Date: Tue, 31 Mar 2020 17:20:15 -0600 From: Gary Aitken <freebsd@dreamchaser.org> To: Norman Gray <norman.gray@glasgow.ac.uk> Cc: FreeBSD Mailing List <freebsd-questions@freebsd.org> Subject: Re: weird 403 (forbidden) website access issue Message-ID: <1f345a1d-f0c8-688c-c3e5-3a6b09ff1fa9@dreamchaser.org> In-Reply-To: <B11EF1EF-FF36-4DD9-9996-2643B177CDA7@glasgow.ac.uk> References: <ba457b4a-3362-d9e0-4b8a-c6204937819d@dreamchaser.org> <B11EF1EF-FF36-4DD9-9996-2643B177CDA7@glasgow.ac.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
On 3/31/20 3:12 PM, Norman Gray wrote: > > Gary, greetings. Thanks for helping, Norman. > On 31 Mar 2020, at 21:33, Gary Aitken wrote: > >> The addr (www.ovandoschool.org) resolves to 69.175.87.226 >> >> If I type in 69.175.87.226 in the address bar, I get a 403 error >> with a note 69.175.87.226/cp_errordocument.shtml (port 80) Seems to >> be accessible fine from windows machines going through the same >> fbsd 11.3-RELEASE-P6 gateway (not the same system as the one with >> the browser having the problem). >> >> If I manually access from the failing fbsd system, it works: >> >> $ telnet 69.175.87.226 80 Trying 69.175.87.226... Connected to >> chi-node42.websitehostserver.net. Escape character is '^]'. GET / >> HTTP/1.1 Host: www.ovandoschool.org > > If you type the IP address in to the address bar, then the browser > will either send that as the 'Host' request header, or won't send the > header at all. Thus the server, presuming it's set up to serve > multiple hosts, won't know which website to send back. Makes sense. > An alternative route to the same conclusion is that HTTP 1.1 requires > the 'Host' request header, so if it's missing (or possibly if it's an > IP address, or if it's not one of the hosts the server has been > configured to handle), then... error document. > > If this works with any browser, then it _might_ be that the browser > is being clever, doing a reverse lookup of the IP address, and > sending the result as the 'Host' request header. In that case, a bit > of tcpdump will clarify. A reverse dns shows chi-node42.websitehostserver.net. so that obviously would be a problem. > Apologies if this is obvious, but if this isn't the problem, you > might need to elaborate. So the actual problem is the errors show up when the website url is entered: http://www.ovandoschool.org/ I was using the IP to try to simplify the problem, but obviously that won't work in this case. Since the site displays on windows machines when using the proper url, but not on the fbsd machine, it feels like something messed up in my fbsd environment. A tcpdump from the gateway for a successful (windows) access shows: IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [S], seq 983728199, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], lengt h 0 IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [S.], seq 4210427857, ack 983728200, win 29200, options [mss 1400,nop,nop,sackOK,no p,wscale 7], length 0 IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [.], ack 1, win 16450, length 0 IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [P.], seq 1:375, ack 1, win 16450, length 374: HTTP: GET / HTTP/1.1 IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [.], ack 375, win 237, length 0 IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [.], seq 1:1401, ack 375, win 237, length 1400: HTTP: HTTP/1.1 200 OK IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [.], seq 1401:2801, ack 375, win 237, length 1400: HTTP IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [P.], seq 2801:2850, ack 375, win 237, length 49: HTTP IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [P.], seq 2850:3109, ack 375, win 237, length 259: HTTP IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [P.], seq 3109:3114, ack 375, win 237, length 5: HTTP IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [.], ack 3114, win 16450, length 0 IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [P.], seq 375:814, ack 3114, win 16450, length 439: HTTP: GET /wp-content/themes/tw entythirteen/fonts/genericons.css?ver=2.09 HTTP/1.1 On the machine that fails, the tcpdump on the gateway shows: IP 66.109.141.62.12350 > 69.175.87.226.80: Flags [S], seq 1576349922, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 336582 5370 ecr 0], length 0 IP 69.175.87.226.80 > 66.109.141.62.12350: Flags [S.], seq 4093820683, ack 1576349923, win 28960, options [mss 1400,sackOK,TS val 25 42931075 ecr 3365825370,nop,wscale 7], length 0 IP 66.109.141.62.12350 > 69.175.87.226.80: Flags [.], ack 1, win 1028, options [nop,nop,TS val 3365825433 ecr 2542931075], length 0 IP 66.109.141.62.12350 > 69.175.87.226.80: Flags [P.], seq 1:341, ack 1, win 1028, options [nop,nop,TS val 3365825523 ecr 2542931075 ], length 340: HTTP: GET / HTTP/1.1 IP 69.175.87.226.80 > 66.109.141.62.12350: Flags [.], ack 341, win 235, options [nop,nop,TS val 2542931231 ecr 3365825523], length 0 IP 69.175.87.226.80 > 66.109.141.62.12350: Flags [P.], seq 1:1048, ack 341, win 235, options [nop,nop,TS val 2542931232 ecr 33658255 23], length 1047: HTTP: HTTP/1.1 403 Forbidden IP 66.109.141.62.12350 > 69.175.87.226.80: Flags [.], ack 1048, win 1028, options [nop,nop,TS val 3365825697 ecr 2542931232], length 0 On the machine actually making the request, a tcpdump shows: 192.168.151.122.24498 > 69.175.87.226.80: Flags [S], cksum 0xf5e2 (incorrect -> 0x059c), seq 3235489561, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 683891704 ecr 0], length 0 192.168.151.122.21254 > 69.175.87.226.80: Flags [S], cksum 0xf5e2 (incorrect -> 0x13bb), seq 2862645472, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 4284596312 ecr 0], length 0 69.175.87.226.80 > 192.168.151.122.24498: Flags [S.], cksum 0x8738 (correct), seq 30361359, ack 3235489562, win 28960, options [mss 1400,sackOK,TS val 2544446693 ecr 683891704,nop,wscale 7], length 0 192.168.151.122.24498 > 69.175.87.226.80: Flags [.], cksum 0xf5da (incorrect -> 0x21cf), ack 1, win 1028, options [nop,nop,TS val 683891982 ecr 2544446693], length 0 192.168.151.122.24498 > 69.175.87.226.80: Flags [P.], cksum 0xf748 (incorrect -> 0x172f), seq 1:367, ack 1, win 1028, options [nop,nop,TS val 683891982 ecr 2544446693], length 366: HTTP, length: 366 GET / HTTP/1.1 Host: www.ovandoschool.org User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:74.0) Gecko/20100101 Firefox/74.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 69.175.87.226.80 > 192.168.151.122.21254: Flags [S.], cksum 0x9745 (correct), seq 1337325334, ack 2862645473, win 28960, options [mss 1400,sackOK,TS val 2544446729 ecr 4284596312,nop,wscale 7], length 0 192.168.151.122.21254 > 69.175.87.226.80: Flags [.], cksum 0xf5da (incorrect -> 0x32b4), ack 1, win 1028, options [nop,nop,TS val 4284596374 ecr 2544446729], length 0 69.175.87.226.80 > 192.168.151.122.24498: Flags [.], cksum 0x2337 (correct), ack 367, win 235, options [nop,nop,TS val 2544446760 ecr 683891982], length 0 69.175.87.226.80 > 192.168.151.122.24498: Flags [P.], cksum 0xcf9c (correct), seq 1:1048, ack 367, win 235, options [nop,nop,TS val 2544446760 ecr 683891982], length 1047: HTTP, length: 1047 HTTP/1.1 403 Forbidden Connection: Keep-Alive Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Pragma: no-cache Content-Type: text/html Content-Length: 698 Date: Tue, 31 Mar 2020 22:47:03 GMT Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff <!DOCTYPE html> <html style="height:100%"> <head> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" > <title> 403 Forbidden </title></head> <body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"> <div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">403</h1> <h2 style="margin-top:20px;font-size: 30px;">Forbidden </h2> <p>Access to this resource on the server is denied!</p> </div></div></body></html> I'm out of my depth here... (Aside: What's with the incorrect checksum flags?) Comparing the gateway dumps, the difference is in the first four lines. I've interlaced them below, with the lines from the successful request first: IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [S], seq 983728199, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0 IP 66.109.141.62.12350 > 69.175.87.226.80: Flags [S], seq 1576349922, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 3365825370 ecr 0], length 0 IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [S.], seq 4210427857, ack 983728200, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0 IP 69.175.87.226.80 > 66.109.141.62.12350: Flags [S.], seq 4093820683, ack 1576349923, win 28960, options [mss 1400,sackOK,TS val 2542931075 ecr 3365825370,nop,wscale 7], length 0 IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [.], ack 1, win 16450, length 0 IP 66.109.141.62.12350 > 69.175.87.226.80: Flags [.], ack 1, win 1028, options [nop,nop,TS val 3365825433 ecr 2542931075], length 0 IP 66.109.141.60.55271 > 69.175.87.226.80: Flags [P.], seq 1:375, ack 1, win 16450, length 374: HTTP: GET / HTTP/1.1 IP 66.109.141.62.12350 > 69.175.87.226.80: Flags [P.], seq 1:341, ack 1, win 1028, options [nop,nop,TS val 3365825523 ecr 2542931075], length 340: HTTP: GET / HTTP/1.1 IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [.], ack 375, win 237, length 0 IP 69.175.87.226.80 > 66.109.141.62.12350: Flags [.], ack 341, win 235, options [nop,nop,TS val 2542931231 ecr 3365825523], length 0 IP 69.175.87.226.80 > 66.109.141.60.55271: Flags [.], seq 1:1401, ack 375, win 237, length 1400: HTTP: HTTP/1.1 200 OK IP 69.175.87.226.80 > 66.109.141.62.12350: Flags [P.], seq 1:1048, ack 341, win 235, options [nop,nop,TS val 2542931232 ecr 3365825523], length 1047: HTTP: HTTP/1.1 403 Forbidden Thoughts? Thanks, Gary
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1f345a1d-f0c8-688c-c3e5-3a6b09ff1fa9>