summaryrefslogtreecommitdiff
path: root/lib/vauth
Commit message (Collapse)AuthorAgeFilesLines
* lib: fix some misuse of curlx_convert_UTF8_to_tcharJay Satiro2021-04-271-13/+10
| | | | | | | | | | | | | curlx_convert_UTF8_to_tchar must be freed by curlx_unicodefree, but prior to this change some uses mistakenly called free. I've reviewed all other uses of curlx_convert_UTF8_to_tchar and curlx_convert_tchar_to_UTF8. Bug: https://github.com/curl/curl/pull/6602#issuecomment-825236763 Reported-by: sergio-nsk@users.noreply.github.com Closes https://github.com/curl/curl/pull/6938
* ntlm: precaution against super huge type2 offsetsDaniel Stenberg2021-04-271-1/+2
| | | | | | | | | | ... which otherwise caused an integer overflow and circumvented the if() conditional size check. Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33720 Assisted-by: Max Dymond Closes #6975
* tidy-up: make conditional checks more consistentDaniel Stenberg2021-04-221-1/+1
| | | | | | ... remove '== NULL' and '!= 0' Closes #6912
* vauth: factor base64 conversions out of authentication proceduresPatrick Monnerat2021-04-2211-577/+248
| | | | | | | | Input challenges and returned messages are now in binary. Conversions from/to base64 are performed by callers (currently curl_sasl.c and http_ntlm.c). Closes #6654
* ntlm: fix negotiated flags usagePatrick Monnerat2021-04-091-13/+19
| | | | | | | | | | | | | | | | | According to Microsoft document MS-NLMP, current flags usage is not accurate: flag NTLMFLAG_NEGOTIATE_NTLM2_KEY controls the use of extended security in an NTLM authentication message and NTLM version 2 cannot be negotiated within the protocol. The solution implemented here is: if the extended security flag is set, prefer using NTLM version 2 (as a server featuring extended security should also support version 2). If version 2 has been disabled at compile time, use extended security. Tests involving NTLM are adjusted to this new behavior. Fixes #6813 Closes #6849
* ntlm: support version 2 on 32-bit platformsPatrick Monnerat2021-04-091-5/+1
| | | | Closes #6849
* copyright: update copyright year ranges to 2021Daniel Stenberg2021-03-271-1/+1
| | | | | Reviewed-by: Emil Engler Closes #6802
* gsasl: fix errors/warnings building against libgsaslViktor Szakats2021-02-101-14/+20
| | | | | | | | | | | | | - also fix an indentation - make Curl_auth_gsasl_token() use CURLcode (by Daniel Stenberg) Ref: https://github.com/curl/curl/pull/6372#issuecomment-776118711 Ref: https://github.com/curl/curl/pull/6588 Reviewed-by: Jay Satiro Assisted-by: Daniel Stenberg Reviewed-by: Simon Josefsson Closes #6587
* sasl: support SCRAM-SHA-1 and SCRAM-SHA-256 via libgsaslSimon Josefsson2021-02-092-0/+162
| | | | Closes #6372
* misc: fix "warning: empty expression statement has no effect"Daniel Stenberg2020-12-261-6/+8
| | | | | | | | | | Turned several macros into do-while(0) style to allow their use to work find with semicolon. Bug: https://github.com/curl/curl/commit/08e8455dddc5e48e58a12ade3815c01ae3da3b64#commitcomment-45433279 Follow-up to 08e8455dddc5e4 Reported-by: Gisle Vanem Closes #6376
* failf: remove newline from formatting stringsDaniel Stenberg2020-12-254-5/+5
| | | | | | | | | ... as failf adds one itself. Also: add an assert() to failf() that triggers on a newline in the format string! Closes #6365
* digest_sspi: Show InitializeSecurityContext errors in verbose modeJay Satiro2020-12-141-0/+11
| | | | | | | | | | | | | | | | | | | | | The error is shown with infof rather than failf so that the user will see the extended error message information only in verbose mode, and will still see the standard CURLE_AUTH_ERROR message. For example: --- * schannel: InitializeSecurityContext failed: SEC_E_QOP_NOT_SUPPORTED (0x8009030A) - The per-message Quality of Protection is not supported by the security package * multi_done * Connection #1 to host 127.0.0.1 left intact curl: (94) An authentication function returned an error --- Ref: https://github.com/curl/curl/issues/6302 Closes https://github.com/curl/curl/pull/6315
* copyright: fix year rangesDaniel Stenberg2020-11-056-6/+6
| | | | Follow-up from 4d2f8006777
* curl.se: new homeDaniel Stenberg2020-11-0415-15/+15
| | | | Closes #6172
* checksrc: warn on empty line before open braceDaniel Stenberg2020-10-151-1/+0
| | | | | | ... and fix a few occurances Closes #6088
* ntlm: free target_info before (re-)mallocDaniel Stenberg2020-07-261-0/+1
| | | | | | | | | OSS-Fuzz found a way this could get called again with the pointer still pointing to a malloc'ed memory, leading to a leak. Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24379 Closes #5724
* ntlm: enable NTLM support with wolfSSLRuurd Beerstra2020-06-161-1/+4
| | | | | | | | | When wolfSSL is built with its OpenSSL API layer, it fetures the same DES* functions that OpenSSL has. This change take advantage of that. Co-authored-by: Daniel Stenberg Closes #5556 Fixes #5548
* copyright: updated year ranges out of syncDaniel Stenberg2020-05-244-4/+4
| | | | ... and whitelisted a few more files in the the copyright.pl script.
