Post ARSy19NDLbV5uvgOuG by AffirmativeNod@poa.st
(DIR) More posts by AffirmativeNod@poa.st
(DIR) Post #ARRQhCzYh2bRhcXdk8 by josh@poa.st
2023-01-08T18:25:50.095588Z
4 likes, 2 repeats
There is an absolutely bizarre issue with 1 of 3 haproxy servers, all running on debian 11, all running haproxy 2.7.1, where only one (the one that's in North America) is constantly dropping specifically POST requests with error 408 - a client side error indicating that the client is not connecting fast enough.This does NOT happen with the EU servers. The error is coming from haproxy, not the nginx backend servers.I am losing my fucking mind trying to figure out why it's such a piece of shit. They have identical configs.
(DIR) Post #ARRQnZezKHqnkCxI1I by josh@poa.st
2023-01-08T18:26:59.131917Z
1 likes, 0 repeats
The error looks like this.Jan 8 13:06:21 ca haproxy[71068]: xxx:47934 [08/Jan/2023:13:06:11.949] https-in~ https-in/<NOSRV> -1/-1/-1/-1/10002 408 216 - - cD-- 1029/1021/0/0/0 0/0 "POST kiwifarms.net/threads/test.129102/add-reply HTTP/2.0"
(DIR) Post #ARRQvDfkxY6jrqxb1c by josh@poa.st
2023-01-08T18:28:19.531715Z
1 likes, 0 repeats
There's actually one difference I can think of: The NA server is running LUKS encryption.
(DIR) Post #ARRR5Llphq7BsYdJgW by HOLOCAUST@shitposter.club
2023-01-08T18:30:11.985983Z
3 likes, 1 repeats
@josh I wish you the best Josh. You should watch this, it's one of your most memorable moments https://youtu.be/61n6k0XNs1M?t=11025
(DIR) Post #ARRROoszgC1NgIGZv6 by MrFuzzland@seal.cafe
2023-01-08T18:33:43.867306Z
0 likes, 0 repeats
@HOLOCAUST @josh "I have gigabytes of fat women, this is fuckin erver for you" lmao
(DIR) Post #ARRROsHZ3ISSDMmk8O by DumpsterDivedWaifu@poa.st
2023-01-08T18:31:29.826474Z
0 likes, 0 repeats
@josh Is it possibly a firewall issue where somehow the requests are just being blocked for whatever reason?
(DIR) Post #ARRROsnp7MGJpPsVPs by josh@poa.st
2023-01-08T18:33:39.478177Z
0 likes, 0 repeats
@DumpsterDivedWaifu They're running identical firewalls that should not break TCP traffic.
(DIR) Post #ARRSVL86oKCPNK0dFY by cyberiasec@a.sc
2023-01-08T18:41:45Z
0 likes, 0 repeats
@josh https://www.haproxy.com/de/blog/haproxy-and-http-errors-408-in-chrome/ maybe?
(DIR) Post #ARRSVLZl9WJil4wiLg by josh@poa.st
2023-01-08T18:46:05.199722Z
0 likes, 0 repeats
@cyberiasec That's 8 years old. The issue is only on POST requests, and happens consistently (i.e. 100% of the time)
(DIR) Post #ARRTHrKsNBiF9z7IlU by josh@poa.st
2023-01-08T18:54:52.158625Z
1 likes, 0 repeats
This may be some sort of attack? I am seeing tons and tons of these kinds of errors but only out of NA.[08/Jan/2023:13:51:33.792] https-in~ https-in/<NOSRV> -1/-1/-1/-1/2 0 0 - - PR-- 2800/2797/0/0/0 0/0 "<BADREQ>"Some sort of slowhttp attack in modern haproxy that involves malformed requests?
(DIR) Post #ARRTmpbwpqCOmvs2wC by PunishedD@poa.st
2023-01-08T19:00:26.487536Z
1 likes, 0 repeats
@josh Aren't you blessed to live in a world where friendly Internet strangers spend their welfare money to send you new ways to break things?
(DIR) Post #ARRWIbozq7FdCCFq8u by originaldonjulio@poa.st
2023-01-08T19:24:46.871357Z
1 likes, 0 repeats
@josh So like, I dont know what that means but I asked openAI : "It looks like you are seeing a log message or some other output that includes the string https-in~ https-in/<NOSRV> -1/-1/-1/-1/2 0 0 - - PR-- 2800/2797/0/0/0 0/0 "<BADREQ>". This message could be generated by a variety of systems, and without more context it is not possible to accurately interpret the meaning of the message.The https-in~ https-in/<NOSRV> part of the message seems to indicate that the system is trying to process an HTTP request over a secure (https) connection, but is unable to do so because the server is not available (<NOSRV>). The rest of the message appears to be a series of numbers and other tokens that may be related to the request or the system's processing of it, but without more information it is not possible to provide a more detailed explanation.I recommend checking the documentation or configuration for the system that is generating this message to learn more about its meaning and how to resolve any issues that may be indicated by the message. Alternatively, you may want to try searching online for more information about the message and similar messages, as this may provide additional insight."
(DIR) Post #ARRcUVm8kBhLdzyeEi by MemeLandfill@poa.st
2023-01-08T20:38:00.928121Z
0 likes, 0 repeats
@josh you're not you when your hungry eat some niggers (pepperoni).
(DIR) Post #ARSy19NDLbV5uvgOuG by AffirmativeNod@poa.st
2023-01-09T10:41:06.802642Z
0 likes, 0 repeats
@josh Josh, can you help me? I logged into something weird, now I keep getting strange requests, says it's from KF. I'm very hesitant to press "Accept All".
(DIR) Post #ARSy19uBN1s7ZB6jIG by josh@poa.st
2023-01-09T12:13:54.449155Z
0 likes, 0 repeats
@AffirmativeNod how about an email champ
(DIR) Post #ARTSz6fTX4oHWgjJLc by pmtuhole@poa.st
2023-01-09T17:34:34.270046Z
0 likes, 0 repeats
@josh tigrerayé.org/english/post/15-the-strange-case-of-the-tcp-black-holes/
(DIR) Post #ARTSz78BoJmKxkAF6W by josh@poa.st
2023-01-09T18:00:53.203742Z
0 likes, 0 repeats
@pmtuhole Promising, thank you