AUTH_FILE option uses incorrect line ending in HTTP request

[Matt Summers]

Background:

Using the AUTH_FILE option reads the provided file and uses it to add the "Proxy-Authorization" header to the request made to the proxy.

corkscrew.c:231
        if ((argc == 6) || (argc == 7)) {
                strncat(uri, "\nProxy-Authorization: Basic ", sizeof(uri) - strlen(uri) - 1);
                strncat(uri, base64_encode(up), sizeof(uri) - strlen(uri) - 1);
        }

This uses an invalid newline for an HTTP request. \n is used, should be \r\n.

What happens:

When used with apache as a forward proxy, for example, this causes a 400 error to be returned from the server. Using nc and crafting a request to use \r\n instead, this works.

What I expect to happen:

The proxy request takes place.

Environment:

Description: Ubuntu 16.04.2 LTS
Release: 16.04

ii corkscrew 2.0-10 amd64 tunnel TCP connections through HTTP proxies

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Serge (sdolgikh21)]

I can confirm this bug, using apache as a forward proxy too and getting 400 error. Manual patching this line eliminated the problem.

[Launchpad Janitor (janitor)]

This bug was fixed in the package corkscrew - 2.0-13

---------------
corkscrew (2.0-13) unstable; urgency=medium

  * debian/patches:
    - Refresh patches.
    - Add patch 05 to handle AUTH_FILE option using incorrect line
      ending in HTTP request (LP: #1697507).
  * Add lintian-overrides to silence patch-not-forwarded-upstream
    warning.

 -- Roger Shimizu <email address hidden> Sun, 27 Dec 2020 22:38:51 +0900