On Wed, Mar 22, 2017 at 12:25 PM, Marton Legeny
<marton.legeny_at_actual-experience.com> wrote:
> Basically what's happening is the following:
>
> 1) curl sends a HTTP GET to the target, including the first message of the
> NTLM auth
> 2) The proxy replies with 407 and tells the client to use Negotiate to
> authenticate
> 3) curl then includes the Negotiate part and re-sends the first message of
> the NTLM auth
> 4) The proxy lets the connection go through now but the target server
> replies with 401 and includes the second message of the NTLM auth
> 5) curl then includes the final, third message of the NTLM auth _but doesn't
> include the Negotiate part_ for some reason - this part is also added when
> using libcurl 7.35.0

I think it might be the below commit:
https://github.com/curl/curl/commit/87c4abb611c2b7038edc27c08b001d577eb14bd9

You may try to revert it for testing, but I think that commit is
correct because we should not resend the same header twice as the
server would drop it to prevent replay attacks (although replay cache
is sometimes disabled on servers for performance).
Also, can you check if the old libcurl was sending the exact same header?

A possible fix would be to make sure to re-generate a new token for
each request (but only for krb5).
-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2017-03-22