romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-06 12:26:14 +03:00
Code Issues Projects Releases Packages Wiki Activity

lib: add ability to disable auths individually

Browse source 
Both with configure and cmake

Closes #11490
This commit is contained in:
Wyatt O'Day 2023-07-20 10:09:04 -04:00 • committed by Daniel Stenberg
parent 33dac9dfac
commit e92edfbef6
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
33 changed files with 266 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

19
lib/curl_config.h.cmake
View file

@ -41,8 +41,23 @@
/* disables cookies support */
#cmakedefine CURL_DISABLE_COOKIES 1
/* disables cryptographic authentication */
#cmakedefine CURL_DISABLE_CRYPTO_AUTH 1
/* disables Basic authentication */
#cmakedefine CURL_DISABLE_BASIC_AUTH 1
/* disables Bearer authentication */
#cmakedefine CURL_DISABLE_BEARER_AUTH 1
/* disables Digest authentication */
#cmakedefine CURL_DISABLE_DIGEST_AUTH 1
/* disables Kerberos authentication */
#cmakedefine CURL_DISABLE_KERBEROS_AUTH 1
/* disables negotiate authentication */
#cmakedefine CURL_DISABLE_NEGOTIATE_AUTH 1
/* disables AWS-SIG4 */
#cmakedefine CURL_DISABLE_AWS 1
/* disables DICT */
#cmakedefine CURL_DISABLE_DICT 1

3
lib/curl_hmac.h
View file

@ -24,7 +24,8 @@
*
***************************************************************************/
#ifndef CURL_DISABLE_CRYPTO_AUTH
#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
|| !defined(CURL_DISABLE_AWS)
#include <curl/curl.h>

4
lib/curl_md4.h
View file

@ -27,13 +27,13 @@
#include "curl_setup.h"
#include <curl/curl.h>
#if !defined(CURL_DISABLE_CRYPTO_AUTH)
#if defined(USE_CURL_NTLM_CORE)
#define MD4_DIGEST_LENGTH 16
CURLcode Curl_md4it(unsigned char *output, const unsigned char *input,
const size_t len);
#endif /* !defined(CURL_DISABLE_CRYPTO_AUTH) */
#endif /* defined(USE_CURL_NTLM_CORE) */
#endif /* HEADER_CURL_MD4_H */

4
lib/curl_md5.h
View file

@ -24,7 +24,9 @@
*
***************************************************************************/
#ifndef CURL_DISABLE_CRYPTO_AUTH
#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
|| !defined(CURL_DISABLE_DIGEST_AUTH)
#include "curl_hmac.h"
#define MD5_DIGEST_LEN 16

8
lib/curl_sasl.c
View file

@ -420,7 +420,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
}
else
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
if((enabledmechs & SASL_MECH_DIGEST_MD5) &&
Curl_auth_is_digest_supported()) {
mech = SASL_MECH_STRING_DIGEST_MD5;
@ -530,8 +530,8 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
struct bufref resp;
const char *hostname, *disp_hostname;
int port;
#if !defined(CURL_DISABLE_CRYPTO_AUTH) || defined(USE_KERBEROS5) || \
defined(USE_NTLM)
#if defined(USE_KERBEROS5) || defined(USE_NTLM) \
|| !defined(CURL_DISABLE_DIGEST_AUTH)
const char *service = data->set.str[STRING_SERVICE_NAME] ?
data->set.str[STRING_SERVICE_NAME] :
sasl->params->service;
@ -577,7 +577,6 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
case SASL_EXTERNAL:
result = Curl_auth_create_external_message(conn->user, &resp);
break;
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifdef USE_GSASL
case SASL_GSASL:
result = get_server_message(sasl, data, &serverdata);
@ -587,6 +586,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
newstate = SASL_GSASL;
break;
#endif
#ifndef CURL_DISABLE_DIGEST_AUTH
case SASL_CRAMMD5:
result = get_server_message(sasl, data, &serverdata);
if(!result)

