Skip to content

Commit 01165e0

Browse files
bagderbagder
committed
Fred New reported a bug where we used Basic auth and user name and password in
.netrc, and when following a Location: the subsequent requests didn't properly use the auth as found in the netrc file. Added test case 257 to verify my fix.
1 parent 6e1633a commit 01165e0

7 files changed

Lines changed: 130 additions & 7 deletions

File tree

‎CHANGES‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99

1010
Daniel (25 April 2005)
11+
- Fred New reported a bug where we used Basic auth and user name and password
12+
in .netrc, and when following a Location: the subsequent requests didn't
13+
properly use the auth as found in the netrc file. Added test case 257 to
14+
verify my fix.
15+
1116
- Based on feedback from Cory Nelson, I added some preprocessor magic in
1217
*/setup.h and */config-win32.h to build fine with VS2005 on x64.
1318

‎lib/http.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -465,6 +465,7 @@ Curl_http_output_auth(struct connectdata *conn,
465465
/* To prevent the user+password to get sent to other than the original
466466
host due to a location-follow, we do some weirdo checks here */
467467
if(!data->state.this_is_a_follow ||
468+
conn->bits.netrc ||
468469
!data->state.first_host ||
469470
curl_strequal(data->state.first_host, conn->host.name) ||
470471
data->set.http_disable_hostname_check_before_authentication) {

‎lib/netrc.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ int Curl_parsenetrc(char *host,
103103
char *override = curl_getenv("CURL_DEBUG_NETRC");
104104

105105
if (override) {
106-
printf("NETRC: overridden " NETRC " file: %s\n", home);
106+
fprintf(stderr, "NETRC: overridden " NETRC " file: %s\n", override);
107107
netrcfile = override;
108108
netrc_alloc = TRUE;
109109
}
@@ -171,7 +171,7 @@ int Curl_parsenetrc(char *host,
171171
/* and yes, this is our host! */
172172
state=HOSTVALID;
173173
#ifdef _NETRC_DEBUG
174-
printf("HOST: %s\n", tok);
174+
fprintf(stderr, "HOST: %s\n", tok);
175175
#endif
176176
retcode=0; /* we did find our host */
177177
}
@@ -188,7 +188,7 @@ int Curl_parsenetrc(char *host,
188188
else {
189189
strncpy(login, tok, LOGINSIZE-1);
190190
#ifdef _NETRC_DEBUG
191-
printf("LOGIN: %s\n", login);
191+
fprintf(stderr, "LOGIN: %s\n", login);
192192
#endif
193193
}
194194
state_login=0;
@@ -197,7 +197,7 @@ int Curl_parsenetrc(char *host,
197197
if (state_our_login || !specific_login) {
198198
strncpy(password, tok, PASSWORDSIZE-1);
199199
#ifdef _NETRC_DEBUG
200-
printf("PASSWORD: %s\n", password);
200+
fprintf(stderr, "PASSWORD: %s\n", password);
201201
#endif
202202
}
203203
state_password=0;

‎lib/url.c‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3147,15 +3147,23 @@ static CURLcode CreateConnection(struct SessionHandle *data,
31473147
user, passwd);
31483148
}
31493149

3150+
conn->bits.netrc = FALSE;
31503151
if (data->set.use_netrc != CURL_NETRC_IGNORED) {
31513152
if(Curl_parsenetrc(conn->host.name,
31523153
user, passwd,
31533154
data->set.netrc_file)) {
3154-
infof(data, "Couldn't find host %s in the " DOT_CHAR "netrc file, using defaults\n",
3155+
infof(data, "Couldn't find host %s in the " DOT_CHAR
3156+
"netrc file, using defaults\n",
31553157
conn->host.name);
31563158
}
3157-
else
3159+
else {
3160+
/* set bits.netrc TRUE to remember that we got the name from a .netrc
3161+
file, so that it is safe to use even if we followed a Location: to a
3162+
different host or similar. */
3163+
conn->bits.netrc = TRUE;
3164+
31583165
conn->bits.user_passwd = 1; /* enable user+password */
3166+
}
31593167
}
31603168

31613169
/* If our protocol needs a password and we have none, use the defaults */

‎lib/urldata.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -420,6 +420,7 @@ struct ConnectBits {
420420
bool ftp_use_lprt; /* As set with CURLOPT_FTP_USE_EPRT, but if we find out
421421
LPRT doesn't work we disable it for the forthcoming
422422
requests */
423+
bool netrc; /* name+password provided by netrc */
423424
};
424425

