Subject: [hybi] Testing 04 on a paranoid proxy

From: Andy Green <[email-masked]>
Date: Thu, 03 Feb 2011 10:37:42 +0000

Hi -

I am visiting a semiconductor company in France at the moment and their 
guest network uses a quite aggressive proxy, I never had the opportunity 
to be behind such a thing before; maybe it is commonplace for other list 
members but I thought I would see what 04 websockets fared like with it.

Here are the results of being an 04 client behind a "NetCache appliance 
(NetApp/6.0.5)".  In each case the remote server is configured to the 
matching port and mode.

   Port: 7681  Mode: ws or wss  Result:  FAIL (port closed)

   Port: 80    Mode: ws         Result:  FAIL ("BAD GATEWAY") [1]

   Port: 80    Mode wss         Result:  FAIL (SSL HELLO broken) [2]

   Port 443:   Mode ws          Result:  Worked fine

   Port 443:   Mode wss         Result:  Worked fine

I was a bit surprised that ws worked on 443 OK even though this proxy 
has been configured so aggressively as to kill IMAP on 993.  This proxy 
configuration anyway seems to allow websocket funny business so long as 
it is 443.

-Andy

[1]
$ libwebsockets-test-client warmcat.com --port 80
libwebsockets test client
(C) Copyright 2010 Andy Green <[email-masked]> licensed under LGPL2.1
libwebsocket_client_handshake missing required header(s)
HTTP/1.1 502 Bad Gateway
Via: 1.0 BBSM53
Content-Length: 338
Date: Thu, 03 Feb 2011 10:31:05 GMT
Content-Type: text/html
Server: NetCache appliance (NetApp/6.0.5)

<HTML>
<HEAD><TITLE>502 Bad Gateway</TITLE></HEAD>
<BODY>
<H1>Bad Gateway</H1>
<H4>
The following error occurred:<P>
[code=DNS_HOST_NOT_FOUND] The host name was not found during the DNS 
lookup. Contact your system administrator if the problem is not found by 
retrying the URL.
</H4>
<HR>
Please contact the administrator.
</BODY>
</HTML>
libwebsocket dumb connect failed

[2]

$ libwebsockets-test-client warmcat.com --ssl --port 80
libwebsockets test client
(C) Copyright 2010 Andy Green <[email-masked]> licensed under LGPL2.1
SSL connect error error:140770FC:SSL 
routines:SSL23_GET_SERVER_HELLO:unknown protocol
libwebsocket dumb connect failed

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 3 Feb 2011 22:22:49 +1100

FYI some background -- That's an old-ish version of netcache, IIRC. It was a general proxy/cache solution (and a very very good one) that was bought by a security-focused appliance company (BlueCoat) a few years back.

It'd be interesting to make the same requests from behind a BC box, but I don't have access to any...

Cheers,

On 03/02/2011, at 9:37 PM, Andy Green wrote:

> Hi -
> 
> I am visiting a semiconductor company in France at the moment and their guest network uses a quite aggressive proxy, I never had the opportunity to be behind such a thing before; maybe it is commonplace for other list members but I thought I would see what 04 websockets fared like with it.
> 
> Here are the results of being an 04 client behind a "NetCache appliance (NetApp/6.0.5)".  In each case the remote server is configured to the matching port and mode.
> 
> 
> I was a bit surprised that ws worked on 443 OK even though this proxy has been configured so aggressively as to kill IMAP on 993.  This proxy configuration anyway seems to allow websocket funny business so long as it is 443.
> 
> -Andy
> 
> 
> [1]
> [code=DNS_HOST_NOT_FOUND] The host name was not found during the DNS lookup. Contact your system administrator if the problem is not found by retrying the URL.
> </H4>
> <HR>
> SSL connect error error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi

--
Mark Nottingham   http://www.mnot.net/