fix: hold the body in memory whenever the headers are held (#2) #3

Merged

marcos-mendez merged 1 commit from fix/gzip-static-under-delayed-headers into keel/trixie

2026-10-01 18:01:45 -03:00

marcos-mendez commented

2026-10-01 17:15:51 -03:00

(Migrated from github.com)

Fixes #2. While the response headers are held for phase 4 (coraza_delay_response_headers on, the default), upstream's header filter (ngx_http_coraza_header_filter.c, 0.21.0) sets filter_need_in_memory only when the body is inspected. gzip's header filter runs only when the headers are released, after the body filter has passed a sendfile buffer on, so with sendfile on a static file answered with gzip is an empty gzip stream. Browsers always ask for gzip.

debian/patches/delay-headers-in-memory.patch: set filter_need_in_memory whenever the headers are held. Upstream PR #142 (issue #140) covers part of this.
autopkgtest gzip-static: a static file, sendfile on and gzip on, Coraza with the Core Rule Set; the body must come back whole with and without gzip, and the gzip answer must really be compressed.
0.21.0-0keel2.

Test plan

gzip-static on 0.21.0-0keel1, in a container of the Keel Web step 7 image: fails, gzip, 0 of 2800 bytes
the same on 0.21.0-0keel2: passes, gzip, 2800 of 2800 bytes; CRS payload still 403; a phase 4 deny still answers a clean 403
CI: build and both autopkgtests

Fixes #2. While the response headers are held for phase 4 (`coraza_delay_response_headers on`, the default), upstream's header filter (`ngx_http_coraza_header_filter.c`, 0.21.0) sets `filter_need_in_memory` only when the body is inspected. gzip's header filter runs only when the headers are released, after the body filter has passed a sendfile buffer on, so with `sendfile on` a static file answered with gzip is an empty gzip stream. Browsers always ask for gzip. - `debian/patches/delay-headers-in-memory.patch`: set `filter_need_in_memory` whenever the headers are held. Upstream PR #142 (issue #140) covers part of this. - autopkgtest `gzip-static`: a static file, `sendfile on` and `gzip on`, Coraza with the Core Rule Set; the body must come back whole with and without gzip, and the gzip answer must really be compressed. - 0.21.0-0keel2. ## Test plan - [x] `gzip-static` on 0.21.0-0keel1, in a container of the Keel Web step 7 image: fails, `gzip, 0 of 2800 bytes` - [x] the same on 0.21.0-0keel2: passes, `gzip, 2800 of 2800 bytes`; CRS payload still 403; a phase 4 `deny` still answers a clean 403 - [ ] CI: build and both autopkgtests