rproxy: a visitor sending Connection: close can get a reset instead of an early answer #373

New Issue

2026-11-12T07:22:51+01:00

clawbot commented

2026-11-12 07:22:51 +01:00

When rproxy answers a request before reading its whole body (a 413 for a body announced over SWW_RPROXY_MAX_REQUEST_SIZE, or a deny), and the visitor's request carries Connection: close, Go's server closes the connection without reading the rest of the body. The visitor, still sending, gets a reset and may never read the answer.

The comment on answer in internal/rproxy/request.go says a visitor may go on sending so that Go's server can read the rest and end the request cleanly. Go's server skips that read when the request says Connection: close.
Example: a client posts 129 KiB with Connection: close and a 128 KiB limit. rproxy sends the 413 and closes; the client's next write fails with broken pipe or connection reset by peer.
Found while fixing the test in #371, which now avoids this case.

Done when such a visitor reads rproxy's answer, the rest of its body read until the request time limit, as for a visitor without Connection: close.

Model: opus-5-5

When rproxy answers a request before reading its whole body (a 413 for a body announced over `SWW_RPROXY_MAX_REQUEST_SIZE`, or a deny), and the visitor's request carries `Connection: close`, Go's server closes the connection without reading the rest of the body. The visitor, still sending, gets a reset and may never read the answer. - The comment on `answer` in `internal/rproxy/request.go` says a visitor may go on sending so that Go's server can read the rest and end the request cleanly. Go's server skips that read when the request says `Connection: close`. - Example: a client posts 129 KiB with `Connection: close` and a 128 KiB limit. rproxy sends the 413 and closes; the client's next write fails with `broken pipe` or `connection reset by peer`. - Found while fixing the test in https://git.eeqj.de/sneak/smallwebwaf/issues/371, which now avoids this case. Done when such a visitor reads rproxy's answer, the rest of its body read until the request time limit, as for a visitor without `Connection: close`. Model: opus-5-5

clawbot referenced this issue

2026-11-12 07:22:59 +01:00

rproxy test: a body over its limit sometimes fails with connection reset by peer #371

clawbot referenced this issue from a commit

2026-11-12 07:33:30 +01:00

rproxy: read the rest of a Connection: close visitor's body after an early answer (closes #373)

clawbot referenced a pull request that will close this issue

2026-11-12 07:33:42 +01:00

rproxy: read the rest of a Connection: close visitor's body after an early answer (closes #373) #375

clawbot commented

2026-11-12 07:33:46 +01:00

PR: #375 (branch issue-373-read-rest-after-connection-close).

rproxy now reads the rest of the body itself, once it has answered, for a visitor that sent Connection: close. The read stops at the request time limit or after 256 KiB, as Go's server does for other visitors.

Model: opus-5-5

PR: https://git.eeqj.de/sneak/smallwebwaf/pulls/375 (branch `issue-373-read-rest-after-connection-close`). rproxy now reads the rest of the body itself, once it has answered, for a visitor that sent `Connection: close`. The read stops at the request time limit or after 256 KiB, as Go's server does for other visitors. Model: opus-5-5

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#373