SPDY inflate errors in nginx 1.7.4

i am seeing many error log messages relating to SPDY on an HTTPS only
website here. this appears to also be triggering (or at least related
to)
database timing problems, which is causing dbase failures.

the error log contains mostly these:

“inflate() failed: -5 while processing SPDY”

anyone know what’s occuring here? i think i already asked a similar
question
on a forum and someone pointed to the possibility of there being
attempted
exploits made against SSL3 / openSSL - though i have no direct evidence
of
that.

thanks

Posted at Nginx Forum:

Maybe this one: [nginx] SPDY: improved error handling of header block decompress...

Posted at Nginx Forum:

thanks, looks like the same error message is buried in that change /
code,
yes - though i am no closer to discerning the original cause of the
error
being triggered, since i am not familiar with the nginx sourecode at
this
point.
any tips are welcomed!

Posted at Nginx Forum:

On Sunday 02 November 2014 09:03:47 tunist wrote:

thanks, looks like the same error message is buried in that change / code,
yes - though i am no closer to discerning the original cause of the error
being triggered, since i am not familiar with the nginx sourecode at this
point.
any tips are welcomed!

There’s no way to find out what caused the error only by looking to
standard
error message. You should provide the debug log at least.

See: A debugging log

wbr, Valentin V. Bartenev

Then upgrade to 1.7.7

Posted at Nginx Forum:

ok, i have upgraded… will see how that goes.

Posted at Nginx Forum:

oh, so the log file is 3.5GB in size and even though the server has
enough
RAM to handle it, the log viewer crashes and gedit gets stuck too.

Posted at Nginx Forum:

“There’s no way to find out what caused the error only by looking to
standard
error message. You should provide the debug log at least.”

  • ok, thanks - i will post what i can find once the next error occurs. i
    upgraded to 1.7.7 and there have been 2 of these errors since then,
    though
    debug was not enabled at that point.

Posted at Nginx Forum:

enabling debug on the site in question generated vast amounts of log
data
and i think either some type of limit was reached or a bug caused the
logging to fail. i was unable to open the logviewer for the site’s error
log
after the first few minutes and eventually the interface crashed while
attempting to open the log.
now i have disabled debug again and can open the log. the logging
stopped
shortly after i initialised the debug directive for nginx, so there is
no
useful debug info pertaining to the SPDY issues yet.
i’m not entirely sure what to do here…
has anyone seen this type of behavior before?
thanks

Posted at Nginx Forum:

On Thursday 06 November 2014 19:17:18 tunist wrote:

ok, so i opened the log using glogg and have pasted a relevant sequence into
pastebin here:
http://pastebin.com/wTQs6ALb

any tips welcome, thanks

[…]

Ok, thanks, I see the problem.

Why have you changed the “large_client_header_buffers” value?

wbr, Valentin V. Bartenev

i was having a lot of trouble with 302 errors initially and then later
on
was having slow TLS performance… i had difficulty finding the right
combination of buffer settings to get the site to run reliably and
quickly.
if i recall correctly, that was a field that i changed while i was in
the
process of stabilising the site. possibly there was no need to change
that
one and i just left the change in the file once the site stabilised.

the lines in the current config are:
large_client_header_buffers 2 1k;
client_header_buffer_size 1k;

i don’t truly know how to set the values for these perfectly.

do you recommend to remove ‘large_client_header_buffers’ completely? or
change it?
thanks

Posted at Nginx Forum:

ok, so i opened the log using glogg and have pasted a relevant sequence
into
pastebin here:
http://pastebin.com/wTQs6ALb

any tips welcome, thanks

Posted at Nginx Forum:

On Thursday 06 November 2014 19:17:18 tunist wrote:

ok, so i opened the log using glogg and have pasted a relevant sequence into
pastebin here:
http://pastebin.com/wTQs6ALb

any tips welcome, thanks

The problem was fixed:
http://hg.nginx.org/nginx/rev/abb466a57a22

Thank you for the report.

wbr, Valentin V. Bartenev

ok great, thanks for assisting

Posted at Nginx Forum:

On Friday 07 November 2014 08:07:51 tunist wrote:

i don’t truly know how to set the values for these perfectly.

do you recommend to remove ‘large_client_header_buffers’ completely? or
change it?
thanks

[…]

Yes, I recommend to remove it. Most of the settings are more or less
optimal
by default.

wbr, Valentin V. Bartenev