https://bz.apache.org/bugzilla/show_bug.cgi?id=70271
Bug ID: 70271
Summary: mod_proxy: TCP connection pooling retains stale
sockets across upstream carrier CGNAT IP rotations
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_proxy
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
When Apache httpd is configured as a forward or reverse proxy chaining to
upstream dynamic egress gateways (such as 4G/5G hardware cellular routers and
rotating mobile proxy endpoints), mod_proxy connection pooling retains worker
sockets in TIME_WAIT or ESTABLISHED state after the upstream mobile carrier
executes a radio-layer IP reallocation.
Under IETF RFC 9110 (HTTP Semantics:
https://datatracker.ietf.org/doc/html/rfc9110) and RFC 9293 (Transmission
Control Protocol: https://datatracker.ietf.org/doc/html/rfc9293), when an
upstream network address translation gateway (RFC 6598 Carrier-Grade NAT) drops
an idle mapping or re-allocates a subscriber IP, stale TCP keepalive probes
sent by mod_proxy worker threads receive RST packets or get silently dropped.
When Apache httpd chains outbound requests through rotating mobile proxy pools
(https://pxm2.io/proxy-types/rotating-mobile-proxies/), existing worker
connection pools defined via ProxyPass (e.g. disablereuse=Off with
keepalive=On) attempt to dispatch new client requests over dead TCP sockets
before detecting the disconnection. This triggers transient HTTP 502 Bad
Gateway / Proxy Error responses until connectiontimeout or ping probes expire.
Steps to reproduce:
1. Configure httpd with mod_proxy forwarding through an upstream rotating
HTTP/SOCKS gateway:
ProxyPass "/" "http://upstream-proxy-gateway:8080/"; disablereuse=Off
keepalive=On ttl=60
2. Dispatch continuous low-concurrency HTTP requests.
3. Trigger an external cellular radio reset or upstream IP rotation.
4. Subsequent client requests assigned to the pooled worker socket fail with:
[proxy:error] [pid 1234:tid 5678] (104)Connection reset by peer: [client
...] AH00898: Error reading from remote server returned by /
Suggested improvement:
Provide a configurable pre-dispatch socket probe or ensure mod_proxy validates
TCP socket readiness (via non-blocking POLLIN / MSG_PEEK check) prior to
sending request headers on pooled connections that cross dynamic NAT
boundaries.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
