aboutsummaryrefslogtreecommitdiff
path: root/lib/curl_ntlm_core.c
AgeCommit message (Collapse)Author
2020-06-16ntlm: enable NTLM support with wolfSSLRuurd Beerstra
When wolfSSL is built with its OpenSSL API layer, it fetures the same DES* functions that OpenSSL has. This change take advantage of that. Co-authored-by: Daniel Stenberg Closes #5556 Fixes #5548
2020-03-17windows: suppress UI in all CryptAcquireContext() callsViktor Szakats
Ref: https://docs.microsoft.com/windows/win32/api/wincrypt/nf-wincrypt-cryptacquirecontexta#parameters Reviewed-by: Marc Hörsken Closes https://github.com/curl/curl/pull/5088
2020-02-24ntlm: Moved the HMAC MD5 function into the HMAC module as a generic functionSteve Holme
2019-08-04md4: Use our own MD4 implementation when no crypto libraries are availableSteve Holme
Closes #3780
2019-08-04md4: No need to include Curl_md4.h for each TLS librarySteve Holme
2019-08-04md4: No need for the NTLM code to call Curl_md4it() for each TLS librarySteve Holme
As the NTLM code no longer calls any of TLS libraries' specific MD4 functions, there is no need to call this function for each #ifdef.
2019-08-04md4: Move the mbed TLS MD4 implementation out of the NTLM codeSteve Holme
2019-08-04md4: Move the WinCrypt implementation out of the NTLM codeSteve Holme
2019-08-04md4: Move the SecureTransport implementation out of the NTLM codeSteve Holme
2019-08-04md4: Use the Curl_md4it() function for OpenSSL based NTLMSteve Holme
2019-08-04md4: Move the GNU TLS gcrypt MD4 implementation out of the NTLM codeSteve Holme
2019-08-04md4: Move the GNU TLS Nettle MD4 implementation out of the NTLM codeSteve Holme
2019-07-31ntlm: explicit type castinglufia
2019-06-05build: fix Codacy warningsMarcel Raad
Reduce variable scopes and remove redundant variable stores. Closes https://github.com/curl/curl/pull/3975
2019-04-23ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4Steve Holme
Just like we do for mbed TLS, use our local implementation of MD4 when OpenSSL doesn't support it. This allows a type-3 message to include the NT response.
2019-02-28Secure Transport: no more "darwinssl"Daniel Stenberg
Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-10cleanup: make local functions staticDaniel Stenberg
urlapi: turn three local-only functions into statics conncache: make conncache_find_first_connection static multi: make detach_connnection static connect: make getaddressinfo static curl_ntlm_core: make hmac_md5 static http2: make two functions static http: make http_setup_conn static connect: make tcpnodelay static tests: make UNITTEST a thing to mark functions with, so they can be static for normal builds and non-static for unit test builds ... and mark Curl_shuffle_addr accordingly. url: make up_free static setopt: make vsetopt static curl_endian: make write32_le static rtsp: make rtsp_connisdead static warnless: remove unused functions memdebug: remove one unused function, made another static
2018-11-23snprintf: renamed and we now only use msnprintf()Daniel Stenberg
The function does not return the same value as snprintf() normally does, so readers may be mislead into thinking the code works differently than it actually does. A different function name makes this easier to detect. Reported-by: Tomas Hoger Assisted-by: Daniel Gustafsson Fixes #3296 Closes #3297
2018-11-20ntlm: Remove redundant ifdef USE_OPENSSLpkubaj
lib/curl_ntlm.c had code that read as follows: #ifdef USE_OPENSSL # ifdef USE_OPENSSL # else # .. # endif #endif Remove the redundant USE_OPENSSL along with #else (it's not possible to reach it anyway). The removed construction is a leftover from when the SSLeay support was removed. Closes #3269 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2018-09-03Curl_ntlm_core_mk_nt_hash: return error on too long passwordDaniel Stenberg
... since it would cause an integer overflow if longer than (max size_t / 2). This is CVE-2018-14618 Bug: https://curl.haxx.se/docs/CVE-2018-14618.html Closes #2756 Reported-by: Zhaoyang Wu
2018-04-15all: Refactor malloc+memset to use callocDaniel Gustafsson
When a zeroed out allocation is required, use calloc() rather than malloc() followed by an explicit memset(). The result will be the same, but using calloc() everywhere increases consistency in the codebase and avoids the risk of subtle bugs when code is injected between malloc and memset by accident. Closes https://github.com/curl/curl/pull/2497
2018-03-20vauth/cleartext: fix integer overflow checkDaniel Stenberg
Make the integer overflow check not rely on the undefined behavior that a size_t wraps around on overflow. Detected by lgtm.com Closes #2408
2017-11-27curl_ntlm_core.c: use the limits.h's SIZE_T_MAX if providedDaniel Stenberg
2017-11-27ntlm: avoid integer overflow for malloc sizeDaniel Stenberg
Reported-by: Alex Nichols Assisted-by: Kamil Dudka and Max Dymond CVE-2017-8816 Bug: https://curl.haxx.se/docs/adv_2017-11e7.html
2017-11-04ntlm: avoid malloc(0) for zero length passwordsDaniel Stenberg
It triggers an assert() when built with memdebug since malloc(0) may return NULL *or* a valid pointer. Detected by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4054 Assisted-by: Max Dymond Closes #2054
2017-09-22ntlm: use strict order for SSL backend #if branchesViktor Szakats
With the recently introduced MultiSSL support multiple SSL backends can be compiled into cURL That means that now the order of the SSL One option would be to use the same SSL backend as was configured via `curl_global_sslset()`, however, NTLMv2 support would appear to be available only with some SSL backends. For example, when eb88d778e (ntlm: Use Windows Crypt API, 2014-12-02) introduced support for NTLMv1 using Windows' Crypt API, it specifically did *not* introduce NTLMv2 support using Crypt API at the same time. So let's select one specific SSL backend for NTLM support when compiled with multiple SSL backends, using a priority order such that we support NTLMv2 even if only one compiled-in SSL backend can be used for that. Ref: https://github.com/curl/curl/pull/1848
2017-09-11code style: use spaces around plusesDaniel Stenberg
2017-06-05curl_ntlm_core: use Curl_raw_toupper instead of toupperMarcel Raad
This was the only remaining use of toupper in the entire source code. Suggested-by: Daniel Stenberg
2017-06-04curl_ntlm_core: pass unsigned char to toupperMarcel Raad
Otherwise, clang on Cygwin64 warns: curl_ntlm_core.c:525:35: error: array subscript is of type 'char' [-Werror,-Wchar-subscripts] dest[2 * i] = (unsigned char)(toupper(src[i])); ^~~~~~~~~~~~~~~ /usr/include/ctype.h:152:25: note: expanded from macro 'toupper' (void) __CTYPE_PTR[__x]; (toupper) (__x);}) ^~~~
2017-04-21mbedtls: enable NTLM (& SMB) even if MD4 support is unavailableDan Fandrich
In that case, use libcurl's internal MD4 routine. This fixes tests 1013 and 1014 which were failing due to configure assuming NTLM and SMB were always available whenever mbed TLS was in use (which is now true).
2017-03-29NTLM: check for features with #ifdef instead of #ifMarcel Raad
Feature defines are normally checked with #ifdef instead of #if in the rest of the codebase. Additionally, some compilers warn when a macro is implicitly evaluated to 0 because it is not defined, which was the case here. Ref: https://github.com/curl/curl/pull/1362#discussion_r108605101 Closes https://github.com/curl/curl/pull/1367
2017-02-19string formatting: fix 4 printf-style format stringsMichael Kaufmann
2017-02-06use *.sourceforge.io and misc URL updatesViktor Szakats
Ref: https://sourceforge.net/blog/introducing-https-for-project-websites/ Closes: https://github.com/curl/curl/pull/1247
2016-12-13checksrc: stricter no-space-before-paren enforcementDaniel Stenberg
In order to make the code style more uniform everywhere
2016-10-31strcasecompare: all case insensitive string compares ignore locale nowDaniel Stenberg
We had some confusions on when each function was used. We should not act differently on different locales anyway.
2016-08-03mbedtls: Added support for NTLMBill Nagel
2016-06-22internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg
2016-04-29lib: include curl_printf.h as one of the last headersDaniel Stenberg
curl_printf.h defines printf to curl_mprintf, etc. This can cause problems with external headers which may use __attribute__((format(printf, ...))) markers etc. To avoid that they cause problems with system includes, we include curl_printf.h after any system headers. That makes the three last headers to always be, and we keep them in this order: curl_printf.h curl_memory.h memdebug.h None of them include system headers, they all do funny #defines. Reported-by: David Benjamin Fixes #743
2016-04-06URLs: change http to https in many placesViktor Szakats
Closes #754
2016-02-09openssl: remove most BoringSSL #ifdefs.David Benjamin
As of https://boringssl-review.googlesource.com/#/c/6980/, almost all of BoringSSL #ifdefs in cURL should be unnecessary: - BoringSSL provides no-op stubs for compatibility which replaces most #ifdefs. - DES_set_odd_parity has been in BoringSSL for nearly a year now. Remove the compatibility codepath. - With a small tweak to an extend_key_56_to_64 call, the NTLM code builds fine. - Switch OCSP-related #ifdefs to the more generally useful OPENSSL_NO_OCSP. The only #ifdefs which remain are Curl_ossl_version and the #undefs to work around OpenSSL and wincrypt.h name conflicts. (BoringSSL leaves that to the consumer. The in-header workaround makes things sensitive to include order.) This change errs on the side of removing conditionals despite many of the restored codepaths being no-ops. (BoringSSL generally adds no-op compatibility stubs when possible. OPENSSL_VERSION_NUMBER #ifdefs are bad enough!) Closes #640
2016-02-03URLs: change all http:// URLs to https://Daniel Stenberg
2015-11-05curl_ntlm_core: fix 2 curl_off_t constant overflows.Patrick Monnerat
2015-10-09ntlm: error out without 64bit support as the code needs itDaniel Stenberg
It makes it a clearer message for developers reaching that point without the necessary support. Thanks-by: Jay Satiro Closes #78
2015-10-08ntlm: get rid of unconditional use of long longDaniel Stenberg
... since some compilers don't have it and instead use other types, such as __int64. Reported by: gkinseyhpw Closes #478
2015-08-22NTLM: recent boringssl brought DES_set_odd_parity backDaniel Stenberg
... so improve the #ifdefs for using our local implementation.
2015-03-24curl_memory: make curl_memory.h the second-last header file loadedDan Fandrich
This header file must be included after all header files except memdebug.h, as it does similar memory function redefinitions and can be similarly affected by conflicting definitions in system or dependent library headers.
2015-03-16free: instead of Curl_safefree()Daniel Stenberg
Since we just started make use of free(NULL) in order to simplify code, this change takes it a step further and: - converts lots of Curl_safefree() calls to good old free() - makes Curl_safefree() not check the pointer before free() The (new) rule of thumb is: if you really want a function call that frees a pointer and then assigns it to NULL, then use Curl_safefree(). But we will prefer just using free() from now on.
2015-03-05openssl: remove all uses of USE_SSLEAYDaniel Stenberg
SSLeay was the name of the library that was subsequently turned into OpenSSL many moons ago (1999). curl does not work with the old SSLeay library since years. This is now reflected by only using USE_OPENSSL in code that depends on OpenSSL.
2015-03-03mprintf.h: remove #ifdef CURLDEBUGDaniel Stenberg
... and as a consequence, introduce curl_printf.h with that re-define magic instead and make all libcurl code use that instead.
2015-02-03unit1600: unit test for Curl_ntlm_core_mk_nt_hashDaniel Stenberg
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-01 23:26:01 +0000