aboutsummaryrefslogtreecommitdiff
path: root/lib/http_ntlm.c
AgeCommit message (Collapse)Author
2008-08-11- Constantine Sapuntzakis filed bug report #2042430Daniel Stenberg
(http://curl.haxx.se/bug/view.cgi?id=2042430) with a patch. "NTLM Windows SSPI code is not thread safe". This was due to libcurl using static variables to tell wether to load the necessary SSPI DLL, but now the loading has been moved to the more suitable curl_global_init() call.
2007-11-05removed space after if and while before the parenthesis for better source codeDaniel Stenberg
consistency
2007-09-27Enabled a few more gcc warnings with --enable-debug. Renamed a fewDan Fandrich
variables to avoid shadowing global declarations.
2007-08-27Fixed some minor type mismatches and missing consts mainly found by splint.Dan Fandrich
2007-08-14Andrew Wansink provided an NTLM bugfix: in the case the server sets the flagDaniel Stenberg
NTLMFLAG_NEGOTIATE_UNICODE, we need to filter it off because libcurl doesn't unicode encode the strings it packs into the NTLM authenticate packet.
2007-07-11added netdb.h for NetWare CLIB since gethostname() is defined there.Gunter Knauf
2007-04-10Fixed some out of memory handling issues.Dan Fandrich
2007-04-10Update NTLM flag and descriptionYang Tse
2007-04-04Fixes some more out of memory handling bugs.Dan Fandrich
2007-02-21silence two cases of "comparison between signed and unsigned"Daniel Stenberg
2007-02-21curlassert macro replaced with DEBUGASSERT macro defined in setup_once.hYang Tse
2007-01-23- David McCreedy did NTLM changes mainly for non-ASCII platforms:Daniel Stenberg
#1 There's a compilation error in http_ntlm.c if USE_NTLM2SESSION is NOT defined. I noticed this while testing various configurations. Line 867 of the current http_ntlm.c is a closing bracket for an if/else pair that only gets compiled in if USE_NTLM2SESSION is defined. But this closing bracket wasn't in an #ifdef so the code fails to compile unless USE_NTLM2SESSION was defined. Lines 198 and 140 of my patch wraps that closing bracket in an #ifdef USE_NTLM2SESSION. #2 I noticed several picky compiler warnings when DEBUG_ME is defined. I've fixed them with casting. By the way, DEBUG_ME was a huge help in understanding this code. #3 Hopefully the last non-ASCII conversion patch for libcurl in a while. I changed the "NTLMSSP" literal to hex since this signature must always be in ASCII. Conversion code was strategically added where necessary. And the Curl_base64_encode calls were changed so the binary "blobs" http_ntlm.c creates are NOT translated on non-ASCII platforms.
2007-01-03- David McCreedy made changes to allow base64 encoding/decoding to work onDaniel Stenberg
non-ASCII platforms.
2006-11-02prototype for gethostname is in unistd.hYang Tse
2006-10-17Avoid typecasting a signed char to an int when using is*() functions, as thatDaniel Stenberg
could very well cause a negate number get passed in and thus cause reading outside of the array usually used for this purpose. We avoid this by using the uppercase macro versions introduced just now that does some extra crazy typecasts to avoid byte codes > 127 to cause negative int values.
2006-09-09Michele Bini fixed how the hostname is put in NTLM packages. As serversDaniel Stenberg
don't expect fully qualified names we need to cut them off at the first dot.
2006-07-19Fix compiler warningsYang Tse
2006-06-07NTLM2 session response supportDaniel Stenberg
2006-04-08readint_le() not needed in USE_WINDOWS_SSPI code.Gisle Vanem
2006-04-05Michele Bini modified the NTLM code to work for his "weird IIS case"Daniel Stenberg
(http://curl.haxx.se/mail/lib-2006-02/0154.html) by adding the NTLM hash function in addition to the LM one and making some other adjustments in the order the different parts of the data block are sent in the Type-2 reply. Inspiration for this work was taken from the Firefox NTLM implementation. I edited the existing 21(!) NTLM test cases to run fine with these news. Due to the fact that we now properly include the host name in the Type-2 message the test cases now only compare parts of that chunk.
2005-11-14Quagmire reported that he needed to raise a NTLM buffer for SSPI to workDaniel Stenberg
properly for a case, and so we did. We raised it even for non-SSPI builds but it should not do any harm. http://curl.haxx.se/bug/view.cgi?id=1356715
2005-11-08Dmitry Bartsevich discovered some issues in compatibilty of SSPI-enabledDaniel Stenberg
version of libcurl with different Windows versions. Current version of libcurl imports SSPI functions from secur32.dll. However, under Windows NT 4.0 these functions are located in security.dll, under Windows 9x - in secur32.dll and Windows 2000 and XP contains both these DLLs (security.dll just forwards calls to secur32.dll). Dmitry's patch loads proper library dynamically depending on Windows version. Function InitSecurityInterface() is used to obtain pointers to all of SSPI function in one structure. : ----------------------------------------------------------------------
2005-10-13Make sure that the user and domain strings fit in the target buffer before weDaniel Stenberg
copy them there.
2005-10-02Avoid gcc warning "dereferencing type-punned pointerGisle Vanem
will break strict-aliasing rules".
2005-09-20Uses __stdcall instead of SEC_ENTRY since it seems (at least) mingw doesn'tDaniel Stenberg
define SEC_ENTRY and thus fails unless this is done!
2005-09-19Dmitry Bartsevich made the SSPI support work on Windows 9x as wellDaniel Stenberg
2005-04-07GnuTLS support added. There's now a "generic" SSL layer that we use all overDaniel Stenberg
internally, with code provided by sslgen.c. All SSL-layer-specific code is then written in ssluse.c (for OpenSSL) and gtls.c (for GnuTLS). As far as possible, internals should not need to know what SSL layer that is in use. Building with GnuTLS currently makes two test cases fail. TODO.gnutls contains a few known outstanding issues for the GnuTLS support. GnuTLS support is enabled with configure --with-gnutls
2005-03-14hushing up more warningsDaniel Stenberg
2005-03-14Avoid "unused variable" warnings.Gisle Vanem
2005-03-11Fixed some compiler warnings.Dan Fandrich
2005-03-10Christopher R. Palmer made it possible to build libcurl with theDaniel Stenberg
USE_WINDOWS_SSPI on Windows, and then libcurl will be built to use the native way to do NTLM. SSPI also allows libcurl to pass on the current user and its password in the request.
2005-02-22Curl_base64_decode() now returns an allocated bufferDaniel Stenberg
2005-02-22Thanks for the notification iDEFENCE. We are the "initial vendor" and we sureDaniel Stenberg
got no notification, no mail, no nothing. You didn't even bother to mail us when you went public with this. Cool. NTLM buffer overflow fix, as reported here: http://www.securityfocus.com/archive/1/391042
2004-12-07Rene Bernhardt found and fixed a buffer overrun in the NTLM code, whereDaniel Stenberg
libcurl always and unconditionally overwrote a stack-based array with 3 zero bytes. I edited the fix to make it less likely to occur again (and added a comment explaining the reason to the buffer size).
2004-07-04explicit typecasts to prevent warningsDaniel Stenberg
2004-06-21typecasts to prevent compiler warningsDaniel Stenberg
2004-05-25remove trailing whitespaceDaniel Stenberg
2004-05-11curl_global_init_mem() allows the memory functions to be replaced.Daniel Stenberg
memory.h is included everywhere for this.
2004-05-04General HTTP authentication cleanup and fixesDaniel Stenberg
2004-03-30'authdone' was added to the sessionhandle and thus was removed from theDaniel Stenberg
argument to the NTLM function(s)
2004-03-22Enabled 'NT responses' in the NTLM type-3 message.Daniel Stenberg
2004-03-08don't compare signed/unsignedDaniel Stenberg
2004-03-08strlen() returns size_tDaniel Stenberg
2004-02-23adjusted to the modified base64 protosDaniel Stenberg
2004-02-23The base64 encode function now takes a size_t for size, not an int asDaniel Stenberg
previously.
2004-01-07updated year in the copyright stringDaniel Stenberg
2003-10-17typecasts to prevent warningsDaniel Stenberg
2003-10-17make no user or no password just mean blank fields, not aborted operationDaniel Stenberg
2003-10-05weird typo removedDaniel Stenberg
2003-09-15When we issue a HTTP request, first make sure if the authentication phaseDaniel Stenberg
is over or not, as if it isn't we shall not begin any PUT or POST operation. This cures bug report #805853, and test case 88 verifies it!