Bug #10937
closed
HAProxy frontend and backend entry limit
Added by Marcos M over 4 years ago.
Updated about 3 years ago.
Description
There seems to be some sort of limit in the number of entries/rows you can have in a single haproxy frontend or backend.
- In backends, it shows an error after clicking save at 292 server rows. Error: The value " in field 'Client timeout' is not a number
- In frontends, it shows an error after clicking save at 122 action rows with 1 ext address entry. Depending on the combination of entries(ext address entries, acl entries, action entries), the overall limit changes. Error: The field 'Strict-Transport-Security' is not empty or a number.
This is reproducible in 2.5.0, 2.4.5-p1, as well as haproxy and haproxy-devel packages.
Steps to reproduce:
- Start with a default configuration of haproxy-devel
- Click Add to create a front end; give it a name.
- Click the arrow to add an action; leave everything else as is.
- Click Save.
- Edit the new frontend and duplicate the action entry until there's a total of 121, then click save.
- Edit the new frontend and create 1 duplicate action entry and click save.
- Error appears.
Files
Some additional files from testing.
Making the following change then restarting php-fpm and webConfigurator (option 16 & 11 in console) resolved the issue:
In the file:
/etc/rc.php_ini_setup
Change:
max_input_vars = 5000
to:
max_input_vars = 50000
I looked for existing CVE's around increasing the limit, but did not find any issues with it. I would agree however that increasing the limit is not ideal and a more efficient form submission method should be implemented.
Error still present on 21.02.2 using haproxy-devel.
Tested on 21.09.a.20210517.0100 and the issue persists, but php crashes instead and the user receives a "CSRF check failed" error:
Crash report begins. Anonymous machine information:
amd64
12.2-STABLE
FreeBSD 12.2-STABLE plus-devel-12-n202543-5c42cd642845 pfSense
Crash report details:
PHP Errors:
[18-May-2021 18:33:39 Etc/UTC] PHP Warning: Unknown: Input variables exceeded 5000. To increase the limit change max_input_vars in php.ini. in Unknown on line 0
[18-May-2021 18:33:39 Etc/UTC] PHP Warning: Cannot modify header information - headers already sent in /usr/local/www/guiconfig.inc on line 30
[18-May-2021 18:33:39 Etc/UTC] PHP Warning: session_start(): Cannot start session when headers already sent in /etc/inc/phpsessionmanager.inc on line 41
[18-May-2021 18:33:39 Etc/UTC] PHP Warning: Cannot modify header information - headers already sent in /usr/local/www/csrf_error.php on line 22
[18-May-2021 18:33:39 Etc/UTC] PHP Warning: session_start(): Cannot start session when headers already sent in /etc/inc/phpsessionmanager.inc on line 41
[18-May-2021 18:33:39 Etc/UTC] PHP Warning: Cannot modify header information - headers already sent in /usr/local/www/csrf/csrf-magic.php on line 234
No FreeBSD crash data found.
- Status changed from New to Pull Request Review
- Assignee set to Viktor Gurov
- Status changed from Pull Request Review to Feedback
- Related to Bug #12692: Haproxy backend issue added
Tested on
2.6.0-RELEASE (amd64)
built on Mon Jan 31 19:57:53 UTC 2022
FreeBSD 12.3-STABLE
on haproxy-devel 0.62_8 and it behaves as expected even when a large number of entries are input. Marking as resolved.
- Status changed from Feedback to Resolved
Also available in: Atom
PDF