[BUG] 开启h2后，网站图片加载失败，且ssllab显示http failure #171

ghost · 2019-12-05T12:12:35Z

[ok ] I certify that I acknowledge if I don't follow the format below, or I'm using an old version of trojan, or I apparently fail to provide sufficient information (such as logs, specific numbers), or I don't check this box, my issue will be closed immediately without any notice.

Trojan Version
The version of trojan you are using.
1.13.0
Describe the bug
A clear and concise description of what the bug is.
服务器和nginx均开启h2情况下，访问网站图片加载失败，去掉h2支持后加载正常
To Reproduce
Steps to reproduce the behavior:

Go to '...'
Click on '....'
Scroll down to '....'
See error

Expected behavior
A clear and concise description of what you expected to happen.
图片加载正常
Logs
If applicable, add logs to help explain your problem.
not trojan request, connecting to 127.0.0.1:80
Environment
Where are you running trojan? What is your proxy set up?
debian9 nginx
Additional context
Add any other context about the problem here.
h2有bug,开启后ssllab会出现http failure,仅使用http1.1则不会

GreaterFire · 2019-12-20T18:26:04Z

Please provide your nginx configuration.

ghost · 2019-12-21T02:16:35Z

server {
listen 127.0.0.1:80 http2;
server_name $domain;
location / {
root /usr/share/nginx/html/;
index index.html;
}
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
}

server {
listen 80;
listen [::]:80;
server_name $domain;
return 301 https://$domain;
}

server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 444;
}

blankhang · 2019-12-24T03:56:35Z

http2 不支持 http(80)协议吧....
放到443端口试试

ghost · 2019-12-24T04:50:22Z

http2 不支持 http(80)协议吧....
放到443端口试试

请你自己调试通过再说

blankhang · 2019-12-24T04:54:52Z

http2 不支持 http(80)协议吧....
放到443端口试试

请你自己调试通过再说

废话我生产服务器都是443 才开http2
建议你先好好学习下 http2

ghost · 2019-12-24T04:56:30Z

http2 不支持 http(80)协议吧....
放到443端口试试

请你自己调试通过再说

废话我生产服务器都是443 才开http2
建议你先好好学习下 http2

我是指你用Trojan当前端的情况下

GreaterFire · 2019-12-27T01:35:34Z

@blankhang Please don't try to answer this question if you have no idea what the problem is.

@johnrosen1 Can you provide any browser debug info when loading the images?

al123xiaaaa · 2019-12-28T09:11:24Z

h2是个啥？

laboeuf · 2019-12-31T09:27:02Z

需要升级到debian 10，

GreaterFire · 2020-01-02T06:45:14Z

I'll try to look into this myself. Thanks for reporting it.

GreaterFire · 2020-01-02T07:43:11Z

I can't reproduce this bug. With my configuration everything works fine.

Nginx config:

    server {
        listen       127.0.0.1:80 http2;
        server_name  localhost;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }

Trojan config:

{
    "run_type": "server",
    "local_addr": "0.0.0.0",
    "local_port": 443,
    "remote_addr": "127.0.0.1",
    "remote_port": 80,
    "password": [
        "password1",
        "password2"
    ],
    "log_level": 0,
    "ssl": {
        "cert": "certificate.crt",
        "key": "private.key",
        "key_password": "",
        "cipher": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256",
        "cipher_tls13":"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",
        "prefer_server_cipher": true,
        "alpn": [
            "h2",
            "http/1.1"
        ],
        "reuse_session": true,
        "session_ticket": false,
        "session_timeout": 600,
        "plain_http_response": "",
        "curves": "",
        "dhparam": ""
    },
    "tcp": {
        "prefer_ipv4": false,
        "no_delay": true,
        "keep_alive": true,
        "reuse_port": false,
        "fast_open": false,
        "fast_open_qlen": 20
    },
    "mysql": {
        "enabled": false,
        "server_addr": "127.0.0.1",
        "server_port": 3306,
        "database": "trojan",
        "username": "trojan",
        "password": ""
    }
}

ghost · 2020-01-02T07:54:33Z

I can't reproduce this bug. With my configuration everything works fine.

Nginx config:

    server {
        listen       127.0.0.1:80 http2;
        server_name  localhost;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }

Trojan config:

{
    "run_type": "server",
    "local_addr": "0.0.0.0",
    "local_port": 443,
    "remote_addr": "127.0.0.1",
    "remote_port": 80,
    "password": [
        "password1",
        "password2"
    ],
    "log_level": 0,
    "ssl": {
        "cert": "certificate.crt",
        "key": "private.key",
        "key_password": "",
        "cipher": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256",
        "cipher_tls13":"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",
        "prefer_server_cipher": true,
        "alpn": [
            "h2",
            "http/1.1"
        ],
        "reuse_session": true,
        "session_ticket": false,
        "session_timeout": 600,
        "plain_http_response": "",
        "curves": "",
        "dhparam": ""
    },
    "tcp": {
        "prefer_ipv4": false,
        "no_delay": true,
        "keep_alive": true,
        "reuse_port": false,
        "fast_open": false,
        "fast_open_qlen": 20
    },
    "mysql": {
        "enabled": false,
        "server_addr": "127.0.0.1",
        "server_port": 3306,
        "database": "trojan",
        "username": "trojan",
        "password": ""
    }
}

all right, i will check again

ghost · 2020-01-02T08:19:39Z

I can't reproduce this bug. With my configuration everything works fine.

