Subject: No data access for one site WWWW

From: [email-masked]
Date: Wed, 16 May 2001 10:29:22 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

I use FWTK 2.1 with http-gw. I don't have any problem, but
I don't have access on the site http://www.credit-du-nord.fr/
I don't understand why.

The other site http://www.bnp.fr/ has the same architectural network
security, I have 
access at the site, no problem.

Can you make a test with your configuration ? thanks a lot.

My configuration for http-gw in my netperm-table :
--------------------------------------------------
[...]
http-gw:        permit-hosts option -java -javascript -activex
http-gw:        permit-hosts 10.10.10.3
http-gw:        deny-hosts unknown
http-gw:        deny-hosts *
http-gw:        default-policy -java -javascript -activex
http-gw:        policy -java -javascript -activex
[...]

---

From: Tony Gale <[email-masked]>
Date: 17 May 2001 12:09:30 +0100

> I don't have access on the site http://www.credit-du-nord.fr/

They are running a broken version of IIS 4.0. The attached patch will
work around the problem. Apply on top of the jumbo patch on
www.fwtk.org.

-tony

Only in fwtk.dist/fwtk: Makefile.config
Only in fwtk.patched/fwtk/http-gw: auth.c.rej
Only in fwtk.patched/fwtk/http-gw: ftp.c.rej
diff -ur fwtk.dist/fwtk/http-gw/hmain.c fwtk.patched/fwtk/http-gw/hmain.c
--- fwtk.dist/fwtk/http-gw/hmain.c	Wed Dec 20 14:58:07 2000
+++ fwtk.patched/fwtk/http-gw/hmain.c	Wed Dec 20 14:53:29 2000
@@ -942,24 +942,35 @@
  char	*s;
  int	n;
  {
-	char *buff;
+	/* Attempt to write the message in one packet
+	* Failing that, try and make sure it all gets sent
+         * TRG - 20001220
+         */
+ 	char *buff, *buffptr;
  	int retval;
-
-	/* Attempt to send message in one packet
-	* Some FTP servers don't like split messages
-	* TRG - 20001114
-	*/
-	if ( (buff = malloc(n+2)) == NULL) {
+ 	int length;
+ 
+ 	if ( (buff = malloc(n+2)) == NULL) {
  		if(net_write(fd,s,n) != n)
  			return(1);
  		return(net_write(fd,"\r\n",2) != 2);
  	}
-	memcpy(buff, s, n);
-	buff[n]='\r';
-	buff[n+1]='\n';
-	retval = net_write(fd,buff,n+2);
-	free(buff);
-	return(retval);
+ 	memcpy(buff, s, n);
+ 	buff[n]='\r';
+ 	buff[n+1]='\n';
+ 	length = n+2;
+ 	buffptr = buff;
+ 	while (length > 0) {
+ 		retval = net_write(fd,buffptr,length);
+ 		if (retval > 0) {
+ 			length -= retval;
+ 			buffptr += retval;
+ 		} else {
+ 			break;
+ 		}
+ 	}
+ 	free(buff);
+ 	return(retval);
  }

Only in fwtk.patched/fwtk/http-gw: hmain.c.orig
Only in fwtk.patched/fwtk/http-gw: hmain.c.rej
diff -ur fwtk.dist/fwtk/http-gw/http-gw.c fwtk.patched/fwtk/http-gw/http-gw.c
--- fwtk.dist/fwtk/http-gw/http-gw.c	Wed Dec 20 14:58:07 2000
+++ fwtk.patched/fwtk/http-gw/http-gw.c	Wed Dec 20 16:13:49 2000
@@ -568,7 +568,7 @@
  	if( (rem_type & TYPE_HTTP) ){
  		int hlen = 0;
  		if( http_protocol[0] != '\0'){
- 			copy_http_headers( -1, sockfd, 0, &hlen, G_NOPERM);
+ 			copy_http_headers( NULL, -1, sockfd, 0, &hlen, G_NOPERM);
  		}
  	}
  	if( rem_type & TYPE_FTP){
@@ -1178,8 +1178,7 @@
  	}else{
  		sprintf(go_request,"%s%s", http_method, buf);
  	}
-	if( rfd != -1)say(rfd, go_request);
-
+  
  frominternal:
  	if( http_protocol[0]){	/* Was there http protocol info? */
  		int hlen = 0;
@@ -1187,7 +1186,7 @@
  
