{"thread":{"id":"44181","subject":"[PATCH] http: Control GSSAPI credential delegation.","startedAt":"2016-09-28T16:09:36Z","lastAt":"2016-09-29T23:53:30Z","messageCount":7,"participants":["Petr Stodulka","Jeff King","Junio C Hamano","brian m. carlson"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"302811","messageId":"1475078752-31195-1-git-send-email-pstodulk@redhat.com","threadId":"44181","inReplyTo":null,"subject":"[PATCH] http: Control GSSAPI credential delegation.","fromName":"Petr Stodulka","fromEmail":"pstodulk@redhat.com","sentAt":"2016-09-28T16:05:52Z","receivedAt":"2016-09-28T16:09:36Z","isPatch":true,"sender":{"key":"pstodulk@redhat.com","avatar":"https://avatars.githubusercontent.com/u/1656374?v=4"},"body":"Delegation of credentials is disabled by default in libcurl since\nversion 7.21.7 due to security vulnerability CVE-2011-2192. Which\nmakes troubles with GSS/kerberos authentication where delegation\nof credentials is required. This can be changed with option\nCURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter\nsince libcurl version 7.22.0.\n\nThis patch provides new configuration variable http.delegation\nwhich corresponds to curl parameter \"--delegation\" (see man 1 curl).\n\nThe following values are supported:\n\n* none (default).\n* policy\n* always\n\nSigned-off-by: Petr Stodulka <pstodulk@redhat.com>\n---\n Documentation/config.txt | 14 ++++++++++++++\n http.c                   | 32 ++++++++++++++++++++++++++++++++\n 2 files changed, 46 insertions(+)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex e78293b..a179474 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -1736,6 +1736,20 @@ http.emptyAuth::\n \ta username in the URL, as libcurl normally requires a username for\n \tauthentication.\n \n+http.delegation::\n+\tControl GSSAPI credential delegation. The delegation is disabled\n+\tby default in libcurl since version 7.21.7. Set parameter to tell\n+\tthe server what it is allowed to delegate when it comes to user\n+\tcredentials. Used with GSS/kerberos. Possible values are:\n++\n+--\n+* `none` - Don't allow any delegation.\n+* `policy` - Delegates if and only if the OK-AS-DELEGATE flag is set in the\n+  Kerberos service ticket, which is a matter of realm policy.\n+* `always` - Unconditionally allow the server to delegate.\n+--\n+\n+\n http.extraHeader::\n \tPass an additional HTTP header when communicating with a server.  If\n \tmore than one such entry exists, all of them are added as extra\ndiff --git a/http.c b/http.c\nindex 82ed542..5f8fab3 100644\n--- a/http.c\n+++ b/http.c\n@@ -90,6 +90,18 @@ static struct {\n \t * here, too\n \t */\n };\n+#if LIBCURL_VERSION_NUM >= 0x071600\n+static const char *curl_deleg;\n+static struct {\n+\tconst char *name;\n+\tlong curl_deleg_param;\n+} curl_deleg_levels[] = {\n+\t{ \"none\", CURLGSSAPI_DELEGATION_NONE },\n+\t{ \"policy\", CURLGSSAPI_DELEGATION_POLICY_FLAG },\n+\t{ \"always\", CURLGSSAPI_DELEGATION_FLAG },\n+};\n+#endif\n+\n static struct credential proxy_auth = CREDENTIAL_INIT;\n static const char *curl_proxyuserpwd;\n static const char *curl_cookie_file;\n@@ -323,6 +335,10 @@ static int http_options(const char *var, const char *value, void *cb)\n \t\treturn 0;\n \t}\n \n+\tif (!strcmp(\"http.delegation\", var)) {\n+\t\treturn git_config_string(&curl_deleg, var, value);\n+\t}\n+\n \tif (!strcmp(\"http.pinnedpubkey\", var)) {\n #if LIBCURL_VERSION_NUM >= 0x072c00\n \t\treturn git_config_pathname(&ssl_pinnedkey, var, value);\n@@ -629,6 +645,22 @@ static CURL *get_curl_handle(void)\n \tcurl_easy_setopt(result, CURLOPT_HTTPAUTH, CURLAUTH_ANY);\n #endif\n \n+#if LIBCURL_VERSION_NUM >= 0x071600\n+\tif (curl_deleg) {\n+\t\tint i;\n+\t\tfor (i = 0; i < ARRAY_SIZE(curl_deleg_levels); i++) {\n+\t\t\tif (!strcmp(curl_deleg, curl_deleg_levels[i].name)) {\n+\t\t\t\tcurl_easy_setopt(result, CURLOPT_GSSAPI_DELEGATION,\n+\t\t\t\t\t\tcurl_deleg_levels[i].curl_deleg_param);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\tif (i == ARRAY_SIZE(curl_deleg_levels))\n+\t\t\twarning(\"Unknown delegation method '%s': using default\",\n+\t\t\t\tcurl_deleg);\n+\t}\n+#endif\n+\n \tif (http_proactive_auth)\n \t\tinit_curl_http_auth(result);\n \n-- \n2.5.5\n\n"},{"id":"302814","messageId":"a4d9efd9-8cce-dafe-f2f7-0cdbc5d7ddae@redhat.com","threadId":"44181","inReplyTo":"1475078752-31195-1-git-send-email-pstodulk@redhat.com","subject":"Re: [PATCH] http: Control GSSAPI credential delegation.","fromName":"Petr Stodulka","fromEmail":"pstodulk@redhat.com","sentAt":"2016-09-28T17:03:23Z","receivedAt":"2016-09-28T17:03:38Z","isPatch":true,"sender":{"key":"pstodulk@redhat.com","avatar":"https://avatars.githubusercontent.com/u/1656374?v=4"},"body":"\n\nOn 28.9.2016 18:05, Petr Stodulka wrote:\n> Delegation of credentials is disabled by default in libcurl since\n> version 7.21.7 due to security vulnerability CVE-2011-2192. Which\n> makes troubles with GSS/kerberos authentication where delegation\n> of credentials is required. This can be changed with option\n> CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter\n> since libcurl version 7.22.0.\n\nCorrection:\n  Which makes troubles with GSS/kerberos authentication when delegation\n  of credentials is required.\n\n"},{"id":"302815","messageId":"20160928171610.pbghg4sk23vm4xnp@sigill.intra.peff.net","threadId":"44181","inReplyTo":"1475078752-31195-1-git-send-email-pstodulk@redhat.com","subject":"Re: [PATCH] http: Control GSSAPI credential delegation.","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2016-09-28T17:16:10Z","receivedAt":"2016-09-28T17:16:17Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Sep 28, 2016 at 06:05:52PM +0200, Petr Stodulka wrote:\n\n> Delegation of credentials is disabled by default in libcurl since\n> version 7.21.7 due to security vulnerability CVE-2011-2192. Which\n> makes troubles with GSS/kerberos authentication where delegation\n> of credentials is required. This can be changed with option\n> CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter\n> since libcurl version 7.22.0.\n\nI don't have any real knowledge of GSSAPI, so I'll refrain from\ncommenting on that aspect. But I did notice one mechanical issue:\n\n> +#if LIBCURL_VERSION_NUM >= 0x071600\n> +static const char *curl_deleg;\n> +static struct {\n> +\tconst char *name;\n> +\tlong curl_deleg_param;\n> +} curl_deleg_levels[] = {\n> +\t{ \"none\", CURLGSSAPI_DELEGATION_NONE },\n> +\t{ \"policy\", CURLGSSAPI_DELEGATION_POLICY_FLAG },\n> +\t{ \"always\", CURLGSSAPI_DELEGATION_FLAG },\n> +};\n> +#endif\n\nWe only declare the curl_deleg variable if we have a new-enough curl.\nBut...\n\n> @@ -323,6 +335,10 @@ static int http_options(const char *var, const char *value, void *cb)\n>  \t\treturn 0;\n>  \t}\n>  \n> +\tif (!strcmp(\"http.delegation\", var)) {\n> +\t\treturn git_config_string(&curl_deleg, var, value);\n> +\t}\n> +\n\n...here we try to use it regardless. I think you want another #ifdef,\nand probably to warn the user in the #else block (similar to what the\nhttp.pinnedpubkey code does).\n\n-Peff\n"},{"id":"302821","messageId":"1475085694-10056-1-git-send-email-pstodulk@redhat.com","threadId":"44181","inReplyTo":"20160928171610.pbghg4sk23vm4xnp@sigill.intra.peff.net","subject":"[PATCH v2] http: Control GSSAPI credential delegation.","fromName":"Petr Stodulka","fromEmail":"pstodulk@redhat.com","sentAt":"2016-09-28T18:01:34Z","receivedAt":"2016-09-28T18:01:51Z","isPatch":true,"sender":{"key":"pstodulk@redhat.com","avatar":"https://avatars.githubusercontent.com/u/1656374?v=4"},"body":"Delegation of credentials is disabled by default in libcurl since\nversion 7.21.7 due to security vulnerability CVE-2011-2192. Which\nmakes troubles with GSS/kerberos authentication when delegation\nof credentials is required. This can be changed with option\nCURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter\nsince libcurl version 7.22.0.