summaryrefslogtreecommitdiff
path: root/lib/krb5.c
Commit message (Collapse)AuthorAgeFilesLines
* krb5: avoid sscanf for parsingDaniel Stenberg2023-02-241-4/+4
| | | | Closes #10599
* krb5: silence cast-align warningMarcel Raad2023-02-161-1/+1
| | | | | | | Add an intermediate cast to `void *`, as done everywhere else when casting from `sockaddr *` to `sockaddr_in *`. Closes https://github.com/curl/curl/pull/10528
* cf-socket: improvements in socket I/O handlingStefan Eissing2023-01-311-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Curl_write_plain/Curl_read_plain have been eliminated. Last code use now uses Curl_conn_send/recv so that requests use conn->send/revc callbacks which defaults to cfilters use. - Curl_recv_plain/Curl_send_plain have been internalized in cf-socket.c. - USE_RECV_BEFORE_SEND_WORKAROUND (active on Windows) has been moved into cf-socket.c. The pre_recv buffer is held at the socket filter context. `postponed_data` structures have been removed from `connectdata`. - the hanger in HTTP/2 request handling was a result of read buffering on all sends and the multi handling is not prepared for this. The following happens: - multi preforms on a HTTP/2 easy handle - h2 reads and processes data - this leads to a send of h2 data - which receives and buffers before the send - h2 returns - multi selects on the socket, but no data arrives (its in the buffer already) the workaround now receives data in a loop as long as there is something in the buffer. The real fix would be for multi to change, so that `data_pending` is evaluated before deciding to wait on the socket. io_buffer, optional, in cf-socket.c, http/2 sets state.drain if lower filter have pending data. This io_buffer is only available/used when the -DUSE_RECV_BEFORE_SEND_WORKAROUND is active, e.g. on Windows configurations. It also maintains the original checks on protocol handler being HTTP and conn->send/recv not being replaced. The HTTP/2 (nghttp2) cfilter now sets data->state.drain when it finds out that the "lower" filter chain has still pending data at the end of its IO operation. This prevents the processing from becoming stalled. Closes #10280
* cf-socket: keep sockaddr local in the socket filtersStefan Eissing2023-01-031-3/+4
| | | | | | | | | | | | | - copy `struct Curl_addrinfo` on filter setup into context - remove `struct Curl_addrinfoi *` with `struct Curl_sockaddr_ex *` in connectdata that is set and NULLed by the socket filter - this means we have no reference to the resolver info in connectdata or its filters - trigger the CF_CTRL_CONN_INFO_UPDATE event when the complete filter chain reaches connected status - update easy handle connection information on CF_CTRL_DATA_SETUP event. Closes #10213
* copyright: update all copyright lines and remove year rangesDaniel Stenberg2023-01-031-1/+1
| | | | | | | | | | | | - they are mostly pointless in all major jurisdictions - many big corporations and projects already don't use them - saves us from pointless churn - git keeps history for us - the year range is kept in COPYING checksrc is updated to allow non-year using copyright statements Closes #10205
* sendf: change Curl_read_plain to wrap Curl_recv_plain (take 2)Jay Satiro2022-11-201-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this change Curl_read_plain would attempt to read the socket directly. On Windows that's a problem because recv data may be cached by libcurl and that data is only drained using Curl_recv_plain. Rather than rewrite Curl_read_plain to handle cached recv data, I changed it to wrap Curl_recv_plain, in much the same way that Curl_write_plain already wraps Curl_send_plain. Curl_read_plain -> Curl_recv_plain Curl_write_plain -> Curl_send_plain This fixes a bug in the schannel backend where decryption of arbitrary TLS records fails because cached recv data is never drained. We send data (TLS records formed by Schannel) using Curl_write_plain, which calls Curl_send_plain, and that may do a recv-before-send ("pre-receive") to cache received data. The code calls Curl_read_plain to read data (TLS records from the server), which prior to this change did not call Curl_recv_plain and therefore cached recv data wasn't retrieved, resulting in malformed TLS records and decryption failure (SEC_E_DECRYPT_FAILURE). The bug has only been observed during Schannel TLS 1.3 handshakes. Refer to the