docs: Improve inline GSS-API naming in code documentation (eed1c63c) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP curl

lib/http.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -786,7 +786,7 @@ CURLcode Curl_http_input_auth(struct connectdata *conn, bool proxy,
		if(!data->req.newurl)
		return CURLE_OUT_OF_MEMORY;
		data->state.authproblem = FALSE;
		/* we received GSS auth info and we dealt with it fine */
		/* we received a GSS auth token and we dealt with it fine */
		negdata->state = GSS_AUTHRECV;
		}
		else

lib/socks.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -419,7 +419,7 @@ CURLcode Curl_SOCKS5(const char *proxy_name,
		#if defined(HAVE_GSSAPI) \|\| defined(USE_WINDOWS_SSPI)
		socksreq[1] = (char)(proxy_name ? 3 : 2); /* number of methods (below) */
		socksreq[2] = 0; /* no authentication */
		socksreq[3] = 1; /* gssapi */
		socksreq[3] = 1; /* GSS-API */
		socksreq[4] = 2; /* username/password */
		#else
		socksreq[1] = (char)(proxy_name ? 2 : 1); /* number of methods (below) */
		@@ -474,7 +474,7 @@ CURLcode Curl_SOCKS5(const char *proxy_name,
		else if(socksreq[1] == 1) {
		code = Curl_SOCKS5_gssapi_negotiate(sockindex, conn);
		if(code != CURLE_OK) {
		failf(data, "Unable to negotiate SOCKS5 gssapi context.");
		failf(data, "Unable to negotiate SOCKS5 GSS-API context.");
		return CURLE_COULDNT_CONNECT;
		}
		}
		@@ -636,7 +636,7 @@ CURLcode Curl_SOCKS5(const char *proxy_name,

		#if defined(HAVE_GSSAPI) \|\| defined(USE_WINDOWS_SSPI)
		if(conn->socks5_gssapi_enctype) {
		failf(data, "SOCKS5 gssapi protection not yet implemented.");
		failf(data, "SOCKS5 GSS-API protection not yet implemented.");
		}
		else
		#endif
		@@ -651,7 +651,7 @@ CURLcode Curl_SOCKS5(const char *proxy_name,

		#if defined(HAVE_GSSAPI) \|\| defined(USE_WINDOWS_SSPI)
		if(conn->socks5_gssapi_enctype) {
		failf(data, "SOCKS5 gssapi protection not yet implemented.");
		failf(data, "SOCKS5 GSS-API protection not yet implemented.");
		}
		else
		#endif

lib/socks.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -65,7 +65,7 @@ CURLcode Curl_SOCKS5(const char *proxy_name,

		#if defined(HAVE_GSSAPI) \|\| defined(USE_WINDOWS_SSPI)
		/*
		* This function handles the sockss5 gssapie negotiation and initialisation
		* This function handles the SOCKS5 GSS-API negotiation and initialisation
		*/
		CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		struct connectdata *conn);

lib/socks_gssapi.c

+28 −28

Original line number	Diff line number	Diff line
		@@ -52,7 +52,7 @@
		static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;

		/*
		* Helper gssapi error functions.
		* Helper GSS-API error functions.
		*/
		static int check_gss_err(struct SessionHandle *data,
		OM_uint32 major_status,
		@@ -103,7 +103,7 @@ static int check_gss_err(struct SessionHandle *data,
		}
		gss_release_buffer(&min_stat, &status_string);
		}
		failf(data, "GSSAPI error: %s failed:\n%s", function, buf);
		failf(data, "GSS-API error: %s failed:\n%s", function, buf);
		return(1);
		}

		@@ -131,10 +131,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_name_t gss_client_name = GSS_C_NO_NAME;
		unsigned short us_length;
		char *user=NULL;
		unsigned char socksreq[4]; /* room for gssapi exchange header only */
		unsigned char socksreq[4]; /* room for GSS-API exchange header only */
		char *serviceptr = data->set.str[STRING_SOCKS5_GSSAPI_SERVICE];

		/* GSSAPI request looks like
		/* GSS-API request looks like
		* +----+------+-----+----------------+
		* \|VER \| MTYP \| LEN \| TOKEN \|
		* +----+------+----------------------+
		@@ -195,19 +195,19 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_release_buffer(&gss_status, &gss_recv_token);
		gss_release_buffer(&gss_status, &gss_send_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		failf(data, "Failed to initial GSSAPI token.");
		failf(data, "Failed to initial GSS-API token.");
		return CURLE_COULDNT_CONNECT;
		}

		if(gss_send_token.length != 0) {
		socksreq[0] = 1; /* gssapi subnegotiation version */
		socksreq[0] = 1; /* GSS-API subnegotiation version */
		socksreq[1] = 1; /* authentication message type */
		us_length = htons((short)gss_send_token.length);
		memcpy(socksreq+2,&us_length,sizeof(short));

		code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written);
		if((code != CURLE_OK) \|\| (4 != written)) {
		failf(data, "Failed to send GSSAPI authentication request.");
		failf(data, "Failed to send GSS-API authentication request.");
		gss_release_name(&gss_status, &server);
		gss_release_buffer(&gss_status, &gss_recv_token);
		gss_release_buffer(&gss_status, &gss_send_token);
		@@ -219,7 +219,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_send_token.length, &written);

		if((code != CURLE_OK) \|\| ((ssize_t)gss_send_token.length != written)) {
		failf(data, "Failed to send GSSAPI authentication token.");
		failf(data, "Failed to send GSS-API authentication token.");
		gss_release_name(&gss_status, &server);
		gss_release_buffer(&gss_status, &gss_recv_token);
		gss_release_buffer(&gss_status, &gss_send_token);
		@@ -235,7 +235,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,

		/* analyse response */

		/* GSSAPI response looks like
		/* GSS-API response looks like
		* +----+------+-----+----------------+
		* \|VER \| MTYP \| LEN \| TOKEN \|
		* +----+------+----------------------+
		@@ -245,7 +245,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,

		result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread);
		if(result != CURLE_OK \|\| actualread != 4) {
		failf(data, "Failed to receive GSSAPI authentication response.");
		failf(data, "Failed to receive GSS-API authentication response.");
		gss_release_name(&gss_status, &server);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		return CURLE_COULDNT_CONNECT;
		@@ -261,7 +261,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		}

		if(socksreq[1] != 1) { /* status / messgae type */
		failf(data, "Invalid GSSAPI authentication response type (%d %d).",
		failf(data, "Invalid GSS-API authentication response type (%d %d).",
		socksreq[0], socksreq[1]);
		gss_release_name(&gss_status, &server);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		@@ -275,7 +275,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_recv_token.value=malloc(us_length);
		if(!gss_recv_token.value) {
		failf(data,
		"Could not allocate memory for GSSAPI authentication "
		"Could not allocate memory for GSS-API authentication "
		"response token.");
		gss_release_name(&gss_status, &server);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		@@ -286,7 +286,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_recv_token.length, &actualread);

		if(result != CURLE_OK \|\| actualread != us_length) {
		failf(data, "Failed to receive GSSAPI authentication token.");
		failf(data, "Failed to receive GSS-API authentication token.");
		gss_release_name(&gss_status, &server);
		gss_release_buffer(&gss_status, &gss_recv_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		@@ -331,12 +331,12 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		user[gss_send_token.length] = '\0';
		gss_release_name(&gss_status, &gss_client_name);
		gss_release_buffer(&gss_status, &gss_send_token);
		infof(data, "SOCKS5 server authencticated user %s with gssapi.\n",user);
		infof(data, "SOCKS5 server authencticated user %s with GSS-API.\n",user);
		free(user);
		user=NULL;

