06 AM, Mounier Florian notifications@github.com wrote:

This should be fixed in git version. Could you please try it ?

— Reply to this email directly or view it on GitHub.

[mingfang]

Any update on this? I'm still unable to front butterfly using nginx ssl. Non ssl work fine.