PuTTY semi-bug msproxy-denied

summary: Connections through MS Proxy Server (HTTP) are spuriously denied
class: semi-bug: This might or might not be a bug, depending on your precise definition of what a bug is.
difficulty: fun: Just needs tuits, and not many of them.
priority: medium: This should be fixed one day.
present-in: 0.53b 2002-12-30
fixed-in: 2003-03-19 (0.54) (0.55) (0.56) (0.57) (0.58) (0.59) (0.60) (0.61) (0.62)

Original report (<007801c2b108$5ad5a200$33db8ad8@alexin.ca>):


I believe I have found a bug in Win32 putty .53b. (found in Win2000,

also tested current dev binary).  I am connection to a NetBSD server 1.6

running OpenSSH 3.4 on port 443, but had the same problem on an OpenBSD

server with OpenSSH 3.4.



I am connecting through an authenticated Microsoft Proxy server v2 on

Windows 2000, using HTTP proxy services.





Using Putty, the connection conversation is: 



 CONNECT 216.138.219.54:443 HTTP/1.1

 Host: 216.138.219.54:443

 Proxy-Authorization: basic YW1leeljYXNcc3RldmVfYmFya2V5OmluZXNzMTA=



 HTTP/1.1 407 Proxy Access Denied

 Server: Microsoft-IIS/5.0

 Date: Tue, 31 Dec 2002 19:32:43 GMT

 Connection: close

 Proxy-Authenticate: Negotiate

 Proxy-Authenticate: NTLM

 Proxy-Authenticate: Basic realm="53.244.73.245"



And the connection fails with putty event log: 

"2002-12-31 14:48:08    Connecting to 216.138.219.54 port 443

2002-12-31 14:48:08     Proxy error: 407 Proxy Access Denied"





Using MindTerm 2.0 (an inferior java ssh client), the connection

conversation is:



 CONNECT 216.138.219.54:443 HTTP/1.0

 proxy-connection: Keep-Alive

 pragma: No-Cache

 user-agent: MindTerm/$Name:  $



 HTTP/1.1 407 Proxy Access Denied

 Server: Microsoft-IIS/5.0

 Date: Tue, 31 Dec 2002 19:33:05 GMT

 Proxy-Authenticate: Negotiate

 Proxy-Authenticate: NTLM

 Proxy-Authenticate: Basic realm="53.244.73.245"



----------- and then -----------



 CONNECT 216.138.219.54:443 HTTP/1.0

 proxy-authorization: Basic YW1leeljYXNcc3RldmVfYmFya2V5OmluZXNzMTA=



 proxy-connection: Keep-Alive

 pragma: No-Cache user-agent: MindTerm/$Name:  $



 HTTP/1.1  200 Connection established

 Via: 1.1 YYZXPROXY01



 SSH-1.99-OpenSSH_3.4 NetBSD_Secure_Shell-20020626

 SSH-2.0-MindTerm_2.0 2.0 (non-commercial)

 

... encrypted, successful connection ....

Another user has experimented with this, and concluded that the problem is that the proxy insists that the authentication scheme be "Basic" rather than "basic". RFC 2617 states that the scheme token is case-insensitive, but in the interests of being conservative in what we send, PuTTY should probably use "Basic".

This bug should be fixed as of proxy.c rev 1.27.

Audit trail for this semi-bug.

If you want to comment on this web site, see the Feedback page.
(last revision of this bug record was at 2004-11-16 15:27:00 +0000)