Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 33 replies
  • Subscribers 37 subscribers
  • Views 8168 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Traffic inspection bug relay_invalid_traffic

l0rdraiden

Is this bug going to be fixed, or it has become a feature with a workaround?

Workaround

https://support.sophos.com/support/s/article/KB-000035989?language=en_US&c__displayLanguage=en_US#How-to-Enable-relay_invalid_traffic

BUG reason="HTTP parsing error encountered."

https://community.sophos.com/xg-firewall/sfos-eap/sfos-v18-early-access-program/f/feedback-and-issues/117316/bug---ssl-tls-inspection-seems-to-break-honeywell-smart-devices

BUG reason="HTTP pipelined request encountered."

https://community.sophos.com/xg-firewall/f/discussions/119219/bug-web-filter-blocking-random-categories



This thread was automatically locked due to age.

Top Replies

  • in reply to LuCar Toni +3

    As LuCar has said, HTTP Pipeline is not supported in DPI mode.

    As posted in the EAP threads you mention, but let me clarify.

    The HTTP Pipeline error was appearing for some non-pipeline reasons in EAP, which we think are all resolved in GA.

    The only HTTP Pipeline errors that we know about are "real" pipelines such as some netflix hardware.  The solution it to configure that traffic only to go through the traditional web proxy.

    If you are getting the error for specific traffic only then it is likely real a pipeline error, and you should configure it so that traffic goes through the proxy.

    If you are getting that error all over the place (like your screenshot during EAP) you may have another problem that is something to do with your network topology, your configuration, or a fault on your box.  Given that we are not getting any support calls about this, it is unlikely (but certainly possible) this is a bug, or if it is one it is only in certain uncommon setups.

    For example, HTTP pipeline was supported (but disabled) in FireFox and then removed in 2017.  Its removed from Chrome as well, not sure when. However if you are using an old browser that still supports it, and enabled pipelining for it, then you may be experiencing HTTP pipeline errors all over the place.  At that point the solution is to update/reconfigure your browser/app/whatever is doing that.

    If you are getting that error all over the place and you have Sophos Support, please raise a ticket with them.
    If you are getting that error all over the place and you don't have Sophos Support, there is not much I can suggest.  Maybe install another box, see if it happens there as well.

    Jump to answer
Parents
  • 0

    Thanks to everyone who has reported sites or applications that trigger the HTTP pipelining issue.

    Could you also confirm which firmware version you are using when you make these reports. There were some issues addressed in v18.0 MR4 where packet boundary issues sometimes caused the Firewall to report pipelining where it wasn't actually being used. If you're not using MR4, it would be great if you could upgrade and see if the problem persists.

  • 0 in reply to RichBaldry

    I am using v18.0 MR4.
    Unfortunately, there are still issues.

  • 0 in reply to core_memory

    Trying to reproduce the issue with MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT, I see similar requests from Windows machines on my network but they are never getting blocked or logged as pipelined.

    The requests to go.microsoft.com/fwlink/... always gets a status_code="302" response - a redirection.

    They are always followed in the log by a request to dmd.metaservices.microsoft.com

    There is then another request to go.microsoft.com/fwlink/... but this always seems to come over a new TCP connection (it has a different source port), so it cannot be Pipelined.

    Perhaps you could take a look in the detailed log viewer and filter it on "go.microsoft.com". It would be interesting to see (a) how often these requests are blocked as Pipelined, and (b) if there are requests logged immediately after or before the 'blocked' ones that might give us some hints as to why some are OK and some not.

  • 0 in reply to RichBaldry

    Thank you for your support.

    (a) "HTTP pipelined request encountered." was 1/64.
    (b) There was no access from the same source port.

    And Denied with reason="" was 18/64.
    When is this? Is this related?

Reply Children
No Data