被控端 WebSocket 无法回传

[ReiSuzunami]

被控端报告 2023/06/25 04:32:24 Caught Exception: websocket: bad handshake

监控端使用了 Cloudflare CDN，开启了 Network->WebSocket 选项，Nginx 日志显示有如下错误：

2023/06/19 05:43:09 [error] 524943#524943: *388 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 162.158.178.153, server: nodes.domain.com, request: "GET /connect HTTP/1.1", upstream: "http://127.0.0.1:35601/connect", host: "nodes.domain.com"

此问题只发生在部分实例中，目前尚未找到规律。

贴上 Nginx 配置文件：

server{
                listen 80;
                listen 443 ssl http2;
                server_name nodes.domain.com;
                ssl_certificate /opt/ssl/nodes.domain.com_ecc/fullchain.pem; # SSL 证书路径
        ssl_certificate_key /opt/ssl/nodes.domain.com_ecc/nodes.facmata.net.pem; # SSL Key 证书路径
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_timeout 10m;
        ssl_session_cache builtin:1000 shared:SSL:10m;
        ssl_buffer_size 1400;
        add_header Strict-Transport-Security max-age=15768000;
        ssl_stapling on;
        ssl_stapling_verify on;
        access_log /var/log/nginx/nodes.domain.com_nginx.log combined; # 日志位置, 目录如果不存在需要提前创建好
                location / {
                        proxy_pass http://127.0.0.1:35601;
                        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_http_version 1.1;
                }
}