Re: [PATCH] http: Control GSSAPI credential delegation.
- From
Petr Stodulka <pstodulk@redhat.com>
- Date
- Sep 28, 2016, 18:19 UTC
- Message-ID
- <9c9e9949-cfe0-5465-6ae1-3e8254ff055b@redhat.com>
- In-Reply-To
- <20160928171610.pbghg4sk23vm4xnp@sigill.intra.peff.net>
On 28.9.2016 19:16, Jeff King wrote:
Show 12 quoted lines
> On Wed, Sep 28, 2016 at 06:05:52PM +0200, Petr Stodulka wrote: > >> Delegation of credentials is disabled by default in libcurl since >> version 7.21.7 due to security vulnerability CVE-2011-2192. Which >> makes troubles with GSS/kerberos authentication where delegation >> of credentials is required. This can be changed with option >> CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter >> since libcurl version 7.22.0. > > I don't have any real knowledge of GSSAPI, so I'll refrain from > commenting on that aspect. But I did notice one mechanical issue: >
Me neither. I have just basic knowledge and I am not able to configure virtual machine, which really need set delegation in libcurl (I need just negotiation, which is in git possible, I guess since v2.8.0).
However, I discuss it with libcurl maintainer and he confirm that this option can be required in some cases and this is what I need to do. this already. I tested just setting of parameter in libcurl according to description and nothing else seems broken. So anyone else who will be able to test complete behaviour, where delegation is needed, is welcomed.
[snip]
Show 18 quoted lines
> We only declare the curl_deleg variable if we have a new-enough curl.
> But...
>
>> @@ -323,6 +335,10 @@ static int http_options(const char *var, const char *value, void *cb)
>> return 0;
>> }
>>
>> + if (!strcmp("http.delegation", var)) {
>> + return git_config_string(&curl_deleg, var, value);
>> + }
>> +
>
> ...here we try to use it regardless. I think you want another #ifdef,
> and probably to warn the user in the #else block (similar to what the
> http.pinnedpubkey code does).
>
> -Peff
> You are right. Thanks. I sent new version of patch with fix.
Petr