mirror of
https://github.com/curl/curl.git
synced 2026-04-14 22:31:41 +03:00
tests: move GSS-API dynamic stub into debug-mode libcurl
Replace the `libstubgss.so`-based overload solution with one built into libcurl at compile-time. The previous, `LD_PRELOAD`-based, solution was non-portable, allowlisted for Linux, BSD and Solaris. It also required non-debug builds, which turned out to be an accidental condition:7d342c723c. It also required a curl tool built against a shared libcurl. Detecting this condition wasn't always accurate, e.g. with certain cmake configurations. The overload solution also didn't work on macOS, though it theoretically should have: - #17653 - #2394 Experiments on making the overload solution work in more envs: - #17759 That revealed that it also did not work on NetBSD, in CI. The replacement solution is overloading the necessary GSS-API functions for test 2056 and 2057 at compile time. It requires a debug-enabled curl build (due to its insecure nature). This makes these tests run on all platforms. Including most GSS jobs in CI, that are running tests. (the exception is old-linux, non-debug jobs, where it felt overkill to enable debug for this.) The refactored GSS stub code needs to overload less than before because it's free to use the official GSS API. (This didn't work with the overload solution on Alpine for example). It can also use libcurl functions, allowing to replace `snprintf()` with `msnprintf()`. OS/400 is also overloading GSS API functions. I haven't tested how this works after this PR. In theory it should, because this PR doesn't rely on preprocessor overrides. Note that for future GSS tests, it may be necessary to stub these GSS API functions: `gss_inquire_context()`, `gss_unwrap()`, `gss_wrap()`. They are on codepaths not (yet) touched by tests. Also: - stub-gss: check for token buffer overrun. - stub-gss: replace size macros with `sizeof()`. - GHA: enable debug for some jobs with GSS. - GHA/linux: ignore results for 2056 and 2057 in the valgrind job. They leak the same way as seen with 2077 and 2078. Ref:7020ba7979#17462 Ref:146759716c#14430 - GHA/linux: fix to ignore `gss_import_name()` leaks in valgrind builds. only. - lib/vauth/krb5_gssapi: reduce variable scope. - lib/vauth/spnego_gssapi: reduce variable scope. - tests/libtest: drop code and build logic dealing with `libstubgss`. - runtests: - drop `ld_preload` feature. - drop special handling of `LD_PRELOAD` env in tests. - drop logic dealing with shared curl tool detection. - drop `LD_PRELOAD` envs from tests. Follow-up to56d949d31a#1687 Closes #17752
This commit is contained in:
Viktor Szakats
parent
c9bb9cd165
commit
73840836a5
19 changed files with 345 additions and 772 deletions
|
|
@ -199,7 +199,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_release_name(&gss_status, &server);
|
||||
gss_release_buffer(&gss_status, &gss_recv_token);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
failf(data, "Failed to initial GSS-API token.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
|
@ -217,7 +217,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_release_name(&gss_status, &server);
|
||||
gss_release_buffer(&gss_status, &gss_recv_token);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -229,7 +229,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_release_name(&gss_status, &server);
|
||||
gss_release_buffer(&gss_status, &gss_recv_token);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -254,7 +254,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(result || (actualread != 4)) {
|
||||
failf(data, "Failed to receive GSS-API authentication response.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -263,7 +263,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data, "User was rejected by the SOCKS5 server (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -271,7 +271,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data, "Invalid GSS-API authentication response type (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -285,7 +285,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
"Could not allocate memory for GSS-API authentication "
|
||||
"response token.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
|
|
@ -296,7 +296,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data, "Failed to receive GSS-API authentication token.");
|
||||
gss_release_name(&gss_status, &server);
|
||||
gss_release_buffer(&gss_status, &gss_recv_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -311,7 +311,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
NULL, NULL, NULL);
|
||||
if(check_gss_err(data, gss_major_status,
|
||||
gss_minor_status, "gss_inquire_context")) {
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, &gss_client_name);
|
||||
failf(data, "Failed to determine username.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
|
|
@ -320,7 +320,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
&gss_send_token, NULL);
|
||||
if(check_gss_err(data, gss_major_status,
|
||||
gss_minor_status, "gss_display_name")) {
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, &gss_client_name);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
failf(data, "Failed to determine username.");
|
||||
|
|
@ -328,7 +328,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
}
|
||||
user = malloc(gss_send_token.length + 1);
|
||||
if(!user) {
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
gss_release_name(&gss_status, &gss_client_name);
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
|
|
@ -397,7 +397,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_send_token.length = 1;
|
||||
gss_send_token.value = Curl_memdup(&gss_enc, 1);
|
||||
if(!gss_send_token.value) {
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
|
|
@ -408,7 +408,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_wrap")) {
|
||||
gss_release_buffer(&gss_status, &gss_send_token);
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
failf(data, "Failed to wrap GSS-API encryption value into token.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
|
@ -423,7 +423,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(code || (4 != nwritten)) {
|
||||
failf(data, "Failed to send GSS-API encryption request.");
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -433,7 +433,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
&nwritten);
|
||||
if(code || ( 1 != nwritten)) {
|
||||
failf(data, "Failed to send GSS-API encryption type.");
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
}
|
||||
|
|
@ -443,7 +443,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(code || (gss_w_token.length != nwritten)) {
|
||||
failf(data, "Failed to send GSS-API encryption type.");
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
|
|
@ -452,7 +452,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
|
||||
if(result || (actualread != 4)) {
|
||||
failf(data, "Failed to receive GSS-API encryption response.");
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -460,14 +460,14 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(socksreq[1] == 255) { /* status / message type */
|
||||
failf(data, "User was rejected by the SOCKS5 server (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
if(socksreq[1] != 2) { /* status / message type */
|
||||
failf(data, "Invalid GSS-API encryption response type (%d %d).",
|
||||
socksreq[0], socksreq[1]);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -477,7 +477,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
gss_recv_token.length = us_length;
|
||||
gss_recv_token.value = malloc(gss_recv_token.length);
|
||||
if(!gss_recv_token.value) {
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_OUT_OF_MEMORY;
|
||||
}
|
||||
result = Curl_blockread_all(cf, data, (char *)gss_recv_token.value,
|
||||
|
|
@ -486,7 +486,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(result || (actualread != us_length)) {
|
||||
failf(data, "Failed to receive GSS-API encryption type.");
|
||||
gss_release_buffer(&gss_status, &gss_recv_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -498,7 +498,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
if(check_gss_err(data, gss_major_status, gss_minor_status, "gss_unwrap")) {
|
||||
gss_release_buffer(&gss_status, &gss_recv_token);
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
failf(data, "Failed to unwrap GSS-API encryption value into token.");
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
|
@ -508,7 +508,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data, "Invalid GSS-API encryption response length (%zu).",
|
||||
gss_w_token.length);
|
||||
gss_release_buffer(&gss_status, &gss_w_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -520,7 +520,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
failf(data, "Invalid GSS-API encryption response length (%zu).",
|
||||
gss_recv_token.length);
|
||||
gss_release_buffer(&gss_status, &gss_recv_token);
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
return CURLE_COULDNT_CONNECT;
|
||||
}
|
||||
|
||||
|
|
@ -537,7 +537,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
|
||||
conn->socks5_gssapi_enctype = socksreq[0];
|
||||
if(socksreq[0] == 0)
|
||||
gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
|
||||
|
||||
return CURLE_OK;
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue