Re: Updated: setup (2.880)

[Brian Inglis <Brian.Inglis@SystematicSw.ab.ca>]

On 2017-06-27 14:55, Nellis, Kenneth wrote:
> From: Csaba Raduly 
>> I also couldn't reproduce your scenario.
>> ...
>> Since it's reproducible for you, you could (if you're curious) run
>> wget with the -d (--debug) switch or break out the heavy artillery:
>> install Wireshark and look at the HTTP headers sent and received by
>> wget.
> Thanx, Csaba, for your interest. Another test with -d is easy enough,
> so here it is:
> $ wget -d -O setup-x86_64.exe http://cygwin.com/setup-x86_64.exe
...
> ---request begin---
> GET /setup-x86_64.exe HTTP/1.1
> User-Agent: Wget/1.19.1 (cygwin)
> Accept: */*
> Accept-Encoding: identity
> Host: cygwin.com
> Connection: Keep-Alive
> ---request end---
> HTTP request sent, awaiting response...
> ---response begin---
> HTTP/1.1 200 OK
> Server: Apache
> ETag: "16b1f9e-dd613-55161a558184f"
> Accept-Ranges: bytes
> Cache-Control: max-age=0
> Expires: Tue, 27 Jun 2017 20:40:06 GMT
> Vary: Accept-Encoding
> Content-Encoding: gzip
> Content-Security-Policy: default-src 'self' http: https:
> Keep-Alive: timeout=30, max=20
> Content-Length: 877562
> Content-Type: application/octet-stream
> Last-Modified: Wed, 07 Jun 2017 16:58:31 GMT
> Date: Tue, 27 Jun 2017 20:39:27 GMT
> Age: 0
> Via: 1.1 ironport.tms.local:80 (Cisco-WSA/10.1.0-204)
> Connection: keep-alive
> ---response end---
...
> $ file *.exe
> setup-x86_64.exe: gzip compressed data, from Unix
> $
> Note the response from the Apache server:
>> Content-Encoding: gzip
> Not sure why it would do that. Maybe my wget could be more specific.
> But my updated script (per advice from others) is working fine.

Try:
$ rm -f setup-x86_64.exe
$ wget -d -N -nv --no-cache --no-http-keep-alive --no-proxy \
	https://cygwin.com/setup-x86_64.exe
and see if it can bypass the effects of the appliance, or get it to
respond as requested, but it may download and cache gzipped content
that pass its scans, and serve them as is, ignoring client content
negotiation. Not encouraging when a security product web site states
in its Features [emphasis added]:
"*When* compromise occurs, quickly determine the scope of the damage,
remediate it, and bring operations back to normal."

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple