romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 21:33:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

creds: add sasl service name

Browse source 
The SASL service name, used in authentication, is part of curl's credentials
when authenticating to a server/proxy. Make it part of `struct Curl_creds`.

Change code to use `creds` to obtain a service name. By tying creds used
to the connection, connection reuse is also only allowed when the service
name matches.

Closes #21585
This commit is contained in:
Stefan Eissing 2026-05-13 12:02:48 +02:00 • committed by Daniel Stenberg
parent b2476a0712
commit 5e99b73cf4
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
24 changed files with 98 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/vauth/digest.c
View file

@ -333,9 +333,11 @@ bool Curl_auth_is_digest_supported(void)
CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
const struct bufref *chlg,
struct Curl_creds *creds,
const char *service,
const char *default_service,
struct bufref *out)
{
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
size_t i;
struct MD5_context *ctxt;
const char *userp = Curl_creds_user(creds);

4
lib/vauth/digest_sspi.c
View file

@ -85,7 +85,7 @@ bool Curl_auth_is_digest_supported(void)
CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
const struct bufref *chlg,
struct Curl_creds *creds,
const char *service,
const char *default_service,
struct bufref *out)
{
CURLcode result = CURLE_OK;
@ -103,6 +103,8 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
SecBufferDesc resp_desc;
SECURITY_STATUS status;
unsigned long attrs;
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
/* Ensure we have a valid challenge message */
if(!Curl_bufref_len(chlg)) {

6
lib/vauth/krb5_gssapi.c
View file

@ -75,7 +75,7 @@ bool Curl_auth_is_gssapi_supported(void)
*/
CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
const bool mutual_auth,
const struct bufref *chlg,
@ -88,8 +88,8 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
OM_uint32 unused_status;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
(void)creds;
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
if(!krb5->spn) {
gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;

4
lib/vauth/krb5_sspi.c
View file

@ -80,7 +80,7 @@ bool Curl_auth_is_gssapi_supported(void)
*/
CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
const bool mutual_auth,
const struct bufref *chlg,
@ -96,6 +96,8 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
SecBufferDesc resp_desc;
SECURITY_STATUS status;
unsigned long attrs;
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
if(!krb5->spn) {
/* Generate our SPN */

4
lib/vauth/ntlm.c
View file

@ -422,7 +422,7 @@ static void unicodecpy(unsigned char *dest, const char *src, size_t length)
*/
CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
struct ntlmdata *ntlm,
struct bufref *out)
@ -441,6 +441,8 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
(*) -> Optional
*/
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
size_t size;
char *ntlmbuf;

4
lib/vauth/ntlm_sspi.c
View file

@ -77,7 +77,7 @@ bool Curl_auth_is_ntlm_supported(void)
*/
CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
struct ntlmdata *ntlm,
struct bufref *out)
@ -87,6 +87,8 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
SecBufferDesc type_1_desc;
SECURITY_STATUS status;
unsigned long attrs;
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
/* Clean up any former leftovers and initialise to defaults */
Curl_auth_cleanup_ntlm(ntlm);

4
lib/vauth/spnego_gssapi.c
View file

@ -71,7 +71,7 @@ bool Curl_auth_is_spnego_supported(void)
*/
CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
const char *chlg64,
struct negotiatedata *nego)
@ -103,6 +103,8 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
/* Generate our SPN */
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
char *spn = Curl_auth_build_spn(service, NULL, host);
if(!spn)
return CURLE_OUT_OF_MEMORY;

4
lib/vauth/spnego_sspi.c
View file

@ -79,7 +79,7 @@ bool Curl_auth_is_spnego_supported(void)
*/
CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
const char *chlg64,
struct negotiatedata *nego)
@ -104,6 +104,8 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
if(!nego->spn) {
/* Generate our SPN */
const char *service = Curl_creds_has_sasl_service(creds) ?
Curl_creds_sasl_service(creds) : default_service;
nego->spn = Curl_auth_build_spn(service, host, NULL);
if(!nego->spn)
return CURLE_OUT_OF_MEMORY;

8
lib/vauth/vauth.h
View file

@ -95,7 +95,7 @@ bool Curl_auth_is_digest_supported(void);
CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
const struct bufref *chlg,
struct Curl_creds *creds,
const char *service,
const char *default_service,
struct bufref *out);
/* This is used to decode an HTTP DIGEST challenge message */
@ -193,7 +193,7 @@ void Curl_auth_cleanup_ntlm(struct ntlmdata *ntlm);
/* This is used to generate a base64 encoded NTLM type-1 message */
CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
struct ntlmdata *ntlm,
struct bufref *out);
@ -252,7 +252,7 @@ bool Curl_auth_is_gssapi_supported(void);
message */
CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
const bool mutual_auth,
const struct bufref *chlg,
@ -321,7 +321,7 @@ Curl_auth_nego_get(struct connectdata *conn, bool proxy);
message */
CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
struct Curl_creds *creds,
const char *service,
const char *default_service,
const char *host,
const char *chlg64,
struct negotiatedata *nego);