Bugs item #3172608, was opened at 2011-02-04 12:07
Message generated for change (Comment added) made by bagder
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3172608&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: libcurl
Group: bad behaviour
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Pierre F BESSON (pfbesson)
Assigned to: Daniel Stenberg (bagder)
Summary: No re-authentication when HTTP connecton is closed

Initial Comment:
When accessing an httpd server configured with KeepAlive on & MaxKeepAliveRequests 100 and Kerberos authentication, libcurl authenticates the first time the connexion is opened and reusing the connexion for 100 requests, but when the connexion is closed by the server and re-athentication must happen, the authentication automat of curl responds to the 401 status by incorrectly detecting "Athentication problem" and not resending the authentication because he remembers having already done so 100 requests before ! Status of the authentication automat should be reset when at least one request succeds ?
The error is detected around line 737 in http.c.
Version is libcurl 7.21.3 on RedHat using gssapi on httpd v2.2 kerberized
Sorry, I cannot provide the trace of the session, it is on a classified system.

----------------------------------------------------------------------

>Comment By: Daniel Stenberg (bagder)
Date: 2011-02-08 22:52

Message:
Thanks for your report and analysis!

Can you please do a "diff -u" (or git diff) output with your suggested
changes and submit it here so that we get to see exactly what you suggest?

----------------------------------------------------------------------

Comment By: Pierre F BESSON (pfbesson)
Date: 2011-02-04 17:59

Message:
I modified the source to have a workaround but I am not an expert in HTTP
nor in libcurl, so I submit this "as is".
First, there is a problem in the last lines of http_negotiate.c, in the
cleanup function, the memset resets the state of the authentication automat
to zero during the authentication process. Luckily, nobody depends on the
state when it is in GSS_AUTHRECV. The function should memorize the state,
then memset then restore the state. There are perhaps other values to save
and restore..?
Second, I inserted near line 3520 of http.c (into the default of the
switch) a test that resets the state of the autentication automat to NONE
when the httpcode is something between 200 and 299 (ie when the request
succeds). Thus next time the authentication process starts, the automat is
in its start state. I didn't make the changes on the proxy part of the
function because I do not have any proxy to test the change.
If someone knowing better http and libcurl than me could validate the
workaround, it would be a great help.
Thank you in advance.

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3172608&group_id=976
Received on 2011-02-08