Commit 9ad282b1 authored by David Woodhouse's avatar David Woodhouse Committed by Daniel Stenberg
Browse files

Remove all traces of FBOpenSSL SPNEGO support 

This is just fundamentally broken. SPNEGO (RFC4178) is a protocol which
allows client and server to negotiate the underlying mechanism which will
actually be used to authenticate. This is *often* Kerberos, and can also
be NTLM and other things. And to complicate matters, there are various
different OIDs which can be used to specify the Kerberos mechanism too.

A SPNEGO exchange will identify *which* GSSAPI mechanism is being used,
and will exchange GSSAPI tokens which are appropriate for that mechanism.

But this SPNEGO implementation just strips the incoming SPNEGO packet
and extracts the token, if any. And completely discards the information
about *which* mechanism is being used. Then we *assume* it was Kerberos,
and feed the token into gss_init_sec_context() with the default
mechanism (GSS_S_NO_OID for the mech_type argument).

Furthermore... broken as this code is, it was never even *used* for input
tokens anyway, because higher layers of curl would just bail out if the
server actually said anything *back* to us in the negotiation. We assume
that we send a single token to the server, and it accepts it. If the server
wants to continue the exchange (as is required for NTLM and for SPNEGO
to do anything useful), then curl was broken anyway.

So the only bit which actually did anything was the bit in
Curl_output_negotiate(), which always generates an *initial* SPNEGO
token saying "Hey, I support only the Kerberos mechanism and this is its
token".

You could have done that by manually just prefixing the Kerberos token
with the appropriate bytes, if you weren't going to do any proper SPNEGO
handling. There's no need for the FBOpenSSL library at all.

The sane way to do SPNEGO is just to *ask* the GSSAPI library to do
SPNEGO. That's what the 'mech_type' argument to gss_init_sec_context()
is for. And then it should all Just Work™.

That 'sane way' will be added in a subsequent patch, as will bug fixes
for our failure to handle any exchange other than a single outbound
token to the server which results in immediate success.
parent 223612af

configure.ac

+0 −40
Original line number Diff line number Diff line
@@ -151,7 +151,6 @@ dnl initialize all the info variables 
    curl_ssh_msg="no      (--with-libssh2)"

   curl_zlib_msg="no      (--with-zlib)"

    curl_gss_msg="no      (--with-gssapi)"

 curl_spnego_msg="no      (--with-spnego)"

curl_tls_srp_msg="no      (--enable-tls-srp)"

    curl_res_msg="default (--enable-ares / --enable-threaded-resolver)"

   curl_ipv6_msg="no      (--enable-ipv6)"
@@ -1134,41 +1133,6 @@ no) 
        ;;

esac



dnl **********************************************************************

dnl Check for FBopenssl(SPNEGO) libraries

dnl **********************************************************************



AC_ARG_WITH(spnego,

  AC_HELP_STRING([--with-spnego=DIR],

                 [Specify location of SPNEGO library fbopenssl]), [

  SPNEGO_ROOT="$withval"

  if test x"$SPNEGO_ROOT" != xno; then

    want_spnego="yes"

  fi

])



AC_MSG_CHECKING([if SPNEGO support is requested])

if test x"$want_spnego" = xyes; then



  if test X"$SPNEGO_ROOT" = Xyes; then

     AC_MSG_ERROR([FBOpenSSL libs and/or directories were not found where specified!])

     AC_MSG_RESULT(no)

  else

     if test -z "$SPNEGO_LIB_DIR"; then

        LDFLAGS="$LDFLAGS -L$SPNEGO_ROOT -lfbopenssl"

     else

        LDFLAGS="$LDFLAGS $SPNEGO_LIB_DIR"

     fi



     AC_MSG_RESULT(yes)

     AC_DEFINE(HAVE_SPNEGO, 1,

               [Define this if you have the SPNEGO library fbopenssl])

     curl_spnego_msg="enabled"

  fi

else

  AC_MSG_RESULT(no)

fi



dnl **********************************************************************

dnl Check for GSS-API libraries

dnl **********************************************************************
@@ -3406,9 +3370,6 @@ fi 
if test "x$USE_NGHTTP2" = "x1"; then

  SUPPORT_FEATURES="$SUPPORT_FEATURES HTTP2"

fi

if test "x$curl_spnego_msg" = "xenabled"; then

  SUPPORT_FEATURES="$SUPPORT_FEATURES SPNEGO"

fi

if test "x$want_gss" = "xyes"; then

  SUPPORT_FEATURES="$SUPPORT_FEATURES GSS-API"

fi
@@ -3560,7 +3521,6 @@ AC_MSG_NOTICE([Configured to build curl/libcurl: 
  SSH support:      ${curl_ssh_msg}

  zlib support:     ${curl_zlib_msg}

  GSS-API support:  ${curl_gss_msg}

  SPNEGO support:   ${curl_spnego_msg}

  TLS-SRP support:  ${curl_tls_srp_msg}

  resolver:         ${curl_res_msg}

  ipv6 support:     ${curl_ipv6_msg}

docs/LICENSE-MIXING

+0 −6
Original line number Diff line number Diff line
@@ -94,12 +94,6 @@ GNU GSS http://www.gnu.org/software/gss/ 
        may not distribute binary curl packages that uses this if you build

        curl to also link and use any Original BSD licensed libraries!