425426
struct hostname {

‎tests/data/Makefile.am‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ EXTRA_DIST = test1 test108 test117 test127 test20 test27 test34 test46 \
3535
test229 test233 test234 test235 test236 test520 test237 test238 \
3636
test239 test243 test245 test246 test247 test248 test249 test250 \
3737
test251 test252 test253 test254 test255 test521 test522 test523 \
38-
test256
38+
test256 test257
3939

4040
# The following tests have been removed from the dist since they no longer
4141
# work. We need to fix the test suite's FTPS server first, then bring them

‎tests/data/test257‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
<info>
2+
<keywords>
3+
HTTP
4+
HTTP GET
5+
followlocation
6+
netrc
7+
</keywords>
8+
</info>
9+
# Server-side
10+
<reply>
11+
<data>
12+
HTTP/1.1 301 This is a weirdo text message swsclose
13+
Date: Thu, 09 Nov 2010 14:49:00 GMT
14+
Server: test-server/fake
15+
Location: http://anotherone.com/2570002
16+
Connection: close
17+
18+
This server reply is for testing a simple Location: following
19+
20+
</data>
21+
<data2>
22+
HTTP/1.1 302 Followed here fine swsclose
23+
Date: Thu, 09 Nov 2010 14:49:00 GMT
24+
Server: test-server/fake
25+
Location: http://athird.com/2570003
26+
27+
If this is received, the location following worked
28+
29+
</data2>
30+
<data3>
31+
HTTP/1.1 200 Followed here fine swsclose
32+
Date: Thu, 09 Nov 2010 14:49:00 GMT
33+
Server: test-server/fake
34+
35+
If this is received, the location following worked
36+
37+
</data3>
38+
<datacheck>
39+
HTTP/1.1 301 This is a weirdo text message swsclose
40+
Date: Thu, 09 Nov 2010 14:49:00 GMT
41+
Server: test-server/fake
42+
Location: http://anotherone.com/2570002
43+
Connection: close
44+
45+
HTTP/1.1 302 Followed here fine swsclose
46+
Date: Thu, 09 Nov 2010 14:49:00 GMT
47+
Server: test-server/fake
48+
Location: http://athird.com/2570003
49+
50+
HTTP/1.1 200 Followed here fine swsclose
51+
Date: Thu, 09 Nov 2010 14:49:00 GMT
52+
Server: test-server/fake
53+
54+
If this is received, the location following worked
55+
56+
</datacheck>
57+
</reply>
58+
59+
# Client-side
60+
<client>
61+
<features>
62+
netrc_debug
63+
</features>
64+
<server>
65+
http
66+
</server>
67+
<name>
68+
HTTP Location: following with --netrc-optional
69+
</name>
70+
<command>
71+
http://supersite.com/want/257 -L -x http://%HOSTIP:%HTTPPORT --netrc-optional
72+
</command>
73+
74+
# netrc auth for two out of three sites:
75+
<file name="log/netrc">
76+
machine supersite.com login user1 password passwd1
77+
machine anotherone.com login user2 password passwd2
78+
</file>
79+
</client>
80+
81+
# Verify data after the test has been "shot"
82+
<verify>
83+
<strip>
84+
^User-Agent:.*
85+
</strip>
86+
<protocol>
87+
GET http://supersite.com/want/257 HTTP/1.1
88+
Authorization: Basic dXNlcjE6cGFzc3dkMQ==
89+
User-Agent: curl/7.14.0-CVS (i686-pc-linux-gnu) libcurl/7.14.0-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13
90+
Host: supersite.com
91+
Pragma: no-cache
92+
Accept: */*
93+
94+
GET http://anotherone.com/2570002 HTTP/1.1
95+
Authorization: Basic dXNlcjI6cGFzc3dkMg==
96+
User-Agent: curl/7.14.0-CVS (i686-pc-linux-gnu) libcurl/7.14.0-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13
97+
Host: anotherone.com
98+
Pragma: no-cache
99+
Accept: */*
100+
101+
GET http://athird.com/2570003 HTTP/1.1
102+
User-Agent: curl/7.14.0-CVS (i686-pc-linux-gnu) libcurl/7.14.0-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13
103+
Host: athird.com
104+
Pragma: no-cache
105+
Accept: */*
106+
107+
</protocol>
108+
</verify>

0 commit comments

Comments
 (0)