From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: Re: [pve-devel] [PATCH proxmox-acme 1/1] Close the acme standalone connection after sending a response
Date: Thu, 01 Oct 2020 11:15:49 +0200 [thread overview]
Message-ID: <1601543152.9js94vfimk.astroid@nora.none> (raw)
In-Reply-To: <20200930140909.1612753-2-daniel@firewall-services.com>
On September 30, 2020 4:09 pm, Daniel Berteaud wrote:
> Without this, the first req get a response, but not the next ones as the listeners stays busy
> Fixes #3048
>
> Signed-off-by: Daniel Berteaud <daniel@firewall-services.com>
> ---
> src/PVE/ACME/StandAlone.pm | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/PVE/ACME/StandAlone.pm b/src/PVE/ACME/StandAlone.pm
> index 0e2ece6..552c35c 100644
> --- a/src/PVE/ACME/StandAlone.pm
> +++ b/src/PVE/ACME/StandAlone.pm
> @@ -55,8 +55,8 @@ sub setup {
> } else {
> $c->send_error(404, 'Not found.')
> }
> + $c->close();
I think this is not right - we only end up looping/blocking on
get_request if the client requested keep alive, in which case the server
should obviously not close the connection..
I guess we have to fork (up to some limit) on accept()? it's obviously
not ideal that anybody can race with the LE validation attempts and
block the single request handler ;)
maybe you can change something in your apache config to close the
connection (or rather, to propagate the connection closing from the
actual client)? it looks like this can only affect you if
- your apache proxy keeps the connection open
- your apache proxy does not re-use the open connection
the multi-perspective validation by LE is not that new, and it works
when LE talks directly to the standalone plugin...
> }
> - $c->close();
> $c = undef;
> }
> }
> --
> 2.26.2
>
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>
>
next prev parent reply other threads:[~2020-10-01 9:15 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-30 14:09 [pve-devel] [PATCH proxmox-acme 0/1] " Daniel Berteaud
2020-09-30 14:09 ` [pve-devel] [PATCH proxmox-acme 1/1] " Daniel Berteaud
2020-10-01 9:15 ` Fabian Grünbichler [this message]
2020-10-01 10:55 ` Daniel Berteaud
2020-10-01 11:55 ` Fabian Grünbichler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1601543152.9js94vfimk.astroid@nora.none \
--to=f.gruenbichler@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox