[esnible]

What

Close the downstream connection after any final non-2xx response to CONNECT. In prepare_response_header, this adds an else if to the CONNECT 2xx branch that calls set_keepalive(None) before the Connection header value is chosen. A 403/407 to CONNECT is now always sent with Connection: close, and reuse() returns None.

Follow-up to #7. The review is on that PR.

Why

#7 keeps early tunnel bytes (bytes the client sends after the CONNECT head, before the response) out of the next request, but only when they arrive in a later read. The idle branch of read_body_or_idle stashes them and turns keepalive off.

When those bytes arrive in the same read as the CONNECT head, init_content_length_owned(0, preread_body) puts them in overread, and the stash never runs. Keepalive stays on, and on a refusal with pipelining enabled, reuse() passes the overread to the next session as pipelined_prefix:

CONNECT pingora.org:443 HTTP/1.1\r\nHost: pingora.org:443\r\n\r\nGET /x HTTP/1.1\r\nHost: a\r\n\r\n   (one read)
-> 407, Content-Length: 0
-> reuse() == Some(prefix = "GET /x HTTP/1.1...")

A front end that treats bytes after a CONNECT as opaque tunnel data would see them parsed here as an HTTP request. Without pipelining (the default), reuse() already closes because of the overread, but the refusal still said Connection: keep-alive.

Turning keepalive off for every refused CONNECT makes the existing comment ("A refused CONNECT closes the connection") true no matter how the bytes were read. The cost is one new connection for a client that retries after a 407, which a client sees Connection: close for anyway.

Testing

• New same_read_early_bytes_close_a_refused_connect: same read + set_pipelining_enabled(true) + 407, asserts !will_keepalive() and reuse() is None. It fails without the fix.
• cargo test -p quixotic-plecostomus-core --lib: 587 passed.
• cargo test -p quixotic-plecostomus-proxy --lib: 77 passed. --test test_basic connect: 12 passed.
• cargo fmt --all -- --check and cargo clippy -p quixotic-plecostomus-core --all-targets -- -D warnings: clean.

Assisted-By: Claude Code

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7957a4f2-0e24-4853-a64d-b8568dfdab89

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.