summaryrefslogtreecommitdiff
path: root/lib/curl_sasl.c
Commit message (Collapse)AuthorAgeFilesLines
* sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZIDSteve Holme2019-08-061-4/+6
| | | | | | | | | | | | | | | | | Added the ability for the calling program to specify the authorisation identity (authzid), the identity to act as, in addition to the authentication identity (authcid) and password when using SASL PLAIN authentication. Fixes #3653 Closes #3790 NOTE: This commit was cherry-picked and is part of a series of commits that added the authzid feature for upcoming 7.66.0. The series was temporarily reverted in db8ec1f so that it would not ship in a 7.65.x patch release. Closes https://github.com/curl/curl/pull/4186
* Revert all SASL authzid (new feature) commitsJay Satiro2019-05-251-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Revert all commits related to the SASL authzid feature since the next release will be a patch release, 7.65.1. Prior to this change CURLOPT_SASL_AUTHZID / --sasl-authzid was destined for the next release, assuming it would be a feature release 7.66.0. However instead the next release will be a patch release, 7.65.1 and will not contain any new features. After the patch release after the reverted commits can be restored by using cherry-pick: git cherry-pick a14d72c a9499ff 8c1cc36 c2a8d52 0edf690 Details for all reverted commits: Revert "os400: take care of CURLOPT_SASL_AUTHZID in curl_easy_setopt_ccsid()." This reverts commit 0edf6907ae37e2020722e6f61229d8ec64095b0a. Revert "tests: Fix the line endings for the SASL alt-auth tests" This reverts commit c2a8d52a1356a722ff9f4aeb983cd4eaf80ef221. Revert "examples: Added SASL PLAIN authorisation identity (authzid) examples" This reverts commit 8c1cc369d0c7163c6dcc91fd38edfea1f509ae75. Revert "curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool" This reverts commit a9499ff136d89987af885e2d7dff0a066a3e5817. Revert "sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID" This reverts commit a14d72ca2fec5d4eb5a043936e4f7ce08015c177.
* sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZIDSteve Holme2019-05-221-4/+6
| | | | | | | | | | Added the ability for the calling program to specify the authorisation identity (authzid), the identity to act as, in addition to the authentication identity (authcid) and password when using SASL PLAIN authentication. Fixed #3653 Closes #3790
* cleanup: remove FIXME and TODO commentsDaniel Stenberg2019-05-161-1/+1
| | | | | | | | | They serve very little purpose and mostly just add noise. Most of them have been around for a very long time. I read them all before removing or rephrasing them. Ref: #3876 Closes #3883
* sasl: only enable if there's a protocol enabled using itDaniel Stenberg2019-05-131-0/+4
|
* auth: Rename the various authentication clean up functionsSteve Holme2019-05-121-2/+2
| | | | | | For consistency and to a avoid confusion. Closes #3869
* sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616Steve Holme2019-04-221-2/+2
| | | | | | | RFC 4616 specifies the authzid is optional in the client authentication message and that the server will derive the authorisation identity (authzid) from the authentication identity (authcid) when not specified by the client.
* vauth/cleartext: Update the PLAIN login function signature to match RFC 4616Steve Holme2019-04-111-5/+4
| | | | | | | Functionally this doesn't change anything as we still use the username for both the authorisation identity and the authentication identity. Closes #3757
* vauth/oauth2: Fix OAUTHBEARER token generationMert Yazıcıoğlu2019-04-021-8/+6
| | | | | | | | | | | OAUTHBEARER tokens were incorrectly generated in a format similar to XOAUTH2 tokens. These changes make OAUTHBEARER tokens conform to the RFC7628. Fixes: #2487 Reported-by: Paolo Mossino Closes https://github.com/curl/curl/pull/3377
* urldata: rename easy_conn to just connDaniel Stenberg2019-01-111-4/+3
| | | | | | | | | | | | | | | We use "conn" everywhere to be a pointer to the connection. Introduces two functions that "attaches" and "detaches" the connection to and from the transfer. Going forward, we should favour using "data->conn" (since a transfer always only has a single connection or none at all) to "conn->data" (since a connection can have none, one or many transfers associated with it and updating conn->data to be correct is error prone and a frequent reason for internal issues). Closes #3442
* cppcheck: fix warningsMarian Klymov2018-06-111-2/+1
| | | | | | | | | | | | | - Get rid of variable that was generating false positive warning (unitialized) - Fix issues in tests - Reduce scope of several variables all over etc Closes #2631
* ntlm_sspi: fix authentication using Credential Managertoughengineer2018-04-161-6/+8
| | | | | | | | | | | | | If you pass empty user/pass asking curl to use Windows Credential Storage (as stated in the docs) and it has valid credentials for the domain, e.g. curl -v -u : --ntlm example.com currently authentication fails. This change fixes it by providing proper SPN string to the SSPI API calls. Fixes https://github.com/curl/curl/issues/1622 Closes https://github.com/curl/curl/pull/1660
* sasl: prefer PLAIN mechanism over LOGINPatrick Monnerat2018-02-211-10/+10
| | | | | SASL PLAIN is a standard, LOGIN only a draft. The LOGIN draft says PLAIN should be used instead if available.
