Opened 2 years ago
Closed 2 years ago
#2388 closed defect (duplicate)
proxy_intercept_errors breaks keepalive connections
| Reported by: | Owned by: | ||
|---|---|---|---|
| Priority: | minor | Milestone: | |
| Component: | nginx-module | Version: | |
| Keywords: | proxy keepalive | Cc: | |
| uname -a: | Linux rpi-woonkamer 5.15.32-v8+ #1538 SMP PREEMPT Thu Mar 31 19:40:39 BST 2022 aarch64 GNU/Linux | ||
| nginx -V: |
nginx version: nginx/1.18.0
built with OpenSSL 1.1.1n 15 Mar 2022 TLS SNI support enabled configure arguments: --with-cc-opt='-g -O2 -ffile-prefix-map=/build/nginx-vNp64q/nginx-1.18.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module |
||
Description
Tested with multiple versions. This is the simplest case that can be reproduced. Apologies if not following standards here, this is my first nginx bug report.
Intention: I want to leverage proxy with keepalive using the upstream API. When the upstream returns a non-200 status code, I want to capture this and return a different page with a 200 status code.
What happens: If I set proxy_intercept_errors on with error_page directives, an upstream error code kills the keepalive connection. This is not desirable, because both ends have the intention to keep the connection open.
Working config:
upstream nginx_upstream {
server nginx.org;
keepalive 5;
}
server {
listen 127.0.0.1:80;
location ^~ /test/ {
rewrite ^/test/(.*) /$1 break;
proxy_pass http://nginx_upstream;
proxy_set_header Host nginx.org;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_socket_keepalive on;
#proxy_intercept_errors on;
#error_page 404 =200 /index.html;
}
}
Not working config:
upstream nginx_upstream {
server nginx.org;
keepalive 5;
}
server {
listen 127.0.0.1:80;
location ^~ /test/ {
rewrite ^/test/(.*) /$1 break;
proxy_pass http://nginx_upstream;
proxy_set_header Host nginx.org;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_socket_keepalive on;
proxy_intercept_errors on;
error_page 404 =200 /index.html;
}
}
Testing (from localhost):
curl -v 127.0.0.1:80/test/ > /dev/null (returns 200 from upstream)
curl -v 127.0.0.1:80/test/asdf > /dev/null (returns 404 from upstream)
Logging (debug) with working config:
$ tail -f /var/log/nginx/error.log | grep 'free keepalive'
2022/09/02 16:23:01 [debug] 162002#162002: *1 free keepalive peer
2022/09/02 16:23:01 [debug] 162002#162002: *1 free keepalive peer: saving connection 0000007F8619E3B0
2022/09/02 16:23:13 [debug] 162002#162002: *3 free keepalive peer
2022/09/02 16:23:13 [debug] 162002#162002: *3 free keepalive peer: saving connection 0000007F8619E498
Logging (debug) with not working config:
$ tail -f /var/log/nginx/error.log | grep 'free keepalive'
2022/09/02 16:28:33 [debug] 162429#162429: *1 free keepalive peer
2022/09/02 16:28:33 [debug] 162429#162429: *1 free keepalive peer: saving connection 0000007F994E53B0
2022/09/02 16:28:43 [debug] 162429#162429: *3 free keepalive peer
Verified with GDB that keepalive = 0 in the upstream connection. In tcpdump I can see the FIN packets coming from my host.
Duplicate of #2033.