summaryrefslogtreecommitdiffstats
path: root/curl-7.15.5-bz657396.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2012-06-24 18:59:40 +0200
committerRemi Collet <fedora@famillecollet.com>2012-06-24 18:59:40 +0200
commit46c63d5553c4f2d54b30679b6bfd22893fbb05f6 (patch)
treeae6557a386696721dbbf8991bd21958051083173 /curl-7.15.5-bz657396.patch
parent5f92f6832f1ee6d21ba25a5cb5c2d180f91a0ea5 (diff)
compat-libcurl3-7.15.5-2, sync with curl-7.15.5-15
Diffstat (limited to 'curl-7.15.5-bz657396.patch')
-rw-r--r--curl-7.15.5-bz657396.patch465
1 files changed, 465 insertions, 0 deletions
diff --git a/curl-7.15.5-bz657396.patch b/curl-7.15.5-bz657396.patch
new file mode 100644
index 0000000..8abba2c
--- /dev/null
+++ b/curl-7.15.5-bz657396.patch
@@ -0,0 +1,465 @@
+From 795a6b48946f22d4562e6ad859306ac62eb3f6a0 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 3 Nov 2006 12:43:55 +0000
+Subject: [PATCH 1/4] Olaf Stueben provided a patch that I edited slightly. It
+ fixes the notorious KNOWN_BUGS #25, which happens when
+ a proxy closes the connection when libcurl has sent
+ CONNECT, as part of an authentication negotiation.
+ Starting now, libcurl will re-connect accordingly and
+ continue the authentication as it should.
+
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ lib/http.c | 15 +++++++++++++++
+ lib/url.c | 54 +++++++++++++++++++++++++++++++++---------------------
+ lib/urldata.h | 3 +++
+ 3 files changed, 51 insertions(+), 21 deletions(-)
+
+diff --git a/lib/http.c b/lib/http.c
+index 0fd0cbe..4d39a98 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1095,6 +1095,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
+ curl_socket_t tunnelsocket = conn->sock[sockindex];
+ send_buffer *req_buffer;
+ curl_off_t cl=0;
++ bool closeConnection = FALSE;
+
+ #define SELECT_OK 0
+ #define SELECT_ERROR 1
+@@ -1102,6 +1103,7 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
+ int error = SELECT_OK;
+
+ infof(data, "Establish HTTP proxy tunnel to %s:%d\n", hostname, remote_port);
++ conn->bits.proxy_connect_closed = FALSE;
+
+ do {
+ if(conn->newurl) {
+@@ -1295,6 +1297,9 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
+ cl = curlx_strtoofft(line_start + strlen("Content-Length:"),
+ NULL, 10);
+ }
++ else if(Curl_compareheader(line_start,
++ "Connection:", "close"))
++ closeConnection = TRUE;
+ else if(2 == sscanf(line_start, "HTTP/1.%d %d",
+ &subversion,
+ &k->httpcode)) {
+@@ -1321,11 +1326,21 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
+ headers. 'newurl' is set to a new URL if we must loop. */
+ Curl_http_auth_act(conn);
+
++ if (closeConnection && conn->newurl) {
++ /* Connection closed by server. Don't use it anymore */
++ sclose(conn->sock[sockindex]);
++ conn->sock[sockindex] = CURL_SOCKET_BAD;
++ break;
++ }
+ } while(conn->newurl);
+
+ if(200 != k->httpcode) {
+ failf(data, "Received HTTP code %d from proxy after CONNECT",
+ k->httpcode);
++
++ if (closeConnection && conn->newurl)
++ conn->bits.proxy_connect_closed = TRUE;
++
+ return CURLE_RECV_ERROR;
+ }
+
+diff --git a/lib/url.c b/lib/url.c
+index 1a0c206..bf4a3dd 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -2484,7 +2484,8 @@ CURLcode Curl_protocol_connect(struct connectdata *conn, bool *protocol_done)
+
+ /* it has started, possibly even completed but that knowledge isn't stored
+ in this bit! */
+- conn->bits.protoconnstart = TRUE;
++ if (!result)
++ conn->bits.protoconnstart = TRUE;
+ }
+
+ return result; /* pass back status */
