Reverse mode anomaly?

Andrew J. Richardson <[email protected]> Tue, 04 Nov 2003 11:13:10 -0500
Newsgroups gmane.comp.security.zebedee.general
Message-ID <[email protected]>
I'm using ZBD in reverse mode, with the server on a private ip network behind a NAT http proxy server. ZBD server attempts to make a connection to a client running out on the Internet and enters a recursive error condition.

The behavior begins after ZBD receives an "HTTP/1.0 200 Connection established" reply message from the proxy server. Here's a snippet from the log:

zebedee(1248/1272): connected to proxy
zebedee(1248/1272): written connect string
zebedee(1248/1272): read 39 bytes from proxy: HTTP/1.0 200 Connection estab
lished

zebedee(1248/1272): connection via proxy successful
zebedee(1248/1272): connected to client
zebedee(1248/1272): spawning handler function thread
zebedee(1248/1272): handler thread created
zebedee(1248/1272): initiating connection back to client at xxx.dyndns.
org:10255
zebedee(1248/1272): connecting to xxx.dyndns.org:10255 via proxy yyy:8080
zebedee(1248/1740): server routine entered
zebedee(1248/1740): validating client IP address
zebedee(1248/1740): peer address from connection is 10.32.14.6
zebedee(1248/1740): reading protocol version
zebedee(1248/1740): readData: receiving 2 of 2
zebedee(1248/1740): readData: EOF or error
zebedee(1248/1740): ERROR: failed reading protocol v
ersion
zebedee(1248/1272): socket 692 is usable
zebedee(1248/1272): connected to proxy
zebedee(1248/1272): written connect string
zebedee(1248/1272): read 39 bytes from proxy: HTTP/1.0 200 Connection estab
lished

zebedee(1248/1272): connection via proxy successful
zebedee(1248/1272): connected to client
zebedee(1248/1272): spawning handler function thread
zebedee(1248/1272): handler thread created
zebedee(1248/1272): initiating connection back to client at xxx.dyndns.
org:10255
zebedee(1248/1272): connecting to xxx.dyndns.org:10255 via proxy yyy:8080
zebedee(1248/1740): server routine entered
zebedee(1248/1740): validating client IP address
zebedee(1248/1740): peer address from connection is 10.32.14.6
zebedee(1248/1740): reading protocol version
zebedee(1248/1740): readData: receiving 2 of 2
zebedee(1248/1740): readData: EOF or error
zebedee(1248/1740): ERROR: failed reading protocol v
ersion
zebedee(1248/1272): socket 696 is usable
zebedee(1248/1272): connected to proxy
zebedee(1248/1272): written connect string
zebedee(1248/1272): read 39 bytes from proxy: HTTP/1.0 200 Connection estab
lished

I've edited out the actual domain names for security.

This behavior continues until the process is terminated. In the above example, the client was NOT running at the other end, although this behavior occurs either way. It appears that the ZBD server is confused and believes the proxy server to be ZBD client, and tries gathering the protocol version from it. If the client is, in fact, running and accepts the connection, ZBD server forks another thread and this recursive behavior continues on that thread. No timeouts seem to apply and this just runs and runs.

I've read the doc thoroughly and can achieve a stable connection to my machine, but this process won't shut down on it's own if I'm not at home allowing a connection.

Has anyone else seen this behavior?

Andrew

-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/