romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 01:13:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

creds: add sasl service name

Browse source 
The SASL service name, used in authentication, is part of curl's credentials
when authenticating to a server/proxy. Make it part of `struct Curl_creds`.

Change code to use `creds` to obtain a service name. By tying creds used
to the connection, connection reuse is also only allowed when the service
name matches.

Closes #21585
This commit is contained in:
Stefan Eissing 2026-05-13 12:02:48 +02:00 • committed by Daniel Stenberg
parent b2476a0712
commit 5e99b73cf4
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
24 changed files with 98 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

30
lib/creds.c
View file

@ -33,36 +33,39 @@
CURLcode Curl_creds_create(const char *user, CURLcode Curl_creds_create(const char *user,
const char *passwd, const char *passwd,
const char *sasl_authzid,
const char *oauth_bearer, const char *oauth_bearer,
const char *sasl_authzid,
const char *sasl_service,
uint8_t source, uint8_t source,
struct Curl_creds **pcreds) struct Curl_creds **pcreds)
{ {
struct Curl_creds *creds = NULL; struct Curl_creds *creds = NULL;
size_t ulen = user ? strlen(user) : 0; size_t ulen = user ? strlen(user) : 0;
size_t plen = passwd ? strlen(passwd) : 0; size_t plen = passwd ? strlen(passwd) : 0;
size_t salen = sasl_authzid ? strlen(sasl_authzid) : 0;
size_t olen = oauth_bearer ? strlen(oauth_bearer) : 0; size_t olen = oauth_bearer ? strlen(oauth_bearer) : 0;
size_t salen = sasl_authzid ? strlen(sasl_authzid) : 0;
size_t sslen = sasl_service ? strlen(sasl_service) : 0;
char *s, *buf; char *s, *buf;
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
Curl_creds_unlink(pcreds); Curl_creds_unlink(pcreds);
/* Everything empty/NULL, this is the NULL credential */ /* Everything empty/NULL, this is the NULL credential */
if(!ulen && !plen && !salen && !olen) if(!ulen && !plen && !olen && !salen && !sslen)
goto out; goto out;
if((ulen > CURL_MAX_INPUT_LENGTH) || if((ulen > CURL_MAX_INPUT_LENGTH) ||
(plen > CURL_MAX_INPUT_LENGTH) || (plen > CURL_MAX_INPUT_LENGTH) ||
(olen > CURL_MAX_INPUT_LENGTH) ||
(salen > CURL_MAX_INPUT_LENGTH) || (salen > CURL_MAX_INPUT_LENGTH) ||
(olen > CURL_MAX_INPUT_LENGTH)) { (sslen > CURL_MAX_INPUT_LENGTH)) {
result = CURLE_BAD_FUNCTION_ARGUMENT; result = CURLE_BAD_FUNCTION_ARGUMENT;
goto out; goto out;
} }
/* NUL terminator for user already part of struct */ /* NUL terminator for user already part of struct */
creds = curlx_calloc(1, sizeof(*creds) + creds = curlx_calloc(1, sizeof(*creds) +
ulen + plen + 1 + salen + 1 + olen + 1); ulen + plen + 1 + olen + 1 + salen + 1 + sslen + 1);
if(!creds) { if(!creds) {
result = CURLE_OUT_OF_MEMORY; result = CURLE_OUT_OF_MEMORY;
goto out; goto out;
@ -78,12 +81,15 @@ CURLcode Curl_creds_create(const char *user,
creds->passwd = s = buf + ulen + 1; creds->passwd = s = buf + ulen + 1;
if(plen) if(plen)
memcpy(s, CURL_UNCONST(passwd), plen + 1); memcpy(s, CURL_UNCONST(passwd), plen + 1);
creds->sasl_authzid = s = buf + ulen + 1 + plen + 1; creds->oauth_bearer = s = buf + ulen + 1 + plen + 1;
if(salen)
memcpy(s, CURL_UNCONST(sasl_authzid), salen + 1);
creds->oauth_bearer = s = buf + ulen + 1 + plen + 1 + salen + 1;
if(olen) if(olen)
memcpy(s, CURL_UNCONST(oauth_bearer), olen + 1); memcpy(s, CURL_UNCONST(oauth_bearer), olen + 1);
creds->sasl_authzid = s = buf + ulen + 1 + plen + 1 + olen + 1;
if(salen)
memcpy(s, CURL_UNCONST(sasl_authzid), salen + 1);
creds->sasl_service = s = buf + ulen + 1 + plen + 1 + olen + 1 + salen + 1;
if(sslen)
memcpy(s, CURL_UNCONST(sasl_service), sslen + 1);
out: out:
if(!result) if(!result)
@ -107,8 +113,9 @@ CURLcode Curl_creds_merge(const char *user,
if(!passwd || !passwd[0]) if(!passwd || !passwd[0])
passwd = Curl_creds_passwd(creds_in); passwd = Curl_creds_passwd(creds_in);
result = Curl_creds_create(user, passwd, result = Curl_creds_create(user, passwd,
Curl_creds_sasl_authzid(creds_in),
Curl_creds_oauth_bearer(creds_in), Curl_creds_oauth_bearer(creds_in),
Curl_creds_sasl_authzid(creds_in),
Curl_creds_sasl_service(creds_in),
source, &creds_out); source, &creds_out);
Curl_creds_link(pcreds_out, creds_out); Curl_creds_link(pcreds_out, creds_out);
Curl_creds_unlink(&creds_out); Curl_creds_unlink(&creds_out);
@ -158,8 +165,9 @@ bool Curl_creds_same(struct Curl_creds *c1, struct Curl_creds *c2)
(c1 && c2 && (c1 && c2 &&
!Curl_timestrcmp(c1->user, c2->user) && !Curl_timestrcmp(c1->user, c2->user) &&
!Curl_timestrcmp(c1->passwd, c2->passwd) && !Curl_timestrcmp(c1->passwd, c2->passwd) &&
!Curl_timestrcmp(c1->oauth_bearer, c2->oauth_bearer) &&
!Curl_timestrcmp(c1->sasl_authzid, c2->sasl_authzid) && !Curl_timestrcmp(c1->sasl_authzid, c2->sasl_authzid) &&
!Curl_timestrcmp(c1->oauth_bearer, c2->oauth_bearer)); !Curl_timestrcmp(c1->sasl_service, c2->sasl_service));
} }
#ifdef CURLVERBOSE #ifdef CURLVERBOSE

11
lib/creds.h
View file

@ -34,8 +34,9 @@ struct Curl_easy;
struct Curl_creds { struct Curl_creds {
const char *user; /* non-NULL, maybe empty string */ const char *user; /* non-NULL, maybe empty string */
const char *passwd; /* non-NULL, maybe empty string */ const char *passwd; /* non-NULL, maybe empty string */
const char *sasl_authzid; /* non-NULL, maybe empty string */
const char *oauth_bearer; /* non-NULL, maybe empty string */ const char *oauth_bearer; /* non-NULL, maybe empty string */
const char *sasl_authzid; /* non-NULL, maybe empty string */
const char *sasl_service; /* non-NULL, maybe empty string */
uint32_t refcount; uint32_t refcount;
uint8_t source; /* CREDS_* value */ uint8_t source; /* CREDS_* value */
char buf[1]; char buf[1];
@ -43,8 +44,9 @@ struct Curl_creds {
CURLcode Curl_creds_create(const char *user, CURLcode Curl_creds_create(const char *user,
const char *passwd, const char *passwd,
const char *sasl_authzid,
const char *oauth_bearer, const char *oauth_bearer,
const char *sasl_authzid,
const char *sasl_service,
uint8_t source, uint8_t source,
struct Curl_creds **pcreds); struct Curl_creds **pcreds);
@ -72,11 +74,12 @@ bool Curl_creds_same_passwd(struct Curl_creds *creds, const char *passwd);
#define Curl_creds_has_user(c) ((c) && (c)->user[0]) #define Curl_creds_has_user(c) ((c) && (c)->user[0])
#define Curl_creds_has_passwd(c) ((c) && (c)->passwd[0]) #define Curl_creds_has_passwd(c) ((c) && (c)->passwd[0])
#define Curl_creds_has_oauth_bearer(c) ((c) && (c)->oauth_bearer[0]) #define Curl_creds_has_oauth_bearer(c) ((c) && (c)->oauth_bearer[0])
#define Curl_creds_has_sasl_service(c) ((c) && (c)->sasl_service[0])
#define Curl_creds_user(c) ((c)? (c)->user : "") #define Curl_creds_user(c) ((c)? (c)->user : "")
#define Curl_creds_passwd(c) ((c)? (c)->passwd : "") #define Curl_creds_passwd(c) ((c)? (c)->passwd : "")
#define Curl_creds_sasl_authzid(c) ((c)? (c)->sasl_authzid : "")
#define Curl_creds_oauth_bearer(c) ((c)? (c)->oauth_bearer : "") #define Curl_creds_oauth_bearer(c) ((c)? (c)->oauth_bearer : "")
#define Curl_creds_sasl_authzid(c) ((c)? (c)->sasl_authzid : "")
#define Curl_creds_sasl_service(c) ((c)? (c)->sasl_service : "")
#ifdef CURLVERBOSE #ifdef CURLVERBOSE
void Curl_creds_trace(struct Curl_easy *data, struct Curl_creds *creds, void Curl_creds_trace(struct Curl_easy *data, struct Curl_creds *creds,

