一处可能的协议探测漏洞

[bash99]

Gaukas 提到的
enfein/mieru#8 (comment)_

未开启trojan相关配置，和普通的caddy一样，对443端口收到的普通HTTP请求返回400

root@xxx:~# curl -D - http://xxx.mysite.com:443/
HTTP/1.0 400 Bad Request

Client sent an HTTP request to an HTTPS server.

开启trojan相关配置，响应不一样了

root@xxx:~# curl -D - http://xxx.mysite.com:443/
curl: (52) Empty reply from server

[gaukas]

On a side note, the behavior of returning an HTTP 400 response seems to be an arbitrary choice made by most HTTP server implementations. lighttpd makes a perfect counterexample as it returns an empty response.