Cache: do not inherit last_modified and etag from stale response.

When replacing a stale cache entry, its last_modified and etag could be
inherited from the old entry if the response code is not 200 or 206.  Moreover,
etag could be inherited with any response code if it's missing in the new
response.  As a result, the cache entry is left with invalid last_modified or
etag which could lead to broken revalidation.

For example, when a file is deleted from backend, its last_modified is copied to
the new 404 cache entry and is used later for revalidation.  Once the old file
appears again with its original timestamp, revalidation succeeds and the cached
404 response is sent to client instead of the file.

The problem appeared with etags in 44b9ab7752e3 (1.7.3) and affected
last_modified in 1573fc7875fa (1.7.9).

diff --git a/src/http/ngx_http_file_cache.c b/src/http/ngx_http_file_cache.c
index 8d06fb9bfd6e7bccbe6b82f94fe4927c7bbdb429..7f289ed3368f993a2eca56db5773c3b9e027641a 100644 (file)
--- a/src/http/ngx_http_file_cache.c
+++ b/src/http/ngx_http_file_cache.c
@@ -181,8 +181,6 @@ ngx_http_file_cache_new(ngx_http_request_t *r)
     c->file.log = r->connection->log;
     c->file.fd = NGX_INVALID_FILE;
 
-    c->last_modified = -1;
-
     return NGX_OK;
 }
 

diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index 7a5b3fdc2a55f69a154d16a191d9997c1588d94e..23208c80ee85856963d601e2c8e20af196da408a 100644 (file)
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -2635,7 +2635,14 @@ ngx_http_upstream_send_response(ngx_http_request_t *r, ngx_http_upstream_t *u)
 
                 if (u->headers_in.etag) {
                     r->cache->etag = u->headers_in.etag->value;
+
+                } else {
+                    ngx_str_null(&r->cache->etag);
                 }
+
+            } else {
+                r->cache->last_modified = -1;
+                ngx_str_null(&r->cache->etag);
             }
 
             if (ngx_http_file_cache_set_header(r, u->buffer.start) != NGX_OK) {