mirror of
https://github.com/haproxy/haproxy.git
synced 2026-04-15 21:59:41 -04:00
HAProxy - Load balancer
ff95f2d447
QUIC handshakes were frequently in error due to haproxy misuse of ncbuf. This resulted in one of the following scenario : - handshake rejected with CONNECTION_CLOSE due to overlapping data rejected - CRYPTO data fully received by haproxy but handshake completion signal not reported causing the client to emit PING repeatedly before timeout This was produced because ncb_advance() result was not checked after providing crypto data to the SSL stack in qc_provide_cdata(). However, this operation can fail if a too small gap is formed. In the meantime, quic_enc_level offset was always incremented. In some cases, this caused next ncb_add() to report rejected overlapping data. In other cases, no error was reported but SSL stack never received the end of CRYPTO data. Change slightly the handling of new CRYPTO frames to avoid this bug : when receiving a CRYPTO frame for the current offset, handle them directly as previously done only if quic_enc_level ncbuf is empty. In the other case, copy them to the buffer before treating contiguous data via qc_treat_rx_crypto_frms(). This change ensures that ncb_advance() operation is now conducted only in a data block : thus this is guaranteed to never fail. This bug was easily reproduced with chromium as it fragments CRYPTO frames randomly in several frames out of order. This commit has two drawbacks : - it is slightly less worst on performance because as sometimes even data at the current offset will be memcpy - if a client uses too many fragmented CRYPTO frames, this can cause repeated ncb_add() error on gap size. This can be reproduced with chrome, albeit with a slighly less frequent rate than the fixed issue. This change should fix in part github issue #1903. This must be backported up to 2.6. |
||
|---|---|---|
| .github | ||
| addons | ||
| admin | ||
| dev | ||
| doc | ||
| examples | ||
| include | ||
| reg-tests | ||
| scripts | ||
| src | ||
| tests | ||
| .cirrus.yml | ||
| .gitattributes | ||
| .gitignore | ||
| .mailmap | ||
| .travis.yml | ||
| BRANCHES | ||
| CHANGELOG | ||
| CONTRIBUTING | ||
| INSTALL | ||
| LICENSE | ||
| MAINTAINERS | ||
| Makefile | ||
| README | ||
| SUBVERS | ||
| VERDATE | ||
| VERSION | ||
The HAProxy documentation has been split into a number of different files for ease of use. Please refer to the following files depending on what you're looking for : - INSTALL for instructions on how to build and install HAProxy - BRANCHES to understand the project's life cycle and what version to use - LICENSE for the project's license - CONTRIBUTING for the process to follow to submit contributions The more detailed documentation is located into the doc/ directory : - doc/intro.txt for a quick introduction on HAProxy - doc/configuration.txt for the configuration's reference manual - doc/lua.txt for the Lua's reference manual - doc/SPOE.txt for how to use the SPOE engine - doc/network-namespaces.txt for how to use network namespaces under Linux - doc/management.txt for the management guide - doc/regression-testing.txt for how to use the regression testing suite - doc/peers.txt for the peers protocol reference - doc/coding-style.txt for how to adopt HAProxy's coding style - doc/internals for developer-specific documentation (not all up to date)