Race condition in limit_zone/limit_conn?

[Maxim Dounin]

Hello!

On Tue, May 04, 2010 at 12:10:26PM -0400, Barry Jaspan wrote:

> Maxim,
> 
> Thank you for your reply.
> 
> On Mon, May 3, 2010 at 7:58 PM, Maxim Dounin <mdounin at mdounin.ru> wrote:
> > You had at least 7 connections (*1, *2, *4, *6, *8, *9, *10)
> > during the test.  First 3 were passed through, others were
> > rejected. ... Most likely you configured nginx to proxy to itself and this
> > causes extra connections.
> 
> I understand how making nginx proxy to itself would cause extra
> connections and how those might make all of the initial connections
> fail. If the limit is 3, I open 3, then each of those 3 attempt to
> proxy to nginx again, nginx will return 503 to the proxy request which
> will then be returned to the original requests.
> 
> However, I do not see how that is happening in my case.

Sure, but 1) you haven't provided any evidence it doesn't happen 
with 3 requests and 2) even assumming it doesn't happen - nobody 
says loop is unconditional.

> I have reduced
> my configuration file to a minimum. Here it is:
> 
> ---- snip snip ----
> user              nginx;
> worker_processes  10;
> error_log         /var/log/nginx/error.log debug;
> pid               /var/run/nginx.pid;
> events {
>     worker_connections  2048;
> }
> http {
>   proxy_set_header Host $host;
>   limit_zone max_conn $host 10m;
>   limit_conn max_conn 3;
>   server {
>     listen       80;
>     server_name _;
>     location / {
>       proxy_pass http://10.252.86.98;
>     }
>   }
> }
> ---- snip snip ----
> 
> Does this config file make nginx proxy to itself? I do not see how.

The question is: what handles connections on 10.252.86.98:80 and 
how it handles them?  In most simple case it's the same nginx, and 
loop is clear enough.

[...]

> Any thoughts?

Your logs clearly show there are more requests than you expect 
from ab.  And your config doesn't make proxy loop impossible.

You may either remove "proxy_set_header Host $host" to make sure 
Host header in original request will differ from one in proxied, 
or add something like

    proxy_set_header X-Loop-Test washere;

to make sure requests will be at least distingushable in debug 
log.

Maxim Dounin