[GH-ISSUE #2500] FRP does not work with latest Chromium (likely due to changes in handshake) #1987

Closed
opened 2026-05-05 13:16:56 -06:00 by gitea-mirror · 15 comments
Owner

Originally created by @ProfFan on GitHub (Jul 29, 2021).
Original GitHub issue: https://github.com/fatedier/frp/issues/2500

[REQUIRED] hat version of frp are you using

Version: 0.37

[REQUIRED] What operating system and processor architecture are you using
OS: Ubuntu 20.04
CPU architecture: amd64

[REQUIRED] description of errors

"ERROR_CONNECTION_RESET" when trying to visit a website served using FRP with HTTPS (TLS).
Error log shows that the clientHello is sent and then the server returns TCP reset.

However, any other browser than Chromium (92.0.4515 currently) works fine.

confile

log file

Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [I] [proxy.go:162] [] [] get a user connection [:48712]
Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [control.go:248] [] get work connection from pool
Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [proxy.go:103] [] [] get a new work connection: [:44742]
Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [proxy.go:273] [] [] join connections, workConn(l[:7000] r[:44742]) userConn(l[:443] r[:48712])
Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [control.go:219] [] new work connection registered
Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [proxy.go:283] [] [bitwarden] join connections closed
Jul 29 23:50:03 us-atl frps[1384]: 2021/07/29 23:50:03 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910]
Jul 29 23:50:03 us-atl frps[1384]: 2021/07/29 23:50:03 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908]
Jul 29 23:50:07 us-atl frps[1384]: 2021/07/29 23:50:07 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910]
Jul 29 23:50:07 us-atl frps[1384]: 2021/07/29 23:50:07 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908]
Jul 29 23:50:08 us-atl frps[1384]: 2021/07/29 23:50:08 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910]
Jul 29 23:50:08 us-atl frps[1384]: 2021/07/29 23:50:08 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908]
Jul 29 23:50:09 us-atl frps[1384]: 2021/07/29 23:50:09 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910]
Jul 29 23:50:09 us-atl frps[1384]: 2021/07/29 23:50:09 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908]
Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [I] [proxy.go:162] [] [bitwarden] get a user connection [:48712]

Supplementary information

Can you guess what caused this issue

The parser code for TLS clientHello messages in FRP.

Checklist:

  • I included all information required in the sections above
  • I made sure there are no duplicates of this report (Use Search)
Originally created by @ProfFan on GitHub (Jul 29, 2021). Original GitHub issue: https://github.com/fatedier/frp/issues/2500 <!-- From Chinese to English by machine translation, welcome to revise and polish. --> <!-- ⚠️⚠️ Incomplete reports will be marked as invalid, and closed, with few exceptions ⚠️⚠️ --> <!-- in addition, please use search well so that the same solution can be found in the feedback, we will close it directly --> <!-- for convenience of differentiation, use FRPS or FRPC to refer to the FRP server or client --> **[REQUIRED] hat version of frp are you using** <!-- Use ./frpc -v or ./frps -v --> Version: 0.37 **[REQUIRED] What operating system and processor architecture are you using** OS: Ubuntu 20.04 CPU architecture: amd64 **[REQUIRED] description of errors** "ERROR_CONNECTION_RESET" when trying to visit a website served using FRP with HTTPS (TLS). Error log shows that the clientHello is sent and then the server returns TCP reset. However, any other browser than Chromium (92.0.4515 currently) works fine. **confile** <!-- Please pay attention to hiding the token, server_addr and other privacy information --> **log file** ``` Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [I] [proxy.go:162] [] [] get a user connection [:48712] Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [control.go:248] [] get work connection from pool Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [proxy.go:103] [] [] get a new work connection: [:44742] Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [proxy.go:273] [] [] join connections, workConn(l[:7000] r[:44742]) userConn(l[:443] r[:48712]) Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [control.go:219] [] new work connection registered Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [D] [proxy.go:283] [] [bitwarden] join connections closed Jul 29 23:50:03 us-atl frps[1384]: 2021/07/29 23:50:03 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910] Jul 29 23:50:03 us-atl frps[1384]: 2021/07/29 23:50:03 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908] Jul 29 23:50:07 us-atl frps[1384]: 2021/07/29 23:50:07 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910] Jul 29 23:50:07 us-atl frps[1384]: 2021/07/29 23:50:07 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908] Jul 29 23:50:08 us-atl frps[1384]: 2021/07/29 23:50:08 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910] Jul 29 23:50:08 us-atl frps[1384]: 2021/07/29 23:50:08 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908] Jul 29 23:50:09 us-atl frps[1384]: 2021/07/29 23:50:09 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1375] is not equal to dataLen[910] Jul 29 23:50:09 us-atl frps[1384]: 2021/07/29 23:50:09 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908] Jul 29 23:50:00 us-atl frps[1384]: 2021/07/29 23:50:00 [I] [proxy.go:162] [] [bitwarden] get a user connection [:48712] ``` **Supplementary information** **Can you guess what caused this issue** The parser code for TLS clientHello messages in FRP. **Checklist**: <!--- Make sure you've completed the following steps (put an "X" between of brackets): --> - [X] I included all information required in the sections above - [X] I made sure there are no duplicates of this report [(Use Search)](https://github.com/fatedier/frp/issues?q=is%3Aissue)
Author
Owner

@fatedier commented on GitHub (Jul 30, 2021):

Can't reproduce in my local environment.

