Honor allow_half_open when a client aborts early - #13560
Open
bneradt wants to merge 1 commit into
Open
Conversation
Operators who set proxy.config.http.allow_half_open to 0 expect a client abort to tear down the transaction, including the connection to the origin server. Since 10.1, that no longer happens when the client goes away before the origin has sent its response header: ATS holds the origin connection open until the response arrives, so a slow origin combined with impatient clients can accumulate connections until max_requests_in or connections_throttle is reached. The path that keeps the state machine alive in that window exists so that background fill works for clients whose transport cannot half close a connection, such as TLS and HTTP/2. It was reachable for two unrelated reasons, though, since ProxyTransaction::allow_half_open() reports false both for those transports and for an operator who disabled half open connections outright. This patch distinguishes the two by also requiring that half open connections be configured before keeping the transaction alive for a background fetch. Background fill continues to work for TLS and HTTP/2 clients under the default configuration, while disabling half open connections once again aborts the transaction and drops the origin connection. The accompanying autest exercises both outcomes with an origin that reports whether the proxy closed the connection, and the documentation for allow_half_open now describes the interaction. Fixes: apache#13549
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Operators who set proxy.config.http.allow_half_open to 0 expect a
client abort to tear down the transaction, including the connection to
the origin server. Since 10.1, that no longer happens when the client
goes away before the origin has sent its response header: ATS holds the
origin connection open until the response arrives, so a slow origin
combined with impatient clients can accumulate connections until
max_requests_in or connections_throttle is reached.
The path that keeps the state machine alive in that window exists so
that background fill works for clients whose transport cannot half
close a connection, such as TLS and HTTP/2. It was reachable for two
unrelated reasons, though, since ProxyTransaction::allow_half_open()
reports false both for those transports and for an operator who
disabled half open connections outright.
This patch distinguishes the two by also requiring that half open
connections be configured before keeping the transaction alive for a
background fetch. Background fill continues to work for TLS and HTTP/2
clients under the default configuration, while disabling half open
connections once again aborts the transaction and drops the origin
connection. The accompanying autest exercises both outcomes with an
origin that reports whether the proxy closed the connection, and the
documentation for allow_half_open now describes the interaction.
Fixes: #13549