mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-11-21 01:16:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

http: Fix proxy connection reuse with basic-auth

Browse Source 
When using basic-auth, connections and proxy connections
can be re-used with different Authorization headers since
it does not authenticate the connection (like NTLM does).

For instance, the below command should re-use the proxy
connection, but it currently doesn't:
curl -v -U alice:a -x http://localhost:8181 http://localhost/
  --next -U bob:b -x http://localhost:8181 http://localhost/

This is a regression since refactoring of ConnectionExists()
as part of: cb4e2be7c6

Fix the above by removing the username and password compare
when re-using proxy connection at proxy_info_matches().

However, this fix brings back another bug would make curl
to re-print the old proxy-authorization header of previous
proxy basic-auth connection because it wasn't cleared.

For instance, in the below command the second request should
fail if the proxy requires authentication, but would succeed
after the above fix (and before aforementioned commit):
curl -v -U alice:a -x http://localhost:8181 http://localhost/
  --next -x http://localhost:8181 http://localhost/

Fix this by clearing conn->allocptr.proxyuserpwd after use
unconditionally, same as we do for conn->allocptr.userpwd.

Also fix test 540 to not expect digest auth header to be
resent when connection is reused.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

Closes https://github.com/curl/curl/pull/1350
This commit is contained in:
Isaac Boukris 2017-03-23 21:28:28 +02:00 committed by Jay Satiro
parent b04e4ebdd8
commit 7975d10cf8
3 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lib/http.c
View File

@ -2312,20 +2312,10 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
te
);
/* clear userpwd to avoid re-using credentials from re-used connections */
/* clear userpwd and proxyuserpwd to avoid re-using old credentials
* from re-used connections */
Curl_safefree(conn->allocptr.userpwd);
/*
* Free proxyuserpwd for Negotiate/NTLM. Cannot reuse as it is associated
* with the connection and shouldn't be repeated over it either.
*/
switch(data->state.authproxy.picked) {
case CURLAUTH_NEGOTIATE:
case CURLAUTH_NTLM:
case CURLAUTH_NTLM_WB:
Curl_safefree(conn->allocptr.proxyuserpwd);
break;
}
Curl_safefree(conn->allocptr.proxyuserpwd);
if(result)
return result;

4
lib/url.c
View File

@ -3277,9 +3277,7 @@ proxy_info_matches(const struct proxy_info* data,
{
if((data->proxytype == needle->proxytype) &&
(data->port == needle->port) &&
Curl_safe_strcasecompare(data->host.name, needle->host.name) &&
Curl_safe_strcasecompare(data->user, needle->user) &&
Curl_safe_strcasecompare(data->passwd, needle->passwd))
Curl_safe_strcasecompare(data->host.name, needle->host.name))
return TRUE;
return FALSE;

13
tests/data/test540
View File

@ -11,6 +11,9 @@ multi
# Server-side
<reply>
<servercmd>
connection-monitor
</servercmd>
# this is returned first since we get no proxy-auth
<data>
@ -40,6 +43,10 @@ Content-Length: 21
Server: no
Nice proxy auth sir!
HTTP/1.1 407 Authorization Required to proxy me my dear
Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
Content-Length: 33
HTTP/1.1 200 OK
Content-Length: 21
Server: no
@ -86,12 +93,18 @@ Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345"
Accept: */*
Proxy-Connection: Keep-Alive
GET http://test.remote.example.com/path/540 HTTP/1.1
Host: custom.set.host.name
Accept: */*
Proxy-Connection: Keep-Alive
GET http://test.remote.example.com/path/540 HTTP/1.1
Host: custom.set.host.name
Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/540", response="ca507dcf189196b6a5374d3233042261"
Accept: */*
Proxy-Connection: Keep-Alive
[DISCONNECT]
</protocol>
</verify>
</testcase>