mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-08-06 15:17:01 +02:00
a544c66716
Github issue #472 reports a problem with short client connections making stick-table entries disappear. The problem is in fact totally different and stems at the connection establishment step. What happens is that the stick-table there has a single entry. The "stick-on" directive is forced to purge an existing entry before being able to create a new one. The new entry will be committed during the call to process_store_rules() on the response path. But if the client sends the FIN immediately after the connection is set up (e.g. using nc -z) then the SHUTR is received and will cancel the connection setup just after it starts. This cancellation will induce a call to cs_shutw() which will in turn leave the server-side state in ST_DIS. This transition from ST_CON to ST_DIS doesn't belong to the list of handled transition during the connection setup so it will be handled right after on the regular path, causing the connection to be closed. Because of this, we never pass through back_establish() and the backend's analysers are never set on the response channel, which is why process_store_rules() is not called and the stick-tables entry never committed. The comment above the code that causes this transition clearly says that the function is to be used after the connection is established with the server, but there's no such protection, and we always have the AUTO_CLOSE flag there (but there's hardly any available condition to eliminate it). This patch adds a test for the connection not being in ST_CON or for option abortonclose being set. It's sufficient to do the job and it should not cause issues. One concern was that the transition could happen during cs_recv() after the connection switches from CON to RDY then the read0 would be taken into account and would cause DIS to appear, which is not handled either. But that cannot happen because cs_recv() doesn't do anything until it's in ST_EST state, hence the read0() cannot be called from CON/RDY. Thus the transition from CON to DIS is only possible in back_handle_st_con() and back_handle_st_rdy() both of which are called when dealing with the transition already, or when abortonclose is set and the client aborts before connect() succeeds. It's possible that some further improvements could be made to detect this specific transition but it doesn't seem like anything would have to be added. This issue was first reported on 2.1. The abortonclose area is very sensitive so it would be wise to backport slowly, and probably no further than 2.4. |
||
|---|---|---|
| .github | ||
| addons | ||
| admin | ||
| dev | ||
| doc | ||
| examples | ||
| include | ||
| reg-tests | ||
| scripts | ||
| src | ||
| tests | ||
| .cirrus.yml | ||
| .gitattributes | ||
| .gitignore | ||
| .mailmap | ||
| .travis.yml | ||
| BRANCHES | ||
| CHANGELOG | ||
| CONTRIBUTING | ||
| INSTALL | ||
| LICENSE | ||
| MAINTAINERS | ||
| Makefile | ||
| README | ||
| ROADMAP | ||
| SUBVERS | ||
| VERDATE | ||
| VERSION | ||
The HAProxy documentation has been split into a number of different files for ease of use. Please refer to the following files depending on what you're looking for : - INSTALL for instructions on how to build and install HAProxy - BRANCHES to understand the project's life cycle and what version to use - LICENSE for the project's license - CONTRIBUTING for the process to follow to submit contributions The more detailed documentation is located into the doc/ directory : - doc/intro.txt for a quick introduction on HAProxy - doc/configuration.txt for the configuration's reference manual - doc/lua.txt for the Lua's reference manual - doc/SPOE.txt for how to use the SPOE engine - doc/network-namespaces.txt for how to use network namespaces under Linux - doc/management.txt for the management guide - doc/regression-testing.txt for how to use the regression testing suite - doc/peers.txt for the peers protocol reference - doc/coding-style.txt for how to adopt HAProxy's coding style - doc/internals for developer-specific documentation (not all up to date)