Welcome! Log In Create A New Profile

Advanced

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Maxim Dounin
March 15, 2013 04:12AM
Hello!

On Fri, Mar 15, 2013 at 03:22:31PM +1100, Robert Mueller wrote:

[...]

> When using http with my test client, I see this in the nginx log when
> the client disconnects:
>
> 2013/03/14 23:27:27 [info] 27717#0: *1 client prematurely closed
> connection, so upstream connection is closed too while reading upstream,
> client: 10.50.1.14, server: www.*, request: "GET /events/ HTTP/1.0",
> upstream: "http://127.0.0.4:80/.../", host: "..."
>
> And when I check netstat, I see that the connection from nginx ->
> pushbackend has been dropped as well.
>
> However for https connections, this is not what happens. Instead, it
> appears nginx fails to detect that the client has closed the connection,
> and leaves the nginx -> pushbackend connection open (confirmed with
> netstat). And because we set proxy_read_timeout to 2 hours, it takes 2
> hours for that connection to be closed! That's bad.

You shouldn't rely on connection close being detected by nginx.
It's generally useful optimization, but it's not something which
is guaranteed to work.

It is generally not possible to check if the connection was closed
if there a pending data in it. One have to read all pending data
before connection close can be detected, but it doesn't work as a
generic detection mechanism as one have to buffer read data
somewhere.

As of now, nginx uses:

1) A EV_EOF flag as reported by kqueue. This only works if you
use kqueue, i.e. on FreeBSD and friends.

2) The recv(MSG_PEEK) call to test a case when connection was
closed. This works on all platforms, but only if there are no
pending data.

In case of https, in many (most) cases there are pending data -
due to various SSL packets send during connection close. This
means connection close detection with https doesn't work unless
you use kqueue.

Further reading:

http://mailman.nginx.org/pipermail/nginx/2011-June/027672.html
http://mailman.nginx.org/pipermail/nginx/2011-November/030630.html

--
Maxim Dounin
http://nginx.org/en/donation.html

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

Dropped https client connection doesn't drop backend proxy_pass connection

Robert Mueller March 15, 2013 12:24AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Maxim Dounin March 15, 2013 04:12AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Robert Mueller March 15, 2013 06:34PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Maxim Dounin March 16, 2013 07:50PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Robert Mueller March 19, 2013 12:46AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Maxim Dounin March 19, 2013 10:56AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Robert Mueller March 19, 2013 09:08PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Lintao L. June 26, 2013 10:48PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Robert Mueller July 08, 2013 10:54PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Maxim Dounin July 09, 2013 08:10AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Robert Mueller July 22, 2013 08:08PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Maxim Dounin July 23, 2013 12:12PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Peter B. May 12, 2014 06:48PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Valentin V. Bartenev May 13, 2014 03:52AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Peter B. May 13, 2014 10:20AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

newnovice May 16, 2014 06:32PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Valentin V. Bartenev May 17, 2014 05:44AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

newnovice May 17, 2014 11:28AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Valentin V. Bartenev May 19, 2014 10:48AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Demetr May 19, 2014 11:12AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

newnovice May 19, 2014 05:32PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Valentin V. Bartenev May 20, 2014 01:00AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

newnovice May 20, 2014 02:04AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

dgobaud July 13, 2015 12:02PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Valentin V. Bartenev July 14, 2015 09:26AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

dgobaud July 14, 2015 11:50AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

dgobaud July 14, 2015 12:43PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

Maxim Dounin July 14, 2015 01:38PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

dgobaud July 15, 2015 07:04AM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

tdavis January 27, 2016 11:16PM

Re: Dropped https client connection doesn't drop backend proxy_pass connection

dgobaud January 28, 2016 01:59AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 97
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 500 on July 15, 2024
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready