|
 |
fdd391 |
From 7dbd01e4815727ce46de0b5d6c2916fec9154196 Mon Sep 17 00:00:00 2001
|
|
|
fdd391 |
From: Petr Stodulka <pstodulk@redhat.com>
|
|
|
fdd391 |
Date: Mon, 5 Dec 2016 16:49:09 +0100
|
|
|
fdd391 |
Subject: [PATCH] http: control GSSAPI credential delegation
|
|
|
fdd391 |
|
|
|
fdd391 |
Delegation of credentials is disabled by default in libcurl since
|
|
|
fdd391 |
version 7.21.7 due to security vulnerability CVE-2011-2192. Which
|
|
|
fdd391 |
makes troubles with GSS/kerberos authentication when delegation
|
|
|
fdd391 |
of credentials is required. This can be changed with option
|
|
|
fdd391 |
CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter
|
|
|
fdd391 |
since libcurl version 7.22.0.
|
|
|
fdd391 |
|
|
|
fdd391 |
This patch provides new configuration variable http.delegation
|
|
|
fdd391 |
which corresponds to curl parameter "--delegation" (see man 1 curl).
|
|
|
fdd391 |
|
|
|
fdd391 |
The following values are supported:
|
|
|
fdd391 |
|
|
|
fdd391 |
* none (default).
|
|
|
fdd391 |
* policy
|
|
|
fdd391 |
* always
|
|
|
fdd391 |
---
|
|
|
fdd391 |
http.c | 38 ++++++++++++++++++++++++++++++++++++++
|
|
|
fdd391 |
1 file changed, 38 insertions(+)
|
|
|
fdd391 |
|
|
|
fdd391 |
diff --git a/http.c b/http.c
|
|
|
fdd391 |
index a1c7dcb..e7c77c0 100644
|
|
|
fdd391 |
--- a/http.c
|
|
|
fdd391 |
+++ b/http.c
|
|
|
fdd391 |
@@ -66,6 +66,19 @@ static struct curl_slist *no_pragma_header;
|
|
|
fdd391 |
|
|
|
fdd391 |
static struct active_request_slot *active_queue_head;
|
|
|
fdd391 |
|
|
|
fdd391 |
+#if LIBCURL_VERSION_NUM >= 0x071600
|
|
|
fdd391 |
+static const char *curl_deleg;
|
|
|
fdd391 |
+static struct {
|
|
|
fdd391 |
+ const char *name;
|
|
|
fdd391 |
+ long curl_deleg_param;
|
|
|
fdd391 |
+} curl_deleg_levels[] = {
|
|
|
fdd391 |
+ { "none", CURLGSSAPI_DELEGATION_NONE },
|
|
|
fdd391 |
+ { "policy", CURLGSSAPI_DELEGATION_POLICY_FLAG },
|
|
|
fdd391 |
+ { "always", CURLGSSAPI_DELEGATION_FLAG },
|
|
|
fdd391 |
+};
|
|
|
fdd391 |
+#endif
|
|
|
fdd391 |
+
|
|
|
fdd391 |
+
|
|
|
fdd391 |
size_t fread_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)
|
|
|
fdd391 |
{
|
|
|
fdd391 |
size_t size = eltsize * nmemb;
|
|
|
fdd391 |
@@ -169,6 +182,16 @@ static int http_options(const char *var, const char *value, void *cb)
|
|
|
fdd391 |
curl_ssl_try = git_config_bool(var, value);
|
|
|
fdd391 |
return 0;
|
|
|
fdd391 |
}
|
|
|
fdd391 |
+
|
|
|
fdd391 |
+ if (!strcmp("http.delegation", var)) {
|
|
|
fdd391 |
+#if LIBCURL_VERSION_NUM >= 0x071600
|
|
|
fdd391 |
+ return git_config_string(&curl_deleg, var, value);
|
|
|
fdd391 |
+#else
|
|
|
fdd391 |
+ warning("Delegation control is not supported with cURL < 7.22.0");
|
|
|
fdd391 |
+ return 0;
|
|
|
fdd391 |
+#endif
|
|
|
fdd391 |
+ }
|
|
|
fdd391 |
+
|
|
|
fdd391 |
if (!strcmp("http.minsessions", var)) {
|
|
|
fdd391 |
min_curl_sessions = git_config_int(var, value);
|
|
|
fdd391 |
#ifndef USE_CURL_MULTI
|
|
|
fdd391 |
@@ -271,6 +294,21 @@ static CURL *get_curl_handle(void)
|
|
|
fdd391 |
#ifdef LIBCURL_CAN_HANDLE_AUTH_ANY
|
|
|
fdd391 |
curl_easy_setopt(result, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
|
|
|
fdd391 |
#endif
|
|
|
fdd391 |
+#if LIBCURL_VERSION_NUM >= 0x071600
|
|
|
fdd391 |
+ if (curl_deleg) {
|
|
|
fdd391 |
+ int i;
|
|
|
fdd391 |
+ for (i = 0; i < ARRAY_SIZE(curl_deleg_levels); i++) {
|
|
|
fdd391 |
+ if (!strcmp(curl_deleg, curl_deleg_levels[i].name)) {
|
|
|
fdd391 |
+ curl_easy_setopt(result, CURLOPT_GSSAPI_DELEGATION,
|
|
|
fdd391 |
+ curl_deleg_levels[i].curl_deleg_param);
|
|
|
fdd391 |
+ break;
|
|
|
fdd391 |
+ }
|
|
|
fdd391 |
+ }
|
|
|
fdd391 |
+ if (i == ARRAY_SIZE(curl_deleg_levels))
|
|
|
fdd391 |
+ warning("Unknown delegation method '%s': using default",
|
|
|
fdd391 |
+ curl_deleg);
|
|
|
fdd391 |
+ }
|
|
|
fdd391 |
+#endif
|
|
|
fdd391 |
|
|
|
fdd391 |
if (http_proactive_auth)
|
|
|
fdd391 |
init_curl_http_auth(result);
|
|
|
fdd391 |
--
|
|
|
fdd391 |
2.5.5
|
|
|
fdd391 |
|