diff -u -N -r curl-7.32.0/docs/curl.1 curl-7.32-new/docs/curl.1 --- curl-7.32.0/docs/curl.1 2013-07-19 22:23:23.000000000 +0100 +++ curl-7.32-new/docs/curl.1 2013-09-22 15:51:28.661404554 +0100 @@ -934,6 +934,25 @@ user name and password from the \fI-u\fP option aren't actually used. If this option is used several times, only the first one is used. + +.IP "--negotiate-gssapi-service " +The default service name for a HTTP server is HTTP/host-fqdn. This option +allows you to change it. + +Examples: --negotiate \fI--negotiate-gssapi-service\fP KHTTP would use +KHTTP/host --negotiate \fI--negotiate-gssapi-service\fP +HTTP/host-int2 would use HTTP/host-int2 for cases where the host does +not match the principal name. (Added in 7.x.y). + +.IP "--proxy-negotiate-gssapi-service " +The default service name for a HTTP proxy server is HTTP/proxy-fqdn. This option +allows you to change it. + +Examples: --proxy-negotiate \fI--proxy-negotiate-gssapi-service\fP KHTTP would use +KHTTP/proxyhost --negotiate \fI--proxy-negotiate-gssapi-service\fP +HTTP/proxyhost-int2 would use HTTP/proxyhost-int2 for cases where the proxyhost does +not match the principal name. (Added in 7.x.y). + .IP "--no-keepalive" Disables the use of keepalive messages on the TCP connection, as by default curl enables them. diff -u -N -r curl-7.32.0/include/curl/curl.h curl-7.32-new/include/curl/curl.h --- curl-7.32.0/include/curl/curl.h 2013-08-06 22:18:16.000000000 +0100 +++ curl-7.32-new/include/curl/curl.h 2013-09-20 23:31:59.728811735 +0100 @@ -1551,6 +1551,12 @@ * prototype defines. (Deprecates CURLOPT_PROGRESSFUNCTION) */ CINIT(XFERINFOFUNCTION, FUNCTIONPOINT, 219), + /* Socks Service */ + CINIT(NEGOTIATE_GSSAPI_SERVICE, OBJECTPOINT, 219), + + /* Socks Service */ + CINIT(PROXY_NEGOTIATE_GSSAPI_SERVICE, OBJECTPOINT, 220), + CURLOPT_LASTENTRY /* the last unused */ } CURLoption; diff -u -N -r curl-7.32.0/include/curl/typecheck-gcc.h curl-7.32-new/include/curl/typecheck-gcc.h --- curl-7.32.0/include/curl/typecheck-gcc.h 2013-07-15 22:37:58.000000000 +0100 +++ curl-7.32-new/include/curl/typecheck-gcc.h 2013-09-20 23:32:14.193812691 +0100 @@ -259,6 +259,8 @@ (option) == CURLOPT_CRLFILE || \ (option) == CURLOPT_ISSUERCERT || \ (option) == CURLOPT_SOCKS5_GSSAPI_SERVICE || \ + (option) == CURLOPT_NEGOTIATE_GSSAPI_SERVICE || \ + (option) == CURLOPT_PROXY_NEGOTIATE_GSSAPI_SERVICE || \ (option) == CURLOPT_SSH_KNOWNHOSTS || \ (option) == CURLOPT_MAIL_FROM || \ (option) == CURLOPT_RTSP_SESSION_ID || \ diff -u -N -r curl-7.32.0/lib/http_negotiate.c curl-7.32-new/lib/http_negotiate.c --- curl-7.32.0/lib/http_negotiate.c 2013-07-15 22:37:58.000000000 +0100 +++ curl-7.32-new/lib/http_negotiate.c 2013-09-22 15:46:54.176386416 +0100 @@ -61,12 +61,16 @@ static int get_gss_name(struct connectdata *conn, bool proxy, gss_name_t *server) { - struct negotiatedata *neg_ctx = proxy?&conn->data->state.proxyneg: - &conn->data->state.negotiate; OM_uint32 major_status, minor_status; gss_buffer_desc token = GSS_C_EMPTY_BUFFER; char name[2048]; - const char* service; + struct negotiatedata *neg_ctx = proxy?