Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return HTTP response to RX_OVERFLOW #4207

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

cartoush
Copy link
Contributor

@cartoush cartoush commented Oct 3, 2024

Resolves #2735

Before this PR, Varnish would silently close the connection to a client that triggered an RX_OVERFLOW (too long URI), this PR allows configuring Varnish to respond to RX_OVERFLOW with a minimal HTTP response that will contain a chosen HTTP code instead.

Its done by adding a new feature flag in order to enable the feature and a new parameter in order to set the HTTP code that will be sent in the response.

This flag will allow toggling whether Varnish
will, in case of an RX_OVERFLOW happening,
silently close the connection as was done before
or send an HTTP response code before closing the
connection.
Adds a Varnish parameter for which HTTP response
code should be sent in case of a request
parameter overflow.
Copy link
Member

@nigoroll nigoroll left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for writing a better PR description and better commit messages ;)

I am generally 👍🏽 , and only have this nit-pick: Instead of having a feature flag and a parameter, can't we just just an invalid status code like 0 with req_overflow_status to mean "disable" (= close connection)?

@nigoroll
Copy link
Member

nigoroll commented Oct 7, 2024

bugwash: we would appreciate some more research regarding which scenarios would benefit from a similar mechanism. Also, the argument has been made that, once we send a response at all, we might as well do so through vcl_synth, but then the question arises what to present to VCL as the request (url, proto, headers).

@cartoush volunteered to spend some time on researching these questions, thank you!

@cartoush
Copy link
Contributor Author

bugwash: we would appreciate some more research regarding which scenarios would benefit from a similar mechanism. Also, the argument has been made that, once we send a response at all, we might as well do so through vcl_synth, but then the question arises what to present to VCL as the request (url, proto, headers).

@cartoush volunteered to spend some time on researching these questions, thank you!

Sorry for the delay, I did some thinking on that and I think one could argue all cases where an error causes a connection to close silently could benefit from that.
But generalizing that using vcl_synth might not be appropriate, as you can do restart for example which be quite dangerous, something better could be creating a vcl_invalid subroutine which only gives access to what's relevant to handle the error.
In this case the default vcl behavior would be:

sub vcl_invalid {
        return (close);
}

and in order to handle the case here we would have something like:

sub vcl_invalid {
        if (req.error.reason == REQ_HTTP_OVERFLOW) {
                resp.status == 413;
                return (deliver);
        }
        return (close);
}

I think the the whole req should not be usable in vcl_invalid but req.error should be populated with all necessary information to do the processing.
But then this would have to take place in another PR as this requires quite a bit of planning in order to decide what can be done in vcl_invalid.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

RX_OVERFLOW returns TCP reset instead of HTTP 414
5 participants