Skip to content

Commit

Permalink
url: extract and store username + password in the easy handle
Browse files Browse the repository at this point in the history
When a username and password are provided in the URL, they were not
correctly stored and remembered in the easy handle, only for the
connection, so when doing HTTP auth that uses multiple connections (like
Digest) curl mishaved.

Regression from 46e1640 (7.62.0)

Test case 335 added to verify.

Reported-by: Mike Crowe

Fixes #4228
  • Loading branch information
bagder committed Aug 15, 2019
1 parent a8ac1be commit ddce169
Show file tree
Hide file tree
Showing 3 changed files with 108 additions and 1 deletion.
6 changes: 6 additions & 0 deletions lib/url.c
Expand Up @@ -1986,6 +1986,9 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
if(!conn->user)
return CURLE_OUT_OF_MEMORY;
conn->bits.user_passwd = TRUE;
result = Curl_setstropt(&data->set.str[STRING_USERNAME], conn->user);
if(result)
return result;
}
else if(uc != CURLUE_NO_USER)
return Curl_uc_to_curlcode(uc);
Expand All @@ -1997,6 +2000,9 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
if(!conn->passwd)
return CURLE_OUT_OF_MEMORY;
conn->bits.user_passwd = TRUE;
result = Curl_setstropt(&data->set.str[STRING_PASSWORD], conn->passwd);
if(result)
return result;
}
else if(uc != CURLUE_NO_PASSWORD)
return Curl_uc_to_curlcode(uc);
Expand Down
2 changes: 1 addition & 1 deletion tests/data/Makefile.inc
Expand Up @@ -57,7 +57,7 @@ test298 test299 test300 test301 test302 test303 test304 test305 test306 \
test307 test308 test309 test310 test311 test312 test313 test314 test315 \
test316 test317 test318 test319 test320 test321 test322 test323 test324 \
test325 test326 test327 test328 test329 test330 test331 test332 test333 \
test334 \
test334 test335 \
test340 \
\
test350 test351 test352 test353 test354 test355 test356 \
Expand Down
101 changes: 101 additions & 0 deletions tests/data/test335
@@ -0,0 +1,101 @@
<testcase>
<info>
<keywords>
HTTP
HTTP GET
HTTP proxy
HTTP proxy Digest auth
HTTP Digest auth
HTTP auth in URL
</keywords>
</info>

# Server-side
<reply>

# this is returned first since we get no proxy-auth
<data>
HTTP/1.1 407 Authorization Required to proxy me my dear swsclose
Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"

And you should ignore this data.
</data>

# then this is returned since we get no server-auth
<data1000>
HTTP/1.1 401 Authorization to the remote host as well swsbounce swsclose
WWW-Authenticate: Digest realm="realmweirdo", nonce="123456"

you should ignore this data too
</data1000>

<data1001>
HTTP/1.1 200 OK swsclose
Server: no
Content-Length: 15

Nice auth sir!
</data1001>

<datacheck>
HTTP/1.1 407 Authorization Required to proxy me my dear swsclose
Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"

HTTP/1.1 401 Authorization to the remote host as well swsbounce swsclose
WWW-Authenticate: Digest realm="realmweirdo", nonce="123456"

HTTP/1.1 200 OK swsclose
Server: no
Content-Length: 15

Nice auth sir!
</datacheck>
</reply>

# Client-side
<client>
<server>
http
</server>
<features>
!SSPI
crypto
</features>
<name>
HTTP with proxy-requiring-Digest to site-requiring-Digest
</name>
<command>
http://digest:alot@data.from.server.requiring.digest.hohoho.com/335 --proxy http://%HOSTIP:%HTTPPORT --proxy-user foo:bar --proxy-digest --digest
</command>
</client>

# Verify data after the test has been "shot"
<verify>
<strip>
^User-Agent: curl/.*
</strip>
<protocol>
GET http://data.from.server.requiring.digest.hohoho.com/335 HTTP/1.1
Host: data.from.server.requiring.digest.hohoho.com
User-Agent: curl/7.12.0-CVS (i686-pc-linux-gnu) libcurl/7.12.0-CVS OpenSSL/0.9.6b zlib/1.1.4 c-ares/1.2.0 libidn/0.4.3
Accept: */*
Proxy-Connection: Keep-Alive

GET http://data.from.server.requiring.digest.hohoho.com/335 HTTP/1.1
Host: data.from.server.requiring.digest.hohoho.com
Proxy-Authorization: Digest username="foo", realm="weirdorealm", nonce="12345", uri="/335", response="f61609cd8f5bb205ef4e169b2c5626cb"
User-Agent: curl/7.12.0-CVS (i686-pc-linux-gnu) libcurl/7.12.0-CVS OpenSSL/0.9.6b zlib/1.1.4 c-ares/1.2.0 libidn/0.4.3
Accept: */*
Proxy-Connection: Keep-Alive

GET http://data.from.server.requiring.digest.hohoho.com/335 HTTP/1.1
Host: data.from.server.requiring.digest.hohoho.com
Proxy-Authorization: Digest username="foo", realm="weirdorealm", nonce="12345", uri="/335", response="f61609cd8f5bb205ef4e169b2c5626cb"
Authorization: Digest username="digest", realm="realmweirdo", nonce="123456", uri="/335", response="08a2e2e684047f4219a38ddc189ac00c"
User-Agent: curl/7.12.0-CVS (i686-pc-linux-gnu) libcurl/7.12.0-CVS OpenSSL/0.9.6b ipv6 zlib/1.1.4 GSS libidn/0.4.3
Accept: */*
Proxy-Connection: Keep-Alive

</protocol>
</verify>
</testcase>

0 comments on commit ddce169

Please sign in to comment.