bug#4883: 23.1; url-http: wrong server name used for pwd lookup during proxy authentication

[Kai Tetzlaff]

Hi Ted,

I'm not sure why, but also my last post below never made it to the list.
I also sent it to you directly but did not get any reply so i assume
that it also got lost. I don't get why, but i'm trying again.

In addition to what i wrote below, i've now actually tested the url code
with a double auth. scenario (proxy auth + auth at url target). It
actually works fine without any further changes!

When you wrote your message suggesting to rework the patch, what problem
did you had in mind? Is there some other scenario which needs testing?

BR,
Kai



At Tue, 17 Nov 2009 09:19:00 -0600,
Ted Zlatanov wrote:
> >
> > The following message is a courtesy copy of an article
> > that has been posted to gnu.emacs.bug as well.
> >
> > On Tue, 10 Nov 2009 14:07:39 -0600 Ted Zlatanov <tzz@lifelogs.com>
wrote:
> >
> > TZ> On Sat, 07 Nov 2009 12:43:01 +0100 Kai Tetzlaff
<kai.tetzlaff@web.de> wrote:
> > KT> There might be a better solution from someone who has a deeper
understanding
> > KT> of the code in the url lib. But the following solves the problem
- at least
> > KT> for my case:
> > KT> Index: lisp/url/url-http.el
> > KT> ===================================================================
> > KT> RCS file: /cvsroot/emacs/emacs/lisp/url/url-http.el,v
> > KT> retrieving revision 1.64
> > KT> diff -u -r1.64 url-http.el
> > KT> --- lisp/url/url-http.el        1 Oct 2009 02:06:55 -0000       1.64
> > KT> +++ lisp/url/url-http.el        6 Nov 2009 10:25:02 -0000
> > KT> @@ -315,12 +315,16 @@
> > KT> '("basic")))
> > KT> (type nil)
> > KT> (url (url-recreate-url url-current-object))
> > KT> -       (url-basic-auth-storage 'url-http-real-basic-auth-storage)
> > KT> +       (auth-url (url-recreate-url
> > KT> +                  (if (and proxy (boundp 'url-http-proxy))
> > KT> +                      url-http-proxy
> > KT> +                    url-current-object)))
> > KT> +       (url-basic-auth-storage (if proxy
> > KT> +                                   ;; Cheating, but who cares?  :)
> > KT> +                                   'url-http-proxy-basic-auth-storage
> > KT> +                                 'url-http-real-basic-auth-storage))
> > KT> auth
> > KT> (strength 0))
> > KT> -    ;; Cheating, but who cares?  :)
> > KT> -    (if proxy
> > KT> -       (setq url-basic-auth-storage 
> > 'url-http-proxy-basic-auth-storage))
> >
> > KT> ;; find strongest supported auth
> > KT> (dolist (this-auth auths)
> > KT> @@ -347,7 +351,7 @@
> > KT> " send it to " url-bug-address ".<hr>")
> > KT> (setq status t))
> > KT> (let* ((args (url-parse-args (subst-char-in-string ?, ?\; auth)))
> > KT> -            (auth (url-get-authentication url (cdr-safe (assoc
"realm" args))
> > KT> +            (auth (url-get-authentication auth-url (cdr-safe (assoc
"realm" args))
> > KT> type t args)))
> > KT> (if (not auth)
> > KT> (setq success t)
> >
> > TZ> I introduced the auth-source hooks in url-http.el but the
question of
> > TZ> which URL needs to be authenticated is not something I
considered.  Can
> > TZ> we hook the auth at a lower point?  I'm concerned that if the
proxy and
> > TZ> the destination URL both need authentication, your proposal
won't work.
> >
> > Kai, can you please follow up with your opinion?
> >
> > Thanks
> > Ted
> >

Hi Ted,

thanks for lookin into this! I already send a reply a week ago - at
least i thought so. But somehow i now cannot find any trace of it.
Something must have gone wrong...

Back to the problem - i'm not sure what exactly is supposed to happen in
the situation where proxy and final destination URL both require
authentication. But i suppose, that the HTTP requests then need to
contain two sets of credentials. And you're probably right that this
currently would not work.

As i already wrote, i've so far just scratched at the surface of the
code in the url lib. More or less just enough to create aboves patch.
What did you have in mind with "...hook the auth at a lower point"? How
should we continue from here? For a start, I could just try what the
current url code actually does.

While looking at the previous problem, i was just using irfc to retrieve
RFC documents via HTTP through the proxy at work. To set up a test
environment for double authentication i could potentially just modify
the irfc configuration to point to a server that also requires
authentication. But there are probably better ways to do this? I also
wanted to ask if you know of a server which could be used for testing,
but then thought i'll check myself shortly. And - how could it be any
different - i actually found some sites which provide authentication
test pages (e.g. http://test.webdav.org/ (not sure if its really
working) or http://koivi.com/php-http-auth/).

Given that, it should not be difficult for me to do the first step (i.e.
just check how the current code deals with double auth). If, as is
expected, it does not work i could probably use some advice on how to
continue. Can you suggest a good entry point? Would you want to spent
some time on it yourself?


Kai