gzip encoding on back end web server using SSL with NAM

  • 7011798
  • 18-Feb-2013
  • 19-Feb-2013

Environment

Access Manager 3.2 Support Pack 1 applied (3.2.1-57)
MultiPlatform Access Gateway Appliance (MAG Appliance)
Issue likely to appear on the Access Gateway Service too
Web server running Liferay Application on Tomcat 7

Situation

When trying to access back end Liferay web server, accelerated by the Access Gateway over SSL, users complain about not being able to view the contents of the pages.

After enabling the proxy in debug mode, the following errors are seen in the /var/log/novell-apache2/error_log file:

Jan 30 10:25:30 namtestgw1 httpd[6643]: [error] AMEVENTID#199: Insufficient data for inflate
Jan 30 10:25:30 namtestgw1 httpd[6643]: [error] AMEVENTID#199: Zlib: Validation bytes not present

Running the MAG apache process in debug mode shows the following additional info:

Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] mod_proxy_http.c(1879): proxy: start body send
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1897): OpenSSL: read 5/5 bytes from BIO#7f4c8967d2f0 [mem: 7f4c896a2bc0] (BIO dump follows)
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1830): +-------------------------------------------------------------------------+
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1869): | 0000: 17 03 01 00 18                                   .....            |
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1875): +-------------------------------------------------------------------------+
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1897): OpenSSL: read 24/24 bytes from BIO#7f4c8967d2f0 [mem: 7f4c896a2bc5] (BIO dump follows)
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1830): +-------------------------------------------------------------------------+
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1869): | 0000: 69 4f 82 28 48 81 73 74-95 86 0c 5f 62 98 32 32  iO.(H.st..._b.22 |
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1869): | 0010: 1b 43 0f 03 b0 f9 25 61-                         .C....%a         |
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] ssl_engine_io.c(1875): +-------------------------------------------------------------------------+
Jan 30 11:30:37 namtestgw1 httpd[21344]: [error] AMEVENTID#9: Insufficient data for inflate
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] mod_proxy_http.c(1983): proxy: end body send
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] proxy_util.c(2049): proxy: HTTPS: has released connection for (172.21.95.75)
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] mod_proxy_balancer.c(630): proxy_balancer_post_request for (balancer://bal_jontest)
Jan 30 11:30:37 namtestgw1 httpd[21344]: [debug] mod_deflate.c(1113): AMEVENTID#9: Zlib: Inflated 0 to 0 : URL /web/guest/home
Jan 30 11:30:37 namtestgw1 httpd[21344]: [error] AMEVENTID#9: Zlib: Validation bytes not present

The Access Gateway should not be compressing when Enable 'Force HTTP 1.0 to Origin Server' is enabled, but users still getting the same errors when this parameter was set.

Setting:
In Admin Console under Access Gateways | Edit | Reverse Proxy | Proxy Service | Web Servers Tab |  Enable Force HTTP 1.0 to Origin

On the back end Liferay server, multiple compression options exist:

java.util.zip.Deflater - gzip.compression.level=-1 (can be set from -1, to 0-9)  Tried setting it to -1, 1 and 2 but the results were all the same with error - "Zlib: Validation bytes not present"

Resolution

com.liferay.portal.servlet.filters.gzip.GZipFilter - Set this parameter to false in order to completely disable gzip encoding on the Liferay web server.

The AG Appliance is no longer throwing the Zlib error.
Able to remove the HTTP 1.0 option to the web server as well.