mirror of
https://github.com/curl/curl.git
synced 2026-07-31 08:58:03 +03:00
gssapi: add support for Apple GSS Framework
Add support for the native GSS Framework on Apple targets, which is Apple's fork of Heimdal. This option allows to drop Apple's deprecated MIT Kerberos compatibility shim "mit-krb5/1.7-prerelease". Source code uses different headers, other than that no source changes are necessary. You can enable by configuring with: autotools: `--enable-gssapi-apple` CMake: `-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=Apple` These options are experimental, and may receive breaking updates till the GSS backend selection logic settles, for Apple and also for the GNU and MIT implementation. Version string: ``` curl 8.21.0-DEV (aarch64-apple-darwin25.4.0) libcurl/8.21.0-DEV OpenSSL/3.6.2 zlib/1.2.12 AppleIDN AppleGSS OpenLDAP/2.4.28/Apple ``` Also: - drop in-source deprecation warning suppressions when using AppleGSS. - GHA/macos: enable Apple GSS in CI jobs. Supported by: iOS 5.0+, iPadOS 5.0+, Mac Catalyst 13.0+, macOS 10.14+, visionOS 1.0+ Ref: https://developer.apple.com/documentation/gss Ref: #19109 Closes #22052
This commit is contained in:
Viktor Szakats
parent
b8ceb430be
commit
d169ad68fa
13 changed files with 315 additions and 244 deletions
10
.github/workflows/macos.yml
vendored
10
.github/workflows/macos.yml
vendored
|
|
@ -39,7 +39,7 @@ permissions: {}
|
|||
# - 10.9 Mavericks (2013) - LDAP (build-time, deprecated), memset_s(), OCSP (runtime)
|
||||
# - 10.11 El Capitan (2015) - connectx() (runtime)
|
||||
# - 10.12 Sierra (2016) - clock_gettime() (build-time, runtime)
|
||||
# - 10.14 Mojave (2018) - SecTrustEvaluateWithError() (runtime)
|
||||
# - 10.14 Mojave (2018) - SecTrustEvaluateWithError() (runtime), GSS Framework
|
||||
|
||||
env:
|
||||
CURL_CI: github
|
||||
|
|
@ -328,12 +328,12 @@ jobs:
|
|||
-DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/opt/homebrew/opt/llvm/bin/clang-tidy
|
||||
-DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
|
||||
|
||||
- name: 'LibreSSL openldap krb5 c-ares +examples'
|
||||
- name: 'LibreSSL openldap AppleGSS c-ares +examples'
|
||||
compiler: clang
|
||||
install: libressl krb5 openldap
|
||||
generate: >-
|
||||
-DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON
|
||||
-DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
|
||||
-DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DENABLE_ARES=ON
|
||||
-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=Apple
|
||||
-DLDAP_INCLUDE_DIR=/opt/homebrew/opt/openldap/include
|
||||
-DLDAP_LIBRARY=/opt/homebrew/opt/openldap/lib/libldap.dylib
|
||||
-DLDAP_LBER_LIBRARY=/opt/homebrew/opt/openldap/lib/liblber.dylib
|
||||
|
|
@ -737,6 +737,7 @@ jobs:
|
|||
-DUSE_NGHTTP2=OFF -DUSE_LIBIDN2=OFF \
|
||||
-DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF \
|
||||
-DUSE_APPLE_IDN=ON -DUSE_APPLE_SECTRUST=ON \
|
||||
-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=Apple \
|
||||
${options}
|
||||
else
|
||||
export CFLAGS
|
||||
|
|
@ -756,6 +757,7 @@ jobs:
