httpauth: add support for Bearer tokens (239a7061) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP curl

docs/libcurl/opts/CURLOPT_HTTPAUTH.3

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -56,6 +56,10 @@ defined in RFC2617 and is a more secure way to do authentication over public
	networks than the regular old-fashioned Basic method. The IE flavor is simply		networks than the regular old-fashioned Basic method. The IE flavor is simply
	that libcurl will use a special "quirk" that IE is known to have used before		that libcurl will use a special "quirk" that IE is known to have used before
	version 7 and that some servers require the client to use.		version 7 and that some servers require the client to use.
			.IP CURLAUTH_BEARER
			HTTP Bearer token authentication, used primarily in OAuth 2.0 protocol.

			You can set the Bearer token to use with \fICURLOPT_XOAUTH2_BEARER(3)\fP.
	.IP CURLAUTH_NEGOTIATE		.IP CURLAUTH_NEGOTIATE
	HTTP Negotiate (SPNEGO) authentication. Negotiate authentication is defined		HTTP Negotiate (SPNEGO) authentication. Negotiate authentication is defined
	in RFC 4559 and is the most secure way to perform authentication over HTTP.		in RFC 4559 and is the most secure way to perform authentication over HTTP.

docs/libcurl/opts/CURLOPT_XOAUTH2_BEARER.3

+4 −4

Original line number	Original line	Diff line number	Diff line
	@@ -29,11 +29,11 @@ CURLOPT_XOAUTH2_BEARER \- specify OAuth 2.0 access token
	CURLcode curl_easy_setopt(CURL handle, CURLOPT_XOAUTH2_BEARER, char token);		CURLcode curl_easy_setopt(CURL handle, CURLOPT_XOAUTH2_BEARER, char token);
	.SH DESCRIPTION		.SH DESCRIPTION
	Pass a char * as parameter, which should point to the zero terminated OAuth		Pass a char * as parameter, which should point to the zero terminated OAuth
	2.0 Bearer Access Token for use with IMAP, POP3 and SMTP servers that support		2.0 Bearer Access Token for use with HTTP, IMAP, POP3 and SMTP servers
	the OAuth 2.0 Authorization Framework.		that support the OAuth 2.0 Authorization Framework.

	Note: The user name used to generate the Bearer Token should be supplied via		Note: For IMAP, POP3 and SMTP, the user name used to generate the Bearer Token
	the \fICURLOPT_USERNAME(3)\fP option.		should be supplied via the \fICURLOPT_USERNAME(3)\fP option.

	The application does not have to keep the string around after setting this		The application does not have to keep the string around after setting this
	option.		option.

docs/libcurl/symbols-in-versions

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -15,6 +15,7 @@
	CURLAUTH_ANY 7.10.6		CURLAUTH_ANY 7.10.6
	CURLAUTH_ANYSAFE 7.10.6		CURLAUTH_ANYSAFE 7.10.6
	CURLAUTH_BASIC 7.10.6		CURLAUTH_BASIC 7.10.6
			CURLAUTH_BEARER 7.61.0
	CURLAUTH_DIGEST 7.10.6		CURLAUTH_DIGEST 7.10.6
	CURLAUTH_DIGEST_IE 7.19.3		CURLAUTH_DIGEST_IE 7.19.3
	CURLAUTH_GSSAPI 7.55.0		CURLAUTH_GSSAPI 7.55.0

include/curl/curl.h

+2 −0

lib/http.c

+54 −1

Original line number	Original line	Diff line number	Diff line
	@@ -310,6 +310,31 @@ static CURLcode http_output_basic(struct connectdata *conn, bool proxy)
	return result;		return result;
	}		}

			/*
			* http_output_bearer() sets up an Authorization: header
			* for HTTP Bearer authentication.
			*
			* Returns CURLcode.
			*/
			static CURLcode http_output_bearer(struct connectdata *conn)
			{
			char **userp;
			CURLcode result = CURLE_OK;

			userp = &conn->allocptr.userpwd;
			free(*userp);
			*userp = aprintf("Authorization: Bearer %s\r\n",
			conn->oauth_bearer);

