From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id C4F5B1FF0AA for ; Tue, 03 Nov 2026 17:19:31 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 0CD1721249; Tue, 03 Nov 2026 17:19:28 +0100 (CET) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Tue, 03 Nov 2026 17:19:22 +0100 Message-Id: Subject: Re: [PATCH http-server 1/1] apiserver: send TLS close notify at the end of streamed responses From: =?utf-8?q?Michael_K=C3=B6ppl?= To: =?utf-8?q?Michael_K=C3=B6ppl?= , X-Mailer: aerc 0.22.0 References: <20261103155223.1960754-1-m.koeppl@proxmox.com> In-Reply-To: <20261103155223.1960754-1-m.koeppl@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793722762924 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.219 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: YS4ENL5HUKCJKX4HZ46HUDDHX5BOJUGE X-Message-ID-Hash: YS4ENL5HUKCJKX4HZ46HUDDHX5BOJUGE X-MailFrom: m.koeppl@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: I was made aware and simply forgot that I should probably give an example how to reproduce this. 1. Create a container 2. Back it up to PBS 3. The script below covers a simplified form of what the E2E test does. Running it as root on a test node, pointing it at the container backup like `repro.sh pbs:backup/ct/100/2026-11-03T12:00:00Z` will return the data (the container's hostname) successfully downloaded, but curl will show error 56. ``` #!/bin/bash # e.g. repro.sh pbs:backup/ct/100/2026-11-03T12:00:00Z volid=3D$1 storage=3D${volid%%:*} ticket=3D$(perl -MPVE::AccessControl -e 'print PVE::AccessControl::assemble= _ticket("root\@pam")') filepath=3D$(printf '/root.pxar.didx/etc/hostname' | base64 -w0) curl -sSk -G -H "Cookie: PVEAuthCookie=3D$ticket" \ --data-urlencode "volume=3D$volid" --data-urlencode "filepath=3D$filepa= th" \ "https://localhost:8006/api2/json/nodes/$(hostname)/storage/$storage/fi= le-restore/download" echo "exit code: $?" ``` Thanks, @Maximiliano for pointing this out. On Tue Nov 3, 2026 at 4:52 PM CET, Michael K=C3=B6ppl wrote: > A streamed response (e.g. for the single file restore download), has no > Content-Length nor chunked encoding, so the client can only tell where > the body ends by the connection being closed. The response accounced > 'Connection: Keep-Alive' and, at the end of the stream, push_shutdown() > shut down the socket directly, bypassing the TLS layer. The client then [snip]