  		if( (permissions & G_PLUS) == 0)
  			rfd = -1;
- 		if( copy_http_headers(rfd, sockfd, (rem_type&TYPE_WRITE), &hlen, G_NOPERM) &&
+ 		if( copy_http_headers(go_request, rfd, sockfd, (rem_type&TYPE_WRITE), &hlen, G_NOPERM) &&
  			(rem_type&TYPE_WRITE)){
  			rfd = rsaved;
  			trans_html_file(rfd, sockfd, "http", hlen);
@@ -1198,12 +1197,15 @@
  			return 0;
  		}
  		rfd = rsaved;
+	} else {
+		if( rfd != -1)
+			say(rfd, go_request);
  	}
-
+    
  /* Get possible response line (maybe an old server)*/
  	if( get_http_response(sockfd, rfd)){
  
-		if( copy_http_headers(sockfd, rfd, 1, NULL, logging)){
+		if( copy_http_headers(NULL, sockfd, rfd, 1, NULL, logging)){
  			trans_html_file(sockfd, rfd, "http", -1);
  		}
  	}else if( rem_type & TYPE_HEAD){
@@ -1230,7 +1232,16 @@
  	return 0;
  }
  
-int copy_http_headers(sockfd, rfd,expect_data, lptr, logging)
+/* copy_http_headers buffers its output in an attempt to workaround
+ * some broken web servers that can't handle receiving requests that are
+ * split over multiple packets
+ * TRG - 20001220
+ */
+
+#define REQ_BUFF_LEN (MAX_URL_LEN*2) /* SECURITY: Must be bigger than MAX_URL_LEN */
+
+int copy_http_headers(request, sockfd, rfd,expect_data, lptr, logging)
+char *request;
  int sockfd, rfd;
  int expect_data, *lptr, logging;
  {	int len, cnt;
@@ -1238,12 +1249,26 @@
  	int n;
  	static char content_len[80];
  	static char content_type[513];
+	static char request_buff[REQ_BUFF_LEN];
+	int request_buff_len;
  	int	tmpX;
  	char	*tmpP;
  
+	request_buff_len = 0;
+	if ( request && (strlen(request) > REQ_BUFF_LEN-3)) {
+		goto broken;
+	}
+  
+	if (request) {
+                request_buff_len = strlen(request);
+		strncpy(request_buff, request, request_buff_len);
+		strncpy(request_buff+request_buff_len, "\r\n", 2);
+		request_buff_len += 2;
+	}
+  
  	content_len[0] = '\0';
  	content_type[0]= '\0';
-
+  
  	if( lptr)
  		*lptr = 0;
  