24
lib/curl_sasl.c
View file

@ -319,9 +319,8 @@ static bool sasl_choose_krb5(struct Curl_easy *data, struct sasl_ctx *sctx)
if((sctx->enabledmechs & SASL_MECH_GSSAPI) && if((sctx->enabledmechs & SASL_MECH_GSSAPI) &&
Curl_auth_is_gssapi_supported() && Curl_auth_is_gssapi_supported() &&
Curl_auth_user_contains_domain(sctx->conn->creds)) { Curl_auth_user_contains_domain(sctx->conn->creds)) {
const char *service = data->set.str[STRING_SERVICE_NAME] ? const char *service = Curl_creds_has_sasl_service(sctx->conn->creds) ?
data->set.str[STRING_SERVICE_NAME] : Curl_creds_sasl_service(sctx->conn->creds) : sctx->sasl->params->service;
sctx->sasl->params->service;
sctx->sasl->mutual_auth = FALSE; sctx->sasl->mutual_auth = FALSE;
sctx->mech = SASL_MECH_STRING_GSSAPI; sctx->mech = SASL_MECH_STRING_GSSAPI;
@ -412,9 +411,8 @@ static bool sasl_choose_ntlm(struct Curl_easy *data, struct sasl_ctx *sctx)
{ {
if((sctx->enabledmechs & SASL_MECH_NTLM) && if((sctx->enabledmechs & SASL_MECH_NTLM) &&
Curl_auth_is_ntlm_supported()) { Curl_auth_is_ntlm_supported()) {
const char *service = data->set.str[STRING_SERVICE_NAME] ? const char *service = Curl_creds_has_sasl_service(sctx->conn->creds) ?
data->set.str[STRING_SERVICE_NAME] : Curl_creds_sasl_service(sctx->conn->creds) : sctx->sasl->params->service;
sctx->sasl->params->service;
const char *hostname; const char *hostname;
Curl_conn_get_current_host(data, FIRSTSOCKET, &hostname, NULL); Curl_conn_get_current_host(data, FIRSTSOCKET, &hostname, NULL);
@ -589,12 +587,6 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
struct bufref resp; struct bufref resp;
const char *hostname; const char *hostname;
int port; int port;
#if defined(USE_KERBEROS5) || defined(USE_NTLM) || \
!defined(CURL_DISABLE_DIGEST_AUTH)
const char *service = data->set.str[STRING_SERVICE_NAME] ?
data->set.str[STRING_SERVICE_NAME] :
sasl->params->service;
#endif
struct bufref serverdata; struct bufref serverdata;
Curl_conn_get_current_host(data, FIRSTSOCKET, &hostname, &port); Curl_conn_get_current_host(data, FIRSTSOCKET, &hostname, &port);
@ -657,7 +649,8 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
result = get_server_message(sasl, data, &serverdata); result = get_server_message(sasl, data, &serverdata);
if(!result) if(!result)
result = Curl_auth_create_digest_md5_message(data, &serverdata, result = Curl_auth_create_digest_md5_message(data, &serverdata,
conn->creds, service, conn->creds,
sasl->params->service,
&resp); &resp);
if(!result && (sasl->params->flags & SASL_FLAG_BASE64)) if(!result && (sasl->params->flags & SASL_FLAG_BASE64))
newstate = SASL_DIGESTMD5_RESP; newstate = SASL_DIGESTMD5_RESP;
@ -673,7 +666,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
struct ntlmdata *ntlm = Curl_auth_ntlm_get(conn, FALSE); struct ntlmdata *ntlm = Curl_auth_ntlm_get(conn, FALSE);
result = !ntlm ? CURLE_OUT_OF_MEMORY : result = !ntlm ? CURLE_OUT_OF_MEMORY :
Curl_auth_create_ntlm_type1_message(data, conn->creds, Curl_auth_create_ntlm_type1_message(data, conn->creds,
service, hostname, sasl->params->service, hostname,
ntlm, &resp); ntlm, &resp);
newstate = SASL_NTLM_TYPE2MSG; newstate = SASL_NTLM_TYPE2MSG;
break; break;
@ -697,7 +690,8 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
struct kerberos5data *krb5 = Curl_auth_krb5_get(conn); struct kerberos5data *krb5 = Curl_auth_krb5_get(conn);
result = !krb5 ? CURLE_OUT_OF_MEMORY : result = !krb5 ? CURLE_OUT_OF_MEMORY :
Curl_auth_create_gssapi_user_message(data, conn->creds, Curl_auth_create_gssapi_user_message(data, conn->creds,
service, conn->origin->hostname, sasl->params->service,
conn->origin->hostname,
(bool)sasl->mutual_auth, NULL, (bool)sasl->mutual_auth, NULL,
krb5, &resp); krb5, &resp);
newstate = SASL_GSSAPI_TOKEN; newstate = SASL_GSSAPI_TOKEN;

