WebSocket improvements: Haproxy support for hixie76

[majek]

In order to get Hixie76 through a HAProxy loadbalancer the server must send response headers before the request nonce is received. In other words: before haproxy will send extra data from the client it expects the server to respond to the header. Current cowboy implementation does not support that. Example (nc localhost 8080 and paste):

GET /echo/000/afc7f9ea-5b6f-4c94-bc2e-4fe7f5a74241/websocket HTTP/1.1
Host: localhost:8080
Accept-Encoding: identity
Origin: http://localhost:8080
Connection: Upgrade
Upgrade: WebSocket
Sec-WebSocket-Key2: 12998 5 Y3 1  .P00
Sec-WebSocket-Key1: 4 @1  46546xW%0l 1 5

Result: cowboy waits.
Expected result: response headers.
How to trigger expected result: type eight more bytes and press enter.

[essen]

Thanks for the report! Can you make one bug report per issue though? It'll be easier to discuss them.

[essen]

Thanks.

Yes hixie-76 is a huge problem for proxies. Not sure how much I should send back at that point though? How are the other websocket implementations doing here?

[majek]

I'm not talking about proxies. I'm talking about haproxy loadbalancer. Other implementations are mostly ignoring the problem and do not work behind loadbalancers.

Relevant discussion: https://github.com/miksago/node-websocket-server/issues/29

Fix for HAProxy? No change is needed to HAProxy. The WebSocket server that sits behind HAProxy needs only send the 101 response before receiving the binary nonce from the client. HAProxy will go ahead and forward the binary nonce upstream once the 101 response has validated that the server wishes to receive it, and then your WebSocket server can generate and transmit the rest of the handshake response.

So, don't wait for nonce, send 101 back just after request headers were received and then block and wait for nonce.

[essen]

Haproxy is a proxy by all meaning of the term. :)

But yeah if sending the Status-line is all that's needed it should be an easy change. I'll do that one this week.

[majek]

I would say status line and the headers, but that needs investigating.

[essen]

Can't send all the headers though, we can't calculate the key.

[majek]

In hixie76 there is no key in response headers. The nonce is returned after the headers, src:

GET /demo HTTP/1.1
Upgrade: WebSocket
Connection: Upgrade
Host: example.com
Origin: http://example.com
Sec-WebSocket-Key1: 4 @1  46546xW%0l 1 5
Sec-WebSocket-Key2: 12998 5 Y3 1  .P00

^n:ds[4U

HTTP/1.1 101 WebSocket Protocol Handshake
Upgrade: WebSocket
Connection: Upgrade
Sec-WebSocket-Origin: http://example.com
Sec-WebSocket-Location: ws://example.com/demo
Sec-WebSocket-Protocol: sample

8jKS'y:G*Co,Wxa-

[essen]

Oh right. Then it's not a problem. It'll even be a little cleaner to do it like this.

[essen]

Should be done in 70d28ff. Tell me if that works for you.

[majek]

Works fine. Thanks. One comment: on timeout, when headers were given but not nonce yet, an error appears:

=ERROR REPORT==== 20-Oct-2011::13:45:23 ===
Error in process <0.1339.0> with exit value: {{badmatch,{error,timeout}},[{cowboy_http_websocket,websocket_handshake,3}]}

I'm not sure what should happen in such case. Is this error desired?

[essen]

It's not undesired. A proper error should probably be sent instead, but there's other points where the handshake can fail by crashing so I suppose we can take a look at that later, unless there's an implementation having an issue.

I'm doing things on an implementation basis for websocket code at the moment, until the drafts get completed.

[essen]

If something else goes bad open a new ticket, thanks.