Server and CDN
Notes from the layer under WordPress: OpenLiteSpeed, PHP, LiteSpeed Cache, Cloudflare, DNS and DKIM. Most of them start with a check that gave the wrong answer: a purge that reported success and cleared nothing, a file marked no-store that the edge kept anyway, a redirect that proved nothing about a page. Each one ends with the request that showed what was really happening.
By John Patzi 16 notes
Server and CDN The PHP syntax check on this server crashes, and a pipe turns that into a passphp -l segfaults on a one-line file here. The manual documents two exit codes and this is neither, and piping the output converts the crash into the value that means success.Read the note
Server and CDN I made 60 requests to my own site and the access log recorded 6Sixty requests left my laptop and six reached my server. The rest were answered at the CDN edge. What that does to every crawler conclusion drawn from an origin log, including two of mine I had to retract.
Server and CDN A quarter of my server log is the site calling itself, and I caused half of itBetween a sixth and two fifths of the requests reaching my server are WordPress asking WordPress whether anything is due. The busiest days were the days I spent measuring the site.
Server and CDN Five machines asked my site for the same 272 paths, and none of them are about my siteFive rented machines requested an identical list of 272 paths. Sorted by what they are looking for, the list stops being an attack and becomes a catalogue of the same deployment mistake, written down forever.
Server and CDN My probe returned the same code whether the rule was alive or deadI asked for a file that did not exist to find out whether a block rule was working, got 404, and concluded it was dead. It was alive. The condition my probe relied on is the one that guarantees the rule gets skipped.
Server and CDN A path I invented returned 301, and the one that exists returned 200I asked my own site for twenty random characters that have never been published. Over HTTP it answered 301. The redirect was about the scheme, not the path, and then the standard took away my 404 too.
Server and CDN My firewall rule would block my own article about firewall rulesI deployed a rule that blocks probes for phpinfo files. It also blocks any article whose URL contains that word, and this site writes about those probes. No measurement taken today could have found it.
Server and CDN php -i answers for a different program than the one serving your siteI diagnosed OPcache on this site with php -i, wrote it up, and sent it to a colleague. Every word was about a different binary from the one the virtual host names.
Server and CDN My cache rule asks a different question from the one it looks like it asksIt misses TEXT/MARKDOWN, which the HTTP standard says is the same media type, and it fires on a vendor type that is not Markdown at all. Both errors come from one substitution, and I published the wrong explanation first.
Server and CDN The two tools that ship with OpenDKIM both misreported my keys, in opposite directionsOne corrupts the signature it has just computed, but only in its default invocation. The other prints a DNSSEC warning about every key it is ever given, because the build has no DNSSEC support compiled in. Both measured and reproducible.
Server and CDN The cache was never ignoring the header. I had never told it the page variedI spent two days proving my server refused to vary its cache by Accept, and wrote three explanations for it. The first two were wrong. The cache keys on request headers perfectly well — it just has to be told by the response, and my site never told it.
Server and CDN A cache-buster gave me my own copy of the page, and hid what everyone else was servedA subdomain of mine served a hosting panel's splash screen to every visitor while a cache-busted request returned the real site. Both readings were correct. Only one was the URL anybody else would type — and the fix is three seconds of work.
Server and CDN Cloudflare stores the file I marked no-store, and my own rule is whyNine files tell agents what this site is. I measured what the edge did with each against what the origin asked for, and they disagree about three of them, in both directions.
Server and CDN Three ways to be told a cache purge worked, and none of them looked at the cacheI ran the command that purges one URL. It printed Success, the edge kept serving the old copy, and the origin never dropped its own. That message is not a report about a cache: it is a report that an HTTP request came back 200.
Server and CDN Four ways to ask PHP what it is configured to do, and three of them are not your siteI wanted to confirm that one PHP setting was active on this site. There are four ways to ask, all of them one line long, and three of them answer about something that is not my website. Two of those three read the same php.ini as the real one and still disagree with it.
Server and CDN Passing the DNS-AID check with an SVCB record, and the two records I rejectedA public scanner's DNS-AID check fails Infoblox, Cloudflare and the scanner's own site. The one domain I found passing was passing with a record type the draft does not define. Here is what the IETF draft actually specifies, the single SVCB record I published, and the two I rejected because they would have been false.