求教caddy2的h2代理配置，調試了好久都不行

wenjinlibug commented 4 years ago

caddy2的配置：

https://<hosts> {
    file_server browse {
        root <path_root>
    }
    tls <pem> <key> {
        protocols tls1.2 tls1.3
        ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
        curves x25519
        alpn "h2","http/1.1"
    }
    @v2ray_ws {
        path <path_ws>
        header Connection Upgrade
        header Upgrade websocket
    }
    reverse_proxy @v2ray_ws localhost:<port_ws>

    reverse_proxy <path_h2> {
        to localhost:<port_h2>
        header_up Host {host}
        header_up X-Real-IP {remote}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Port {server_port}
        header_up X-Forwarded-Proto "https"
        transport http {
            tls
            tls_insecure_skip_verify
        }
    }
}

可以看到其實caddy2的配置裏有ws+tls的配置，只是新開了一個端口用來調試h2 使用ws+tls時是完全沒問題的，因此不用懷疑證書的配置。 web方面也完全沒問題。下面是v2ray 4.25.0的服務端配置：


`"inbound": {
        {
        "tag": "httpPort",
        "listen": "0.0.0.0",
        "port": <port_ws>,
        "protocol": "vmess",
        "sniffing": {
            "enabled": true
        },
        "streamSettings": {
            "network": "ws",
            "wsSettings": {
                "path": <part_ws>
            },
            "security": "none"
        },
        "settings": {
            "clients": [
                {
                    "id": <uuid>,
                    "email": <email>,
                    "level": 0,
                    "alterid": 32
                }
            ],
            "disableInsecureEncryption": false
        }
    }
},
"inboundDetour": [
    {
        "tag": "httpPort",
        "listen": "0.0.0.0",
        "port": <port_h2>,
        "protocol": "vmess",
        "sniffing": {
            "enabled": true
        },
        "streamSettings": {
            "network": "h2",
            "httpSettings": {
                "host": [<host>],
                "path": <part_h2>
            },
            "security": "tls",
            "tlsSettings": {
                "serverName": <host>,
                "allowInsecure": true,
                "alpn": ["h2","http/1.1"],
                "disableSystemRoot": false,
                "certificates": [
                    {
                        "usage": "verify",
                        "certificateFile": <CA-ecc.pem>
                    },
                    {   
                        "usage": "encipherment",
                        "certificateFile": <pem>,
                        "keyFile": <key>
                    }
                ]
            }
        },
        "settings": {
            "clients": [
                {
                    "id": <uuid>,
                    "email": <email>,
                    "level": 0,
                    "alterid": 32
                }
            ],
            "disableInsecureEncryption": false
        }
    }
],`

```客戶端配置上ws+tls和h2沒差多少懶得放。
這個配置在ws上完美運行，一旦切到h2就不通
v2ray會報錯
' failed to read request header > stream error: stream ID <number>; CANCEL'

Kounenri commented 4 years ago

www.website.com { tls user@email.com gzip root /var/www/ log /var/log/caddy/access.log proxy /xxxxx localhost:123 { websocket header_upstream -Origin } proxy /yyyy https://localhost:1234 { insecure_skip_verify transparent }

换Caddy1看看呢,或者Caddy2用上面的参数试试

DolorHunter commented 4 years ago

https://github.com/v2ray/discussion/issues/749

o0HalfLife0o commented 4 years ago

https://github.com/caddyserver/caddy/issues/2889#issuecomment-643872805 试试，可以吗

wenjinlibug commented 4 years ago

@o0HalfLife0o 試過不行，會提示head错误，如果用tls重新加密仍然會提示錯誤。剛剛更新了2.1，看了下更新文檔有提到增加h2c支持，找個時間再試試看。 transport http { versions h2c } 同样提示' failed to read request header > stream error: stream ID ; CANCEL'

soulmercy commented 4 years ago

@o0HalfLife0o 試過不行，會提示head错误，如果用tls重新加密仍然會提示錯誤。剛剛更新了2.1，看了下更新文檔有提到增加h2c支持，找個時間再試試看。 transport http { versions h2c } 同样提示' failed to read request header > stream error: stream ID ; CANCEL'

遇到同样问题，也没有测通。caddy2.1.1

masknu commented 4 years ago

This is due a bug in Caddy v2, I submitted a PR to address the issue, hope it would be merged soon. caddyserver/caddy#3556

hang333 commented 4 years ago

这里有人试过自己 git clone devel version caddy 来 build 吗？我 build 了还是一样报错

masknu commented 4 years ago

这里有人试过自己 git clone devel version caddy 来 build 吗？我 build 了还是一样报错

提供一下你的caddy配置文件以及 v2ray 服务端和客户端配置文件看看(隐去隐私信息)。

hang333 commented 4 years ago

这里有人试过自己 git clone devel version caddy 来 build 吗？我 build 了还是一样报错

提供一下你的caddy配置文件以及 v2ray 服务端和客户端配置文件看看(隐去隐私信息)。

你好，这是我的客户端与服务端的配置，还请过目 https://gist.github.com/hang333/5021e39f8f6f3fe5b94a1cf571c8c245

masknu commented 4 years ago

大致看了一下， https://gist.github.com/hang333/5021e39f8f6f3fe5b94a1cf571c8c245#file-caddyfile-L32 这一节可以这样定义：

reverse_proxy /h2path http://localhost:h2port {
  transport http {
    versions h2c 2
  }
}

https://gist.github.com/hang333/5021e39f8f6f3fe5b94a1cf571c8c245#file-server_v2ray-json-L41 这一行改成： "security": "none",

并且去掉"tlsSettings" 那一节。

