server { listen 80; server_name www.test.com; index index.php index.htm ; root /var/www/html;
location / { if (!-f $request_filename) { rewrite ^(.*)$ /index.php last; } } location /admin/mytest { default_type "text/html"; access_by_lua_file conf/access_auth.lua; }
include conf/php.conf;function auth() local red = redis_connect() if not red then return false end tkey = red:get(ngx.var.cookie_tkey) or nil if ngx.var.cookie_tkey ~= nil and ngx.var.cookie_tkey == tkey then return true else local username = ngx.var.remote_user local password = ngx.var.remote_passwd if auth_user(username, password) then local tkey = ngx.md5(math.random(1000000000,10000000000)) local expires = cookie_expire ngx.header["Set-Cookie"] = "tkey="..tkey..";Domain=.test.com; Path=/; Expires=" .. ngx.cookie_time(ngx.time() + expires) red:set(tkey,tkey) red:expire(tkey,tkey,cookie_expire) redis_close(red) return true end access_deny(red) ngx.header.www_authenticate = [[Basic realm="access auth"]] ngx.exit(401) endend
function auth_user() ...end
function reids_connect()...end
if ngx.var.remote_addr ~= '192.168.0.11' then auth()end--
--
邮件来自列表“openresty”,专用于技术讨论!
订阅: 请发空白邮件到 openresty...@googlegroups.com
发言: 请发邮件到 open...@googlegroups.com
退订: 请发邮件至 openresty+...@googlegroups.com
归档: http://groups.google.com/group/openresty
官网: http://openresty.org/
仓库: https://github.com/agentzh/ngx_openresty
教程: http://openresty.org/download/agentzh-nginx-tutorials-zhcn.html
return192.168.0.100 www.test.com<html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>--user=www --group=www --prefix=/usr/local/tengine --add-module=../nginx_mod_h264_streaming-2.2.7 --with-pcre=../pcre-8.35 --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --with-http_flv_module --with-http_realip_module --with-openssl-opt=enable --with-cc-opt=-O3 --with-google_perftools_module --with-http_sysguard_module --with-http_concat_module --add-module=../ngx_cache_purge-2.1 --with-ld-opt=-Wl,-rpath,/usr/local/luajit/lib --add-module=../ngx_devel_kit-0.2.19 --add-module=../lua-nginx-module-0.9.16 --add-module=../ngx_coolkit
现在我把测试服 ngnix php的配置项由fastcgi_pass 127.0.0.1:9000 改为 fastcgi_pass unix:/dev/shm/php-cgi.sock; 也同样出现错误502,400错误了,(生产环境暂时不敢动)
估计是这个原因引起的,使用socket 方式无法 proxy_pass ,但这是什么原因呢?
58.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:37:26 +0800] "GET /admin/login HTTP/1.1" 502 627 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:39:09 +0800] "GET /admin/login HTTP/1.1" 400 101 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.22658.249.26.226 - admin [26/Sep/2015:22:39:09 +0800] "GET /admin/login HTTP/1.1" 400 101 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" 58.249.26.226.....我在生产环境安装了 openresty , 把原来的配置放了过去,还是同样有问题,日志也没显示什么来,
location /admin/mytest{ default_type "text/html"; access_by_lua_file /usr/local/openresty/nginx/conf/access_auth.lua; proxy_pass http://www.test.com;
XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203, XXX.XXX.142.203"XXX.XXX.142.203 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.0" 400 90 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41, XXX.XXX.142.203"XXX.XX.188.41 - admin [27/Sep/2015:01:26:11 +0800] "GET /admin/login HTTP/1.1" 400 101 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41"XXX.XX.188.41 - admin [27/Sep/2015:01:26:29 +0800] "GET /admin/login HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41"XXX.XX.188.41 - admin [27/Sep/2015:01:26:31 +0800] "GET /admin/login HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41"XXX.XX.188.41 - admin [27/Sep/2015:01:26:31 +0800] "GET /admin/login HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36" "XXX.XX.188.41"不用 access_by_file ,proxy_pass 一切访问都正常,添加 access_by_file 就返回404, 加入content handle proxy_pass 返回 502和400.
