> Source: [sk111579](https://support.checkpoint.com/results/sk/sk111579)

# sk111579 - IPS blade drops non-compliant HTTP packets with multiple gzip compression

| Property | Value |
|----------|-------|
| Solution ID | sk111579 |
| Date Created | 2016-05-23 |
| Last Modified | 2019-06-04 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * HTTP traffic is dropped without SmartView Tracker logs when IPS blade is enabled.

* Kernel debug ('`fw ctl debug -m fw + drop tcpstr`' and '`fw ctl debug -m WS + session`' \* ) shows:

  `
  ;xxx:{session} [SID: ...] ws_gzip_policy_element_header_cb: gzip matched;`  
  `
  ;xxx:{session} [SID: ...] ws_gzip_policy_element_header_cb: ws_block_recursive_content_encoding || strict_resp_parsing is on - checking multi layer compression;`  
  `
  ;xxx:{session} [SID: ...] ws_gzip_policy_element_header_cb: search another 'gzip', ... ',gzip';`  
  `
  ... ...`  
  `
  `**;xxx:{session} [SID: ...] ws_gzip_policy_element_header_cb: [WARNING]: ws_block_recursive_content_encoding is on and multi layer compression was found - rejecting;**   
  `
  ... ...`  
  `
  ;xxx:{policy} [SID: ...] ws_policy_process_header: wpe GZIP returned action REJECT [];`  
  `
  ;xxx:{policy} [SID: ...] ws_policy_process_header: returned action REJECT [];`  
  `
  ... ...`  
  `
  ;xxx:{session} [SID: ...] ws_http_parser_header_cb: [WARNING]: Stopping parser - reject has been ordered;`  
  `
  ... ...`  
  `
  ;xxx:{session} [SID: ...] ws_http_process_raw_data: [WARNING]: reject stop was requested;`  
  `
  ... ...`  
  `
  ;xxx:{module} ws_connection_passive_read_handler: read handler requested to close connection;`  
  `
  ;xxx:{module} ws_connection_passive_read_handler: READ END: returned: PSL_STAT_STOP_AND_REJECT;`  
  `
  ;psl_process_data: processing function for app 2[HTTP_PSL] returned STOP_AND_REJECT;`  
  `
  ... ...`  
  `
  ;psl_handle_packet: saving msg "HTTP_PSL";`  
  `
  ;psl_handle_packet: finished REJECT, ...;`  
  `
  ;fwpslglue_pkt_handler: finished REJECT, ..., msg "HTTP_PSL";`  
  `
  ... ...`  
  `
  ;fwpslglue_chain: reject packet will be filtered;`  
  `
  ;fwpslglue_chain: rejecting both dirs;`  
  `
  ;fwpslglue_chain: rejecting packet, message "PSL Reject: HTTP_PSL";`  
  `
  `**;fw_log_drop_ex: Packet proto=6 IP_Address:80 -> Dest_IP_Address:Port dropped by fwpslglue_chain Reason: PSL Reject: HTTP_PSL;**`
  `
* Traffic capture on Security Gateway shows that the dropped HTTP packets are:

  * HTTP responses "302 Found" that contain multiple gzip compression:  
    `Content-Encoding: gzip,gzip\r\n`
  * These HTTP responses "302 Found" are sent by web server in response to HTTP "POST" packets sent by client

## Cause

IPS will drop HTTP traffic with multiple encoding schemes, only if Gzip enforcement is enabled and the "drop compressed traffic if inspection is stopped" was checked. By default this checkbox is not enabled.**\***

In this case, per RFC 2068, HTTP response "302 Found" should only be sent in response to a "GET" or "HEAD" request.

**\*** To see these settings, go to:

1. **Shared Policies** \>**Inspecton Settings**
2. Search for "gzip" \> **Edit**
3. Select relevant profile \>**Edit**
4. **Advanced settings**

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content