Search squid archive

Negotiate bug in squidclient ?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This time I tried squidclient to check Kerberos authentication. I am
afraid there is a bug in squidclient where the "Proxy-Authorization:"
header (the Negotiate token) is being sent truncated, and the server
reacts with the 'gss_accept_sec_context() failed:  A token was
invalid.' error.

Here is what I run:

./squidclient -v -h proxy.sibptus.transneft.ru -p 3131 -n http://ya.ru

and what it being sent to the server:

=====================

Request:'GET http://ya.ru HTTP/1.0
Host: ya.ru
User-Agent: squidclient/3.4.8
Accept: */*
Proxy-Authorization: Negotiate YIIGDQYGKwYBBQUCoIIGATCCBf2gDTALBgkqhkiG9xIBAgKiggXqBIIF5mCCBeIGCSqGSIb3EgECAgEAboIF0TCCBc2gAwIBBaEDAgEOogcDBQAAAAAAo4IEtGGCBLAwggSsoAMCAQWhFhsUU0lCUFRVUy5UUkFOU05FRlQuUlWiLTAroAMCAQGhJDAiGwRIVFRQGxpwcm94eS5zaWJwdHVzLnRyYW5zbmVmdC5ydaOCBFwwggRYoAMCAReiggRPBIIES8Tjx9IM4sRh+fXqnEEslV/wXuEqv1o5fA9k9QYfpd1Wwhll7ZDKEsDrGPKp57ylsm7X9l5ODhONBlkGwd24vngmmlgQ3Frxn8csh2+QgxeQZqhiV2QgdT/MVU3Khjae4jklS/F5yFxdd4DO0UrqRu7iaXLsgRf4h/4p/kxkTlQAtn+u5H8Nm50M670pdHU5s5GWAIKFY+v/oq6k8OdmU/COaXn5qkU2UtTPj51i24/Vi8aI7qb+KnvpmEOktMZ/+lhbjerZut6jQYXX7rZ6K/uBAGbI8wBLPjymv8yyd9bE3THTOuykcI+l/lEi3uyPP9ievHYnvlT9c1TSvuTRCJOFpRZ2WM1MPifu7GJ6RYkReHoyhQC+uCXcOaWsCn22uWBYNvVsUWCFEPAkId40k5y7w6IThtoDLC6+3NYtWJgl+LhXbiRNMl25H+4nDyNhm8eg2XC46WPJQ/4ljBfD/GoAJz6I2hWD+5Pvc1zGQQcS1w9vTXuDoWqkDeCQKFhfIWASY7H9w0v1IePRbGx+o8FJZuVtTU/8DKDJJ0x3FVxaMjKwrZk08jsDtxFpk+pdWOH9li+WPjXG5d1TL9tntrt6gsnl89i4hjuCfIL3hpfLN//QE41e+pbVGgyEOQk06mYetn6juKStlslQSPk8wXMr2J40Avmgzv9fFSZ5IdH9uyFbau0Q6Hf4Y6BVNKkT8qDxVjmakCDz8xl93k6HLcDUdt98Connection: close

'
Resolving... proxy.sibptus.transneft.ru
Connecting... proxy.sibptus.transneft.ru(10.14.140.9)
Connected to: proxy.sibptus.transneft.ru (10.14.140.9)
Sending HTTP request ... done.
HTTP/1.1 407 Proxy Authentication Required
Server: squid/3.4.8
=====================

WireShark reports about "SPNEGO-KRB5 truncated" in this packet
(though the capture size was set to "unlimited" and squid's helper
reacts with 'A token was invalid.'

Could someone reproduce?

Attached please find how it looks in Wireshark (note the "Connection:"
header glued to the end of the truncated Negotiate token).