Nginx config:

    server {
        listen       127.0.0.1:80 http2;
        server_name  localhost;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }

Trojan config:

{
    "run_type": "server",
    "local_addr": "0.0.0.0",
    "local_port": 443,
    "remote_addr": "127.0.0.1",
    "remote_port": 80,
    "password": [
        "password1",
        "password2"
    ],
    "log_level": 0,
    "ssl": {
        "cert": "certificate.crt",
        "key": "private.key",
        "key_password": "",
        "cipher": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256",
        "cipher_tls13":"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",
        "prefer_server_cipher": true,
        "alpn": [
            "h2",
            "http/1.1"
        ],
        "reuse_session": true,
        "session_ticket": false,
        "session_timeout": 600,
        "plain_http_response": "",
        "curves": "",
        "dhparam": ""
    },
    "tcp": {
        "prefer_ipv4": false,
        "no_delay": true,
        "keep_alive": true,
        "reuse_port": false,
        "fast_open": false,
        "fast_open_qlen": 20
    },
    "mysql": {
        "enabled": false,
        "server_addr": "127.0.0.1",
        "server_port": 3306,
        "database": "trojan",
        "username": "trojan",
        "password": ""
    }
}

@GreaterFire HTTP request to this server failed, see below for details. ssllab still show this error
config is the exact same as yours and web speed is still low comparing to h2 being disabled

aglent · 2020-01-18T15:40:19Z

I build the lastest trojan and test it. The problem was gone.

How to build the lastest trojan? thanks

ghost · 2020-01-19T08:33:03Z

it seems to be a bug of ssllab,close issue

WillyPillow · 2020-03-20T16:26:40Z

EDIT: This is already discussed in #226, sorry for the duplicate.

Upon inspection, this seems to be due to https://trac.nginx.org/nginx/ticket/808.

Specifically, since nginx does not support placing h2c (http2 over TCP) and http1.1 on the same port, clients that only support http1.1 would fail. This can be verified by running curl -v --http1.1 https://example.com to a server running, say, the configuration posted by @GreaterFire .

It may be possible to mitigate this by changing remote_port according to the received ALPN and running nginx on two separate ports. If you guys think that this is an acceptable solution, I can try to cook up a PR in the coming days.

…entry `ssl.alpn_port_override` that changes the remote port according to the received ALPN.

that changes the remote port according to the ALPN. Fixes trojan-gfw#171 and trojan-gfw#226.

* Add an optional config entry `ssl.alpn_port_override` that changes the remote port according to the ALPN. Fixes #171 and #226. * Handle `ssl.alpn_port_override` only when the request is not valid. * Fixes to `ssl.alpn_port_override` Co-authored-by: GreaterFire <[email protected]>

ghost added the bug label Dec 5, 2019

ghost assigned GreaterFire Dec 5, 2019

ghost closed this as completed Jan 19, 2020

WillyPillow mentioned this issue Mar 20, 2020

[Protocol] NGINX doesn't support HTTP/1.1 on h2c ports #226

Closed

WillyPillow added a commit to WillyPillow/trojan that referenced this issue Mar 21, 2020

Fixes trojan-gfw#171 and trojan-gfw#226 by adding an optional config …

e1e308d

…entry `ssl.alpn_port_override` that changes the remote port according to the received ALPN.

WillyPillow added a commit to WillyPillow/trojan that referenced this issue Mar 21, 2020

Add an optional config entry ssl.alpn_port_override

27e82f7

that changes the remote port according to the ALPN. Fixes trojan-gfw#171 and trojan-gfw#226.

GreaterFire pushed a commit to WillyPillow/trojan that referenced this issue Mar 22, 2020

Add an optional config entry ssl.alpn_port_override

b7320e7

that changes the remote port according to the ALPN. Fixes trojan-gfw#171 and trojan-gfw#226.

GreaterFire pushed a commit to WillyPillow/trojan that referenced this issue Mar 22, 2020

Add an optional config entry ssl.alpn_port_override

dad9d4e

that changes the remote port according to the ALPN. Fixes trojan-gfw#171 and trojan-gfw#226.

This issue was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BUG] 开启h2后，网站图片加载失败，且ssllab显示http failure #171

[BUG] 开启h2后，网站图片加载失败，且ssllab显示http failure #171

ghost commented Dec 5, 2019

GreaterFire commented Dec 20, 2019

ghost commented Dec 21, 2019

blankhang commented Dec 24, 2019

ghost commented Dec 24, 2019

blankhang commented Dec 24, 2019

ghost commented Dec 24, 2019

GreaterFire commented Dec 27, 2019

al123xiaaaa commented Dec 28, 2019

laboeuf commented Dec 31, 2019

GreaterFire commented Jan 2, 2020

GreaterFire commented Jan 2, 2020

ghost commented Jan 2, 2020

ghost commented Jan 2, 2020

aglent commented Jan 18, 2020

ghost commented Jan 19, 2020

WillyPillow commented Mar 20, 2020 •

edited

Loading

[BUG] 开启h2后，网站图片加载失败，且ssllab显示http failure #171

[BUG] 开启h2后，网站图片加载失败，且ssllab显示http failure #171

Comments

ghost commented Dec 5, 2019

GreaterFire commented Dec 20, 2019

ghost commented Dec 21, 2019

blankhang commented Dec 24, 2019

ghost commented Dec 24, 2019

blankhang commented Dec 24, 2019

ghost commented Dec 24, 2019

GreaterFire commented Dec 27, 2019

al123xiaaaa commented Dec 28, 2019

laboeuf commented Dec 31, 2019

GreaterFire commented Jan 2, 2020

GreaterFire commented Jan 2, 2020

ghost commented Jan 2, 2020

ghost commented Jan 2, 2020

aglent commented Jan 18, 2020

ghost commented Jan 19, 2020

WillyPillow commented Mar 20, 2020 • edited Loading

WillyPillow commented Mar 20, 2020 •

edited

Loading