curl enters busy loop when POSTing HTTP/2 to IBM Cloud using digest auth

[OlekMazur]

I did this

I did the same query as in #11194 and #11485, and found a regression in 8.3.0 compared to 8.2.1.
This time it's neither timeout nor connection reset but busy loop after getting 401.
Full output:

} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [19 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [4006 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
> POST /api/v1/<my_secret_api_endpoint> HTTP/2
> Host: eu-gb.functions.appdomain.cloud
> User-Agent: curl/8.3.0
> Accept: */*
> Content-Type: text/csv
> Content-Length: 13
> 
} [13 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [57 bytes data]
< HTTP/2 401 
< date: Tue, 19 Sep 2023 20:40:58 GMT
< content-length: 0
< x-request-id: XXX
< access-control-allow-origin: *
< access-control-allow-methods: OPTIONS, GET, DELETE, POST, PUT, HEAD, PATCH
< access-control-allow-headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, User-Agent
< x-openwhisk-activation-id: XXX

... and curl process starts hogging CPU seemingly endlessly.

I expected the following

No response

curl/libcurl version

curl 8.3.0 (x86_64-pc-linux-gnu) libcurl/8.3.0 OpenSSL/3.0.9 zlib/1.2.13 brotli/1.0.9 zstd/1.5.5 nghttp2/1.52.0
Release-Date: 2023-09-13
Protocols: http https imap imaps smtp smtps
Features: AsynchDNS brotli HTTP2 HTTPS-proxy Largefile libz SSL threadsafe zstd

operating system

Linux 6.4.13-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Aug 30 17:07:31 UTC 2023 x86_64 GNU/Linux

[OlekMazur]

Curl enters the busy loop inside Curl_http_input_auth() within while(*auth) { ... }.
The regression seems to be caused by commit e92edfb.
Newly added #ifndefs may throw away the code which was previously right after "else" in lib/http.c:1111 (in case only digest auth is enabled).
This causes the code which jumps over next comma (line 1145) to be compiled under "else" from line 1111, what was surely not intended. Therefore the loop never moves the "auth" pointer further.
To confirm that, I added empty statement "{ }" as a possible workaround between last #endif and "while" (before line 1144) and it fixed the problem.
So the problem isn't related to HTTP/2 but to --disable-bearer-auth; disabling bearer auth leaves unwanted "else" right before the code which advances the loop further.
Strictly speaking, since --disable-bearer-auth is an option introduced in 8.3.0, maybe I shouldn't call this a regression...

[bagder]

@OlekMazur after reading the code again I can only agree with you. I made #11895 as an attempted fix. It would be great if you can just double-check that I got it right.

[OlekMazur]

I confirm that the fix works for me.