DO NOT REPLY [Bug 49405] New: Handling proxy backends sending RST

[bu...@apache.org]

https://issues.apache.org/bugzilla/show_bug.cgi?id=49405

           Summary: Handling proxy backends sending RST
           Product: Apache httpd-2
           Version: 2.2.3
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_proxy_http
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: ville.sulko@elisa.fi


Current mod_proxy_http implementation tries to send the whole proxied request
to the backend server before even trying to read the response. Some http server
implementations however think they can send a response and close the connection
(both directions with RST) before the whole request has been read. Servers
implemented using java can cause this very easily, by calling socket.close().

To give an example, request might need authentication, and HTTP 401 is
returned. In a way, sending RST makes sense. The request might be big one (say,
a http PUT-request with 2MB file transfer). If the whole request needs to be
read before the connection can be closed, the whole file needs to be sent
twice. This is more of a application design issue, agreed, but this is how
applications work today.

One example of a http server which sends RSTs is jetty. It is also very common
to "hide" many applications behind a mod_proxy/rewrite frontend, often also
offloading SSL-handling to apache. In these scenarios we get a lot of proxy 502
errors.

If possible, I would say that mod_proxy_http should try to read any possible
response received from the backend, even if the request sending fails. And if a
sane response can be read, it should be passed to the client and no 502 error
should be given. I'm not sure how TCP stacks behave. If tcp stacks drop any
traffic received after rst, there's of course not much that can be done, except
maybe async reading.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 49405] Handling proxy backends sending RST

[bu...@apache.org]

https://issues.apache.org/bugzilla/show_bug.cgi?id=49405

William A. Rowe Jr. <wr...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #1 from William A. Rowe Jr. <wr...@apache.org> 2010-06-25 11:47:18 EDT ---
If the response isn't handled, the back end is in violation of the spec.

Accepting serious spec violations is addressed in the Watchfire request
smuggling report http://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
and providing the behavior you describe would make request injection much
simpler.

Closing as invalid and won't change.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org