On 10/25/22 20:55, Matthew H wrote:
I have included the requested output from tcpdump below:
Thank you! This raw output is sufficient to determine that no transfer
encoding was used by this buggy origin server. I have updated the GitHub
comment/summary accordingly.
N.B. In the future, please consider sharing libpcap packet captures
instead of raw tcpdump console output. It is not necessary to re-share
anything now.
FWIW, I am not aware of any official Squid workarounds for this origin
server bug. Some of the features Factory is currently working on will be
useful here, but they are not yet ready for the official submission. One
can remove the corresponding check from Squid source code, of course,
but doing so will open modified Squid (and other HTTP agents) to serious
security vulnerabilities, so I cannot recommend such a blunt workaround.
Alex.
tcpdump -A -s 0 -ni enp4s0 "host 159.203.14.9 and (((ip[2:2] -
((ip[0]&0xf)<<2)) - ((tcp[12]&
0xf0)>>2)) != 0)"
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp4s0, link-type EN10MB (Ethernet), snapshot length 262144
bytes
01:40:17.310479 IP 10.0.160.10.43426 > 159.203.14.9.1996: Flags [P.],
seq 2955630477:2955630939, ack 2382737005, win 502, options [nop,nop,TS
val 3000375654 ecr 1932743995], length 462
E....:@.?.7.
..
... .....+W....m....Y......
...fs3U;GET http://nintendo.com/ <http://nintendo.com/> HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0)
Gecko/20100101 Firefox/106.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Host: nintendo.com <http://nintendo.com>
Via: 1.1 dce3749b9671 (squid/5.6)
X-Forwarded-For: 10.0.130.210
Cache-Control: max-age=259200
Connection: keep-alive
01:40:18.957475 IP 159.203.14.9.1996 > 10.0.160.10.43426: Flags [P.],
seq 1:1466, ack 462, win 114, options [nop,nop,TS val 1932744407 ecr
3000375654], length 1465
E....@@.3......
..
.......m.+Y[...r]......
s3V....fHTTP/1.1 200 OK
x-powered-by: Express
content-type: text/html; charset=iso-8859-1
transfer-encoding:
date: Wed, 26 Oct 2022 00:40:20 GMT
connection: close
<!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head>
<!-- this automatically loads the hallway after 20 seconds -->
<meta http-equiv="refresh" content="20;
url=http://nintendo.com//./hallway/index.html
<http://nintendo.com//./hallway/index.html>">
<title>Nintendo Power Source</title>
On Tue, Oct 25, 2022 at 2:08 PM Alex Rousskov
<rousskov@xxxxxxxxxxxxxxxxxxxxxxx
<mailto:rousskov@xxxxxxxxxxxxxxxxxxxxxxx>> wrote:
On 10/23/22 20:36, Matthew H wrote:
> Hi,
>
> I'm using Squid to proxy HTTP requests to another proxy. I can
see squid
> sending the request to the parent and getting a response, but it
sends
> the client that initiated the request a 502 Bad Gateway response.
>
> On closer inspection it appears the parent proxy is sending an
> empty transfer-encoding header, and this is causing Squid to send
a 502.
Do you know whether the response body was using chunked (or any other
non-identity) encoding? I have already added your case to the list of
known rejected responses[1], but it would be good to update that with
the information on the actual response encoding.
[1]
https://github.com/squid-cache/squid/pull/702#issuecomment-762459132
<https://github.com/squid-cache/squid/pull/702#issuecomment-762459132>
If the very first bytes of the response are "<html" or similar, then no
encoding was probably applied. If you see what can be interpreted as a
small hex number followed by a new line, then chunked encoding was
probably applied (at least). If you cannot tell, or are not sure, feel
free to share the response packet in libpcap format, captured with
wireshark or "tcpdump -s0".
Thank you,
Alex.
> 2022/10/24 00:23:59.106| ctx: enter level 0:
'http://nintendo.com/ <http://nintendo.com/>
> <http://nintendo.com/ <http://nintendo.com/>>'
> 2022/10/24 00:23:59.106| 11,3| http.cc(666) processReplyHeader:
> processReplyHeader: key '19010000000000000C00000000000000'
> 2022/10/24 00:23:59.106| 11,2| http.cc(720) processReplyHeader: HTTP
> Server conn294 local=172.25.0.3:57802 <http://172.25.0.3:57802>
> <http://172.25.0.3:57802/
<http://172.25.0.3:57802/>> remote=159.203.14.9:1996
<http://159.203.14.9:1996>
> <http://159.203.14.9:1996/
<http://159.203.14.9:1996/>> FIRSTUP_PARENT FD 26 flags=1
> 2022/10/24 00:23:59.106| 11,2| http.cc(721) processReplyHeader: HTTP
> Server RESPONSE:
> ---------
> HTTP/1.1 200 OK
> x-powered-by: Express
> content-type: text/html; charset=iso-8859-1
> transfer-encoding:
> date: Mon, 24 Oct 2022 00:23:57 GMT
> connection: close
>
> ----------
> 2022/10/24 00:23:59.106| 55,3| HttpHeader.cc(882) getList: empty
list
> header: Transfer-Encoding(Transfer-Encoding[63])
> 2022/10/24 00:23:59.106| 55,2| HttpHeader.cc(559) parse: WARNING:
> unsupported Transfer-Encoding used by client:
> 2022/10/24 00:23:59.106| ctx: exit level 0
> 2022/10/24 00:23:59.106| 20,3| store.cc(1673) reset:
> http://nintendo.com/ <http://nintendo.com/> <http://nintendo.com/
<http://nintendo.com/>>
> 2022/10/24 00:23:59.107| 17,3| FwdState.cc(492) fail:
ERR_INVALID_RESP
> "Bad Gateway"
> http://nintendo.com/ <http://nintendo.com/> <http://nintendo.com/
<http://nintendo.com/>>
> 2022/10/24 00:23:59.107| 17,3| FwdState.cc(533) unregister:
> http://nintendo.com/ <http://nintendo.com/> <http://nintendo.com/
<http://nintendo.com/>>
>
> _______________________________________________
> squid-users mailing list
> squid-users@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>
> http://lists.squid-cache.org/listinfo/squid-users
<http://lists.squid-cache.org/listinfo/squid-users>
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
<mailto:squid-users@xxxxxxxxxxxxxxxxxxxxx>
http://lists.squid-cache.org/listinfo/squid-users
<http://lists.squid-cache.org/listinfo/squid-users>
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