-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
sip:sudakov@xxxxxxxxxxxxxxxx
GET http://ya.ru HTTP/1.0
Host: ya.ru
User-Agent: squidclient/3.4.8
Accept: */*
Proxy-Authorization: Negotiate YIIGDQYGKwYBBQUCoIIGATCCBf2gDTALBgkqhkiG9xIBAgKiggXqBIIF5mCCBeIGCSqGSIb3EgECAgEAboIF0TCCBc2gAwIBBaEDAgEOogcDBQAAAAAAo4IEtGGCBLAwggSsoAMCAQWhFhsUU0lCUFRVUy5UUkFOU05FRlQuUlWiLTAroAMCAQGhJDAiGwRIVFRQGxpwcm94eS5zaWJwdHVzLnRyYW5zbmVmdC5ydaOCBFwwggRYoAMCAReiggRPBIIES8Tjx9IM4sRh+fXqnEEslV/wXuEqv1o5fA9k9QYfpd1Wwhll7ZDKEsDrGPKp57ylsm7X9l5ODhONBlkGwd24vngmmlgQ3Frxn8csh2+QgxeQZqhiV2QgdT/MVU3Khjae4jklS/F5yFxdd4DO0UrqRu7iaXLsgRf4h/4p/kxkTlQAtn+u5H8Nm50M670pdHU5s5GWAIKFY+v/oq6k8OdmU/COaXn5qkU2UtTPj51i24/Vi8aI7qb+KnvpmEOktMZ/+lhbjerZut6jQYXX7rZ6K/uBAGbI8wBLPjymv8yyd9bE3THTOuykcI+l/lEi3uyPP9ievHYnvlT9c1TSvuTRCJOFpRZ2WM1MPifu7GJ6RYkReHoyhQC+uCXcOaWsCn22uWBYNvVsUWCFEPAkId40k5y7w6IThtoDLC6+3NYtWJgl+LhXbiRNMl25H+4nDyNhm8eg2XC46WPJQ/4ljBfD/GoAJz6I2hWD+5Pvc1zGQQcS1w9vTXuDoWqkDeCQKFhfIWASY7H9w0v1IePRbGx+o8FJZuVtTU/8DKDJJ0x3FVxaMjKwrZk08jsDtxFpk+pdWOH9li+WPjXG5d1TL9tntrt6gsnl89i4hjuCfIL3hpfLN//QE41e+pbVGgyEOQk06mYetn6juKStlslQSPk8wXMr2J40Avmgzv9fFSZ5IdH9uyFbau0Q6Hf4Y6BVNKkT8qDxVjmakCDz8xl93k6HLcDUdt98Connection: close

HTTP/1.1 407 Proxy Authentication Required
Server: squid/3.4.8
Mime-Version: 1.0
Date: Sat, 18 Oct 2014 11:56:09 GMT
Content-Type: text/html
Content-Length: 4231
X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
Proxy-Authenticate: Negotiate
X-Cache: MISS from proxy.sibptus.transneft.ru
X-Cache-Lookup: NONE from proxy.sibptus.transneft.ru:3131
Via: 1.1 proxy.sibptus.transneft.ru (squid/3.4.8)
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd";>
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>ERROR: Cache Access Denied</title>
<style type="text/css"><!-- 
 /*
 Stylesheet for Squid Error pages
 Adapted from design by Free CSS Templates
 http://www.freecsstemplates.org
 Released for free under a Creative Commons Attribution 2.5 License
*/

/* Page basics */
* {
	font-family: verdana, sans-serif;
}

html body {
	margin: 0;
	padding: 0;
	background: #efefef;
	font-size: 12px;
	color: #1e1e1e;
}

/* Page displayed title area */
#titles {
	margin-left: 15px;
	padding: 10px;
	padding-left: 100px;
	background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;
}

/* initial title */
#titles h1 {
	color: #000000;
}
#titles h2 {
	color: #000000;
}

/* special event: FTP success page titles */
#titles ftpsuccess {
	background-color:#00ff00;
	width:100%;
}

/* Page displayed body content area */
#content {
	padding: 10px;
	background: #ffffff;
}

/* General text */
p {
}

/* error brief description */
#error p {
}

/* some data which may have caused the problem */
#data {
}

/* the error message received from the system or other software */
#sysmsg {
}

pre {
    font-family:sans-serif;
}

/* special event: FTP / Gopher directory listing */
#dirmsg {
    font-family: courier;
    color: black;
    font-size: 10pt;
}
#dirlisting {
    margin-left: 2%;
    margin-right: 2%;
}
#dirlisting tr.entry td.icon,td.filename,td.size,td.date {
    border-bottom: groove;
}
#dirlisting td.size {
    width: 50px;
    text-align: right;
    padding-right: 5px;
}

/* horizontal lines */
hr {
	margin: 0;
}

/* page displayed footer area */
#footer {
	font-size: 9px;
	padding-left: 10px;
}


body
:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }
:lang(he) { direction: rtl; }
 --></style>
</head><body id=ERR_CACHE_ACCESS_DENIED>
<div id="titles">
<h1>ERROR</h1>
<h2>Cache Access Denied.</h2>
</div>
<hr>

