patch, 2 partshttp: use a feature check to enable GSSAPI delegation control

The curl packages provided by Red Hat for RHEL contain several backports of features from later curl releases. This causes problems with current version based checks in http.c.

Here is an overview of the features that have been backported:
7.10.6 (el3) Backports CURLPROTO_*
7.12.1 (el4) Backports CURLPROTO_*
7.15.5 (el5) Backports GSSAPI_DELEGATION_*
             Backports CURLPROTO_*
7.19.7 (el6) Backports GSSAPI_DELEGATION_*
             Backports CURL_SSL_VERSION_TLSv1_{0,1,2}
7.29.0 (el7) Backports CURL_SSL_VERSION_TLSv1_{0,1,2}

This patch series will update the current version based checks for protocol restriction and GSSAPI delegation control support to ones based on features to properly deal with the above listed backports. The fine grained TLS version support does not seem to be distinguishable via a preprocessor macro so I've left that alone.

I have build tested these changes against upstream curl 7.12.0 (fails), 7.12.1 and 7.15.5. I have also built and run the testsuite against the Red Hat provided curl versions listed above.

Tom G. Christensen (2):
  http: Fix handling of missing CURLPROTO_*
  http: use a feature check to enable GSSAPI delegation control

 http.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Turn the version check into a feature check to ensure this functionality is also enabled with vendor supported curl versions where the feature may have been backported.

Signed-off-by: Tom G. Christensen <tgc@jupiterrise.com>
---
 http.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Commit aeae4db1 refactored the handling of the curl protocol restriction support into a function but failed to add a version check for older versions of curl that lack CURLPROTO_* support. This adds the missing check and at the same time converts it to a feature check instead of a version based check. This is done to ensure that vendor supported curl versions that have had CURLPROTO_* support backported are handled correctly.

Signed-off-by: Tom G. Christensen <tgc@jupiterrise.com>
---
 http.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

"Tom G. Christensen" <tgc@jupiterrise.com> writes:

This may make the code to _compile_, but is it sensible to let the code build and be used by the end users without the "these protocols are safe" filter, I wonder?

Granted, ancient code was unsafe and people were happily using it, but now we know better, and more importantly, we have since added users of transport (e.g. blindly fetch submodules recursively) that may _rely_ on this layer of the code safely filtering unsafe protocols, so...

On 12/08/17 02:30, Junio C Hamano wrote:

Git will display a warning at runtime if this is not available but perhaps this warning could be worded more strongly and/or make reference to CVE-2009-0037.

-tgc

On Fri, Aug 11, 2017 at 05:30:34PM -0700, Junio C Hamano wrote:

I don't think Tom's patch changes this in any meaningful way. The "fallback to skipping the safety and showing a warning" dates back to the original introduction of the feature.

But FWIW, that is exactly the kind of thing that led me to wanting to implement a hard cutoff in the first place. The warning is small consolation if Git allows an attack through anyway. Or worse, you don't even see the warning because it's an automated process that is being exploited.

There's a good chance if you have such an antique curl that it is also riddled with other curl-specific bugs that have since been fixed. And that would argue that we don't need to care that much anyway; people running old curl have decided that it's not worth caring about the security implications.

But in the case of RHEL, in theory they are patching security bugs in curl but just not implementing new features. So if we have a vulnerability introduced by using an old version of curl, we really are making things worse. And that argues for having a hard cutoff.

But as Tom's series demonstrates, they are backporting _some_ features (presumably ones needed by other programs like Git to fix security bugs). Which argues for having #ifdefs that handle those backports, which in theory gives us a secure Git on systems that do careful backporting, and gives us an insecure-but-not-worse-than-it-already-was Git on systems that don't do backporting.

I dunno. There were a lot of assumptions and mental gymnastics there. I'm still tempted to target curl >= 7.19.4 just based on timing and RHEL5's support life-cycle.

-Peff

"Tom G. Christensen" <tgc@jupiterrise.com> writes:

Thanks; these feature macros ought to be more dependable, and I think this moves things in the right direction (regardless of which features we might later pick as mandatory and cut off supports for older versions).

Hmph, what does "(fails)" mean here?

On 12/08/17 00:15, Junio C Hamano wrote:

It means building against 7.12.0 fails which is expected because it is missing CURLINFO_SSL_DATA_{IN,OUT}. There are patches in the other thread that would add support for curl < 7.12.1 if necessary.

-tgc

On Fri, Aug 11, 2017 at 03:15:06PM -0700, Junio C Hamano wrote:

Yes, I agree that these are an improvement regardless. If we follow through on the cut-off to 7.19.4, then the CURLPROTO ones all go away. But I don't mind rebasing any cut-off proposal on top of this work.

-Peff

Jeff King <peff@peff.net> writes:

Yeah I came to a similar conclusion and was about asking if you feel the same way that your series should be made on top of Tom's fixes.

The aspect of that series I do like the most is to base our decisions on features, not versions, and I also wonder if we can do similar in your "abandon too old ones" series, too.

Thanks.

On Sun, Aug 20, 2017 at 09:28:20AM -0700, Junio C Hamano wrote:

Yeah, I don't mind moving to feature flags where we can (though some features do not have a useful flag; e.g., the only way to know whether we must be strdup curl_easy_setopt() arguments is by checking the curl version).

One annoying thing about "feature" flags instead of version flags is that it takes a lot of legwork to figure out how old those features are (whereas with the versions I was able to look that up in the curl history pretty easily). Since people adding the feature flag generally do that legwork, it's probably worth having a comment for each mentioning the general vintage (or maybe the commit message is an OK place for that).

I actually wonder if it is worth defining our own readable flags in a big table at the beginning of the file, like:

  /*
   * introduced in curl 7.19.4, but backported by some distros like
   * RHEL. We can identify it by the presence of the PROTO flags.
   */
  #ifdef CURLPROTO_HTTP
  #define CURL_SUPPORTS_PROTOCOL_REDIRECTION
  #endif

That keeps the logic in one place (where it can be changed if we later find that the define we picked for our feature isn't quite accurate). And then the #ifdefs sprinkled through the code itself become self-documenting.

-Peff