<div dir="ltr"><div><font color="#000000">I do apologize I do not have logs of that specific file but I have an example from the same site and doing the same post.</font></div><div><span class="gmail-im" style="color:rgb(80,0,80)"><br></span></div><span class="gmail-im" style="color:rgb(80,0,80)">> Even though it looks like TeChunkedParser is getting all the<br>> additional headers<br><br></span>>TeChunkedParser has nothing to do with multipart/form-data bodies.<br>>TeChunkedParser parses chunked encoding, and even then it is applied to<br>>remove _transfer_ encoding, not to interpret the actual resource content<br>>inside the chunks. <div><br></div><div><font color="#9900ff">I do see it in two locations.<br><br>2020/07/26 23:11:12.921 kid6| 74,9| TeChunkedParser.cc(45) parse: Parse buf={length=3667, data='e47<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="action"<br><br>frm_submit_dropzone<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="field_id"<br><br>8<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="form_id"<br><br>5<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="nonce"<br><br>6bb20c0bd7<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="file8"; filename="file.zip"<br>Content-Type: application/x-zip-compressed</font></div><div><font color="#9900ff"><br></font></div><div><font color="#9900ff">As well as the following location<br></font><br><font color="#9900ff">2020/07/26 23:11:12.921 kid6| 58,9| HttpMsg.cc(198) parse: HttpMsg::parse success (689 bytes) near 'POST <a href="http://bbbb.com/post">http://bbbb.com/post</a> HTTP/1.1<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0<br>Accept: application/json<br>Accept-Language: en-US,en;q=0.5<br>Accept-Encoding: gzip, deflate<br>Cache-Control: no-cache<br>X-Requested-With: XMLHttpRequest<br>Content-Type: multipart/form-data; boundary=---------------------------351645264024548376901231954897<br>Content-Length: 3655<br>Origin: <a href="http://bbbbbb.com">http://bbbbbb.com</a><br>Referer: <a href="http://bbbbb.com.com/http-post/">http://bbbbb.com.com/http-post/</a><br>Cookie: _ga=GA1.2.1194289608.1595640198; _gid=GA1.2.252592555.1595804428; _gat_gtag_UA_47458108_3=1<br>Host: <a href="http://bbbbbbb.com">bbbbbbb.com</a><br>Via: ICAP/1.0 (C-ICAP/0.5.6 ICAP service )<br><br>e47<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="action"<br><br>frm_submit_dropzone<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="field_id"<br><br>8<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="form_id"<br><br>5<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="nonce"<br><br>6bb20c0bd7<br>-----------------------------351645264024548376901231954897<br>Content-Disposition: form-data; name="file8"; filename="file.zip"<br>Content-Type: application/x-zip-compressed</font><br><br><br>>I am not sure, but it looks like you have pasted a part of an ICAP<br>>message. TeChunkedParser is used to parse chunked transfer encoding used<br>>for a part of the ICAP message body. Beyond decoding those chunks, it is<br>>all opaque data to Squid.<div><br></div><div><font color="#9900ff">Thanks for that information.</font></div><div><br><br>>To avoid misunderstanding, in your pasted example, the contents of the<br>>first chunk starts with these two lines:<span class="gmail-im" style="color:rgb(80,0,80)"><br><br>> -----------------------------328901485836611227811186534509<br>> Content-Disposition: form-data; name="action"<br><br></span>>It does _not_ start with the "Content-Disposition:..." line or the<br>>"frm_submit_dropzone" line.<span class="gmail-im" style="color:rgb(80,0,80)"><br><br><br>> I can't seem to create ACL or output them using<br>> logformat. I was trying to request these headers with<br>> req_mime_type/resp_mime_type.<br><br></span>>If by "them" you mean MIME headers inside multipart parts, then Squid<br>>does not see them and does not operate on them. The insides of each<br>>chunk is opaque data to Squid.<span class="gmail-im" style="color:rgb(80,0,80)"><br><br><br>> and also had log_mime_hdrs on and then in<br>> logformat just had all.<br><br></span>>You should be able to log the HTTP request header values using %>h or<br>>%>ha. You will not be able to log or match any message body snippets,<br>>including things like MIME Content-Disposition values. Squid does not<br>>look inside the body of the POSTed resource.<br><br><font color="#9900ff">I will test with the two examples given and see what they return. </font><br><br><br>>If you need further help, you may want to clarify what you are trying to<br>>achieve. You said "send multipart form data to another service". Are you<br>>trying to _route_ request messages based on multipart form _contents_? <br></div></div><div><br></div><div><font color="#9900ff">What I am ultimately trying to accomplish is to see the best way to get more detail and have an action on sites </font></div><div><font color="#9900ff">that are posting using multipart/form-data as the Content-Type header. This is mainly to separate action taken on an actual form being submitted </font></div><div><font color="#9900ff">versus a file being submitted or as you stated route request messages based on the content. </font></div><div><font color="#9900ff">Whether that be logformat with headers and passing the headers to a custom external service or within squid itself. </font></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 29, 2020 at 12:16 PM Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com">rousskov@measurement-factory.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 7/29/20 11:38 AM, Ryan Le wrote:<br>
