Subject: The end of the Internet as we now it

From: Christian Huitema <[email-masked]>
Date: Wed, 14 Oct 2020 21:19:35 -0700

Trying to access RFC 7230 as https://tools.ietf.org/html/rfc7230, I get:

Forbidden

You don't have permission to access /html/rfc7230 on this server.

Additionally, a 403 Forbidden error was encountered while trying to use
an ErrorDocument to handle the request.
------------------------------------------------------------------------
Apache/2.2.22 (Debian) Server at tools.ietf.org Port 443

So, the Internet is no for everybody anymore...

-- Christian Huitema

---

From: Jared Mauch <[email-masked]>
Date: Thu, 15 Oct 2020 01:07:43 -0400

Seems to work for me. 

Sent from my iCar

> On Oct 15, 2020, at 12:20 AM, Christian Huitema <[email-masked]> wrote:
> 
> 
> Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

---

From: Fred Baker <[email-masked]>
Date: Wed, 14 Oct 2020 22:37:21 -0700

Works for me...

Sent from my iPad

> On Oct 14, 2020, at 10:08 PM, Jared Mauch <[email-masked]> wrote:
> 
> Seems to work for me. 
> 
> Sent from my iCar
>

---

From: Christian Huitema <[email-masked]>
Date: Wed, 14 Oct 2020 23:01:49 -0700

Keeps not working for me. Tried getting RFC1984, same result. Tried from
my IPhone and that's forbidden too. I wonder whether I was put on some
kind of no-rfc list.

On 10/14/2020 10:37 PM, Fred Baker wrote:
>>> Additionally, a 403 Forbidden error was encountered while trying to
>>> use an ErrorDocument to handle the request.

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 15 Oct 2020 17:10:48 +1100

Christian,

The relevant HTTP RFCs are also available at <https://httpwg.org/specs/> -- and of course <https://rfc-editor.org/>.

Cheers,

> On 15 Oct 2020, at 5:01 pm, Christian Huitema <[email-masked]> wrote:
> 
> Keeps not working for me. Tried getting RFC1984, same result. Tried from my IPhone and that's forbidden too. I wonder whether I was put on some kind of no-rfc list.
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Christian Huitema <[email-masked]>
Date: Wed, 14 Oct 2020 23:17:15 -0700

I think there must be some side effect from my setup. What is really
weird is that it fails from 2 different computers.

I know the RFC can be accessed elsewhere. In fact, the IETF datatracker
works. It is just an issue for me with the tool server. But it is really
weird.

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 15 Oct 2020 17:18:49 +1100

Send:

GET /html/rfc7230 HTTP/1.1
Host: tools.ietf.org
Is-Christian: ?0

Cheers,

> On 15 Oct 2020, at 5:17 pm, Christian Huitema <[email-masked]> wrote:
>

---

From: Christian Huitema <[email-masked]>
Date: Thu, 15 Oct 2020 00:04:52 -0700

> GET /html/rfc7230 HTTP/1.1

That's a bit too high level for me :-). But wireshark shows several
TCP-SYN being sent and repeated to port 443 at 4.31.198.61, and no
SYN-ACK ever coming back.  On the other hand, ping responds just fine.
Which means there is a firewall somewhere that sees fit to block the
packets. Oh well. Time to get some sleep...

-- Christian Huitema

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 15 Oct 2020 11:47:11 +0200

Christian: Its most likely Marks fault. Since rfc8890 he is responsible for
the list of end users for the Internet and must have forgotten to add you.

Mark: Expecting Christian to understand rfc7230 headers before he
can read it is recursive logic.

Christian: wget -d https://tools.ietf.org/html/rfc7230

paste relevant output if that does not work.

I think what Mark was suggesting is:

openssl s_client -crlf -connect tools.ietf.org:443
GET /html/rfc7230 HTTP/1.1
User-Agent: Not Christian Huitema
Host: tools.ietf.org

(don't forget empty line at the end)

Cheers
    Toerless

On Thu, Oct 15, 2020 at 05:18:49PM +1100, Mark Nottingham wrote:
> >>>>> ??? Seems to work for me. 
> >>>>> 
> >>>>> Sent from my iCar
> >>>>> 
> >>>>>> ???

-- 
---
[email-masked]

---

From: Leif Johansson <[email-masked]>
Date: Thu, 15 Oct 2020 11:59:19 +0200

> Is-Christian: ?0

/me frantically looking for IANA registries...

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 15 Oct 2020 10:56:59 +0000

> Oh well. Time to get some sleep...

Yes, Christian, we put parental controls on for you to limit your screen time.  Do your chores!

