breaking change in 7.82.0: mandatory login token in .netrc #8653

standsed · 2022-03-30T13:30:30Z

I did this

Create/append ~/.netrc file with record without login token, e.g.,
machine curl.com password S3cr3t

run
curl https://host.com --netrc --verbose

I expected the following

Header to be sent
Authorization: Basic Onp4Y3Y=

curl/libcurl version

Does not work:
docker image: curlimages/curl:7.82.0
curl 7.82.0-DEV (x86_64-pc-linux-musl) libcurl/7.82.0-DEV OpenSSL/1.1.1n zlib/1.2.11 brotli/1.0.9 libssh2/1.10.0 nghttp2/1.46.0
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTPS-proxy IPv6 Largefile libz NTLM NTLM_WB SSL TLS-SRP UnixSockets

Works:
docker image: curlimages/curl:7.81.0
curl 7.81.0-DEV (x86_64-pc-linux-musl) libcurl/7.81.0-DEV OpenSSL/1.1.1l zlib/1.2.11 brotli/1.0.9 libssh2/1.10.0 nghttp2/1.46.0
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTPS-proxy IPv6 Largefile libz NTLM NTLM_WB SSL TLS-SRP UnixSockets

curlimages/curl:7.77.0 also ok

The text was updated successfully, but these errors were encountered:

jay · 2022-03-30T21:43:38Z

Bisected to 7d600ad (#8451) which removed the user_passwd flag in favor of checking user pointer. AFAICT that means now that a username must always be set if a password is set. There is code in parseurlandfillconn which sets an empty username if no username was found in the URL but a password was found:

curl/lib/url.c

Lines 2066 to 2069 in 64db5c5

    
           else if(data->state.aptr.passwd) { 
        
             /* no user was set but a password, set a blank user */ 
        
             result = Curl_setstropt(&data->state.aptr.user, ""); 
        
           }

netrc user/pass comes in later in override_login, but it doesn't have the same logic to create a blank username if there's a password but no username. I'm not sure the reasons for that but here is some similar logic that works:

diff --git a/lib/url.c b/lib/url.c
index a56e4b0..9f29593 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -2971,6 +2971,12 @@ static CURLcode override_login(struct Curl_easy *data,
       /* don't update the user name below */
       userp = NULL;
     }
+    /* no user was set but a password, set a blank user */
+    if(userp && !*userp && *passwdp) {
+      *userp = strdup("");
+      if(!*userp)
+        return CURLE_OUT_OF_MEMORY;
+    }
   }
 #endif

curlimages/curl:7.77.0 also ok

Though 7.81.0 may work, 7.77.0 and some other older versions have a bug with blank usernames where they actually send "(nil)" for the username. So if you must work around this immediately use 7.81.0 not older versions.

bagder · 2022-04-03T10:14:18Z

@jay, if this is a proposal shouldn't it be made as a PR?

jay · 2022-04-04T18:33:31Z

I was more at the concept phase. Does it make sense to check in override_login?

bagder · 2022-05-06T07:52:46Z

If all other existing tests work and you add a new one that reproduces the problem without the patch and works with the patch, then I think it sounds l like a good fix!

domenkozar · 2022-06-08T19:50:38Z

This broke https://cachix.org and a lot of users are having problems when they upgrade to latest curl.

How can I help to expedite this?

curl/curl#8653

domenkozar · 2022-06-09T00:37:27Z

I can confirm the patch fixes the issue.

curl/curl#8653 (cherry picked from commit 7434c16)

curl/curl#8653

jay · 2022-06-24T07:29:32Z

I can confirm the patch fixes the issue.

Thanks. I will look at turning the patch into a PR.

- If, after parsing netrc, there is a password with no username then set a blank username. This used to be the case prior to 7d600ad (precedes 7.82). Note parseurlandfillconn already does the same thing for URLs. Reported-by: Raivis <standsed@users.noreply.github.com> Testing-by: Domen Kožar Fixes curl#8653 Closes #xxxx

curl/curl#8653

It is set in .netrc anyway, and there is a regression in curl that causes it to fail when passing the user name. See curl/curl#8653 Change-Id: Ic7aa2d874884db71f71d162486acf4e054eab7e9 Reviewed-by: hjk <hjk@qt.io>

orgads · 2022-08-03T12:24:38Z

I've noticed another regression. I do have username in netrc, but if I provide a username in the URL, none of them is used, and no Authorization header is sent (even if it is the same user).

