8616e5aada
Devdatta Talele
2025-11-03
Subject
gssapi: make channel binding conditional on GSS_C_CHANNEL_BOUND_FLAG
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/curl_gssapi.h +5 -0lib/http_negotiate.c +3 -3lib/vauth/spnego_gssapi.c +4 -0lib/vauth/vauth.h +2 -0
lib/curl_gssapi.h+5 -0
| @@ -28,6 +28,11 @@ | |
| #include "urldata.h" | |
| #ifdef HAVE_GSSAPI | |
| + | |
| + | #ifdef GSS_C_CHANNEL_BOUND_FLAG /* MIT Kerberos 1.19+, missing from GNU GSS */ |
| + | #define CURL_GSSAPI_HAS_CHANNEL_BINDING |
| + | #endif |
| + | |
| extern gss_OID_desc Curl_spnego_mech_oid; | |
| extern gss_OID_desc Curl_krb5_mech_oid; | |
lib/http_negotiate.c+3 -3
| @@ -124,7 +124,7 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn, | |
| neg_ctx->sslContext = conn->sslContext; | |
| #endif | |
| /* Check if the connection is using SSL and get the channel binding data */ | |
| - | #ifdef HAVE_GSSAPI |
| + | #ifdef CURL_GSSAPI_HAS_CHANNEL_BINDING |
| #ifdef USE_SSL | |
| curlx_dyn_init(&neg_ctx->channel_binding_data, SSL_CB_MAX_SIZE + 1); | |
| if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) { | |
| @@ -138,13 +138,13 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn, | |
| #else | |
| curlx_dyn_init(&neg_ctx->channel_binding_data, 1); | |
| #endif /* USE_SSL */ | |
| - | #endif /* HAVE_GSSAPI */ |
| + | #endif /* CURL_GSSAPI_HAS_CHANNEL_BINDING */ |
| /* Initialize the security context and decode our challenge */ | |
| result = Curl_auth_decode_spnego_message(data, userp, passwdp, service, | |
| host, header, neg_ctx); | |
| - | #ifdef HAVE_GSSAPI |
| + | #ifdef CURL_GSSAPI_HAS_CHANNEL_BINDING |
| curlx_dyn_free(&neg_ctx->channel_binding_data); | |
| #endif | |
lib/vauth/spnego_gssapi.c+4 -0
| @@ -96,7 +96,9 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data, | |
| gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER; | |
| gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER; | |
| gss_channel_bindings_t chan_bindings = GSS_C_NO_CHANNEL_BINDINGS; | |
| + | #ifdef CURL_GSSAPI_HAS_CHANNEL_BINDING |
| struct gss_channel_bindings_struct chan; | |
| + | #endif |
| (void)user; | |
| (void)password; | |
| @@ -157,12 +159,14 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data, | |
| } | |
| /* Set channel binding data if available */ | |
| + | #ifdef CURL_GSSAPI_HAS_CHANNEL_BINDING |
| if(curlx_dyn_len(&nego->channel_binding_data)) { | |
| memset(&chan, 0, sizeof(struct gss_channel_bindings_struct)); | |
| chan.application_data.length = curlx_dyn_len(&nego->channel_binding_data); | |
| chan.application_data.value = curlx_dyn_ptr(&nego->channel_binding_data); | |
| chan_bindings = &chan; | |
| } | |
| + | #endif |
| /* Generate our challenge-response message */ | |
| major_status = Curl_gss_init_sec_context(data, | |
lib/vauth/vauth.h+2 -0
| @@ -306,7 +306,9 @@ struct negotiatedata { | |
| gss_ctx_id_t context; | |
| gss_name_t spn; | |
| gss_buffer_desc output_token; | |
| + | #ifdef CURL_GSSAPI_HAS_CHANNEL_BINDING |
| struct dynbuf channel_binding_data; | |
| + | #endif |
| #else | |
| #ifdef USE_WINDOWS_SSPI | |
| #ifdef SECPKG_ATTR_ENDPOINT_BINDINGS | |