+@@ -3981,30 +3982,41 @@ static CURLcode SetupConnection(struct connectdata *conn,
+ data->state.crlf_conversions = 0; /* reset CRLF conversion counter */
+ #endif /* CURL_DO_LINEEND_CONV */
+
+- if(CURL_SOCKET_BAD == conn->sock[FIRSTSOCKET]) {
+- bool connected = FALSE;
++ for(;;) {
++ /* loop for CURL_SERVER_CLOSED_CONNECTION */
+
+- /* Connect only if not already connected! */
+- result = ConnectPlease(conn, hostaddr, &connected);
++ if(CURL_SOCKET_BAD == conn->sock[FIRSTSOCKET]) {
++ bool connected = FALSE;
+
+- if(connected) {
+- result = Curl_protocol_connect(conn, protocol_done);
+- if(CURLE_OK == result)
+- conn->bits.tcpconnect = TRUE;
+- }
+- else
+- conn->bits.tcpconnect = FALSE;
++ /* Connect only if not already connected! */
++ result = ConnectPlease(conn, hostaddr, &connected);
+
++ if(connected) {
++ result = Curl_protocol_connect(conn, protocol_done);
++ if(CURLE_OK == result)
++ conn->bits.tcpconnect = TRUE;
++ }
++ else
++ conn->bits.tcpconnect = FALSE;
+
+- if(CURLE_OK != result)
+- return result;
+- }
+- else {
+- Curl_pgrsTime(data, TIMER_CONNECT); /* we're connected already */
+- conn->bits.tcpconnect = TRUE;
+- *protocol_done = TRUE;
+- if(data->set.verbose)
+- verboseconnect(conn);
++ /* if the connection was closed by the server while exchanging
++ authentication informations, retry with the new set
++ authentication information */
++ if(conn->bits.proxy_connect_closed)
++ continue;
++
++ if(CURLE_OK != result)
++ return result;
++ }
++ else {
++ Curl_pgrsTime(data, TIMER_CONNECT); /* we're connected already */
++ conn->bits.tcpconnect = TRUE;
++ *protocol_done = TRUE;
++ if(data->set.verbose)
++ verboseconnect(conn);
++ }
++ /* Stop the loop now */
++ break;
+ }
+
+ conn->now = Curl_tvnow(); /* time this *after* the connect is done, we
+diff --git a/lib/urldata.h b/lib/urldata.h
+index d092113..3ac8fbf 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -454,6 +454,9 @@ struct ConnectBits {
+ when Curl_done() is called, to prevent Curl_done() to
+ get invoked twice when the multi interface is
+ used. */
++ bool proxy_connect_closed; /* set true if a proxy disconnected the
++ connection in a CONNECT request with auth, so
++ that libcurl should reconnect and continue. */
+ };
+
+ struct hostname {
+--
+1.7.4.4
+
+
+From e3c76c19fd8d61f41b4025c4f085413dd9935e28 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 10 Jul 2007 22:31:13 +0000
+Subject: [PATCH 2/4] Giancarlo Formicuccia reported and fixed a problem with
+ a closed connection to a proxy during CONNECT auth
+ negotiation.
+
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ lib/http.c | 3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/lib/http.c b/lib/http.c
+index 4d39a98..6481fa0 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1300,6 +1300,9 @@ CURLcode Curl_proxyCONNECT(struct connectdata *conn,
+ else if(Curl_compareheader(line_start,
+ "Connection:", "close"))
+ closeConnection = TRUE;
++ else if(Curl_compareheader(line_start,
++ "Proxy-Connection:", "close"))
++ closeConnection = TRUE;
+ else if(2 == sscanf(line_start, "HTTP/1.%d %d",
+ &subversion,
+ &k->httpcode)) {
+--
+1.7.4.4
+
+
+From c1bfdb84733e58b11dce10eb2c99bf4c1f5c8806 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 21 Sep 2007 11:05:31 +0000
+Subject: [PATCH 3/4] Mark Davies fixed Negotiate authentication over proxy,
+ and also introduced the --proxy-negotiate command line
+ option to allow a user to explicitly select it.
