1

我正在尝试为 apache2 后面的花设置反向代理,如本文Celery Flower Security in Production 中所述。

来自花的 Https 页面加载可以通过代理正常工作,但它打开以更新仪表板的 websocket 却没有 - ssl 握手失败并且没有返回响应。我在 ubuntu 12.04 上使用 apache2 2.2.22,并且我通过常用的补丁添加了 mod_proxy_wstunnel,以便通过隧道连接 websocket。我在 127.0.0.1:5555 上通过 supervisord 运行花。

这是我的 apache .conf 的相关部分

SSLProxyEngine On
SSLProxyVerify none

ProxyRequests Off
ProxyPass /update-dashboard wss://127.0.0.1:5555/update-dashboard
ProxyPassReverse /update-dashboard wss://127.0.0.1:5555/update-dashboard

ProxyPass / http://127.0.0.1:5555/
ProxyPassReverse / http://127.0.0.1:5555/
<Proxy  *>
Order deny,allow
Allow from all
</Proxy>

这是最终超时后的请求

"GET /update-dashboard HTTP/1.1"
 500 419 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,     like Gecko) Chrome/43.0.2357.124 Safari/537.36"

这是 apache2 错误日志的输出

[Fri Jun 12 16:44:28 2015] [info] Initial (No.1) HTTPS request received for child 195 (server demoflower.eatthismuch.com:80)
[Fri Jun 12 16:44:28 2015] [debug] mod_proxy_wstunnel.c(377): [client 71.189.228.118] canonicalising URL //127.0.0.1:5555/update-dashboard
[Fri Jun 12 16:44:28 2015] [debug] proxy_util.c(1509): [client 71.189.228.118] proxy: wss: found worker wss://127.0.0.1:5555/update-dashboard for wss://127.0.0.1:5555/update-dashboard
[Fri Jun 12 16:44:28 2015] [debug] mod_proxy.c(1020): Running scheme wss handler (attempt 0)
[Fri Jun 12 16:44:28 2015] [debug] mod_proxy_http.c(1978): proxy: HTTP: declining URL wss://127.0.0.1:5555/update-dashboard
[Fri Jun 12 16:44:28 2015] [debug] mod_proxy_wstunnel.c(659): [client 71.189.228.118] AH02451: serving URL wss://127.0.0.1:5555/update-dashboard
[Fri Jun 12 16:44:28 2015] [debug] proxy_util.c(2014): proxy: WSS: has acquired connection for (127.0.0.1)
[Fri Jun 12 16:44:28 2015] [debug] proxy_util.c(2070): proxy: connecting wss://127.0.0.1:5555/update-dashboard to 127.0.0.1:5555
[Fri Jun 12 16:44:28 2015] [debug] proxy_util.c(2196): proxy: connected /update-dashboard to 127.0.0.1:5555
[Fri Jun 12 16:44:28 2015] [debug] proxy_util.c(2447): proxy: WSS: fam 2 socket created to connect to 127.0.0.1
[Fri Jun 12 16:44:28 2015] [debug] proxy_util.c(2579): proxy: WSS: connection complete to 127.0.0.1:5555 (127.0.0.1)
[Fri Jun 12 16:44:28 2015] [info] [client 127.0.0.1] Connection to child 0 established (server demoflower.eatthismuch.com:80)
[Fri Jun 12 16:44:28 2015] [info] Seeding PRNG with 656 bytes of entropy
[Fri Jun 12 16:44:28 2015] [debug] mod_proxy_wstunnel.c(518): [client 71.189.228.118] sending request
[Fri Jun 12 16:44:28 2015] [debug] ssl_engine_kernel.c(1819): OpenSSL: Handshake: start
[Fri Jun 12 16:44:28 2015] [debug] ssl_engine_kernel.c(1827): OpenSSL: Loop: before/connect initialization
[Fri Jun 12 16:44:28 2015] [debug] ssl_engine_kernel.c(1827): OpenSSL: Loop: unknown state
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#7f0b6c001650 [mem: 7f0b68006f83]
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_kernel.c(1837): OpenSSL: Write: SSL negotiation finished successfully
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#7f0b60001650 [mem: 7f0b60006f83]
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_kernel.c(1837): OpenSSL: Write: SSL negotiation finished successfully
[Fri Jun 12 13:44:32 2015] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#7f0b70001650 [mem: 7f0b70006f83]
[Fri Jun 12 13:44:32 2015] [debug] ssl_engine_kernel.c(1837): OpenSSL: Write: SSL negotiation finished successfully
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#7f0b6c001650 [mem: 7f0b70006f83]
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_kernel.c(1837): OpenSSL: Write: SSL negotiation finished successfully
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#7f0b60001650 [mem: 7f0b70006f83]
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_kernel.c(1837): OpenSSL: Write: SSL negotiation finished successfully
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#7f0b64001650 [mem: 7f0b70006f83]
[Fri Jun 12 16:44:32 2015] [debug] ssl_engine_kernel.c(1837): OpenSSL: Write: SSL negotiation finished successfully

有什么想法可能会出错吗?我尝试了很多不同的 apache2 设置都无济于事。谢谢阅读!

4

1 回答 1

0

我有一个类似的 apache 配置文件,但它无法正常工作,我看到了 OpenSSL 错误 5 bytes expected 消息。

我添加了以下内容:

ProxyPreserveHost On

现在应用程序正常工作。我仍然看到 OpenSSL 错误,但它似乎不是问题。

请注意,拒绝 http URL 只是按mod_proxy指定顺序尝试所有较低级别的代理模块直到找到匹配的一个正常操作。

此外,我使用ws:协议不wss:与 Tomcat 8 后端对话。

于 2016-05-19T05:34:32.653 回答