&conn->data->state.proxyneg: + &conn->data->state.negotiate; + const char *serviceptr = proxy? + conn->data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE]: + conn->data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE]; + bool service_set = proxy ? conn->bits.proxy_negotiate_gssapi_service: + conn->bits.negotiate_gssapi_service; /* GSSAPI implementation by Globus (known as GSI) requires the name to be of form "/" instead of @ (ie. slash instead @@ -75,25 +79,40 @@ /* IIS uses the @ form but uses 'http' as the service name */ - if(neg_ctx->gss) - service = "KHTTP"; - else - service = "HTTP"; - - token.length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name : + if (!service_set) { + if(neg_ctx->gss) + serviceptr = "KHTTP"; + else + serviceptr = "HTTP"; + } + if(strchr(serviceptr,'/')) { + token.value = malloc(strlen(serviceptr)); + if(!token.value) + return EMSGSIZE; + + token.length = strlen(serviceptr); + memcpy(token.value, serviceptr, token.length); + major_status = gss_import_name(&minor_status, + &token, + (gss_OID) GSS_C_NULL_OID, + server); + + } + else { + token.length = strlen(serviceptr) + 1 + strlen(proxy ? conn->proxy.name : conn->host.name) + 1; - if(token.length + 1 > sizeof(name)) - return EMSGSIZE; - - snprintf(name, sizeof(name), "%s@%s", service, proxy ? conn->proxy.name : - conn->host.name); - - token.value = (void *) name; - major_status = gss_import_name(&minor_status, - &token, - GSS_C_NT_HOSTBASED_SERVICE, - server); + if(token.length + 1 > sizeof(name)) + return EMSGSIZE; + snprintf(name, sizeof(name), "%s@%s", serviceptr, proxy ? conn->proxy.name : + conn->host.name); + token.value = (void *) name; + major_status = gss_import_name(&minor_status, + &token, + GSS_C_NT_HOSTBASED_SERVICE, + server); + } + infof(conn->data,"Import Service Name %.*s\n",token.length,token.value); return GSS_ERROR(major_status) ? -1 : 0; } diff -u -N -r curl-7.32.0/lib/http_negotiate_sspi.c curl-7.32-new/lib/http_negotiate_sspi.c --- curl-7.32.0/lib/http_negotiate_sspi.c 2013-07-15 22:37:58.000000000 +0100 +++ curl-7.32-new/lib/http_negotiate_sspi.c 2013-09-22 15:44:23.216376441 +0100 @@ -45,8 +45,12 @@ get_gss_name(struct connectdata *conn, bool proxy, struct negotiatedata *neg_ctx) { - const char* service; size_t length; + char *serviceptr = proxy? + conn->data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE]: + conn->data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE]; + bool service_set = proxy ? conn->bits.proxy_negotiate_gssapi_service: + conn->bits.negotiate_gssapi_service; if(proxy && !conn->proxy.name) /* proxy auth requested but no given proxy name, error out! */ @@ -61,19 +65,32 @@ and SSPI then generates an NTLM token. When using / a Kerberos token is generated. */ - if(neg_ctx->gss) - service = "KHTTP"; - else - service = "HTTP"; - - length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name : - conn->host.name) + 1; - if(length + 1 > sizeof(neg_ctx->server_name)) - return EMSGSIZE; - - snprintf(neg_ctx->server_name, sizeof(neg_ctx->server_name), "%s/%s", - service, proxy ? conn->proxy.name : conn->host.name); - + if (!service_set) { + if(neg_ctx->gss) + serviceptr = "KHTTP"; + else + serviceptr = "HTTP"; + } + + if(strchr(serviceptr,'/')) { + length = strlen(serviceptr)+1; + + if(length + 1 > sizeof(neg_ctx->server_name)) + return EMSGSIZE; + + snprintf(neg_ctx->server_name, sizeof(neg_ctx->server_name), "%s", + serviceptr); + } + else { + length = strlen(serviceptr) + 1 + strlen(proxy ? conn->proxy.name : + conn->host.name) + 1; + if(length + 1 > sizeof(neg_ctx->server_name)) + return EMSGSIZE; + + snprintf(neg_ctx->server_name, sizeof(neg_ctx->server_name), "%s/%s", + serviceptr, proxy ? conn->proxy.name : conn->host.name); + } + infof(conn->data,"Import Service Name %.