6
lib/curl_setup.h
View file

@ -652,19 +652,19 @@
#endif
/* Single point where USE_SPNEGO definition might be defined */
#if !defined(CURL_DISABLE_CRYPTO_AUTH) && \
#if !defined(CURL_DISABLE_NEGOTIATE_AUTH) && \
(defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI))
#define USE_SPNEGO
#endif
/* Single point where USE_KERBEROS5 definition might be defined */
#if !defined(CURL_DISABLE_CRYPTO_AUTH) && \
#if !defined(CURL_DISABLE_KERBEROS_AUTH) && \
(defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI))
#define USE_KERBEROS5
#endif
/* Single point where USE_NTLM definition might be defined */
#if !defined(CURL_DISABLE_CRYPTO_AUTH) && !defined(CURL_DISABLE_NTLM)
#if !defined(CURL_DISABLE_NTLM)
# if defined(USE_OPENSSL) || defined(USE_MBEDTLS) || \
defined(USE_GNUTLS) || defined(USE_SECTRANSP) || \
defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO) || \

4
lib/curl_sha256.h
View file

@ -25,7 +25,9 @@
*
***************************************************************************/
#ifndef CURL_DISABLE_CRYPTO_AUTH
#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) \
|| defined(USE_LIBSSH2)
#include <curl/curl.h>
#include "curl_hmac.h"

2
lib/easy.c
View file

@ -1064,7 +1064,7 @@ void curl_easy_reset(struct Curl_easy *data)
memset(&data->state.authhost, 0, sizeof(struct auth));
memset(&data->state.authproxy, 0, sizeof(struct auth));
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH)
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)
Curl_http_auth_cleanup_digest(data);
#endif
}

5
lib/hmac.c
View file

@ -26,7 +26,8 @@
#include "curl_setup.h"
#ifndef CURL_DISABLE_CRYPTO_AUTH
#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
|| !defined(CURL_DISABLE_AWS)
#include <curl/curl.h>
@ -169,4 +170,4 @@ CURLcode Curl_hmacit(const struct HMAC_params *hashparams,
return CURLE_OK;
}
#endif /* CURL_DISABLE_CRYPTO_AUTH */
#endif /* Using NTLM (without SSPI) or AWS */

