{"action":"created","issue":{"url":"https://api.github.com/repos/nghttp2/nghttp2/issues/1265","repository_url":"https://api.github.com/repos/nghttp2/nghttp2","labels_url":"https://api.github.com/repos/nghttp2/nghttp2/issues/1265/labels{/name}","comments_url":"https://api.github.com/repos/nghttp2/nghttp2/issues/1265/comments","events_url":"https://api.github.com/repos/nghttp2/nghttp2/issues/1265/events","html_url":"https://github.com/nghttp2/nghttp2/issues/1265","id":382211181,"node_id":"MDU6SXNzdWUzODIyMTExODE=","number":1265,"title":"Proxy CONNECT aborted","user":{"login":"zdenek-pizl","id":45171040,"node_id":"MDQ6VXNlcjQ1MTcxMDQw","avatar_url":"https://avatars2.githubusercontent.com/u/45171040?v=4","gravatar_id":"","url":"https://api.github.com/users/zdenek-pizl","html_url":"https://github.com/zdenek-pizl","followers_url":"https://api.github.com/users/zdenek-pizl/followers","following_url":"https://api.github.com/users/zdenek-pizl/following{/other_user}","gists_url":"https://api.github.com/users/zdenek-pizl/gists{/gist_id}","starred_url":"https://api.github.com/users/zdenek-pizl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zdenek-pizl/subscriptions","organizations_url":"https://api.github.com/users/zdenek-pizl/orgs","repos_url":"https://api.github.com/users/zdenek-pizl/repos","events_url":"https://api.github.com/users/zdenek-pizl/events{/privacy}","received_events_url":"https://api.github.com/users/zdenek-pizl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-11-19T13:19:39Z","updated_at":"2018-11-26T15:20:49Z","closed_at":null,"author_association":"NONE","body":"Greetings, \r\n\r\nI am facing problem described bellow when trying to fetch an URI through HTTP/2 fwd proxy. Configuration of  nghttpx is:\r\n\r\n*Configuration*\r\n```\r\nhttp2-proxy=yes\r\n\r\nfrontend=<public IP>,8443;sni-fwd\r\nbackend=127.0.0.1,8080  # backend is squid cache\r\n\r\nadd-x-forwarded-for=yes\r\n\r\nnpn-list=h2,h2-16,h2-14,http/1.1\r\n\r\nprivate-key-file=/opt/cert-key.prv.pem\r\ncertificate-file=/opt/cert.crt.pem\r\n```\r\n\r\n*Action*\r\n\r\nWhen issuing a curl command:\r\n\r\n```\r\ncurl -v -v -SIL --proxy https://http2-proxy.company.com:8443 --proxy-user username:password https://www.google.com/\r\n```\r\n\r\n*Problematic results*\r\n\r\nCurl output:\r\n```\r\n[root@server ~]# curl -v -v -SIL --http2 --proxy https://http2-proxy.company.com:8443 --proxy-user username:password https://www.google.com/\r\nWarning: -v, --verbose overrides an earlier trace/verbose option\r\n* Added http2-proxy.company.com:8443:77.234.46.184 to DNS cache\r\n* Hostname http2-proxy.company.com was found in DNS cache\r\n*   Trying 77.234.46.184...\r\n* TCP_NODELAY set\r\n* Connected to http2-proxy.company.com (1.2.3.4) port 8443 (#0)\r\n* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH\r\n* successfully set certificate verify locations:\r\n*   CAfile: /etc/pki/tls/certs/ca-bundle.crt\r\n  CApath: none\r\n\r\nSSL info removed \r\n\r\n* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384\r\n* Proxy certificate:\r\n*  subject: C=XX; ST=YYYY; L=YYYY; O=Company LLC.; OU=IT Crowd; CN=*.company.com\r\n\r\nSSL Certificate info removed \r\n\r\n*  SSL certificate verify ok.