+
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ docs/curl.1 | 11 +++++++++++
+ lib/http.c | 16 ++++++++++++++--
+ lib/http_negotiate.c | 14 +++++++-------
+ lib/http_negotiate.h | 4 ++--
+ src/main.c | 11 +++++++++++
+ 5 files changed, 45 insertions(+), 11 deletions(-)
+
+diff --git a/docs/curl.1 b/docs/curl.1
+index e62be55..2658954 100644
+--- a/docs/curl.1
++++ b/docs/curl.1
+@@ -688,6 +688,9 @@ meant as a support for Kerberos5 authentication but may be also used along
+ with another authentication methods. For more information see IETF draft
+ draft-brezak-spnego-http-04.txt.
+
++If you want to enable Negotiate for your proxy authentication, then use
++\fI--proxy-negotiate\fP.
++
+ This option requires that the library was built with GSSAPI support. This is
+ not very common. Use \fI-V/--version\fP to see if your version supports
+ GSS-Negotiate.
+@@ -768,6 +771,14 @@ Tells curl to use HTTP Digest authentication when communicating with the given
+ proxy. Use \fI--digest\fP for enabling HTTP Digest with a remote host.
+
+ If this option is used twice, the second will again disable proxy HTTP Digest.
++.IP "--proxy-negotiate"
++Tells curl to use HTTP Negotiate authentication when communicating
++with the given proxy. Use \fI--negotiate\fP for enabling HTTP Negotiate
++with a remote host.
++
++If this option is used twice, the second will again disable proxy HTTP
++Negotiate.
++
+ .IP "--proxy-ntlm"
+ Tells curl to use HTTP NTLM authentication when communicating with the given
+ proxy. Use \fI--ntlm\fP for enabling NTLM with a remote host.
+diff --git a/lib/http.c b/lib/http.c
+index 6481fa0..033ee9b 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -416,6 +416,18 @@ Curl_http_output_auth(struct connectdata *conn,
+ /* Send proxy authentication header if needed */
+ if (conn->bits.httpproxy &&
+ (conn->bits.tunnel_proxy == proxytunnel)) {
++#ifdef HAVE_GSSAPI
++ if((authproxy->picked == CURLAUTH_GSSNEGOTIATE) &&
++ data->state.negotiate.context &&
++ !GSS_ERROR(data->state.negotiate.status)) {
++ auth="GSS-Negotiate";
++ result = Curl_output_negotiate(conn, TRUE);
++ if (result)
++ return result;
++ authproxy->done = TRUE;
++ }
++ else
++#endif
+ #ifdef USE_NTLM
+ if(authproxy->picked == CURLAUTH_NTLM) {
+ auth=(char *)"NTLM";
+@@ -478,7 +490,7 @@ Curl_http_output_auth(struct connectdata *conn,
+ data->state.negotiate.context &&
+ !GSS_ERROR(data->state.negotiate.status)) {
+ auth=(char *)"GSS-Negotiate";
+- result = Curl_output_negotiate(conn);
++ result = Curl_output_negotiate(conn, FALSE);
+ if (result)
+ return result;
+ authhost->done = TRUE;
+@@ -585,7 +597,7 @@ CURLcode Curl_http_input_auth(struct connectdata *conn,
+ authp->avail |= CURLAUTH_GSSNEGOTIATE;
+ if(authp->picked == CURLAUTH_GSSNEGOTIATE) {
+ /* if exactly this is wanted, go */
+- int neg = Curl_input_negotiate(conn, start);
++ int neg = Curl_input_negotiate(conn, (bool)(httpcode == 407), start);
+ if (neg == 0) {
+ conn->newurl = strdup(data->change.url);
+ data->state.authproblem = (conn->newurl == NULL);
+diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c
+index 3fc678f..73deda5 100644
+--- a/lib/http_negotiate.c
++++ b/lib/http_negotiate.c
+@@ -49,7 +49,7 @@
+ #include "memdebug.h"
+
+ static int