Caddy 中的 /h2path 需要和 v2ray server端的"httpSettings": { "path": "/h2path"} 一致。

试试看。

hang333 commented 4 years ago

大致看了一下， https://gist.github.com/hang333/5021e39f8f6f3fe5b94a1cf571c8c245#file-caddyfile-L32 这一节可以这样定义：
reverse_proxy /h2path http://localhost:h2port {
  transport http {
    versions h2c 2
  }
}
https://gist.github.com/hang333/5021e39f8f6f3fe5b94a1cf571c8c245#file-server_v2ray-json-L41 这一行改成： "security": "none",

并且去掉"tlsSettings" 那一节。

Caddy 中的 /h2path 需要和 v2ray server端的"httpSettings": { "path": "/h2path"} 一致。

试试看。

我试了一下，还是发生错误了。我的新配置文件在这里。 https://gist.github.com/hang333/047ecf4c8d7d2868f1ce142d713a3520 还请你看一下。

masknu commented 4 years ago

看上去新的配置文件没问题，重新启动一下v2ray server 和 Caddy，然后输出一下两者的日志看看。

hang333 commented 4 years ago

看上去新的配置文件没问题，重新启动一下v2ray server 和 Caddy，然后输出一下两者的日志看看。

我看了一下我 caddy 的日志，发现 v2ray 请求的时候 host 是 www.example.com ，把 client 的 httpSettings 加多一个 host 数组里放服务器的域名就行了 https://gist.github.com/hang333/047ecf4c8d7d2868f1ce142d713a3520#file-v2ray_client-json-L82 改成

        "httpSettings": {
          "host": [
            "domain"
          ],
          "path": "/h2path"
        }

谢谢你的协助！

masknu commented 4 years ago

好的，不客气。你的配置文件可以一直放在那给其他人一个参考了。

ha-ku commented 4 years ago

我尝试了自己build v2.2.0-rc.1 版本的caddy，现在收到http2请求的时候caddy能正常通过h2c反代给后端，但是收到（比如由CDN回源的）http1.1请求的时候依然会出问题。这是正常的吗？

caddy的log：

{"level":"error","ts":1598361724.3903546,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_addr":"xxx.xxx.xxx.xxx","proto":"HTTP/1.1","method":"PUT","host":"xxx.xxx.xxx","uri":"/xxx","headers":{"X-Forwarded-For":["xxx.xxx.xxx.xxx"],"Accept-Encoding":["identity"],"User-Agent":["CDN-User-Agent"],"Connection":["Keep-Alive"]},"tls":{"resumed":true,"version":771,"cipher_suite":49200,"proto":"","proto_mutual":true,"server_name":"xxx.xxx.xxx"}},"common_log":"xxx.xxx.xxx.xxx - - [25/Aug/2020:13:22:04 +0000] \"PUT /xxx HTTP/1.1\" 502 0","duration":59.996314451,"size":0,"status":502,"resp_headers":{"Server":["Caddy"]}}

v2ray的error.log: 2020/08/25 13:23:52 [Info] [2861881780] v2ray.com/core/app/proxyman/inbound: connection ends > v2ray.com/core/proxy/vmess/inbound: invalid request from 127.0.0.1:45456 > v2ray.com/core/proxy/vmess/encoding: failed to read request header > unexpected EOF 2020/08/25 13:23:52 [Info] [2861881780] v2ray.com/core/app/proxyman/inbound: failed to close connection > multierr: unexpected EOF |

caddy的配置：

https://xxx.xxx.xxx {
        tls /path/to/cert/fullchain.pem /path/to/key/privkey.pem
        reverse_proxy /xxx localhost:xxxxx {
                header_up Host {http.request.host}
                header_up X-Real-IP {http.request.remote.host}
                header_up X-Forwarded-For {http.request.remote.host}
                header_up X-Forwarded-Port {http.request.port}
                header_up X-Forwarded-Proto {http.request.scheme}
                transport http {
                        versions h2c
                }
        }
        其他的web server 配置
}

v2ray的配置:

                {
                        "port": xxxxx,
                        "listen":"0.0.0.0",
                        "protocol": "vmess",
                        "settings": {
                                "clients": [
                                        {
                                                "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                                                "level": 2,
                                                "alterId": 64,
                                        }
                                ]
                        },
                        "streamSettings": {
                                "network": "http",
                                "security": "none",
                                "httpSettings": {
                                        "host": [
                                                "xxx.xxx.xxx"
                                        ],
                                        "path": "/xxx"
                                },
                                "tlsSettings": {
                                        "certificates": [{
                                                "certificateFile": "/path/to/cert/fullchain.pem",
                                                "keyFile": "/path/to/key/privkey.pem"
                                        }],
                                        "alpn": ["h2"],
                                        "disableSystemRoot": true
                                }
                        }
                }

masknu commented 4 years ago

嗯，这个特性只有在 <-http2->Caddy<-http2->时会启用。

ha-ku commented 4 years ago

嗯，这个特性只有在 <-http2->Caddy<-http2->时会启用。

所以现在是用H2就只能不过CDN直连吗？还是说有什么CDN支持http2回源的？我找了好久发现基本都是1.1回源

masknu commented 4 years ago

可能要按CDN提供商的控制面板配置一下http2 CDN。

ha-ku commented 4 years ago

可能要按CDN提供商的控制面板配置一下http2 CDN。

我目前为止试了Cloudfront、cloudflare和gcorelab，三家回源都固定只能是http1.x，就没什么办法

github-actions[bot] commented 3 years ago

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days