|
|||
--without-nghttp2 --without-libidn2 \
|
||||
--without-libpsl \
|
||||
--with-apple-idn --with-apple-sectrust \
|
||||
--enable-gssapi-apple \
|
||||
${options}
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -23,6 +23,10 @@
|
|||
###########################################################################
|
||||
# Find the GSS Kerberos library
|
||||
#
|
||||
# This module accepts optional COMPONENTS to control the GSS library flavor:
|
||||
#
|
||||
# - Apple
|
||||
#
|
||||
# Input variables:
|
||||
#
|
||||
# - `GSS_ROOT_DIR`: Absolute path to the root installation of GSS. (also supported as environment)
|
||||
|
|
@ -32,7 +36,7 @@
|
|||
# - `GSS_FOUND`: System has GSS.
|
||||
# - `GSS_VERSION`: Version of GSS.
|
||||
# - `CURL::gss`: GSS library target.
|
||||
# - `INTERFACE_CURL_GSS_FLAVOR`: Custom property. "GNU" or "MIT" if detected.
|
||||
# - `INTERFACE_CURL_GSS_FLAVOR`: Custom property. "Apple", "GNU" or "MIT" if detected.
|
||||
|
||||
set(_gnu_modname "gss")
|
||||
set(_mit_modname "mit-krb5-gssapi")
|
||||
|
|
@ -46,8 +50,12 @@ set(_gss_root_hints "${GSS_ROOT_DIR}" "$ENV{GSS_ROOT_DIR}")
|
|||
set(_gss_CFLAGS "")
|
||||
set(_gss_LIBRARY_DIRS "")
|
||||
|
||||
if(NOT APPLE AND GSS_FIND_COMPONENTS STREQUAL "Apple")
|
||||
set(GSS_FIND_COMPONENTS "")
|
||||
endif()
|
||||
|
||||
# Try to find library using system pkg-config if user did not specify root dir
|
||||
if(NOT GSS_ROOT_DIR AND NOT "$ENV{GSS_ROOT_DIR}")
|
||||
if(NOT GSS_ROOT_DIR AND NOT "$ENV{GSS_ROOT_DIR}" AND NOT GSS_FIND_COMPONENTS STREQUAL "Apple")
|
||||
if(CURL_USE_PKGCONFIG)
|
||||
find_package(PkgConfig QUIET)
|
||||
pkg_search_module(_gss ${_mit_modname} ${_gnu_modname})
|
||||
|
|
@ -60,136 +68,146 @@ if(NOT GSS_ROOT_DIR AND NOT "$ENV{GSS_ROOT_DIR}")
|
|||
endif()
|
||||
|
||||
if(NOT _gss_FOUND) # Not found by pkg-config. Let us take more traditional approach.
|
||||
find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin" HINTS ${_gss_root_hints}
|
||||
NO_CMAKE_PATH NO_CMAKE_ENVIRONMENT_PATH)
|
||||
# If not found in user-supplied directories, maybe system knows better
|
||||
find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin")
|
||||
if(GSS_FIND_COMPONENTS STREQUAL "Apple")
|
||||
find_path(_gss_INCLUDE_DIRS NAMES "GSS/gssapi.h" PATH_SUFFIXES "include")
|
||||
find_library(_gss_LIBRARIES NAMES "GSS")
|
||||
|
||||
if(_gss_configure_script)
|
||||
|
||||
set(_gss_INCLUDE_DIRS "")
|
||||
set(_gss_LIBRARIES "")
|
||||
|
||||
execute_process(COMMAND ${_gss_configure_script} "--cflags" "gssapi"
|
||||
OUTPUT_VARIABLE _gss_cflags_raw
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
message(STATUS "FindGSS krb5-config --cflags: ${_gss_cflags_raw}")
|
||||
|
||||
if(NOT _gss_configure_failed) # 0 means success
|
||||
# Should also work in an odd case when multiple directories are given.
|
||||
string(STRIP "${_gss_cflags_raw}" _gss_cflags_raw)
|
||||
string(REGEX REPLACE " +-(I)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
|
||||
string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
|
||||
|
||||
foreach(_flag IN LISTS _gss_cflags_raw)
|
||||
if(_flag MATCHES "^-I")
|
||||
string(REGEX REPLACE "^-I" "" _flag "${_flag}")
|
||||
list(APPEND _gss_INCLUDE_DIRS "${_flag}")
|
||||
else()
|
||||
list(APPEND _gss_CFLAGS "${_flag}")
|
||||
endif()
|
||||
endforeach()
|
||||
if(_gss_INCLUDE_DIRS AND _gss_LIBRARIES)
|
||||
message(STATUS "Found AppleGSS: ${_gss_INCLUDE_DIRS}")
|
||||
set(_gss_flavor "Apple")
|
||||
endif()
|
||||
else()
|
||||
find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin" HINTS ${_gss_root_hints}
|
||||
NO_CMAKE_PATH NO_CMAKE_ENVIRONMENT_PATH)
|
||||
# If not found in user-supplied directories, maybe system knows better
|
||||
find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin")
|
||||
|
||||
execute_process(COMMAND ${_gss_configure_script} "--libs" "gssapi"
|
||||
OUTPUT_VARIABLE _gss_lib_flags
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
message(STATUS "FindGSS krb5-config --libs: ${_gss_lib_flags}")
|
||||
if(_gss_configure_script)
|
||||
|
||||
if(NOT _gss_configure_failed) # 0 means success
|
||||
# This script gives us libraries and link directories.
|
||||
string(STRIP "${_gss_lib_flags}" _gss_lib_flags)
|
||||
string(REGEX REPLACE " +-(L|l)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
|
||||
string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
|
||||
set(_gss_INCLUDE_DIRS "")
|
||||
set(_gss_LIBRARIES "")
|
||||
|
||||
foreach(_flag IN LISTS _gss_lib_flags)
|
||||
if(_flag MATCHES "^-l")
|
||||
string(REGEX REPLACE "^-l" "" _flag "${_flag}")
|
||||
list(APPEND _gss_LIBRARIES "${_flag}")
|
||||
elseif(_flag MATCHES "^-L")
|
||||
string(REGEX REPLACE "^-L" "" _flag "${_flag}")
|
||||
list(APPEND _gss_LIBRARY_DIRS "${_flag}")
|
||||
endif()
|
||||
endforeach()
|
||||
endif()
|
||||
execute_process(COMMAND ${_gss_configure_script} "--cflags" "gssapi"
|
||||
OUTPUT_VARIABLE _gss_cflags_raw
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
message(STATUS "FindGSS krb5-config --cflags: ${_gss_cflags_raw}")
|
||||
|
||||
execute_process(COMMAND ${_gss_configure_script} "--version"