		/* Do encryption */
		socksreq[0] = 1; /* gssapi subnegotiation version */
		socksreq[0] = 1; /* GSS-API subnegotiation version */
		socksreq[1] = 2; /* encryption message type */

		gss_enc = 0; /* no data protection */
		@@ -347,7 +347,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		else if(gss_ret_flags & GSS_C_INTEG_FLAG)
		gss_enc = 1;

		infof(data, "SOCKS5 server supports gssapi %s data protection.\n",
		infof(data, "SOCKS5 server supports GSS-API %s data protection.\n",
		(gss_enc==0)?"no":((gss_enc==1)?"integrity":"confidentiality"));
		/* force for the moment to no data protection */
		gss_enc = 0;
		@@ -402,7 +402,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_release_buffer(&gss_status, &gss_send_token);
		gss_release_buffer(&gss_status, &gss_w_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		failf(data, "Failed to wrap GSSAPI encryption value into token.");
		failf(data, "Failed to wrap GSS-API encryption value into token.");
		return CURLE_COULDNT_CONNECT;
		}
		gss_release_buffer(&gss_status, &gss_send_token);
		@@ -413,7 +413,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,

		code = Curl_write_plain(conn, sock, (char *)socksreq, 4, &written);
		if((code != CURLE_OK) \|\| (4 != written)) {
		failf(data, "Failed to send GSSAPI encryption request.");
		failf(data, "Failed to send GSS-API encryption request.");
		gss_release_buffer(&gss_status, &gss_w_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		return CURLE_COULDNT_CONNECT;
		@@ -423,7 +423,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		memcpy(socksreq, &gss_enc, 1);
		code = Curl_write_plain(conn, sock, socksreq, 1, &written);
		if((code != CURLE_OK) \|\| ( 1 != written)) {
		failf(data, "Failed to send GSSAPI encryption type.");
		failf(data, "Failed to send GSS-API encryption type.");
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		return CURLE_COULDNT_CONNECT;
		}
		@@ -432,7 +432,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		code = Curl_write_plain(conn, sock, (char *)gss_w_token.value,
		gss_w_token.length, &written);
		if((code != CURLE_OK) \|\| ((ssize_t)gss_w_token.length != written)) {
		failf(data, "Failed to send GSSAPI encryption type.");
		failf(data, "Failed to send GSS-API encryption type.");
		gss_release_buffer(&gss_status, &gss_w_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		return CURLE_COULDNT_CONNECT;
		@@ -442,7 +442,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,

		result=Curl_blockread_all(conn, sock, (char *)socksreq, 4, &actualread);
		if(result != CURLE_OK \|\| actualread != 4) {
		failf(data, "Failed to receive GSSAPI encryption response.");
		failf(data, "Failed to receive GSS-API encryption response.");
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		return CURLE_COULDNT_CONNECT;
		}
		@@ -456,7 +456,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		}

		if(socksreq[1] != 2) { /* status / messgae type */
		failf(data, "Invalid GSSAPI encryption response type (%d %d).",
		failf(data, "Invalid GSS-API encryption response type (%d %d).",
		socksreq[0], socksreq[1]);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		return CURLE_COULDNT_CONNECT;
		@@ -475,7 +475,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_recv_token.length, &actualread);

		if(result != CURLE_OK \|\| actualread != us_length) {
		failf(data, "Failed to receive GSSAPI encryptrion type.");
		failf(data, "Failed to receive GSS-API encryptrion type.");
		gss_release_buffer(&gss_status, &gss_recv_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		return CURLE_COULDNT_CONNECT;
		@@ -490,13 +490,13 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		gss_release_buffer(&gss_status, &gss_recv_token);
		gss_release_buffer(&gss_status, &gss_w_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		failf(data, "Failed to unwrap GSSAPI encryption value into token.");
		failf(data, "Failed to unwrap GSS-API encryption value into token.");
		return CURLE_COULDNT_CONNECT;
		}
		gss_release_buffer(&gss_status, &gss_recv_token);

		if(gss_w_token.length != 1) {
		failf(data, "Invalid GSSAPI encryption response length (%d).",
		failf(data, "Invalid GSS-API encryption response length (%d).",
		gss_w_token.length);
		gss_release_buffer(&gss_status, &gss_w_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		@@ -508,7 +508,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		}
		else {
		if(gss_recv_token.length != 1) {
		failf(data, "Invalid GSSAPI encryption response length (%d).",
		failf(data, "Invalid GSS-API encryption response length (%d).",
		gss_recv_token.length);
		gss_release_buffer(&gss_status, &gss_recv_token);
		gss_delete_sec_context(&gss_status, &gss_context, NULL);
		@@ -520,8 +520,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		}