*s\n",length,neg_ctx->server_name); return 0; } diff -u -N -r curl-7.32.0/lib/url.c curl-7.32-new/lib/url.c --- curl-7.32.0/lib/url.c 2013-08-09 22:41:42.000000000 +0100 +++ curl-7.32-new/lib/url.c 2013-09-22 15:27:01.845307627 +0100 @@ -1391,6 +1391,22 @@ */ data->set.socks5_gssapi_nec = (0 != va_arg(param, long))?TRUE:FALSE; break; + + case CURLOPT_NEGOTIATE_GSSAPI_SERVICE: + /* + * Set gssapi service name + */ + result = setstropt(&data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE], + va_arg(param, char *)); + break; + + case CURLOPT_PROXY_NEGOTIATE_GSSAPI_SERVICE: + /* + * Set gssapi service name + */ + result = setstropt(&data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE], + va_arg(param, char *)); + break; #endif case CURLOPT_WRITEHEADER: @@ -3560,6 +3576,9 @@ conn->bits.httpproxy = FALSE; conn->bits.proxy_user_passwd = FALSE; conn->bits.tunnel_proxy = FALSE; +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + conn->bits.proxy_negotiate_gssapi_service = FALSE; +#endif /* HAVE_GSSAPI) || USE_WINDOWS_SSPI */ #else /* CURL_DISABLE_PROXY */ @@ -3573,9 +3592,19 @@ conn->bits.proxy_user_passwd = (NULL != data->set.str[STRING_PROXYUSERNAME])?TRUE:FALSE; conn->bits.tunnel_proxy = data->set.tunnel_thru_httpproxy; +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + conn->bits.proxy_negotiate_gssapi_service = + (data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE] && + *data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE])?TRUE:FALSE; +#endif /* HAVE_GSSAPI) || USE_WINDOWS_SSPI */ #endif /* CURL_DISABLE_PROXY */ +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + conn->bits.negotiate_gssapi_service = + (data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE] && + *data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE])?TRUE:FALSE; +#endif /* HAVE_GSSAPI) || USE_WINDOWS_SSPI */ conn->bits.user_passwd = (NULL != data->set.str[STRING_USERNAME])?TRUE:FALSE; conn->bits.ftp_use_epsv = data->set.ftp_use_epsv; conn->bits.ftp_use_eprt = data->set.ftp_use_eprt; diff -u -N -r curl-7.32.0/lib/urldata.h curl-7.32-new/lib/urldata.h --- curl-7.32.0/lib/urldata.h 2013-08-09 22:41:42.000000000 +0100 +++ curl-7.32-new/lib/urldata.h 2013-09-22 15:30:10.782320112 +0100 @@ -523,6 +523,14 @@ bool bound; /* set true if bind() has already been done on this socket/ connection */ bool type_set; /* type= was used in the URL */ +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + bool negotiate_gssapi_service ; /* set true if a service name has been + provided to overwrite the default HTTP or + kHTTP */ + bool proxy_negotiate_gssapi_service ; /* set true if a service name has been + provided to overwrite the default + HTTP or kHTTP */ +#endif /* HAVE_GSSAPI || USE_WINDOWS_SSPI */ }; struct hostname { @@ -1378,6 +1386,8 @@ #endif #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) STRING_SOCKS5_GSSAPI_SERVICE, /* GSSAPI service name */ + STRING_NEGOTIATE_GSSAPI_SERVICE, /* GSSAPI service name */ + STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE, /* GSSAPI service name */ #endif STRING_MAIL_FROM, STRING_MAIL_AUTH, diff -u -N -r curl-7.32.0/src/tool_cfgable.c curl-7.32-new/src/tool_cfgable.c --- curl-7.32.0/src/tool_cfgable.c 2013-07-18 13:49:52.000000000 +0100 +++ curl-7.32-new/src/tool_cfgable.c 2013-09-20 23:33:26.928817497 +0100 @@ -119,6 +119,8 @@ Curl_safefree(config->socksproxy); Curl_safefree(config->socks5_gssapi_service); + Curl_safefree(config->negotiate_gssapi_service); + Curl_safefree(config->proxy_negotiate_gssapi_service); Curl_safefree(config->ftp_account); Curl_safefree(config->ftp_alternative_to_user); diff -u -N -r curl-7.32.0/src/tool_cfgable.h curl-7.32-new/src/tool_cfgable.h --- curl-7.32.0/src/tool_cfgable.h 2013-07-19 22:23:23.000000000 +0100 +++ curl-7.32-new/src/tool_cfgable.h 2013-09-20 23:33:31.810817820 +0100 @@ -171,6 +171,10 @@ int socksver; /* set to CURLPROXY_SOCKS* define */ char *socks5_gssapi_service; /* set service name for gssapi principal * default rcmd */ + char *negotiate_gssapi_service; /* set service name for gssapi principal + * default HTTP */ + char *proxy_negotiate_gssapi_service; /* set service name for gssapi principal + * default HTTP */ int socks5_gssapi_nec ; /* The NEC reference server does not protect * the encryption type exchange */ diff -u -N -r curl-7.32.0/src/tool_getparam.c curl-7.32-new/src/tool_getparam.c --- curl-7.32.0/src/tool_getparam.c 2013-07-19 22:23:23.000000000 +0100 +++ curl-7.32-new/src/tool_getparam.c 2013-09-20 23:33:55.605819392 +0100 @@ -174,6 +174,10 @@ {"$I", "post303", FALSE}, {"$J", "metalink", FALSE}, {"$K", "sasl-ir", FALSE}, +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + {"$L", "proxy-negotiate-gssapi-service", TRUE}, + {"$M", "negotiate-gssapi-service", TRUE}, +#endif {"0", "http1.0", FALSE}, {"1", "tlsv1", FALSE}, {"2", "sslv2", FALSE}, @@ -961,6 +965,14 @@ case 'K': /* --sasl-ir */ config->sasl_ir = TRUE; break; +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + case 'L': /* --proxy-negotiate-gssapi-service */ + GetStr(&config->proxy_negotiate_gssapi_service, nextarg); + break; + case 'M': /* --negotiate-gssapi-service */ + GetStr(&config->negotiate_gssapi_service, nextarg); + break; +#endif } break; case '#': /* --progress-bar */ diff -u -N -r curl-7.32.0/src/tool_help.c curl-7.32-new/src/tool_help.c --- curl-7.32.0/src/tool_help.c 2013-07-18 13:49:52.000000000 +0100 +++ curl-7.32-new/src/tool_help.c 2013-09-20 23:34:05.879820071 +0100 @@ -127,6 +127,9 @@ " -m, --max-time SECONDS Maximum time allowed for the transfer", " --metalink Process given URLs as metalink XML file", " --negotiate Use HTTP Negotiate Authentication (H)", +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + " --negotiate-gssapi-service NAME HTTP service name for gssapi", +#endif " -n, --netrc Must read .netrc for user name and password", " --netrc-optional Use either .netrc or URL; overrides -n", " --netrc-file FILE Set up the netrc filename to use", @@ -152,6 +155,9 @@ " --proxy-basic Use Basic authentication on the proxy (H)", " --proxy-digest Use Digest authentication on the proxy (H)", " --proxy-negotiate Use Negotiate authentication on the proxy (H)", +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + " --proxy-negotiate-gssapi-service NAME HTTP proxy service name for gssapi", +#endif " --proxy-ntlm Use NTLM authentication on the proxy (H)", " -U, --proxy-user USER[:PASSWORD] Proxy user and password", " --proxy1.0 HOST[:PORT] Use HTTP/1.0 proxy on given port", diff -u -N -r curl-7.32.0/src/tool_operate.c curl-7.32-new/src/tool_operate.c --- curl-7.32.0/src/tool_operate.c 2013-07-31 21:53:34.000000000 +0100 +++ curl-7.32-new/src/tool_operate.c 2013-09-20 23:34:18.311820893 +0100 @@ -1299,6 +1299,16 @@ if(config->socks5_gssapi_nec) my_setopt_str(curl, CURLOPT_SOCKS5_GSSAPI_NEC, config->socks5_gssapi_nec); + + /* new in curl 7.x.y */ + if(config->negotiate_gssapi_service) + my_setopt_str(curl, CURLOPT_NEGOTIATE_GSSAPI_SERVICE, + config->negotiate_gssapi_service); + + /* new in curl 7.x.y */ + if(config->proxy_negotiate_gssapi_service) + my_setopt_str(curl, CURLOPT_PROXY_NEGOTIATE_GSSAPI_SERVICE, + config->proxy_negotiate_gssapi_service); } #endif /* curl 7.13.0 */