|
/
Zope
/
Apsis
/
Pound Mailing List
/
Archive
/
2006
/
2006-10
/
problem with http forward infinite loop
[
Pound - Does it redirect all traffic back to the ... ]
[
Re: [Pound Mailing List] problem with http ... ]
problem with http forward infinite loop
Adam Just <adam_just(at)yahoo.com> |
2006-10-31 00:51:00 |
[ FULL ]
|
Hello Pound Users,
Thank you for this excellent product!
I am using Pound 2.1.5 on Debian Etch beta 3 with kernel 2.6. The backend
servers are running JBoss 4.0.4 with Apache Tomcat as the Http Servlet
Container.
In a staging setup that I have made, I can successfully use pound to proxy
http requests to two backend servers, but only for certain URI's (those that do
not involve forwarding). For requests (through the proxy) for URI's that
involve an HTTP Forward, I am getting from the proxy an HTTP REDIRECT (HTTP
302) to the same resource, amended with a jsessionid both as a url parameter
and as a cookie. This causes the web client to repeat the request, it gets the
same response (redirect to the same resource with the sessionid). For MSIE -
there is an infinite loop until I stop it by pressing the 'stop' button.
Adding the 'Session' mechanism to the 'Service' definition in pound did not
alleviate the problem. The mystery to me is that when I make requests directly
to the backend servers (skipping pound), the forward occurs (transparently to
my web client as I expect) and I get an HTTP 200 with the resulting (generated)
HTML response.
Your help is greatly appreciated.
Thank you,
Adam
-----------------------------------------------------
/usr/local/etc/pound.cfg
-----------------------------------------------------
ListenHTTP
Address 192.168.2.201
Port 8000
Service
BackEnd
Address 192.168.2.200
Port 8080
End
Session
Type PARM
ID "jsessionid"
TTL 300
End
End
Service
BackEnd
Address 192.168.2.201
Port 8080
End
Session
Type PARM
ID "jsessionid"
TTL 300
End
End
End
-------------------------------------------
The good case: invocation to a uri (without pound directly to a backend
server) that causes an http forward and results in
an HTTP 200 with a generated HTML response.
------------------------------------------
ares:~/tmp# wget --debug http://192.168.2.201:8080/company/contact.do
DEBUG output created by Wget 1.10.2 on linux-gnu.
--15:40:05-- http://192.168.2.201:8080/company/contact.do
=> `contact.do'
Connecting to 192.168.2.201:8080... connected.
Created socket 3.
Releasing 0x0808d4c8 (new refcount 0).
Deleting unused 0x0808d4c8.
---request begin---
GET /company/contact.do HTTP/1.0
User-Agent: Wget/1.10.2
Accept: */*
Host: 192.168.2.201:8080
Connection: Keep-Alive
---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.4.CR2 (build: CVSTag=JBoss_4_0_4_CR2
date=2
00603311500)/Tomcat-5.5
Set-Cookie: JSESSIONID=7250D46AD0D4F8458E0049168AA4E570; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 30 Oct 2006 23:40:05 GMT
Connection: close
---response end---
200 OK
Stored cookie 192.168.2.201 8080 / <session> <insecure> [expiry
none] JSESSIONID
7250D46AD0D4F8458E0049168AA4E570
Length: unspecified [text/html]
[ <=> ] 7,012 --.--K/s
Closed fd 3
15:40:05 (1.30 MB/s) - `contact.do' saved [7012]
-----------------------------------------------------
The bad case: a request through pound that causes an infinite loop, only the
first is shown - it repeats un-endingly with MSIE, wget terminates after being
redirected more than 20 times.
-----------------------------------------------------
ares:~/tmp# wget --debug http://192.168.2.201:8000/company/contact.do
DEBUG output created by Wget 1.10.2 on linux-gnu.
--15:49:39-- http://192.168.2.201:8000/company/contact.do
=> `contact.do.1'
Connecting to 192.168.2.201:8000... connected.
