[Pharo-project] [regression reporter]regression occurred
https://ci.inria.fr/pharo/job/Pharo-3.0-Update-Step-2-Validation/./label=win... 2 regressions found. Zinc.Tests.ZnClientTests.testRedirect Zinc.Tests.ZnClientTests.testRedirectDontFollow
On 07 May 2013, at 07:42, no-reply@ci.inria.fr wrote:
https://ci.inria.fr/pharo/job/Pharo-3.0-Update-Step-2-Validation/./label=win...
2 regressions found. Zinc.Tests.ZnClientTests.testRedirect Zinc.Tests.ZnClientTests.testRedirectDontFollow
These tests assume that http://www.pharo-project.org is a redirect. The website seems to behave a bit different now, I'll have to investigate. Any pointers as to what changed are welcome. Sven -- Sven Van Caekenberghe Proudly supporting Pharo http://pharo.org http://association.pharo.org http://consortium.pharo.org
On 2013-05-07, at 11:15, Sven Van Caekenberghe <sven@stfx.eu> wrote:
On 07 May 2013, at 07:42, no-reply@ci.inria.fr wrote:
https://ci.inria.fr/pharo/job/Pharo-3.0-Update-Step-2-Validation/./label=win...
2 regressions found. Zinc.Tests.ZnClientTests.testRedirect Zinc.Tests.ZnClientTests.testRedirectDontFollow
These tests assume that http://www.pharo-project.org is a redirect. The website seems to behave a bit different now, I'll have to investigate. Any pointers as to what changed are welcome.
I think we updated the DNS to point directly to the same server as pharo.org. I think http://ci.pharo.org is going to be candidate in future (needs to be properly configured first :)
On May 7, 2013, at 12:06 PM, Camillo Bruni <camillobruni@gmail.com> wrote:
On 2013-05-07, at 11:15, Sven Van Caekenberghe <sven@stfx.eu> wrote:
On 07 May 2013, at 07:42, no-reply@ci.inria.fr wrote:
https://ci.inria.fr/pharo/job/Pharo-3.0-Update-Step-2-Validation/./label=win...
2 regressions found. Zinc.Tests.ZnClientTests.testRedirect Zinc.Tests.ZnClientTests.testRedirectDontFollow
These tests assume that http://www.pharo-project.org is a redirect. The website seems to behave a bit different now, I'll have to investigate. Any pointers as to what changed are welcome.
I think we updated the DNS to point directly to the same server as pharo.org.
But this was the same like before⦠they both point to cmsbox, who does whatever they do.
I think http://ci.pharo.org is going to be candidate in future (needs to be properly configured first :)
Yes, it is on the TODO⦠Marcus
On 07 May 2013, at 12:11, Marcus Denker <marcus.denker@inria.fr> wrote:
On May 7, 2013, at 12:06 PM, Camillo Bruni <camillobruni@gmail.com> wrote:
On 2013-05-07, at 11:15, Sven Van Caekenberghe <sven@stfx.eu> wrote:
On 07 May 2013, at 07:42, no-reply@ci.inria.fr wrote:
https://ci.inria.fr/pharo/job/Pharo-3.0-Update-Step-2-Validation/./label=win...
2 regressions found. Zinc.Tests.ZnClientTests.testRedirect Zinc.Tests.ZnClientTests.testRedirectDontFollow
These tests assume that http://www.pharo-project.org is a redirect. The website seems to behave a bit different now, I'll have to investigate. Any pointers as to what changed are welcome.
I think we updated the DNS to point directly to the same server as pharo.org.
But this was the same like before⦠they both point to cmsbox, who does whatever they do.
