1157206 - ntlm problem wih server rst

Status: RESOLVED DUPLICATE of bug 1311720

(Core :: Networking, defect)

Description

[yaggoth.maergal]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Build ID: 20150402191859

Steps to reproduce:

Connect to a website throught a proxy server which use NTLM_CHALLENGE - RESPONSE process.

Reset the connexion (tcp.flag.reset = 1) while firefox is requesting the body.


Actual results:

Firefox send back the NTLM message 3 without a new phase 1 and 2.

Of course the proxy server refuse the NTLM phase 3 (response to challenge) because it doesn't send a challenge request (phase 2).

here is the full exchange between firefox and the proxy server :

1st Request : CONNECT ******:80 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Proxy-Connection: keep-alive
Connection: keep-alive
Host: ******:80

Response : HTTP/1.1 407 Unauthorized
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache
Content-Length: 129
Proxy-Authenticate: NTLM
Proxy-Authenticate: Basic realm="******:"
Date: Wed, 22 Apr 2015 08:54:46 GMT

<HTML><TITLE>Proxy Authentication Required</TITLE><H1>Authentication Failure.</H1>Please check your username and password.</HTML>

2nd Request : CONNECT ******:HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Proxy-Connection: keep-alive
Connection: keep-alive
Host: ******:80
Proxy-Authorization: NTLM ************************

2nd response : HTTP/1.1 407 Unauthorized
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache
Content-Length: 0
Proxy-Authenticate: NTLM ************************
Date: Wed, 22 Apr 2015 08:54:46 GMT

3rd request : CONNECT ******::80 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Proxy-Connection: keep-alive
Connection: keep-alive
Host: ******:80
Proxy-Authorization: NTLM ************************

3rd response : HTTP/1.1 200 Connection Established
Proxy-Agent: ****
Date: Wed, 22 Apr 2015 08:54:46 GMT

4th request : GET /ws HTTP/1.1
Host: ******
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: http://******
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: ************************
Cookie: ************************; domainCookie=************************; ismobile=no
Connection: keep-alive, Upgrade
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

CONNEXION IS RESETED HERE BY THE SERVER

5th request : CONNECT ******:80 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Proxy-Connection: keep-alive
Connection: keep-alive
Host: ******:80
Proxy-Authorization: NTLM ************************;


HTTP/1.1 407 Unauthorized
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache
Content-Length: 129
Proxy-Authenticate: NTLM
Proxy-Authenticate: Basic realm="******"
Date: Wed, 22 Apr 2015 08:54:46 GMT

<HTML><TITLE>Proxy Authentication Required</TITLE><H1>Authentication Failure.</H1>Please check your username and password.</HTML>




Expected results:

According to the RFC2616 §8.2.4 the browser should initiate a new connection to the server (NTLM phase 1 + 2 +  3) then ask the body.

At the user side, firefox ask to the user a new password and use it to encrypt the challenge it has received at the last phase 2 but this challenge isn't valid anymore leading to loop of wrong password even if the user type the right password.

On other browser : 
- Chrome don't resend a request after the tcp reset
periodically chrome try again to load it and stay in "loading" state.
- IE resend a request with correct order starting with a new phase 1.

Comment 1

[Brindusa Tot, DTE]

Update the component to Core: Networking, perhaps there's someone with extensive knowledge on this area that might be able to help here.