|
||||
OUTPUT_VARIABLE _gss_version
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
if(NOT _gss_configure_failed) # 0 means success
|
||||
# Should also work in an odd case when multiple directories are given.
|
||||
string(STRIP "${_gss_cflags_raw}" _gss_cflags_raw)
|
||||
string(REGEX REPLACE " +-(I)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
|
||||
string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
|
||||
|
||||
# Older versions may not have the "--version" parameter. In this case we do not care.
|
||||
if(_gss_configure_failed)
|
||||
set(_gss_version 0)
|
||||
else()
|
||||
# Strip prefix string to leave the version number only
|
||||
string(REPLACE "Kerberos 5 release " "" _gss_version "${_gss_version}")
|
||||
endif()
|
||||
|
||||
execute_process(COMMAND ${_gss_configure_script} "--vendor"
|
||||
OUTPUT_VARIABLE _gss_vendor
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
|
||||
# Older versions may not have the "--vendor" parameter. In this case we do not care.
|
||||
if(NOT _gss_configure_failed AND NOT _gss_vendor MATCHES "Heimdal|heimdal")
|
||||
set(_gss_flavor "MIT") # assume a default, should not really matter
|
||||
endif()
|
||||
|
||||
else() # Either there is no config script or we are on a platform that does not provide one (Windows?)
|
||||
|
||||
find_path(_gss_INCLUDE_DIRS NAMES "gssapi/gssapi.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include" "inc")
|
||||
|
||||
if(_gss_INCLUDE_DIRS) # We have found something
|
||||
set(_gss_libdir_suffixes "")
|
||||
|
||||
cmake_push_check_state()
|
||||
list(APPEND CMAKE_REQUIRED_INCLUDES "${_gss_INCLUDE_DIRS}")
|
||||
check_include_files("gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _gss_have_mit_headers)
|
||||
cmake_pop_check_state()
|
||||
|
||||
if(_gss_have_mit_headers)
|
||||
set(_gss_flavor "MIT")
|
||||
if(WIN32)
|
||||
if(CMAKE_SIZEOF_VOID_P EQUAL 8)
|
||||
list(APPEND _gss_libdir_suffixes "lib/AMD64")
|
||||
set(_gss_libname "gssapi64")
|
||||
foreach(_flag IN LISTS _gss_cflags_raw)
|
||||
if(_flag MATCHES "^-I")
|
||||
string(REGEX REPLACE "^-I" "" _flag "${_flag}")
|
||||
list(APPEND _gss_INCLUDE_DIRS "${_flag}")
|
||||
else()
|
||||
list(APPEND _gss_libdir_suffixes "lib/i386")
|
||||
set(_gss_libname "gssapi32")
|
||||
list(APPEND _gss_CFLAGS "${_flag}")
|
||||
endif()
|
||||
else()
|
||||
list(APPEND _gss_libdir_suffixes "lib" "lib64") # those suffixes are not checked for HINTS
|
||||
set(_gss_libname "gssapi_krb5")
|
||||
endforeach()
|
||||
endif()
|
||||
|
||||
execute_process(COMMAND ${_gss_configure_script} "--libs" "gssapi"
|
||||
OUTPUT_VARIABLE _gss_lib_flags
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
message(STATUS "FindGSS krb5-config --libs: ${_gss_lib_flags}")
|
||||
|
||||
if(NOT _gss_configure_failed) # 0 means success
|
||||
# This script gives us libraries and link directories.
|
||||
string(STRIP "${_gss_lib_flags}" _gss_lib_flags)
|
||||
string(REGEX REPLACE " +-(L|l)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
|
||||
string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
|
||||
|
||||
foreach(_flag IN LISTS _gss_lib_flags)
|
||||
if(_flag MATCHES "^-l")
|
||||
string(REGEX REPLACE "^-l" "" _flag "${_flag}")
|
||||
list(APPEND _gss_LIBRARIES "${_flag}")
|
||||
elseif(_flag MATCHES "^-L")
|
||||
string(REGEX REPLACE "^-L" "" _flag "${_flag}")
|
||||
list(APPEND _gss_LIBRARY_DIRS "${_flag}")
|
||||
endif()
|
||||
endforeach()
|
||||
endif()
|
||||
|
||||
execute_process(COMMAND ${_gss_configure_script} "--version"
|
||||
OUTPUT_VARIABLE _gss_version
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
|
||||
# Older versions may not have the "--version" parameter. In this case we do not care.
|
||||
if(_gss_configure_failed)
|
||||
set(_gss_version 0)
|
||||
else()
|
||||
# Strip prefix string to leave the version number only
|
||||
string(REPLACE "Kerberos 5 release " "" _gss_version "${_gss_version}")
|
||||
endif()
|
||||
|
||||
execute_process(COMMAND ${_gss_configure_script} "--vendor"
|
||||
OUTPUT_VARIABLE _gss_vendor
|
||||
RESULT_VARIABLE _gss_configure_failed
|
||||
OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
|
||||
# Older versions may not have the "--vendor" parameter. In this case we do not care.
|
||||
if(NOT _gss_configure_failed AND NOT _gss_vendor MATCHES "Heimdal|heimdal")
|
||||
set(_gss_flavor "MIT") # assume a default, should not really matter
|
||||
endif()
|
||||
|
||||
else() # Either there is no config script or we are on a platform that does not provide one (Windows?)
