proxy_cache_bypass and non-200 response

2017-09-26 Thread Grzegorz Kulewski
Hello, I think I found a bug or undocumented feature in nginx. Or it's just me being stupid. I am debugging the following case: 1. I have an upstream that sometimes returns HTTP 200 and sometimes returns HTTP 401 and both codes are OK from my point of view. Both are returned with X-Accel-Expir

Re: auth_request called multiple times for same single request

2017-09-26 Thread garyc
Ok, thanks, I will look into tcpdump. In your opinion, in principle, is what i am attempting feasible? >In the second case, 30 seconds after the response was sent by nginx, the >request body still wasn't received and nginx had nothing to do than just >close the connection. This suggests to me tha

Re: OCSP stapling and resolver

2017-09-26 Thread Grzegorz Kulewski
W dniu 26.09.2017 15:20, Maxim Dounin pisze: > Hello! > > On Tue, Sep 26, 2017 at 03:48:57AM +0200, Grzegorz Kulewski wrote: > >> Is resolver in nginx still needed for OCSP stapling? > > Yes. > >> I am getting a warning from nginx if resolver is not supplied >> but at the same time both Qualys

Re: load balancing algorithms

2017-09-26 Thread Maxim Dounin
Hello! On Tue, Sep 26, 2017 at 09:43:37AM -0400, Adam Schwartz wrote: > > On the other hand, there is API in nginx which allows to implement > > any load balancing algorithm needed. > > Cool! I was looking for something like that. > > > As for the algorithms you've mentioned, "power of two cho

Re: server_name that starts with a number

2017-09-26 Thread rainer
Am 2017-09-26 16:15, schrieb Maxim Dounin: Hello! Note well that testing with browsers is generally a bad idea, as browsers tend to cache responses. I almost always test with curl. I can see that the nginx access log of the vhost where the requests are supposed to show up is empty. They d

Re: auth_request called multiple times for same single request

2017-09-26 Thread Valentin V. Bartenev
On Tuesday 26 September 2017 05:07:25 garyc wrote: [..] > > indicate that the request was unacknowledged by the client hence the http > request is closed along with the connection: > > > 2017/09/21 12:09:31 [debug] 22090#0: *1 close http connection: 3 > > and it is marked as non re-usable? > >

Re: server_name that starts with a number

2017-09-26 Thread Maxim Dounin
Hello! On Tue, Sep 26, 2017 at 02:42:41PM +0200, rai...@ultra-secure.de wrote: > I have a website that has a server_name that starts with a number (or > two numbers, actually). > > I also have a catchall default_server configured with the server_name > "_". > > Now, it seems when the server_n

Re: 'real_ip_header proxy_protocol' don't change the client address

2017-09-26 Thread Maxim Dounin
Hello! On Tue, Sep 26, 2017 at 07:02:33AM -0400, fengx wrote: > I have the setting as follow: > > real_ip_header proxy_protocol; > real_ip_recursive on; > set_real_ip_from 192.168.1.0/24; > > For example, when I send request to nginx from 10.0.0.1, > $proxy_protocol_addr prints 10.0.0.1, wh

Re: load balancing algorithms

2017-09-26 Thread Adam Schwartz
> On the other hand, there is API in nginx which allows to implement > any load balancing algorithm needed. Cool! I was looking for something like that. > As for the algorithms you've mentioned, "power of two choices" seems > to be better than random, though it does not look like it is > benef

Re: OCSP stapling and resolver

2017-09-26 Thread Maxim Dounin
Hello! On Tue, Sep 26, 2017 at 03:48:57AM +0200, Grzegorz Kulewski wrote: > Is resolver in nginx still needed for OCSP stapling? Yes. > I am getting a warning from nginx if resolver is not supplied > but at the same time both Qualys and openssl s_client output > suggest OCSP stapling is worki

server_name that starts with a number

2017-09-26 Thread rainer
Hi, I have a website that has a server_name that starts with a number (or two numbers, actually). I also have a catchall default_server configured with the server_name "_". Now, it seems when the server_name starts with a number, it's ignored and requests are routed to the default server.

Re: Nginx splitting one single request's into multiple requests to upstream. (version 1.13.3)

2017-09-26 Thread Peter Booth
Pankaj, I can’t understand exactly what you are saying. But I’m confident that here will be a way for nginx to work for you, providing you ask the question in a clear, unambiguous fashion. Is your application behind nginx, such that nginx is POSTING to the app? Or is your application making th

Re: Two Way SSL - client SSL certificate verify error

2017-09-26 Thread vikas027
This stands resolved now. Pls visit this thread https://serverfault.com/questions/875229/two-way-ssl-error-400-the-ssl-certificate-error-just-for-client-certificate/875547 Posted at Nginx Forum: https://forum.nginx.org/read.php?2,276514,276546#msg-276546

Nginx splitting one single request's into multiple requests to upstream. (version 1.13.3)

2017-09-26 Thread pankaj
Hi there,Not sure if anyone has experienced this before.I have a app which gets requests with header "Transfer-Encoding: chunked" and get's a json doc as a post call. For some reason, nginx is in most cases splitting that document into multiple request to upstream server. That said in some cases it

Re: 'real_ip_header proxy_protocol' don't change the client address

2017-09-26 Thread fengx
I have the setting as follow: real_ip_header proxy_protocol; real_ip_recursive on; set_real_ip_from 192.168.1.0/24; For example, when I send request to nginx from 10.0.0.1, $proxy_protocol_addr prints 10.0.0.1, which is the original client, but $remote_addr prints 192.168.1.1 which is our pro

'real_ip_header proxy_protocol' don't change the client address

2017-09-26 Thread fengx
Hello, I have enabled proxy_protocol like 'listen 8080 proxy_protocol' and can get the right client address from the $proxy_protocol_addr parameter. I also set 'real_ip_header proxy_protocol', but it don't change the $remote_addr parameter. It says 'The proxy_protocol parameter (1.5.12) changes

Re: auth_request called multiple times for same single request

2017-09-26 Thread garyc
Hello, thanks for explaining, can I ask, in the 5MB scenario (client accepted 413 response) the logs show: 2017/09/21 12:06:41 [debug] 21560#0: *1 http run request: "/pcapLowDiskSpace.html?" 2017/09/21 12:06:41 [debug] 21560#0: *1 http read discarded body 2017/09/21 12:06:41 [debug] 21560#0: *1 re

Re: OCSP stapling and resolver

2017-09-26 Thread A. Schulze
Grzegorz Kulewski: Hello, Is resolver in nginx still needed for OCSP stapling? I am getting a warning from nginx if resolver is not supplied but at the same time both Qualys and openssl s_client output suggest OCSP stapling is working. Strange There are two options - let nginx fetch th