Created socket 3.
Releasing 0x0808d4c8 (new refcount 0).
Deleting unused 0x0808d4c8.
---request begin---
GET /company/contact.do HTTP/1.0
User-Agent: Wget/1.10.2
Accept: */*
Host: 192.168.2.201:8000
Connection: Keep-Alive
---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.4.CR2 (build: CVSTag=JBoss_4_0_4_CR2
date=2
00603311500)/Tomcat-5.5
Set-Cookie: JSESSIONID=8403FB7AFAFA8F4FB0CCBC53882F44FC; Path=/
Location: http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFAFA8F
4FB0CCBC53882F44FC
Content-Type: text/html
Content-Length: 0
Date: Mon, 30 Oct 2006 23:46:48 GMT
Connection: keep-alive
---response end---
302 Moved Temporarily
Registered socket 3 for persistent reuse.
Stored cookie 192.168.2.201 8000 / <session> <insecure> [expiry
none] JSESSIONID
8403FB7AFAFA8F4FB0CCBC53882F44FC
Location: http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFAFA8F
4FB0CCBC53882F44FC [following]
Skipping 0 bytes of body: [] done.
--15:49:39-- http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFA
FA8F4FB0CCBC53882F44FC
=> `contact.do.1'
Disabling further reuse of socket 3.
Closed fd 3
Connecting to 192.168.2.201:8000... connected.
Created socket 3.
Releasing 0x0808dc88 (new refcount 0).
Deleting unused 0x0808dc88.
[snip] repeats 20 times...
20 redirections exceeded.
|
|
|
|
|
RE: [Pound Mailing List] problem with http forward infinite loop
=?iso-8859-2?B?Vu1nIFDhbA==?= <pal.vig(at)sonitar.hu> |
2006-10-31 01:22:40 |
[ FULL ]
|
Hi Pound users,
I have nearly the same approach as Adam has written about in his letter.
Using Pound 1.9 on both Linux and FreeBSD version gave me the correct
solution to my problems. After an upgrade to 2.1 (actually 2.1.5 at the
moment) I have the same problems.
I do not have the session thing in it, just using the plain load-balancing
features among backend servers to separate so-called "dynamic" and "static"
content => serving pictures and static data from one server and serving php
and dynamic content from another pool of servers.
I tried several setup and configuration tests, but not succeeded to make it
behave like the good old 1.9 version.
I had two cases :
1.) I must redirect a user from one domain to another on the same backend,
and same frontend. Does not work, I have to redirect the user to a third,
public server, and then back again to the other domain. This all happens on
HTTP, and works this way well. Could be comfortable to avoid using external
servers only for redirection.
2.) I have some sensitive data on a site, and try to redirect on a page from
PHP using the following code to the same server, but with HTTPS protocol.
<?
....
if ($_SERVER['SERVER_PORT'] != 443) {
Header('Location: https://some.domain.address.tld/');
}
...
?>
SERVER_PORT reports correct data, so the problem lies somewhere in Pound's
code...
Interesting fact, that in some cases when I tested this Mozilla Firefox
worked, but M$ IE didn't. Internet Explorer went to an infinite loop,
logging lots of requests on the server with Pound, Firefox just redirected
after a few (about 10-20) redirects.
Tried to set REWRITELOCATION and REWRITEDESTINATION in pound.cfg, but didn't
help yet.
Your help is appreciated.
Pound is a great program, and glad to have it using on the other hand... :)
Best wishes,
Paul
-----Original Message-----
From: Adam Just [mailto:adam_just(at)yahoo.com]
Sent: Tuesday, October 31, 2006 12:51 AM
To: pound(at)apsis.ch
Cc: adam_just(at)yahoo.com
Subject: [Pound Mailing List] problem with http forward infinite loop
Hello Pound Users,
Thank you for this excellent product!
I am using Pound 2.1.5 on Debian Etch beta 3 with kernel 2.6. The
backend servers are running JBoss 4.0.4 with Apache Tomcat as the Http
Servlet Container.
