Fred New reported a bug where we used Basic auth and user name and password in

.netrc, and when following a Location: the subsequent requests didn't properly
use the auth as found in the netrc file. Added test case 257 to verify my fix.

diff --git a/CHANGES b/CHANGES
index 49582ae2e7a15307d3d24276c7b8413c56bbdb9b..90b67081c519445a5ace0600cf3ea317e58d159b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,11 @@
 
 
 Daniel (25 April 2005)
+- Fred New reported a bug where we used Basic auth and user name and password
+  in .netrc, and when following a Location: the subsequent requests didn't
+  properly use the auth as found in the netrc file. Added test case 257 to
+  verify my fix.
+
 - Based on feedback from Cory Nelson, I added some preprocessor magic in
   */setup.h and */config-win32.h to build fine with VS2005 on x64.
 

diff --git a/lib/http.c b/lib/http.c
index c3c80595670b4620af2d882254fa227637dc3e23..f61ce42c4504bce5caaf365c7b216fa15bb17394 100644 (file)
--- a/lib/http.c
+++ b/lib/http.c
@@ -465,6 +465,7 @@ Curl_http_output_auth(struct connectdata *conn,
   /* To prevent the user+password to get sent to other than the original
      host due to a location-follow, we do some weirdo checks here */
   if(!data->state.this_is_a_follow ||
+     conn->bits.netrc ||
      !data->state.first_host ||
      curl_strequal(data->state.first_host, conn->host.name) ||
      data->set.http_disable_hostname_check_before_authentication) {

diff --git a/lib/netrc.c b/lib/netrc.c
index e43140ac3d723a9f2d4cd87de777310316a21899..9b56dd4a21b75179470c8ae9b160bc6f8eb59c9b 100644 (file)
--- a/lib/netrc.c
+++ b/lib/netrc.c
@@ -103,7 +103,7 @@ int Curl_parsenetrc(char *host,
     char *override = curl_getenv("CURL_DEBUG_NETRC");
 
     if (override) {
-      printf("NETRC: overridden " NETRC " file: %s\n", home);
+      fprintf(stderr, "NETRC: overridden " NETRC " file: %s\n", override);
       netrcfile = override;
       netrc_alloc = TRUE;
     }
@@ -171,7 +171,7 @@ int Curl_parsenetrc(char *host,
             /* and yes, this is our host! */
             state=HOSTVALID;
 #ifdef _NETRC_DEBUG
-            printf("HOST: %s\n", tok);
+            fprintf(stderr, "HOST: %s\n", tok);
 #endif
             retcode=0; /* we did find our host */
           }
@@ -188,7 +188,7 @@ int Curl_parsenetrc(char *host,
             else {
               strncpy(login, tok, LOGINSIZE-1);
 #ifdef _NETRC_DEBUG
-              printf("LOGIN: %s\n", login);
+              fprintf(stderr, "LOGIN: %s\n", login);
 #endif
             }
             state_login=0;
@@ -197,7 +197,7 @@ int Curl_parsenetrc(char *host,
             if (state_our_login || !specific_login) {
               strncpy(password, tok, PASSWORDSIZE-1);
 #ifdef _NETRC_DEBUG
-              printf("PASSWORD: %s\n", password);
+              fprintf(stderr, "PASSWORD: %s\n", password);
 #endif
             }
             state_password=0;

diff --git a/lib/url.c b/lib/url.c
index e75c29043c97acdad08fe190e08864f524a7a784..fb9c5905d8300d779a9cfcc02007c5cdec8dfc20 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -3147,15 +3147,23 @@ static CURLcode CreateConnection(struct SessionHandle *data,
            user, passwd);
   }
 
+  conn->bits.netrc = FALSE;
   if (data->set.use_netrc != CURL_NETRC_IGNORED) {
     if(Curl_parsenetrc(conn->host.name,
                        user, passwd,
                        data->set.netrc_file)) {
-      infof(data, "Couldn't find host %s in the " DOT_CHAR "netrc file, using defaults\n",
+      infof(data, "Couldn't find host %s in the " DOT_CHAR
+            "netrc file, using defaults\n",
             conn->host.name);
     }
-    else
+    else {
+      /* set bits.netrc TRUE to remember that we got the name from a .netrc
+         file, so that it is safe to use even if we followed a Location: to a
+         different host or similar. */
+      conn->bits.netrc = TRUE;
+
       conn->bits.user_passwd = 1; /* enable user+password */
+    }
   }
 
