Opened 5 weeks ago

Closed 5 weeks ago

#2388 closed defect (duplicate)

proxy_intercept_errors breaks keepalive connections

Reported by: mhofstra@… Owned by:
Priority: minor Milestone:
Component: nginx-module Version:
Keywords: proxy keepalive Cc:
uname -a: Linux rpi-woonkamer 5.15.32-v8+ #1538 SMP PREEMPT Thu Mar 31 19:40:39 BST 2022 aarch64 GNU/Linux
nginx -V: nginx version: nginx/1.18.0
built with OpenSSL 1.1.1n 15 Mar 2022
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -ffile-prefix-map=/build/nginx-vNp64q/nginx-1.18.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module

Description

Tested with multiple versions. This is the simplest case that can be reproduced. Apologies if not following standards here, this is my first nginx bug report.

Intention: I want to leverage proxy with keepalive using the upstream API. When the upstream returns a non-200 status code, I want to capture this and return a different page with a 200 status code.

What happens: If I set proxy_intercept_errors on with error_page directives, an upstream error code kills the keepalive connection. This is not desirable, because both ends have the intention to keep the connection open.

Working config:

        upstream nginx_upstream {
          server nginx.org;
          keepalive 5;
        }

        server {
          listen 127.0.0.1:80;
          location ^~ /test/ {
            rewrite ^/test/(.*) /$1 break;
            proxy_pass http://nginx_upstream;
            proxy_set_header Host nginx.org;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_socket_keepalive on;
            #proxy_intercept_errors on;
            #error_page 404 =200 /index.html;
          }
        }

Not working config:

        upstream nginx_upstream {
          server nginx.org;
          keepalive 5;
        }

        server {
          listen 127.0.0.1:80;
          location ^~ /test/ {
            rewrite ^/test/(.*) /$1 break;
            proxy_pass http://nginx_upstream;
            proxy_set_header Host nginx.org;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_socket_keepalive on;
            proxy_intercept_errors on;
            error_page 404 =200 /index.html;
          }
        }

Testing (from localhost):
curl -v 127.0.0.1:80/test/ > /dev/null (returns 200 from upstream)
curl -v 127.0.0.1:80/test/asdf > /dev/null (returns 404 from upstream)

Logging (debug) with working config:
$ tail -f /var/log/nginx/error.log | grep 'free keepalive'
2022/09/02 16:23:01 [debug] 162002#162002: *1 free keepalive peer
2022/09/02 16:23:01 [debug] 162002#162002: *1 free keepalive peer: saving connection 0000007F8619E3B0
2022/09/02 16:23:13 [debug] 162002#162002: *3 free keepalive peer
2022/09/02 16:23:13 [debug] 162002#162002: *3 free keepalive peer: saving connection 0000007F8619E498

Logging (debug) with not working config:
$ tail -f /var/log/nginx/error.log | grep 'free keepalive'
2022/09/02 16:28:33 [debug] 162429#162429: *1 free keepalive peer
2022/09/02 16:28:33 [debug] 162429#162429: *1 free keepalive peer: saving connection 0000007F994E53B0
2022/09/02 16:28:43 [debug] 162429#162429: *3 free keepalive peer

Verified with GDB that keepalive = 0 in the upstream connection. In tcpdump I can see the FIN packets coming from my host.

Change History (1)

comment:1 by Maxim Dounin, 5 weeks ago

Resolution: duplicate
Status: newclosed

Duplicate of #2033.

Note: See TracTickets for help on using tickets.