hpagent receives a socket on proxy server response to the CONNECT request. On non-200 response, hpagent passes an Error to the createConnection callback without first destroying the socket.
While it's highly unlikely the proxy server will fail to close the connection immediately after responding with a bad status code, I'm nervous about the complete lack of client control over socket cleanup.
Environment
Node v16.15.1
hpagent v1.0.0
Linux kernel 5.13
Steps to reproduce
Run a simple web server on port 80 that returns 403 in response to any request:
#!/bin/bash
while true; do
echo -e "HTTP/1.1 403 FORBIDDEN\r\n$(date)\r\n\r\n<h1>hello world from $(hostname) on $(date)</h1>" | nc -vl -p 80
done
Summary
hpagent receives a socket on proxy server response to the
CONNECT
request. On non-200 response, hpagent passes an Error to thecreateConnection
callback without first destroying the socket.While it's highly unlikely the proxy server will fail to close the connection immediately after responding with a bad status code, I'm nervous about the complete lack of client control over socket cleanup.
Environment
v16.15.1
v1.0.0
5.13
Steps to reproduce
Run a simple web server on port 80 that returns 403 in response to any request:
Run the following test script:
Note that Node doesn't exit until the server is killed, because the proxy socket remains connected, with no ability to destroy it on the client side.
A potential fix
Call
socket.destroy()
before passing a bad response error to thecreateConnection
callback. E.g.: