CODEWITHSUNDEEP
linuxapachehttp2okhttpalpn
Michał Gawin
Michał Gawin

Reputation: 21

Cannot establish HTTP/2 connection from OkHTTP/ALPN/Linux client with Apache HTTP

Problem which I have is Linux related, as it does not occur when the same HTTP2 client runs from Windows.

$java -jar -Xbootclasspath/p:alpn-boot-8.1.9.v20160720.jar SampleOkHttp-1.0.jar https://192.168.1.10:8080/simple.html

HTTP/2 preface communication:

Windows

>> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
>> 0x00000000     6 SETTINGS
>> 0x00000000     4 WINDOW_UPDATE
<< 0x00000000     6 SETTINGS
<< 0x00000000     4 WINDOW_UPDATE
>> 0x00000003    69 HEADERS       END_STREAM|END_HEADERS
>> 0x00000000     0 SETTINGS      ACK
<< 0x00000000     0 SETTINGS      ACK
<< 0x00000003    86 HEADERS       END_HEADERS
<< 0x00000003   220 DATA          END_STREAM
h2
<< 0x00000000     8 GOAWAY

Linux

>> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
>> 0x00000000     6 SETTINGS      
>> 0x00000000     4 WINDOW_UPDATE 
>> 0x00000003    69 HEADERS       END_STREAM|END_HEADERS
<< 0x00000000     6 SETTINGS      
>> 0x00000000     0 SETTINGS      ACK
<< 0x00000000     8 GOAWAY        
<< 0x00000000     4 WINDOW_UPDATE 
<< 0x00000000     8 GOAWAY

Tried with Ubuntu\Fedora, from local\remote machine, with different java\alpn versions. I'm still getting GOAWAY. Why Apache in case of Linux sends GOAWAY message? How to fix it?

Upvotes: 0

Views: 474

Answers (1)

Michał Gawin
Michał Gawin

Reputation: 21

Problem occurred during cipher key negotiation.

Windows with TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 had no issue.

Linux was rejected because tried to use TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.

I solved issue by providing acceptable cipher keys in Apache config file conf/extra/httpd-ssl.conf described here.

In short I changed default settings for SSLCipherSuite on:

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

Upvotes: 1

Related Questions