On 8/30/22 07:34, David Ferreira wrote:
I did a new capture like you said, since there's only a few http
messages in gonna post them here:
Perhaps others will be able to spot the answer in your narration of the
captured packets, but I am missing critical details like timestamps and
connection IDs to interpret this correctly. For example, I cannot tell
who sends the "HTTP/1.1 503 Service Unavailable" response -- Squid or
the origin server -- and _when_. Also, there may be critical low-level
details like unusual whitespace characters or missing delimiters that
cannot be easily relayed when one copy-pastes high-level details.
Needless to say, all those details may not help reveal the answer
either, but there is a chance that they will help. If you can share (a
link to) the actual packet capture containing these messages (i.e. the
files saved by tcpdump), please do so. Compress the file if needed. Feel
free to do that privately if you prefer.
I regret that this triage requires so many iterations.
Alex.
Squid 5.2:
dump -i ens224 -nn port 80 -s0 -w squid52output
POST /webserver/index.php HTTP/1.1
Accept-Encoding: deflate, gzip
Cookie: tickets[InDesign]=9ce90349BDxzBw6TeaGM1sYvG6dDlABl0NqbswO9;
tickets[]=716c37c9qD4eeMFPHZvbfAa8S7VMmLh3Skkgrb31;
AWSELB=0D3B27870CA3C45CF463C76E69DC284A499EFD0DF6EE047B11D31BB6D9B01943D41E6D72FB8A97227A031F20EAAC9364FE0968EA5AAEE1102734343F2F0133CD3A0C6A4A0C
Accept: */*
SOAPAction: "urn:#SaveObjects"
Content-Type: multipart/form-data; boundary=----------------7d123
Content-Length: 4277021
Expect: 100-continue
Host: webserverhost
Via: 1.1 squid5.2host (squid/5.2)
X-Forwarded-For: 172.19.222.132
Cache-Control: max-age=259200
Connection: keep-alive
HTTP/1.1 100 Continue
HTTP/1.1 503 Service Unavailable.
Content-length:0
POST /webserver/index.php HTTP/1.1
Accept-Encoding: deflate, gzip
Cookie: tickets[InDesign]=9ce90349BDxzBw6TeaGM1sYvG6dDlABl0NqbswO9;
tickets[]=716c37c9qD4eeMFPHZvbfAa8S7VMmLh3Skkgrb31;
AWSELB=0D3B27870CA3C45CF463C76E69DC284A499EFD0DF6EE047B11D31BB6D9B01943D41E6D72FB8A97227A031F20EAAC9364FE0968EA5AAEE1102734343F2F0133CD3A0C6A4A0C
Accept: */*
SOAPAction: "urn:#GetDialog"
Content-Type: multipart/form-data; boundary=----------------7d123
Content-Length: 1120
Expect: 100-continue
Host: webserverhost
Via: 1.1 squid5.2host (squid/5.2)
X-Forwarded-For: 172.19.222.132
Cache-Control: max-age=259200
Connection: keep-alive
HTTP/1.1 100 Continue
------
Squid 4.15:
dump -i ens224 -nn port 80 -s0 -w squid4.15output
POST /webserver/index.php HTTP/1.1
Accept-Encoding: deflate, gzip
Cookie: tickets[InDesign]=1ae95903t3jY2HDSgfvoEsfpsibbkf9mlNZ4eDjA;
tickets[]=716c37c9qD4eeMFPHZvbfAa8S7VMmLh3Skkgrb31;
AWSELB=0D3B27870CA3C45CF463C76E69DC284A499EFD0DF6EE047B11D31BB6D9B01943D41E6D72FB8A97227A031F20EAAC9364FE0968EA5AAEE1102734343F2F0133CD3A0C6A4A0C
Accept: */*
SOAPAction: "urn:#SaveObjects"
Content-Type: multipart/form-data; boundary=----------------7d123
Content-Length: 4272865
Expect: 100-continue
Host: webserverhost
Via: 1.1 squid4.15host (squid/4.15)
X-Forwarded-For: 172.19.222.132
Cache-Control: max-age=259200
Connection: keep-alive
HTTP/1.1 100 Continue
POST /webserver/index.php HTTP/1.1
Accept-Encoding: deflate, gzip
Cookie: tickets[InDesign]=1ae95903t3jY2HDSgfvoEsfpsibbkf9mlNZ4eDjA;
tickets[]=716c37c9qD4eeMFPHZvbfAa8S7VMmLh3Skkgrb31;
AWSELB=0D3B27870CA3C45CF463C76E69DC284A499EFD0DF6EE047B11D31BB6D9B01943D41E6D72FB8A97227A031F20EAAC9364FE0968EA5AAEE1102734343F2F0133CD3A0C6A4A0C
Accept: */*
SOAPAction: "urn:#UnlockObjects"
Content-Type: multipart/form-data; boundary=----------------7d123
Content-Length: 644
Host: webserverhost
Via: 1.1 squid4.15host (squid/4.15)
X-Forwarded-For: 172.19.222.132
Cache-Control: max-age=259200
Connection: keep-alive
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Date: Tue, 30 Aug 2022 10:52:05 GMT
Server: Apache/2.4.6 (CentOS) PHP/7.1.26
Set-Cookie: tickets[InDesign]=1ae95903t3jY2HDSgfvoEsfpsibbkf9mlNZ4eDjA;
expires=Wed, 31-Aug-2022 10:52:05 GMT; Max-Age=86400; path=/webserver;
HttpOnly
X-Powered-By: PHP/7.1.26
Content-Length: 266
Connection: keep-alive
Again thank you for you time.