9
lib/http_negotiate.c
View file

@ -54,9 +54,8 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
CURLcode result; CURLcode result;
size_t len; size_t len;
/* Point to the username, password, service and host */ /* Point to credentials and host */
struct Curl_creds *creds = NULL; struct Curl_creds *creds = NULL;
const char *service;
const char *host; const char *host;
/* Point to the correct struct with this */ /* Point to the correct struct with this */
@ -66,8 +65,6 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
if(proxy) { if(proxy) {
#ifndef CURL_DISABLE_PROXY #ifndef CURL_DISABLE_PROXY
creds = conn->http_proxy.creds; creds = conn->http_proxy.creds;
service = data->set.str[STRING_PROXY_SERVICE_NAME] ?
data->set.str[STRING_PROXY_SERVICE_NAME] : "HTTP";
host = conn->http_proxy.peer->hostname; host = conn->http_proxy.peer->hostname;
state = conn->proxy_negotiate_state; state = conn->proxy_negotiate_state;
#else #else
@ -76,8 +73,6 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
} }
else { else {
creds = data->state.creds; creds = data->state.creds;
service = data->set.str[STRING_SERVICE_NAME] ?
data->set.str[STRING_SERVICE_NAME] : "HTTP";
host = conn->origin->hostname; host = conn->origin->hostname;
state = conn->http_negotiate_state; state = conn->http_negotiate_state;
} }
@ -127,7 +122,7 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
#endif /* GSS_C_CHANNEL_BOUND_FLAG */ #endif /* GSS_C_CHANNEL_BOUND_FLAG */
/* Initialize the security context and decode our challenge */ /* Initialize the security context and decode our challenge */
result = Curl_auth_decode_spnego_message(data, creds, service, result = Curl_auth_decode_spnego_message(data, creds, "HTTP",
host, header, neg_ctx); host, header, neg_ctx);
#ifdef GSS_C_CHANNEL_BOUND_FLAG #ifdef GSS_C_CHANNEL_BOUND_FLAG

11
lib/http_ntlm.c
View file

@ -122,9 +122,8 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
server, which is for a plain host or for an HTTP proxy */ server, which is for a plain host or for an HTTP proxy */
char **allocuserpwd; char **allocuserpwd;
/* point to credentials, service and host */ /* point to credentials and host */
struct Curl_creds *creds = NULL; struct Curl_creds *creds = NULL;
const char *service = NULL;
const char *hostname = NULL; const char *hostname = NULL;
/* point to the correct struct with this */ /* point to the correct struct with this */
@ -140,8 +139,6 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
#ifndef CURL_DISABLE_PROXY #ifndef CURL_DISABLE_PROXY
allocuserpwd = &data->req.hd_proxy_auth; allocuserpwd = &data->req.hd_proxy_auth;
creds = conn->http_proxy.creds; creds = conn->http_proxy.creds;
service = data->set.str[STRING_PROXY_SERVICE_NAME] ?
data->set.str[STRING_PROXY_SERVICE_NAME] : "HTTP";
hostname = conn->http_proxy.peer->hostname; hostname = conn->http_proxy.peer->hostname;
state = &conn->proxy_ntlm_state; state = &conn->proxy_ntlm_state;
authp = &data->state.authproxy; authp = &data->state.authproxy;
@ -152,8 +149,6 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
else { else {
allocuserpwd = &data->req.hd_auth; allocuserpwd = &data->req.hd_auth;
creds = data->state.creds; creds = data->state.creds;
service = data->set.str[STRING_SERVICE_NAME] ?
data->set.str[STRING_SERVICE_NAME] : "HTTP";
hostname = conn->origin->hostname; hostname = conn->origin->hostname;
state = &conn->http_ntlm_state; state = &conn->http_ntlm_state;
authp = &data->state.authhost; authp = &data->state.authhost;
@ -185,7 +180,7 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
switch(*state) { switch(*state) {
case NTLMSTATE_TYPE1: case NTLMSTATE_TYPE1:
default: /* for the weird cases we (re)start here */ default: /* for the weird cases we (re)start here */
if(!proxy) { if(!proxy) {
/* Start it up. From this time onwards, the connection is tied /* Start it up. From this time onwards, the connection is tied
* tp the credentials used. */ * tp the credentials used. */
@ -195,7 +190,7 @@ CURLcode Curl_output_ntlm(struct Curl_easy *data, bool proxy)
} }
Curl_creds_link(&conn->creds, creds); Curl_creds_link(&conn->creds, creds);
} }
result = Curl_auth_create_ntlm_type1_message(data, creds, service, result = Curl_auth_create_ntlm_type1_message(data, creds, "HTTP",
hostname, ntlm, &ntlmmsg); hostname, ntlm, &ntlmmsg);
if(!result) { if(!result) {
DEBUGASSERT(Curl_bufref_len(&ntlmmsg) != 0); DEBUGASSERT(Curl_bufref_len(&ntlmmsg) != 0);

