romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 18:43:08 +03:00
Code Issues Projects Releases Packages Wiki Activity
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl offers a myriad of powerful features
36708 commits 20 branches 229 tags 262 MiB
Find a file
Devdatta Talele 8616e5aada
gssapi: make channel binding conditional on GSS_C_CHANNEL_BOUND_FLAG 
Fixes #19109 - GSSAPI authentication fails on macOS with Apple's Heimdal
implementation which lacks GSS_C_CHANNEL_BOUND_FLAG support for TLS
channel binding.

Commit 0a5ea09a91 introduced TLS channel binding for SPNEGO/GSSAPI
authentication unconditionally, but Apple's Heimdal fork (used on macOS)
does not support this feature, causing "unsupported mechanism" errors
when authenticating to corporate HTTP services with Kerberos.

Solution:
- Add CURL_GSSAPI_HAS_CHANNEL_BINDING detection in curl_gssapi.h based
  on GSS_C_CHANNEL_BOUND_FLAG presence (MIT Kerberos >= 1.19)
- Make negotiatedata.channel_binding_data field conditional in vauth.h
- Guard channel binding collection/cleanup in http_negotiate.c
- Guard channel binding usage in spnego_gssapi.c

This follows the same pattern as GSS_C_DELEG_POLICY_FLAG detection and
ensures graceful degradation when channel binding is unavailable while
maintaining full support for implementations that have it.

Changes:
- lib/curl_gssapi.h: Add feature detection macro
- lib/vauth/vauth.h: Make struct field conditional
- lib/http_negotiate.c: Conditional init/cleanup (2 locations)
- lib/vauth/spnego_gssapi.c: Conditional channel binding usage

Tested on macOS with Apple Heimdal (no channel binding) and Linux with
MIT Kerberos (with channel binding). Both configurations authenticate
successfully without errors.

Closes #19164
2025-11-03 18:16:54 +01:00
.circleci CI: move no-verbose build from Circle CI to existing GHA jobs, with tests 2025-10-02 14:58:06 +02:00
.github GHA/dependabot: tidy-ups 2025-11-02 17:45:50 +01:00
CMake tidy-up: miscellaneous 2025-10-25 00:19:00 +02:00
docs tests: avoid more hard-coded CRLFs in protocol sections 2025-11-01 23:52:55 +01:00
include tidy-up: miscellaneous 2025-10-25 00:19:00 +02:00
lib gssapi: make channel binding conditional on GSS_C_CHANNEL_BOUND_FLAG 2025-11-03 18:16:54 +01:00
LICENSES krb5: drop support for Kerberos FTP 2025-09-20 23:58:28 +02:00
m4 autotools: merge ifs in GnuTLS/OpenSSL feature detection 2025-10-24 22:53:26 +02:00
packages spelling: subdirectories 2025-10-21 17:18:35 +02:00
plan9 tidy-up: LibreSSL Git repository URLs and local CI builds 2025-10-01 12:55:20 +02:00
projects build: drop the winbuild build system 2025-09-20 01:20:25 +02:00
scripts singleuse.pl: fix string warning 2025-10-28 11:34:19 +01:00
src tool/var: explain how the null termination byte is there 2025-10-30 20:22:37 +01:00
tests ftpserver.pl: fix newlines in 227/229 replies, adjust tests 2025-11-03 12:19:03 +01:00
.dir-locals.el copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
.editorconfig .editorconfig: add 2025-09-02 08:36:40 +02:00
.git-blame-ignore-revs copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
.gitattributes winbuild: MS-DOS batch tidy-ups 2024-07-02 19:26:15 +02:00
.gitignore build: drop the winbuild build system 2025-09-20 01:20:25 +02:00
.mailmap REUSE: add copyright header to two files 2025-11-03 16:08:52 +01:00
acinclude.m4 ssl: support Apple SecTrust configurations 2025-10-03 12:02:23 +02:00
appveyor.sh build: drop the winbuild build system 2025-09-20 01:20:25 +02:00
appveyor.yml CI: two display name tweaks 2025-11-01 02:24:17 +01:00
buildconf copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
CHANGES.md CHANGES: rename to CHANGES.md, no longer generated 2024-08-01 13:37:12 +02:00
CMakeLists.txt NTLM: disable if DES support missing from OpenSSL or mbedTLS 2025-10-24 12:12:20 +02:00
configure.ac NTLM: disable if DES support missing from OpenSSL or mbedTLS 2025-10-24 12:12:20 +02:00
COPYING COPYING: bump copyright year range to 1996 - 2025 2025-01-01 21:12:12 +01:00
curl-config.in curl-config: remove X prefix use 2025-08-04 10:01:07 +02:00
Dockerfile Dockerfile: update debian:bookworm-slim Docker digest to 78d2f66 2025-10-21 17:33:46 +02:00
GIT-INFO.md REUSE: add copyright header to two files 2025-11-03 16:08:52 +01:00
libcurl.pc.in configure: do not echo most inherited LDFLAGS to config files 2024-11-14 09:55:45 +01:00
Makefile.am cmake: add and use local FindGnuTLS module 2025-10-21 14:37:40 +02:00
README krb5: drop support for Kerberos FTP 2025-09-20 23:58:28 +02:00
README.md krb5: drop support for Kerberos FTP 2025-09-20 23:58:28 +02:00
RELEASE-NOTES RELEASE-NOTES: synced 2025-11-02 23:09:54 +01:00
renovate.json GHA: drop quictls 3.3.0 builds in favor of openssl 3.5+ 2025-10-04 17:49:21 +02:00
REUSE.toml REUSE: add copyright header to two files 2025-11-03 16:08:52 +01:00
SECURITY.md docs: Clarify OpenSSF Best Practices vs Scorecard 2024-08-22 11:50:20 +02:00

README.md

curl logo

curl is a command-line tool for transferring data specified with URL syntax. Learn how to use curl by reading the manpage or everything curl.

Find out how to install curl by reading the INSTALL document.

libcurl is the library curl is using to do its job. It is readily available to be used by your software. Read the libcurl manpage to learn how.

Open Source

curl is Open Source and is distributed under an MIT-like license.

Contact

Contact us on a suitable mailing list or use GitHub issues/ pull requests/ discussions.

All contributors to the project are listed in the THANKS document.

Commercial support

For commercial support, maybe private and dedicated help with your problems or applications using (lib)curl visit the support page.

Website

Visit the curl website for the latest news and downloads.

Source code

Download the latest source from the Git server:

git clone https://github.com/curl/curl.git

Security problems

Report suspected security problems via our HackerOne page and not in public.

Backers

Thank you to all our backers 🙏 Become a backer.

Sponsors

Support this project by becoming a sponsor.