31
lib/http.c
View file

@ -341,6 +341,8 @@ char *Curl_copy_header_value(const char *header)
}
#ifndef CURL_DISABLE_HTTP_AUTH
#ifndef CURL_DISABLE_BASIC_AUTH
/*
* http_output_basic() sets up an Authorization: header (or the proxy version)
* for HTTP Basic authentication.
@ -402,6 +404,9 @@ fail:
return result;
}
#endif
#ifndef CURL_DISABLE_BEARER_AUTH
/*
* http_output_bearer() sets up an Authorization: header
* for HTTP Bearer authentication.
@ -429,6 +434,8 @@ fail:
#endif
#endif
/* pickoneauth() selects the most favourable authentication method from the
* ones available and the ones we want.
*
@ -445,18 +452,26 @@ static bool pickoneauth(struct auth *pick, unsigned long mask)
of preference in case of the existence of multiple accepted types. */
if(avail & CURLAUTH_NEGOTIATE)
pick->picked = CURLAUTH_NEGOTIATE;
#ifndef CURL_DISABLE_BEARER_AUTH
else if(avail & CURLAUTH_BEARER)
pick->picked = CURLAUTH_BEARER;
#endif
#ifndef CURL_DISABLE_DIGEST_AUTH
else if(avail & CURLAUTH_DIGEST)
pick->picked = CURLAUTH_DIGEST;
#endif
else if(avail & CURLAUTH_NTLM)
pick->picked = CURLAUTH_NTLM;
else if(avail & CURLAUTH_NTLM_WB)
pick->picked = CURLAUTH_NTLM_WB;
#ifndef CURL_DISABLE_BASIC_AUTH
else if(avail & CURLAUTH_BASIC)
pick->picked = CURLAUTH_BASIC;
#endif
#ifndef CURL_DISABLE_AWS
else if(avail & CURLAUTH_AWS_SIGV4)
pick->picked = CURLAUTH_AWS_SIGV4;
#endif
else {
pick->picked = CURLAUTH_PICKNONE; /* we select to use nothing */
picked = FALSE;
@ -722,11 +737,11 @@ output_auth_headers(struct Curl_easy *data,
CURLcode result = CURLE_OK;
(void)conn;
#ifdef CURL_DISABLE_CRYPTO_AUTH
#ifdef CURL_DISABLE_DIGEST_AUTH
(void)request;
(void)path;
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_AWS
if(authstatus->picked == CURLAUTH_AWS_SIGV4) {
auth = "AWS_SIGV4";
result = Curl_output_aws_sigv4(data, proxy);
@ -762,7 +777,7 @@ output_auth_headers(struct Curl_easy *data,
}
else
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
if(authstatus->picked == CURLAUTH_DIGEST) {
auth = "Digest";
result = Curl_output_digest(data,
@ -774,6 +789,7 @@ output_auth_headers(struct Curl_easy *data,
}
else
#endif
#ifndef CURL_DISABLE_BASIC_AUTH
if(authstatus->picked == CURLAUTH_BASIC) {
/* Basic */
if(
@ -793,6 +809,8 @@ output_auth_headers(struct Curl_easy *data,
functions work that way */
authstatus->done = TRUE;
}
#endif
#ifndef CURL_DISABLE_BEARER_AUTH
if(authstatus->picked == CURLAUTH_BEARER) {
/* Bearer */
if((!proxy && data->set.str[STRING_BEARER] &&
@ -807,6 +825,7 @@ output_auth_headers(struct Curl_easy *data,
functions work that way */
authstatus->done = TRUE;
}
#endif
if(auth) {
#ifndef CURL_DISABLE_PROXY
@ -1068,7 +1087,7 @@ CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
}
else
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
if(checkprefix("Digest", auth) && is_valid_auth_separator(auth[6])) {
if((authp->avail & CURLAUTH_DIGEST) != 0)
infof(data, "Ignoring duplicate digest auth header.");
@ -1091,6 +1110,7 @@ CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
}
else
#endif
#ifndef CURL_DISABLE_BASIC_AUTH
if(checkprefix("Basic", auth) &&
is_valid_auth_separator(auth[5])) {
*availp |= CURLAUTH_BASIC;
@ -1105,6 +1125,8 @@ CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
}
}
else
#endif
#ifndef CURL_DISABLE_BEARER_AUTH
if(checkprefix("Bearer", auth) &&
is_valid_auth_separator(auth[6])) {
*availp |= CURLAUTH_BEARER;
@ -1117,6 +1139,7 @@ CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
data->state.authproblem = TRUE;
}
}
#endif
/* there may be multiple methods on one line, so keep reading */
while(*auth && *auth != ',') /* read up to the next comma */

4
lib/http_aws_sigv4.c
View file

@ -24,7 +24,7 @@
#include "curl_setup.h"
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH)
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_AWS)
#include "urldata.h"
#include "strcase.h"
@ -646,4 +646,4 @@ fail:
return ret;
}
#endif /* !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH) */
#endif /* !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_AWS) */

2
lib/http_digest.c
View file

@ -24,7 +24,7 @@
#include "curl_setup.h"
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH)
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)
#include "urldata.h"
#include "strcase.h"

4
lib/http_digest.h
View file

@ -25,7 +25,7 @@
***************************************************************************/
#include "curl_setup.h"
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH)
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)
/* this is for digest header input */
CURLcode Curl_input_digest(struct Curl_easy *data,
@ -39,6 +39,6 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
void Curl_http_auth_cleanup_digest(struct Curl_easy *data);
#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_CRYPTO_AUTH */
#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_DIGEST_AUTH */
#endif /* HEADER_CURL_HTTP_DIGEST_H */