Indeed, whatever they do, it is very weird. The expected behaviour, what Zinc saw in the past, was this: $ curl -v http://www.pharo-project.org * About to connect() to www.pharo-project.org port 80 (#0) * Trying 217.11.221.200... * connected * Connected to www.pharo-project.org (217.11.221.200) port 80 (#0)
GET / HTTP/1.1 User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8r zlib/1.2.5 Host: www.pharo-project.org Accept: */*
< HTTP/1.1 301 Moved Permanently < Date: Tue, 07 May 2013 13:31:49 GMT < Server: KomHttpServer/7.1.2 (unix) < Expires: Wed, 11 Jun 1980 12:00:00 GMT < Pragma: no-cache < Cache-Control: no-cache, must-revalidate < Location: http://www.pharo-project.org/home < Content-type: text/html;charset=utf-8 < Content-length: 0 < Set-Cookie: cmsbox=2iGdm7JKpeAWQIr4; expires=Wed, 8-May-2013 11:31:49 GMT; path=/ < Set-Cookie: cmsbox_intro=true; expires=Wed, 8-May-2013 11:31:49 GMT; path=/ < Via: 1.1 one.cmsbox.com < Vary: Accept-Encoding < * Connection #0 to host www.pharo-project.org left intact * Closing connection #0 Now I see this (in older 2.0 images as well) : ZnClient new logToTranscript; url: 'http://www.pharo-project.org'; get. 2013-05-07 13:33:00 454373 I Wrote a ZnRequest(GET /) 2013-05-07 13:33:00 454373 D Sent headers Accept: */* User-Agent: Zinc HTTP Components 1.0 Host: www.pharo-project.org 2013-05-07 13:33:01 454373 I Read a ZnResponse(403 Forbidden text/html;charset=iso-8859-1 289B) 2013-05-07 13:33:01 454373 D Received headers Content-Length: 289 Date: Tue, 07 May 2013 11:32:59 GMT Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 2013-05-07 13:33:01 454373 T GET / 403 289B 1048ms In other words we get a 403, Forbidden. Browsers seem fine. Only Zinc fails. Note how only 3 headers are sent, this is almost minimal. Let's seen what happens if we pretend to be curl: ZnClient new logToTranscript; url: 'http://www.pharo-project.org'; headerAt: 'User-Agent' put: 'curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8r zlib/1.2.5'; get. 2013-05-07 13:35:06 454373 I Wrote a ZnRequest(GET /) 2013-05-07 13:35:06 454373 D Sent headers Accept: */* User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8r zlib/1.2.5 Host: www.pharo-project.org 2013-05-07 13:35:06 454373 I Read a ZnResponse(301 Moved Permanently) 2013-05-07 13:35:06 454373 D Received headers Vary: Accept-Encoding Content-Length: 0 Set-Cookie: cmsbox=42OaBSDBRqNTayAJ; expires=Wed, 8-May-2013 11:35:5 GMT; path=/ Set-Cookie: cmsbox_intro=true; expires=Wed, 8-May-2013 11:35:5 GMT; path=/ Content-Type: text/html;charset=utf-8 Date: Tue, 07 May 2013 13:35:05 GMT Location: http://www.pharo-project.org/home Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Wed, 11 Jun 1980 12:00:00 GMT Via: 1.1 one.cmsbox.com Server: KomHttpServer/7.1.2 (unix) 2013-05-07 13:35:06 454373 D Redirecting to http://www.pharo-project.org/home 2013-05-07 13:35:06 454373 D Received cookie: cmsbox=42OaBSDBRqNTayAJ; path=/; domain=www.pharo-project.org; expires=Wed, 8-May-2013 11:35:5 GMT 2013-05-07 13:35:06 454373 D Received cookie: cmsbox_intro=true; path=/; domain=www.pharo-project.org; expires=Wed, 8-May-2013 11:35:5 GMT 2013-05-07 13:35:06 454373 D Cookie set to: cmsbox_intro=true; cmsbox=42OaBSDBRqNTayAJ 2013-05-07 13:35:06 454373 I Wrote a ZnRequest(GET /home) 2013-05-07 13:35:06 454373 D Sent headers Cookie: cmsbox_intro=true; cmsbox=42OaBSDBRqNTayAJ Accept: */* User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8r zlib/1.2.5 Host: www.pharo-project.org 2013-05-07 13:35:06 454373 I Read a ZnResponse(200 OK text/html;charset=utf-8 17183B) 2013-05-07 13:35:06 454373 D Received headers Via: 1.1 one.cmsbox.com Date: Tue, 07 May 2013 13:35:05 GMT Expires: Wed, 11 Jun 1980 12:00:00 GMT Content-Length: 17183 Pragma: no-cache Cache-Control: no-cache, must-revalidate Server: KomHttpServer/7.1.2 (unix) Vary: Accept-Encoding Content-Type: text/html;charset=utf-8 2013-05-07 13:35:06 454373 T GET /home 200 17183B 655ms Magic, everything works: first response is a 301, the redirect is followed correctly, the page is returned as it should ! I tried various variations of User-Agent values, it is almost as if they do it on purpose. What if curl pretended to be Zinc ? curl -v http://www.pharo-project.org -H'User-Agent:Zinc HTTP Components 1.0' * About to connect() to www.pharo-project.org port 80 (#0) * Trying 217.11.221.200... * connected * Connected to www.pharo-project.org (217.11.221.200) port 80 (#0)