			if(!*userp) {
			result = CURLE_OUT_OF_MEMORY;
			goto fail;
			}

			fail:
			return result;
			}

	/* pickoneauth() selects the most favourable authentication method from the		/* pickoneauth() selects the most favourable authentication method from the
	* ones available and the ones we want.		* ones available and the ones we want.
	*		*
	@@ -326,6 +351,8 @@ static bool pickoneauth(struct auth *pick)
	of preference in case of the existence of multiple accepted types. */		of preference in case of the existence of multiple accepted types. */
	if(avail & CURLAUTH_NEGOTIATE)		if(avail & CURLAUTH_NEGOTIATE)
	pick->picked = CURLAUTH_NEGOTIATE;		pick->picked = CURLAUTH_NEGOTIATE;
			else if(avail & CURLAUTH_BEARER)
			pick->picked = CURLAUTH_BEARER;
	else if(avail & CURLAUTH_DIGEST)		else if(avail & CURLAUTH_DIGEST)
	pick->picked = CURLAUTH_DIGEST;		pick->picked = CURLAUTH_DIGEST;
	else if(avail & CURLAUTH_NTLM)		else if(avail & CURLAUTH_NTLM)
	@@ -628,6 +655,20 @@ output_auth_headers(struct connectdata *conn,
	functions work that way */		functions work that way */
	authstatus->done = TRUE;		authstatus->done = TRUE;
	}		}
			if(authstatus->picked == CURLAUTH_BEARER) {
			/* Bearer */
			if((!proxy && conn->oauth_bearer &&
			!Curl_checkheaders(conn, "Authorization:"))) {
			auth = "Bearer";
			result = http_output_bearer(conn);
			if(result)
			return result;
			}

			/* NOTE: this function should set 'done' TRUE, as the other auth
			functions work that way */
			authstatus->done = TRUE;
			}

	if(auth) {		if(auth) {
	infof(data, "%s auth using %s with user '%s'\n",		infof(data, "%s auth using %s with user '%s'\n",
	@@ -674,7 +715,7 @@ Curl_http_output_auth(struct connectdata *conn,
	authproxy = &data->state.authproxy;		authproxy = &data->state.authproxy;

	if((conn->bits.httpproxy && conn->bits.proxy_user_passwd) \|\|		if((conn->bits.httpproxy && conn->bits.proxy_user_passwd) \|\|
	conn->bits.user_passwd)		conn->bits.user_passwd \|\| conn->oauth_bearer)
	/* continue please */;		/* continue please */;
	else {		else {
	authhost->done = TRUE;		authhost->done = TRUE;
	@@ -883,6 +924,18 @@ CURLcode Curl_http_input_auth(struct connectdata *conn, bool proxy,
	data->state.authproblem = TRUE;		data->state.authproblem = TRUE;
	}		}
	}		}
			else
			if(checkprefix("Bearer", auth)) {
			*availp \|= CURLAUTH_BEARER;
			authp->avail \|= CURLAUTH_BEARER;
			if(authp->picked == CURLAUTH_BEARER) {
			/* We asked for Bearer authentication but got a 40X back
			anyway, which basically means our token isn't valid. */
			authp->avail = CURLAUTH_NONE;
			infof(data, "Authentication problem. Ignoring this.\n");
			data->state.authproblem = TRUE;
			}
			}

	/* there may be multiple methods on one line, so keep reading */		/* there may be multiple methods on one line, so keep reading */
	while(auth && auth != ',') /* read up to the next comma */		while(auth && auth != ',') /* read up to the next comma */

Original line number	Original line	Diff line number	Diff line
	@@ -691,6 +691,7 @@ typedef enum {
	* CURLAUTH_NTLM - HTTP NTLM authentication		* CURLAUTH_NTLM - HTTP NTLM authentication
	* CURLAUTH_DIGEST_IE - HTTP Digest authentication with IE flavour		* CURLAUTH_DIGEST_IE - HTTP Digest authentication with IE flavour
	* CURLAUTH_NTLM_WB - HTTP NTLM authentication delegated to winbind helper		* CURLAUTH_NTLM_WB - HTTP NTLM authentication delegated to winbind helper
			* CURLAUTH_BEARER - HTTP Bearer token authentication
	* CURLAUTH_ONLY - Use together with a single other type to force no		* CURLAUTH_ONLY - Use together with a single other type to force no
	* authentication or just that single type		* authentication or just that single type
	* CURLAUTH_ANY - All fine types set		* CURLAUTH_ANY - All fine types set
	@@ -708,6 +709,7 @@ typedef enum {
	#define CURLAUTH_NTLM (((unsigned long)1)<<3)		#define CURLAUTH_NTLM (((unsigned long)1)<<3)
	#define CURLAUTH_DIGEST_IE (((unsigned long)1)<<4)		#define CURLAUTH_DIGEST_IE (((unsigned long)1)<<4)
	#define CURLAUTH_NTLM_WB (((unsigned long)1)<<5)		#define CURLAUTH_NTLM_WB (((unsigned long)1)<<5)
			#define CURLAUTH_BEARER (((unsigned long)1)<<6)
	#define CURLAUTH_ONLY (((unsigned long)1)<<31)		#define CURLAUTH_ONLY (((unsigned long)1)<<31)
	#define CURLAUTH_ANY (~CURLAUTH_DIGEST_IE)		#define CURLAUTH_ANY (~CURLAUTH_DIGEST_IE)
	#define CURLAUTH_ANYSAFE (~(CURLAUTH_BASIC\|CURLAUTH_DIGEST_IE))		#define CURLAUTH_ANYSAFE (~(CURLAUTH_BASIC\|CURLAUTH_DIGEST_IE))