2
lib/ldap.c
View file

@ -239,7 +239,7 @@ static int ldap_win_bind_auth(LDAP *server, const char *user,
}
else
#endif
#if !defined(CURL_DISABLE_CRYPTO_AUTH)
#if !defined(CURL_DISABLE_DIGEST_AUTH)
if(authflags & CURLAUTH_DIGEST) {
method = LDAP_AUTH_DIGEST;
}

5
lib/md5.c
View file

@ -24,7 +24,8 @@
#include "curl_setup.h"
#ifndef CURL_DISABLE_CRYPTO_AUTH
#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
|| !defined(CURL_DISABLE_DIGEST_AUTH)
#include <string.h>
#include <curl/curl.h>
@ -652,4 +653,4 @@ CURLcode Curl_MD5_final(struct MD5_context *context, unsigned char *result)
return CURLE_OK;
}
#endif /* CURL_DISABLE_CRYPTO_AUTH */
#endif /* Using NTLM (without SSPI) || Digest */

10
lib/pop3.c
View file

@ -419,7 +419,7 @@ static CURLcode pop3_perform_user(struct Curl_easy *data,
return result;
}
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
/***********************************************************************
*
* pop3_perform_apop()
@ -563,7 +563,7 @@ static CURLcode pop3_perform_authentication(struct Curl_easy *data,
}
if(!result && progress == SASL_IDLE) {
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
if(pop3c->authtypes & pop3c->preftype & POP3_TYPE_APOP)
/* Perform APOP authentication */
result = pop3_perform_apop(data, conn);
@ -831,7 +831,7 @@ static CURLcode pop3_state_auth_resp(struct Curl_easy *data,
pop3_state(data, POP3_STOP); /* Authenticated */
break;
case SASL_IDLE: /* No mechanism left after cancellation */
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
if(pop3c->authtypes & pop3c->preftype & POP3_TYPE_APOP)
/* Perform APOP authentication */
result = pop3_perform_apop(data, conn);
@ -852,7 +852,7 @@ static CURLcode pop3_state_auth_resp(struct Curl_easy *data,
return result;
}
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
/* For APOP responses */
static CURLcode pop3_state_apop_resp(struct Curl_easy *data, int pop3code,
pop3state instate)
@ -1015,7 +1015,7 @@ static CURLcode pop3_statemachine(struct Curl_easy *data,
result = pop3_state_auth_resp(data, pop3code, pop3c->state);
break;
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
case POP3_APOP:
result = pop3_state_apop_resp(data, pop3code, pop3c->state);
break;

2
lib/setopt.c
View file

@ -679,6 +679,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
break;
#endif
#if !defined(CURL_DISABLE_AWS)
case CURLOPT_AWS_SIGV4:
/*
* String that is merged to some authentication
@ -692,6 +693,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
if(data->set.str[STRING_AWS_SIGV4])
data->set.httpauth = CURLAUTH_AWS_SIGV4;
break;
#endif
case CURLOPT_REFERER:
/*

5
lib/sha256.c
View file

@ -25,7 +25,8 @@
#include "curl_setup.h"
#ifndef CURL_DISABLE_CRYPTO_AUTH
#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) \
|| defined(USE_LIBSSH2)
#include "warnless.h"
#include "curl_sha256.h"
@ -541,4 +542,4 @@ const struct HMAC_params Curl_HMAC_SHA256[] = {
};
#endif /* CURL_DISABLE_CRYPTO_AUTH */
#endif /* AWS, DIGEST, or libSSH2 */

2
lib/url.c
View file

@ -414,7 +414,7 @@ CURLcode Curl_close(struct Curl_easy **datap)
Curl_hsts_cleanup(&data->hsts);
curl_slist_free_all(data->set.hstslist); /* clean up list */
#endif
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH)
#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_DIGEST_AUTH)
Curl_http_auth_cleanup_digest(data);
#endif
Curl_safefree(data->info.contenttype);