<div id="content">
<p>The following error was encountered while trying to retrieve the URL: <a href="http://ya.ru/";>http://ya.ru/</a></p>

<blockquote id="error">
<p><b>Cache Access Denied.</b></p>
</blockquote>

<p>Sorry, you are not currently allowed to request http://ya.ru/ from this cache until you have authenticated yourself.</p>

<p>Please contact the <a href="mailto:noc@xxxxxxxxxx?subject=CacheErrorInfo%20-%20ERR_CACHE_ACCESS_DENIED&amp;body=CacheHost%3A%20proxy.sibptus.transneft.ru%0D%0AErrPage%3A%20ERR_CACHE_ACCESS_DENIED%0D%0AErr%3A%20%5Bnone%5D%0D%0ATimeStamp%3A%20Sat,%2018%20Oct%202014%2011%3A56%3A09%20GMT%0D%0A%0D%0AClientIP%3A%2010.14.140.125%0D%0A%0D%0AHTTP%20Request%3A%0D%0AGET%20%2F%20HTTP%2F1.0%0AHost%3A%20ya.ru%0D%0AUser-Agent%3A%20squidclient%2F3.4.8%0D%0AAccept%3A%20*%2F*%0D%0AProxy-Authorization%3A%20Negotiate%20YIIGDQYGKwYBBQUCoIIGATCCBf2gDTALBgkqhkiG9xIBAgKiggXqBIIF5mCCBeIGCSqGSIb3EgECAgEAboIF0TCCBc2gAwIBBaEDAgEOogcDBQAAAAAAo4IEtGGCBLAwggSsoAMCAQWhFhsUU0lCUFRVUy5UUkFOU05FRlQuUlWiLTAroAMCAQGhJDAiGwRIVFRQGxpwcm94eS5zaWJwdHVzLnRyYW5zbmVmdC5ydaOCBFwwggRYoAMCAReiggRPBIIES8Tjx9IM4sRh+fXqnEEslV%2FwXuEqv1o5fA9k9QYfpd1Wwhll7ZDKEsDrGPKp57ylsm7X9l5ODhONBlkGwd24vngmmlgQ3Frxn8csh2+QgxeQZqhiV2QgdT%2FMVU3Khjae4jklS%2FF5yFxdd4DO0UrqRu7iaXLsgRf4h%2F4p%2FkxkTlQAtn+u5H8Nm50M670pdHU5s5GWAIKFY+v%2Foq6k8OdmU%2FCOaXn5qkU2UtTPj51i24%2FVi8aI7qb+KnvpmEOktMZ%2F+lhbjerZut6jQYXX7rZ6K%2FuBAGbI8wBLPjymv8yyd9bE3THTOuykcI+l%2FlEi3uyPP9ievHYnvlT9c1TSvuTRCJOFpRZ2WM1MPifu7GJ6RYkReHoyhQC+uCXcOaWsCn22uWBYNvVsUWCFEPAkId40k5y7w6IThtoDLC6+3NYtWJgl+LhXbiRNMl25H+4nDyNhm8eg2XC46WPJQ%2F4ljBfD%2FGoAJz6I2hWD+5Pvc1zGQQcS1w9vTXuDoWqkDeCQKFhfIWASY7H9w0v1IePRbGx+o8FJZuVtTU%2F8DKDJJ0x3FVxaMjKwrZk08jsDtxFpk+pdWOH9li+WPjXG5d1TL9tntrt6gsnl89i4hjuCfIL3hpfLN%2F%2FQE41e+pbVGgyEOQk06mYetn6juKStlslQSPk8wXMr2J40Avmgzv9fFSZ5IdH9uyFbau0Q6Hf4Y6BVNKkT8qDxVjmakCDz8xl93k6HLcDUdt98Connection%3A%20close%0D%0A%0D%0A%0D%0A";>cache administrator</a> if you have difficulties authenticating yourself.</p>

<br>
</div>

<hr> 
<div id="footer">
<p>Generated Sat, 18 Oct 2014 11:56:09 GMT by proxy.sibptus.transneft.ru (squid/3.4.8)</p>
<!-- ERR_CACHE_ACCESS_DENIED -->
</div>
</body></html>
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users

[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux