Граф коммитов

26 Коммитов

Автор SHA1 Сообщение Дата
max.mehl ad9bc5976d
copyright: make repository REUSE compliant
Add licensing and copyright information for all files in this repository. This
either happens in the file itself as a comment header or in the file
`.reuse/dep5`.

This commit also adds a Github workflow to check pull requests and adapts
copyright.pl to the changes.

Closes #8869
2022-06-13 09:13:00 +02:00
Patrick Monnerat 7da2990b19
auth: do not append zero-terminator to authorisation id in kerberos
RFC4752 Section 3.1 states "The authorization identity is not terminated
with a zero-valued (%x00) octet". Although a comment in code said it may
be needed anyway, nothing confirms it. In addition, servers may consider
it as part of the identity, causing a failure.

Closes #7008
2021-08-16 08:36:10 +02:00
Patrick Monnerat 396a2d7fe3
auth: use sasl authzid option in kerberos
... instead of deriving it from active ticket.
Closes #7008
2021-08-16 08:36:06 +02:00
Patrick Monnerat 0a1c85e39b
auth: we do not support a security layer after kerberos authentication
Closes #7008
2021-08-16 08:36:03 +02:00
Patrick Monnerat 3f9b1d0c9d
auth: properly handle byte order in kerberos security message
Closes #7008
2021-08-16 08:35:55 +02:00
Daniel Stenberg e7416cfd2b
infof: remove newline from format strings, always append it
- the data needs to be "line-based" anyway since it's also passed to the
  debug callback/application

- it makes infof() work like failf() and consistency is good

- there's an assert that triggers on newlines in the format string

- Also removes a few instances of "..."

- Removes the code that would append "..." to the end of the data *iff*
  it was truncated in infof()

Closes #7357
2021-07-07 22:54:01 +02:00
Patrick Monnerat 19ea52da4d
vauth: factor base64 conversions out of authentication procedures
Input challenges and returned messages are now in binary.
Conversions from/to base64 are performed by callers (currently curl_sasl.c
and http_ntlm.c).

Closes #6654
2021-04-22 09:06:07 +02:00
Daniel Stenberg ac0a88fd25
copyright: fix year ranges
Follow-up from 4d2f800677
2020-11-05 08:22:10 +01:00
Daniel Stenberg 4d2f800677
curl.se: new home
Closes #6172
2020-11-04 23:59:47 +01:00
Jay Satiro dca6f73613 vauth: Use CURLE_AUTH_ERROR for auth function errors
- Add new error code CURLE_AUTH_ERROR.

Prior to this change auth function errors were signaled by
CURLE_OUT_OF_MEMORY and CURLE_RECV_ERROR, and neither one was
technically correct.

Ref: https://github.com/curl/curl/pull/3848

Co-authored-by: Dominik Hölzl

Closes https://github.com/curl/curl/pull/3864
2019-08-14 03:14:01 -04:00
Steve Holme 52dfab65d6
auth: Rename the various authentication clean up functions
For consistency and to a avoid confusion.

Closes #3869
2019-05-12 18:37:00 +01:00
Daniel Gustafsson e182fc1613 comment: Fix multiple typos in function parameters
Ensure that the parameters in the comment match the actual names in the
prototype.

Closes #3079
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2018-10-03 10:27:27 +02:00
klemens f7df67cff0 spelling fixes
Closes #1356
2017-03-26 23:56:23 +02:00
Steve Holme a0f212946b vauth: Introduced Curl_auth_is_<mechansism>_supported() functions
As Windows SSPI authentication calls fail when a particular mechanism
isn't available, introduced these functions for DIGEST, NTLM, Kerberos 5
and Negotiate to allow both HTTP and SASL authentication the opportunity
to query support for a supported mechanism before selecting it.

For now each function returns TRUE to maintain compatability with the
existing code when called.
2016-08-18 20:31:20 +01:00
Daniel Stenberg 434f8d0389 internals: rename the SessionHandle struct to Curl_easy 2016-06-22 10:28:41 +02:00
Steve Holme cbc52ff341 vauth: Corrected a number of typos in comments
Reported-by: Michael Osipov
2016-04-06 00:21:07 +01:00
Steve Holme 9feb2676a4 vauth: Removed the need for a separate GSS-API based SPN function 2016-04-03 20:26:03 +01:00
Steve Holme 1d451bdd99 krb5: Small code tidy up
* Prefer dereference of string pointer rather than strlen()
* Free challenge pointer in one place
* Additional comments
2016-04-03 17:30:51 +01:00
Steve Holme 156b8287a7 krb5_gssapi: Only process challenge when present
This wouldn't cause a problem because of the way the function is called,
but prior to this change, we were processing the challenge message when
the credentials were NULL rather than when the challenge message was
populated.

This also brings this part of the Kerberos 5 code in line with the
Negotiate code.
2016-04-03 17:17:20 +01:00
Steve Holme 73f1096335 krb5: Fixed missing client response when mutual authentication enabled
Although mutual authentication is currently turned off and can only be
enabled by changing libcurl source code, authentication using Kerberos
5 has been broken since commit 79543caf90 in this use case.
2016-04-03 17:02:44 +01:00
Steve Holme 2d2c67e3ed krb5: Only generate a SPN when its not known
Prior to this change, we were generating the SPN in the SSPI code when
the credentials were NULL and in the GSS-API code when the context was
empty. It is better to decouple the SPN generation from these checks
and only generate it when the SPN itself is NULL.

This also brings this part of the Kerberos 5 code in line with the
Negotiate code.
2016-04-03 11:15:03 +01:00
Steve Holme 9173dc0682 krb5_gssapi: Renamed the status variables
For consistency with the spnego code.
2016-04-02 06:25:30 +01:00
Steve Holme ced0cbb5b7 krb5: Moved host from Curl_auth_create_gssapi_user_message() to be argument
For consistency with the spnego and oauth2 code moved the setting of
the host name outside of the Curl_auth_create_gssapi_user_messag()
function.

This will allow us to more easily override it in the future.
2016-04-02 06:15:29 +01:00
Isaac Boukris d5fc6e14b0 GSS: make Curl_gss_log_error more verbose
Also display the GSS_C_GSS_CODE (major code) when specified instead of
only GSS_C_MECH_CODE (minor code).

In addition, the old code was printing a colon twice after the prefix
and also miscalculated the length of the buffer in between calls to
gss_display_status (the length of ": " was missing).

Also, gss_buffer is not guaranteed to be NULL terminated and thus need
to restrict reading by its length.

Closes #738
2016-03-29 16:51:29 +02:00
Steve Holme 58a7bc96ec vauth: Refactored function names after move to new vauth directory
Renamed all the SASL functions that moved to the new vauth directory to
include the correct module name.
2016-03-25 17:40:12 +00:00
Steve Holme e1dca8a117 vauth: Moved the Kerberos V5 authentication code to the new vauth directory 2016-03-25 15:11:07 +00:00