In a staging setup that I have made, I can successfully use pound to
proxy http requests to two backend servers, but only for certain URI's
(those that do not involve forwarding). For requests (through the proxy)
for URI's that involve an HTTP Forward, I am getting from the proxy an HTTP
REDIRECT (HTTP 302) to the same resource, amended with a jsessionid both as
a url parameter and as a cookie. This causes the web client to repeat the
request, it gets the same response (redirect to the same resource with the
sessionid). For MSIE - there is an infinite loop until I stop it by
pressing the 'stop' button.
Adding the 'Session' mechanism to the 'Service' definition in pound did
not alleviate the problem. The mystery to me is that when I make requests
directly to the backend servers (skipping pound), the forward occurs
(transparently to my web client as I expect) and I get an HTTP 200 with the
resulting (generated) HTML response.
Your help is greatly appreciated.
Thank you,
Adam
-----------------------------------------------------
/usr/local/etc/pound.cfg
-----------------------------------------------------
ListenHTTP
Address 192.168.2.201
Port 8000
Service
BackEnd
Address 192.168.2.200
Port 8080
End
Session
Type PARM
ID "jsessionid"
TTL 300
End
End
Service
BackEnd
Address 192.168.2.201
Port 8080
End
Session
Type PARM
ID "jsessionid"
TTL 300
End
End
End
-------------------------------------------
The good case: invocation to a uri (without pound directly to a backend
server) that causes an http forward and results in
an HTTP 200 with a generated HTML response.
------------------------------------------
ares:~/tmp# wget --debug http://192.168.2.201:8080/company/contact.do
DEBUG output created by Wget 1.10.2 on linux-gnu.
--15:40:05-- http://192.168.2.201:8080/company/contact.do
=> `contact.do'
Connecting to 192.168.2.201:8080... connected.
Created socket 3.
Releasing 0x0808d4c8 (new refcount 0).
Deleting unused 0x0808d4c8.
---request begin---
GET /company/contact.do HTTP/1.0
User-Agent: Wget/1.10.2
Accept: */*
Host: 192.168.2.201:8080
Connection: Keep-Alive
---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.4.CR2 (build: CVSTag=JBoss_4_0_4_CR2
date=2
00603311500)/Tomcat-5.5
Set-Cookie: JSESSIONID=7250D46AD0D4F8458E0049168AA4E570; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 30 Oct 2006 23:40:05 GMT
Connection: close
---response end---
200 OK
Stored cookie 192.168.2.201 8080 / <session> <insecure> [expiry
none]
JSESSIONID 7250D46AD0D4F8458E0049168AA4E570
Length: unspecified [text/html]
[ <=> ] 7,012 --.--K/s
Closed fd 3
15:40:05 (1.30 MB/s) - `contact.do' saved [7012]
-----------------------------------------------------
The bad case: a request through pound that causes an infinite loop, only
the first is shown - it repeats un-endingly with MSIE, wget terminates after
being redirected more than 20 times.
-----------------------------------------------------
ares:~/tmp# wget --debug http://192.168.2.201:8000/company/contact.do
DEBUG output created by Wget 1.10.2 on linux-gnu.
--15:49:39-- http://192.168.2.201:8000/company/contact.do
=> `contact.do.1'
Connecting to 192.168.2.201:8000... connected.
Created socket 3.
Releasing 0x0808d4c8 (new refcount 0).
Deleting unused 0x0808d4c8.
---request begin---
GET /company/contact.do HTTP/1.0
User-Agent: Wget/1.10.2
Accept: */*
Host: 192.168.2.201:8000
Connection: Keep-Alive
---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.4.CR2 (build: CVSTag=JBoss_4_0_4_CR2
date=2
00603311500)/Tomcat-5.5
Set-Cookie: JSESSIONID=8403FB7AFAFA8F4FB0CCBC53882F44FC; Path=/
Location:
http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFAFA8F
4FB0CCBC53882F44FC
Content-Type: text/html
Content-Length: 0
Date: Mon, 30 Oct 2006 23:46:48 GMT
Connection: keep-alive
---response end---
302 Moved Temporarily
Registered socket 3 for persistent reuse.
