the glib implementation of the http proxy correctly checks the
http response (response code, followed by an empty line)
so we need to answer with the correct status
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
AnyEvent checks rbuf_max after calling the callback (too late), so
we can receive larger data, because AnyEvent uses MAX_READ_SIZE=131072
to fill the buffer.
So a more elegant solution is to set $max_payload_size=128*1024. At least
I am not able to receive rbuf larger than 128*1024 now. But I keep the
protection from the previous patch - just to be sure.
The given patch fixes incoming WebSocket traffic behind buffered Proxies
like NGINX.
NGINX buffers multiple requests from the Browser into one frame and sends that to pveproxy,
before this patch we then processed the first message of the frame and cleared the buffer which
may contained more messages.
With this patch we process each message and clear the buffer right.
This fixes the "NoVNC blank screen" problem users reported on the forums.
Allows to fix a problem where a logged in connected client was logged
out because we could not verify him for this call as the cluster
filesystem was unavailable.
If we get such a exception then use it for responding.
THis is save as no logged out client can get ever do anything where
login privileges are required and a logged in client cannot to
anything during the problematic period, but does not gets logged out.
Partail fix for #1589
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
those are needed for the noVNC upgrade
svg: button images
mp3/oga: bell sound of terminal
json: language files
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
this matches also our wbuf_max settings of our AnyEvent handle
Tested with 1000 parallel started dummy POST request with 64KB
payload, wh
It should not be too problematic to increase the limit
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Previously, we called decode_utf8_parameters(), which only encoded
some parameters. This was just an optimization, and it turend out to
be error prone (for example passwords also contain utf8 parameters).
with openssl 1.0.1, we had to limit ourself to one curve to
allow ECDHE at all.
with openssl 1.1.x, the same limit actually means only
allowing ECDSA certificates using that curve, even for
non-ephemeral ECDH handshakes, effectively only allowing
prime256 EC certificates.
since openssl 1.1.x supports auto-negotiation of the curve
used for ECDHE, simply use that for now.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Some auth_handlers use Crypt::OpenSSL::RSA, which seems to set the openssl error
variable. We need to clear that here, else AnyEvent::TLS aborts the connection.
