A static file answered with gzip has an empty body while Coraza is on (sendfile on) #2

New issue

Closed

opened 2026-10-01 16:56:47 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-01 16:56:47 -03:00

(Migrated from github.com)

Found by step 7 of handbook decision 0041 (Keel-Linux/keel-web#1), on the Keel Web image with libnginx-mod-http-coraza 0.21.0-0keel1 and trixie's nginx 1.26.3, Debian's nginx.conf unchanged (sendfile on, gzip on).

With the module loaded and coraza on, a static file answered with gzip has an empty body: 200, Content-Encoding: gzip, 20 bytes, which gunzip to nothing. Without Accept-Encoding: gzip the same request gets the whole file, and with sendfile off in the server the gzip answer is whole again (423 bytes for a 625 byte page). With the module not loaded the gzip answer is whole.

curl -s -H 'Accept-Encoding: gzip' --unix-socket /run/nginx/keel-app.sock -o b.gz -w '%{size_download}\n' http://web/   # 20
gunzip -c b.gz | wc -c                                                                                                  # 0

Browsers always send Accept-Encoding: gzip, so every static page of a server where Coraza is on comes back blank. The probable cause is the delayed response headers of the body filter (headers_delayed): the file-backed buffer is held while gzip's header filter has not run yet, so nothing has asked for the body in memory, and gzip later gets a buffer with no bytes in memory. The test set probably wants a case with sendfile on and gzip on over a static file.

keel-web works around it on its one internal hop (gzip off on unix:/run/nginx/keel-app.sock, which only Anubis reads); any other server with Coraza on keeps the bug.

Found by step 7 of handbook decision 0041 (Keel-Linux/keel-web#1), on the Keel Web image with libnginx-mod-http-coraza 0.21.0-0keel1 and trixie's nginx 1.26.3, Debian's `nginx.conf` unchanged (`sendfile on`, `gzip on`). With the module loaded and `coraza on`, a static file answered with gzip has an empty body: 200, `Content-Encoding: gzip`, 20 bytes, which gunzip to nothing. Without `Accept-Encoding: gzip` the same request gets the whole file, and with `sendfile off` in the server the gzip answer is whole again (423 bytes for a 625 byte page). With the module not loaded the gzip answer is whole. ``` curl -s -H 'Accept-Encoding: gzip' --unix-socket /run/nginx/keel-app.sock -o b.gz -w '%{size_download}\n' http://web/ # 20 gunzip -c b.gz | wc -c # 0 ``` Browsers always send `Accept-Encoding: gzip`, so every static page of a server where Coraza is on comes back blank. The probable cause is the delayed response headers of the body filter (`headers_delayed`): the file-backed buffer is held while gzip's header filter has not run yet, so nothing has asked for the body in memory, and gzip later gets a buffer with no bytes in memory. The test set probably wants a case with `sendfile on` and `gzip on` over a static file. keel-web works around it on its one internal hop (`gzip off` on `unix:/run/nginx/keel-app.sock`, which only Anubis reads); any other server with Coraza on keeps the bug.