HAProxy 2.0.13 does not close connection even though "connection: close" is sent, leaves many connections in CLOSE-WAIT state for HEAD-method requests
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
haproxy (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
Confirmed
|
Medium
|
Unassigned | ||
Groovy |
Fix Released
|
Undecided
|
Unassigned | ||
Hirsute |
Fix Released
|
Undecided
|
Unassigned | ||
Impish |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
I figured that the current latest HAProxy (2.0.13-2ubuntu0.1) for focal has a problem closing connections, even if "connection: close" is being sent, the connection is not closed afterwards. The problem does not exist if "no option http-use-htx" is set (disabling HTX). The problem only affects the HEAD-method.
Using 2.0.20 (2.0.20-
I marked this as security relevant because I believe that this bug can be used for DoS, just like Slowloris, but much easier, because no effort is required to keep the connection open.
Here is a minimal (working with 2.0.20-1ppa1~focal, not working with 2.0.13-2ubuntu0.1) example cfg:
====
global
user haproxy
group haproxy
daemon
frontend test
bind *:80
mode http
====
Here is a minimal working example cfg:
====
global
user haproxy
group haproxy
daemon
frontend test
bind *:80
mode http
no option http-use-htx
====
Testing can be done multiple ways:
curl will not close the connection:
====
curl -v -XHEAD http://
====
curl will close the connection:
====
curl -v -I http://
====
To exclude any curl related problems:
====
telnet 10.0.0.1 80
HEAD / HTTP/1.1
====
To summarize:
I expect to happen: Connections get closed proactively by server if "connection: close" header is sent.
This happens: Connections stay open and in CLOSE-WAIT on server.
Related branches
- Canonical Server: Pending requested
- Canonical Server packageset reviewers: Pending requested
- git-ubuntu developers: Pending requested
-
Diff: 86 lines (+64/-0)3 files modifieddebian/changelog (+8/-0)
debian/patches/lp1919468-BUG-MEDIUM-make-h1_shutw_conn-idempotent.patch (+55/-0)
debian/patches/series (+1/-0)
description: | updated |
description: | updated |
information type: | Public Security → Public |
Changed in haproxy (Ubuntu): | |
importance: | Undecided → Medium |
Changed in haproxy (Ubuntu Focal): | |
assignee: | nobody → Utkarsh Gupta (utkarsh) |
Changed in haproxy (Ubuntu Groovy): | |
status: | New → Fix Released |
Changed in haproxy (Ubuntu Hirsute): | |
status: | New → Fix Released |
Changed in haproxy (Ubuntu Focal): | |
status: | New → Confirmed |
Changed in haproxy (Ubuntu Impish): | |
status: | Confirmed → Fix Released |
Changed in haproxy (Ubuntu Focal): | |
importance: | Undecided → Medium |
Changed in haproxy (Ubuntu Impish): | |
importance: | Medium → Undecided |
assignee: | Utkarsh Gupta (utkarsh) → nobody |
Changed in haproxy (Ubuntu Focal): | |
assignee: | Utkarsh Gupta (utkarsh) → nobody |
This was created 20 days ago. When can I expect somebody to look into it?