From 188cf6b4eb47c6bc97a9d93aa0c7ea6331b29838 Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Mon, 25 Jul 2011 11:49:26 +0200
Subject: [PATCH 2/2] curl_gssapi: refine the handling of
 CURLOPT_GSSAPI_DELEGATION

Suggested by Richard Silverman.
---
 docs/libcurl/curl_easy_setopt.3 |    7 +++++--
 lib/curl_gssapi.c               |   21 ++++++++++++++++++---
 lib/url.c                       |    4 ++--
 lib/urldata.h                   |    5 ++++-
 4 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3
index 2cdfcf8..6b2a939 100644
--- a/docs/libcurl/curl_easy_setopt.3
+++ b/docs/libcurl/curl_easy_setopt.3
@@ -2110,8 +2110,11 @@ support for FTP.
 
 (This option was known as CURLOPT_KRB4LEVEL up to 7.16.3)
 .IP CURLOPT_GSSAPI_DELEGATION
-Set the parameter to 1 to allow GSSAPI credential delegation.  The delegation
-is disabled by default since 7.21.7.
+Set the parameter to 2 to allow unconditional GSSAPI credential delegation.  The
+delegation is disabled by default since 7.21.7.  Set the parameter to 1 to
+delegate only if the OK-AS-DELEGATE flag is set in the service ticket in case
+this feature is supported by the GSSAPI implementation; otherwise the value 1 is
+treated as disable credential delegation, too.
 (Added in 7.21.8)
 .SH SSH OPTIONS
 .IP CURLOPT_SSH_AUTH_TYPES
diff --git a/lib/curl_gssapi.c b/lib/curl_gssapi.c
index 6b47987..a6801dc 100644
--- a/lib/curl_gssapi.c
+++ b/lib/curl_gssapi.c
@@ -36,11 +36,26 @@ OM_uint32 Curl_gss_init_sec_context(
     gss_buffer_t output_token,
     OM_uint32 * ret_flags)
 {
-  OM_uint32 req_flags;
+  OM_uint32 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
 
-  req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
-  if (data->set.gssapi_delegation)
+  switch(data->set.gssapi_delegation) {
+  case 0L:
+  default:
+    break;
+
+  case 1L:
+#ifdef GSS_C_DELEG_POLICY_FLAG
+    req_flags |= GSS_C_DELEG_POLICY_FLAG;
+#else
+    infof(data, "warning: GSS_C_DELEG_POLICY_FLAG not provided by the GSSAPI "
+        "implementation\n");
+#endif
+    break;
+
+  case 2L:
     req_flags |= GSS_C_DELEG_FLAG;
+    break;
+  }
 
   return gss_init_sec_context(minor_status,
                               GSS_C_NO_CREDENTIAL, /* cred_handle */
diff --git a/lib/url.c b/lib/url.c
index 9323b0c..c27e027 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1985,9 +1985,9 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
     break;
   case CURLOPT_GSSAPI_DELEGATION:
     /*
-     * allow GSSAPI credential delegation
+     * GSSAPI credential delegation
      */
-    data->set.gssapi_delegation = (bool)(0 != va_arg(param, long));
+    data->set.gssapi_delegation = va_arg(param, long);
     break;
   case CURLOPT_SSL_VERIFYPEER:
     /*
diff --git a/lib/urldata.h b/lib/urldata.h
index f774a13..1cd83e9 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -1527,7 +1527,10 @@ struct UserDefined {
                                     to pattern (e.g. if WILDCARDMATCH is on) */
   void *fnmatch_data;
 
-  bool gssapi_delegation;	/* allow GSSAPI credential delegation */
+  long gssapi_delegation; /* GSSAPI credential delegation
+                             0: disable credential delegation (default)
+                             1: if OK-AS-DELEGATE is set in the service ticket
+                             2: unconditional credential delegation */
 };
 
 struct Names {
-- 
1.7.4.4