Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Testing a socket.io application in the PROD environment for the first time, we found that while the xhr-polling transport (Ajax long polling) works, the websocket transport does not.

Looking at the data transmitted using Fiddler, I can see that the

  • UPGRADE happens and
  • the first message from the server (5 bytes gross) arrive at the client.
  • The client then sends a couple of messages to the server, which normally result in server->client messages

But those server->client messages never arrive (I'm not even sure if the client->server messages arrive on the server side). Eventually (after about 6 seconds), Fiddler reports a

Read from Server failed...

and a new connection gets established, as unsuccessful as the first one.

Our setup looks something like this:

Internet -> Firewall -> BIG-IP 3600 (terminates SSL) -> Node.js server

I'd think the firewall could not be the culprit, as all it sees is an SSL encrypted stream of data, and with a the non-websocket transport it does works. I also tried the match origin protocol option in socket.io, without success.

Unfortunately I cannot freely play in that environment, so I tried to replicate the issue in my DEV environment, without success. I created a software SSL proxy (using node.js's http-proxy), which should work similar to BIG-IP. But going through that SSL proxy with websockets works just fine.

Could this a be an issue with the BIG-IP? Configuration? What else could it be?

share|improve this question
    
As of December of 2012, BIG-IP doesn't support SSL offload of WebSocket traffic. How are you managing to do this? –  David Schwartz Jan 28 '13 at 7:58
    
Do you have any link where this issue is addressed? And maybe an explanation on why SSL offloading WebSockets would be an issue? –  Eugene Beresovksy Jan 28 '13 at 8:05
    
It's a direct quote when asked if it was supported. They said it was not and to submit a feature request through their support channel. The issue is that it thinks it's HTTP and doesn't recognize when the direction of flow changes. –  David Schwartz Jan 28 '13 at 8:07
    
Interesting. Wouldn't that also affect other transports like chunked http transfer, as used by socket.io's htmlfile, to do streaming (works only downstream: server -> client) –  Eugene Beresovksy Jan 28 '13 at 8:12
    
I assume it understands chunked transfer. –  David Schwartz Jan 28 '13 at 8:12
show 1 more comment

1 Answer

up vote 1 down vote accepted

As of December of 2012, BIG-IP doesn't support SSL offload of WebSocket traffic. Because the requests look like HTTP, they're processed by an HTTP engine that doesn't understand when the direction of flow changes for a WebSocket connection. Don't use SSL offload with WebSocket connections until it's officially supported.

share|improve this answer
    
Couldn't something like configuring ELB on TCP/SSL, instead of HTTP/HTTPS, makes the trick with WebSockets be done with BIG-IPs? –  Eugene Beresovksy Jan 29 '13 at 5:48
    
I would think so. –  David Schwartz Jan 29 '13 at 15:25
    
Any update on this? Thanks. –  NullOrEmpty Jan 23 at 11:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.