2
lib/imap.c
View file

@ -597,7 +597,7 @@ static CURLcode imap_perform_login(struct Curl_easy *data,
/* Check we have a username and password to authenticate with and end the /* Check we have a username and password to authenticate with and end the
connect phase if we do not */ connect phase if we do not */
if(!data->state.creds) { if(!conn->creds) {
imap_state(data, imapc, IMAP_STOP); imap_state(data, imapc, IMAP_STOP);
return result; return result;

3
lib/netrc.c
View file

@ -391,7 +391,8 @@ static NETRCcode netrc_finalize(struct netrc_state *ns,
/* success without a password, set a blank one */ /* success without a password, set a blank one */
const char *passwd = ns->password ? ns->password : ""; const char *passwd = ns->password ? ns->password : "";
if(Curl_creds_create(login, passwd, NULL, NULL, CREDS_NETRC, pcreds)) { if(Curl_creds_create(login, passwd, NULL, NULL, NULL, CREDS_NETRC,
pcreds)) {
retcode = NETRC_OUT_OF_MEMORY; retcode = NETRC_OUT_OF_MEMORY;
goto out; goto out;
} }

2
lib/openldap.c
View file

@ -345,7 +345,7 @@ static CURLcode oldap_perform_bind(struct Curl_easy *data, ldapstate newstate)
passwd.bv_val = NULL; passwd.bv_val = NULL;
passwd.bv_len = 0; passwd.bv_len = 0;
if(data->state.creds) { if(conn->creds) {
binddn = Curl_creds_user(conn->creds); binddn = Curl_creds_user(conn->creds);
passwd.bv_val = CURL_UNCONST(Curl_creds_passwd(conn->creds)); passwd.bv_val = CURL_UNCONST(Curl_creds_passwd(conn->creds));
passwd.bv_len = strlen(passwd.bv_val); passwd.bv_len = strlen(passwd.bv_val);

2
lib/pop3.c
View file

@ -527,7 +527,7 @@ static CURLcode pop3_perform_user(struct Curl_easy *data,
/* Check we have a username and password to authenticate with and end the /* Check we have a username and password to authenticate with and end the
connect phase if we do not */ connect phase if we do not */
if(!data->state.creds) { if(!conn->creds) {
pop3_state(data, POP3_STOP); pop3_state(data, POP3_STOP);
return result; return result;

2
lib/socks.c
View file

@ -1079,7 +1079,7 @@ process_state:
case SOCKS5_ST_GSSAPI_INIT: { case SOCKS5_ST_GSSAPI_INIT: {
#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
/* GSSAPI stuff done non-blocking */ /* GSSAPI stuff done non-blocking */
CURLcode result = Curl_SOCKS5_gssapi_negotiate(cf, data); CURLcode result = Curl_SOCKS5_gssapi_negotiate(cf, data, sx->creds);
if(result) { if(result) {
failf(data, "Unable to negotiate SOCKS5 GSS-API context."); failf(data, "Unable to negotiate SOCKS5 GSS-API context.");
return CURLPX_GSSAPI; return CURLPX_GSSAPI;

3
lib/socks.h
View file

@ -47,7 +47,8 @@ CURLcode Curl_blockread_all(struct Curl_cfilter *cf,
* This function handles the SOCKS5 GSS-API negotiation and initialization * This function handles the SOCKS5 GSS-API negotiation and initialization
*/ */
CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf, CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
struct Curl_easy *data); struct Curl_easy *data,
struct Curl_creds *creds);
#endif #endif
/* Insert a SOCKS filter after `cf_at` for connecting to `dest`. /* Insert a SOCKS filter after `cf_at` for connecting to `dest`.