\n\nThis patch provides new configuration variable http.delegation\nwhich corresponds to curl parameter \"--delegation\" (see man 1 curl).\n\nThe following values are supported:\n\n* none (default).\n* policy\n* always\n\nSigned-off-by: Petr Stodulka <pstodulk@redhat.com>\n---\n Documentation/config.txt | 14 ++++++++++++++\n http.c                   | 37 +++++++++++++++++++++++++++++++++++++\n 2 files changed, 51 insertions(+)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex e78293b..a179474 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -1736,6 +1736,20 @@ http.emptyAuth::\n \ta username in the URL, as libcurl normally requires a username for\n \tauthentication.\n \n+http.delegation::\n+\tControl GSSAPI credential delegation. The delegation is disabled\n+\tby default in libcurl since version 7.21.7. Set parameter to tell\n+\tthe server what it is allowed to delegate when it comes to user\n+\tcredentials. Used with GSS/kerberos. Possible values are:\n++\n+--\n+* `none` - Don't allow any delegation.\n+* `policy` - Delegates if and only if the OK-AS-DELEGATE flag is set in the\n+  Kerberos service ticket, which is a matter of realm policy.\n+* `always` - Unconditionally allow the server to delegate.\n+--\n+\n+\n http.extraHeader::\n \tPass an additional HTTP header when communicating with a server.  If\n \tmore than one such entry exists, all of them are added as extra\ndiff --git a/http.c b/http.c\nindex 82ed542..0c65639 100644\n--- a/http.c\n+++ b/http.c\n@@ -90,6 +90,18 @@ static struct {\n \t * here, too\n \t */\n };\n+#if LIBCURL_VERSION_NUM >= 0x071600\n+static const char *curl_deleg;\n+static struct {\n+\tconst char *name;\n+\tlong curl_deleg_param;\n+} curl_deleg_levels[] = {\n+\t{ \"none\", CURLGSSAPI_DELEGATION_NONE },\n+\t{ \"policy\", CURLGSSAPI_DELEGATION_POLICY_FLAG },\n+\t{ \"always\", CURLGSSAPI_DELEGATION_FLAG },\n+};\n+#endif\n+\n static struct credential proxy_auth = CREDENTIAL_INIT;\n static const char *curl_proxyuserpwd;\n static const char *curl_cookie_file;\n@@ -323,6 +335,15 @@ static int http_options(const char *var, const char *value, void *cb)\n \t\treturn 0;\n \t}\n \n+\tif (!strcmp(\"http.delegation\", var)) {\n+#if LIBCURL_VERSION_NUM >= 0x071600\n+\t\treturn git_config_string(&curl_deleg, var, value);\n+#else\n+\t\twarning(_(\"Delegation control is not supported with cURL < 7.22.0\"));\n+\t\treturn 0;\n+#endif\n+\t}\n+\n \tif (!strcmp(\"http.pinnedpubkey\", var)) {\n #if LIBCURL_VERSION_NUM >= 0x072c00\n \t\treturn git_config_pathname(&ssl_pinnedkey, var, value);\n@@ -629,6 +650,22 @@ static CURL *get_curl_handle(void)\n \tcurl_easy_setopt(result, CURLOPT_HTTPAUTH, CURLAUTH_ANY);\n #endif\n \n+#if LIBCURL_VERSION_NUM >= 0x071600\n+\tif (curl_deleg) {\n+\t\tint i;\n+\t\tfor (i = 0; i < ARRAY_SIZE(curl_deleg_levels); i++) {\n+\t\t\tif (!strcmp(curl_deleg, curl_deleg_levels[i].name)) {\n+\t\t\t\tcurl_easy_setopt(result, CURLOPT_GSSAPI_DELEGATION,\n+\t\t\t\t\t\tcurl_deleg_levels[i].curl_deleg_param);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\tif (i == ARRAY_SIZE(curl_deleg_levels))\n+\t\t\twarning(\"Unknown delegation method '%s': using default\",\n+\t\t\t\tcurl_deleg);\n+\t}\n+#endif\n+\n \tif (http_proactive_auth)\n \t\tinit_curl_http_auth(result);\n \n-- \n2.5.5\n\n"},{"id":"302828","messageId":"9c9e9949-cfe0-5465-6ae1-3e8254ff055b@redhat.com","threadId":"44181","inReplyTo":"20160928171610.pbghg4sk23vm4xnp@sigill.intra.peff.net","subject":"Re: [PATCH] http: Control GSSAPI credential delegation.","fromName":"Petr Stodulka","fromEmail":"pstodulk@redhat.com","sentAt":"2016-09-28T18:19:47Z","receivedAt":"2016-09-28T19:18:40Z","isPatch":true,"sender":{"key":"pstodulk@redhat.com","avatar":"https://avatars.githubusercontent.com/u/1656374?v=4"},"body":"\n\nOn 28.9.2016 19:16, Jeff King wrote:\n> On Wed, Sep 28, 2016 at 06:05:52PM +0200, Petr Stodulka wrote:\n> \n>> Delegation of credentials is disabled by default in libcurl since\n>> version 7.21.7 due to security vulnerability CVE-2011-2192. Which\n>> makes troubles with GSS/kerberos authentication where delegation\n>> of credentials is required. This can be changed with option\n>> CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter\n>> since libcurl version 7.22.0.