tempesta-tech / tempesta

All-in-one solution for high performance web content delivery and advanced protection against DDoS and web attacks
https://tempesta-tech.com/
GNU General Public License v2.0
607 stars 103 forks source link

Zero 'sent bytes' in access log for non-empty responses #2141

Open krizhanovsky opened 1 week ago

krizhanovsky commented 1 week ago

Run the current master as of 27bab668a528dc0075a99d174f3b370c58ce9aed in a VM with config

cache 1;
cache_fulfill * *;
cache_methods GET HEAD;
cache_ttl 3600;

listen 192.168.100.4:443 proto=h2,https;

srv_group default {
        server 10.245.18.242:80 conns_n = 2;
}

tls_certificate /root/tempesta/etc/tfw-root.crt;
tls_certificate_key /root/tempesta/etc/tfw-root.key;

req_hdr_add X-Forwarded-Proto "https";
resp_hdr_set Strict-Transport-Security "max-age=31536000; includeSubDomains";

req_hdr_set Proxy;

vhost default {
        tls_match_any_server_name;
        proxy_pass default;
}

access_log on;

block_action attack reply;
block_action error reply;

http_chain {
    uri == "/wp-admin*" -> cache_disable;
    uri == "/wp-comments-post.php*" -> cache_disable;

        -> default;
}

Run our website LXC staging container on the host system as an upstream. Send requests (maybe many times) like

 curl --http2 -ik -o res.html -D /dev/stdout -H 'Cache-Control: max-age=2' -H 'Host: tempesta-tech.com' https://tempesta-tech.com/blog/building-your-own-wordpress-staging-with-tempesta-fw/
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/2 200 
date: Sun, 16 Jun 2024 16:21:17 GMT
x-pingback: https://tempesta-tech.com/xmlrpc.php
link: <https://tempesta-tech.com/wp-json/>; rel="https://api.w.org/"
link: <https://tempesta-tech.com/wp-json/wp/v2/posts/3658>; rel="alternate"; type="application/json"
link: <https://tempesta-tech.com/?p=3658>; rel=shortlink
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
via: 2.0 tempesta_fw (Tempesta FW 0.8.0)
content-length: 158036
server: Tempesta FW/0.8.0
strict-transport-security: max-age=31536000; includeSubDomains

100  154k  100  154k    0     0   978k      0 --:--:-- --:--:-- --:--:--  983k
$ ls -l res.html 
-rw-rw-r-- 1 alex alex 158588 Jun 16 18:21 res.html

Observe the access log in the VM serial console output:

$ tail ~/vm/serial-ubuntu.txt 
[17584.805349] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17587.970051] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17591.141974] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17603.113167] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17606.273670] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17609.435576] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17612.606389] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17615.801306] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17659.233122] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"
[17671.992858] [tempesta fw] 192.168.100.1 "default" "GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/2.0" 200 0 "-" "curl/7.81.0"

Obviously Tempesta sends not 0 bytes.

Testing

Please update our tests to make sure that Tempesta reports the right number of sent bytes for the access log

krizhanovsky commented 1 week ago

From the tcpdump log between the upstream and Tempesta FW:

GET /blog/building-your-own-wordpress-staging-with-tempesta-fw/ HTTP/1.1
host: tempesta-tech.com
user-agent: curl/7.81.0
x-forwarded-for: 192.168.100.1
accept: */*
cache-control: max-age=2
x-forwarded-proto: https
via: 1.1 tempesta_fw (Tempesta FW 0.8.0)
HTTP/1.1 200 OK
Date: Sun, 16 Jun 2024 17:25:41 GMT
Server: Apache/2.4.52 (Ubuntu)
X-Pingback: https://tempesta-tech.com/xmlrpc.php
Link: <https://tempesta-tech.com/wp-json/>; rel="https://api.w.org/"
Link: <https://tempesta-tech.com/wp-json/wp/v2/posts/3658>; rel="alternate"; type="application/json"
Link: <https://tempesta-tech.com/?p=3658>; rel=shortlink
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

26896
<!DOCTYPE html><html ....