romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 07:17:20 +03:00
Code Issues Projects Releases Packages Wiki Activity

spnego_sspi: honor CURLOPT_GSSAPI_DELEGATION for Windows SSPI

Browse source 
Make CURLOPT_GSSAPI_DELEGATION effective on Windows builds that use SSPI
(instead of a native GSS-API implementation), so Kerberos delegation can
be requested during SPNEGO/Negotiate authentication.

Closes #21528
This commit is contained in:
Song X. Gao 2026-05-11 12:45:15 -04:00 • committed by Daniel Stenberg
parent 2256162fa7
commit cc6777d939
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
7 changed files with 128 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/setopt.c
View file

@ -1288,7 +1288,7 @@ static CURLcode setopt_long_misc(struct Curl_easy *data, CURLoption option,
case CURLOPT_ALTSVC_CTRL:
return Curl_altsvc_ctrl(data, arg);
#endif
#ifdef HAVE_GSSAPI
#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
case CURLOPT_GSSAPI_DELEGATION:
s->gssapi_delegation = (unsigned char)arg &
(CURLGSSAPI_DELEGATION_POLICY_FLAG | CURLGSSAPI_DELEGATION_FLAG);

5
lib/urldata.h
View file

@ -1191,9 +1191,8 @@ struct UserDefined {
uint8_t ipver; /* the CURL_IPRESOLVE_* defines in the public header
file 0 - whatever, 1 - v2, 2 - v6 */
uint8_t upload_flags; /* flags set by CURLOPT_UPLOAD_FLAGS */
#ifdef HAVE_GSSAPI
/* GSS-API credential delegation, see the documentation of
CURLOPT_GSSAPI_DELEGATION */
#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
/* GSS-API/SSPI credential delegation, see CURLOPT_GSSAPI_DELEGATION */
uint8_t gssapi_delegation;
#endif
uint8_t http_follow_mode; /* follow HTTP redirects */

24
lib/vauth/spnego_sspi.c
View file

@ -223,15 +223,21 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
resp_buf.cbBuffer = curlx_uztoul(nego->token_max);
/* Generate our challenge-response message */
nego->status =
Curl_pSecFn->InitializeSecurityContext(nego->credentials,
chlg ? nego->context : NULL,
nego->spn,
ISC_REQ_CONFIDENTIALITY,
0, SECURITY_NATIVE_DREP,
chlg ? &chlg_desc : NULL,
0, nego->context,
&resp_desc, &attrs, NULL);
{
DWORD sspi_flags = ISC_REQ_CONFIDENTIALITY;
if(data->set.gssapi_delegation & (CURLGSSAPI_DELEGATION_FLAG |
CURLGSSAPI_DELEGATION_POLICY_FLAG))
sspi_flags |= ISC_REQ_DELEGATE | ISC_REQ_MUTUAL_AUTH;
nego->status =
Curl_pSecFn->InitializeSecurityContext(nego->credentials,
chlg ? nego->context : NULL,
nego->spn,
sspi_flags,
0, SECURITY_NATIVE_DREP,
chlg ? &chlg_desc : NULL,
0, nego->context,
&resp_desc, &attrs, NULL);
}
/* Free the decoded challenge as it is not required anymore */
curlx_free(chlg);