\n> \n> I don't have any real knowledge of GSSAPI, so I'll refrain from\n> commenting on that aspect. But I did notice one mechanical issue:\n> \n\nMe neither. I have just basic knowledge and I am not able to configure\nvirtual machine, which really need set delegation in libcurl (I need\njust negotiation, which is in git possible, I guess since v2.8.0).\n\nHowever, I discuss it with libcurl maintainer and he confirm that this\noption can be required in some cases and this is what I need to do.\nthis already. I tested just setting of parameter in libcurl according\nto description and nothing else seems broken. So anyone else who will\nbe able to test complete behaviour, where delegation is needed, is welcomed.\n\n[snip]\n> We only declare the curl_deleg variable if we have a new-enough curl.\n> But...\n> \n>> @@ -323,6 +335,10 @@ static int http_options(const char *var, const char *value, void *cb)\n>>  \t\treturn 0;\n>>  \t}\n>>  \n>> +\tif (!strcmp(\"http.delegation\", var)) {\n>> +\t\treturn git_config_string(&curl_deleg, var, value);\n>> +\t}\n>> +\n> \n> ...here we try to use it regardless. I think you want another #ifdef,\n> and probably to warn the user in the #else block (similar to what the\n> http.pinnedpubkey code does).\n> \n> -Peff\n> \n\nYou are right. Thanks. I sent new version of patch with fix.\n\nPetr\n\n"},{"id":"302839","messageId":"xmqqd1jniur6.fsf@gitster.mtv.corp.google.com","threadId":"44181","inReplyTo":"9c9e9949-cfe0-5465-6ae1-3e8254ff055b@redhat.com","subject":"Re: [PATCH] http: Control GSSAPI credential delegation.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2016-09-28T21:23:25Z","receivedAt":"2016-09-28T21:25:40Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Petr Stodulka <pstodulk@redhat.com> writes:\n\n> However, I discuss it with libcurl maintainer and he confirm that this\n> option can be required in some cases and this is what I need to do.\n> this already. I tested just setting of parameter in libcurl according\n> to description and nothing else seems broken. So anyone else who will\n> be able to test complete behaviour, where delegation is needed, is welcomed.\n\nThanks; let's queue this in 'pu' to make it easier for people who\nwould be affected to try it out.\n"},{"id":"302965","messageId":"20160929235320.ur3t66kypckmq4wl@vauxhall.crustytoothpaste.net","threadId":"44181","inReplyTo":"1475085694-10056-1-git-send-email-pstodulk@redhat.com","subject":"Re: [PATCH v2] http: Control GSSAPI credential delegation.","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2016-09-29T23:53:20Z","receivedAt":"2016-09-29T23:53:30Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Wed, Sep 28, 2016 at 08:01:34PM +0200, Petr Stodulka wrote:\n> Delegation of credentials is disabled by default in libcurl since\n> version 7.21.7 due to security vulnerability CVE-2011-2192. Which\n> makes troubles with GSS/kerberos authentication when delegation\n> of credentials is required. This can be changed with option\n> CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter\n> since libcurl version 7.22.0.\n> \n> This patch provides new configuration variable http.delegation\n> which corresponds to curl parameter \"--delegation\" (see man 1 curl).\n> \n> The following values are supported:\n> \n> * none (default).\n> * policy\n> * always\n\nI don't personally use Kerberos delegation with Git, but I don't see any\nproblems with this patch.  It preserves the security properties of the\ncurrent behavior, and I think adding \"policy\" as an option to allow\nper-realm configuration is a good idea.\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: https://keybase.io/bk2204\n"}]}