Stored cookie 192.168.2.201 8000 / <session> <insecure> [expiry
none]
JSESSIONID 8403FB7AFAFA8F4FB0CCBC53882F44FC
Location:
http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFAFA8F
4FB0CCBC53882F44FC [following]
Skipping 0 bytes of body: [] done.
--15:49:39--
http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFA
FA8F4FB0CCBC53882F44FC
=> `contact.do.1'
Disabling further reuse of socket 3.
Closed fd 3
Connecting to 192.168.2.201:8000... connected.
Created socket 3.
Releasing 0x0808dc88 (new refcount 0).
Deleting unused 0x0808dc88.
[snip] repeats 20 times...
20 redirections exceeded.
--
To unsubscribe send an email with subject 'unsubscribe' to pound(at)apsis.ch.
Please contact roseg(at)apsis.ch for questions.
http://www.apsis.ch/pound/pound_list/archive/2006/2006-10/1162252260000
|
|
|
RE: [Pound Mailing List] problem with http forward infinite loop
"Dean" <deanmaunder(at)telstra.com> |
2006-10-31 01:41:16 |
[ FULL ]
|
Pound requests are redirected to backends using HTTP protocol, so when your
request via Pound is sent via https, it redirects that to the backend via
http, and the loop continues.....the backends always see the request as
being via http.
-----Original Message-----
From: Víg Pál [mailto:pal.vig(at)sonitar.hu]
Sent: Tuesday, 31 October 2006 10:23 AM
To: pound(at)apsis.ch
Subject: RE: [Pound Mailing List] problem with http forward infinite loop
Hi Pound users,
I have nearly the same approach as Adam has written about in his letter.
Using Pound 1.9 on both Linux and FreeBSD version gave me the correct
solution to my problems. After an upgrade to 2.1 (actually 2.1.5 at the
moment) I have the same problems.
I do not have the session thing in it, just using the plain load-balancing
features among backend servers to separate so-called "dynamic" and "static"
content => serving pictures and static data from one server and serving php
and dynamic content from another pool of servers.
I tried several setup and configuration tests, but not succeeded to make it
behave like the good old 1.9 version.
I had two cases :
1.) I must redirect a user from one domain to another on the same backend,
and same frontend. Does not work, I have to redirect the user to a third,
public server, and then back again to the other domain. This all happens on
HTTP, and works this way well. Could be comfortable to avoid using external
servers only for redirection.
2.) I have some sensitive data on a site, and try to redirect on a page from
PHP using the following code to the same server, but with HTTPS protocol.
<?
....
if ($_SERVER['SERVER_PORT'] != 443) {
Header('Location: https://some.domain.address.tld/');
}
...
?>
SERVER_PORT reports correct data, so the problem lies somewhere in Pound's
code...
Interesting fact, that in some cases when I tested this Mozilla Firefox
worked, but M$ IE didn't. Internet Explorer went to an infinite loop,
logging lots of requests on the server with Pound, Firefox just redirected
after a few (about 10-20) redirects.
Tried to set REWRITELOCATION and REWRITEDESTINATION in pound.cfg, but didn't
help yet.
Your help is appreciated.
Pound is a great program, and glad to have it using on the other hand... :)
Best wishes,
Paul
-----Original Message-----
From: Adam Just [mailto:adam_just(at)yahoo.com]
Sent: Tuesday, October 31, 2006 12:51 AM
To: pound(at)apsis.ch
Cc: adam_just(at)yahoo.com
Subject: [Pound Mailing List] problem with http forward infinite loop
Hello Pound Users,
Thank you for this excellent product!