|
||||
|
||||
find_path(_gss_INCLUDE_DIRS NAMES "gssapi/gssapi.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include" "inc")
|
||||
|
||||
if(_gss_INCLUDE_DIRS) # We have found something
|
||||
set(_gss_libdir_suffixes "")
|
||||
|
||||
cmake_push_check_state()
|
||||
list(APPEND CMAKE_REQUIRED_INCLUDES "${_gss_INCLUDE_DIRS}")
|
||||
check_include_files("gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _gss_have_mit_headers)
|
||||
cmake_pop_check_state()
|
||||
|
||||
if(_gss_have_mit_headers)
|
||||
set(_gss_flavor "MIT")
|
||||
if(WIN32)
|
||||
if(CMAKE_SIZEOF_VOID_P EQUAL 8)
|
||||
list(APPEND _gss_libdir_suffixes "lib/AMD64")
|
||||
set(_gss_libname "gssapi64")
|
||||
else()
|
||||
list(APPEND _gss_libdir_suffixes "lib/i386")
|
||||
set(_gss_libname "gssapi32")
|
||||
endif()
|
||||
else()
|
||||
list(APPEND _gss_libdir_suffixes "lib" "lib64") # those suffixes are not checked for HINTS
|
||||
set(_gss_libname "gssapi_krb5")
|
||||
endif()
|
||||
endif()
|
||||
else()
|
||||
find_path(_gss_INCLUDE_DIRS NAMES "gss.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include")
|
||||
|
||||
if(_gss_INCLUDE_DIRS)
|
||||
set(_gss_flavor "GNU")
|
||||
set(_gss_pc_requires ${_gnu_modname})
|
||||
set(_gss_libname "gss")
|
||||
endif()
|
||||
endif()
|
||||
else()
|
||||
find_path(_gss_INCLUDE_DIRS NAMES "gss.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include")
|
||||
|
||||
if(_gss_INCLUDE_DIRS)
|
||||
set(_gss_flavor "GNU")
|
||||
set(_gss_pc_requires ${_gnu_modname})
|
||||
set(_gss_libname "gss")
|
||||
# If we have headers, look up libraries
|
||||
if(_gss_flavor)
|
||||
set(_gss_libdir_hints ${_gss_root_hints})
|
||||
if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
|
||||
cmake_path(GET _gss_INCLUDE_DIRS PARENT_PATH _gss_calculated_potential_root)
|
||||
else()
|
||||
get_filename_component(_gss_calculated_potential_root "${_gss_INCLUDE_DIRS}" DIRECTORY)
|
||||
endif()
|
||||
list(APPEND _gss_libdir_hints ${_gss_calculated_potential_root})
|
||||
|
||||
find_library(_gss_LIBRARIES NAMES ${_gss_libname} HINTS ${_gss_libdir_hints} PATH_SUFFIXES ${_gss_libdir_suffixes})
|
||||
endif()
|
||||
endif()
|
||||
|
||||
# If we have headers, look up libraries
|
||||
if(_gss_flavor)
|
||||
set(_gss_libdir_hints ${_gss_root_hints})
|
||||
if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
|
||||
cmake_path(GET _gss_INCLUDE_DIRS PARENT_PATH _gss_calculated_potential_root)
|
||||
else()
|
||||
get_filename_component(_gss_calculated_potential_root "${_gss_INCLUDE_DIRS}" DIRECTORY)
|
||||
endif()
|
||||
list(APPEND _gss_libdir_hints ${_gss_calculated_potential_root})
|
||||
|
||||
find_library(_gss_LIBRARIES NAMES ${_gss_libname} HINTS ${_gss_libdir_hints} PATH_SUFFIXES ${_gss_libdir_suffixes})
|
||||
endif()
|
||||
endif()
|
||||
if(NOT _gss_flavor)
|
||||
message(FATAL_ERROR "MIT or GNU GSS is required")
|
||||
message(FATAL_ERROR "MIT, GNU or Apple GSS is required")
|
||||
endif()
|
||||
else()
|
||||
if(_gss_MODULE_NAME STREQUAL _gnu_modname)
|
||||
|
|
@ -199,7 +217,7 @@ else()
|
|||
set(_gss_flavor "MIT")
|
||||
set(_gss_pc_requires ${_mit_modname})
|
||||
else()
|
||||
message(FATAL_ERROR "MIT or GNU GSS is required")
|
||||
message(FATAL_ERROR "MIT, GNU or Apple GSS is required")
|
||||
endif()
|
||||
message(STATUS "Found GSS/${_gss_flavor} (via pkg-config): ${_gss_INCLUDE_DIRS} (found version \"${_gss_version}\")")
|
||||
endif()
|
||||
|
|
|
|||
|
|
@ -74,7 +74,7 @@ if("@USE_ARES@")
|
|||
list(APPEND _curl_libs CURL::cares)
|
||||
endif()
|
||||
if("@HAVE_GSSAPI@")
|
||||
find_dependency(GSS MODULE)
|
||||
find_dependency(GSS MODULE COMPONENTS "@GSS_FLAVOR@")
|
||||
list(APPEND _curl_libs CURL::gss)
|
||||
endif()
|
||||
if("@USE_BACKTRACE@")
|
||||
|
|
|
|||
|
|
