Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

haproxy configuration fails when maxips=1 and path_ips flushes #57

Open
parhawm opened this issue Dec 13, 2023 · 2 comments
Open

haproxy configuration fails when maxips=1 and path_ips flushes #57

parhawm opened this issue Dec 13, 2023 · 2 comments
Labels
bug Something isn't working

Comments

@parhawm
Copy link

parhawm commented Dec 13, 2023

just after I set my maxips count to 1 I noticed random disconnections, so I investigated further into 429 errors
Haproxy container logs showed a loop of connection - flush - disconnection

I'd share the log if anyone is interested

@VZiChoushaDui VZiChoushaDui added the bug Something isn't working label Jan 8, 2024
@VZiChoushaDui
Copy link
Owner

Sorry for the delay. Please share the log.

@parhawm
Copy link
Author

parhawm commented Jan 13, 2024

No problem, unfortunately I don't have the logs any more. I also used and modified your lua script to implement a way to limit ips without timeouts during this time, users are able to connect as soon as another one disconnects, so thanks for the idea.

I don't know lua, but I read the script at the time for several hours and figured out what's wrong with it;
so if ip_limit is x and x users are connected, whenever we flush the table:

flush_if_needed()

the username isn't in the path_ips_list[1], so these lines happen:

Libertea/haproxy/script.lua

Lines 175 to 178 in b07ff61

if getLength(path_ips_list[ip_user_connected_list_items][username]) >= maxIps then
logWarn("User " .. username .. " has reached max number of " .. maxIps .. " ips. Will deny request from " .. user_ip .. " on " .. hostname .. "\n")
txn:set_var("txn.auth_response_successful", false)
return

and we'd look path_ips_list[2] for the length of ips, which is indeed equal to x.
so the function returns and the user is banned until the next flush happens.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants