http proxy module: wrong Content-Length shared between main request and subrequests

[Sergey Kandaurov]

lanshun zhou <zls.sogou@…> reports:

Nginx uses a variable "$proxy_internal_body_length" for the "Content-Length" header in http proxy module, which is cacheable and shared between the main request and all subrequests by default. Although ctx->internal_body_length is calculated for each request/subrequest, the string format is cached after the first generation, and this may be wrong for other subrequests.

The following simple config can reproduce the problem, where xxxxx is a place that can receive post data. curl --data-binary "xxxxxxxxxxxxxxx" localhost/test.html will cause the client hang.

      location = /test.html {
        add_after_body /vpost;

        proxy_pass http://xxxxx;
      }

      location /vpost {
        proxy_set_body "in vpost";

        proxy_pass http://xxxxx;
      }

Reference: ​http://mailman.nginx.org/pipermail/nginx-devel/2013-May/003669.html

diff -r 0ebf6344db81 src/http/modules/ngx_http_proxy_module.c
--- a/src/http/modules/ngx_http_proxy_module.c	Fri Apr 26 11:11:03 2013 +0800
+++ b/src/http/modules/ngx_http_proxy_module.c	Fri May 03 10:52:41 2013 +0800
@@ -615,7 +615,8 @@
 #endif
 
     { ngx_string("proxy_internal_body_length"), NULL,
-      ngx_http_proxy_internal_body_length_variable, 0, NGX_HTTP_VAR_NOHASH, 0 },
+      ngx_http_proxy_internal_body_length_variable, 0,
+      NGX_HTTP_VAR_NOCACHEABLE|NGX_HTTP_VAR_NOHASH, 0 },
 
     { ngx_null_string, NULL, NULL, 0, 0, 0 }
 };

[Maxim Dounin]

Patch committed, [bfb99b75833b].