@ -1345,14 +1345,18 @@ option(CURL_USE_GSSAPI "Use GSSAPI implementation" OFF)
|
|||
mark_as_advanced(CURL_USE_GSSAPI)
|
||||
|
||||
if(CURL_USE_GSSAPI)
|
||||
find_package(GSS MODULE)
|
||||
set(CURL_GSS_FLAVOR "" CACHE STRING "Set preferred GSSAPI implementation ('Apple'). Default: MIT, then GNU (experimental)")
|
||||
|
||||
find_package(GSS MODULE COMPONENTS "${CURL_GSS_FLAVOR}")
|
||||
|
||||
set(HAVE_GSSAPI ${GSS_FOUND})
|
||||
if(GSS_FOUND)
|
||||
list(APPEND CURL_LIBS CURL::gss)
|
||||
|
||||
get_target_property(_gss_flavor CURL::gss INTERFACE_CURL_GSS_FLAVOR)
|
||||
if(_gss_flavor STREQUAL "GNU")
|
||||
get_target_property(GSS_FLAVOR CURL::gss INTERFACE_CURL_GSS_FLAVOR)
|
||||
if(GSS_FLAVOR STREQUAL "Apple")
|
||||
set(HAVE_GSSAPPLE 1)
|
||||
elseif(GSS_FLAVOR STREQUAL "GNU")
|
||||
set(HAVE_GSSGNU 1)
|
||||
elseif(GSS_VERSION) # MIT
|
||||
set(CURL_KRB5_VERSION "\"${GSS_VERSION}\"")
|
||||
|
|
@ -2388,6 +2392,7 @@ if(NOT CURL_DISABLE_INSTALL)
|
|||
# CURL_SUPPORTED_PROTOCOLS_LIST
|
||||
# CURL_USE_CMAKECONFIG
|
||||
# CURL_USE_PKGCONFIG
|
||||
# GSS_FLAVOR
|
||||
# HAVE_BROTLI
|
||||
# HAVE_GSSAPI
|
||||
# HAVE_LIBIDN2
|
||||
|
|
|
|||
255
configure.ac
255
configure.ac
|
|
@ -1914,6 +1914,27 @@ AC_ARG_WITH(gssapi,
|
|||
]
|
||||
)
|
||||
|
||||
want_gss_apple="no"
|
||||
if test "$curl_cv_apple" = "yes"; then
|
||||
AC_MSG_CHECKING([whether to use Apple GSS Framework for GSS-API])
|
||||
AC_ARG_ENABLE(gssapi-apple,
|
||||
AS_HELP_STRING([--enable-gssapi-apple],[Enable Apple GSS Framework (experimental)])
|
||||
AS_HELP_STRING([--disable-gssapi-apple],[Disable Apple GSS Framework (experimental) (default)]), [
|
||||
case "$enableval" in
|
||||
yes)
|
||||
want_gss="yes"
|
||||
want_gss_apple="yes"
|
||||
AC_MSG_RESULT([yes])
|
||||
;;
|
||||
*)
|
||||
AC_MSG_RESULT([no])
|
||||
;;
|
||||
esac
|
||||
],
|
||||
AC_MSG_RESULT([no])
|
||||
)
|
||||
fi
|
||||
|
||||
: ${KRB5CONFIG:="$GSSAPI_ROOT/bin/krb5-config"}
|
||||
|
||||
save_CPPFLAGS="$CPPFLAGS"
|
||||
|
|
@ -1921,130 +1942,146 @@ AC_MSG_CHECKING([if GSS-API support is requested])
|
|||
if test "$want_gss" = "yes"; then
|
||||
AC_MSG_RESULT(yes)
|
||||
|
||||
if test "$GSSAPI_ROOT" != "/usr"; then
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi, $GSSAPI_ROOT/lib/pkgconfig)
|
||||
if test "$want_gss_apple" = "yes"; then
|
||||
AC_CHECK_HEADER(GSS/gssapi.h, [
|
||||
AC_DEFINE(HAVE_GSSAPPLE, 1, [if you have Apple GSS Framework])
|
||||
],[
|
||||
AC_MSG_ERROR([--enable-gssapi-apple was specified, but GSS/gssapi.h was not found])
|
||||
])
|
||||
else
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi)
|
||||
fi
|
||||
if test -z "$GSSAPI_INCS"; then
|
||||
if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
|
||||
GSSAPI_INCS=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --cflags gssapi`
|
||||
elif test "$PKGCONFIG" != "no"; then
|
||||
GSSAPI_INCS=`$PKGCONFIG --cflags mit-krb5-gssapi`
|
||||
elif test -f "$KRB5CONFIG"; then
|
||||
GSSAPI_INCS=`$KRB5CONFIG --cflags gssapi`
|
||||
elif test "$GSSAPI_ROOT" != "yes"; then
|
||||
GSSAPI_INCS="-I$GSSAPI_ROOT/include"
|
||||
if test "$GSSAPI_ROOT" != "/usr"; then
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi, $GSSAPI_ROOT/lib/pkgconfig)
|
||||
else
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi)
|
||||
fi
|
||||
fi
|
||||
|
||||
CPPFLAGS="$CPPFLAGS $GSSAPI_INCS"
|
||||
|
||||
AC_CHECK_HEADER(gss.h,
|
||||
[
|
||||
dnl found in the given dirs
|
||||
AC_DEFINE(HAVE_GSSGNU, 1, [if you have GNU GSS])
|
||||
gnu_gss=yes
|
||||
],
|
||||
[
|
||||
dnl not found, check for MIT
|
||||
AC_CHECK_HEADERS(
|
||||
[gssapi/gssapi.h gssapi/gssapi_generic.h gssapi/gssapi_krb5.h],
|
||||
[],
|
||||
[not_mit=1])
|
||||
if test "$not_mit" = "1"; then
|
||||
dnl MIT not found
|
||||