* Curl_base64_encode: always call with a real data handle.Patrick Monnerat2017-09-021-2/+4
| | | | | Some calls in different modules were setting the data handle to NULL, causing segmentation faults when using builds that enable character code conversions.
* curl_sasl: fix unused-variable warningMarcel Raad2017-06-031-1/+4
| | | | | | | | This fixes the following warning with CURL_DISABLE_CRYPTO_AUTH, as seen in the autobuilds: curl_sasl.c:417:9: warning: unused variable 'serverdata' [-Wunused-variable]
* curl_sasl: fix build error with CURL_DISABLE_CRYPTO_AUTH + USE_NTLMDaniel Stenberg2017-05-161-2/+2
| | | | | Reported-by: wyattoday at github Fixes #1487
* curl_sasl: declare mechtable staticMartin Kepplinger2017-04-041-1/+1
| | | | struct mechtable is only used locally here. It can be declared static.
* checksrc: code style: use 'char *name' styleDaniel Stenberg2016-11-241-3/+3
|
* HTTPS-proxy: fixed mbedtls and polishingOkhin Vasilij2016-11-241-4/+10
|
* strcasecompare: all case insensitive string compares ignore locale nowDaniel Stenberg2016-10-311-1/+0
| | | | | We had some confusions on when each function was used. We should not act differently on different locales anyway.
* strcasecompare: is the new name for strequal()Daniel Stenberg2016-10-311-2/+1
| | | | | | | ... to make it less likely that we forget that the function actually does case insentive compares. Also replaced several invokes of the function with a plain strcmp when case sensitivity is not an issue (like comparing with "-").
* sasl: Don't use GSSAPI authentication when domain name not specifiedSteve Holme2016-08-211-1/+2
| | | | | | | Only choose the GSSAPI authentication mechanism when the user name contains a Windows domain name or the user is a valid UPN. Fixes #718
* sasl: Added calls to Curl_auth_is_<mechansism>_supported()Steve Holme2016-08-201-3/+4
| | | | | | | Hooked up the SASL authentication layer to query the new 'is mechanism supported' functions when deciding what mechanism to use. For now existing functionality is maintained.
* internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg2016-06-221-2/+2
|
* lib: include curl_printf.h as one of the last headersDaniel Stenberg2016-04-291-2/+1
| | | | | | | | | | | | | | | | | | | | curl_printf.h defines printf to curl_mprintf, etc. This can cause problems with external headers which may use __attribute__((format(printf, ...))) markers etc. To avoid that they cause problems with system includes, we include curl_printf.h after any system headers. That makes the three last headers to always be, and we keep them in this order: curl_printf.h curl_memory.h memdebug.h None of them include system headers, they all do funny #defines. Reported-by: David Benjamin Fixes #743
* sasl: Fixed compilation errors from commit 9d89a0387Steve Holme2016-04-091-1/+5
| | | | ...when GSS-API or Windows SSPI are not used.
* ftp/imap/pop3/smtp: Allow the service name to be overriddenSteve Holme2016-04-081-3/+9
| | | | | Allow the service name to be overridden for DIGIST-MD5 and Kerberos 5 authentication in FTP, IMAP, POP3 and SMTP.
