http: control GSSAPI credential delegation
Delegation of credentials is disabled by default in libcurl since version 7.21.7 due to security vulnerability CVE-2011-2192. Which makes troubles with GSS/kerberos authentication when delegation of credentials is required. This can be changed with option CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter since libcurl version 7.22.0. This patch provides new configuration variable http.delegation which corresponds to curl parameter "--delegation" (see man 1 curl). The following values are supported: * none (default). * policy * always Signed-off-by: Petr Stodulka <pstodulk@redhat.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Petr Stodulka committed
Sep 28, 2016 at 20:01 UTC
26a7b2342980f2eb46b47122d1d6dfbf13ed4ccb
2 files changed
+51
Documentation/config.txt
+14
@@ -1730,6 +1730,20 @@ http.emptyAuth::
1730
a username in the URL, as libcurl normally requires a username for
1731
authentication.
1732
1733
+http.delegation::
1734
+ Control GSSAPI credential delegation. The delegation is disabled
1735
+ by default in libcurl since version 7.21.7. Set parameter to tell
1736
+ the server what it is allowed to delegate when it comes to user
1737
+ credentials. Used with GSS/kerberos. Possible values are:
1738
++
1739
+--
1740
+* `none` - Don't allow any delegation.
1741
+* `policy` - Delegates if and only if the OK-AS-DELEGATE flag is set in the
1742
+ Kerberos service ticket, which is a matter of realm policy.
1743
+* `always` - Unconditionally allow the server to delegate.
1744
+--
1745
+
1746
+
1747
http.extraHeader::
1748
Pass an additional HTTP header when communicating with a server. If
1749
more than one such entry exists, all of them are added as extra
http.c
+37
@@ -90,6 +90,18 @@ static struct {
90
* here, too
91
*/
92
};
93
+#if LIBCURL_VERSION_NUM >= 0x071600
94
+static const char *curl_deleg;
95
+static struct {
96
+ const char *name;
97
+ long curl_deleg_param;
98
+} curl_deleg_levels[] = {
99
+ { "none", CURLGSSAPI_DELEGATION_NONE },
100
+ { "policy", CURLGSSAPI_DELEGATION_POLICY_FLAG },
101
+ { "always", CURLGSSAPI_DELEGATION_FLAG },
102
+};
103
+#endif
104
+
105
static struct credential proxy_auth = CREDENTIAL_INIT;
106
static const char *curl_proxyuserpwd;
107
static const char *curl_cookie_file;
@@ -316,6 +328,15 @@ static int http_options(const char *var, const char *value, void *cb)
328
return 0;
329
}
330
331
+ if (!strcmp("http.delegation", var)) {
332
+#if LIBCURL_VERSION_NUM >= 0x071600
333
+ return git_config_string(&curl_deleg, var, value);
334
+#else
335
+ warning(_("Delegation control is not supported with cURL < 7.22.0"));
336
+ return 0;
337
+#endif
338
+ }
339
+
340
if (!strcmp("http.pinnedpubkey", var)) {
341
#if LIBCURL_VERSION_NUM >= 0x072c00
342
return git_config_pathname(&ssl_pinnedkey, var, value);
@@ -622,6 +643,22 @@ static CURL *get_curl_handle(void)
643
curl_easy_setopt(result, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
644
#endif
645
646
+#if LIBCURL_VERSION_NUM >= 0x071600
647
+ if (curl_deleg) {
648
+ int i;
649
+ for (i = 0; i < ARRAY_SIZE(curl_deleg_levels); i++) {
650
+ if (!strcmp(curl_deleg, curl_deleg_levels[i].name)) {
651
+ curl_easy_setopt(result, CURLOPT_GSSAPI_DELEGATION,
652
+ curl_deleg_levels[i].curl_deleg_param);
653
+ break;
654
+ }
655
+ }
656
+ if (i == ARRAY_SIZE(curl_deleg_levels))
657
+ warning("Unknown delegation method '%s': using default",
658
+ curl_deleg);
659
+ }
660
+#endif
661
+
662
if (http_proactive_auth)
663
init_curl_http_auth(result);
664