RE: Reverse mode anomaly?

"Neil Winton" <neil.winton-XZoyATsUNX5Wk0Htik3J/[email protected]> Fri, 21 Nov 2003 21:51:19 -0000
Newsgroups gmane.comp.security.zebedee.general
Message-ID <[email protected]>
Hi,

Before going further, I think you need to understand what happens when the
server runs in reverse mode. Essentially it continually attempts to connect
back to the client (well, controlled by "connectattempts" as of 2.5.2).
Every time it gets a successful connection it tries to open another
"speculative" connection to handle the next client request. So, if you
connect back via a proxy, the server can see this as "successful" and
immediately try another connection ... which could also be successful. I say
"can" and "could" because this is the case if the proxy server in question
gives a "connection established" message even if it *hasn't* really managed
to connect back to the client. This seems to be the case with your server,
but it's not necessarily the case with all servers.

To be honest, I'm not sure that I can see a solution for this at the moment.
Perhaps I could put in some code that only created the next "speculative"
connection once a previous one was *really* found to be connected to a
client (and the protocol exchange had started). I'll have to think carefully
about this, but in the meantime, I'm sorry but I'm not sure there's too much
you can do.  You can slow down the reconnects with the serverconnecttimeout
value, but that will come at a price of not being able to establish a tunnel
very quickly.

    Regards,
        Neil
  -----Original Message-----
  From: zebedee-talk-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
[mailto:zebedee-talk-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org]On Behalf Of Andrew J.
Richardson
  Sent: 04 November 2003 16:13
  To: [email protected]
  Subject: [Zebedee-talk] Reverse mode anomaly?


  I'm using ZBD in reverse mode, with the server on a private ip network
behind a NAT http proxy server.  ZBD server attempts to make a connection to
a client running out on the Internet and enters a recursive error condition.

  The behavior begins after ZBD receives an "HTTP/1.0 200 Connection
established" reply message from the proxy server.  Here's a snippet from the
log:

  zebedee(1248/1272):      connected to proxy
  zebedee(1248/1272):      written connect string
  zebedee(1248/1272):      read 39 bytes from proxy: HTTP/1.0 200 Connection
estab
  lished


  zebedee(1248/1272):     connection via proxy successful
  zebedee(1248/1272):   connected to client
  zebedee(1248/1272):     spawning handler function thread
  zebedee(1248/1272):     handler thread created
  zebedee(1248/1272):   initiating connection back to client at xxx.dyndns.
  org:10255
  zebedee(1248/1272):     connecting to xxx.dyndns.org:10255 via proxy
yyy:8080
  zebedee(1248/1740):    server routine entered
  zebedee(1248/1740):    validating client IP address
  zebedee(1248/1740):     peer address from connection is 10.32.14.6
  zebedee(1248/1740):    reading protocol version
  zebedee(1248/1740):      readData: receiving 2 of 2
  zebedee(1248/1740):      readData: EOF or error
  zebedee(1248/1740): ERROR: failed reading protocol version
  zebedee(1248/1272):     socket 692 is usable
  zebedee(1248/1272):      connected to proxy
  zebedee(1248/1272):      written connect string
  zebedee(1248/1272):      read 39 bytes from proxy: HTTP/1.0 200 Connection
estab
  lished


  zebedee(1248/1272):     connection via proxy successful
  zebedee(1248/1272):   connected to client
  zebedee(1248/1272):     spawning handler function thread
  zebedee(1248/1272):     handler thread created
  zebedee(1248/1272):   initiating connection back to client at xxx.dyndns.
  org:10255
  zebedee(1248/1272):     connecting to xxx.dyndns.org:10255 via proxy
yyy:8080
  zebedee(1248/1740):    server routine entered
  zebedee(1248/1740):    validating client IP address
  zebedee(1248/1740):     peer address from connection is 10.32.14.6
  zebedee(1248/1740):    reading protocol version
  zebedee(1248/1740):      readData: receiving 2 of 2
  zebedee(1248/1740):      readData: EOF or error
  zebedee(1248/1740): ERROR: failed reading protocol version
  zebedee(1248/1272):     socket 696 is usable
  zebedee(1248/1272):      connected to proxy
  zebedee(1248/1272):      written connect string
  zebedee(1248/1272):      read 39 bytes from proxy: HTTP/1.0 200 Connection
estab
  lished

  I've edited out the actual domain names for security.

  This behavior continues until the process is terminated.  In the above
example, the client was NOT running at the other end, although this behavior
occurs either way.  It appears that the ZBD server is confused and believes
the proxy server to be ZBD client, and tries gathering the protocol version
from it.  If the client is, in fact, running and accepts the connection, ZBD
server forks another thread and this recursive behavior continues on that
thread.  No timeouts seem to apply and this just runs and runs.

  I've read the doc thoroughly and can achieve a stable connection to my
machine, but this process won't shut down on it's own if I'm not at home
allowing a connection.

  Has anyone else seen this behavior?

  Andrew


  ------------------------------------------------------- This SF.net email
is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be
more productive? Does it help you create better code? SHARE THE LOVE, and
help us help YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________ Zebedee-talk mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/zebedee-talk