GC/SDC and Proxy Server Woes....

from Stardock Forums
GC and SDC both appear to still have problems with non-socks proxy servers.

1. They are unable to read the proxy exceptions. Adding *.stardock.com to my domain policy for proxy exceptions, or even manually adding it when running as a local or domain admin has no effect.

2. When running through squid as a authenticating proxy server, SDC is unable to read the IE proxy settings at all. I have to specify the SDC proxy authentication info in the SDC settings tab. This creates a problem since our Domain Policy and logon scripts enforce the users logon username in the IE proxy settings. Our proxy server verifies the logged in username against the username being passed to the proxy server. If they don't match it doesn't go. Because SDC doesn't read the IE proxy settings properly it will only allow me to play GalCiv on my workstations, not either of my sons - unless I manually go in and set up the SDC proxy info each time they log on.

3. Even if SDC is set up with manually specified username/password settings and works through the proxy server correctly, GC still does not if we are running a non-socks proxy server. It is unable to submit to metaverse unless I clear the IE proxy server entirely - AND clear all SDC proxy server info whether or not the proxy server is set to require auth or not.

I've testing with multiple proxy server configurations, including require auth, no auth, fake auth (accept any username/pw combo), socks, non-socks (HTTP only proxy). It works fine with a bridging proxy/content filter (such as a SonicWall or Lightspeed content filter), but not one such as Squid, NetNanny, SurfWatch. I have not tested CyberPatrol as I have a difference of opinion regarding both their privacy policy and ethical issues with their refusal to release their blacklist.

I can easily set up a Squid http based proxy server for remote testing by SDC if desired. (Bandwidth should be adequate for testing purposes as I have a server colocated on a 100 MB multi-homed ethernet connection).

If you wish further info let me know and I will assist however possible. I can provide traffic dumps of the data stream during submission if desired - as long as you promise the test submissions won't mess up my metaverse score!!! :D
249 views 4 replies
Reply #1 from Stardock Forums Top
.bump.
Reply #2 from Stardock Forums Top
Sedennial
Remember SDC said that most firewalls etc.. would cause problems.
Also, proxies substitute ip addresses(and names) when repackaging the encapsulated packet.By doing this the original game machines identification is stripped and substituted with the proxies info.the proxy doesn't have galciv loaded and SDC can't(won't)interpret this correctly.Have you opened the correct ports and tried to submit straight thru without the use of the proxy?If I remember you can adjust IE5 and above to bypass proxies.
Fences - Organize your desktop icons today!
Reply #3 from Stardock Forums Top
Firewall is not an issue. What you have said is correct as far as layer three transparent proxy with SNAT/NAT/PAT. However an HTTP proxy server does not perform packet rewriting. SDC works correctly if the correct username/pw is supplied in the SDC config. The whole point of a content filter and web proxy server is to BLOCK outbound HTTP requests unless they pass through the content filter. The problem is that SDC and GC do not appear to be protocol compliant for HTTP proxy servers which only support HTTP basic authentication (i.e. non-socks based proxy filters). HTTP Basic authentication is spelled out in RFC 2617 and has not changed since 1999. SDC and GC should be able to pull the username/password from the IE settings and use HTTP Basic Auth to authenticate with ANY proxy server.

I think you are operating under an incorrect assumption regarding the game machine identification. The serial number is contained in the IP packet payload, and not in the TCP headers. The packet headers can be rewritten in any manner desired (as long as they remain protocol compliant) without affecting serial number/game machine identification. Otherwise broadband users would not be able to submit/upload since most are running behind DSL or Cable modem routers which runs PAT/NAT to perform transparent NAT services. HTTP proxy servers and/or content filters should not do layer 2/4 rewrites. If they do they are not truly proxy servers but become layer 2 bridges with layer 4 redirects. If SDC and GC are supposed to only support SOCKS 4/5 proxy servers and layer 2 bridging proxy devices (even software based ones) they are going to run into problems. I can find several medium to larger ISPs (10000-50000 users) that offer proxied content filtering for parental control, and of these at least half run a service that uses HTTP Basic Auth for proxy authentication - not SOCKS or MS Extended proxy negotiation.
[Message Edited]
Reply #4 from Stardock Forums Top
By the way - I LIKE SDC! It is an effective distribution platform for patching, and I appreciate all the effort has gone into it's production. I very much enjoy the fact that it only updates needed files, and that so much work has gone into minimizing download times.

Outside of one time early on, SDC has never been or caused any major problems, and I have had only minor issues (like the above).

:)