From 3377c001191d13d5f7bfbb111c323152d91a9603 Mon Sep 17 00:00:00 2001 From: Maxim Dounin Date: Thu, 11 Jan 2018 21:43:49 +0300 Subject: [PATCH] Upstream: fixed "header already sent" alerts on backend errors. Following ad3f342f14ba046c (1.9.13), it is possible that a request where header was already sent will be finalized with NGX_HTTP_BAD_GATEWAY, triggering an attempt to return additional error response and the "header already sent" alert as a result. In particular, it is trivial to reproduce the problem with a HEAD request and caching enabled. With caching enabled nginx will change HEAD to GET and will set u->pipe->downstream_error to suppress sending the response body to the client. When a backend-related error occurs (for example, proxy_read_timeout expires), ngx_http_finalize_upstream_request() will be called with NGX_HTTP_BAD_GATEWAY. After ad3f342f14ba046c this will result in ngx_http_finalize_request(NGX_HTTP_BAD_GATEWAY). Fix is to move u->pipe->downstream_error handling to a later point, where all special response codes are changed to NGX_ERROR. Reported by Jan Prachar, http://mailman.nginx.org/pipermail/nginx-devel/2018-January/010737.html. --- src/http/ngx_http_upstream.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c index f8d5707d3..736ab6349 100644 --- a/src/http/ngx_http_upstream.c +++ b/src/http/ngx_http_upstream.c @@ -4374,8 +4374,7 @@ ngx_http_upstream_finalize_request(ngx_http_request_t *r, if (!u->header_sent || rc == NGX_HTTP_REQUEST_TIME_OUT - || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST - || (u->pipe && u->pipe->downstream_error)) + || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST) { ngx_http_finalize_request(r, rc); return; @@ -4388,7 +4387,9 @@ ngx_http_upstream_finalize_request(ngx_http_request_t *r, flush = 1; } - if (r->header_only) { + if (r->header_only + || (u->pipe && u->pipe->downstream_error)) + { ngx_http_finalize_request(r, rc); return; }