10
lib/socks_gssapi.c
View file

@ -564,19 +564,19 @@ static CURLcode socks5_gss_negotiate_enc(struct Curl_cfilter *cf,
} }
CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf, CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
struct Curl_easy *data) struct Curl_easy *data,
struct Curl_creds *creds)
{ {
struct connectdata *conn = cf->conn; struct connectdata *conn = cf->conn;
curl_socket_t sock = conn->sock[cf->sockindex]; curl_socket_t sock = conn->sock[cf->sockindex];
CURLcode result; CURLcode result;
OM_uint32 gss_ret_flags = 0; OM_uint32 gss_ret_flags = 0;
gss_name_t server = GSS_C_NO_NAME; gss_name_t server = GSS_C_NO_NAME;
const char *serviceptr = const char *service = Curl_creds_has_sasl_service(creds) ?
data->set.str[STRING_PROXY_SERVICE_NAME] ? Curl_creds_sasl_service(creds) : "rcmd";
data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd";
gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT; gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
result = socks5_gss_create_service_name(data, conn, serviceptr, &server); result = socks5_gss_create_service_name(data, conn, service, &server);
if(!result) { if(!result) {
(void)curlx_nonblock(sock, FALSE); (void)curlx_nonblock(sock, FALSE);
result = socks5_gss_auth_loop(cf, data, &server, &gss_context, result = socks5_gss_auth_loop(cf, data, &server, &gss_context,

10
lib/socks_sspi.c
View file

@ -58,12 +58,13 @@ static int check_sspi_err(struct Curl_easy *data,
/* This is the SSPI-using version of this function */ /* This is the SSPI-using version of this function */
static CURLcode socks5_sspi_setup(struct Curl_cfilter *cf, static CURLcode socks5_sspi_setup(struct Curl_cfilter *cf,
struct Curl_easy *data, struct Curl_easy *data,
struct Curl_creds *creds,
CredHandle *cred_handle, CredHandle *cred_handle,
char **service_namep) char **service_namep)
{ {
struct connectdata *conn = cf->conn; struct connectdata *conn = cf->conn;
const char *service = data->set.str[STRING_PROXY_SERVICE_NAME] ? const char *service = Curl_creds_has_sasl_service(creds) ?
data->set.str[STRING_PROXY_SERVICE_NAME] : "rcmd"; Curl_creds_sasl_service(creds) : "rcmd";
SECURITY_STATUS status; SECURITY_STATUS status;
/* prepare service name */ /* prepare service name */
@ -473,7 +474,8 @@ static CURLcode socks5_sspi_encrypt(struct Curl_cfilter *cf,
} }
CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf, CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
struct Curl_easy *data) struct Curl_easy *data,
struct Curl_creds *creds)
{ {
struct connectdata *conn = cf->conn; struct connectdata *conn = cf->conn;
curl_socket_t sock = conn->sock[cf->sockindex]; curl_socket_t sock = conn->sock[cf->sockindex];
@ -489,7 +491,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
memset(&sspi_context, 0, sizeof(sspi_context)); memset(&sspi_context, 0, sizeof(sspi_context));
names.sUserName = NULL; names.sUserName = NULL;
result = socks5_sspi_setup(cf, data, &cred_handle, &service_name); result = socks5_sspi_setup(cf, data, creds, &cred_handle, &service_name);
if(result) if(result)
goto error; goto error;