I am using Pound 2.1.5 on Debian Etch beta 3 with kernel 2.6. The
backend servers are running JBoss 4.0.4 with Apache Tomcat as the Http
Servlet Container.
In a staging setup that I have made, I can successfully use pound to
proxy http requests to two backend servers, but only for certain URI's
(those that do not involve forwarding). For requests (through the proxy)
for URI's that involve an HTTP Forward, I am getting from the proxy an HTTP
REDIRECT (HTTP 302) to the same resource, amended with a jsessionid both as
a url parameter and as a cookie. This causes the web client to repeat the
request, it gets the same response (redirect to the same resource with the
sessionid). For MSIE - there is an infinite loop until I stop it by
pressing the 'stop' button.
Adding the 'Session' mechanism to the 'Service' definition in pound did
not alleviate the problem. The mystery to me is that when I make requests
directly to the backend servers (skipping pound), the forward occurs
(transparently to my web client as I expect) and I get an HTTP 200 with the
resulting (generated) HTML response.
Your help is greatly appreciated.
Thank you,
Adam
-----------------------------------------------------
/usr/local/etc/pound.cfg
-----------------------------------------------------
ListenHTTP
Address 192.168.2.201
Port 8000
Service
BackEnd
Address 192.168.2.200
Port 8080
End
Session
Type PARM
ID "jsessionid"
TTL 300
End
End
Service
BackEnd
Address 192.168.2.201
Port 8080
End
Session
Type PARM
ID "jsessionid"
TTL 300
End
End
End
-------------------------------------------
The good case: invocation to a uri (without pound directly to a backend
server) that causes an http forward and results in
an HTTP 200 with a generated HTML response.
------------------------------------------
ares:~/tmp# wget --debug http://192.168.2.201:8080/company/contact.do
DEBUG output created by Wget 1.10.2 on linux-gnu.
--15:40:05-- http://192.168.2.201:8080/company/contact.do
=> `contact.do'
Connecting to 192.168.2.201:8080... connected.
Created socket 3.
Releasing 0x0808d4c8 (new refcount 0).
Deleting unused 0x0808d4c8.
---request begin---
GET /company/contact.do HTTP/1.0
User-Agent: Wget/1.10.2
Accept: */*
Host: 192.168.2.201:8080
Connection: Keep-Alive
---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.4.CR2 (build: CVSTag=JBoss_4_0_4_CR2
date=2
00603311500)/Tomcat-5.5
Set-Cookie: JSESSIONID=7250D46AD0D4F8458E0049168AA4E570; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 30 Oct 2006 23:40:05 GMT
Connection: close
---response end---
200 OK
Stored cookie 192.168.2.201 8080 / <session> <insecure> [expiry
none]
JSESSIONID 7250D46AD0D4F8458E0049168AA4E570
Length: unspecified [text/html]
[ <=> ] 7,012 --.--K/s
Closed fd 3
15:40:05 (1.30 MB/s) - `contact.do' saved [7012]
-----------------------------------------------------
The bad case: a request through pound that causes an infinite loop, only
the first is shown - it repeats un-endingly with MSIE, wget terminates after
being redirected more than 20 times.
-----------------------------------------------------
ares:~/tmp# wget --debug http://192.168.2.201:8000/company/contact.do
DEBUG output created by Wget 1.10.2 on linux-gnu.
--15:49:39-- http://192.168.2.201:8000/company/contact.do
=> `contact.do.1'
Connecting to 192.168.2.201:8000... connected.
Created socket 3.
Releasing 0x0808d4c8 (new refcount 0).
Deleting unused 0x0808d4c8.
---request begin---
GET /company/contact.do HTTP/1.0
User-Agent: Wget/1.10.2
Accept: */*
Host: 192.168.2.201:8000
Connection: Keep-Alive
---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.4.CR2 (build: CVSTag=JBoss_4_0_4_CR2
date=2
00603311500)/Tomcat-5.5
Set-Cookie: JSESSIONID=8403FB7AFAFA8F4FB0CCBC53882F44FC; Path=/
Location:
http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFAFA8F
4FB0CCBC53882F44FC
Content-Type: text/html
Content-Length: 0
Date: Mon, 30 Oct 2006 23:46:48 GMT
Connection: keep-alive
---response end---
302 Moved Temporarily
Registered socket 3 for persistent reuse.
