Skip to content
  1. Jul 26, 2014
  3. Jul 25, 2014
  5. Jul 24, 2014
  7. Jul 23, 2014
  9. Jul 22, 2014
  11. Jul 19, 2014
  13. Jul 18, 2014
  15. Jul 17, 2014
  17. Jul 16, 2014
    • Dan Fandrich's avatar
      testcurl.pl: log the value of --runtestopts in the test header · 6ffc113c
      Dan Fandrich authored
      6ffc113c
    • Daniel Stenberg's avatar
      RELEASE-NOTES: cleared, working towards next release · 1abc42b2
      Daniel Stenberg authored
      1abc42b2
    • Daniel Stenberg's avatar
      curl_gssapi.c: make line shorter than 80 columns · d19dfa97
      Daniel Stenberg authored
      d19dfa97
    • David Woodhouse's avatar
      Fix negotiate auth to proxies to track correct state · 3de576ef
      David Woodhouse authored
      3de576ef
    • David Woodhouse's avatar
      Don't abort Negotiate auth when the server has a response for us · 6bc76194
      David Woodhouse authored 
      It's wrong to assume that we can send a single SPNEGO packet which will
complete the authentication. It's a *negotiation* — the clue is in the
name. So make sure we handle responses from the server.

Curl_input_negotiate() will already handle bailing out if it thinks the
state is GSS_S_COMPLETE (or SEC_E_OK on Windows) and the server keeps
talking to us, so we should avoid endless loops that way.
      6bc76194
    • David Woodhouse's avatar
      Don't clear GSSAPI state between each exchange in the negotiation · f78ae415
      David Woodhouse authored 
      GSSAPI doesn't work very well if we forget everything ever time.

XX: Is Curl_http_done() the right place to do the final cleanup?
      f78ae415
    • David Woodhouse's avatar
      Use SPNEGO for HTTP Negotiate · 59431c24
      David Woodhouse authored 
      This is the correct way to do SPNEGO. Just ask for it

Now I correctly see it trying NTLMSSP authentication when a Kerberos ticket
isn't available. Of course, we bail out when the server responds with the
challenge packet, since we don't expect that. But I'll fix that bug next...
      59431c24
    • David Woodhouse's avatar
      Remove all traces of FBOpenSSL SPNEGO support · 9ad282b1
      David Woodhouse authored 
      This is just fundamentally broken. SPNEGO (RFC4178) is a protocol which
allows client and server to negotiate the underlying mechanism which will
actually be used to authenticate. This is *often* Kerberos, and can also
be NTLM and other things. And to complicate matters, there are various
different OIDs which can be used to specify the Kerberos mechanism too.

A SPNEGO exchange will identify *which* GSSAPI mechanism is being used,
and will exchange GSSAPI tokens which are appropriate for that mechanism.

But this SPNEGO implementation just strips the incoming SPNEGO packet
and extracts the token, if any. And completely discards the information
about *which* mechanism is being used. Then we *assume* it was Kerberos,
and feed the token into gss_init_sec_context() with the default
mechanism (GSS_S_NO_OID for the mech_type argument).

Furthermore... broken as this code is, it was never even *used* for input
tokens anyway, because higher layers of curl would just bail out if the
server actually said anything *back* to us in the negotiation. We assume
that we send a single token to the server, and it accepts it. If the server
wants to continue the exchange (as is required for NTLM and for SPNEGO
to do anything useful), then curl was broken anyway.

So the only bit which actually did anything was the bit in
Curl_output_negotiate(), which always generates an *initial* SPNEGO
token saying "Hey, I support only the Kerberos mechanism and this is its
token".

You could have done that by manually just prefixing the Kerberos token
with the appropriate bytes, if you weren't going to do any proper SPNEGO
handling. There's no need for the FBOpenSSL library at all.

The sane way to do SPNEGO is just to *ask* the GSSAPI library to do
SPNEGO. That's what the 'mech_type' argument to gss_init_sec_context()
is for. And then it should all Just Work™.

That 'sane way' will be added in a subsequent patch, as will bug fixes
for our failure to handle any exchange other than a single outbound
token to the server which results in immediate success.
      9ad282b1