You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
94 lines
4.0 KiB
94 lines
4.0 KiB
commit 7b728d616e417f0a8cd25375f70b8a332ad23a71
|
|
Author: Lukas Tribus <lukas@ltri.eu>
|
|
Date: Sat Oct 27 20:06:59 2018 +0200
|
|
|
|
BUG/MINOR: only mark connections private if NTLM is detected
|
|
|
|
Instead of marking all connections that see a 401/407 response private
|
|
(for connection reuse), this patch detects a RFC4559/NTLM authentication
|
|
scheme and restricts the private setting to those connections.
|
|
|
|
This is so we can reuse connections with 401/407 responses with
|
|
deterministic load balancing algorithms later (which requires another fix).
|
|
|
|
This fixes the problem reported here by Elliot Barlas :
|
|
|
|
https://discourse.haproxy.org/t/unable-to-configure-load-balancing-per-request-over-persistent-connection/3144
|
|
|
|
Should be backported to 1.8.
|
|
|
|
(cherry picked from commit fd9b68c48ecdba5e7971899f4eec315c8e3a3cfe)
|
|
Signed-off-by: Willy Tarreau <w@1wt.eu>
|
|
|
|
diff --git a/doc/configuration.txt b/doc/configuration.txt
|
|
index 09980248..43b1b822 100644
|
|
--- a/doc/configuration.txt
|
|
+++ b/doc/configuration.txt
|
|
@@ -4798,10 +4798,8 @@ http-reuse { never | safe | aggressive | always }
|
|
- connections sent to a server with a TLS SNI extension are marked private
|
|
and are never shared;
|
|
|
|
- - connections receiving a status code 401 or 407 expect some authentication
|
|
- to be sent in return. Due to certain bogus authentication schemes (such
|
|
- as NTLM) relying on the connection, these connections are marked private
|
|
- and are never shared;
|
|
+ - connections with certain bogus authentication schemes (relying on the
|
|
+ connection) like NTLM are detected, marked private and are never shared;
|
|
|
|
No connection pool is involved, once a session dies, the last idle connection
|
|
it was attached to is deleted at the same time. This ensures that connections
|
|
diff --git a/src/proto_http.c b/src/proto_http.c
|
|
index 8f86422d..cde2dbf7 100644
|
|
--- a/src/proto_http.c
|
|
+++ b/src/proto_http.c
|
|
@@ -4388,8 +4388,6 @@ void http_end_txn_clean_session(struct stream *s)
|
|
* it's better to do it (at least it helps with debugging).
|
|
*/
|
|
s->txn->flags |= TX_PREFER_LAST;
|
|
- if (srv_conn)
|
|
- srv_conn->flags |= CO_FL_PRIVATE;
|
|
}
|
|
|
|
/* Never ever allow to reuse a connection from a non-reuse backend */
|
|
@@ -5053,10 +5051,13 @@ int http_wait_for_response(struct stream *s, struct channel *rep, int an_bit)
|
|
struct http_txn *txn = s->txn;
|
|
struct http_msg *msg = &txn->rsp;
|
|
struct hdr_ctx ctx;
|
|
+ struct connection *srv_conn;
|
|
int use_close_only;
|
|
int cur_idx;
|
|
int n;
|
|
|
|
+ srv_conn = cs_conn(objt_cs(s->si[1].end));
|
|
+
|
|
DPRINTF(stderr,"[%u] %s: stream=%p b=%p, exp(r,w)=%u,%u bf=%08x bh=%d analysers=%02x\n",
|
|
now_ms, __FUNCTION__,
|
|
s,
|
|
@@ -5588,6 +5589,27 @@ int http_wait_for_response(struct stream *s, struct channel *rep, int an_bit)
|
|
msg->body_len = msg->chunk_len = cl;
|
|
}
|
|
|
|
+ /* check for NTML authentication headers in 401 (WWW-Authenticate) and
|
|
+ * 407 (Proxy-Authenticate) responses and set the connection to private
|
|
+ */
|
|
+ if (srv_conn && txn->status == 401) {
|
|
+ /* check for Negotiate/NTLM WWW-Authenticate headers */
|
|
+ ctx.idx = 0;
|
|
+ while (http_find_header2("WWW-Authenticate", 16, rep->buf->p, &txn->hdr_idx, &ctx)) {
|
|
+ if ((ctx.vlen >= 9 && word_match(ctx.line + ctx.val, ctx.vlen, "Negotiate", 9)) ||
|
|
+ (ctx.vlen >= 4 && word_match(ctx.line + ctx.val, ctx.vlen, "NTLM", 4)))
|
|
+ srv_conn->flags |= CO_FL_PRIVATE;
|
|
+ }
|
|
+ } else if (srv_conn && txn->status == 407) {
|
|
+ /* check for Negotiate/NTLM Proxy-Authenticate headers */
|
|
+ ctx.idx = 0;
|
|
+ while (http_find_header2("Proxy-Authenticate", 18, rep->buf->p, &txn->hdr_idx, &ctx)) {
|
|
+ if ((ctx.vlen >= 9 && word_match(ctx.line + ctx.val, ctx.vlen, "Negotiate", 9)) ||
|
|
+ (ctx.vlen >= 4 && word_match(ctx.line + ctx.val, ctx.vlen, "NTLM", 4)))
|
|
+ srv_conn->flags |= CO_FL_PRIVATE;
|
|
+ }
|
|
+ }
|
|
+
|
|
skip_content_length:
|
|
/* Now we have to check if we need to modify the Connection header.
|
|
* This is more difficult on the response than it is on the request,
|