* source cleanup: remove all custom typedef structsDaniel Stenberg2020-05-152-3/+3
| | | | | | | | | | | - Stick to a single unified way to use structs - Make checksrc complain on 'typedef struct {' - Allow them in tests, public headers and examples - Let MD4_CTX, MD5_CTX, and SHA256_CTX typedefs remain as they actually typedef different types/structs depending on build conditions. Closes #5338
* curl_multibyte: add to curlxMarcel Raad2020-05-143-11/+11
| | | | | | | This will also be needed in the tool and tests. Ref: https://github.com/curl/curl/pull/3758#issuecomment-482197512 Closes https://github.com/curl/curl/pull/3784
* vauth/cleartext: fix theoretical integer overflowMajor_Tom2020-05-141-1/+2
| | | | | | | | | | | Fix theoretical integer overflow in Curl_auth_create_plain_message. The security impact of the overflow was discussed on hackerone. We agreed this is more of a theoretical vulnerability, as the integer overflow would only be triggerable on systems using 32-bits size_t with over 4GB of available memory space for the process. Closes #5391
* *_sspi: fix bad uses of CURLE_NOT_BUILT_INPeter Wang2020-05-083-6/+12
| | | | | | | | Return CURLE_AUTH_ERROR instead of CURLE_NOT_BUILT_IN for other instances of QuerySecurityPackageInfo failing, as in commit 2a81439553286f12cd04a4bdcdf66d8e026d8201. Closes #5355
* ntlm_sspi: fix bad use of CURLE_NOT_BUILT_INDaniel Stenberg2020-05-071-3/+5
| | | | | | | | | That return code is reserved for build-time conditional code not being present while this was a regular run-time error from a Windows API. Reported-by: wangp on github Fixes #5349 Closes #5350
* ntlm: Removed the dependency on the TLS libaries when using MD5Steve Holme2020-02-231-6/+7
| | | | | | | As we have our own MD5 implementation use the MD5 wrapper to remove the TLS dependency. Closes #4967
* md5/sha256: Updated the functions to allow non-string data to be hashedSteve Holme2020-02-231-27/+19
|
* digest: Corrected the name of the local HTTP digest functionSteve Holme2020-02-231-12/+12
| | | | | Follow up to 2b5b37cb. Local static functions do not require the Curl prefix.
* digest: Do not quote algorithm in HTTP authorisationPierre-Yves Bigourdan2020-02-071-2/+2
| | | | | | | | | | RFC 7616 section 3.4 (The Authorization Header Field) states that "For historical reasons, a sender MUST NOT generate the quoted string syntax for the following parameters: algorithm, qop, and nc". This removes the quoting for the algorithm parameter. Reviewed-by: Steve Holme Closes #4890
* copyrights: fix copyright year rangeDaniel Stenberg2019-11-082-2/+2
| | | | | | | | .. because checksrc's copyright year check stopped working. Ref: https://github.com/curl/curl/pull/4547 Closes https://github.com/curl/curl/pull/4549
* vauth: The parameter 'status' must be surrounded by parenthesesDaniel Stenberg2019-09-231-1/+1
| | | | | PVS-Studio warning Fixes #4402
* sspi: fix memory leaksmigueljcrum2019-09-104-0/+21
| | | | Closes #4299
* vauth: return CURLE_AUTH_ERROR on gss_init_sec_context() failureKamil Dudka2019-08-262-2/+2
| | | | | | This is a follow-up to https://github.com/curl/curl/pull/3864 . Closes #4224
* spnego_sspi: add typecast to fix build warningDaniel Stenberg2019-08-201-2/+2
| | | | | | | Reported in build "Win32 target on Debian Stretch (64-bit) - i686-w64-mingw32 - gcc-20170516" Closes #4245
* vauth: Use CURLE_AUTH_ERROR for auth function errorsJay Satiro2019-08-146-17/+52
| | | | | | | | | | | | | | - Add new error code CURLE_AUTH_ERROR. Prior to this change auth function errors were signaled by CURLE_OUT_OF_MEMORY and CURLE_RECV_ERROR, and neither one was technically correct. Ref: https://github.com/curl/curl/pull/3848 Co-authored-by: Dominik Hölzl Closes https://github.com/curl/curl/pull/3864
* build: fix Codacy warningsMarcel Raad2019-06-051-5/+6
| | | | | | Reduce variable scopes and remove redundant variable stores. Closes https://github.com/curl/curl/pull/3975
* cleanup: remove FIXME and TODO commentsDaniel Stenberg2019-05-161-3/+2
| | | | | | | | | They serve very little purpose and mostly just add noise. Most of them have been around for a very long time. I read them all before removing or rephrasing them. Ref: #3876 Closes #3883
* http_negotiate: Move the Negotiate state out of the negotiatedata structureSteve Holme2019-05-152-2/+0
| | | | | | | Given that this member variable is not used by the SASL based protocols there is no need to have it here. Closes #3882
* pingpong: disable more when no pingpong enabledDaniel Stenberg2019-05-132-1/+11
|
* auth: Rename the various authentication clean up functionsSteve Holme2019-05-127-23/+23
| | | | | | For consistency and to a avoid confusion. Closes #3869
* vauth: Fix incorrect function description for Curl_auth_user_contains_domain()Steve Holme2019-05-101-21/+21
| | | | | | ...and misalignment of these comments. From a78c61a4. Closes #3860
* ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup()Steve Holme2019-05-101-9/+9
| | | | | | From 6012fa5a. Closes #3858
* spnego_gssapi: fix return code on gss_init_sec_context() failureKamil Dudka2019-05-091-1/+1
| | | | | Fixes #3726 Closes #3849
* vauth/cleartext: Don't send the authzid if it is emptySteve Holme2019-04-211-2/+3
| | | | Follow up to 762a292f.
