Proxy Server Problem

[Li Chunfeng]

I've running Netscape Proxy Server v3.52 on HP-UX11.00,and there is a stranger phenomenon.I can access all websites except for that of www.21cn.com.The progress I've made to solve the problem is:
1.Reinstall the netscape proxy server.The question still exists.
2.Reinstall HP-UX OS,then install NS proxy server,but the question still exists.
3.Change the IP address of the proxy server.I've suspect maybe the IP has been limited,but the result is the same.
And,there are two PC running Linux+squid in my network,and just in the same subnet of my HP box.But they works well,and can proxy for all websites.I've also install the NS proxy on a Solaris box,it works well too.
So,I confirm that there is no problem in my network settings.And I ask help from iPlanet and HP,but they cannot give me a solution.Does anyone meet the question?Or,if you have some idea about it,please let me know.Thanks!!!
Yours,
Li Chunfeng

[Steven Gillard_2]

Wow do Iplanet still support that version? It is OLD! I would first check if there are any later versions available - I'm sure I remember running 3.6 or something and even that was three years ago (actually we had a special site specific version because we kept finding bugs :). In fact I've got a feeling that Iplanet stopped supporting the proxy server full stop, but I might be wrong. In any case I recommend you stick to squid.

Anyway I do remember having some similar problems with certain sites through the proxy server. Some of them were fixed by upgrading to a later version, others were browser bugs that only appeared when accessing content through a configured proxy. For example, I know that in the past IE did not like 302 redirect responses that contained a body when they were received through a proxy. Instead of requesting the redirected page it would display the redirects body and the user would need to open the redirected link manually. MS probably fixed this by now (well, maybe).

A couple of quick questions:

- Is there an error being displayed by the browser? What does it day?

- Is there an error being reported in the proxy error log?

- What is the actual behaviour you see? Does the page partially load or does the request just time out?

Otherwise, the only real way to troubleshoot these types of problems is with network traces - I learnt everything there is to know about nettl working on proxy problems :) You might like to try tcpdump, a tool similar to snoop which is available from the hpux porting centre - its a bit easier to handle. Make sure you use the '-X -s 1500' arguments so you get the full http packets in your trace.

Once you've got the traces, its needle in a haystack time - look what the server is returning to the proxy and what the proxy is returning to the client. Whats different? Also compare the trace to one on the working squid proxy.

If you can give some more information about the problem you are seeing it may help me remember a similar problem I might have had.

Good luck!

Regards,
Steve

[Li Chunfeng]

Hi,Steve:
Thanks for your kindly help!
Let me describe that situation in detail.
1.When I access the website from desktop in IE through the proxy server,IE returns error number 500:could not access that page.
2.When I use netscape4.73 on HP box to access the website directly,netscape eject an error window,it say that:"could not connect to www.21cn.com.Connection reset by peer".
3.The following is the proxy server's access log message:

10.8.6.3 - guest [13/Jan/2002:00:07:02 +0800] "GET http://www.21cn.com/ HTTP/1.0" 500 397 - - - - 539 111 - - 0

This is the error log message:

[13/Jan/2002:00:06:25] failure: for host 10.8.6.3 trying to GET http://www.21cn.com/, retrieve-exit-routine reports: proxy retrieve failed: A network error occurred while the proxy server was receiving data. (Network Error: Socket is already connected) Try connecting again.

4.As you mentioned,I've also try the latest version of iPlanet Web Proxy server 3.6,but it seems no difference.

5.AS you suggested,I've download a squid source code from www.squid-cache.org and compile it on HP box,but the same result appear.(I made a mistake that I haven't store the error message in squid)

Now,I suspect this question has two possible reasons:
1.The HP-UX has some bugs.
2.That website has something differ from others.
Do you have any suggest about it?

