the handling of failed authentification with NTLM is not yet satisfying.
I looked through it and did not find a much better solution yet.

1. On failing we currently fall back to round trip state zero on and on.
Where is the best location to break the NTLM authentification cycle?

This happens i.e. if you set CURLOPT_PROXYUSERPWD to "" which is then
defaulted in CreateConnection() to CURL_DEFAULT_USER and
CURL_DEFAULT_PASSWORD (currently "anonymous:curl_by_daniel_at_haxx.se").
Should we rather try checking the scheme in the url before setting a
default?

2. If you set CURLOPT_PROXYUSERPWD to NULL we will segfault in
Curl_output_ntlm() with ntlm->state NTLMSTATE_TYPE2 or later in mkhash().
(I would be happier to add a NULL check before strlen() and toupper().)
The quickest implementation would be to return !=0 from
Curl_output_ntlm() but is this OK

Joerg M-T

-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
Received on 2003-09-01