* vauth/cleartext: Update the PLAIN login function signature to match RFC 4616Steve Holme2019-04-112-18/+23
| | | | | | | Functionally this doesn't change anything as we still use the username for both the authorisation identity and the authentication identity. Closes #3757
* vauth/oauth2: Fix OAUTHBEARER token generationMert Yazıcıoğlu2019-04-022-8/+50
| | | | | | | | | | | OAUTHBEARER tokens were incorrectly generated in a format similar to XOAUTH2 tokens. These changes make OAUTHBEARER tokens conform to the RFC7628. Fixes: #2487 Reported-by: Paolo Mossino Closes https://github.com/curl/curl/pull/3377
* Negotiate: fix for HTTP POST with NegotiateDominik Hölzl2019-03-142-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | * Adjusted unit tests 2056, 2057 * do not generally close connections with CURLAUTH_NEGOTIATE after every request * moved negotiatedata from UrlState to connectdata * Added stream rewind logic for CURLAUTH_NEGOTIATE * introduced negotiatedata::GSS_AUTHDONE and negotiatedata::GSS_AUTHSUCC * Consider authproblem state for CURLAUTH_NEGOTIATE * Consider reuse_forbid for CURLAUTH_NEGOTIATE * moved and adjusted negotiate authentication state handling from output_auth_headers into Curl_output_negotiate * Curl_output_negotiate: ensure auth done is always set * Curl_output_negotiate: Set auth done also if result code is GSS_S_CONTINUE_NEEDED/SEC_I_CONTINUE_NEEDED as this result code may also indicate the last challenge request (only works with disabled Expect: 100-continue and CURLOPT_KEEP_SENDING_ON_ERROR -> 1) * Consider "Persistent-Auth" header, detect if not present; Reset/Cleanup negotiate after authentication if no persistent authentication * apply changes introduced with #2546 for negotiate rewind logic Fixes #1261 Closes #1975
* strerror: make the strerror function use local buffersDaniel Stenberg2019-02-261-1/+2
| | | | | | | | | | | | | | | | Instead of using a fixed 256 byte buffer in the connectdata struct. In my build, this reduces the size of the connectdata struct by 11.8%, from 2160 to 1904 bytes with no functionality or performance loss. This also fixes a bug in schannel's Curl_verify_certificate where it called Curl_sspi_strerror when it should have called Curl_strerror for string from GetLastError. the only effect would have been no text or the wrong text being shown for the error. Co-authored-by: Jay Satiro Closes #3612
* ntlm: fix *_type3_message size check to avoid buffer overflowDaniel Stenberg2019-02-041-4/+7
| | | | | | Bug: https://curl.haxx.se/docs/CVE-2019-3822.html Reported-by: Wenxiang Qian CVE-2019-3822
* NTLM: fix size check condition for type2 received dataDaniel Stenberg2019-02-041-3/+4
| | | | | | Bug: https://curl.haxx.se/docs/CVE-2018-16890.html Reported-by: Wenxiang Qian CVE-2018-16890
* spnego_sspi: add support for channel bindinggeorgeok2019-02-011-7/+34
| | | | | | | | | | Attempt to add support for Secure Channel binding when negotiate authentication is used. The problem to solve is that by default IIS accepts channel binding and curl doesn't utilise them. The result was a 401 response. Scope affects only the Schannel(winssl)-SSPI combination. Fixes https://github.com/curl/curl/issues/3503 Closes https://github.com/curl/curl/pull/3509
* ntlm_sspi: add support for channel bindinggeorgeok2019-01-191-8/+35
| | | | | | | | | Windows extended potection (aka ssl channel binding) is required to login to ntlm IIS endpoint, otherwise the server returns 401 responses. Fixes #3280 Closes #3321
View Lorry Controller Status