13
lib/url.c
View file

@ -1442,8 +1442,9 @@ static CURLcode url_set_data_creds(struct Curl_easy *data,
Curl_peer_same_destination(data->state.initial_origin, conn->origin))) { Curl_peer_same_destination(data->state.initial_origin, conn->origin))) {
result = Curl_creds_create(data->set.str[STRING_USERNAME], result = Curl_creds_create(data->set.str[STRING_USERNAME],
data->set.str[STRING_PASSWORD], data->set.str[STRING_PASSWORD],
data->set.str[STRING_SASL_AUTHZID],
data->set.str[STRING_BEARER], data->set.str[STRING_BEARER],
data->set.str[STRING_SASL_AUTHZID],
data->set.str[STRING_SERVICE_NAME],
CREDS_OPTION, &data->state.creds); CREDS_OPTION, &data->state.creds);
if(result) if(result)
return result; return result;
@ -1859,18 +1860,21 @@ static CURLcode parse_proxy(struct Curl_easy *data,
if(proxyuser || proxypasswd) { if(proxyuser || proxypasswd) {
result = Curl_creds_create(proxyuser, proxypasswd, NULL, NULL, result = Curl_creds_create(proxyuser, proxypasswd, NULL, NULL,
data->set.str[STRING_PROXY_SERVICE_NAME],
CREDS_URL, &proxyinfo->creds); CREDS_URL, &proxyinfo->creds);
if(result) if(result)
goto error; goto error;
} }
else if(!for_pre_proxy && else if(!for_pre_proxy &&
(data->set.str[STRING_PROXYUSERNAME] || (data->set.str[STRING_PROXYUSERNAME] ||
data->set.str[STRING_PROXYPASSWORD])) { data->set.str[STRING_PROXYPASSWORD] ||
data->set.str[STRING_PROXY_SERVICE_NAME])) {
/* No user/passwd in URL, if this is not a pre-proxy, the /* No user/passwd in URL, if this is not a pre-proxy, the
* CURLOPT_PROXY* settings apply. */ * CURLOPT_PROXY* settings apply. */
result = Curl_creds_create(data->set.str[STRING_PROXYUSERNAME], result = Curl_creds_create(data->set.str[STRING_PROXYUSERNAME],
data->set.str[STRING_PROXYPASSWORD], data->set.str[STRING_PROXYPASSWORD],
NULL, NULL, NULL, NULL,
data->set.str[STRING_PROXY_SERVICE_NAME],
CREDS_OPTION, &proxyinfo->creds); CREDS_OPTION, &proxyinfo->creds);
} }
else else
@ -2191,7 +2195,8 @@ static CURLcode override_login(struct Curl_easy *data,
if(data->set.use_netrc == CURL_NETRC_REQUIRED) { if(data->set.use_netrc == CURL_NETRC_REQUIRED) {
/* use the URL user to search netrc */ /* use the URL user to search netrc */
result = Curl_creds_create( result = Curl_creds_create(
data->state.creds->user, NULL, NULL, NULL, CREDS_URL, &ncreds_in); data->state.creds->user, NULL, NULL, NULL, NULL, CREDS_URL,
&ncreds_in);
if(result) if(result)
goto out; goto out;
} }
@ -2294,7 +2299,7 @@ static CURLcode url_set_conn_login(struct Curl_easy *data,
Curl_creds_link(&conn->creds, data->state.creds); Curl_creds_link(&conn->creds, data->state.creds);
else else
return Curl_creds_create(CURL_DEFAULT_USER, CURL_DEFAULT_PASSWORD, return Curl_creds_create(CURL_DEFAULT_USER, CURL_DEFAULT_PASSWORD,
NULL, NULL, CREDS_NONE, &conn->creds); NULL, NULL, NULL, CREDS_NONE, &conn->creds);
} }
else if(!(conn->scheme->flags & PROTOPT_CREDSPERREQUEST)) { else if(!(conn->scheme->flags & PROTOPT_CREDSPERREQUEST)) {
/* for protocols that do not handle credentials per request, /* for protocols that do not handle credentials per request,

4
lib/vauth/digest.c
View file

@ -333,9 +333,11 @@ bool Curl_auth_is_digest_supported(void)
CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data, CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
const struct bufref *chlg, const struct bufref *chlg,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
struct bufref *out) struct bufref *out)
{ {
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
size_t i; size_t i;
struct MD5_context *ctxt; struct MD5_context *ctxt;
const char *userp = Curl_creds_user(creds); const char *userp = Curl_creds_user(creds);

4
lib/vauth/digest_sspi.c
View file

@ -85,7 +85,7 @@ bool Curl_auth_is_digest_supported(void)
CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data, CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
const struct bufref *chlg, const struct bufref *chlg,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
struct bufref *out) struct bufref *out)
{ {
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
@ -103,6 +103,8 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
SecBufferDesc resp_desc; SecBufferDesc resp_desc;
SECURITY_STATUS status; SECURITY_STATUS status;
unsigned long attrs; unsigned long attrs;
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
/* Ensure we have a valid challenge message */ /* Ensure we have a valid challenge message */
if(!Curl_bufref_len(chlg)) { if(!Curl_bufref_len(chlg)) {

6
lib/vauth/krb5_gssapi.c
View file

@ -75,7 +75,7 @@ bool Curl_auth_is_gssapi_supported(void)
*/ */
CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data, CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
const bool mutual_auth, const bool mutual_auth,
const struct bufref *chlg, const struct bufref *chlg,
@ -88,8 +88,8 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
OM_uint32 unused_status; OM_uint32 unused_status;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER; gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
const char *service = Curl_creds_has_sasl_service(creds) ?
(void)creds; Curl_creds_sasl_service(creds) : default_service;
if(!krb5->spn) { if(!krb5->spn) {
gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER; gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;

