Firewall blocks the HTTP request from HP-ux platform

[kalemuthu]

In HP-UX when Squid connects to the destination website, the connection is refused. A firewall that sits on the website is refusing the connection.

The firewall expects the following TCP packets:

Squid ---- (SYN) datalength=0 ---> website
Squid <--- (SYN,ACK) datalength=0 ---- website
Squid ---- (ACK) datalength=0 ---> website
Squid ---- (PUSH) datalength=69 ---> website

The first 3 packets contain no application data. In the 4th packet, Squid sends application data (the HTTP request).


Instead, the following is occuring in HP-UX:

Squid ---- (SYN) datalength=0 ---> website
Squid <--- (SYN,ACK) datalength=0 ---- website
Squid ---- (PUSH,ACK) datalength=69 ---> website

Squid is sending data in the 3rd packet of the TCP handshake. (We are not sure if this is allowed or not in the TCP protocol). The firewall on the website interprets this as an attack, and rejects the connection.

IMPORTANT: On Linux and Solaris, the 3rd packet does not contain data.

Reproducing the problem
We can reproduce the problem using a test http client application (attached). We have tried it on all 11iv1 and 11v2 (PA and IPF) and also on Linux.

On Linux, the httpclient does not send any data in the 3rd packet.

On HP-UX (all 3 platforms) the httpclient sends data in the 3rd handshake packet.