Stored cookie 192.168.2.201 8000 / <session> <insecure> [expiry
none]
JSESSIONID 8403FB7AFAFA8F4FB0CCBC53882F44FC
Location:
http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFAFA8F
4FB0CCBC53882F44FC [following]
Skipping 0 bytes of body: [] done.
--15:49:39--
http://192.168.2.201:8000/company/contact.do;jsessionid=8403FB7AFA
FA8F4FB0CCBC53882F44FC
=> `contact.do.1'
Disabling further reuse of socket 3.
Closed fd 3
Connecting to 192.168.2.201:8000... connected.
Created socket 3.
Releasing 0x0808dc88 (new refcount 0).
Deleting unused 0x0808dc88.
[snip] repeats 20 times...
20 redirections exceeded.
--
To unsubscribe send an email with subject 'unsubscribe' to pound(at)apsis.ch.
Please contact roseg(at)apsis.ch for questions.
http://www.apsis.ch/pound/pound_list/archive/2006/2006-10/1162252260000
--
To unsubscribe send an email with subject 'unsubscribe' to pound(at)apsis.ch.
Please contact roseg(at)apsis.ch for questions.
http://www.apsis.ch/pound/pound_list/archive/2006/2006-10/1162252260000/1162
254160000
|
|
|
Re: [Pound Mailing List] problem with http forward infinite loop
Ted Dunning <tdunning(at)veoh.com> |
2006-10-31 02:00:38 |
[ FULL ]
|
Dean,
You can use HTTP with direct server return. What happens is that the
backend server does IP masquerading to pretend that it is the IP to which
you sent the request.
Yahoo, for instance, does this extensively.
The downsides are many and start with the fact that you are breaking the IP
abstraction layer, and making it so that your backends can send data
directly to the internet. This can be Really Bad.
But the upside of only having to pass the request to the backend and then
getting out of the way can be pretty compelling. I guess. I have never
been tempted.
On 10/30/06 4:41 PM, "Dean" <deanmaunder(at)telstra.com> wrote:
[...]
|
|
|
Re: [Pound Mailing List] problem with http forward infinite loop
Robert Segall <roseg(at)apsis.ch> |
2006-10-31 18:47:02 |
[ FULL ]
|
On Mon, 2006-10-30 at 15:51 -0800, Adam Just wrote:[...]
That is a rather poor config: the second service will never be used, and
sessions are not useful for a single back-end. Could it be that you
really meant:
ListenHTTP
Address 192.168.2.201
Port 8000
Service
BackEnd
Address 192.168.2.200
Port 8080
End
BackEnd
Address 192.168.2.201
Port 8080
End
Session
Type PARM
ID "jsessionid"
TTL 300
End
End
End
[...]
You obviously have a bug in your application: without Pound the server
answers with a 200 (no "forward", whatever that may be, and no
redirect). With Pound you get a 302 (redirect), which Pound rewrites to
the correct address, as shown by your headers.
I suggest you check carefully on your application to see exactly why it
reacts differently to a request coming from Pound and one that comes
from a browser.[...]
|
|
|
RE: [Pound Mailing List] problem with http forward infinite loop
Robert Segall <roseg(at)apsis.ch> |
2006-10-31 18:49:48 |
[ FULL ]
|
On Tue, 2006-10-31 at 01:22 +0100, VÃg Pál wrote:[...]
I am not entirely sure what that means. Could you try and explain again?
[...]
Pound ALWAYS talks HTTP to the back-end, regardless of how the request
came in. Please fix your code (for example by checking on the
HTTPS-specific headers which Pound adds to the request).[...]
|
|
|
|
