Description: fix wrong re-use of connections
Origin: backport, https://github.com/bagder/curl/commit/378af08c99299683eb728fd8f9d3d3ab05f73ec0
Origin: backport, https://github.com/bagder/curl/commit/d765099813f58153cb859279c743e6494d179341
Origin: backport, https://github.com/bagder/curl/commit/517b06d657aceb11a234b05cc891170c367ab80d
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742728

WARNING: this patch contains weird line endings, editing it may
break tests.

Index: curl-7.35.0/lib/http.c
===================================================================
--- curl-7.35.0.orig/lib/http.c	2014-03-29 13:59:11.203519268 -0400
+++ curl-7.35.0/lib/http.c	2014-03-29 13:59:11.195519268 -0400
@@ -145,7 +145,7 @@
   ZERO_NULL,                            /* readwrite */
   PORT_HTTPS,                           /* defport */
   CURLPROTO_HTTP | CURLPROTO_HTTPS,     /* protocol */
-  PROTOPT_SSL                           /* flags */
+  PROTOPT_SSL | PROTOPT_CREDSPERREQUEST /* flags */
 };
 #endif
 
Index: curl-7.35.0/lib/url.c
===================================================================
--- curl-7.35.0.orig/lib/url.c	2014-03-29 13:59:11.203519268 -0400
+++ curl-7.35.0/lib/url.c	2014-03-29 13:59:11.199519268 -0400
@@ -2885,8 +2885,9 @@
   struct connectdata *check;
   struct connectdata *chosen = 0;
   bool canPipeline = IsPipeliningPossible(data, needle);
-  bool wantNTLM = (data->state.authhost.want & CURLAUTH_NTLM) ||
-    (data->state.authhost.want & CURLAUTH_NTLM_WB) ? TRUE : FALSE;
+  bool wantNTLMhttp = ((data->state.authhost.want & CURLAUTH_NTLM) ||
+                       (data->state.authhost.want & CURLAUTH_NTLM_WB)) &&
+    (needle->handler->protocol & CURLPROTO_HTTP) ? TRUE : FALSE;
   struct connectbundle *bundle;
 
   *force_reuse = FALSE;
@@ -3041,16 +3042,16 @@
           continue;
       }
 
-      if((needle->handler->protocol & CURLPROTO_FTP) ||
-         ((needle->handler->protocol & CURLPROTO_HTTP) && wantNTLM)) {
-         /* This is FTP or HTTP+NTLM, verify that we're using the same name
-            and password as well */
-         if(!strequal(needle->user, check->user) ||
-            !strequal(needle->passwd, check->passwd)) {
-            /* one of them was different */
-            continue;
-         }
-         credentialsMatch = TRUE;
+      if((!(needle->handler->flags & PROTOPT_CREDSPERREQUEST)) ||
+         wantNTLMhttp) {
+        /* This protocol requires credentials per connection or is HTTP+NTLM,
+           so verify that we're using the same name and password as well */
+        if(!strequal(needle->user, check->user) ||
+           !strequal(needle->passwd, check->passwd)) {
+          /* one of them was different */
+          continue;
+        }
+        credentialsMatch = TRUE;
       }
 
       if(!needle->bits.httpproxy || needle->handler->flags&PROTOPT_SSL ||
@@ -3102,12 +3103,12 @@
       }
 
       if(match) {
-        /* If we are looking for an NTLM connection, check if this is already
-           authenticating with the right credentials. If not, keep looking so
-           that we can reuse NTLM connections if possible. (Especially we
-           must not reuse the same connection if partway through
-           a handshake!) */
-        if(wantNTLM) {
+        /* If we are looking for an HTTP+NTLM connection, check if this is
+           already authenticating with the right credentials. If not, keep
+           looking so that we can reuse NTLM connections if
+           possible. (Especially we must not reuse the same connection if
+           partway through a handshake!) */
+        if(wantNTLMhttp) {
           if(credentialsMatch && check->ntlm.state != NTLMSTATE_NONE) {
             chosen = check;
 
@@ -3115,8 +3116,10 @@
             *force_reuse = TRUE;
             break;
           }
-          else
-            continue;
+          else if(credentialsMatch)
+            /* this is a backup choice */
+            chosen = check;
+          continue;
         }
 
         if(canPipeline) {
Index: curl-7.35.0/lib/urldata.h
===================================================================
--- curl-7.35.0.orig/lib/urldata.h	2014-03-29 13:59:11.203519268 -0400
+++ curl-7.35.0/lib/urldata.h	2014-03-29 13:59:11.199519268 -0400
@@ -785,6 +785,8 @@
                                       gets a default */
 #define PROTOPT_NOURLQUERY (1<<6)   /* protocol can't handle
                                         url query strings (?foo=bar) ! */
+#define PROTOPT_CREDSPERREQUEST (1<<7) /* requires login creditials per request
+                                          as opposed to per connection */
 
