aboutsummaryrefslogtreecommitdiff
path: root/lib/http_ntlm.c
AgeCommit message (Collapse)Author
2007-01-03- David McCreedy made changes to allow base64 encoding/decoding to work onDaniel Stenberg
non-ASCII platforms.
2006-11-02prototype for gethostname is in unistd.hYang Tse
2006-10-17Avoid typecasting a signed char to an int when using is*() functions, as thatDaniel Stenberg
could very well cause a negate number get passed in and thus cause reading outside of the array usually used for this purpose. We avoid this by using the uppercase macro versions introduced just now that does some extra crazy typecasts to avoid byte codes > 127 to cause negative int values.
2006-09-09Michele Bini fixed how the hostname is put in NTLM packages. As serversDaniel Stenberg
don't expect fully qualified names we need to cut them off at the first dot.
2006-07-19Fix compiler warningsYang Tse
2006-06-07NTLM2 session response supportDaniel Stenberg
2006-04-08readint_le() not needed in USE_WINDOWS_SSPI code.Gisle Vanem
2006-04-05Michele Bini modified the NTLM code to work for his "weird IIS case"Daniel Stenberg
(http://curl.haxx.se/mail/lib-2006-02/0154.html) by adding the NTLM hash function in addition to the LM one and making some other adjustments in the order the different parts of the data block are sent in the Type-2 reply. Inspiration for this work was taken from the Firefox NTLM implementation. I edited the existing 21(!) NTLM test cases to run fine with these news. Due to the fact that we now properly include the host name in the Type-2 message the test cases now only compare parts of that chunk.
2005-11-14Quagmire reported that he needed to raise a NTLM buffer for SSPI to workDaniel Stenberg
properly for a case, and so we did. We raised it even for non-SSPI builds but it should not do any harm. http://curl.haxx.se/bug/view.cgi?id=1356715
2005-11-08Dmitry Bartsevich discovered some issues in compatibilty of SSPI-enabledDaniel Stenberg
version of libcurl with different Windows versions. Current version of libcurl imports SSPI functions from secur32.dll. However, under Windows NT 4.0 these functions are located in security.dll, under Windows 9x - in secur32.dll and Windows 2000 and XP contains both these DLLs (security.dll just forwards calls to secur32.dll). Dmitry's patch loads proper library dynamically depending on Windows version. Function InitSecurityInterface() is used to obtain pointers to all of SSPI function in one structure. : ----------------------------------------------------------------------
2005-10-13Make sure that the user and domain strings fit in the target buffer before weDaniel Stenberg
copy them there.
2005-10-02Avoid gcc warning "dereferencing type-punned pointerGisle Vanem
will break strict-aliasing rules".
2005-09-20Uses __stdcall instead of SEC_ENTRY since it seems (at least) mingw doesn'tDaniel Stenberg
define SEC_ENTRY and thus fails unless this is done!
2005-09-19Dmitry Bartsevich made the SSPI support work on Windows 9x as wellDaniel Stenberg
2005-04-07GnuTLS support added. There's now a "generic" SSL layer that we use all overDaniel Stenberg
internally, with code provided by sslgen.c. All SSL-layer-specific code is then written in ssluse.c (for OpenSSL) and gtls.c (for GnuTLS). As far as possible, internals should not need to know what SSL layer that is in use. Building with GnuTLS currently makes two test cases fail. TODO.gnutls contains a few known outstanding issues for the GnuTLS support. GnuTLS support is enabled with configure --with-gnutls
2005-03-14hushing up more warningsDaniel Stenberg
2005-03-14Avoid "unused variable" warnings.Gisle Vanem
2005-03-11Fixed some compiler warnings.Dan Fandrich
2005-03-10Christopher R. Palmer made it possible to build libcurl with theDaniel Stenberg
USE_WINDOWS_SSPI on Windows, and then libcurl will be built to use the native way to do NTLM. SSPI also allows libcurl to pass on the current user and its password in the request.
2005-02-22Curl_base64_decode() now returns an allocated bufferDaniel Stenberg
2005-02-22Thanks for the notification iDEFENCE. We are the "initial vendor" and we sureDaniel Stenberg
got no notification, no mail, no nothing. You didn't even bother to mail us when you went public with this. Cool. NTLM buffer overflow fix, as reported here: http://www.securityfocus.com/archive/1/391042
2004-12-07Rene Bernhardt found and fixed a buffer overrun in the NTLM code, whereDaniel Stenberg
libcurl always and unconditionally overwrote a stack-based array with 3 zero bytes. I edited the fix to make it less likely to occur again (and added a comment explaining the reason to the buffer size).
2004-07-04explicit typecasts to prevent warningsDaniel Stenberg
2004-06-21typecasts to prevent compiler warningsDaniel Stenberg
2004-05-25remove trailing whitespaceDaniel Stenberg
2004-05-11curl_global_init_mem() allows the memory functions to be replaced.Daniel Stenberg
memory.h is included everywhere for this.
2004-05-04General HTTP authentication cleanup and fixesDaniel Stenberg
2004-03-30'authdone' was added to the sessionhandle and thus was removed from theDaniel Stenberg
argument to the NTLM function(s)
2004-03-22Enabled 'NT responses' in the NTLM type-3 message.Daniel Stenberg
2004-03-08don't compare signed/unsignedDaniel Stenberg
2004-03-08strlen() returns size_tDaniel Stenberg
2004-02-23adjusted to the modified base64 protosDaniel Stenberg
2004-02-23The base64 encode function now takes a size_t for size, not an int asDaniel Stenberg
previously.
2004-01-07updated year in the copyright stringDaniel Stenberg
2003-10-17typecasts to prevent warningsDaniel Stenberg
2003-10-17make no user or no password just mean blank fields, not aborted operationDaniel Stenberg
2003-10-05weird typo removedDaniel Stenberg
2003-09-15When we issue a HTTP request, first make sure if the authentication phaseDaniel Stenberg
is over or not, as if it isn't we shall not begin any PUT or POST operation. This cures bug report #805853, and test case 88 verifies it!
2003-09-04no user or password set, bail outDaniel Stenberg
2003-08-11added include "http.h" to prevent a warningDaniel Stenberg
2003-08-11Serge Semashko added CURLOPT_PROXYAUTH support, and now NTLM for proxiesDaniel Stenberg
work.
2003-07-22More support for NTLM on proxies, now proxy state and nonce is stored inDaniel Stenberg
a separate struct properly.
2003-07-21adjusted to support NTLM for proxiesDaniel Stenberg
2003-07-19Access the user and passwd fields from the connectdata struct now insteadDaniel Stenberg
of the sessionhandle struct, as that was not good.
2003-07-15Moved the NTLM credentials to the connectdata struct instead, as NTLMDaniel Stenberg
authenticates connections and not single requests. This should make it work better when we mix requests from multiple hosts. Problem pointed out by Cris Bailiff.
2003-07-15Dan Winship's patch added that makes use of DOMAIN\USER or DOMAIN/USERDaniel Stenberg
for the user field. I changed it slightly to stay with strchr() only instead of strpbrk() for portability reasons.
2003-06-26Many fixes, most of them based on comments by Eric GlassDaniel Stenberg
2003-06-13Cris Bailiff's patch that should make us do NTLM correctly. When we'veDaniel Stenberg
authenticated our connection, we can continue without any Authorization: headers as long as our connection is maintained.
2003-06-13Cris Bailiff's bugfixDaniel Stenberg
2003-06-13use more curlish strings, these should be able to change...Daniel Stenberg
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 18:35:36 +0000