Re: [PATCH] http: Control GSSAPI credential delegation.
- From
Jeff King <peff@peff.net>
- Date
- Sep 28, 2016, 17:16 UTC
- Message-ID
- <20160928171610.pbghg4sk23vm4xnp@sigill.intra.peff.net>
- In-Reply-To
- <1475078752-31195-1-git-send-email-pstodulk@redhat.com>
On Wed, Sep 28, 2016 at 06:05:52PM +0200, Petr Stodulka wrote:
Show 6 quoted lines
> Delegation of credentials is disabled by default in libcurl since > version 7.21.7 due to security vulnerability CVE-2011-2192. Which > makes troubles with GSS/kerberos authentication where delegation > of credentials is required. This can be changed with option > CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter > since libcurl version 7.22.0.
I don't have any real knowledge of GSSAPI, so I'll refrain from commenting on that aspect. But I did notice one mechanical issue:
Show 11 quoted lines
> +#if LIBCURL_VERSION_NUM >= 0x071600
> +static const char *curl_deleg;
> +static struct {
> + const char *name;
> + long curl_deleg_param;
> +} curl_deleg_levels[] = {
> + { "none", CURLGSSAPI_DELEGATION_NONE },
> + { "policy", CURLGSSAPI_DELEGATION_POLICY_FLAG },
> + { "always", CURLGSSAPI_DELEGATION_FLAG },
> +};
> +#endifWe only declare the curl_deleg variable if we have a new-enough curl. But...
Show 8 quoted lines
> @@ -323,6 +335,10 @@ static int http_options(const char *var, const char *value, void *cb)
> return 0;
> }
>
> + if (!strcmp("http.delegation", var)) {
> + return git_config_string(&curl_deleg, var, value);
> + }
> +...here we try to use it regardless. I think you want another #ifdef, and probably to warn the user in the #else block (similar to what the http.pinnedpubkey code does).
-Peff