AC_MSG_ERROR([MIT or GNU GSS library required, but not found])
|
||||
if test -z "$GSSAPI_INCS"; then
|
||||
if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
|
||||
GSSAPI_INCS=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --cflags gssapi`
|
||||
elif test "$PKGCONFIG" != "no"; then
|
||||
GSSAPI_INCS=`$PKGCONFIG --cflags mit-krb5-gssapi`
|
||||
elif test -f "$KRB5CONFIG"; then
|
||||
GSSAPI_INCS=`$KRB5CONFIG --cflags gssapi`
|
||||
elif test "$GSSAPI_ROOT" != "yes"; then
|
||||
GSSAPI_INCS="-I$GSSAPI_ROOT/include"
|
||||
fi
|
||||
]
|
||||
)
|
||||
fi
|
||||
|
||||
CPPFLAGS="$CPPFLAGS $GSSAPI_INCS"
|
||||
|
||||
AC_CHECK_HEADER(gss.h,
|
||||
[
|
||||
dnl found in the given dirs
|
||||
AC_DEFINE(HAVE_GSSGNU, 1, [if you have GNU GSS])
|
||||
gnu_gss=yes
|
||||
],
|
||||
[
|
||||
dnl not found, check for MIT
|
||||
AC_CHECK_HEADERS(
|
||||
[gssapi/gssapi.h gssapi/gssapi_generic.h gssapi/gssapi_krb5.h],
|
||||
[],
|
||||
[not_mit=1])
|
||||
if test "$not_mit" = "1"; then
|
||||
dnl MIT not found
|
||||
AC_MSG_ERROR([MIT or GNU GSS library required, but not found])
|
||||
fi
|
||||
]
|
||||
)
|
||||
fi
|
||||
else
|
||||
AC_MSG_RESULT(no)
|
||||
fi
|
||||
if test "$want_gss" = "yes"; then
|
||||
AC_DEFINE(HAVE_GSSAPI, 1, [if you have GSS-API libraries])
|
||||
HAVE_GSSAPI=1
|
||||
curl_gss_msg="enabled (MIT Kerberos)"
|
||||
link_pkgconfig=''
|
||||
|
||||
if test -n "$gnu_gss"; then
|
||||
curl_gss_msg="enabled (GNU GSS)"
|
||||
LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"
|
||||
LDFLAGSPC="$LDFLAGSPC $GSSAPI_LIB_DIR"
|
||||
LIBS="-lgss $LIBS"
|
||||
link_pkgconfig=1
|
||||
elif test -z "$GSSAPI_LIB_DIR"; then
|
||||
if test "$curl_cv_apple" = "yes"; then
|
||||
LIBS="-lgssapi_krb5 -lresolv $LIBS"
|
||||
else
|
||||
if test "$GSSAPI_ROOT" != "/usr"; then
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi, $GSSAPI_ROOT/lib/pkgconfig)
|
||||
else
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi)
|
||||
fi
|
||||
if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
|
||||
dnl krb5-config does not have --libs-only-L or similar, put everything
|
||||
dnl into LIBS
|
||||
gss_libs=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --libs gssapi`
|
||||
LIBS="$gss_libs $LIBS"
|
||||
elif test "$PKGCONFIG" != "no"; then
|
||||
gss_libs=`$PKGCONFIG --libs mit-krb5-gssapi`
|
||||
LIBS="$gss_libs $LIBS"
|
||||
link_pkgconfig=1
|
||||
elif test -f "$KRB5CONFIG"; then
|
||||
dnl krb5-config does not have --libs-only-L or similar, put everything
|
||||
dnl into LIBS
|
||||
gss_libs=`$KRB5CONFIG --libs gssapi`
|
||||
LIBS="$gss_libs $LIBS"
|
||||
link_pkgconfig=1
|
||||
else
|
||||
case $host in
|
||||
*-hp-hpux*)
|
||||
gss_libname="gss"
|
||||
;;
|
||||
*)
|
||||
gss_libname="gssapi"
|
||||
;;
|
||||
esac
|
||||
if test "$want_gss_apple" = "yes"; then
|
||||
curl_gss_msg="enabled (Apple GSS)"
|
||||
GSS_LDFLAGS='-framework GSS'
|
||||
LDFLAGS="$LDFLAGS $GSS_LDFLAGS"
|
||||
LDFLAGSPC="$LDFLAGSPC $GSS_LDFLAGS"
|
||||
else
|
||||
curl_gss_msg="enabled (MIT Kerberos)"
|
||||
link_pkgconfig=''
|
||||
|
||||
if test "$GSSAPI_ROOT" != "yes"; then
|
||||
LDFLAGS="$LDFLAGS -L$GSSAPI_ROOT/lib$libsuff"
|
||||
LDFLAGSPC="$LDFLAGSPC -L$GSSAPI_ROOT/lib$libsuff"
|
||||
LIBS="-l$gss_libname $LIBS"
|
||||
if test -n "$gnu_gss"; then
|
||||
curl_gss_msg="enabled (GNU GSS)"
|
||||
LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"
|
||||
LDFLAGSPC="$LDFLAGSPC $GSSAPI_LIB_DIR"
|
||||
LIBS="-lgss $LIBS"
|
||||
link_pkgconfig=1
|
||||
elif test -z "$GSSAPI_LIB_DIR"; then
|
||||
if test "$curl_cv_apple" = "yes"; then
|
||||
LIBS="-lgssapi_krb5 -lresolv $LIBS"
|
||||
else
|
||||
if test "$GSSAPI_ROOT" != "/usr"; then
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi, $GSSAPI_ROOT/lib/pkgconfig)
|
||||
else