David
On Mon, 29 Aug 2022 at 18:18, Alex Rousskov
<rousskov@xxxxxxxxxxxxxxxxxxxxxxx
<mailto:rousskov@xxxxxxxxxxxxxxxxxxxxxxx>> wrote:
On 8/29/22 12:17, David Ferreira wrote:
> I tried to capture the http trafic with the following tcpdump:
>
> tcpdump -i any -nn port 80|grep -i http
I am not cool enough to easily grok this kind of output. Please
share (a
link to) the packet capture file instead (tcpdump -s0 -w filename ...).
Thank you,
Alex.
> Notes:
> - 1.2.3.4 is the webserver ip
> - 10.185.23.202 is the squid machine outbound interface
>
> Here's the results:
>
> Squid 4.15(Working one):
>
> ---
> Im not that familiar with tcpdump, if there's a better way to
capture
> please say so, im also gonna build a squid v5 to test it out.
>
> Again, thanks for your time
>
>
> On Mon, 29 Aug 2022 at 13:52, Alex Rousskov
> <rousskov@xxxxxxxxxxxxxxxxxxxxxxx
<mailto:rousskov@xxxxxxxxxxxxxxxxxxxxxxx>
> <mailto:rousskov@xxxxxxxxxxxxxxxxxxxxxxx
<mailto:rousskov@xxxxxxxxxxxxxxxxxxxxxxx>>> wrote:
>
> On 8/29/22 06:17, David Ferreira wrote:
>
> > I have some squid's running on rocky linux 8 with verion 4.15,
> recently
> > been testing squid version 5.2(stable version that comes with
> Rocky 9)to
> > upgrade the current ones and most of the configs/acls seem to
> work fine.
> >
> > Unfortualy theres an application that we use that everytime it
> tries to
> > upload files it fails on squid 5.2, on 4.15 is works completly
> fine, so
> > far ive test on squid 5.2 and 5.5 and it's the same
behavior, im
> testing
> > this with default configurations and it always works on 4.15,
> access log
> > only shows this:
> >
> > Squid 4.15:
> > 26/Aug/2022:15:36:08 +0100 273
172.19.222.132TCP_MISS/200 745
> POST http://websiteurl/index.php
<http://websiteurl/index.php> <http://websiteurl/index.php
<http://websiteurl/index.php>> -
> HIER_DIRECT/websitedomain text/xml
> >
> > Squid 5.2:
> > 25/Aug/2022:15:10:00 +0100 139 172.19.222.132
> TCP_MISS_ABORTED/100 0 POST http://websiteurl
<http://websiteurl> <http://websiteurl <http://websiteurl>>
> HIER_DIRECT/websitedomain -
> >
> > anyone has an ideia of what may be happening here?, been
> searching about
> > http errors 100 and so far i did not find anything that
points me
> to the
> > problem.
> >
> > On the application side the error it shows when it tries to
> upload is:
> > "
> > Error storing the document on the server
> > Detail HTTP error 100
> > Send failure: Connection was aborted (55)
> > "
>
> Squid v5.2 has many serious bugs. I would not use it in
production.
> Build the latest Squid v5 from sources if you have to.
>
>
> If the latest Squid v5 shows the same problem then this is
probably a
> client application or Squid bug/misconfiguration. There were
quite a
> few
> changes in HTTP 1xx control message handling since Squid v4,
and one of
> those changes is probably affecting your client. For example,
either
> Squid v4 does not deliver that 100 control message to the
client at all
> or it is delivering a slightly different 100 control message
that your
> client is happy with.
> If you share what HTTP messages are exchanged between
client and
> Squid
> and between Squid and the origin server, in both successful
and failing
> use cases, we may be able to tell you more. I would use tcpdump,
> wireshark, or a similar tool to collect HTTP traffic since
these are
> non-TLS transactions.
>
>
> HTH,
>
> Alex.
> _______________________________________________
> squid-users mailing list
> squid-users@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>
> <mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>>
> http://lists.squid-cache.org/listinfo/squid-users
<http://lists.squid-cache.org/listinfo/squid-users>
> <http://lists.squid-cache.org/listinfo/squid-users
<http://lists.squid-cache.org/listinfo/squid-users>>
>
>
>
> --
> Com os melhores cumprimentos,
>
> David Ferreira
--
Com os melhores cumprimentos,
David Ferreira
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
