[pve-devel] [PATCH proxmox-acme 1/1] Close the acme standalone connection after sending a response

[Fabian Grünbichler]

On September 30, 2020 4:09 pm, Daniel Berteaud wrote:
> Without this, the first req get a response, but not the next ones as the listeners stays busy
> Fixes #3048
> 
> Signed-off-by: Daniel Berteaud <daniel at firewall-services.com>
> ---
>  src/PVE/ACME/StandAlone.pm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/PVE/ACME/StandAlone.pm b/src/PVE/ACME/StandAlone.pm
> index 0e2ece6..552c35c 100644
> --- a/src/PVE/ACME/StandAlone.pm
> +++ b/src/PVE/ACME/StandAlone.pm
> @@ -55,8 +55,8 @@ sub setup {
>  		} else {
>  		    $c->send_error(404, 'Not found.')
>  		}
> +		$c->close();

I think this is not right - we only end up looping/blocking on 
get_request if the client requested keep alive, in which case the server 
should obviously not close the connection..

I guess we have to fork (up to some limit) on accept()? it's obviously 
not ideal that anybody can race with the LE validation attempts and 
block the single request handler ;)

maybe you can change something in your apache config to close the 
connection (or rather, to propagate the connection closing from the 
actual client)? it looks like this can only affect you if
- your apache proxy keeps the connection open
- your apache proxy does not re-use the open connection

the multi-perspective validation by LE is not that new, and it works 
when LE talks directly to the standalone plugin...

>  	    }
> -	    $c->close();
>  	    $c = undef;
>  	}
>      }
> -- 
> 2.26.2
> 
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
> 
>