RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-19 20:20:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

MINOR: quic: report error if force-retry without cluster-secret

Browse Source 
QUIC Retry generation relies on global cluster-secret to produce token
valid even after a process restart and across several LBs instances.

Before this patch, Retry is automatically deactivated if no
cluster-secret is provided. This is the case even if a user has
configured a QUIC listener with quic-force-retry. Change this behavior
by now returning an error during configuration parsing. The user must
provide a cluster-secret if quic-force-retry is used.

This shoud be backported up to 2.6.
This commit is contained in:
Amaury Denoyelle 2022-11-14 16:17:13 +01:00
parent 936c135e05
commit 996ca7d0fa
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
doc/configuration.txt
View File

@ -14586,9 +14586,10 @@ quic-force-retry
contains a token. This token must be sent back to the Retry packet sender,
this latter being the only one to be able to validate the token. Note that QUIC
Retry will always be used even if a Retry threshold was set (see
"tune.quic.retry-threshold" setting). To be functional this setting needs a
cluster secret to be set, if not it will be silently ignored (see "cluster-secret"
setting).
"tune.quic.retry-threshold" setting).
This setting requires the cluster secret to be set or else an error will be
reported on startup (see "cluster-secret").
See https://www.rfc-editor.org/rfc/rfc9000.html#section-8.1.2 for more
information about QUIC retry.

7
src/cfgparse.c
View File

@ -4317,8 +4317,13 @@ init_proxies_list_stage2:
#ifdef USE_QUIC
/* override the accept callback for QUIC listeners. */
if (listener->flags & LI_F_QUIC_LISTENER) {
if (!global.cluster_secret)
if (!global.cluster_secret) {
diag_no_cluster_secret = 1;
if (listener->bind_conf->options & BC_O_QUIC_FORCE_RETRY) {
ha_alert("QUIC listener with quic-force-retry requires global cluster-secret to be set.\n");
cfgerr++;
}
}
li_init_per_thr(listener);
}