issue and PR for more information. -- This is take 2 of the original fix. It preserves the original behavior of Curl_read_plain to write 0 to the bytes read parameter on error, since apparently some callers expect that (SOCKS tests were hanging). The original fix which landed in 12e1def5 and was later reverted in 18383fbf failed to work properly because it did not do that. Also, it changes Curl_write_plain the same way to complement Curl_read_plain, and it changes Curl_send_plain to return -1 instead of 0 on CURLE_AGAIN to complement Curl_recv_plain. Behavior on error with these changes: Curl_recv_plain returns -1 and *code receives error code. Curl_send_plain returns -1 and *code receives error code. Curl_read_plain returns error code and *n (bytes read) receives 0. Curl_write_plain returns error code and *written receives 0. -- Ref: https://github.com/curl/curl/issues/9431#issuecomment-1312420361 Assisted-by: Joel Depooter Reported-by: Egor Pugin Fixes https://github.com/curl/curl/issues/9431 Closes https://github.com/curl/curl/pull/9949
* Revert "sendf: change Curl_read_plain to wrap Curl_recv_plain"Daniel Stenberg2022-11-181-8/+8
| | | | | | | | This reverts commit 12e1def51a75392df62e65490416007d7e68dab9. It introduced SOCKS proxy fails, like test 700 never ending. Reopens #9431
* sendf: change Curl_read_plain to wrap Curl_recv_plainJay Satiro2022-11-181-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this change Curl_read_plain would attempt to read the socket directly. On Windows that's a problem because recv data may be cached by libcurl and that data is only drained using Curl_recv_plain. Rather than rewrite Curl_read_plain to handle cached recv data, I changed it to wrap Curl_recv_plain, in much the same way that Curl_write_plain already wraps Curl_send_plain. Curl_read_plain -> Curl_recv_plain Curl_write_plain -> Curl_send_plain This fixes a bug in the schannel backend where decryption of arbitrary TLS records fails because cached recv data is never drained. We send data (TLS records formed by Schannel) using Curl_write_plain, which calls Curl_send_plain, and that may do a recv-before-send ("pre-receive") to cache received data. The code calls Curl_read_plain to read data (TLS records from the server), which prior to this change did not call Curl_recv_plain and therefore cached recv data wasn't retrieved, resulting in malformed TLS records and decryption failure (SEC_E_DECRYPT_FAILURE). The bug has only been observed during Schannel TLS 1.3 handshakes. Refer to the issue and PR for more information. Ref: https://github.com/curl/curl/issues/9431#issuecomment-1312420361 Assisted-by: Joel Depooter Reported-by: Egor Pugin Fixes https://github.com/curl/curl/issues/9431 Closes https://github.com/curl/curl/pull/9904
* build: fix for NonStopRandall S. Becker2022-10-271-0/+3
| | | | | | | | - Include arpa/inet.h in all units where htonl is called. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Closes https://github.com/curl/curl/pull/9816
* krb5: return error properly on decode errorsDaniel Stenberg2022-06-251-7/+11
| | | | | | | Bug: https://curl.se/docs/CVE-2022-32208.html CVE-2022-32208 Reported-by: Harry Sintonen Closes #9051
* copyright: make repository REUSE compliantmax.mehl2022-06-131-0/+2
| | | | | | | | | | | Add licensing and copyright information for all files in this repository. This either happens in the file itself as a comment header or in the file `.reuse/dep5`. This commit also adds a Github workflow to check pull requests and adapts copyright.pl to the changes. Closes #8869
* lib: remove support for CURL_DOES_CONVERSIONSDaniel Stenberg2022-02-041-9/+3
| | | | | | TPF was the only user and support for that was dropped. Closes #8378
* checksrc: detect more kinds of NULL comparisons we avoidDaniel Stenberg2021-12-271-1/+1
| | | | | Co-authored-by: Jay Satiro Closes #8180
* lib: fixing comment spelling typos in lib filesEddie Lumpkin2021-10-221-2/+2
| | | | | Closes #7894 Signed-off-by: ewlumpkin <ewlumpkin@gmail.com>
* cleanup: constify unmodified static structsRikard Falkeborn2021-09-231-1/+1
| | | | | | | Constify a number of static structs that are never modified. Make them const to show this. Closes #7759
* infof: remove newline from format strings, always append itDaniel Stenberg2021-07-071-12/+11