* curl_sasl: Fixed potential null pointer utilisationSteve Holme2016-04-031-7/+5
| | | | | | | | | | | | Although this should never happen due to the relationship between the 'mech' and 'resp' variables, and the way they are allocated together, it does cause problems for code analysis tools: V595 The 'mech' pointer was utilized before it was verified against nullptr. Check lines: 376, 381. curl_sasl.c 376 Bug: https://github.com/curl/curl/issues/745 Reported-by: Alexis La Goutte
* krb5: Moved host from Curl_auth_create_gssapi_user_message() to be argumentSteve Holme2016-04-021-1/+5
| | | | | | | | For consistency with the spnego and oauth2 code moved the setting of the host name outside of the Curl_auth_create_gssapi_user_messag() function. This will allow us to more easily override it in the future.
* vauth: Refactored function names after move to new vauth directorySteve Holme2016-03-251-42/+44
| | | | | Renamed all the SASL functions that moved to the new vauth directory to include the correct module name.
* vauth: Moved the OAuth 2.0 authentication code to the new vauth directorySteve Holme2016-03-251-49/+0
|
* vauth: Moved the NTLM authentication code to the new vauth directorySteve Holme2016-03-251-21/+0
|
* vauth: Moved the DIGEST authentication code to the new vauth directorySteve Holme2016-03-251-837/+0
|
* vauth: Moved the CRAM-MD5 authentication code to the new vauth directorySteve Holme2016-03-251-100/+1
|
* vauth: Moved the ClearText authentication code to the new vauth directorySteve Holme2016-03-251-113/+0
|
* vauth: Moved Curl_sasl_build_spn() to create the initial vauth source filesSteve Holme2016-03-251-20/+1
|
* ftp/imap/pop3/smtp: Fixed compilation warning when /Wall enabledSteve Holme2016-03-191-6/+9
| | | | warning C4706: assignment within conditional expression
* curl_sasl.c: minor code indent fixesDaniel Stenberg2016-03-141-29/+29
|
* digest: Use boolean based success code for Curl_sasl_digest_get_pair()Steve Holme2016-03-121-11/+10
| | | | | Rather than use a 0 and 1 integer base result code use a TRUE / FALSE based success code.
* digest: Corrected some typos in commentsSteve Holme2016-03-121-9/+9
|
* ntlm: Corrected some typos in function descriptionsSteve Holme2016-03-121-4/+4
|
* curl_sasl: Fix memory leak in digest parserEmil Lerner2016-02-191-0/+6
| | | | | | | If any parameter in a HTTP DIGEST challenge message is present multiple times, memory allocated for all but the last entry should be freed. Bug: https://github.com/curl/curl/pull/667
* URLs: change all http:// URLs to https://Daniel Stenberg2016-02-031-1/+1
|
* sasl; fix checksrc warningsDaniel Stenberg2015-11-151-4/+6
|
* oauth2: Support OAUTHBEARER failures sent as continuation responsesSteve Holme2015-11-151-2/+30
| | | | | | | According to RFC7628 a failure message may be sent by the server in a base64 encoded JSON string as a continuation response. Currently only implemented for OAUTHBEARER and not XAUTH2.
* oauth2: Added support for OAUTHBEARER SASL mechanism to IMAP, POP3 and SNMPSteve Holme2015-11-141-13/+34
| | | | | | OAUTHBEARER is now the official "registered" SASL mechanism name for OAuth 2.0. However, we don't want to drop support for XOAUTH2 as some servers won't support the new mechanism yet.
* sasl: Re-introduced XOAUTH2 in the default enabled authentication mechanismSteve Holme2015-11-121-2/+1
| | | | | | | | | Following the fix in commit d6d58dd558 it is necessary to re-introduce XOAUTH2 in the default enabled authentication mechanism, which was removed in commit 7b2012f262, otherwise users will have to specify AUTH=XOAUTH2 in the URL. Note: OAuth 2.0 will only be used when the bearer is specified.
* oauth2: Re-factored OAuth 2.0 state variableSteve Holme2015-11-121-3/+3
|
* sasl: Don't choose OAuth 2.0 if mechanism not advertisedSteve Holme2015-11-121-1/+2
| | | | | | Regression from commit 9e8ced9890 which meant if --oauth2-bearer was specified but the SASL mechanism wasn't supported by the server then the mechanism would be chosen.
* oauth2: Introduced support for host and port detailsSteve Holme2015-11-111-5/+18
| | | | | | Added support to the OAuth 2.0 message function for host and port, in order to accommodate the official OAUTHBEARER SASL mechanism which is to be added shortly.
View Lorry Controller Status