<!-- gh-comment-id:889598770 --> @fatedier commented on GitHub (Jul 30, 2021): Can't reproduce in my local environment.
Author
Owner

@AlainLam commented on GitHub (Jul 30, 2021):

I can recreate this, version 0.37.0 and 0.34.3.
It seems that this issue occurs on edge and chrome, and works well on Firefox and IE.

The error message same this:
get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908].

I've always wondered if it was my config error, but it works fine on Firefox.

<!-- gh-comment-id:889687598 --> @AlainLam commented on GitHub (Jul 30, 2021): I can recreate this, version 0.37.0 and 0.34.3. It seems that this issue occurs on edge and chrome, and works well on Firefox and IE. The error message same this: get hostname from http/https request error: readHandshake: extensionsLen[1377] is not equal to dataLen[908]. I've always wondered if it was my config error, but it works fine on Firefox.
Author
Owner

@mao13820 commented on GitHub (Jul 30, 2021):

Me too, same problem, my version is 0.21.

When I used FRP for HTTPS reverse proxy, certain domains cannot be accessed by HTTPS with chrome 92.0.4515.107 for windows, throwing out ERROR_CONNECTION_RESET error message.

I have also tested the newest chrome 93.0.4577.15 beta for android and got the same problem (I have not test newest chrome for android yet).

I tested again with chrome 91.0.4472.57 for windows and chrome 91.0.4472 for android but there is no problem for accessing the https website. It seems FRP have compatibility issues with the newest chrome.

I use the newest chrome for windows and take the following test.
Same website, same domain with http method, it can work well.
Same website, changing to another domain with https method, it can work well.
Same website, same domain with https method without FRP, it can work well.

Very strange problem

<!-- gh-comment-id:889776061 --> @mao13820 commented on GitHub (Jul 30, 2021): Me too, same problem, my version is 0.21. When I used FRP for HTTPS reverse proxy, certain domains cannot be accessed by HTTPS with **chrome 92.0.4515.107** for windows, throwing out ERROR_CONNECTION_RESET error message. I have also tested the **newest chrome 93.0.4577.15 beta** for android and got the same problem (I have not test newest chrome for android yet). I tested again with **chrome 91.0.4472.57** for windows and **chrome 91.0.4472 for android** but there is no problem for accessing the https website. It seems FRP have compatibility issues with the newest chrome. I use the newest chrome for windows and take the following test. Same website, same domain with http method, it can work well. Same website, changing to another domain with https method, it can work well. Same website, same domain with https method **without FRP**, it can work well. Very strange problem
Author
Owner

@mao13820 commented on GitHub (Jul 30, 2021):

I have also tested on edge and ie. It works perfect on IE but failed on edge (version 92.0.902.55)

<!-- gh-comment-id:889777738 --> @mao13820 commented on GitHub (Jul 30, 2021): I have also tested on edge and ie. It works perfect on IE but failed on edge (version 92.0.902.55)
Author
Owner

@fatedier commented on GitHub (Jul 30, 2021):

I tested it on my macos chrome 92 and it success. Does anyone run into this problem using windows?

<!-- gh-comment-id:889800070 --> @fatedier commented on GitHub (Jul 30, 2021): I tested it on my macos chrome 92 and it success. Does anyone run into this problem using windows?
Author
Owner

@mao13820 commented on GitHub (Jul 30, 2021):

I tested it on my macos chrome 92 and it success. Does anyone run into this problem using windows?

I tested it on windows and android, you can see the part I wrote above

<!-- gh-comment-id:889807402 --> @mao13820 commented on GitHub (Jul 30, 2021): > I tested it on my macos chrome 92 and it success. Does anyone run into this problem using windows? I tested it on windows and android, you can see the part I wrote above
Author
Owner

@ProfFan commented on GitHub (Jul 30, 2021):

I temporarily downgraded to Chromium 91 and it works. I can see if I can get some packet caps.

