Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Host header set improperly. We should validate against HTTP proxy RFC(s).
Steps to Reproduce:
- yum install subscription-manager squid httpd mod_ssl
- make apache return HTTP 403:
echo $'<Location />\nDeny from all\n</Location>\n' > /etc/httpd/conf.d/welcome.conf
- configure subscription-manager to use this setup instead of RHN
# subscription-manager config --server.hostname=127.0.0.99
# subscription-manager config --server.proxy_hostname=127.0.0.11
# subscription-manager config --server.proxy_port=3128
# subscription-manager config --server.insecure=1
- watch it fail
# subscription-manager register --user foo --password bar
Registering to: 127.0.0.99:443/subscription
Forbidden: Invalid credentials for request.
- further details can be analyzed with the following hack:
by adding 'print data' to /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Connection.py:221
we can intercept the unencrypted HTTP traffic:
GET /subscription/users/foo/owners HTTP/1.1
Host: 127.0.0.11:3128
Accept-Encoding: identity
Content-Length: 0
Accept-Language: en-us
x-subscription-manager-version: 1.17.15-1.el7.centos
x-python-rhsm-version: 1.17.9-1.el7
Accept: application/json
User-Agent: RHSM/1.0 (cmd=subscription-manager)
Content-type: application/json
Authorization: Basic Zm9vOmJhcg==
This shows that the request contains a Host: header with the proxy's name/address.
At this place, the hostname of the target address is (127.0.0.99 ) is
supposed to show up.
Description of problem: Host header set improperly. We should validate against HTTP proxy RFC(s). Steps to Reproduce: - yum install subscription-manager squid httpd mod_ssl - make apache return HTTP 403: echo $'<Location />\nDeny from all\n</Location>\n' > /etc/httpd/conf.d/welcome.conf - configure subscription-manager to use this setup instead of RHN # subscription-manager config --server.hostname=127.0.0.99 # subscription-manager config --server.proxy_hostname=127.0.0.11 # subscription-manager config --server.proxy_port=3128 # subscription-manager config --server.insecure=1 - watch it fail # subscription-manager register --user foo --password bar Registering to: 127.0.0.99:443/subscription Forbidden: Invalid credentials for request. - further details can be analyzed with the following hack: by adding 'print data' to /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Connection.py:221 we can intercept the unencrypted HTTP traffic: GET /subscription/users/foo/owners HTTP/1.1 Host: 127.0.0.11:3128 Accept-Encoding: identity Content-Length: 0 Accept-Language: en-us x-subscription-manager-version: 1.17.15-1.el7.centos x-python-rhsm-version: 1.17.9-1.el7 Accept: application/json User-Agent: RHSM/1.0 (cmd=subscription-manager) Content-type: application/json Authorization: Basic Zm9vOmJhcg== This shows that the request contains a Host: header with the proxy's name/address. At this place, the hostname of the target address is (127.0.0.99 ) is supposed to show up.