romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 21:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

spnego: add --disable-negotiate-ntlm compile-time option

Browse source 
Add configure and CMake options to define CURL_DISABLE_NEGOTIATE_NTLM,
which gates the NTLM blocking logic in the SSPI and GSS-API SPNEGO
code paths behind a compile-time flag.

Add a 'SPNEGO-no-NTLM' feature string to curl --version output and
gate the SPNEGO NTLM blocking tests on the negotiate-ntlm-disabled
feature.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
This commit is contained in:
Matthew John Cheetham 2026-04-14 14:11:00 +01:00
parent 3ea51e7a1f
commit 0267a63dc0
11 changed files with 48 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/curl_config-cmake.h.in
View file

@ -58,6 +58,9 @@
/* disables negotiate authentication */
#cmakedefine CURL_DISABLE_NEGOTIATE_AUTH 1
/* blocks NTLM within SPNEGO negotiation */
#cmakedefine CURL_DISABLE_NEGOTIATE_NTLM 1
/* disables aws-sigv4 */
#cmakedefine CURL_DISABLE_AWS 1

4
lib/vauth/spnego_gssapi.c
View file

@ -160,6 +160,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
#endif
#ifdef HAVE_GSS_SET_NEG_MECHS
#ifdef CURL_DISABLE_NEGOTIATE_NTLM
/* Acquire explicit credentials and restrict SPNEGO sub-mechanisms to
* exclude NTLM. We enumerate all available mechanisms and filter out
* the NTLMSSP OID, matching SSPI's "!ntlm". */
@ -203,6 +204,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
gss_release_oid_set(&minor_status, &available_mechs);
}
}
#endif /* CURL_DISABLE_NEGOTIATE_NTLM */
#endif /* HAVE_GSS_SET_NEG_MECHS */
/* Generate our challenge-response message */
@ -240,6 +242,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
}
/* Check if NTLM was selected and is disallowed */
#ifdef CURL_DISABLE_NEGOTIATE_NTLM
if(nego->context != GSS_C_NO_CONTEXT) {
/* OID 1.3.6.1.4.1.311.2.2.10 (NTLMSSP) */
static const gss_OID_desc ntlmssp_oid = {
@ -261,6 +264,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
return CURLE_AUTH_ERROR;
}
}
#endif /* CURL_DISABLE_NEGOTIATE_NTLM */
/* Free previous token */
if(nego->output_token.length && nego->output_token.value)

2
lib/vauth/spnego_sspi.c
View file

@ -146,6 +146,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
/* Use the current Windows user */
nego->p_identity = NULL;
#ifdef CURL_DISABLE_NEGOTIATE_NTLM
/* Exclude NTLM from SPNEGO negotiation via the PackageList field */
if(!nego->p_identity) {
memset(&nego->identity, 0, sizeof(nego->identity));
@ -166,6 +167,7 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
nego->identity.PackageList =
(unsigned TCHAR *)CURL_UNCONST(TEXT("!ntlm"));
nego->identity.PackageListLength = 5;
#endif /* CURL_DISABLE_NEGOTIATE_NTLM */
/* Allocate our credentials handle */
nego->credentials = curlx_calloc(1, sizeof(CredHandle));

3
lib/version.c
View file

@ -525,6 +525,9 @@ static const struct feat features_table[] = {
#endif /* USE_SSL */
#ifdef USE_SPNEGO
FEATURE("SPNEGO", NULL, CURL_VERSION_SPNEGO),
#ifdef CURL_DISABLE_NEGOTIATE_NTLM
FEATURE("SPNEGO-no-NTLM", NULL, 0),
#endif
#endif
#ifdef USE_SSL
FEATURE("SSL", NULL, CURL_VERSION_SSL),