From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 5AC741FF0B4 for ; Tue, 10 Nov 2026 12:07:33 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C7D162143D; Tue, 10 Nov 2026 12:07:32 +0100 (CET) From: "Max R. Carrara" To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox v3 0/5] Fix #6738: Improve TLS Handshake Handling & Error Logging Date: Tue, 10 Nov 2026 12:07:22 +0100 Message-ID: <20261110110728.144880-1-m.carrara@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1794308848327 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.316 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: VALT5X5CTURJI4EBFAEG6G4WLEQLZSXG X-Message-ID-Hash: VALT5X5CTURJI4EBFAEG6G4WLEQLZSXG X-MailFrom: m.carrara@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Fix #6738: Improve TLS Handshake Handling & Error Logging - v3 ============================================================== This is a slightly bigger refresh of an older patch (see below) that reduces the noisiness of TLS handshake errors, in particular when health checks are only opening and closing connections without sending any data. The reason why I'm "revamping" this is to make the code more readable overall, add tests, and also to fix a very rare, but possible race condition, where we inspect the incoming buffer too quickly while the client is still sending data -- see patch #4 for the details. Patch #5 contains the actual fix for #6738. I smoke tested all of this on my local development setup, but another look certainly wouldn't hurt here. Notable Changes --------------- - Use a proper `enum` instead of an `Option` to represent the outcome of the TLS handshake check (patch #1) - Add tests for the TLS handshake handling (patch #2) - Fix race condition where we inspect the incoming buffer too quickly while the client is still sending data (patch #4) Note that this race condition is only really possible if we received less than 5 bytes from the client initially. I'm not sure when this would ever "naturally" occur, but some misbehaved script or perhaps some kind of "streaming" proxy could maybe trigger this. Previous Versions ----------------- v1: https://lore.proxmox.com/pbs-devel/20250910154041.1032251-1-m.carrara@proxmox.com/ v2: https://lore.proxmox.com/pbs-devel/20260427134051.557840-1-m.carrara@proxmox.com/ Summary of Changes ------------------ proxmox: Max R. Carrara (5): rest-server: connection: use enum for TLS handshake check result rest-server: connection: add tests for TLS handshake check rest-server: connection: log cause of TLS handshake check errors rest-server: connection: avoid dropping clients during TLS check fix #6738: rest-server: log early closed connections at debug level proxmox-rest-server/src/connection.rs | 289 +++++++++++++++++++++++--- 1 file changed, 263 insertions(+), 26 deletions(-) Summary over all repositories: 1 files changed, 263 insertions(+), 26 deletions(-) -- Generated by murpp 0.12.0