Nginx does not handle URL larger than 8K

[kvaps@…]

Steps to reproduce:

# curl "https://example.org/$(head -c 9999 /dev/zero |tr '\0' 'a')"
curl: (52) Empty reply from server

Logs are clean, these parameters does not affect original issue:

large_client_header_buffers 16 64k;
client_body_buffer_size 1M;
client_header_buffer_size 1M;

[kvaps@…]

Discussion:
​https://t.me/nginx_ru/82745
(russian)

[kvaps@…]

verbose log enabled:

# curl -svv "https://victoriametrics.example.org/$(head -c 9999 /dev/zero |tr '\0' 'a')" 
*   Trying 10.36.1.99:443...
* TCP_NODELAY set
* Connected to victoriametrics.example.org (10.36.1.99) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [106 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4236 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [556 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=CZ; CN=*.example.org; emailAddress=domains@example.com
*  start date: Feb 27 12:25:50 2017 GMT
*  expire date: Feb 27 12:25:50 2020 GMT
*  subjectAltName: host "victoriametrics.example.org" matched cert's "*.example.org"
*  issuer: C=PL; O=Unizeto Technologies S.A.; OU=Certum Certification Authority; CN=Certum Domain Validation CA SHA2
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
} [5 bytes data]
* Using Stream ID: 1 (easy handle 0x557c761d2dd0)
} [5 bytes data]
> GET /aaaaaaa HTTP/2
> Host: victoriametrics.example.org
> user-agent: curl/7.67.0
> accept: */*
> 
{ [5 bytes data]
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
} [5 bytes data]
* TLSv1.2 (IN), TLS alert, close notify (256):
{ [2 bytes data]
* Empty reply from server
* Closing connection 0
} [5 bytes data]
* TLSv1.2 (OUT), TLS alert, close notify (256):
} [2 bytes data]

[Maxim Dounin]

You are using HTTP/2, and the request exceeds default http2_max_field_size. There should be something like this in logs at the info level:

2019/12/26 16:39:40 [info] 34596#100149: *2 client exceeded http2_max_field_size limit while processing HTTP/2 connection, client: 127.0.0.1, server: 0.0.0.0:8443

Consider tuning ​http2_max_field_size.

Duplicate of #1520.

[kvaps@…]

This problem affects only http2 protocol:

http2_max_header_size 1M;
http2_max_field_size 1M;

solves issue