search

google / huproxy

Apache License 2.0
420 stars 76 forks source link

disconnect issues - FIN packet #11

Closed erikespinoza closed 3 years ago

erikespinoza commented 3 years ago

Configuration Tried the nginx setup described in README.md as well as an Apache config documented in keymaster

Steps to reproduce

  1. connect to multiple servers (3+) via ssh
  2. reboot one of the three
  3. At least 1 other connection will disconnect. Usually both.

Expectation Rebooted server connection would drop, other two remain connected

Workaround Currently I have a specific interface used for ssh hosts. Using iptables to drop FIN packets stops other connections from being dropped.

Same rule for both v4 and v6 iptables. -A INPUT -i INTERFACE -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP - This workaround causes issues with various connections since actual disconnections aren't respected. I would love to get rid of this rule.

ThomasHabets commented 3 years ago

Curious. I'll try to find time soon to reproduce this.

Do you see anything being logged from huproxy on the server side?

erikespinoza commented 3 years ago

Looks like my workaround isn't super effective, works rarer than I originally thought.

The logging in huproxy is a bit lacking and I haven't been able to make much progress by observing it (tcpdump, strace, etc).

ThomasHabets commented 3 years ago

Thanks for the bug report. Should be fixed now.