Example:
.netrc:

machine server login user password 5up3r53cr31

$ curl -n http://user@server/
Unauthorized

This is not covered by #9066.

orgads · 2022-08-03T15:22:46Z

My issue is caused by d1237ac.

orgads · 2022-08-03T15:27:42Z

I'll file a new issue.

Done: REG [7.81->7.82] Authorization doesn't work for user in URL + netrc #9243

- If, after parsing netrc, there is a password with no username then set a blank username. This used to be the case prior to 7d600ad (precedes 7.82). Note parseurlandfillconn already does the same thing for URLs. Reported-by: Raivis <standsed@users.noreply.github.com> Testing-by: Domen Kožar Fixes curl#8653 Closes #xxxx

- If, after parsing netrc, there is a password with no username then set a blank username. This used to be the case prior to 7d600ad (precedes 7.82). Note parseurlandfillconn already does the same thing for URLs. Reported-by: Raivis <standsed@users.noreply.github.com> Testing-by: Domen Kožar Fixes curl/curl#8653 Closes #9334 Closes #9066

curl/curl#8653

jay added the authentication label Mar 30, 2022

bagder added the regression label Mar 31, 2022

domenkozar mentioned this issue Jun 8, 2022

netrc omits login, defaulting to system username cachix/cachix#406

Closed

domenkozar added a commit to domenkozar/nixpkgs that referenced this issue Jun 9, 2022

nix: patch curl netrc regression

7434c16

curl/curl#8653

domenkozar mentioned this issue Jun 9, 2022

nix: patch curl netrc regression NixOS/nixpkgs#176974

Merged

github-actions bot pushed a commit to NixOS/nixpkgs that referenced this issue Jun 9, 2022

nix: patch curl netrc regression

dd94e0d

curl/curl#8653 (cherry picked from commit 7434c16)

gador pushed a commit to gador/nixpkgs that referenced this issue Jun 10, 2022

nix: patch curl netrc regression

2532a24

curl/curl#8653

jay mentioned this issue Jun 29, 2022

url: treat missing usernames in netrc as empty #9066

Closed

bagder mentioned this issue Jul 13, 2022

netrc not respected if login token is not present #9148

Closed

orgads added a commit to orgads/MINGW-packages that referenced this issue Aug 3, 2022

curl: Fix regression with netrc handling

75b8504

curl/curl#8653

bagder closed this as completed in 8bd0351 Aug 29, 2022

jsoo1 pushed a commit to awakesecurity/nixpkgs that referenced this issue Oct 5, 2023

nix: patch curl netrc regression

e6556a3

curl/curl#8653

jsoo1 pushed a commit to awakesecurity/nixpkgs that referenced this issue Oct 5, 2023

nix: patch curl netrc regression

16b0b90

curl/curl#8653

jsoo1 pushed a commit to awakesecurity/nixpkgs that referenced this issue Oct 6, 2023

nix: patch curl netrc regression

029ee59

curl/curl#8653

jsoo1 pushed a commit to awakesecurity/nixpkgs that referenced this issue Oct 6, 2023

nix: patch curl netrc regression

c29f383

curl/curl#8653

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

breaking change in 7.82.0: mandatory login token in .netrc #8653

breaking change in 7.82.0: mandatory login token in .netrc #8653

standsed commented Mar 30, 2022

jay commented Mar 30, 2022 •

edited

bagder commented Apr 3, 2022 •

edited

jay commented Apr 4, 2022

bagder commented May 6, 2022

domenkozar commented Jun 8, 2022

domenkozar commented Jun 9, 2022

jay commented Jun 24, 2022

orgads commented Aug 3, 2022 •

edited

orgads commented Aug 3, 2022

orgads commented Aug 3, 2022 •

edited

breaking change in 7.82.0: mandatory login token in .netrc #8653

breaking change in 7.82.0: mandatory login token in .netrc #8653

Comments

standsed commented Mar 30, 2022

I did this

I expected the following

curl/libcurl version

jay commented Mar 30, 2022 • edited

bagder commented Apr 3, 2022 • edited

jay commented Apr 4, 2022

bagder commented May 6, 2022

domenkozar commented Jun 8, 2022

domenkozar commented Jun 9, 2022

jay commented Jun 24, 2022

orgads commented Aug 3, 2022 • edited

orgads commented Aug 3, 2022

orgads commented Aug 3, 2022 • edited

jay commented Mar 30, 2022 •

edited

bagder commented Apr 3, 2022 •

edited

orgads commented Aug 3, 2022 •

edited

orgads commented Aug 3, 2022 •

edited