		infof(data, "SOCKS5 access with%s protection granted.\n",
		(socksreq[0]==0)?"out gssapi data":
		((socksreq[0]==1)?" gssapi integrity":" gssapi confidentiality"));
		(socksreq[0]==0)?"out GSS-API data":
		((socksreq[0]==1)?" GSS-API integrity":" GSS-API confidentiality"));

		conn->socks5_gssapi_enctype = socksreq[0];
		if(socksreq[0] == 0)

lib/socks_sspi.c

+10 −10

Original line number	Diff line number	Diff line
		@@ -76,7 +76,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		ssize_t actualread;
		ssize_t written;
		int result;
		/* Needs GSSAPI authentication */
		/* Needs GSS-API authentication */
		SECURITY_STATUS status;
		unsigned long sspi_ret_flags = 0;
		int gss_enc;
		@@ -91,10 +91,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		char *service_name = NULL;
		unsigned short us_length;
		unsigned long qop;
		unsigned char socksreq[4]; /* room for gssapi exchange header only */
		unsigned char socksreq[4]; /* room for GSS-API exchange header only */
		char *service = data->set.str[STRING_SOCKS5_GSSAPI_SERVICE];

		/* GSSAPI request looks like
		/* GSS-API request looks like
		* +----+------+-----+----------------+
		* \|VER \| MTYP \| LEN \| TOKEN \|
		* +----+------+----------------------+
		@@ -201,7 +201,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		}

		if(sspi_send_token.cbBuffer != 0) {
		socksreq[0] = 1; /* gssapi subnegotiation version */
		socksreq[0] = 1; /* GSS-API subnegotiation version */
		socksreq[1] = 1; /* authentication message type */
		us_length = htons((short)sspi_send_token.cbBuffer);
		memcpy(socksreq+2, &us_length, sizeof(short));
		@@ -252,7 +252,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,

		/* analyse response */

		/* GSSAPI response looks like
		/* GSS-API response looks like
		* +----+------+-----+----------------+
		* \|VER \| MTYP \| LEN \| TOKEN \|
		* +----+------+----------------------+
		@@ -329,12 +329,12 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		failf(data, "Failed to determine user name.");
		return CURLE_COULDNT_CONNECT;
		}
		infof(data, "SOCKS5 server authencticated user %s with gssapi.\n",
		infof(data, "SOCKS5 server authencticated user %s with GSS-API.\n",
		names.sUserName);
		s_pSecFn->FreeContextBuffer(names.sUserName);

		/* Do encryption */
		socksreq[0] = 1; /* gssapi subnegotiation version */
		socksreq[0] = 1; /* GSS-API subnegotiation version */
		socksreq[1] = 2; /* encryption message type */

		gss_enc = 0; /* no data protection */
		@@ -345,7 +345,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		else if(sspi_ret_flags & ISC_REQ_INTEGRITY)
		gss_enc = 1;

		infof(data, "SOCKS5 server supports gssapi %s data protection.\n",
		infof(data, "SOCKS5 server supports GSS-API %s data protection.\n",
		(gss_enc==0)?"no":((gss_enc==1)?"integrity":"confidentiality") );
		/* force to no data protection, avoid encryption/decryption for now */
		gss_enc = 0;
		@@ -593,8 +593,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
		}

		infof(data, "SOCKS5 access with%s protection granted.\n",
		(socksreq[0]==0)?"out gssapi data":
		((socksreq[0]==1)?" gssapi integrity":" gssapi confidentiality"));
		(socksreq[0]==0)?"out GSS-API data":
		((socksreq[0]==1)?" GSS-API integrity":" GSS-API confidentiality"));

		/* For later use if encryption is required
		conn->socks5_gssapi_enctype = socksreq[0];