日志如下:
#cat /etc/hosts
192.168.0.100 www.test.com
# cat /usr/local/nginx/conf/vhosts/www.test.com.conf
server { listen 80; server_name www.test.com; index index.html index.php index.htm ; root /data/www/mytest;
location / { try_files $uri $uri/ /index.php; }
location /admin/mytest { #default_type "text/html"; #access_by_lua_file /usr/local/nginx/conf/auth.lua; proxy_pass http://www.test.com; ##测试代理 www.163.com 没问题
}
include /usr/local/nginx/conf/php.conf;
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body bgcolor="white">...<hr/>nginx</body></html>
# tail -f ../logs/nginx_error.log
2015/09/27 14:20:22 [alert] 28863#0: *4989 socket() failed (24: Too many open files) while connecting to upstream, client: 192.168.0.100, server: www.test.com, request: "GET /admin/mytest HTTP/1.0", upstream: "http://192.168.0.100:80/admin/mytest", host: "www.test.com"2015/09/27 14:20:23 [info] 28863#0: *1 client 192.168.0.100 closed keepalive connection2015/09/27 14:29:35 [alert] 28863#0: *9978 socket() failed (24: Too many open files) while connecting to upstream, client: 192.168.0.100, server: www.test.com, request: "GET /admin/mytest HTTP/1.0", upstream: "http://192.168.0.100:80/admin/mytest", host: "www.test.com"看过春哥的https://openresty.org/download/agentzh-nginx-tutorials-zhcn.html 文档,我的情况这个很类似,查还是不明白该怎么做?
春哥的部分教程部分内容这样写道:
获取当前“文档根目录”的路径有一个非常简便的方法,那就是请求一个肯定不存在的文件所对应的资源名,例如:
$ curl 'http://localhost:8080/blah-blah.txt'
<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>
</body>
</html>
我们会很自然地得到 404 错误页。此时再看 Nginx 错误日志文件,应该会看到类似下面这一行错误消息:
[error] 9364#0: *1 open() "/home/agentzh/test/html/blah-blah.txt" failed (2: No such file or directory)
这条错误消息是 ngx_static 模块打印出来的,因为它并不能在文件系统的对应路径上找到名为 blah-blah.txt 的文件。因为这条错误信息中包含有 ngx_static 试图打开的文件的绝对路径,所以从这个路径不难看出,当前的“文档根目录”是 /home/agentzh/test/html/.
很多初学者会想当然地把 404 错误理解为某个 location 不存在,其实上面这个例子表明,即使 location 存在并成功匹配,也是可能返回 404 错误页的。因为决定着 404 错误页的是抽象的“资源”是否存在,而非某个具体的 location 是否存在。
初学者常犯的一个错误是忘记配置 content 阶段的模块指令,而他们自己其实并不期望使用 content 阶段缺省运行的静态资源服务,例如:
location /auth {
access_by_lua '
-- a lot of Lua code omitted here...
';
}
显然,这个 /auth 接口只定义了 access 阶段的配置指令,即 access_by_lua,并未定义任何 content 阶段的配置指令。于是当我们请求 /auth 接口时,在 access 阶段的 Lua 代码会如期执行,然后content 阶段的那些静态文件服务会紧接着自动发生作用,直至 ngx_static 模块去文件系统上找名为 auth 的文件。而经常地,404 错误页会抛出,除非运气太好,在对应路径上确实存在一个叫做 auth的文件。所以,一条经验是,当遇到意外的 404 错误并且又不涉及静态文件服务时,应当首先检查是否在对应的 location 配置块中恰当地配置了 content 阶段的模块指令,例如 content_by_lua、echo 以及 proxy_pass 之类。当然,Nginx 的 error.log 文件一般总是会提供各种意外问题的答案,例如对于上面这个例子,我的 error.log 中有下面这条错误信息:
[error] 9364#0: *1 open() "/home/agentzh/test/html/auth" failed (2: No such file or directory)
不好意思,是我做晕头了,日志搞错了。
看来是proxy_pass 指向自己死循环了
,但是http://www.test.com/admin/mytest 下 的/admin/mytest并不是真实存在的路径,而是PHP ci 框架的控制器路由,像thinkphp一样,或者说是path_info 。如果是真实存在的路径,不用加proxy_pass就可以正常访问了,如果是path_info路径那么返回404, 所以才使用proxy_pass.
location 配置块中恰当地配置了 content 阶段的模块指令" index index.html index.php index.htm ; root /data/www/mytest;
location / { try_files $uri $uri/ /index.php; }
location /admin/mytest { default_type "text/html"; try_files $uri $uri/ /index.php; content_by_lua ' --ngx.say("test") return '; access_by_lua_file /usr/local/nginx/conf/access_auth.lua; }
include /usr/local/nginx/conf/php.conf;
}try_files $uri $uri/ /index.php;