<!-- gh-comment-id:889897924 --> @ProfFan commented on GitHub (Jul 30, 2021): I temporarily downgraded to Chromium 91 and it works. I can see if I can get some packet caps.
Author
Owner

@ProfFan commented on GitHub (Jul 30, 2021):

The clientHello that works:

TLSv1.3 Record Layer: Handshake Protocol: Client Hello
    Content Type: Handshake (22)
    Version: TLS 1.0 (0x0301)
    Length: 512
    Handshake Protocol: Client Hello
        Handshake Type: Client Hello (1)
        Length: 508
        Version: TLS 1.2 (0x0303)
        Random: 
        Session ID Length: 32
        Session ID: 
        Cipher Suites Length: 32
        Cipher Suites (16 suites)
        Compression Methods Length: 1
        Compression Methods (1 method)
        Extensions Length: 403
        Extension: Reserved (GREASE) (len=0)
        Extension: server_name (len=16)
        Extension: extended_master_secret (len=0)
        Extension: renegotiation_info (len=1)
        Extension: supported_groups (len=10)
        Extension: ec_point_formats (len=2)
        Extension: session_ticket (len=0)
        Extension: application_layer_protocol_negotiation (len=14)
        Extension: status_request (len=5)
        Extension: signature_algorithms (len=18)
        Extension: signed_certificate_timestamp (len=0)
        Extension: key_share (len=43)
            Type: key_share (51)
            Length: 43
            Key Share extension
                Client Key Share Length: 41
                Key Share Entry: Group: Reserved (GREASE), Key Exchange length: 1
                Key Share Entry: Group: x25519, Key Exchange length: 32
        Extension: psk_key_exchange_modes (len=2)
        Extension: supported_versions (len=11)
        Extension: compress_certificate (len=3)
        Extension: Unknown type 17513 (len=5)
        Extension: Reserved (GREASE) (len=1)
        Extension: padding (len=121)
        Extension: pre_shared_key (len=75)

The one doesn't (Chrome 92):

TLSv1 Record Layer: Handshake Protocol: Client Hello
    Content Type: Handshake (22)
    Version: TLS 1.0 (0x0301)
    Length: 1488
    Handshake Protocol: Client Hello
        Handshake Type: Client Hello (1)
        Length: 1484
        Version: TLS 1.2 (0x0303)
        Random: 
        Session ID Length: 32
        Session ID: 
        Cipher Suites Length: 34
        Cipher Suites (17 suites)
        Compression Methods Length: 1
        Compression Methods (1 method)
        Extensions Length: 1377
        Extension: Reserved (GREASE) (len=0)
        Extension: server_name (len=16)
        Extension: extended_master_secret (len=0)
        Extension: renegotiation_info (len=1)
        Extension: supported_groups (len=12)
        Extension: ec_point_formats (len=2)
        Extension: session_ticket (len=0)
        Extension: application_layer_protocol_negotiation (len=14)
        Extension: status_request (len=5)
        Extension: signature_algorithms (len=20)
        Extension: signed_certificate_timestamp (len=0)
        Extension: key_share (len=1217)
            Type: key_share (51)
            Length: 1217
            Key Share extension
                Client Key Share Length: 1215
                Key Share Entry: Group: Reserved (GREASE), Key Exchange length: 1
                    Group: Reserved (GREASE) (27242)
                    Key Exchange Length: 1
                    Key Exchange: 00
                Key Share Entry: Group: Unknown (16696), Key Exchange length: 1170
                    Group: Unknown (16696)
                    Key Exchange Length: 1170
                    Key Exchange: …
                Key Share Entry: Group: x25519, Key Exchange length: 32
                    Group: x25519 (29)
                    Key Exchange Length: 32
                    Key Exchange: 
        Extension: psk_key_exchange_modes (len=2)
        Extension: supported_versions (len=11)
        Extension: compress_certificate (len=3)
        Extension: Unknown type 17513 (len=5)
        Extension: Reserved (GREASE) (len=1)
<!-- gh-comment-id:889904909 --> @ProfFan commented on GitHub (Jul 30, 2021): The clientHello that works: ``` TLSv1.3 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 512 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 508 Version: TLS 1.2 (0x0303) Random: Session ID Length: 32 Session ID: Cipher Suites Length: 32 Cipher Suites (16 suites) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 403 Extension: Reserved (GREASE) (len=0) Extension: server_name (len=16) Extension: extended_master_secret (len=0) Extension: renegotiation_info (len=1) Extension: supported_groups (len=10) Extension: ec_point_formats (len=2) Extension: session_ticket (len=0) Extension: application_layer_protocol_negotiation (len=14) Extension: status_request (len=5) Extension: signature_algorithms (len=18) Extension: signed_certificate_timestamp (len=0) Extension: key_share (len=43) Type: key_share (51) Length: 43 Key Share extension Client Key Share Length: 41 Key Share Entry: Group: Reserved (GREASE), Key Exchange length: 1 Key Share Entry: Group: x25519, Key Exchange length: 32 Extension: psk_key_exchange_modes (len=2) Extension: supported_versions (len=11) Extension: compress_certificate (len=3) Extension: Unknown type 17513 (len=5) Extension: Reserved (GREASE) (len=1) Extension: padding (len=121) Extension: pre_shared_key (len=75) ``` The one doesn't (Chrome 92): ``` TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 1488 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1484 Version: TLS 1.2 (0x0303) Random: Session ID Length: 32 Session ID: Cipher Suites Length: 34 Cipher Suites (17 suites) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 1377 Extension: Reserved (GREASE) (len=0) Extension: server_name (len=16) Extension: extended_master_secret (len=0) Extension: renegotiation_info (len=1) Extension: supported_groups (len=12) Extension: ec_point_formats (len=2) Extension: session_ticket (len=0) Extension: application_layer_protocol_negotiation (len=14) Extension: status_request (len=5) Extension: signature_algorithms (len=20) Extension: signed_certificate_timestamp (len=0) Extension: key_share (len=1217) Type: key_share (51) Length: 1217 Key Share extension Client Key Share Length: 1215 Key Share Entry: Group: Reserved (GREASE), Key Exchange length: 1 Group: Reserved (GREASE) (27242) Key Exchange Length: 1 Key Exchange: 00 Key Share Entry: Group: Unknown (16696), Key Exchange length: 1170 Group: Unknown (16696) Key Exchange Length: 1170 Key Exchange: … Key Share Entry: Group: x25519, Key Exchange length: 32 Group: x25519 (29) Key Exchange Length: 32 Key Exchange: Extension: psk_key_exchange_modes (len=2) Extension: supported_versions (len=11) Extension: compress_certificate (len=3) Extension: Unknown type 17513 (len=5) Extension: Reserved (GREASE) (len=1) ```
Author
Owner

