We are experiencing timeouts when trying to https_proxy=http://squid-proxy-host:3128/ curl https://pypi.org/ from a client going through a squid proxy at squid-proxy-host. This only affected proxies in some of our Google Cloud regions until yesterday but now all of our proxied requests are timing out.
Our squid is presently configured as a MITM proxy but the same behavior seems to happen with our without the MITM.
Network telemetry
Setup:
Client (in Google Cloud) --> Squid proxy (in Google Cloud) --> https://pypi.org/
What is interesting is that a direct curl https://pypi.org/ coming from the squid host works, but the client request fails with a timeout. Hitting other websites works fine - it is only pypi.org that is failing for us.
DNS Resolution
(From the proxy host)
dig pypi.org A
; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> pypi.org A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28995
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;pypi.org. IN A
;; ANSWER SECTION:
pypi.org. 21599 IN A 151.101.0.223
pypi.org. 21599 IN A 151.101.192.223
pypi.org. 21599 IN A 151.101.64.223
pypi.org. 21599 IN A 151.101.128.223
;; Query time: 2 msec
;; SERVER: 169.254.169.254#53(169.254.169.254)
;; WHEN: Fri May 22 22:28:49 UTC 2020
;; MSG SIZE rcvd: 101
My Platform
We are experiencing timeouts when trying to
https_proxy=http://squid-proxy-host:3128/ curl https://pypi.org/
from a client going through a squid proxy atsquid-proxy-host
. This only affected proxies in some of our Google Cloud regions until yesterday but now all of our proxied requests are timing out.Our squid is presently configured as a MITM proxy but the same behavior seems to happen with our without the MITM.
Network telemetry
Setup:
What is interesting is that a direct
curl https://pypi.org/
coming from the squid host works, but the client request fails with a timeout. Hitting other websites works fine - it is only pypi.org that is failing for us.DNS Resolution
(From the proxy host)
Traceroutes
IPv4
HTTPS Requests
IPv4
(from the client)
Some proxies are not blocked and work fine. The same exact proxy deployed in a different Google Cloud region causes a timeout.
(from both good and bad proxy servers, the connection works:)
TLS Debug
IPv4
(from proxy server)