Re: relayd as websocket proxy?

2018-05-06 Thread Ajitabh Pandey
Hello,

I am facing issues with running Jupyter notebook behind relayd. This is
most probably because of websockets proxy.

When I open a notebook, its not able to connect to the kernel.


Searching on the net pointed me to this issue -
https://github.com/jupyter/notebook/issues/2664

The solution there is with an nginx configuration. I am not able to figure
out equivalent relayd config.

Any help here would be appreciated.

Here is my relayd config -
-
-

relayd_addr="0.0.0.0"
relayd_port="80"

jupyter_port="5000"
table  { 127.0.0.1 }

httpd_port="8000"
table  { 127.0.0.1 }

log all

http protocol "httpfilter" {
match header append "X-Forwarded-For" \
value "$REMOTE_ADDR"
match header append "X-Forwarded-By" \
value "$REMOTE_ADDR:$SERVER_PORT"
match header set "Keep-Alive" value "$TIMEOUT"

### TCP performance options
tcp { nodelay, sack, socket buffer 65536, backlog 100 }

### Return HTTP/HTML error pages
return error

match request path "/ipython/*" forward to 
match request path "/" forward to 
}

relay http {
listen on $relayd_addr port $relayd_port
protocol "httpfilter"
forward to  port $jupyter_port mode loadbalance
forward to  port $httpd_port check tcp interval 60
}
-
-


Regards.
-- 
Ajitabh Pandey

On Mon, Apr 30, 2018 at 9:24 PM, Andre Ruppert  wrote:

> Hello @misc,
>
> is it possible to configure relayd to act as a websocket proxy with
> v6.2/v6.3?
>
> I set up relayd as ssl accelerator:
>
> excerpt from relayd.conf:
>
> 
> http protocol "httpfilter2" {
>
> tcp { nodelay, sack, socket buffer 65536, backlog 100 }
>
> return error
> match request header set "Connection" value "close"
> match header set "Keep-Alive" value "$TIMEOUT"
> match request header append "X-Forwarded-For" value "$REMOTE_ADDR"
> match request header append "X-Forwarded-By" value \
>   "$SERVER_ADDR:$SERVER_PORT"
>
> tls { tlsv1, ciphers "HIGH:!ADH:!NULL:!RC4:-ECDH:ECDHE" }
> }
> ...
>
> relay webrtc_wsc {
> listen on $webrtc_wsc_relayd_addr \
> port $webrtc_wsc_relayd_port tls
> protocol "httpfilter2"
> transparent forward to  port $webrtc_wsc_web_port \
> mode loadbalance http “/” code 200
> }
> ...
>
> valid .key and .crt-files are placed in /etc/ssl/private and /etc/ssl.
>
>
> First: "standard" SSL acceleration works fine without problems.
>
> Second: websocket connections don't  :-(
>
> As far I can see websocket upgrade messages (decoded in wireshark as
> "HTTP/1.1 101 Switching Protocols" packets) from the internal server are
> replaced by relayd with packets with the RST-flag set directed to the WAN
> client and the connection is closed.
>
>
> My head-scratching question:
> is this possible at all with relayd?
>
> Or do I have to switch to nginx?
>
>
> Regards
> Andre Ruppert
>
>
>
>


-- 
Ajitabh Pandey
http://ajitabhpandey.info/ | http://unixclinic.net/ |
http://buddingthoughts.info
ICQ - 150615062
Registered Linux User - 240748


relayd as websocket proxy?

2018-04-30 Thread Andre Ruppert

Hello @misc,

is it possible to configure relayd to act as a websocket proxy with 
v6.2/v6.3?


I set up relayd as ssl accelerator:

excerpt from relayd.conf:


http protocol "httpfilter2" {

tcp { nodelay, sack, socket buffer 65536, backlog 100 }

return error
match request header set "Connection" value "close"
match header set "Keep-Alive" value "$TIMEOUT"
match request header append "X-Forwarded-For" value "$REMOTE_ADDR"
match request header append "X-Forwarded-By" value \
  "$SERVER_ADDR:$SERVER_PORT"

tls { tlsv1, ciphers "HIGH:!ADH:!NULL:!RC4:-ECDH:ECDHE" }
}
...

relay webrtc_wsc {
listen on $webrtc_wsc_relayd_addr \
port $webrtc_wsc_relayd_port tls
protocol "httpfilter2"
transparent forward to  port $webrtc_wsc_web_port \
mode loadbalance http “/” code 200
}
...

valid .key and .crt-files are placed in /etc/ssl/private and /etc/ssl.


First: "standard" SSL acceleration works fine without problems.

Second: websocket connections don't  :-(

As far I can see websocket upgrade messages (decoded in wireshark as
"HTTP/1.1 101 Switching Protocols" packets) from the internal server are 
replaced by relayd with packets with the RST-flag set directed to the 
WAN client and the connection is closed.



My head-scratching question:
is this possible at all with relayd?

Or do I have to switch to nginx?


Regards
Andre Ruppert





smime.p7s
Description: S/MIME Cryptographic Signature