http proxy module: wrong Content-Length shared between main request and subrequests

[Sergey Kandaurov]

lanshun zhou <zls.sogou@…> reports:

Nginx uses a variable "$proxy_internal_body_length" for the "Content-Length" header in http proxy module, which is cacheable and shared between the main request and all subrequests by default. Although ctx->internal_body_length is calculated for each request/subrequest, the string format is cached after the first generation, and this may be wrong for other subrequests.

The following simple config can reproduce the problem, where xxxxx is a place that can receive post data. curl --data-binary "xxxxxxxxxxxxxxx" localhost/test.html will cause the client hang.

location = /test.html {

add_after_body /vpost;

proxy_pass ​http://xxxxx;

}

location /vpost {

proxy_set_body "in vpost";

proxy_pass ​http://xxxxx;

}

Reference: ​http://mailman.nginx.org/pipermail/nginx-devel/2013-May/003669.html

diff -r 0ebf6344db81 src/http/modules/ngx_http_proxy_module.c
--- a/src/http/modules/ngx_http_proxy_module.c Fri Apr 26 11:11:03 2013 +0800
+++ b/src/http/modules/ngx_http_proxy_module.c Fri May 03 10:52:41 2013 +0800
@@ -615,7 +615,8 @@

#endif

{ ngx_string("proxy_internal_body_length"), NULL,

• ngx_http_proxy_internal_body_length_variable, 0, NGX_HTTP_VAR_NOHASH, 0 },

+ ngx_http_proxy_internal_body_length_variable, 0,
+ NGX_HTTP_VAR_NOCACHEABLE|NGX_HTTP_VAR_NOHASH, 0 },

{ ngx_null_string, NULL, NULL, 0, 0, 0 }

};