|
||||
LIBS="-l$gss_libname $LIBS"
|
||||
CURL_CHECK_PKGCONFIG(mit-krb5-gssapi)
|
||||
fi
|
||||
if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
|
||||
dnl krb5-config does not have --libs-only-L or similar, put everything
|
||||
dnl into LIBS
|
||||
gss_libs=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --libs gssapi`
|
||||
LIBS="$gss_libs $LIBS"
|
||||
elif test "$PKGCONFIG" != "no"; then
|
||||
gss_libs=`$PKGCONFIG --libs mit-krb5-gssapi`
|
||||
LIBS="$gss_libs $LIBS"
|
||||
link_pkgconfig=1
|
||||
elif test -f "$KRB5CONFIG"; then
|
||||
dnl krb5-config does not have --libs-only-L or similar, put everything
|
||||
dnl into LIBS
|
||||
gss_libs=`$KRB5CONFIG --libs gssapi`
|
||||
LIBS="$gss_libs $LIBS"
|
||||
link_pkgconfig=1
|
||||
else
|
||||
case $host in
|
||||
*-hp-hpux*)
|
||||
gss_libname="gss"
|
||||
;;
|
||||
*)
|
||||
gss_libname="gssapi"
|
||||
;;
|
||||
esac
|
||||
|
||||
if test "$GSSAPI_ROOT" != "yes"; then
|
||||
LDFLAGS="$LDFLAGS -L$GSSAPI_ROOT/lib$libsuff"
|
||||
LDFLAGSPC="$LDFLAGSPC -L$GSSAPI_ROOT/lib$libsuff"
|
||||
LIBS="-l$gss_libname $LIBS"
|
||||
else
|
||||
LIBS="-l$gss_libname $LIBS"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
gss_version=""
|
||||
if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
|
||||
gss_version=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --version | $SED 's/Kerberos 5 release //'`
|
||||
elif test "$PKGCONFIG" != "no"; then
|
||||
gss_version=`$PKGCONFIG --modversion mit-krb5-gssapi`
|
||||
elif test -f "$KRB5CONFIG"; then
|
||||
gss_version=`$KRB5CONFIG --version | $SED 's/Kerberos 5 release //'`
|
||||
fi
|
||||
if test -n "$gss_version"; then
|
||||
AC_MSG_NOTICE([GSS-API MIT Kerberos version detected: $gss_version])
|
||||
AC_DEFINE_UNQUOTED([CURL_KRB5_VERSION], ["$gss_version"], [MIT Kerberos version])
|
||||
fi
|
||||
else
|
||||
LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"
|
||||
LDFLAGSPC="$LDFLAGSPC $GSSAPI_LIB_DIR"
|
||||
case $host in
|
||||
*-hp-hpux*)
|
||||
LIBS="-lgss $LIBS"
|
||||
;;
|
||||
*)
|
||||
LIBS="-lgssapi $LIBS"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
if test -n "$link_pkgconfig"; then
|
||||
if test -n "$gnu_gss"; then
|
||||
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE gss"
|
||||
gss_version=""
|
||||
if test -n "$host_alias" && test -f "$GSSAPI_ROOT/bin/$host_alias-krb5-config"; then
|
||||
gss_version=`$GSSAPI_ROOT/bin/$host_alias-krb5-config --version | $SED 's/Kerberos 5 release //'`
|
||||
elif test "$PKGCONFIG" != "no"; then
|
||||
gss_version=`$PKGCONFIG --modversion mit-krb5-gssapi`
|
||||
elif test -f "$KRB5CONFIG"; then
|
||||
gss_version=`$KRB5CONFIG --version | $SED 's/Kerberos 5 release //'`
|
||||
fi
|
||||
if test -n "$gss_version"; then
|
||||
AC_MSG_NOTICE([GSS-API MIT Kerberos version detected: $gss_version])
|
||||
AC_DEFINE_UNQUOTED([CURL_KRB5_VERSION], ["$gss_version"], [MIT Kerberos version])
|
||||
fi
|
||||
else
|
||||
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE mit-krb5-gssapi"
|
||||
LDFLAGS="$LDFLAGS $GSSAPI_LIB_DIR"
|
||||
LDFLAGSPC="$LDFLAGSPC $GSSAPI_LIB_DIR"
|
||||
case $host in
|
||||
*-hp-hpux*)
|
||||
LIBS="-lgss $LIBS"
|
||||
;;
|
||||
*)
|
||||
LIBS="-lgssapi $LIBS"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
if test -n "$link_pkgconfig"; then
|
||||
if test -n "$gnu_gss"; then
|
||||
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE gss"
|
||||
else
|
||||
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE mit-krb5-gssapi"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
else
|
||||
|
|
|
|||
|
|
@ -346,6 +346,7 @@ Details via CMake
|
|||
- `CURL_BROTLI`: Use brotli (`ON`, `OFF` or `AUTO`). Default: `AUTO`
|
||||
- `CURL_USE_CMAKECONFIG`: Enable detecting dependencies via CMake Config.
