Mercurial > hg > nginx-quic
view src/os/unix/ngx_writev_chain.c @ 8366:6df9d7df2784
gRPC: fixed handling of padding on DATA frames.
The response size check introduced in 39501ce97e29 did not take into
account possible padding on DATA frames, resulting in incorrect
"upstream sent response body larger than indicated content length" errors
if upstream server used padding in responses with known length.
Fix is to check the actual size of response buffers produced by the code,
similarly to how it is done in other protocols, instead of checking
the size of DATA frames.
Reported at:
http://mailman.nginx.org/pipermail/nginx-devel/2021-March/013907.html
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Tue, 23 Mar 2021 16:52:23 +0300 |
parents | 2c64b69daec5 |
children |
line wrap: on
line source
/* * Copyright (C) Igor Sysoev * Copyright (C) Nginx, Inc. */ #include <ngx_config.h> #include <ngx_core.h> #include <ngx_event.h> ngx_chain_t * ngx_writev_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit) { ssize_t n, sent; off_t send, prev_send; ngx_chain_t *cl; ngx_event_t *wev; ngx_iovec_t vec; struct iovec iovs[NGX_IOVS_PREALLOCATE]; wev = c->write; if (!wev->ready) { return in; } #if (NGX_HAVE_KQUEUE) if ((ngx_event_flags & NGX_USE_KQUEUE_EVENT) && wev->pending_eof) { (void) ngx_connection_error(c, wev->kq_errno, "kevent() reported about an closed connection"); wev->error = 1; return NGX_CHAIN_ERROR; } #endif /* the maximum limit size is the maximum size_t value - the page size */ if (limit == 0 || limit > (off_t) (NGX_MAX_SIZE_T_VALUE - ngx_pagesize)) { limit = NGX_MAX_SIZE_T_VALUE - ngx_pagesize; } send = 0; vec.iovs = iovs; vec.nalloc = NGX_IOVS_PREALLOCATE; for ( ;; ) { prev_send = send; /* create the iovec and coalesce the neighbouring bufs */ cl = ngx_output_chain_to_iovec(&vec, in, limit - send, c->log); if (cl == NGX_CHAIN_ERROR) { return NGX_CHAIN_ERROR; } if (cl && cl->buf->in_file) { ngx_log_error(NGX_LOG_ALERT, c->log, 0, "file buf in writev " "t:%d r:%d f:%d %p %p-%p %p %O-%O", cl->buf->temporary, cl->buf->recycled, cl->buf->in_file, cl->buf->start, cl->buf->pos, cl->buf->last, cl->buf->file, cl->buf->file_pos, cl->buf->file_last); ngx_debug_point(); return NGX_CHAIN_ERROR; } send += vec.size; n = ngx_writev(c, &vec); if (n == NGX_ERROR) { return NGX_CHAIN_ERROR; } sent = (n == NGX_AGAIN) ? 0 : n; c->sent += sent; in = ngx_chain_update_sent(in, sent); if (send - prev_send != sent) { wev->ready = 0; return in; } if (send >= limit || in == NULL) { return in; } } } ngx_chain_t * ngx_output_chain_to_iovec(ngx_iovec_t *vec, ngx_chain_t *in, size_t limit, ngx_log_t *log) { size_t total, size; u_char *prev; ngx_uint_t n; struct iovec *iov; iov = NULL; prev = NULL; total = 0; n = 0; for ( /* void */ ; in && total < limit; in = in->next) { if (ngx_buf_special(in->buf)) { continue; } if (in->buf->in_file) { break; } if (!ngx_buf_in_memory(in->buf)) { ngx_log_error(NGX_LOG_ALERT, log, 0, "bad buf in output chain " "t:%d r:%d f:%d %p %p-%p %p %O-%O", in->buf->temporary, in->buf->recycled, in->buf->in_file, in->buf->start, in->buf->pos, in->buf->last, in->buf->file, in->buf->file_pos, in->buf->file_last); ngx_debug_point(); return NGX_CHAIN_ERROR; } size = in->buf->last - in->buf->pos; if (size > limit - total) { size = limit - total; } if (prev == in->buf->pos) { iov->iov_len += size; } else { if (n == vec->nalloc) { break; } iov = &vec->iovs[n++]; iov->iov_base = (void *) in->buf->pos; iov->iov_len = size; } prev = in->buf->pos + size; total += size; } vec->count = n; vec->size = total; return in; } ssize_t ngx_writev(ngx_connection_t *c, ngx_iovec_t *vec) { ssize_t n; ngx_err_t err; eintr: n = writev(c->fd, vec->iovs, vec->count); ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0, "writev: %z of %uz", n, vec->size); if (n == -1) { err = ngx_errno; switch (err) { case NGX_EAGAIN: ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, err, "writev() not ready"); return NGX_AGAIN; case NGX_EINTR: ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, err, "writev() was interrupted"); goto eintr; default: c->write->error = 1; ngx_connection_error(c, err, "writev() failed"); return NGX_ERROR; } } return n; }