Hi,
On Fri, Jan 11, 2019 at 01:05:15PM +0200, Assen Totin wrote:
> Hi, everybody!
>
> I'm facing an issue with a somewhat weird/broken client and I'm looking for
> some advise on it.
>
> The client opens a HTTPS session and sends its request (POST data in my
> case). The HTTPS part is fine. The POST data is small, so it fits into a
> single TCP packet, which arrives with ACK,PSH,FIN flags set. HAProxy
> diligently responds with FIN,ACK and closes the client connection, not
> sending anything to the backend server. It also logs the request as CR--
> which seems proper.
>
> There is nothing specific in my HAProxy setup in this case, default config
> with a single frontend/backend. I'm on 1.8 series.
It is *not* supposed to happen by default, we're extremely careful about
half-closed requests, and in fact in 1.8, HTTP/2 is translated to HTTP/1
with a close appended just after the request. Are you up to date with your
1.8 version ? Also are you certain your config doesn't contain
"option abortonclose" ? This option exists exactly to cause the behaviour
you're observing.
> I'm aware that sending a FIN on a TLS connection violates the TLS RFC, but
> I suspect that such a client would do the same on a non-TLS connection too.
> It brings me to the question, is there a way to tell HAProxy not to close a
> client connection upon receipt of FIN on the client side if there is an
> unserved HTTP request, but rather keep the client connection half-open
> until the backend responds?
The client connection is half-open in this case because that's how it is
at the transport level. But the request should properly be served regardless
of this.
> The issue I'm facing is likely exacerbated by
> the fact that client sends FIN together with the HTTP request, so there is
> no backend connection yet when HAProxy decides to close the client
> connection.
As I said, it's exactly what is done for requests coming from HTTP/2, so
if it's neither a configuration issue nor a known bug, you may be on a
corner case that hasn't been identified yet.
> Any ideas will he much appreciated. I'm open to testing config
> changes/patches if needed (or even writing one with some guidance).
Great ;-) Please double-check the points above, and share a reduced
config exhibiting the problem.
Thanks!
Willy
