POST Request with response 302 and content-length 0 crashes nginx

[Søren Christian Aarup]

In the process of setting up Nginx as reverse proxy in front of my apaches I have come across a bug which crashes nginx.
When the client sends the following:
POST /netbank/invoice_ok HTTP/1.1
Host: 172.26.11.11
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: Chunked
DNT: 1
Cookie: PMLCID=XXXXXXXXXXXXXXXXXX
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 3

x=x

Nginx crashes in an infinite loop at src/http/ngx_http_write_filter_module.c:116

The response Nginx receives from apache is (which never comes back to the client):
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.6.0
Date: Mon, 30 Jun 2014 14:44:54 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Location: ​http://google.com

And after some debugging it is discovered that it only happens with POST requests and only with Content-Length: 0 on the response-header. If I add content to the body and a corresponding Content-Length in the response, it works fine. I have compiled Nginx with the version 2.8 version of modsecurity and this problem only occurs if I enable modsecurity (Detection mode only though)! However, the infinite loop is occuring in the Nginx code. I have tested both 1.7.1 and 1.6.0 and they act the same way.

To easier reproduce this I created a perl-script (attached) which can be served with netcat and sends the above response. Running it in a loop like this: while true; do perl redirect.cgi | nc -l -p 1500 ; sleep 1; done

[Søren Christian Aarup]

Perl script to produce response with netcat

[maxim]

Hello,

Have you tried to repoduce the crash without modsecurity compiled in?

[Valentin V. Bartenev]

this problem only occurs if I enable modsecurity

Since you can't reproduce it without the 3rd-party module, so there's no evidence that the problem is in nginx itself. It's very easy for 3rd-party modules to break nginx by incorrect use of its internal API.