@ProfFan commented on GitHub (Jul 30, 2021):

@fatedier

Line 56, in https.go.

data := pool.GetBuf(1024)

This is the culprit I think.

BTW the parser seriously looks very unpolished. Maybe a mature parsing library should be used instead.

<!-- gh-comment-id:889913410 --> @ProfFan commented on GitHub (Jul 30, 2021): @fatedier Line 56, in `https.go`. ``` data := pool.GetBuf(1024) ``` This is the culprit I think. BTW the parser seriously looks very unpolished. Maybe a mature parsing library should be used instead.
Author
Owner

@ProfFan commented on GitHub (Jul 30, 2021):

Fixed in #2502 @fatedier

<!-- gh-comment-id:889926226 --> @ProfFan commented on GitHub (Jul 30, 2021): Fixed in #2502 @fatedier
Author
Owner

@mao13820 commented on GitHub (Jul 30, 2021):

@fatedier

Line 56, in https.go.

data := pool.GetBuf(1024)

This is the culprit I think.

BTW the parser seriously looks very unpolished. Maybe a mature parsing library should be used instead.

OMG, that works! Brilliant job! Thank you so much. The length change of the hello message from 512 to 1488 so it was out of buffer. I'm not sure I understand this bug right?

<!-- gh-comment-id:889963687 --> @mao13820 commented on GitHub (Jul 30, 2021): > @fatedier > > Line 56, in `https.go`. > > ``` > data := pool.GetBuf(1024) > ``` > > This is the culprit I think. > > BTW the parser seriously looks very unpolished. Maybe a mature parsing library should be used instead. OMG, that works! Brilliant job! Thank you so much. The length change of the hello message from 512 to 1488 so it was out of buffer. I'm not sure I understand this bug right?
Author
Owner

@ProfFan commented on GitHub (Jul 30, 2021):

The buffer is too small, and Go is a secure language (pun intended) :)

<!-- gh-comment-id:890029294 --> @ProfFan commented on GitHub (Jul 30, 2021): The buffer is too small, and Go is a secure language (pun intended) :)
Author
Owner

@ProfFan commented on GitHub (Jul 31, 2021):

@fatedier Could you review and merge #2502 ?

<!-- gh-comment-id:890415083 --> @ProfFan commented on GitHub (Jul 31, 2021): @fatedier Could you review and merge #2502 ?
Author
Owner

@fatedier commented on GitHub (Aug 1, 2021):

@ProfFan It was fixed in #2504 by refactoring vhost codes for HTTPS. You can validate if it works in your scenario.

<!-- gh-comment-id:890523157 --> @fatedier commented on GitHub (Aug 1, 2021): @ProfFan It was fixed in #2504 by refactoring vhost codes for HTTPS. You can validate if it works in your scenario.
Author
Owner

@ProfFan commented on GitHub (Aug 1, 2021):

Ping @mao13820 @AlainLam for testing

<!-- gh-comment-id:890535362 --> @ProfFan commented on GitHub (Aug 1, 2021): Ping @mao13820 @AlainLam for testing
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/frp#1987
No description provided.