> Even though it looks like TeChunkedParser is getting all the<br>
> additional headers <br>
<br>
TeChunkedParser has nothing to do with multipart/form-data bodies.<br>
TeChunkedParser parses chunked encoding, and even then it is applied to<br>
remove _transfer_ encoding, not to interpret the actual resource content<br>
inside the chunks.<br>
<br>
I am not sure, but it looks like you have pasted a part of an ICAP<br>
message. TeChunkedParser is used to parse chunked transfer encoding used<br>
for a part of the ICAP message body. Beyond decoding those chunks, it is<br>
all opaque data to Squid.<br>
<br>
To avoid misunderstanding, in your pasted example, the contents of the<br>
first chunk starts with these two lines:<br>
<br>
> -----------------------------328901485836611227811186534509<br>
> Content-Disposition: form-data; name="action"<br>
<br>
It does _not_ start with the "Content-Disposition:..." line or the<br>
"frm_submit_dropzone" line.<br>
<br>
<br>
> I can't seem to create ACL or output them using<br>
> logformat. I was trying to request these headers with<br>
> req_mime_type/resp_mime_type. <br>
<br>
If by "them" you mean MIME headers inside multipart parts, then Squid<br>
does not see them and does not operate on them. The insides of each<br>
chunk is opaque data to Squid.<br>
<br>
<br>
> and alos had log_mime_hdrs on and then in<br>
> logformat just had all.<br>
<br>
You should be able to log the HTTP request header values using %>h or<br>
%>ha. You will not be able to log or match any message body snippets,<br>
including things like MIME Content-Disposition values. Squid does not<br>
look inside the body of the POSTed resource.<br>
<br>
<br>
If you need further help, you may want to clarify what you are trying to<br>
achieve. You said "send multipart form data to another service". Are you<br>
trying to _route_ request messages based on multipart form _contents_?<br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
<br>
> On Thu, Jul 23, 2020 at 11:46 AM Ryan Le wrote:<br>
> <br>
> Thanks, <br>
> <br>
> I have been looking at the squid debug and can see that it is<br>
> getting the multipart.<br>
> <br>
> POST <a href="http://bbbbbb.com" rel="noreferrer" target="_blank">http://bbbbbb.com</a><br>
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0)<br>
> Gecko/20100101 Firefox/78.0<br>
> Accept: application/json<br>
> Accept-Language: en-US,en;q=0.5<br>
> Accept-Encoding: gzip, deflate<br>
> Referer: <a href="http://bbbbb.com" rel="noreferrer" target="_blank">http://bbbbb.com</a><br>
> Cache-Control: no-cache<br>
> X-Requested-With: XMLHttpRequest<br>
> Content-Type: multipart/form-data;<br>
> boundary=---------------------------328901485836611227811186534509<br>
> Content-Length: 1245<br>
> Origin: <a href="http://bbbbb.com" rel="noreferrer" target="_blank">http://bbbbb.com</a><br>
> Cookie: cookie<br>
> Host: <a href="http://bbbbbbb.com" rel="noreferrer" target="_blank">bbbbbbb.com</a> <<a href="http://bbbbbbb.com" rel="noreferrer" target="_blank">http://bbbbbbb.com</a>><br>
> Via: ICAP/1.0 <br>
> <br>
> 4dd<br>
> -----------------------------328901485836611227811186534509<br>
> Content-Disposition: form-data; name="action"<br>
> <br>
> frm_submit_dropzone<br>
> -----------------------------328901485836611227811186534509<br>
> Content-Disposition: form-data; name="field_id"<br>
> <br>
> 8<br>
> -----------------------------328901485836611227811186534509<br>
> Content-Disposition: form-data; name="form_id"<br>
> <br>
> 5<br>
> -----------------------------328901485836611227811186534509<br>
> Content-Disposition: form-data; name="nonce"<br>
> <br>
> e1aca92777<br>
> -----------------------------328901485836611227811186534509<br>
> Content-Disposition: form-data; name="file8"; filename="translate.zip"<br>
> Content-Type: application/x-zip-compressed<br>
> <br>
> On Thu, Jul 23, 2020 at 11:16 AM Alex Rousskov<br>
> <<a href="mailto:rousskov@measurement-factory.com" target="_blank">rousskov@measurement-factory.com</a><br>
> <mailto:<a href="mailto:rousskov@measurement-factory.com" target="_blank">rousskov@measurement-factory.com</a>>> wrote:<br>
> <br>
> On 7/23/20 9:22 AM, Ryan Le wrote:<br>
> > I have been trying to configure squid to decode and send<br>
> multipart form<br>
> > data to another service. Is there an acl or build parameter<br>
> needed for<br>
> > multipart form data support?<br>
> <br>
> No, there is no need to allow any specific Content-Type, including<br>
> multipart. Squid does not know anything about<br>
> multipart/form-data. If a<br>
> multipart/form-data message is well-formed from HTTP point of<br>
> view, then<br>
> Squid will process it as any other message, including passing it to<br>
> ICAP/eCAP (where configured).<br>
> <br>
> Cheers,<br>
> <br>
> Alex.<br>
> <br>
<br>
</blockquote></div>