+-get_gss_name(struct connectdata *conn, gss_name_t *server)
++get_gss_name(struct connectdata *conn, bool proxy, gss_name_t *server)
+ {
+ struct negotiatedata *neg_ctx = &conn->data->state.negotiate;
+ OM_uint32 major_status, minor_status;
+@@ -69,11 +69,11 @@ get_gss_name(struct connectdata *conn, gss_name_t *server)
+ else
+ service = "HTTP";
+
+- token.length = strlen(service) + 1 + strlen(conn->host.name) + 1;
++ token.length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name : conn->host.name) + 1;
+ if (token.length + 1 > sizeof(name))
+ return EMSGSIZE;
+
+- snprintf(name, sizeof(name), "%s@%s", service, conn->host.name);
++ snprintf(name, sizeof(name), "%s@%s", service, proxy ? conn->proxy.name : conn->host.name);
+
+ token.value = (void *) name;
+ major_status = gss_import_name(&minor_status,
+@@ -113,7 +113,7 @@ log_gss_error(struct connectdata *conn, OM_uint32 error_status, char *prefix)
+ infof(conn->data, "%s", buf);
+ }
+
+-int Curl_input_negotiate(struct connectdata *conn, char *header)
++int Curl_input_negotiate(struct connectdata *conn, bool proxy, char *header)
+ {
+ struct negotiatedata *neg_ctx = &conn->data->state.negotiate;
+ OM_uint32 major_status, minor_status, minor_status2;
+@@ -169,7 +169,7 @@ int Curl_input_negotiate(struct connectdata *conn, char *header)
+ }
+
+ if (neg_ctx->server_name == NULL &&
+- (ret = get_gss_name(conn, &neg_ctx->server_name)))
++ (ret = get_gss_name(conn, proxy, &neg_ctx->server_name)))
+ return ret;
+
+ header += strlen(neg_ctx->protocol);
+@@ -258,7 +258,7 @@ int Curl_input_negotiate(struct connectdata *conn, char *header)
+ }
+
+
+-CURLcode Curl_output_negotiate(struct connectdata *conn)
++CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
+ {
+ struct negotiatedata *neg_ctx = &conn->data->state.negotiate;
+ char *encoded = NULL;
+@@ -310,7 +310,7 @@ CURLcode Curl_output_negotiate(struct connectdata *conn)
+ return CURLE_OUT_OF_MEMORY;
+
+ conn->allocptr.userpwd =
+- aprintf("Authorization: %s %s\r\n", neg_ctx->protocol, encoded);
++ aprintf("%sAuthorization: %s %s\r\n", proxy ? "Proxy-" : "", neg_ctx->protocol, encoded);
+ free(encoded);
+ Curl_cleanup_negotiate (conn->data);
+ return (conn->allocptr.userpwd == NULL) ? CURLE_OUT_OF_MEMORY : CURLE_OK;
+diff --git a/lib/http_negotiate.h b/lib/http_negotiate.h
+index cf8b048..8604a0c 100644
+--- a/lib/http_negotiate.h
++++ b/lib/http_negotiate.h
+@@ -27,10 +27,10 @@
+ #ifdef HAVE_GSSAPI
+
+ /* this is for Negotiate header input */
+-int Curl_input_negotiate(struct connectdata *conn, char *header);
++int Curl_input_negotiate(struct connectdata *conn, bool proxy, char *header);
+
+ /* this is for creating Negotiate header output */
+-CURLcode Curl_output_negotiate(struct connectdata *conn);
++CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy);
+
+ void Curl_cleanup_negotiate(struct SessionHandle *data);
+
+diff --git a/src/main.c b/src/main.c
+index 9f378db..44dd2c4 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -309,6 +309,7 @@ struct Configurable {
+ bool create_dirs;
+ bool ftp_create_dirs;
+ bool ftp_skip_ip;
++ bool proxynegotiate;
+ bool proxyntlm;
+ bool proxydigest;
+ bool proxybasic;
+@@ -555,6 +556,7 @@ static void help(void)
+ " --proxy-anyauth Pick \"any\" proxy authentication method (H)",
