Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Tempesta may send empty 'Connection: ' header #1029

Closed
vankoven opened this issue May 30, 2018 · 1 comment
Closed

Tempesta may send empty 'Connection: ' header #1029

vankoven opened this issue May 30, 2018 · 1 comment
Assignees
@vankoven
Labels
bug
Milestone
0.6 Tempesta TLS

Comments

@vankoven
Copy link
Contributor

vankoven commented May 30, 2018 •
edited
Loading

Found by @vladtcvs . If backend treats request as erroneous and closes connection with Tempesta, connection between client and Tempesta is not closed and client receives empty Connection: header.

Here is an example:
Send request directly to backend:

% curl -v -X TRACE http://192.168.122.12:8080/
*   Trying 192.168.122.12...
* TCP_NODELAY set
* Connected to 192.168.122.12 (192.168.122.12) port 8080 (#0)
> TRACE / HTTP/1.1
> Host: 192.168.122.12:8080
> User-Agent: curl/7.60.0
> Accept: */*
> 
< HTTP/1.1 405 Not Allowed
< Server: nginx/1.10.3
< Date: Wed, 30 May 2018 18:04:39 GMT
< Content-Type: text/html
< Content-Length: 173
< Connection: close
< 
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>nginx/1.10.3</center>
</body>
</html>
* Closing connection 0

And send the same request to the the Tempesta:

% curl -v -X TRACE http://192.168.122.12/
*   Trying 192.168.122.12...
* TCP_NODELAY set
* Connected to 192.168.122.12 (192.168.122.12) port 80 (#0)
> TRACE / HTTP/1.1
> Host: 192.168.122.12
> User-Agent: curl/7.60.0
> Accept: */*
> 
< HTTP/1.1 405 Not Allowed
< Date: Wed, 30 May 2018 18:08:03 GMT
< Content-Type: text/html
< Content-Length: 173
< Connection:                                           <------- Empty header
< Server: Tempesta FW/0.6.0
< Via: 1.1 tempesta_fw (Tempesta FW 0.6.0)
< 
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>nginx/1.10.3</center>
</body>
</html>
* Connection #0 to host 192.168.122.12 left intact      <------- Connection is not closed

In the second case client receives Connection: header, but its empty, and connection is not closed.

I suppose, that Tempesta should close client connection if backend responds with non-200 code and closes connection.
@vankoven vankoven changed the title Tempesta may send empty 'Connection: Tempesta may send empty 'Connection: ' header May 30, 2018
@vankoven vankoven self-assigned this May 30, 2018
@vankoven vankoven added the bug label May 30, 2018
@vankoven vankoven added this to the 0.6 KTLS milestone May 30, 2018
@vankoven
Copy link
Contributor Author

I suppose, that Tempesta should close client connection if backend responds with non-200 code and closes connection.

I suppose, that Tempesta should must close client connection if backend responds with non-200 code and closes connection.

Connection to the client must be closed in such case. Client can repeat the same request many times, and every time it will cause backend connection to close. A few such clients can cause severe service quality decrease.

vankoven added a commit that referenced this issue May 30, 2018
@vankoven
fix #1029 Close client connection if backend closed tempesta connecti…
658c6b3 
…on after error code
@vankoven vankoven mentioned this issue May 30, 2018
Merged
vankoven added a commit that referenced this issue May 30, 2018
@vankoven
fix #1029 Close client connection if backend closed tempesta connecti…
8b98110 
…on after error code
vankoven added a commit that referenced this issue Jun 6, 2018
@vankoven
fix #1029 Close client connection if backend closed tempesta connecti…
0e1dd0f 
…on after error code
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vankoven vankoven

Labels
bug
Projects
None yet
Milestone
0.6 Tempesta TLS
Development

No branches or pull requests
1 participant
@vankoven