Regards,
Lichunfeng

[Steven Gillard_2 · Accepted solution]

The error 'socket is already connected' means that the proxy called connect() again after the first call already succeeded - it should definitely *not* be terminating the connection on receiving this error. This smells like a proxy bug. If iPlanet don't support this product any more then you might be better off sticking with squid (you say you had problems with that as well??). Its also a good idea to patch you OS up to date - use the custom patch manager available on the ITRC site for that.

It may still be very useful to get a network trace, and a system call trace would be helpful also. If iPlanet are playing then they'll want this information (even if they don't know it yet :). I suggest you download the following two tools:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/tusc-7.2/

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/tcpdump-3.6.2/

For tcpdump you'll need libpcap as well.

Ideally, run the test when the system is very quiet. If you have another system you can reproduce the problem on that is even better. The commands you need are:

# tcpdump -X -s 1024 tcp port 80 and host www.21cn.com > /tmp/tcpdump.out

Theres probably no point tracing the client traffic as well. For tusc things are trickier because the Netscape proxy uses so many processes and you don't know which one is going to handle your request. If you can reproduce the problem on a test system, I suggest you configure the number of processes down to 1, then tusc this process. Otherwise you'll need to tusc all the processes and then search through the output files for the www.21cn.com connection. To run tusc:

# tusc -T "" -p -o /tmp/proxy-.tusc

Preferably have both the tusc and tcpdump running at the same time so you can look at the output together. Feel free to post the output here once you've got it.

Regards,
Steve

[Li Chunfeng]

Hi,Steve:
I've download the tcpdump and tusc and run them as you suggested.And the result is in the attachment below,please view it and,if you can offer some help to me,please let me know.

Regards,
Li

[Steven Gillard_2]

OK, what is happening here is the remote site is resetting the connection after it is established. Looking at the tusc trace the proxy is doing everything correctly:

1011960495.386465 [904] connect(177, 0x401ff104, 16) ..... ERR#245 EINPROGRESS
1011960495.397975 [904] select(178, NULL, 0x400ea24c, NULL, 0x400ea498) = 1
1011960495.398182 [904] gettimeofday(0x400ea6b0, NULL) ... = 0
1011960495.398333 [904] connect(177, 0x401ff104, 16) ..... ERR#234 EISCONN
1011960495.398537 [904] send(177, "G E T / H T T P / 1 . 0 \r\n".., 513, 0) = 513
1011960495.423832 [904] select(178, 0x400ea14c, NULL, NULL, 0x400ea498) = 1
1011960495.424179 [904] gettimeofday(0x400ea6b0, NULL) ... = 0
1011960495.424406 [904] recv(177, 0x400ff168, 260, 0) .... ERR#232 ECONNRESET

It sets up the remote connection successfully, attempts to send the GET request, but receives the ECONNRESET error when performing the recv(). Note that the EISCONNECTED error that you saw in the proxy's log file is evident here as well - but it can be safely ignored because the proxy still goes on to send the request.

The tcpdump trace confirms that the remote site is sending a TCP RESET before it even receives the GET request:

20:08:15.423705 61.140.60.21.http > rdl1000.54274: R 1:1(0) ack 2 win 17473 (DF)

The most likely cause of this is that your proxy system has been 'denied' by the remote site - ie they accept the connection, see that it is your IP address, then immediately reset it. You can confirm this by telnetting to port 80 on 61.140.60.21, its likely you will receive the same 'connection reset by peer' error that was reported by the browser.

You have a couple of options:

1. Attempt to contact the administrator of the web server and find out why they are refusing connections from your proxy.

2. If you get no response, try changing the IP address of the system (if you can). This will hopefully get you around their security - provided they've just listed your IP and not your whole network (although the fact that other systems work indicates that its just your IP thats been listed).

The good news is there does not appear to be any problem with the proxy or your systems configuration.

Regards,
Steve

[Li Chunfeng]

Hi,Steve:
I am appreciate for your help.You are professional in HP-UX and proxy server administration and taught me much.I hope we can discuss problems in this formus later!

Best Regards,
Li Chunfeng