Re: HAProxy and proxy protocol support

On 2024-06-12 23:35, Sam Varshavchik wrote:
> Andrew Athan writes:
>
>> « HTML content follows
>>
>> »Sam:
>>
>>
>> I've googled but not been able to find a reference to this 
>> duplication of initial bytes issue in TFO. Can you provide more 
>> information?
>
> This is explicitly called out in RFC 7413 section 6.1.
>
> I also found a layman's description at:
>
> https://netty.io/wiki/tcp-fast-open.html
>
> "TFO cannot always be used, however, because it changes how TCP 
> behave: The receiving end might see this data duplicated due to 
> retransmission of the SYN packet. For this reason, TFO must only be 
> used when the data in the initial packet will be processed 
> idempotently. Whether this is the case, depends on the protocol and 
> the application."
>
>> That seems like a catastrophic bug in the TCP contract. I'd like to 
>> make some colleagues aware of the issue, ideally with a reference to 
>> some analysis of it.
>
> This seems like a well known, known issue with this.

Doesn’t this just mean that a single connection could be seen by the 
server as two connections? As long as the initial data isn’t enough to 
actually enqueue an email, one of those ghost connections should just 
timeout and the other real connection actually process. Therefore, as 
long as SMTP itself has a handshake which the client respects, such as 
the client sending waiting for and validating the response of either 
EHLO, MAIL, or RCPT before sending DATA, then that client is protected 
from this issue. Of course, any client which tries to optimize 
performance by sending blindly without waiting for a server response 
might end up double-queuing an email, which is a valid concern. I wonder 
if it could be argued that such a client is non-compliant.

I also apologize for any misunderstanding of SMTP as I am not very 
familiar with it. I would like some confirmation if I am interpreting 
the concern correctly. I do not think it was mentioned explicitly 
(unless I missed it). Is the concern the possibility of double-queuing a 
single email as I purported above?



_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users