Hi, I've noticed that curl is "spinning" (see my explanation later in my mail) when:
1) NTLM auth is used for the target server and 2) Negotiate (Kerberos) auth is used on the HTTP proxy. The command I use is the following: curl -k -v --proxy-negotiate --ntlm -u AH\\oliver -x gateway.zscloud.net:8800 http://actual-experience.mysharepointonline.com/Shared%20Documents/ActualExperienceTargetContent.htm Which works nicely with libcurl 7.35.0 on Ubuntu 14.04: curl 7.35.0 (x86_64-pc-linux-gnu) libcurl/7.35.0 OpenSSL/1.0.1f zlib/1.2.8 libidn/1.28 librtmp/2.3 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smtp smtps telnet tftp Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP Linux st-ub-1404-04 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:07:32 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux But it doesn't work on MacOS Sierra with libcurl 7.51.0: curl 7.51.0 (x86_64-apple-darwin16.0) libcurl/7.51.0 SecureTransport zlib/1.2.8 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz UnixSockets Basically what's happening is the following: 1) curl sends a HTTP GET to the target, including the first message of the NTLM auth 2) The proxy replies with 407 and tells the client to use Negotiate to authenticate 3) curl then includes the Negotiate part and re-sends the first message of the NTLM auth 4) The proxy lets the connection go through now but the target server replies with 401 and includes the second message of the NTLM auth 5) curl then includes the final, third message of the NTLM auth _but doesn't include the Negotiate part_ for some reason - this part is also added when using libcurl 7.35.0 6) The proxy replies with 407 because of the missing Negotiate part 7) curl then includes the Negotiate part but _doesn't include the NTLM part_ 8) The proxy lets the connection go through but the target server replies with 401 because of the missing NTLM part and tells the client to authenticate using NTLM 9) And, because of that, the whole procedure, from step 1) to 8) repeats itself, until it reaches the limit of 50 redirects: * Maximum (50) redirects followed curl: (47) Maximum (50) redirects followed I'm pretty sure this bug was introduced between libcurl 7.35.0 and 7.51.0, can you please look into this? Thanks, Marton -- *MARTON LEGENY* Software Tester *Actual Experience* Bath, UK HQ +44 1225 585 868 www.actual-experience.com | @actualwork <https://twitter.com/actualwork> | LinkedIn <https://www.linkedin.com/company/actual-experience-ltd> | Facebook <https://www.facebook.com/ActualCrowd%20> -- Registered Office: Actual Experience plc Quay House, The Ambury, Bath BA1 1UA, Registered No. 06838738, VAT No. 971 9696 56 The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. Although we routinely screen for viruses, addressees should check this e-mail and any attachment for viruses. We make no warranty as to absence of viruses in this e-mail or any attachments.
------------------------------------------------------------------- Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library Etiquette: https://curl.haxx.se/mail/etiquette.html
