From aab0518d04599627368ab78b1f8713683098b435 Mon Sep 17 00:00:00 2001 From: Stefan Eissing Date: Thu, 20 Aug 2026 12:39:59 +0200 Subject: [PATCH] url: fix handling of empty user in ntml matching Line should already have been removed in 7103a93, but neither humans nor clankers caught it. tststs... Prior to this change it appears all reuse of empty cred connection was blocked for ntlm instead of the intended behavior of allowing reuse in the limited circumstance when it is the same connection used by the transfer before. Closes https://github.com/curl/curl/pull/22629 --- lib/url.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/lib/url.c b/lib/url.c index 3b81bf0067..0b2d414526 100644 --- a/lib/url.c +++ b/lib/url.c @@ -925,18 +925,12 @@ static bool url_match_auth_ntlm(struct connectdata *conn, { if(conn->http_ntlm_state != NTLMSTATE_NONE) { /* Connection is using NTLM. We cannot reuse if transfer - * has different Auth input parameters. - * Empty user: Negotiate on Windows can make use of an "ambient" - * user from a "SecurityToken" associated with the current thread or - * process. This token can be switched at any time. We are therefore - * not able to find out reliably what token the connection really - * used, nor what token in the next connect attempt will use. - * To avoid TOCTOU attacks, do not reuse on empty credentials. */ + * has different Auth input parameters. */ if(!m->want_ntlm_http || - !Curl_creds_has_user(conn->creds) || !Curl_creds_same(conn->creds, m->data->state.creds) || !Curl_peer_equal(conn->creds_origin, m->data->state.origin)) return FALSE; + /* Empty credentials need more careful matching for WINDOWS_SSPI */ if(!url_allow_sspi_empty_creds(conn->creds, m->data, conn)) return FALSE; }