md5 collision

[Maxim Dounin]

Hello!

On Thu, Sep 13, 2012 at 11:21:27AM -0400, karlseguin wrote:

> Getting OpenSSL to handle md5 didn't change anything

As copilation long as 

> (wasn't able to get it
> to compile with your specific flag, but I figured this was what you had
> intended?)

With the flag in question (--with-cc-opt="-DNGX_HAVE_MD5=0") nginx 
should compile with internal md5 implementation.  If it doesn't - 
you may want to provide more details.

> Here's a sample from the debug log:
> 
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 http cache key:
> "http://origin_magick"
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 http cache key:
> "/uploads/channel/thumbnail/5927/e74e97624ef652bc7a8419c02f8a7f92ae71d127.jpg"
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 add cleanup: 000000000196CE68
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 http file cache exists: 0 e:1
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 cache file:
> "/mnt/tmp/nginx/cache/90/6d/2b/422c25423170bac1c4e655ed9c2b6d90"
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 add cleanup: 000000000196CEC0
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 http file cache fd: 24
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 read: 24, 000000000196D198, 285,
> 0
> 2012/09/13 15:15:16 [crit] 27367#0: *3441 cache file
> "/mnt/tmp/nginx/cache/90/6d/2b/422c25423170bac1c4e655ed9c2b6d90" has md5
> collision, client: 127.0.0.1, server: atlas-x.example.com, request: "GET
> /uploads/channel/thumbnail/5927/e74e97624ef652bc7a8419c02f8a7f92ae71d127.jpg
> HTTP/1.1", host: "127.0.0.1"
> 2012/09/13 15:15:16 [debug] 27367#0: *3441 http upstream cache: -5

Calculated md5 looks fine.

Do you see the same problem if you re-request the resource in 
question?

If yes - what's in the cache file?  Intresting part is first bytes 
and the KEY string.  Note that first bytes are binary, please use 
hd/xxd to show them.

If no - how the cache was populated?  Note that cache files aren't 
portable and you can't move the cache from one host to another.

Maxim Dounin