Curl: [ curl-Bugs-3582321 ] libcurl fails to POST > 2000 bytes to a proxy using NTLM

From: SourceForge.net <noreply_at_sourceforge.net>
Date: Wed, 07 Nov 2012 14:16:20 -0800

Bugs item #3582321, was opened at 2012-10-31 13:48
Message generated for change (Comment added) made by bagder
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3582321&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: libcurl
Group: wrong behaviour
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: John Suprock (sooper)
Assigned to: Daniel Stenberg (bagder)
Summary: libcurl fails to POST > 2000 bytes to a proxy using NTLM

Initial Comment:
We're seeing problems with libcurl using an NTLM proxy when the request to be proxied has more that 2000 bytes of POST data. This has been seen with both Forefront and Squid. The problem appears to stem from an incomplete conditional contained in function http_perhapsrewind() of lib file http.c.

The conditional in question accounts for the state of conn->ntlm, but does not contain the same check for conn->proxyntlm. Adding the missing check allows authentication to complete for any POST data greater than 2,000 bytes (as this is also part of the conditional).

Please let us know if we missed anywhere else in the code that may also pose a problem or if there are any other corrections. Again, the patch appears to have fixed this issue which did not present itself for POST sizes less than 2,000 bytes i.e. posting data less than this amount resulted in no problem, while posting data greater than this amount resulted in a 407 error with a closed connection.

I am including test output below this message from before and after the patch was applied to http.c.

Thanks

BEFORE PATCH:
* About to connect() to proxy 172.26.21.103 port 8080 (#0)
* Trying 172.26.21.103...
* connected
* Connected to 172.26.21.103 (172.26.21.103) port 8080 (#0)
* Establish HTTP proxy tunnel to 172.26.21.145:443
* Proxy auth using NTLM with user 'Administrator'
> CONNECT 172.26.21.145:443 HTTP/1.1
Host: 172.26.21.145:443
Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
User-Agent: XXX (20121023946)
Proxy-Connection: Keep-Alive

< HTTP/1.0 407 Proxy Authentication Required
< Server: squid/2.6.STABLE21
< Date: Wed, 31 Oct 2012 XX:XX:XX GMT
< Content-Type: text/html
< Content-Length: 1279
< Expires: Wed, 31 Oct 2012 XX:XX:XX GMT
< X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
< Proxy-Authenticate: NTLM TlRMTVNTUAACAAAABgAGADAAAAAGgokApWQfl33BmzYAAAAAAAAAAEgASAA2AAAAVEFSR0VUAgAMAFQAQQBSAEcARQBUAAEAFABVAFQASQBMADMAUwBRAFUASQBEAAQAAAADABQAVQB0AGkAbAAzAFMAcQB1AGkAZAAAAAAA
< X-Cache: MISS from squid_cent5
< X-Cache-Lookup: NONE from squid_cent5:3128
< Via: 1.0 squid_cent5:3128 (squid/2.6.STABLE21)
< Proxy-Connection: keep-alive
<
* Ignore 1279 bytes of response-body
* NTLM send, close instead of sending 2040 bytes
* Received HTTP code 407 from proxy after CONNECT
* About to connect() to proxy 172.26.21.103 port 8080 (#0)
* Trying 172.26.21.103...
* connected
* Connected to 172.26.21.103 (172.26.21.103) port 8080 (#0)
* Establish HTTP proxy tunnel to 172.26.21.145:443
* Proxy auth using NTLM with user 'Administrator'
> CONNECT 172.26.21.145:443 HTTP/1.1
Host: 172.26.21.145:443
Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAADQANAHAAAAAIAAgAfQAAAAAAAAAAAAAABoKJANoYYwiU1dgNAAAAAAAAAAAAAAAAAAAAAOrKosCGT3wm8kB/EeKlL9wgHjwPHveMDUFkbWluaXN0cmF0b3JKb2huLURldg==
User-Agent: XXX (20121023946)
Proxy-Connection: Keep-Alive

AFTER PATCH:
* About to connect() to proxy 172.26.21.103 port 8080 (#0)
* Trying 172.26.21.103...
* connected
* Connected to 172.26.21.103 (172.26.21.103) port 8080 (#0)
* Establish HTTP proxy tunnel to 172.26.21.145:443
* Proxy auth using NTLM with user 'Administrator'
> CONNECT 172.26.21.145:443 HTTP/1.1
Host: 172.26.21.145:443
Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=
User-Agent: XXX (20121023946)
Proxy-Connection: Keep-Alive

< HTTP/1.0 407 Proxy Authentication Required
< Server: squid/2.6.STABLE21
< Date: Wed, 31 Oct 2012 XX:XX:XX GMT
< Content-Type: text/html
< Content-Length: 1279
< Expires: Wed, 31 Oct 2012 XX:XX:XX GMT
< X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0
< Proxy-Authenticate: NTLM TlRMTVNTUAACAAAABgAGADAAAAAGgokAFdWVabT3i1kAAAAAAAAAAEgASAA2AAAAVEFSR0VUAgAMAFQAQQBSAEcARQBUAAEAFABVAFQASQBMADMAUwBRAFUASQBEAAQAAAADABQAVQB0AGkAbAAzAFMAcQB1AGkAZAAAAAAA
< X-Cache: MISS from squid_cent5
< X-Cache-Lookup: NONE from squid_cent5:3128
< Via: 1.0 squid_cent5:3128 (squid/2.6.STABLE21)
< Proxy-Connection: keep-alive
<
* Ignore 1279 bytes of response-body
* Rewind stream after send
* TUNNEL_STATE switched to: 0
* Establish HTTP proxy tunnel to 172.26.21.145:443
* Proxy auth using NTLM with user 'Administrator'
> CONNECT 172.26.21.145:443 HTTP/1.1
Host: 172.26.21.145:443
Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEAAAAAYABgAWAAAAAAAAABwAAAADQANAHAAAAAIAAgAfQAAAAAAAAAAAAAABoKJAN05cMlfHwrQAAAAAAAAAAAAAAAAAAAAALiG7+OdEgBp7bsaaMgLyVKfKEFjYhhX4EFkbWluaXN0cmF0b3JKb2huLURldg==
User-Agent: XXX (20121023946)
Proxy-Connection: Keep-Alive

< HTTP/1.0 200 Connection established
<
* Proxy replied OK to CONNECT request
...
> POST /policy/add HTTP/1.1
User-Agent: XXX (20121023946)
Host: 172.26.21.145
Accept: */*
Content-Length: 2040
Content-Type: application/x-www-form-urlencoded
Expect: 100-continue

* Done waiting for 100-continue
< HTTP/1.1 200 OK
< Date: Wed, 31 Oct 2012 XX:XX:XX GMT
< Server: XXX
< Connection: close
< Expires: Wed, 31 Oct 2012 XX:XX:XX GMT
< Content-Length: 91108
< Content-Type: text/xml
< X-Frame-Options: DENY
< Cache-Control:
< Expires: 0
< Pragma :
<
* Closing connection #0

--
John Suprock
Software Engineer
Tenable Network Security, Inc.
----------------------------------------------------------------------
Comment By: Daniel Stenberg (bagder)
Date: 2012-11-07 14:16
Message:
Thanks for the report, this problem is now fixed in the git repository.
To try it out, you either checkout/update your git clone:
http://curl.haxx.se/source.html
or you try tomorrow's daily snapshot: http://curl.haxx.se/snapshots/
----------------------------------------------------------------------
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3582321&group_id=976

Received on 2012-11-07

curl-tracker Archives

[ curl-Bugs-3582321 ] libcurl fails to POST > 2000 bytes to a proxy using NTLM