+ " --proxy-basic Use Basic authentication on the proxy (H)",
+ " --proxy-digest Use Digest authentication on the proxy (H)",
++ " --proxy-negotiate Use Negotiate authentication on the proxy (H)",
+ " --proxy-ntlm Use NTLM authentication on the proxy (H)",
+ " -P/--ftp-port <address> Use PORT with address instead of PASV (F)",
+ " -q If used as the first parameter disables .curlrc",
+@@ -1347,6 +1349,7 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */
+ {"$t", "socks4", TRUE},
+ {"$u", "ftp-alternative-to-user", TRUE},
+ {"$v", "ftp-ssl-reqd", FALSE},
++ {"$w", "proxy-negotiate", FALSE},
+
+ {"0", "http1.0", FALSE},
+ {"1", "tlsv1", FALSE},
+@@ -1789,6 +1792,12 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */
+ case 'v': /* --ftp-ssl-reqd */
+ config->ftp_ssl_reqd ^= TRUE;
+ break;
++ case 'w': /* --proxy-negotiate */
++ if(curlinfo->features & CURL_VERSION_GSSNEGOTIATE)
++ config->proxynegotiate ^= TRUE;
++ else
++ return PARAM_LIBCURL_DOESNT_SUPPORT;
++ break;
+ }
+ break;
+ case '#': /* --progress-bar */
+@@ -3960,6 +3969,8 @@ operate(struct Configurable *config, int argc, char *argv[])
+ config->ftp_create_dirs);
+ if(config->proxyanyauth)
+ curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
++ else if(config->proxynegotiate)
++ curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_GSSNEGOTIATE);
+ else if(config->proxyntlm)
+ curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_NTLM);
+ else if(config->proxydigest)
+--
+1.7.4.4
+
+
+From 88507544781155092ccee225bff92a0177e0f4df Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 16 Aug 2010 22:19:38 +0200
+Subject: [PATCH 4/4] negotiation: Wrong proxy authorization
+
+There's an error in http_negotiation.c where a mistake is using only
+userpwd even for proxy requests. Ludek provided a patch, but I decided
+to write the fix slightly different using his patch as inspiration.
+
+Reported by: Ludek Finstrle
+Bug: http://curl.haxx.se/bug/view.cgi?id=3046066
+
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ lib/http_negotiate.c | 12 +++++++++---
+ 1 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c
+index 73deda5..1d6119d 100644
+--- a/lib/http_negotiate.c
++++ b/lib/http_negotiate.c
+@@ -263,6 +263,7 @@ CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
+ struct negotiatedata *neg_ctx = &conn->data->state.negotiate;
+ char *encoded = NULL;
+ int len;
++ char *userp;
+
+ #ifdef HAVE_SPNEGO /* Handle SPNEGO */
+ if (checkprefix("Negotiate",neg_ctx->protocol)) {
+@@ -309,11 +310,16 @@ CURLcode Curl_output_negotiate(struct connectdata *conn, bool proxy)
+ if (len < 0)
+ return CURLE_OUT_OF_MEMORY;
+
+- conn->allocptr.userpwd =
+- aprintf("%sAuthorization: %s %s\r\n", proxy ? "Proxy-" : "", neg_ctx->protocol, encoded);
++ userp = aprintf("%sAuthorization: %s %s\r\n", proxy ? "Proxy-" : "",
++ neg_ctx->protocol, encoded);
++
++ if(proxy)
++ conn->allocptr.proxyuserpwd = userp;
++ else
++ conn->allocptr.userpwd = userp;
+ free(encoded);
+ Curl_cleanup_negotiate (conn->data);
+- return (conn->allocptr.userpwd == NULL) ? CURLE_OUT_OF_MEMORY : CURLE_OK;
++ return (userp == NULL) ? CURLE_OUT_OF_MEMORY : CURLE_OK;
+ }
+
+ void Curl_cleanup_negotiate(struct SessionHandle *data)
+--
+1.7.4.4
+