From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 27 Apr 2026 07:14:51 +0000 (+0200)
Subject: [PATCH] setopt: clear proxy auth properties when switching
X-Git-Tag: archive/raspbian/7.88.1-10+rpi1+deb12u15^2~7
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=bf808b8641d5d4ce5ca8b1d08a5e586021b9e44c;p=curl.git

[PATCH] setopt: clear proxy auth properties when switching

Verify with test 1588

Closes #21453

Backported-by: Samuel Henrique <samueloph@debian.org>
 * lib/setopt.c: upstream's CURLOPT_PROXY case lives in a dedicated
   setopt_cptr_proxy() function; in 8.14.1 it is still inline in the
   setopt_cptr() switch. The setproxy() helper is added directly
   above setopt_cptr() and the inline Curl_setstropt() call is
   swapped for setproxy().
 * lib/vauth/vauth.h: upstream's hunk also adds a no-op
   Curl_auth_is_digest_supported() macro to the CURL_DISABLE_DIGEST_AUTH
   branch, but our 8.14.1 vauth.h has no such #else branch (the file
   ends the digest block with a bare #endif). Add only the
   Curl_auth_digest_cleanup(x) no-op macro inside a new #else, which
   is the part actually needed by setproxy() in disable-digest builds.
 * tests/data/test1588: regression test from upstream with two changes:
   crlf="headers" -> crlf="yes" so the 8.14.1 test runner correctly
   applies CRLF to header lines on both the server-side data and the
   expected protocol block; and the "digest" entry in <features> is
   dropped because the 8.14.1 curlinfo emits the feature toggle as
   "digest-auth" rather than "digest", so the unmodified feature gate
   would always SKIP the test on this branch. Other digest-auth tests
   (e.g. test1061) similarly do not list "digest" as a required
   feature.
 * tests/libtest/lib1588.c: rewritten to use the 8.14.1 libtest
   harness (test.h / CURLcode test(char *URL) / easy_init / easy_setopt
   with goto test_cleanup) instead of upstream's newer first.h-based
   one. The init1588() helper also reuses the parent's test_cleanup
   label rather than upstream's separate init_failed label, since
   8.14.1's easy_setopt jumps directly to test_cleanup.

Backported by: Samuel Henrique <samueloph@debian.org>
 * Bookworm 7.88.1: lib/setopt.c is a single Curl_vsetopt() function
   with one big switch (no setopt_cptr() sub-switch like trixie).
   Add the setproxy() helper just above Curl_vsetopt() instead, and
   replace the inline Curl_setstropt() in the CURLOPT_PROXY case
   with `result = setproxy(data, va_arg(param, char *));`.
 * lib/vauth/vauth.h: bookworm uses CURL_DISABLE_CRYPTO_AUTH (the
   pre-split spelling) instead of CURL_DISABLE_DIGEST_AUTH. Add the
   no-op Curl_auth_digest_cleanup(x) macro under the matching
   #else branch.
 * Drop the test additions: bookworm has neither the test1588
   xml-test infrastructure for CONNECT-based digest replay nor the
   modern libtest harness (test.h / CURLcode test(char *URL)) the
   trixie adaptation rewrote against -- backporting the test would
   require touching the test runner setup more aggressively than is
   appropriate for a stable update. The security property (proxy
   auth state cleared on CURLOPT_PROXY change) is the setproxy()
   helper itself.

Gbp-Pq: Name CVE-2026-7168.patch
---

diff --git a/lib/setopt.c b/lib/setopt.c
index 8862e0ce..4a40a09c 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -50,6 +50,7 @@
 #include "multiif.h"
 #include "altsvc.h"
 #include "hsts.h"
+#include "vauth/vauth.h"
 
 /* The last 3 #include files should be in this order */
 #include "curl_printf.h"
@@ -186,6 +187,20 @@ static CURLcode protocol2num(const char *str, curl_prot_t *val)
   return CURLE_OK;
 }
 
+#ifndef CURL_DISABLE_PROXY
+static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
+{
+  if((data->set.str[STRING_PROXY] && proxy) &&
+     /* there was one set, is this a new one? */
+     !strcmp(data->set.str[STRING_PROXY], proxy))
+    return CURLE_OK; /* same one as before */
+
+  Curl_auth_digest_cleanup(&data->state.proxydigest);
+  memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
+  return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
+}
+#endif
+
 /*
  * Do not make Curl_vsetopt() static: it is called from
  * packages/OS400/ccsidcurl.c.
@@ -1140,8 +1155,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
      * Setting it to NULL, means no proxy but allows the environment variables
      * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
      */
-    result = Curl_setstropt(&data->set.str[STRING_PROXY],
-                            va_arg(param, char *));
+    result = setproxy(data, va_arg(param, char *));
     break;
 
   case CURLOPT_PRE_PROXY:
diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
index e17d7aad..8c09764b 100644
--- a/lib/vauth/vauth.h
+++ b/lib/vauth/vauth.h
@@ -119,6 +119,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
 
 /* This is used to clean up the digest specific data */
 void Curl_auth_digest_cleanup(struct digestdata *digest);
+#else
+#define Curl_auth_digest_cleanup(x)
 #endif /* !CURL_DISABLE_CRYPTO_AUTH */
 
 #ifdef USE_GSASL