"Error while Hello: bufio: buffer full" passtlsclientcert

rowi1de · June 9, 2021, 9:12am

Hey Folks,

I'm occasionally getting "Error while Hello: bufio: buffer full" when using PassTLSClientCert - Traefik | Site | v2.0

It seems the default is 4096 Bytes and I don't see any configuration option to change that.

traefik/traefik/blob/v2.4/pkg/tcp/router.go#L39

    
      
          
          
// ServeTCP forwards the connection to the right TCP/HTTP handler.
          func (r *Router) ServeTCP(conn WriteCloser) {
          	// FIXME -- Check if ProxyProtocol changes the first bytes of the request
          
          
	if r.catchAllNoTLS != nil && len(r.routingTable) == 0 {
          		r.catchAllNoTLS.ServeTCP(conn)
          		return
          	}
          
          
	br := bufio.NewReader(conn)
          	serverName, tls, peeked, err := clientHelloServerName(br)
          	if err != nil {
          		conn.Close()
          		return
          	}
          
          
	// Remove read/write deadline and delegate this to underlying tcp server (for now only handled by HTTP Server)
          	err = conn.SetReadDeadline(time.Time{})
          	if err != nil {
          		log.WithoutContext().Errorf("Error while setting read deadline: %v", err)

This issue had the same issue traefik does not passTLSClientCert on tls session resumption · Issue #7644 · traefik/traefik · GitHub
It only happens when also using Session Resume, so I assume that the session resume header/cookie + cert break the 4096 Byte Limit?

ldez · June 10, 2021, 8:27am

Hello,

We are aware of the bug, I am working on.

github.com/traefik/traefik

traefik does not passTLSClientCert on tls session resumption

opened 02:58PM - 09 Dec 20 UTC

kayuma

area/tls kind/bug/confirmed

### Do you want to request a *feature* or report a *bug*?  Bug  ### What did you do?  Configured middleWare "passTLSClientCert" to be able to retrieve the Client certificate informations on the backend via http header as documented. In my case I want to evaluate these headers on the forwardAuth service. Works fine as long as no tls session resumption is happening (first request). ### What did you expect to see? http headers with the certificate informations on every request: - X-Forwarded-Tls-Client-Cert - X-Forwarded-Tls-Client-Cert-Info ### What did you see instead? Headers are not set when a tls session is reused. I even get log entries in this case: ``` time="2020-12-09T14:49:53Z" level=error msg="Error while Hello: bufio: buffer full" time="2020-12-09T14:49:53Z" level=warning msg="Tried to extract a certificate on a request without mutual TLS" middlewareName=esb-test-passtlscert@kubernetescrd middlewareType=PassClientTLSCert ``` ### Output of `traefik version`: (_What version of Traefik are you using?_)  ``` 2.3.4 ``` ### What is your environment & configuration (arguments, toml, provider, platform, ...)? ```yml apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: name: passtlscert spec: passTLSClientCert: pem: false info: subject: commonName: true serialNumber: true issuer: commonName: true serialNumber: true ```  ### If applicable, please paste the log output in DEBUG level (`--log.level=DEBUG` switch) ``` time="2020-12-09T14:49:53Z" level=error msg="Error while Hello: bufio: buffer full" time="2020-12-09T14:49:53Z" level=warning msg="Tried to extract a certificate on a request without mutual TLS" middlewareName=esb-test-passtlscert@kubernetescrd middlewareType=PassClientTLSCert ```

system · June 13, 2021, 8:27am

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Error parsing headers: 'limit request headers fields size' Traefik v2 (latest) kubernetes-ingress , middleware	2	1325	November 16, 2021
Internal server error with large requests (>10MB) Traefik v1 docker	1	868	September 3, 2020
Upload size >2GB? Traefik v2 (latest) file	3	1960	September 25, 2022
500 errors with HTTP/1.1 Traefik v2 (latest) tcp	2	819	May 31, 2022
How to increase buffering limits in Traefik v2 Traefik v2 (latest) middleware	0	365	November 23, 2021

"Error while Hello: bufio: buffer full" passtlsclientcert

Related Topics