| Age | Commit message (Collapse) | Author |
|---|
|
This is just fundamentally broken. SPNEGO (RFC4178) is a protocol which
allows client and server to negotiate the underlying mechanism which will
actually be used to authenticate. This is *often* Kerberos, and can also
be NTLM and other things. And to complicate matters, there are various
different OIDs which can be used to specify the Kerberos mechanism too.
A SPNEGO exchange will identify *which* GSSAPI mechanism is being used,
and will exchange GSSAPI tokens which are appropriate for that mechanism.
But this SPNEGO implementation just strips the incoming SPNEGO packet
and extracts the token, if any. And completely discards the information
about *which* mechanism is being used. Then we *assume* it was Kerberos,
and feed the token into gss_init_sec_context() with the default
mechanism (GSS_S_NO_OID for the mech_type argument).
Furthermore... broken as this code is, it was never even *used* for input
tokens anyway, because higher layers of curl would just bail out if the
server actually said anything *back* to us in the negotiation. We assume
that we send a single token to the server, and it accepts it. If the server
wants to continue the exchange (as is required for NTLM and for SPNEGO
to do anything useful), then curl was broken anyway.
So the only bit which actually did anything was the bit in
Curl_output_negotiate(), which always generates an *initial* SPNEGO
token saying "Hey, I support only the Kerberos mechanism and this is its
token".
You could have done that by manually just prefixing the Kerberos token
with the appropriate bytes, if you weren't going to do any proper SPNEGO
handling. There's no need for the FBOpenSSL library at all.
The sane way to do SPNEGO is just to *ask* the GSSAPI library to do
SPNEGO. That's what the 'mech_type' argument to gss_init_sec_context()
is for. And then it should all Just Work™.
That 'sane way' will be added in a subsequent patch, as will bug fixes
for our failure to handle any exchange other than a single outbound
token to the server which results in immediate success.
|
|
|
|
... that contains the declaration of PL_ArenaFinish()
|
|
This prevents valgrind from reporting still reachable memory allocated
by NSPR arenas (mainly the freelist).
Reported-by: Hubert Kario
|
|
This prevents valgrind from reporting possibly lost memory that NSPR
uses for file descriptor cache and other globally allocated internal
data structures.
|
|
|
|
There is an implicit conversion from "unsigned long" to "long"
|
|
Fixed a copy / paste error from my 2011 project files.
|
|
|
|
Renamed the CURLX_ONES file list definition in order to a) try and be
consistent with other file lists and b) to allow for the addition of
the curlx header files, which will assist with Visual Studio project
files generation rather than hard coding those files.
|
|
|
|
An enumerated type is mixed with another type.
|
|
|
|
An enumerated type is mixed with another type.
|
|
An enumerated type is mixed with another type.
|
|
...and removed ;OPTIONS from --user as that functionality was removed
in 7.34.0.
|
|
|
|
|
|
|
|
I was tempted to change those to >= 0 until I saw that this is
actually a for loop that terminates once i underflows.
|
|
|
|
|
|
|
|
This makes it possible to fetch from an IPv6 literal without specifying
the -g option. Globbing remains available elsehwere in the URL.
For example:
curl http://[::1]/file[1-3].txt
This creates no ambiguity, because there is no overlap between the
syntax of valid globs and valid IPv6 literals. Globs contain hyphens
and at most 1 colon, while IPv6 literals have no hyphens, and at least 2
colons.
The peek_ipv6() parser simply whitelists a set of characters and counts
colons, because the real validation happens later on. The character set
includes A-Z, in case someone decides to implement support for scopes
like [fe80::1%25eth0] in the future.
Signed-off-by: Paul Marks <pmarks@google.com>
|
|
This allows configure --disable-manual to run and build without having
to regenerate the src/tool_hugehelp.c file which otherwise is necessary
since we ship tarballs with that file present.
Reported-by: Remi Gacogne
Bug: http://curl.haxx.se/bug/view.cgi?id=1350
|
|
For example when a URL is not specified or the headers file fails to
open.
|
|
|
|
|
|
Remove slash/backslash problem, now only slashes are used,
Wmake automaticaly translate slash/backslash to proper version or tools are not sensitive for it.
Enable spaces in path.
Use internal rm command for all host platforms
Add error message if old Open Watcom version is used. Some old versions exhibit build problems for Curl latest version. Now only versions 1.8, 1.9 and 2.O beta are supported
|
|
Ensure a source file isn't generated for the following informational
command line parameters when --libcurl is specified:
--help, --manual, --version and --engine list
As the output would only include a fairly empty looking main() function
and a call to curl_easy_init() and curl_easy_cleanup() when performed
with --engine list.
|
|
Correctly output libcurl source code that includes multiply operations
as specified by --next. Note that each operation evaluates to a single
curl_easy_perform() in source code form.
Also note that the output could be optimised a little so global config
options are only output once rather than per operation as is presently
the case.
|
|
warning: declaration of 'struct GlobalConfig' will not be visible
outside of this function
|
|
|
|
incompatible types - from 'OperationConfig *' to 'GlobalConfig *'
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Other global options such as --libcurl, --trace and --verbose to
follow.
|
|
In order to ease the moving of global options such as the error stream,
updated the OperationConfig structure to point to the GlobalConfig.
|
|
In addition to adding support for URL specific options via the command
line with --next it is now possible to specify "next" in .curlrc.
|
|
Follow up to commit 1a9b58fcb2 to replace the : command line option
with --next and -:.
|
|
Added initial support for --next/-: which will be used to replace the
rather confusing : command line operation what was used for the URL
specific options prototype.
|
|
|
|
...and added the HTTP suffix as these options are only used for HTTP2
based connections.
|
|
Other global options such as --libcurl, --trace and --verbose to
follow.
|
|
In preparation for parsing global options added the GlobalConfig
structure to the getparameter() function.
|
