details: https://hg.nginx.org/nginx/rev/457afc332c67
branches:
changeset: 8044:457afc332c67
user: Aleksei Bavshin <a.bavshin@f5.com>
date: Mon May 23 11:29:44 2022 -0700
description:
Stream: don't flush empty buffers created for read errors.

When we generate the last_buf buffer for an UDP upstream recv error, it does
not contain any data from the wire. ngx_stream_write_filter attempts to forward
it anyways, which is incorrect (e.g., UDP upstream ECONNREFUSED will be
translated to an empty packet).

This happens because we mark the buffer as both 'flush' and 'last_buf', and
ngx_stream_write_filter has special handling for flush with certain types of
connections (see d127837c714f, 32b0ba4855a6). The flags are meant to be
mutually exclusive, so the fix is to ensure that flush and last_buf are not set
at the same time.

Reproduction:

stream {
upstream unreachable {
server 127.0.0.1:8880;
}
server {
listen 127.0.0.1:8998 udp;
proxy_pass unreachable;
}
}

1 0.000000000 127.0.0.1 → 127.0.0.1 UDP 47 45588 → 8998 Len=5
2 0.000166300 127.0.0.1 → 127.0.0.1 UDP 47 51149 → 8880 Len=5
3 0.000172600 127.0.0.1 → 127.0.0.1 ICMP 75 Destination unreachable (Port
unreachable)
4 0.000202400 127.0.0.1 → 127.0.0.1 UDP 42 8998 → 45588 Len=0

Fixes d127837c714f.

diffstat:

src/stream/ngx_stream_proxy_module.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diffs (12 lines):

diff -r 1afd19dc7161 -r 457afc332c67 src/stream/ngx_stream_proxy_module.c
--- a/src/stream/ngx_stream_proxy_module.c Tue Jun 07 21:58:52 2022 +0300
+++ b/src/stream/ngx_stream_proxy_module.c Mon May 23 11:29:44 2022 -0700
@@ -1737,7 +1737,7 @@ ngx_stream_proxy_process(ngx_stream_sess

cl->buf->temporary = (n ? 1 : 0);
cl->buf->last_buf = src->read->eof;
- cl->buf->flush = 1;
+ cl->buf->flush = !src->read->eof;

(*packets)++;
*received += n;
_______________________________________________
nginx-devel mailing list -- nginx-devel@nginx.org
To unsubscribe send an email to nginx-devel-leave@nginx.org