From 3af75d504d83ae3c5660f68737c89ae777e676cc Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Mon, 25 Jul 2011 11:49:26 +0200 Subject: [PATCH 2/2] curl_gssapi: refine the handling of CURLOPT_GSSAPI_DELEGATION Suggested by Richard Silverman. --- docs/libcurl/curl_easy_setopt.3 | 8 ++++++-- include/curl/curl.h | 4 ++++ lib/curl_gssapi.c | 14 +++++++++++--- lib/url.c | 4 ++-- lib/urldata.h | 3 ++- 5 files changed, 25 insertions(+), 8 deletions(-) diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3 index 2cdfcf8..83ab2d4 100644 --- a/docs/libcurl/curl_easy_setopt.3 +++ b/docs/libcurl/curl_easy_setopt.3 @@ -2110,8 +2110,12 @@ support for FTP. (This option was known as CURLOPT_KRB4LEVEL up to 7.16.3) .IP CURLOPT_GSSAPI_DELEGATION -Set the parameter to 1 to allow GSSAPI credential delegation. The delegation -is disabled by default since 7.21.7. +Set the parameter to CURLGSSAPI_DELEGATION_FLAG to allow unconditional GSSAPI +credential delegation. The delegation is disabled by default since 7.21.7. +Set the parameter to CURLGSSAPI_DELEGATION_POLICY_FLAG to delegate only if +the OK-AS-DELEGATE flag is set in the service ticket in case this feature is +supported by the GSSAPI implementation, which means that +GSS_C_DELEG_POLICY_FLAG was defined at compile-time. (Added in 7.21.8) .SH SSH OPTIONS .IP CURLOPT_SSH_AUTH_TYPES diff --git a/include/curl/curl.h b/include/curl/curl.h index 3a510e5..9b2dc70 100644 --- a/include/curl/curl.h +++ b/include/curl/curl.h @@ -615,6 +615,10 @@ typedef enum { #define CURLSSH_AUTH_KEYBOARD (1<<3) /* keyboard interactive */ #define CURLSSH_AUTH_DEFAULT CURLSSH_AUTH_ANY +#define CURLGSSAPI_DELEGATION_NONE 0 /* no delegation (default) */ +#define CURLGSSAPI_DELEGATION_POLICY_FLAG (1<<0) /* if permitted by policy */ +#define CURLGSSAPI_DELEGATION_FLAG (1<<1) /* delegate always */ + #define CURL_ERROR_SIZE 256 struct curl_khkey { diff --git a/lib/curl_gssapi.c b/lib/curl_gssapi.c index 6b47987..2f25a77 100644 --- a/lib/curl_gssapi.c +++ b/lib/curl_gssapi.c @@ -36,10 +36,18 @@ OM_uint32 Curl_gss_init_sec_context( gss_buffer_t output_token, OM_uint32 * ret_flags) { - OM_uint32 req_flags; + OM_uint32 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG; - req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG; - if (data->set.gssapi_delegation) + if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) { +#ifdef GSS_C_DELEG_POLICY_FLAG + req_flags |= GSS_C_DELEG_POLICY_FLAG; +#else + infof(data, "warning: GSS_C_DELEG_POLICY_FLAG not provided by the GSSAPI " + "implementation\n"); +#endif + } + + if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG) req_flags |= GSS_C_DELEG_FLAG; return gss_init_sec_context(minor_status, diff --git a/lib/url.c b/lib/url.c index 9323b0c..c27e027 100644 --- a/lib/url.c +++ b/lib/url.c @@ -1985,9 +1985,9 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, break; case CURLOPT_GSSAPI_DELEGATION: /* - * allow GSSAPI credential delegation + * GSSAPI credential delegation */ - data->set.gssapi_delegation = (bool)(0 != va_arg(param, long)); + data->set.gssapi_delegation = va_arg(param, long); break; case CURLOPT_SSL_VERIFYPEER: /* diff --git a/lib/urldata.h b/lib/urldata.h index f774a13..a0a18e8 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -1527,7 +1527,8 @@ struct UserDefined { to pattern (e.g. if WILDCARDMATCH is on) */ void *fnmatch_data; - bool gssapi_delegation; /* allow GSSAPI credential delegation */ + long gssapi_delegation; /* GSSAPI credential delegation, see the + documentation of CURLOPT_GSSAPI_DELEGATION */ }; struct Names { -- 1.7.4.4