From: Isaac Boukris <iboukris@gmail.com>
Date: Mon, 3 Aug 2015 23:20:23 +0000 (+0300)
Subject: NTLM: handle auth for only a single request
X-Git-Tag: curl-7_44_0~36
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fe6049f0;p=thirdparty%2Fcurl.git

NTLM: handle auth for only a single request

Currently when the server responds with 401 on NTLM authenticated
connection (re-used) we consider it to have failed.  However this is
legitimate and may happen when for example IIS is set configured to
'authPersistSingleRequest' or when the request goes thru a proxy (with
'via' header).

Implemented by imploying an additional state once a connection is
re-used to indicate that if we receive 401 we need to restart
authentication.

Closes #363
---

diff --git a/lib/curl_ntlm.c b/lib/curl_ntlm.c
index 1f3bdccdfa..f9ddf506d0 100644
--- a/lib/curl_ntlm.c
+++ b/lib/curl_ntlm.c
@@ -84,7 +84,11 @@ CURLcode Curl_input_ntlm(struct connectdata *conn,
       ntlm->state = NTLMSTATE_TYPE2; /* We got a type-2 message */
     }
     else {
-      if(ntlm->state == NTLMSTATE_TYPE3) {
+      if(ntlm->state == NTLMSTATE_LAST) {
+        infof(conn->data, "NTLM auth restarted\n");
+        Curl_http_ntlm_cleanup(conn);
+      }
+      else if(ntlm->state == NTLMSTATE_TYPE3) {
         infof(conn->data, "NTLM handshake rejected\n");
         Curl_http_ntlm_cleanup(conn);
         ntlm->state = NTLMSTATE_NONE;
@@ -211,6 +215,9 @@ CURLcode Curl_output_ntlm(struct connectdata *conn, bool proxy)
   case NTLMSTATE_TYPE3:
     /* connection is already authenticated,
      * don't send a header in future requests */
+    ntlm->state = NTLMSTATE_LAST;
+
+  case NTLMSTATE_LAST:
     Curl_safefree(*allocuserpwd);
     authp->done = TRUE;
     break;