[hybi] Proposal for a clean way to detect non-HTTP compliant transparent proxies

[Willy Tarreau <[e-mail]>]

I've just thought about a way to fix the initial handshake so that it
works with proper HTTP-compliant implementations but still fails through
non-compliant transparent proxies.

Let's have the client send the initial handshake request to the server.
This handshake is only made of HTTP headers. The client completes the
request with "Connection: close" so that a transparent intermediate
does not wait for a possible second request in case it does not understand
the upgrade response :

   GET /xxxx HTTP/1.1
   Upgrade: WebSocket
   Connection: close
   ... ws headers ...
   ...
   \r\n

The server will send :

   HTTP/1.1 101 Swithing protocols
   Upgrade: WebSocket
   Content-length: 0
   Connection: close
   ... ws headers ...
   ...
   \r\n
   any-form-of-hello-message (eg: the server's protocol version)

That way, if a transparent proxy does not have explicit support for 101,
it will only forward the headers with an empty body (CL: 0) and close the
connection towards the client.

The client then gets an empty response without the in-protocol HELLO
message and knows that an intermediate is in the way and is not compatible.

The only way for such a response to pass unmolested to the client is
for intermediates to have a proper understanding of the 101/Upgrade
mechanism which implies that any data after the empty line is to be
tunnelled, despite Content-length: 0.

It also has the nice advantage of being compatible with HTTP, which
means that ISPs making use of transparent proxies will have no problem
adding reliable cache-bypass rule which relies on the Upgrade: header.

Any thoughts ?

Willy