mirror of
https://github.com/fatedier/frp.git
synced 2026-05-15 08:05:49 -06:00
[GH-ISSUE #2500] FRP does not work with latest Chromium (likely due to changes in handshake) #1987
Labels
No labels
In Progress
WIP
WaitingForInfo
bug
doc
duplicate
easy
enhancement
future
help wanted
invalid
lifecycle/stale
need-issue-template
need-usage-help
no plan
proposal
pull-request
question
todo
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/frp#1987
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ProfFan on GitHub (Jul 29, 2021).
Original GitHub issue: https://github.com/fatedier/frp/issues/2500
[REQUIRED] hat version of frp are you using
Version: 0.37
[REQUIRED] What operating system and processor architecture are you using
OS: Ubuntu 20.04
CPU architecture: amd64
[REQUIRED] description of errors
"ERROR_CONNECTION_RESET" when trying to visit a website served using FRP with HTTPS (TLS).
Error log shows that the clientHello is sent and then the server returns TCP reset.
However, any other browser than Chromium (92.0.4515 currently) works fine.
confile
log file
Supplementary information
Can you guess what caused this issue
The parser code for TLS clientHello messages in FRP.
Checklist:
@fatedier commented on GitHub (Jul 30, 2021):
Can't reproduce in my local environment.
@AlainLam commented on GitHub (Jul 30, 2021):
I can recreate this, version 0.37.0 and 0.34.3.
It seems that this issue occurs on edge and chrome, and works well on Firefox and IE.
The error message same this:
get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908].
I've always wondered if it was my config error, but it works fine on Firefox.
@mao13820 commented on GitHub (Jul 30, 2021):
Me too, same problem, my version is 0.21.
When I used FRP for HTTPS reverse proxy, certain domains cannot be accessed by HTTPS with chrome 92.0.4515.107 for windows, throwing out ERROR_CONNECTION_RESET error message.
I have also tested the newest chrome 93.0.4577.15 beta for android and got the same problem (I have not test newest chrome for android yet).
I tested again with chrome 91.0.4472.57 for windows and chrome 91.0.4472 for android but there is no problem for accessing the https website. It seems FRP have compatibility issues with the newest chrome.
I use the newest chrome for windows and take the following test.
Same website, same domain with http method, it can work well.
Same website, changing to another domain with https method, it can work well.
Same website, same domain with https method without FRP, it can work well.
Very strange problem
@mao13820 commented on GitHub (Jul 30, 2021):
I have also tested on edge and ie. It works perfect on IE but failed on edge (version 92.0.902.55)
@fatedier commented on GitHub (Jul 30, 2021):
I tested it on my macos chrome 92 and it success. Does anyone run into this problem using windows?
@mao13820 commented on GitHub (Jul 30, 2021):
I tested it on windows and android, you can see the part I wrote above
@ProfFan commented on GitHub (Jul 30, 2021):
I temporarily downgraded to Chromium 91 and it works. I can see if I can get some packet caps.
@ProfFan commented on GitHub (Jul 30, 2021):
The clientHello that works:
The one doesn't (Chrome 92):
@ProfFan commented on GitHub (Jul 30, 2021):
@fatedier
Line 56, in
https.go.This is the culprit I think.
BTW the parser seriously looks very unpolished. Maybe a mature parsing library should be used instead.
@ProfFan commented on GitHub (Jul 30, 2021):
Fixed in #2502 @fatedier
@mao13820 commented on GitHub (Jul 30, 2021):
OMG, that works! Brilliant job! Thank you so much. The length change of the hello message from 512 to 1488 so it was out of buffer. I'm not sure I understand this bug right?
@ProfFan commented on GitHub (Jul 30, 2021):
The buffer is too small, and Go is a secure language (pun intended) :)
@ProfFan commented on GitHub (Jul 31, 2021):
@fatedier Could you review and merge #2502 ?
@fatedier commented on GitHub (Aug 1, 2021):
@ProfFan It was fixed in #2504 by refactoring vhost codes for HTTPS. You can validate if it works in your scenario.
@ProfFan commented on GitHub (Aug 1, 2021):
Ping @mao13820 @AlainLam for testing