----- Le 1 Oct 20, à 11:15, Fabian Grünbichler f.gruenbich...@proxmox.com a
écrit :
> On September 30, 2020 4:09 pm, Daniel Berteaud wrote:
>> Without this, the first req get a response, but not the next ones as the
>> listeners stays busy
>> Fixes #3048
>>
>> Signed-off-by: Daniel Berteaud <dan...@firewall-services.com>
>> ---
>> src/PVE/ACME/StandAlone.pm | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/src/PVE/ACME/StandAlone.pm b/src/PVE/ACME/StandAlone.pm
>> index 0e2ece6..552c35c 100644
>> --- a/src/PVE/ACME/StandAlone.pm
>> +++ b/src/PVE/ACME/StandAlone.pm
>> @@ -55,8 +55,8 @@ sub setup {
>> } else {
>> $c->send_error(404, 'Not found.')
>> }
>> + $c->close();
>
> I think this is not right - we only end up looping/blocking on
> get_request if the client requested keep alive, in which case the server
> should obviously not close the connection..
>
> I guess we have to fork (up to some limit) on accept()? it's obviously
> not ideal that anybody can race with the LE validation attempts and
> block the single request handler ;)
Indeed, having a few more handlers could limit the risk of this happening.
>
> maybe you can change something in your apache config to close the
> connection (or rather, to propagate the connection closing from the
> actual client)? it looks like this can only affect you if
> - your apache proxy keeps the connection open
> - your apache proxy does not re-use the open connection
You're right, the issue was on my rev proxy, which didn't re-used keep-alived
connexions as it should (it was an old httpd 2.2.3 on a CentOS 5 box, on which
I had no control).
Switching my setup so it now runs behind a nginx proxypass works normaly
without any modification
Sorry for not having looked at this more closely before posting ;-)
Cheers,
Daniel
--
[ https://www.firewall-services.com/ ]
Daniel Berteaud
FIREWALL-SERVICES SAS, La sécurité des réseaux
Société de Services en Logiciels Libres
Tél : +33.5 56 64 15 32
Matrix: @dani:fws.fr
[ https://www.firewall-services.com/ | https://www.firewall-services.com ]
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