\r\n* allocate connect buffer!\r\n* Establish HTTP proxy tunnel to www.google.com:443\r\n* Proxy auth using Basic with user 'username'\r\n> CONNECT www.google.com:443 HTTP/1.1\r\n> Host: www.google.com:443\r\n> Proxy-Authorization: Basic aD____removed_____A==\r\n> User-Agent: curl/7.62.0\r\n> Proxy-Connection: Keep-Alive\r\n> \r\n* TLSv1.2 (IN), TLS alert, close notify (256):\r\n* Proxy CONNECT aborted\r\n* CONNECT phase completed!\r\n* Closing connection 0\r\n* TLSv1.2 (OUT), TLS alert, close notify (256):\r\ncurl: (56) Proxy CONNECT aborted\r\n```\r\n\r\nRelevant lines from /var/log/nghttpx/nghttpx.log:\r\n```\r\n2018-11-19T14:01:42.862+01:00 815172 815172 4702f076 INFO (shrpx_client_handler.cc:194) [CLIENT_HANDLER:0x1776590] SSL/TLS handshake completed\r\n2018-11-19T14:01:42.862+01:00 815172 815172 4702f076 INFO (shrpx_client_handler.cc:565) [CLIENT_HANDLER:0x1776590] The negotiated next protocol: h2\r\n2018-11-19T14:01:42.863+01:00 815172 815172 4702f076 INFO (shrpx_client_handler.cc:312) [CLIENT_HANDLER:0x1776590] invalid client connection header\r\n2018-11-19T14:01:42.863+01:00 815172 815172 4702f076 INFO (shrpx_client_handler.cc:492) [CLIENT_HANDLER:0x1776590] Deleting\r\n2018-11-19T14:01:42.863+01:00 815172 815172 4702f076 INFO (shrpx_client_handler.cc:515) [CLIENT_HANDLER:0x1776590] Deleted\r\n```\r\n\r\nDo you have any clue what's wrong? Thank you, .zp."},"comment":{"url":"https://api.github.com/repos/nghttp2/nghttp2/issues/comments/441676121","html_url":"https://github.com/nghttp2/nghttp2/issues/1265#issuecomment-441676121","issue_url":"https://api.github.com/repos/nghttp2/nghttp2/issues/1265","id":441676121,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTY3NjEyMQ==","user":{"login":"zdenek-pizl","id":45171040,"node_id":"MDQ6VXNlcjQ1MTcxMDQw","avatar_url":"https://avatars2.githubusercontent.com/u/45171040?v=4","gravatar_id":"","url":"https://api.github.com/users/zdenek-pizl","html_url":"https://github.com/zdenek-pizl","followers_url":"https://api.github.com/users/zdenek-pizl/followers","following_url":"https://api.github.com/users/zdenek-pizl/following{/other_user}","gists_url":"https://api.github.com/users/zdenek-pizl/gists{/gist_id}","starred_url":"https://api.github.com/users/zdenek-pizl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zdenek-pizl/subscriptions","organizations_url":"https://api.github.com/users/zdenek-pizl/orgs","repos_url":"https://api.github.com/users/zdenek-pizl/repos","events_url":"https://api.github.com/users/zdenek-pizl/events{/privacy}","received_events_url":"https://api.github.com/users/zdenek-pizl/received_events","type":"User","site_admin":false},"created_at":"2018-11-26T15:20:49Z","updated_at":"2018-11-26T15:20:49Z","author_association":"NONE","body":"yes, curl does support HTTP/2.\r\n\r\n```\r\ncurl 7.62.0 (x86_64-redhat-linux-gnu) libcurl/7.62.0 NSS/3.36 zlib/1.2.7 libpsl/0.7.0 (+libicu/50.1.2) libssh2/1.4.3 nghttp2/1.31.1\r\nRelease-Date: 2018-10-31\r\nProtocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp \r\nFeatures: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz HTTP2 UnixSockets HTTPS-proxy PSL Metalink \r\n```"}}
{"actor":{"display_login":"zdenek-pizl"}}