On October 1, 2020 12:55 pm, Daniel Berteaud wrote:
> ----- Le 1 Oct 20, à 11:15, Fabian Grünbichler f.gruenbich...@proxmox.com a
> écrit :
>
>> On September 30, 2020 4:09 pm, Daniel Berteaud wrote:
>>> Without this, the first req get a response, but not the next ones as the
>>> listeners stays busy
>>> Fixes #3048
>>>
>>> Signed-off-by: Daniel Berteaud <dan...@firewall-services.com>
>>> ---
>>> src/PVE/ACME/StandAlone.pm | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/src/PVE/ACME/StandAlone.pm b/src/PVE/ACME/StandAlone.pm
>>> index 0e2ece6..552c35c 100644
>>> --- a/src/PVE/ACME/StandAlone.pm
>>> +++ b/src/PVE/ACME/StandAlone.pm
>>> @@ -55,8 +55,8 @@ sub setup {
>>> } else {
>>> $c->send_error(404, 'Not found.')
>>> }
>>> + $c->close();
>>
>> I think this is not right - we only end up looping/blocking on
>> get_request if the client requested keep alive, in which case the server
>> should obviously not close the connection..
>>
>> I guess we have to fork (up to some limit) on accept()? it's obviously
>> not ideal that anybody can race with the LE validation attempts and
>> block the single request handler ;)
>
> Indeed, having a few more handlers could limit the risk of this happening.
>
>>
>> maybe you can change something in your apache config to close the
>> connection (or rather, to propagate the connection closing from the
>> actual client)? it looks like this can only affect you if
>> - your apache proxy keeps the connection open
>> - your apache proxy does not re-use the open connection
>
> You're right, the issue was on my rev proxy, which didn't re-used keep-alived
> connexions as it should (it was an old httpd 2.2.3 on a CentOS 5 box, on
> which I had no control).
> Switching my setup so it now runs behind a nginx proxypass works normaly
> without any modification
>
> Sorry for not having looked at this more closely before posting ;-)
no worries. I retitled the bug you filed to track the actual issue -
feel free to write a patch for it anyway ;)
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