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 15 Oct 2020 13:01:54 +0200

Hi Christian,

Is your address one of the 3 below (all MSFT addresses, according to whois):

	    40.69.96.43
	    52.170.100.128
	    13.70.140.143

On 10 October, each of the addresses above did more than 100k accesses to
htmlized drafts and RFCs, many of which weren't in the cache and had to be
re-generated.  As the server was already heavily loaded from a distributed
unlabelled crawler, I blocked those 3 at the time.

If your client address(es) are not among the ones above, please provide the
failing addresses, and I'll see what I can find.

Regards,

	Henrik

---

From: Jared Mauch <[email-masked]>
Date: Thu, 15 Oct 2020 08:09:12 -0400

> packets. Oh well. Time to get some sleep...

	Are your packets or OS rfc3514 complaint?

	- Jared

-- 
Jared Mauch  | pgp key available via finger from [email-masked]
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.

---

From: Ofer Inbar <[email-masked]>
Date: Thu, 15 Oct 2020 09:30:26 -0400

On Thu, Oct 15, 2020 at 05:18:49PM +1100,
> GET /html/rfc7230 HTTP/1.1

That header isn't registered, so you really should be using X-Is-Christian:
... which makes me wonder whether you were building up to that clever
pun deliberately by leaving off his last name.
  -- Cos

---

From: Dave Cridland <[email-masked]>
Date: Thu, 15 Oct 2020 15:09:00 +0100

> pun deliberately by leaving off his last name.

https://tools.ietf.org/html/rfc6648 mind, so the pun might be clever, but
would no longer be conformant.

---

From: Dave Aronson <[email-masked]>
Date: Thu, 15 Oct 2020 10:14:29 -0400

> GET /html/rfc7230 HTTP/1.1

Oh, THAT explains why I wasn't able to get it!  I had forgotten
exactly what the line was, and sent:

> Is-Jewish: ?1

-- 
Dave Aronson, T. Rex
Codosaurus, LLC (http://www.Codosaur.us)
Software Development Consulting
How can we evolve you today?

---

From: Michael Thomas <[email-masked]>
Date: Thu, 15 Oct 2020 12:13:58 -0700

> On 10/14/2020 11:10 PM, Mark Nottingham wrote:

Don't you have a teen in the house that can help you with this stuff?

Mike

---

From: Christian Huitema <[email-masked]>
Date: Thu, 15 Oct 2020 12:26:50 -0700

> Don't you have a teen in the house that can help you with this stuff? 

I got much better than that, help from Henrik Levkowetz. It turns out
that the issue was caused by a DOS attack on the tool server -- or in
any case a traffic pattern that had the same effect as a DOS attack. To
keep the server operational, the tools team blocked a set of IP address
ranges from which the offending traffic appeared to come, and my own IP
address was caught in one of these ranges. Thanks to Henrik for
diagnosing and explaining the problem.

I know that my choice of subject line was a bit over the top, but maybe
it is not so wrong after all. Even sophisticated web site operators like
our tools team have difficulties dealing with spikes of traffic and with
attacks, and they have only blunt instruments at their disposal. So,
yes, the Internet is not working as it used too.

-- Christian Huitema

---

From: Michael Thomas <[email-masked]>
Date: Thu, 15 Oct 2020 12:37:54 -0700

On 10/15/20 12:26 PM, Christian Huitema wrote:
> any case a traffic pattern that had the same effect as a DOS attack. 
> To keep the server operational, the tools team blocked a set of IP 
> address ranges from which the offending traffic appeared to come, and 
> my own IP address was caught in one of these ranges. Thanks to Henrik 
> for diagnosing and explaining the problem.
>
> I know that my choice of subject line was a bit over the top, but 
> maybe it is not so wrong after all. Even sophisticated web site 
> operators like our tools team have difficulties dealing with spikes of 
> traffic and with attacks, and they have only blunt instruments at 
> their disposal. So, yes, the Internet is not working as it used too.
>
>
oh my, that is obscure.  welcome back to adolescence, Henrik :)

Mike

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 16 Oct 2020 00:37:06 +0200

> yes, the Internet is not working as it used too.

In the past i had similar blocks for other web services, but at least
i did get web page replies that explicitly said that my IP addres
was blocked for he service due to abuse (i think back when comcast was
using dynamically reassigned ip addresses). Would be great if this
diagnosis could be fashioned also for ietf tool services
so users don't have to guess or get hold of the ietf tools admin.

Wasn't there something with IETF using cloudflare or the like ? I
don't know exactly what they offer, but a hardened web page saying as
much (your address is blocked due to abuse, resolve problem...)
to which a redirect at network level could be done should be possible.

Aka: Just ACL filtering is not nice to the users, but i am only
guessing how its set up - your initial info wasn't fully conclusive
in between "access denied" and "no packets coming back".

Cheer
    toerless