Nginx segfaulting when used with set-misc (for Authelia)

Guides
1

Not quite a guide, but I figure if I post it here it may give people a chance to find it if they face the same issue.

If you:

  • Are using nixos on the unstable channel, and
  • Are using nginx with Authelia, and
  • Have configured your Authelia setup a while ago, with the set-misc nginx plugin to handle redirects (as it was recommended at the time),

You may see nginx segfaulting, like so:

[🡕] Process 5993 (nginx) of user 60 dumped core.

Module libexslt.so.0 without build-id.
Module libxslt.so.1 without build-id.
Module libxml2.so.16 without build-id.
Module libz.so.1 without build-id.
Module libpcre2-8.so.0 without build-id.
Module libcrypt.so.2 without build-id.
Module nginx without build-id.
Stack trace of thread 5993:
#0  0x00005c6d7f086ec0 ngx_escape_uri_patched (nginx + 0x16bec0)
#1  0x00005c6d7f086fee ngx_http_set_misc_escape_uri (nginx + 0x16bfee)
#2  0x00005c6d7f084f20 ndk_set_var_value_code (nginx + 0x169f20)
#3  0x00005c6d7f00bc0f ngx_http_rewrite_handler (nginx + 0xf0c0f)
#4  0x00005c6d7efb318d ngx_http_core_rewrite_phase (nginx + 0x9818d)
#5  0x00005c6d7efae07c ngx_http_core_run_phases (nginx + 0x9307c)
#6  0x00005c6d7efae13e ngx_http_handler (nginx + 0x9313e)
#7  0x00005c6d7efb9ec3 ngx_http_process_request (nginx + 0x9eec3)
#8  0x00005c6d7eff3351 ngx_http_v2_state_header_complete (nginx + 0xd8351)
#9  0x00005c6d7eff3f9d ngx_http_v2_state_process_header (nginx + 0xd8f9d)
#10 0x00005c6d7eff41da ngx_http_v2_state_field_huff (nginx + 0xd91da)
#11 0x00005c6d7eff4439 ngx_http_v2_state_field_len (nginx + 0xd9439)
#12 0x00005c6d7eff46ab ngx_http_v2_state_header_block (nginx + 0xd96ab)
#13 0x00005c6d7eff1b37 ngx_http_v2_read_handler (nginx + 0xd6b37)
#14 0x00005c6d7eff1fae ngx_http_v2_init (nginx + 0xd6fae)
#15 0x00005c6d7efbb4c3 ngx_http_ssl_handshake_handler (nginx + 0xa04c3)
#16 0x00005c6d7ef8ce08 ngx_ssl_handshake_handler (nginx + 0x71e08)
#17 0x00005c6d7ef868a6 ngx_epoll_process_events (nginx + 0x6b8a6)
#18 0x00005c6d7ef7be4b ngx_process_events_and_timers (nginx + 0x60e4b)
#19 0x00005c6d7ef84aef ngx_worker_process_cycle (nginx + 0x69aef)
#20 0x00005c6d7ef82e59 ngx_spawn_process (nginx + 0x67e59)
#21 0x00005c6d7ef85567 ngx_master_process_cycle (nginx + 0x6a567)
#22 0x00005c6d7ef589c0 main (nginx + 0x3d9c0)
#23 0x000071937c22b285 __libc_start_call_main (libc.so.6 + 0x2b285)
#24 0x000071937c22b338 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x2b338)
#25 0x00005c6d7ef56ea5 _start (nginx + 0x3bea5)
ELF object binary architecture: AMD x86-64

This is caused by the set-misc plugin and, it seems, some ABI changes in nginx. I was going to look up those ABI changes and try to fix it, but it turns out the recommended way of configuring nginx to authenticate requests via Authelia has changed and you don’t need the set-misc and develkit plugins anymore.

You can simply replace:

set_escape_uri $target_url $scheme://$host$request_uri;
error_page 401 =302 https://auth.example.com/?rd=$target_url;

with:

auth_request_set $redirection_url $upstream_http_location;
error_page 401 =302 $redirection_url;

and remove pkgs.nginxModules.develkit and pkgs.nginxModules.set-misc from your services.nginx.additionalModules (unless you’re using them elsewhere).

1 Like