4
lib/urldata.h
View file

@ -336,6 +336,7 @@ struct Curl_ssl_session {
#include "curl_sspi.h"
#endif
#ifndef CURL_DISABLE_DIGEST_AUTH
/* Struct used for Digest challenge-response authentication */
struct digestdata {
#if defined(USE_WINDOWS_SSPI)
@ -359,6 +360,7 @@ struct digestdata {
BIT(userhash);
#endif
};
#endif
typedef enum {
NTLMSTATE_NONE,
@ -1347,7 +1349,7 @@ struct UrlState {
/* storage for the previous bag^H^H^HSIGPIPE signal handler :-) */
void (*prev_signal)(int sig);
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
#ifndef CURL_DISABLE_DIGEST_AUTH
struct digestdata digest; /* state data for host Digest auth */
struct digestdata proxydigest; /* state data for proxy Digest auth */
#endif

4
lib/vauth/cram.c
View file

@ -26,7 +26,7 @@
#include "curl_setup.h"
#if !defined(CURL_DISABLE_CRYPTO_AUTH)
#ifndef CURL_DISABLE_DIGEST_AUTH
#include <curl/curl.h>
#include "urldata.h"
@ -94,4 +94,4 @@ CURLcode Curl_auth_create_cram_md5_message(const struct bufref *chlg,
return CURLE_OK;
}
#endif /* !CURL_DISABLE_CRYPTO_AUTH */
#endif /* !CURL_DISABLE_DIGEST_AUTH */

4
lib/vauth/digest.c
View file

@ -27,7 +27,7 @@
#include "curl_setup.h"
#if !defined(CURL_DISABLE_CRYPTO_AUTH)
#ifndef CURL_DISABLE_DIGEST_AUTH
#include <curl/curl.h>
@ -992,4 +992,4 @@ void Curl_auth_digest_cleanup(struct digestdata *digest)
}
#endif /* !USE_WINDOWS_SSPI */
#endif /* CURL_DISABLE_CRYPTO_AUTH */
#endif /* !CURL_DISABLE_DIGEST_AUTH */

2
lib/vauth/digest.h
View file

@ -26,7 +26,7 @@
#include <curl/curl.h>
#if !defined(CURL_DISABLE_CRYPTO_AUTH)
#ifndef CURL_DISABLE_DIGEST_AUTH
#define DIGEST_MAX_VALUE_LENGTH 256
#define DIGEST_MAX_CONTENT_LENGTH 1024

4
lib/vauth/digest_sspi.c
View file

@ -27,7 +27,7 @@
#include "curl_setup.h"
#if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_CRYPTO_AUTH)
#if defined(USE_WINDOWS_SSPI) && !defined(CURL_DISABLE_DIGEST_AUTH)
#include <curl/curl.h>
@ -665,4 +665,4 @@ void Curl_auth_digest_cleanup(struct digestdata *digest)
Curl_safefree(digest->passwd);
}
#endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_CRYPTO_AUTH */
#endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_DIGEST_AUTH */

6
lib/vauth/vauth.h
View file

@ -30,7 +30,7 @@
struct Curl_easy;
#if !defined(CURL_DISABLE_CRYPTO_AUTH)
#if !defined(CURL_DISABLE_DIGEST_AUTH)
struct digestdata;
#endif
@ -86,7 +86,7 @@ CURLcode Curl_auth_create_login_message(const char *value,
CURLcode Curl_auth_create_external_message(const char *user,
struct bufref *out);
#if !defined(CURL_DISABLE_CRYPTO_AUTH)
#ifndef CURL_DISABLE_DIGEST_AUTH
/* This is used to generate a CRAM-MD5 response message */
CURLcode Curl_auth_create_cram_md5_message(const struct bufref *chlg,
const char *userp,
@ -119,7 +119,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
/* This is used to clean up the digest specific data */
void Curl_auth_digest_cleanup(struct digestdata *digest);
#endif /* !CURL_DISABLE_CRYPTO_AUTH */
#endif /* !CURL_DISABLE_DIGEST_AUTH */
#ifdef USE_GSASL
/* This is used to evaluate if MECH is supported by gsasl */