| | | | | | | | | | | | | | | | - the data needs to be "line-based" anyway since it's also passed to the debug callback/application - it makes infof() work like failf() and consistency is good - there's an assert that triggers on newlines in the format string - Also removes a few instances of "..." - Removes the code that would append "..." to the end of the data *iff* it was truncated in infof() Closes #7357
* krb5/name_to_level: replace checkprefix with curl_strequalHarry Sintonen2021-05-031-1/+1
| | | | Closes #6993
* krb5: don't use 'static' to store PBSZ size responseDaniel Stenberg2021-04-261-1/+1
| | | | | | | | ... because it makes the knowledge and usage cross-transfer in funny and unexpected ways. Reported-by: Harry Sintonen Closes #6963
* krb5: remove the unused 'overhead' functionDaniel Stenberg2021-04-251-13/+1
| | | | Closes #6947
* tidy-up: make conditional checks more consistentDaniel Stenberg2021-04-221-2/+2
| | | | | | ... remove '== NULL' and '!= 0' Closes #6912
* lib: remove conn->data usesPatrick Monnerat2021-01-261-37/+38
| | | | Closes #6515
* lib: pass in 'struct Curl_easy *' to most functionsDaniel Stenberg2021-01-171-18/+21
| | | | | | | | | | | | | | | | | | | | | ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
* misc: fix typosFabian Keil2021-01-111-1/+1
| | | | | Bug: https://curl.se/mail/lib-2021-01/0063.html Closes #6434
* sendf: move the verbose-check into Curl_debugDaniel Stenberg2020-11-021-3/+2
| | | | | | Saves us from having the same check done everywhere. Closes #6159
* curl_krb5.h: rename from krb5.hDaniel Stenberg2020-09-221-1/+1
| | | | | | | | | Follow-up from f4873ebd0be32cf Turns out some older openssl installations go bananas otherwise. Reported-by: Tom van der Woerdt Fixes #5995 Closes #5996
* krb5: merged security.c and krb specific FTP functions in hereDaniel Stenberg2020-09-211-14/+582
| | | | | | | | | | | These two files were always tightly connected and it was hard to understand what went into which. This also allows us to make the ftpsend() function static (moved from ftp.c). Removed security.c Renamed curl_sec.h to krb5.h Closes #5987
* copyrights: fix copyright year rangeDaniel Stenberg2019-11-081-1/+1
| | | | | | | | .. because checksrc's copyright year check stopped working. Ref: https://github.com/curl/curl/pull/4547 Closes https://github.com/curl/curl/pull/4549
* lib: Use UTF-8 encoding in commentsGergely Nagy2019-07-061-1/+1
| | | | | | | | | | Some editors and IDEs assume that source files use UTF-8 file encodings. It also fixes the build with MSVC when /utf-8 command line option is used (this option is mandatory for some other open-source projects, this is useful when using the same options is desired for building all libraries of a project). Closes https://github.com/curl/curl/pull/4087
* krb5: fix compiler warningMarcel Raad2019-06-131-4/+2
| | | | | | | | | | | | Even though the variable was used in a DEBUGASSERT, GCC 8 warned in debug mode: krb5.c:324:17: error: unused variable 'maj' [-Werror=unused-variable] Just suppress the warning and declare the variable unconditionally instead of only for DEBUGBUILD (which also missed the check for HAVE_ASSERT_H). Closes https://github.com/curl/curl/pull/4020
* sendf: use failf() rather than Curl_failf()Daniel Gustafsson2018-09-131-3/+2
| | | | | | | | The failf() macro is the name used for invoking Curl_failf(). While there isn't a way to turn off failf like there is for infof, but it's still a good idea to use the macro. Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* krb5: fix memory leak in krb_authDaniel Gustafsson2018-09-131-0/+1
| | | | | | The FTP command allocated by aprintf() must be freed after usage. Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* krb5: use nondeprecated functionsMarcel Raad2018-03-041-3/+3
| | | | | | | | | | | | | | | gss_seal/gss_unseal have been deprecated in favor of gss_wrap/gss_unwrap with GSS-API v2 from January 1997 [1]. The first version of "The Kerberos Version 5 GSS-API Mechanism" [2] from June 1996 already says "GSS_Wrap() (formerly GSS_Seal())" and "GSS_Unwrap() (formerly GSS_Unseal())". Use the nondeprecated functions to avoid deprecation warnings. [1] https://tools.ietf.org/html/rfc2078 [2] https://tools.ietf.org/html/rfc1964 Closes https://github.com/curl/curl/pull/2356
* krb5: fix a potential access of uninitialized memoryDaniel Stenberg2017-12-131-1/+2
| | | | A scan-build warning.