4
lib/vauth/krb5_sspi.c
View file

@ -80,7 +80,7 @@ bool Curl_auth_is_gssapi_supported(void)
*/ */
CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data, CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
const bool mutual_auth, const bool mutual_auth,
const struct bufref *chlg, const struct bufref *chlg,
@ -96,6 +96,8 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
SecBufferDesc resp_desc; SecBufferDesc resp_desc;
SECURITY_STATUS status; SECURITY_STATUS status;
unsigned long attrs; unsigned long attrs;
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
if(!krb5->spn) { if(!krb5->spn) {
/* Generate our SPN */ /* Generate our SPN */

4
lib/vauth/ntlm.c
View file

@ -422,7 +422,7 @@ static void unicodecpy(unsigned char *dest, const char *src, size_t length)
*/ */
CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data, CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
struct ntlmdata *ntlm, struct ntlmdata *ntlm,
struct bufref *out) struct bufref *out)
@ -441,6 +441,8 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
(*) -> Optional (*) -> Optional
*/ */
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
size_t size; size_t size;
char *ntlmbuf; char *ntlmbuf;

4
lib/vauth/ntlm_sspi.c
View file

@ -77,7 +77,7 @@ bool Curl_auth_is_ntlm_supported(void)
*/ */
CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data, CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
struct ntlmdata *ntlm, struct ntlmdata *ntlm,
struct bufref *out) struct bufref *out)
@ -87,6 +87,8 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
SecBufferDesc type_1_desc; SecBufferDesc type_1_desc;
SECURITY_STATUS status; SECURITY_STATUS status;
unsigned long attrs; unsigned long attrs;
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
/* Clean up any former leftovers and initialise to defaults */ /* Clean up any former leftovers and initialise to defaults */
Curl_auth_cleanup_ntlm(ntlm); Curl_auth_cleanup_ntlm(ntlm);

4
lib/vauth/spnego_gssapi.c
View file

@ -71,7 +71,7 @@ bool Curl_auth_is_spnego_supported(void)
*/ */
CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data, CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
const char *chlg64, const char *chlg64,
struct negotiatedata *nego) struct negotiatedata *nego)
@ -103,6 +103,8 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER; gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
/* Generate our SPN */ /* Generate our SPN */
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
char *spn = Curl_auth_build_spn(service, NULL, host); char *spn = Curl_auth_build_spn(service, NULL, host);
if(!spn) if(!spn)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;

4
lib/vauth/spnego_sspi.c
View file

@ -79,7 +79,7 @@ bool Curl_auth_is_spnego_supported(void)
*/ */
CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data, CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
const char *chlg64, const char *chlg64,
struct negotiatedata *nego) struct negotiatedata *nego)
@ -104,6 +104,8 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
if(!nego->spn) { if(!nego->spn) {
/* Generate our SPN */ /* Generate our SPN */
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
nego->spn = Curl_auth_build_spn(service, host, NULL); nego->spn = Curl_auth_build_spn(service, host, NULL);
if(!nego->spn) if(!nego->spn)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;

8
lib/vauth/vauth.h
View file

@ -95,7 +95,7 @@ bool Curl_auth_is_digest_supported(void);
CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data, CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
const struct bufref *chlg, const struct bufref *chlg,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
struct bufref *out); struct bufref *out);
/* This is used to decode an HTTP DIGEST challenge message */ /* This is used to decode an HTTP DIGEST challenge message */
@ -193,7 +193,7 @@ void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm);
/* This is used to generate a base64 encoded NTLM type-1 message */ /* This is used to generate a base64 encoded NTLM type-1 message */
CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data, CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
struct ntlmdata *ntlm, struct ntlmdata *ntlm,
struct bufref *out); struct bufref *out);
@ -252,7 +252,7 @@ bool Curl_auth_is_gssapi_supported(void);
message */ message */
CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data, CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
const bool mutual_auth, const bool mutual_auth,
const struct bufref *chlg, const struct bufref *chlg,
@ -321,7 +321,7 @@ Curl_auth_nego_get(struct connectdata *conn, bool proxy);
message */ message */
CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data, CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
struct Curl_creds *creds, struct Curl_creds *creds,
const char *service, const char *default_service,
const char *host, const char *host,
const char *chlg64, const char *chlg64,
struct negotiatedata *nego); struct negotiatedata *nego);

3
tests/unit/unit1304.c
View file

@ -38,7 +38,8 @@ static bool t1304_set_creds(const char *user, const char *passwd,
{ {
Curl_creds_unlink(pcreds); Curl_creds_unlink(pcreds);
if(user || passwd) if(user || passwd)
return !Curl_creds_create(user, passwd, NULL, NULL, CREDS_NONE, pcreds); return !Curl_creds_create(user, passwd, NULL, NULL, NULL, CREDS_NONE,
pcreds);
else else
return TRUE; return TRUE;
} }