@@ -1263,7 +1288,15 @@
  		}else if( checkBrowserType &&
  		      !strncasecmp(go_request, "user-agent:", 11) ) {
  			if( sockfd != -1){
-				say(sockfd, go_request);
+				if ((strlen(go_request)+request_buff_len+2) > REQ_BUFF_LEN-1) {
+					request_buff[request_buff_len-2] = '\0';
+					say(sockfd, request_buff);
+					request_buff_len = 0;
+				}
+				strncpy(request_buff+request_buff_len, go_request, strlen(go_request));
+				request_buff_len += strlen(go_request);
+				strncpy(request_buff+request_buff_len, "\r\n", 2);
+				request_buff_len += 2;
  			}
  			if (nojava == 2)
  			    for (tmpX=0;
@@ -1287,7 +1320,15 @@
  			cpystr(content_type, go_request, 512);
  			content_type[511] = '\0';
  			if( sockfd != -1){
-				say(sockfd, go_request);
+				if ((strlen(go_request)+request_buff_len+2) > REQ_BUFF_LEN-1) {
+					request_buff[request_buff_len-2] = '\0';
+					say(sockfd, request_buff);
+					request_buff_len = 0;
+				}
+				strncpy(request_buff+request_buff_len, go_request, strlen(go_request));
+				request_buff_len += strlen(go_request);
+				strncpy(request_buff+request_buff_len, "\r\n", 2);
+				request_buff_len += 2;
  			}
  			if( logging & G_CONTYPE){
  				syslog(LLEV,"content-type=%.512s", &go_request[13]);
@@ -1299,11 +1340,27 @@
  			if( dont_touch(p) == 0){
  				sprintf(errbuf, "Location: http://%s:%u/%s", ourname, ourport, p);
  				if( sockfd != -1){
-					say(sockfd, errbuf) ;
+					if ((strlen(errbuf)+request_buff_len+2) > REQ_BUFF_LEN-1) {
+						request_buff[request_buff_len-2] = '\0';
+						say(sockfd, request_buff);
+						request_buff_len = 0;
+					}
+					strncpy(request_buff+request_buff_len, errbuf, strlen(errbuf));
+					request_buff_len += strlen(errbuf);
+					strncpy(request_buff+request_buff_len, "\r\n", 2);
+					request_buff_len += 2;
  				}
  			}else{
  				if( sockfd != -1){
-                                	say(sockfd, go_request) ;
+					if ((strlen(go_request)+request_buff_len+2) > REQ_BUFF_LEN-1) {
+						request_buff[request_buff_len-2] = '\0';
+						say(sockfd, request_buff);
+						request_buff_len = 0;
+					}
+					strncpy(request_buff+request_buff_len, go_request, strlen(go_request));
+					request_buff_len += strlen(go_request);
+					strncpy(request_buff+request_buff_len, "\r\n", 2);
+					request_buff_len += 2;
  				}
  			}
  		}else if( !strncasecmp(go_request, "connection:", 11)){
@@ -1312,7 +1369,15 @@
  			continue;
  		}else {
  			if( sockfd != -1){
-                                 say(sockfd, go_request) ;
+				if ((strlen(go_request)+request_buff_len+2) > REQ_BUFF_LEN-1) {
+					request_buff[request_buff_len-2] = '\0';
+					say(sockfd, request_buff);
+					request_buff_len = 0;
+				}
+				strncpy(request_buff+request_buff_len, go_request, strlen(go_request));
+				request_buff_len += strlen(go_request);
+				strncpy(request_buff+request_buff_len, "\r\n", 2);
+				request_buff_len += 2;
  			}
  		}
  	}
@@ -1342,11 +1407,20 @@
  /* not an html file? so just block copy */
  		if( content_len[0]){
  			if( sockfd != -1){
-                                 say(sockfd,content_len) ;
+				if ((strlen(content_len)+request_buff_len+2) > REQ_BUFF_LEN-1) {
+					request_buff[request_buff_len-2] = '\0';
+					say(sockfd, request_buff);
+					request_buff_len = 0;
+				}
+				strncpy(request_buff+request_buff_len, content_len, strlen(content_len));
+				request_buff_len += strlen(content_len);
+				strncpy(request_buff+request_buff_len, "\r\n", 2);
+				request_buff_len += 2;
  			}
  		}
  		if( sockfd != -1){
-                         say(sockfd,"") ;
+			request_buff[request_buff_len] = '\0';
+			say(sockfd, request_buff);
  		}
  
  		if(expect_data && (rem_type & TYPE_HEAD)==0){
@@ -1384,11 +1458,20 @@
  ishtml:
  	if( lptr){	/* its a POST so need content-length: */
  		if(content_len[0] && sockfd != -1){
-			say(sockfd, content_len) ;
+				if ((strlen(content_len)+request_buff_len+2) > REQ_BUFF_LEN-1) {
+					request_buff[request_buff_len-2] = '\0';
+					say(sockfd, request_buff);
+					request_buff_len = 0;
+				}
+				strncpy(request_buff+request_buff_len, content_len, strlen(content_len));
+				request_buff_len += strlen(content_len);
+				strncpy(request_buff+request_buff_len, "\r\n", 2);
+				request_buff_len += 2;
  		}
  	}
  	if( sockfd != -1){
-		say(sockfd,"") ;
+		request_buff[request_buff_len] = '\0';
+		say(sockfd, request_buff);
  	}
  	if( rem_type & TYPE_HEAD){
  		return 0;	/* flag as done */

---

From: [email-masked]
Date: Thu, 17 May 2001 17:05:59 +0200

Thanks a lot for your patch, the problem is finish.

Tony Gale wrote:
 >   ------------------------------------------------------------------------
 >                            Name: fwtk-broken-web.diff
 >    fwtk-broken-web.diff    Type: text/x-patch
 >                        Encoding: 7bit

---

From: [email-masked]
Date: Thu, 17 May 2001 17:05:59 +0200