romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-03 01:20:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

url: fix reuse of connections using HTTP Negotiate

Browse source 
Assume Negotiate means connection-based

Reported-by: Zhicheng Chen
This commit is contained in:
Daniel Stenberg 2026-02-05 08:34:21 +01:00
parent c6ac2de5b3
commit 8ad8422c4b
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 71 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

76
lib/url.c
View file

@ -764,6 +764,8 @@ struct url_conn_match {
BIT(may_multiplex);
BIT(want_ntlm_http);
BIT(want_proxy_ntlm_http);
BIT(want_nego_http);
BIT(want_proxy_nego_http);
BIT(wait_pipe);
BIT(force_reuse);
@ -1185,6 +1187,54 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
#define url_match_auth_ntlm(c, m) ((void)c, (void)m, TRUE)
#endif
#ifdef USE_SPNEGO
static bool url_match_auth_nego(struct connectdata *conn,
struct url_conn_match *m)
{
/* If we are looking for an HTTP+Negotiate connection, check if this is
already authenticating with the right credentials. If not, keep looking
so that we can reuse Negotiate connections if possible. */
if(m->want_nego_http) {
if(Curl_timestrcmp(m->needle->user, conn->user) ||
Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
/* we prefer a credential match, but this is at least a connection that
can be reused and "upgraded" to Negotiate */
if(conn->http_negotiate_state == GSS_AUTHNONE)
m->found = conn;
return FALSE;
}
}
else if(conn->http_negotiate_state != GSS_AUTHNONE) {
/* Connection is using Negotiate auth but we do not want Negotiate */
return FALSE;
}
#ifndef CURL_DISABLE_PROXY
/* Same for Proxy Negotiate authentication */
if(m->want_proxy_nego_http) {
/* Both conn->http_proxy.user and conn->http_proxy.passwd can be
* NULL */
if(!conn->http_proxy.user || !conn->http_proxy.passwd)
return FALSE;
if(Curl_timestrcmp(m->needle->http_proxy.user,
conn->http_proxy.user) ||
Curl_timestrcmp(m->needle->http_proxy.passwd,
conn->http_proxy.passwd))
return FALSE;
}
else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
/* Proxy connection is using Negotiate auth but we do not want Negotiate */
return FALSE;
}
#endif
return TRUE;
}
#else
#define url_match_auth_nego(c, m) ((void)c, (void)m, TRUE)
#endif
static bool url_match_conn(struct connectdata *conn, void *userdata)
{
struct url_conn_match *m = userdata;
@ -1228,6 +1278,9 @@ static bool url_match_conn(struct connectdata *conn, void *userdata)
else if(m->force_reuse)
return TRUE;
if(!url_match_auth_nego(conn, m))
return FALSE;
if(!url_match_multiplex_limits(conn, m))
return FALSE;
@ -1290,13 +1343,26 @@ static bool url_attach_existing(struct Curl_easy *data,
match.may_multiplex = xfer_may_multiplex(data, needle);
#ifdef USE_NTLM
match.want_ntlm_http = ((data->state.authhost.want & CURLAUTH_NTLM) &&
(needle->scheme->protocol & PROTO_FAMILY_HTTP));
match.want_ntlm_http =
(data->state.authhost.want & CURLAUTH_NTLM) &&
(needle->scheme->protocol & PROTO_FAMILY_HTTP);
#ifndef CURL_DISABLE_PROXY
match.want_proxy_ntlm_http =
(needle->bits.proxy_user_passwd &&
(data->state.authproxy.want & CURLAUTH_NTLM) &&
(needle->scheme->protocol & PROTO_FAMILY_HTTP));
needle->bits.proxy_user_passwd &&
(data->state.authproxy.want & CURLAUTH_NTLM) &&
(needle->scheme->protocol & PROTO_FAMILY_HTTP);
#endif
#endif
#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
match.want_nego_http =
(data->state.authhost.want & CURLAUTH_NEGOTIATE) &&
(needle->scheme->protocol & PROTO_FAMILY_HTTP);
#ifndef CURL_DISABLE_PROXY
match.want_proxy_nego_http =
needle->bits.proxy_user_passwd &&
(data->state.authproxy.want & CURLAUTH_NEGOTIATE) &&
(needle->scheme->protocol & PROTO_FAMILY_HTTP);
#endif
#endif