Skip to content

Detect redirection command in failed authentication response #1318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rmilecki wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Detect redirection command in failed authentication response #1318

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
75f4d34
Check authentication result (return value)
Nov 20, 2025
12fc457
Merge remote-tracking branch 'rmilecki/auth-check-ret' into HEAD
Nov 26, 2025
8a742ec
Detect redirection command in failed authentication response
Nov 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions src/http.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -637,6 +637,7 @@ int auth_log_in(struct tunnel *tunnel)
char username[3 * USERNAME_SIZE + 1];
char password[3 * PASSWORD_SIZE + 1];
char realm[3 * REALM_SIZE + 1];
char auth_ret_text[8];
char reqid[32] = { '\0' };
char polid[32] = { '\0' };
char group[128] = { '\0' };
Expand Down Expand Up @@ -714,6 +715,47 @@ int auth_log_in(struct tunnel *tunnel)
if (ret != 1)
goto end;

ret = get_value_from_response(res, "ret=", auth_ret_text, 8);
if (ret == 1) {
int auth_ret = strtol(auth_ret_text, NULL, 10);
char redir[128];

switch (auth_ret) {
case 0:
log_error("Authentication failed\n");

ret = get_value_from_response(res, "redir=", redir, 128);
if (ret == 1) {
const char *err_start;

log_debug("Received redirection: \"%s\"\n", redir);

/* Check for error value in the redirection URL */
err_start = strstr(redir, "err=");
if (err_start) {
const char *err_end = strstr(err_start, "&");

log_error("Authentication ended up in redirection with error value: \"%.*s\"\n",
err_end ? err_end - err_start - 4 : -1,
err_start + 4);
}
}

ret = ERR_HTTP_PERMISSION;
goto end;
case 1:
log_debug("Authentication succeeded\n");
break;
case 6:
log_error("Gateway replied to authentication with a challenge that is unsupported right now\n");
ret = ERR_HTTP_PERMISSION;
goto end;
default:
log_warn("Unknown authentication result: %d\n", auth_ret);
break;
}
}

/* Probably one-time password required */
if (strncmp(res, "HTTP/1.1 401 Authorization Required\r\n", 37) == 0) {
delay_otp(tunnel);
Expand Down