Hello,

I came across a situation when using X-Accel-Redirect could lead to a
segfault (tested on the latest version - hg changeset 9207:73eb75bee30f
but I believe this has been there for a long time).

It occurs only if the response with the X-Accel-Redirect header is
firstly cached (when using proxy_ignore_headers to not interpret this
header) and later this cached response is interpreted (after removing
the X-Accel-Redirect from the proxy_ignore_headers directive). I
prepared a simple testcase to reproduce it: use the attached nginx.conf
file and run this curl (the first request caches the response, the
second one tries to interpret it):

    curl localhost:1080 localhost:1081

Also, I believe that the core of the problem is because of the
ngx_http_finalize_request(r, NGX_DONE); call in the
ngx_http_upstream_process_headers function. This call is needed when
doing an internal redirect after the real upstream request (to close the
upstream request), but when serving from the cache, there is no upstream
request to close and this call causes ngx_http_set_lingering_close to be
called from the ngx_http_finalize_connection with no active request on
the connection yielding to the segfault.

See the attached patch. Tested on our side and this fix works, also run
through the nginx-tests and ok,  but I am not thoroughly sure that I am
not forgetting some cases.

Thank you for your review.

Sincerely
Jiří Setnička
daemon off;

events {
worker_connections 768;
}

http {
proxy_cache_path /usr/local/nginx/cache levels=1:2 keys_zone=cache:64m;
proxy_cache cache;
proxy_buffering on;
proxy_cache_valid 200 1d;

server {
listen 1080;
location / {
proxy_ignore_headers X-Accel-Redirect;
proxy_pass http://localhost:1082;
}
}

server {
listen 1081;
location / {
proxy_pass http://localhost:1082;
}
}

server {
listen 1082;
location / {
add_header X-Accel-Redirect "/redirected";
return 200 "ORIG";
}
location /redirected {
return 200 "REDIRECTED";
}
}
}

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx-devel