fbopenssl



        (Used for SPNEGO support) Unclear license. Based on its name, I assume

        that it uses the OpenSSL license and thus shares the same issues as

        described for OpenSSL above.



libidn  http://josefsson.org/libidn/



        (Used for IDNA support) Uses the GNU Lesser General Public

docs/examples/Makefile.m32

+0 −6
Original line number Diff line number Diff line
@@ -148,9 +148,6 @@ endif 
ifeq ($(findstring -sspi,$(CFG)),-sspi)

SSPI = 1

endif

ifeq ($(findstring -spnego,$(CFG)),-spnego)

SPNEGO = 1

endif

ifeq ($(findstring -ldaps,$(CFG)),-ldaps)

LDAPS = 1

endif
@@ -230,9 +227,6 @@ ifdef SSPI 
    CFLAGS += -DUSE_SCHANNEL

  endif

endif

ifdef SPNEGO

  CFLAGS += -DHAVE_SPNEGO

endif

ifdef IPV6

  CFLAGS += -DENABLE_IPV6 -D_WIN32_WINNT=0x0501

endif

docs/examples/Makefile.netware

+0 −7
Original line number Diff line number Diff line
@@ -211,9 +211,6 @@ endif 
ifeq ($(findstring -idn,$(CFG)),-idn)

WITH_IDN = 1

endif

ifeq ($(findstring -spnego,$(CFG)),-spnego)

WITH_SPNEGO = 1

endif

ifeq ($(findstring -ipv6,$(CFG)),-ipv6)

ENABLE_IPV6 = 1

endif
@@ -247,10 +244,6 @@ ifdef WITH_SSL 
	LDLIBS += $(OPENSSL_PATH)/out_nw_$(LIBARCH_L)/ssl.$(LIBEXT)

	LDLIBS += $(OPENSSL_PATH)/out_nw_$(LIBARCH_L)/crypto.$(LIBEXT)

	IMPORTS += GetProcessSwitchCount RunningProcess

ifdef WITH_SPNEGO

	# INCLUDES += -I$(FBOPENSSL_PATH)/include

	LDLIBS += $(FBOPENSSL_PATH)/nw/fbopenssl.$(LIBEXT)

endif

else

ifdef WITH_AXTLS

	INCLUDES += -I$(AXTLS_PATH)/inc

install-sh

+7 −7
Original line number Diff line number Diff line 
#!/bin/sh

# install - install a program, script, or datafile



scriptversion=2011-01-19.21; # UTC

scriptversion=2011-11-20.07; # UTC



# This originates from X11R5 (mit/util/scripts/install.sh), which was

# later released in X11R6 (xc/config/util/install.sh) with the
@@ -35,7 +35,7 @@ scriptversion=2011-01-19.21; # UTC 
# FSF changes to this file are in the public domain.

#

# Calling this script install-sh is preferred over install.sh, to prevent

# `make' implicit rules from creating a file called install from it

# 'make' implicit rules from creating a file called install from it

# when there is no Makefile.

#

# This script is compatible with the BSD install script, but was written
@@ -156,7 +156,7 @@ while test $# -ne 0; do 
    -s) stripcmd=$stripprog;;



    -t) dst_arg=$2

	# Protect names problematic for `test' and other utilities.

	# Protect names problematic for 'test' and other utilities.

	case $dst_arg in

	  -* | [=\(\)!]) dst_arg=./$dst_arg;;

	esac
@@ -190,7 +190,7 @@ if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then 
    fi

    shift # arg

    dst_arg=$arg

    # Protect names problematic for `test' and other utilities.

    # Protect names problematic for 'test' and other utilities.

    case $dst_arg in

      -* | [=\(\)!]) dst_arg=./$dst_arg;;

    esac
@@ -202,7 +202,7 @@ if test $# -eq 0; then 
    echo "$0: no input file specified." >&2

    exit 1

  fi

  # It's OK to call `install-sh -d' without argument.

  # It's OK to call 'install-sh -d' without argument.

  # This can happen when creating conditional directories.

  exit 0

fi
@@ -240,7 +240,7 @@ fi 


for src

do

  # Protect names problematic for `test' and other utilities.

  # Protect names problematic for 'test' and other utilities.

  case $src in

    -* | [=\(\)!]) src=./$src;;

  esac
@@ -354,7 +354,7 @@ do 
	      if test -z "$dir_arg" || {

		   # Check for POSIX incompatibilities with -m.

		   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or

		   # other-writeable bit of parent directory when it shouldn't.

		   # other-writable bit of parent directory when it shouldn't.

		   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.

		   ls_ld_tmpdir=`ls -ld "$tmpdir"`

		   case $ls_ld_tmpdir in