Enable secure websocket connection behind TLS-terminating reverse proxy

[flex-seongbok]

In reverse proxy environment that supports TLS-terminating(ex. AWS ELB) wss:// connection throws IOException("SSL connection wanted by client.")

This should only checked when using TLS not websocket

[scottf]

Did you see that we specifically turned off upgradeRequired for websocket? So this won't work. Maybe the check should just be upgradeRequired Will have to think about this. Do you have a repeatable example or unit test for this? Would our new tls first connection option help your situation?

[scottf]

Also please verify your commits, it's a requirement for contributing.

[flex-seongbok]

Did you see that we specifically turned off upgradeRequired for websocket? So this won't work. Maybe the check should just be upgradeRequired Will have to think about this. Do you have a repeatable example or unit test for this? Would our new tls first connection option help your situation?

Thanks for feedback. Yes upgradeRequired is false when websocket protocol used, but secure websocket(wss://) makes isTLSRequired true so line:572 condition is also true. Our environment is under reverse-proxy that uses TLS-terminating which means serverInfo.isTLSRequired() is false.

also i tried tls first option but it throws exception and not makes sense when using secure websocket as mentioned in comment We are already communicating over "https" websocket, so do NOT try to upgrade to secure.

[flex-seongbok]

Changed if condition statement.

Tried to making test but it seems not easy on unit test because this needs reverse proxy to test. Is it okay to use testcontainer to setup nginx or tomcat for reverse proxy?

Or i can make repeatable example using docker compose

[scottf]

Tried to making test but it seems not easy on unit test because this needs reverse proxy to test. Is it okay to use testcontainer to setup nginx or tomcat for reverse proxy? Or i can make repeatable example using docker compose

Let's make a stand alone project for this and I will figure out how to get it integrated into our system. I can see it ending up as a project in the integration-tests repo the https://github.com/nats-io/integration-tests#integration-tests

[flex-seongbok]

Tried to making test but it seems not easy on unit test because this needs reverse proxy to test. Is it okay to use testcontainer to setup nginx or tomcat for reverse proxy? Or i can make repeatable example using docker compose

Let's make a stand alone project for this and I will figure out how to get it integrated into our system. I can see it ending up as a project in the integration-tests repo the https://github.com/nats-io/integration-tests#integration-tests

Good. I will make a working integration test code using testcontainer and open PR on that repo. I think it might take a week roughly.

[flex-seongbok]

Tried to making test but it seems not easy on unit test because this needs reverse proxy to test. Is it okay to use testcontainer to setup nginx or tomcat for reverse proxy? Or i can make repeatable example using docker compose

Let's make a stand alone project for this and I will figure out how to get it integrated into our system. I can see it ending up as a project in the integration-tests repo the https://github.com/nats-io/integration-tests#integration-tests

Good. I will make a working integration test code using testcontainer and open PR on that repo. I think it might take a week roughly.

I made a integration test on https://github.com/flex-team/nats.java/pull/1 Tried on integration-tests repo but i needed TestSSLUtils.

[flex-seongbok]

@scottf Hi, did you checked integration test PR? How do you think?

[OpenX-Public]

@scottf Hi, i have same problem. Do you have any plans to fix this?

[OpenX-Public]

@flex-seongbok Hi, how did you fix this problem?

[scottf]

@OpenX-Public can you please try again using the server feature handshake_first and the client option setting of tlsFirst() I'm also closing this as any fix would have to be re-written against the latest.

[OpenX-Public]

@scottf hello. You guided me to use the handshake_first option on Nats Server, but if I use a TLS-terminating reverse proxy, the TLS connection will only happen between java-nats -> LB, and not between LB -> Nats Server.

That’s why it’s a bit weird to use the handshake_first option on Nats Server. Because Nats Server will never make a TLS connection.

[flex-seongbok]

@flex-seongbok Hi, how did you fix this problem?

I couldn't fix this problem. I was doing PoC of NATS and this keep blocks me using NATS.

[flex-seongbok]

@OpenX-Public can you please try again using the server feature handshake_first and the client option setting of tlsFirst() I'm also closing this as any fix would have to be re-written against the latest.

@scottf I tried below server option and tlsFirst on client but it didn't worked.

"leafnodes": {
  "tls": {
    "handshake_first": true
  }
}

There was a error log on nats-server

wid:39 - Client parser ERROR, state=0, i=0: proto='...'

We are experiencing this issue on reverse-proxy with TLS-termination environment. Client <--WSS(TLS)--> Proxy <--WS(PLAIN)--> NATS Mismatch of TLS configuration should be normal in this environment