GET / HTTP/1.1 Host: www.pharo-project.org Accept: */* User-Agent:Zinc HTTP Components 1.0
< HTTP/1.1 403 Forbidden < Date: Tue, 07 May 2013 11:39:02 GMT < Vary: Accept-Encoding < Content-Length: 289 < Content-Type: text/html; charset=iso-8859-1 < <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access / on this server.</p> <hr> <address>Apache/2.2.22 (Debian) Server at www.pharo-project.org Port 80</address> </body></html> * Connection #0 to host www.pharo-project.org left intact * Closing connection #0 How about that !? I would expected a friendlier response from a CMS written in Pharo ;-) I CC'd cmsbox & Christoph, maybe he can ask his tech team if they can explain this. Sven -- Sven Van Caekenberghe http://stfx.eu Smalltalk is the Red Pill
Dear Sven Am 07.05.13 13:47, schrieb Sven Van Caekenberghe:
On 07 May 2013, at 12:11, Marcus Denker <marcus.denker@inria.fr> wrote:
On May 7, 2013, at 12:06 PM, Camillo Bruni <camillobruni@gmail.com> wrote:
On 2013-05-07, at 11:15, Sven Van Caekenberghe <sven@stfx.eu> wrote:
On 07 May 2013, at 07:42, no-reply@ci.inria.fr wrote:
https://ci.inria.fr/pharo/job/Pharo-3.0-Update-Step-2-Validation/./label=win...
2 regressions found. Zinc.Tests.ZnClientTests.testRedirect Zinc.Tests.ZnClientTests.testRedirectDontFollow
These tests assume that http://www.pharo-project.org is a redirect. The website seems to behave a bit different now, I'll have to investigate. Any pointers as to what changed are welcome.
I think we updated the DNS to point directly to the same server as pharo.org.
But this was the same like before⦠they both point to cmsbox, who does whatever they do.
Indeed, whatever they do, it is very weird.
[...]
In other words we get a 403, Forbidden. Browsers seem fine. Only Zinc fails. Note how only 3 headers are sent, this is almost minimal. Let's seen what happens if we pretend to be curl:
[...]
How about that !? I would expected a friendlier response from a CMS written in Pharo ;-)
I CC'd cmsbox & Christoph, maybe he can ask his tech team if they can explain this.
We are sorry that our server configuration had unforeseen side effects. Your observations are absolutely correct: our security officer blocked these requests based on IP and user agent string which is the reason why your tests now fail. First of all: we did not know what the purpose of these requests was. We just saw regularly strange hits within a small time range like "/page-that-will-never-ever-exist/?C=M%3BO%3DD" that we could not explain and which were never announced to us. As the Cmsbox of pharo-project.org was aggressively attacked (thousands of requests) last weekend by robots and even killed several times (out of memory) we were heavily restricting what comes through to the Cmsbox and what not. And these requests did not make it... sorry. But: please note that our infrastructure is not a playground. It is a productive environment for hundreds of websites which is the reason that we became very careful about security attacks. Using mod_security for Apache and other tools we are restricting access to cmsbox websites as there are a lot of unwanted visitors out there. Besides, a Pharo image cannot handle unlimited requests and we cannot load balancing to infinity. Therefore we focus to keep the existing resources free for real website visitors and some legitimate (and unfortunately rarely intelligent) robots. Of course we are willing to discuss solutions which fulfil some criteria such as a rate limit (max. request count per minute) and we will allow these requests to get through again. Do you have propositions how this could be integrated within this test suite? Or could not be a separate Pharo image on a testing environment we would provide be a better solution for such a test suite? Thank you for your understanding! Chris -- Christoph Wysseier netstyle.ch GmbH, CEO
participants (5)
-
Camillo Bruni -
Christoph Wysseier -
Marcus Denker -
no-reply＠ci.inria.fr -
Sven Van Caekenberghe