romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 23:03:42 +03:00
Code Issues Projects Releases Packages Wiki Activity

url: fix handling of empty user in ntml matching

Browse source 
Line should already have been removed in 7103a93, but neither
humans nor clankers caught it. tststs...

Prior to this change it appears all reuse of empty cred connection was
blocked for ntlm instead of the intended behavior of allowing
reuse in the limited circumstance when it is the same connection used by
the transfer before.

Closes https://github.com/curl/curl/pull/22629
This commit is contained in:
Stefan Eissing 2026-08-20 12:39:59 +02:00 • committed by Jay Satiro
parent f31251b645
commit aab0518d04
1 changed files with 2 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/url.c
View file

@ -925,18 +925,12 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
{
if(conn->http_ntlm_state != NTLMSTATE_NONE) {
/* Connection is using NTLM. We cannot reuse if transfer
* has different Auth input parameters.
* Empty user: Negotiate on Windows can make use of an "ambient"
* user from a "SecurityToken" associated with the current thread or
* process. This token can be switched at any time. We are therefore
* not able to find out reliably what token the connection really
* used, nor what token in the next connect attempt will use.
* To avoid TOCTOU attacks, do not reuse on empty credentials. */
* has different Auth input parameters. */
if(!m->want_ntlm_http ||
!Curl_creds_has_user(conn->creds) ||
!Curl_creds_same(conn->creds, m->data->state.creds) ||
!Curl_peer_equal(conn->creds_origin, m->data->state.origin))
return FALSE;
/* Empty credentials need more careful matching for WINDOWS_SSPI */
if(!url_allow_sspi_empty_creds(conn->creds, m->data, conn))
return FALSE;
}