 
 /* return the count of bytes sent, or -1 on error */
Index: curl-7.35.0/tests/data/Makefile.am
===================================================================
--- curl-7.35.0.orig/tests/data/Makefile.am	2014-03-29 13:59:11.203519268 -0400
+++ curl-7.35.0/tests/data/Makefile.am	2014-03-29 13:59:11.199519268 -0400
@@ -120,7 +120,7 @@
 \
 test1400 test1401 test1402 test1403 test1404 test1405 test1406 test1407 \
 test1408 test1409 test1410          test1412 test1413 test1414 test1415 \
-test1416 test1417 \
+test1416 test1417 test1418 test1419 \
 \
 test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
 test1508 test1509 test1510 test1511 test1512 test1513 test1514 \
Index: curl-7.35.0/tests/data/test1418
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ curl-7.35.0/tests/data/test1418	2014-03-29 13:59:23.695519603 -0400
@@ -0,0 +1,107 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP NTLM auth
+connection re-use
+</keywords>
+</info>
+# Server-side
+<reply>
+<servercmd>
+connection-monitor
+</servercmd>
+
+<data>
+HTTP/1.1 401 Authentication please!
+Content-Length: 20
+WWW-Authenticate: Digest realm="loonie", nonce="314156592"
+WWW-Authenticate: Basic
+
+Please auth with me
+</data>
+
+# This is supposed to be returned when the server gets the second
+# Authorization: NTLM line passed-in from the client
+<data1000>
+HTTP/1.1 200 Things are fine in server land
+Server: Microsoft-IIS/5.0
+Content-Length: 4
+
+moo
+</data1000>
+
+<data1003>
+HTTP/1.1 200 OK
+Server: Another one/1.0
+Content-Length: 4
+
+boo
+</data1003>
+
+# This is the first reply after the redirection
+<data1011>
+HTTP/1.1 200 OK
+Server: Microsoft-IIS/5.0
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 34
+
+This is not the real page either!
+</data1011>
+
+<datacheck>
+HTTP/1.1 401 Authentication please!
+Content-Length: 20
+WWW-Authenticate: Digest realm="loonie", nonce="314156592"
+WWW-Authenticate: Basic
+
+HTTP/1.1 200 Things are fine in server land
+Server: Microsoft-IIS/5.0
+Content-Length: 4
+
+moo
+</datacheck>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+crypto
+</features>
+ <name>
+HTTP with --anyauth and connection re-use
+ </name>
+ <command>
+http://%HOSTIP:%HTTPPORT/1418 -u testuser:testpass --anyauth http://%HOSTIP:%HTTPPORT/14180003
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^User-Agent:.*
+</strip>
+<protocol>
+GET /1418 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /1418 HTTP/1.1
+Authorization: Digest username="testuser", realm="loonie", nonce="314156592", uri="/1418", response="986238b7e0077754944c966f56d9bc77"
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /14180003 HTTP/1.1
+Authorization: Digest username="testuser", realm="loonie", nonce="314156592", uri="/14180003", response="1c6390a67bac3283a9b023402f3b3540"
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+[DISCONNECT]
+</protocol>
+</verify>
+</testcase>
Index: curl-7.35.0/tests/data/test1419
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ curl-7.35.0/tests/data/test1419	2014-03-29 13:59:27.219519697 -0400
@@ -0,0 +1,69 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP NTLM auth
+connection re-use
+</keywords>
+</info>
+# Server-side
+<reply>
+<servercmd>
+connection-monitor
+</servercmd>
+
+<data>
+HTTP/1.1 200 fine!
+Content-Length: 20
+
+Feel free to get it
+</data>
+
+<data3>
+HTTP/1.1 200 OK
+Server: Another one/1.0
+Content-Length: 4
+
+boo
+</data3>
+
+<datacheck>
+HTTP/1.1 200 fine!
+Content-Length: 20
+
+Feel free to get it
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+ <name>
+HTTP with --anyauth (but no auth!) and connection re-use
+ </name>
+ <command>
+http://%HOSTIP:%HTTPPORT/1419 --anyauth http://%HOSTIP:%HTTPPORT/14190003
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^User-Agent:.*
+</strip>
+<protocol>
+GET /1419 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+GET /14190003 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+
+[DISCONNECT]
+</protocol>
+</verify>
+</testcase>
