Re: Apache Broken Images: 2.7 + 2.8 with ipf enabled

[Marina Brown <marina@surferz.net>]

Dear Mattew:

   I have no experience with IPF, but this is what i noticed. Using netscape
under Linux, i do not get any of the images unless i do "View Image" on them.
Then the images load. Using wget -r, i am able to retrieve ALL of the images on 
the first try. This makes me assume the problem is in the way netscape connects
to the server.  I would start checking how your browser is connecting to the
server. Is it using keepalive ? The tool *I* would use to check into this is
tcpdump or another network sniffer.

                       My thoughts, feel free to disregard
                                              Marina Brown

----------------------------------------------


On Sun, 02 Sep 2001, Matthew McGehrin wrote:
> I'm seeing broken images when I view web content on both of my servers. I
> have double checked the code, and the images and html are labeled correctly.
> 
> For example:
> 
> http://bluemoon.reverse.net/~matthew/
> 
> Should show the following : yellow bar, red bar, black bar, and then repeat,
> yellow bar 2, red bar 2, black bar 2
> 
> However, sometimes the pages loads correctly, sometimes it doesnt. If you
> hit reload enough times, it might show 4/6 images, or might show 2/6 images.
> 
> This is also happening on another system
> 
> http://redmoon.reverse.net/~matthew
> 
> I am unsure how to debug this. Both systems are running identical
> ipf.rulesets. Below is detailed information about both boxes.
> 
> Thanks
> 
> Matthew
> 
> # ipf.rules [shell.reverse.net]
> 
> pass out quick on lo0
> 
> pass in quick on lo0
> 
> # block all non-traceable routes
> 
> block in quick on xl0 from 192.168.0.0/16 to any
> 
> block in quick on xl0 from 172.16.0.0/12 to any
> 
> block in quick on xl0 from 10.0.0.0/8 to any
> 
> block in quick on xl0 from 127.0.0.0/8 to any
> 
> block in quick on xl0 from 0.0.0.0/8 to any
> 
> block in quick on xl0 from 169.254.0.0/16 to any
> 
> block in quick on xl0 from 192.0.2.0/24 to any
> 
> # block all incoming traffic
> 
> block in on xl0 from any to any
> 
> # allow escape.com
> 
> pass in quick on xl0 from 198.6.71.0/24 to any
> 
> # allow identd
> 
> pass in quick on xl0 from any to any port = 113
> 
> # allow smtp
> 
> pass in quick on xl0 from any to any port = 25
> 
> # allow http and https
> 
> pass in quick on xl0 from any to any port = 80
> 
> pass in quick on xl0 from any to any port = 443
> 
> # allow pop
> 
> pass in quick on xl0 from any to any port = 110
> 
> # allow ssh
> 
> pass in quick on xl0 from any to any port = ssh
> 
> # allow ftpd
> 
> pass in quick on xl0 from any to any port = 21
> 
> # allow stuff to run on port 1023+
> 
> pass in quick on xl0 proto tcp/udp from any to any port > 1023
> 
> # allow outgoing traffic out
> 
> pass out quick on xl0 proto tcp/udp from any to any keep state
> 
> # end
> 
> bluemoon# ipf -V
> ipf: IP Filter: v3.3.18 (184)
> Kernel: IP Filter: v3.3.18
> Running: yes
> 
> bluemoon# httpd -v
> Server version: Apache/1.3.12 (Unix)
> Server built:   Oct 31 2000 17:41:06
> 
> redmoon# ipf -V
> ipf: IP Filter: v3.3.13 (184)
> Kernel: IP Filter: v3.3.14
> Running: yes
> 
> redmoon# httpd -v
> Server version: Apache/1.3.20 (Unix)
> Server built:   Jul 31 2001 15:22:12
-- 
---------------------------------------------------------
A successful civil rights group requires more guts than 
bucks, pursuit of the buck drains the guts.

            Cathy Platine - Founder Transexual Avengers
---------------------------------------------------------