   /* If our protocol needs a password and we have none, use the defaults */

diff --git a/lib/urldata.h b/lib/urldata.h
index a3b2c25ff1cb8e5cb0cd3f93b5573eb192cae65a..9bd24598049b661f3585d89b47d8efc1f391f9bb 100644 (file)
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -420,6 +420,7 @@ struct ConnectBits {
   bool ftp_use_lprt;  /* As set with CURLOPT_FTP_USE_EPRT, but if we find out
                          LPRT doesn't work we disable it for the forthcoming
                          requests */
+  bool netrc;         /* name+password provided by netrc */
 };
 
 struct hostname {

diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index ccc7023feb5cee6573b568ef818f75328f9f0ce7..8a63ce3dd98e23d1c2ea2546e34d94387a7c5cf5 100644 (file)
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -35,7 +35,7 @@ EXTRA_DIST = test1 test108 test117 test127 test20 test27 test34 test46        \
  test229 test233 test234 test235 test236 test520 test237 test238 \
  test239 test243 test245 test246 test247 test248 test249 test250 \
  test251 test252 test253 test254 test255 test521 test522 test523 \
- test256
+ test256 test257
 
 # The following tests have been removed from the dist since they no longer
 # work. We need to fix the test suite's FTPS server first, then bring them

diff --git a/tests/data/test257 b/tests/data/test257
new file mode 100644 (file)
index 0000000..88a872c
--- /dev/null
+++ b/tests/data/test257
@@ -0,0 +1,108 @@
+<info>
+<keywords>
+HTTP
+HTTP GET
+followlocation
+netrc
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 301 This is a weirdo text message swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Location: http://anotherone.com/2570002
+Connection: close
+
+This server reply is for testing a simple Location: following
+
+</data>
+<data2>
+HTTP/1.1 302 Followed here fine swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Location: http://athird.com/2570003
+
+If this is received, the location following worked
+
+</data2>
+<data3>
+HTTP/1.1 200 Followed here fine swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+
+If this is received, the location following worked
+
+</data3>
+<datacheck>
+HTTP/1.1 301 This is a weirdo text message swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Location: http://anotherone.com/2570002
+Connection: close
+
+HTTP/1.1 302 Followed here fine swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Location: http://athird.com/2570003
+
+HTTP/1.1 200 Followed here fine swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+
+If this is received, the location following worked
+
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<features>
+netrc_debug
+</features>
+<server>
+http
+</server>
+ <name>
+HTTP Location: following with --netrc-optional
+ </name>
+ <command>
+http://supersite.com/want/257 -L -x http://%HOSTIP:%HTTPPORT --netrc-optional
+</command>
+
+# netrc auth for two out of three sites:
+<file name="log/netrc">
+machine supersite.com login user1 password passwd1
+machine anotherone.com login user2 password passwd2
+</file>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^User-Agent:.*
+</strip>
+<protocol>
+GET http://supersite.com/want/257 HTTP/1.1\r
+Authorization: Basic dXNlcjE6cGFzc3dkMQ==\r
+User-Agent: curl/7.14.0-CVS (i686-pc-linux-gnu) libcurl/7.14.0-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13\r
+Host: supersite.com\r
+Pragma: no-cache\r
+Accept: */*\r
+\r
+GET http://anotherone.com/2570002 HTTP/1.1\r
+Authorization: Basic dXNlcjI6cGFzc3dkMg==\r
+User-Agent: curl/7.14.0-CVS (i686-pc-linux-gnu) libcurl/7.14.0-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13
+Host: anotherone.com\r
+Pragma: no-cache\r
+Accept: */*\r
+\r
+GET http://athird.com/2570003 HTTP/1.1\r
+User-Agent: curl/7.14.0-CVS (i686-pc-linux-gnu) libcurl/7.14.0-CVS OpenSSL/0.9.7e zlib/1.2.2 libidn/0.5.13
+Host: athird.com\r
+Pragma: no-cache\r
+Accept: */*\r
+\r
+</protocol>
+</verify>