* krb5: use private buffer for temp string, not receive bufferDaniel Stenberg2017-05-011-5/+9
|
* checksrc: white space edits to comply to stricter checksrcDaniel Stenberg2016-11-241-1/+1
|
* ftp: fix Curl_ftpsendf()Daniel Stenberg2016-10-081-3/+9
| | | | | | | | | | | ... it no longer takes printf() arguments since it was only really taken advantage by one user and it was not written and used in a safe way. Thus the 'f' is removed from the function name and the proto is changed. Although the current code wouldn't end up in badness, it was a risk that future changes could end up springf()ing too large data or passing in a format string inadvertently.
* internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg2016-06-221-1/+1
|
* lib: include curl_printf.h as one of the last headersDaniel Stenberg2016-04-291-2/+2
| | | | | | | | | | | | | | | | | | | | curl_printf.h defines printf to curl_mprintf, etc. This can cause problems with external headers which may use __attribute__((format(printf, ...))) markers etc. To avoid that they cause problems with system includes, we include curl_printf.h after any system headers. That makes the three last headers to always be, and we keep them in this order: curl_printf.h curl_memory.h memdebug.h None of them include system headers, they all do funny #defines. Reported-by: David Benjamin Fixes #743
* ftp/imap/pop3/smtp: Allow the service name to be overriddenSteve Holme2016-04-081-2/+5
| | | | | Allow the service name to be overridden for DIGIST-MD5 and Kerberos 5 authentication in FTP, IMAP, POP3 and SMTP.
* krb5: improved type handling to avoid clang compiler warningsDaniel Stenberg2016-03-101-9/+6
|
* curl_memory: make curl_memory.h the second-last header file loadedDan Fandrich2015-03-241-2/+2
| | | | | | | This header file must be included after all header files except memdebug.h, as it does similar memory function redefinitions and can be similarly affected by conflicting definitions in system or dependent library headers.
* checksrc: use space after commaDaniel Stenberg2015-03-171-2/+4
|
* mprintf.h: remove #ifdef CURLDEBUGDaniel Stenberg2015-03-031-4/+2
| | | | | ... and as a consequence, introduce curl_printf.h with that re-define magic instead and make all libcurl code use that instead.
* gssapi: Remove need for duplicated GSS_C_NT_HOSTBASED_SERVICE definitionsSteve Holme2015-01-091-10/+3
| | | | Better code reuse and consistency in calls to gss_import_name().
* sasl_gssapi: Fixed honouring of no mutual authenticationSteve Holme2014-12-041-0/+1
|
* krb5_encode: remove unused argumentDaniel Stenberg2014-10-081-6/+2
| | | | | | Coverity CID 1241957. Removed the unused argument. As this struct and pointer now are used only for krb5, there's no need to keep unused function arguments around.
* GSSAPI: remove useless *_MECHANISM defines.Patrick Monnerat2014-07-231-1/+1
|
* curl_gssapi: Add macros for common mechs and pass them appropriatelyMichael Osipov2014-07-231-1/+1
| | | | | Macros defined: KRB5_MECHANISM and SPNEGO_MECHANISM called from HTTP, FTP and SOCKS on Unix
* Use SPNEGO for HTTP NegotiateDavid Woodhouse2014-07-161-0/+1
| | | | | | | | This is the correct way to do SPNEGO. Just ask for it Now I correctly see it trying NTLMSSP authentication when a Kerberos ticket isn't available. Of course, we bail out when the server responds with the challenge packet, since we don't expect that. But I'll fix that bug next...
* security.h: rename to curl_sec.h to avoid name collisionDaniel Stenberg2013-08-261-2/+2
| | | | | | I brought back security.h in commit bb5529331334e. As we actually already found out back in 2005 in commit 62970da675249, the file name security.h causes problems so I renamed it curl_sec.h instead.
View Lorry Controller Status