|
||||
Default: `ON` for MSVC (except under vcpkg), if not cross-compiling. (experimental)
|
||||
- `CURL_GSS_FLAVOR`: Set preferred GSSAPI implementation (`Apple`). Default: MIT, then GNU (experimental)
|
||||
- `CURL_USE_GNUTLS`: Enable GnuTLS for SSL/TLS. Default: `OFF`
|
||||
- `CURL_USE_GSASL`: Use libgsasl. Default: `OFF`
|
||||
- `CURL_USE_GSSAPI`: Use GSSAPI implementation. Default: `OFF`
|
||||
|
|
|
|||
|
|
@ -321,6 +321,9 @@
|
|||
/* if you have the gssapi libraries */
|
||||
#cmakedefine HAVE_GSSAPI 1
|
||||
|
||||
/* if you have Apple GSS */
|
||||
#cmakedefine HAVE_GSSAPPLE 1
|
||||
|
||||
/* if you have the GNU gssapi libraries */
|
||||
#cmakedefine HAVE_GSSGNU 1
|
||||
|
||||
|
|
|
|||
|
|
@ -55,7 +55,7 @@
|
|||
#define CURL_ALIGN8
|
||||
#endif
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic push
|
||||
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
||||
#endif
|
||||
|
|
@ -440,7 +440,7 @@ void Curl_gss_log_error(struct Curl_easy *data, const char *prefix,
|
|||
}
|
||||
#endif /* CURLVERBOSE */
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic pop
|
||||
#endif
|
||||
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@
|
|||
#include "socks.h"
|
||||
#include "curlx/strdup.h"
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic push
|
||||
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
||||
#endif
|
||||
|
|
@ -593,7 +593,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
|
|||
return result;
|
||||
}
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic pop
|
||||
#endif
|
||||
|
||||
|
|
|
|||
|
|
@ -98,7 +98,10 @@ typedef CURLcode (Curl_recv)(struct Curl_easy *data, /* transfer */
|
|||
#include "cf-socket.h"
|
||||
|
||||
#ifdef HAVE_GSSAPI
|
||||
# ifdef HAVE_GSSGNU
|
||||
# ifdef HAVE_GSSAPPLE
|
||||
# include <GSS/gssapi.h>
|
||||
# include <GSS/gssapi_oid.h>
|
||||
# elif defined(HAVE_GSSGNU)
|
||||
# include <gss.h>
|
||||
# elif defined(HAVE_GSSAPI_H)
|
||||
# include <gssapi.h>
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@
|
|||
#include "curl_gssapi.h"
|
||||
#include "curl_trc.h"
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic push
|
||||
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
||||
#endif
|
||||
|
|
@ -318,7 +318,7 @@ void Curl_auth_cleanup_gssapi(struct kerberos5data *krb5)
|
|||
}
|
||||
}
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic pop
|
||||
#endif
|
||||
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@
|
|||
#include "curl_gssapi.h"
|
||||
#include "curl_trc.h"
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic push
|
||||
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
||||
#endif
|
||||
|
|
@ -288,7 +288,7 @@ void Curl_auth_cleanup_spnego(struct negotiatedata *nego)
|
|||
nego->havemultiplerequests = FALSE;
|
||||
}
|
||||
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__)
|
||||
#if defined(CURL_HAVE_DIAG) && defined(__APPLE__) && !defined(HAVE_GSSAPPLE)
|
||||
#pragma GCC diagnostic pop
|
||||
#endif
|
||||
|
||||
|
|
|
|||
|
|
@ -242,7 +242,9 @@ char *curl_version(void)
|
|||
src[i++] = gsasl_buf;
|
||||
#endif
|
||||
#ifdef HAVE_GSSAPI
|
||||
#ifdef HAVE_GSSGNU
|
||||
#ifdef HAVE_GSSAPPLE
|
||||
curl_msnprintf(gss_buf, sizeof(gss_buf), "AppleGSS");
|
||||
#elif defined(HAVE_GSSGNU)
|
||||
curl_msnprintf(gss_buf, sizeof(gss_buf), "libgss/%s", GSS_VERSION);
|
||||
#elif defined(CURL_KRB5_VERSION)
|
||||
curl_msnprintf(gss_buf, sizeof(gss_buf), "mit-krb5/%s", CURL_KRB5_VERSION);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue