libcurl: update to 8.13.0

10 files changed, 197 insertions, 249 deletions

diff --git a/libs/libcurl/src/vauth/cleartext.c b/libs/libcurl/src/vauth/cleartext.c
index 198a452962..93d6340bf2 100644
--- a/libs/libcurl/src/vauth/cleartext.c
+++ b/libs/libcurl/src/vauth/cleartext.c
@@ -36,7 +36,6 @@
 

 #include "vauth/vauth.h"

 #include "warnless.h"

-#include "strtok.h"

 #include "sendf.h"

 #include "curl_printf.h"

 

diff --git a/libs/libcurl/src/vauth/digest.c b/libs/libcurl/src/vauth/digest.c
index 98e32900db..98d0c04dca 100644
--- a/libs/libcurl/src/vauth/digest.c
+++ b/libs/libcurl/src/vauth/digest.c
@@ -41,7 +41,7 @@
 #include "curl_sha512_256.h"

 #include "vtls/vtls.h"

 #include "warnless.h"

-#include "strtok.h"

+#include "strparse.h"

 #include "strcase.h"

 #include "curl_printf.h"

 #include "rand.h"

@@ -50,6 +50,7 @@
 #include "curl_memory.h"

 #include "memdebug.h"

 

+#ifndef USE_WINDOWS_SSPI

 #define SESSION_ALGO 1 /* for algos with this bit set */

 

 #define ALGO_MD5 0

@@ -59,7 +60,6 @@
 #define ALGO_SHA512_256 4

 #define ALGO_SHA512_256SESS (ALGO_SHA512_256 | SESSION_ALGO)

 

-#if !defined(USE_WINDOWS_SSPI)

 #define DIGEST_QOP_VALUE_AUTH             (1 << 0)

 #define DIGEST_QOP_VALUE_AUTH_INT         (1 << 1)

 #define DIGEST_QOP_VALUE_AUTH_CONF        (1 << 2)

@@ -141,8 +141,8 @@ bool Curl_auth_digest_get_pair(const char *str, char *value, char *content,
   return TRUE;

 }

 

-#if !defined(USE_WINDOWS_SSPI)

-/* Convert md5 chunk to RFC2617 (section 3.1.3) -suitable ASCII string */

+#ifndef USE_WINDOWS_SSPI

+/* Convert MD5 chunk to RFC2617 (section 3.1.3) -suitable ASCII string */

 static void auth_digest_md5_to_ascii(unsigned char *source, /* 16 bytes */

                                      unsigned char *dest) /* 33 bytes */

 {

@@ -219,33 +219,21 @@ static bool auth_digest_get_key_value(const char *chlg,
 

 static CURLcode auth_digest_get_qop_values(const char *options, int *value)

 {

-  char *tmp;

-  char *token;

-  char *tok_buf = NULL;

-

+  struct Curl_str out;

   /* Initialise the output */

   *value = 0;

 

-  /* Tokenise the list of qop values. Use a temporary clone of the buffer since

-     Curl_strtok_r() ruins it. */

-  tmp = strdup(options);

-  if(!tmp)

-    return CURLE_OUT_OF_MEMORY;

-

-  token = Curl_strtok_r(tmp, ",", &tok_buf);

-  while(token) {

-    if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH))

+  while(!Curl_str_until(&options, &out, 32, ',')) {

+    if(Curl_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH))

       *value |= DIGEST_QOP_VALUE_AUTH;

-    else if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH_INT))

+    else if(Curl_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH_INT))

       *value |= DIGEST_QOP_VALUE_AUTH_INT;

-    else if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH_CONF))

+    else if(Curl_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH_CONF))

       *value |= DIGEST_QOP_VALUE_AUTH_CONF;

-

-    token = Curl_strtok_r(NULL, ",", &tok_buf);

+    if(Curl_str_single(&options, ','))

+      break;

   }

 

-  free(tmp);

-

   return CURLE_OK;

 }

 

@@ -504,10 +492,6 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
                                               struct digestdata *digest)

 {

   bool before = FALSE; /* got a nonce before */

-  bool foundAuth = FALSE;

-  bool foundAuthInt = FALSE;

-  char *token = NULL;

-  char *tmp = NULL;

 

   /* If we already have received a nonce, keep that in mind */

   if(digest->nonce)

@@ -551,29 +535,25 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
           return CURLE_OUT_OF_MEMORY;

       }

       else if(strcasecompare(value, "qop")) {

-        char *tok_buf = NULL;

-        /* Tokenize the list and choose auth if possible, use a temporary

-           clone of the buffer since Curl_strtok_r() ruins it */

-        tmp = strdup(content);

-        if(!tmp)

-          return CURLE_OUT_OF_MEMORY;

-

-        token = Curl_strtok_r(tmp, ",", &tok_buf);

-        while(token) {

-          /* Pass additional spaces here */

-          while(*token && ISBLANK(*token))

-            token++;

-          if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH)) {

+        const char *token = content;

+        struct Curl_str out;

+        bool foundAuth = FALSE;

+        bool foundAuthInt = FALSE;

+        /* Pass leading spaces */

+        while(*token && ISBLANK(*token))

+          token++;

+        while(!Curl_str_until(&token, &out, 32, ',')) {

+          if(Curl_str_casecompare(&out, DIGEST_QOP_VALUE_STRING_AUTH))

             foundAuth = TRUE;

-          }

-          else if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH_INT)) {

+          else if(Curl_str_casecompare(&out,

+                                       DIGEST_QOP_VALUE_STRING_AUTH_INT))

             foundAuthInt = TRUE;

-          }

-          token = Curl_strtok_r(NULL, ",", &tok_buf);

+          if(Curl_str_single(&token, ','))

+            break;

+          while(*token && ISBLANK(*token))

+            token++;

         }

 

-        free(tmp);

-

         /* Select only auth or auth-int. Otherwise, ignore */

         if(foundAuth) {

           free(digest->qop);

diff --git a/libs/libcurl/src/vauth/digest_sspi.c b/libs/libcurl/src/vauth/digest_sspi.c
index 01c1a05d2b..3210e8ad0e 100644
--- a/libs/libcurl/src/vauth/digest_sspi.c
+++ b/libs/libcurl/src/vauth/digest_sspi.c
@@ -61,8 +61,9 @@ bool Curl_auth_is_digest_supported(void)
 

   /* Query the security package for Digest */

   status =

-    Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),

-                                          &SecurityPackage);

+    Curl_pSecFn->QuerySecurityPackageInfo(

+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),

+                                   &SecurityPackage);

 

   /* Release the package buffer as it is not required anymore */

   if(status == SEC_E_OK) {

@@ -121,8 +122,9 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
 

   /* Query the security package for DigestSSP */

   status =

-    Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),

-                                          &SecurityPackage);

+    Curl_pSecFn->QuerySecurityPackageInfo(

+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),

+                                   &SecurityPackage);

   if(status != SEC_E_OK) {

     failf(data, "SSPI: could not get auth info");

     return CURLE_AUTH_ERROR;

@@ -163,10 +165,10 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
 

   /* Acquire our credentials handle */

   status = Curl_pSecFn->AcquireCredentialsHandle(NULL,

-                                              (TCHAR *) TEXT(SP_NAME_DIGEST),

-                                              SECPKG_CRED_OUTBOUND, NULL,

-                                              p_identity, NULL, NULL,

-                                              &credentials, &expiry);

+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),

+                                   SECPKG_CRED_OUTBOUND, NULL,

+                                   p_identity, NULL, NULL,

+                                   &credentials, &expiry);

 

   if(status != SEC_E_OK) {

     Curl_sspi_free_identity(p_identity);

@@ -180,7 +182,7 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
   chlg_desc.cBuffers  = 1;

   chlg_desc.pBuffers  = &chlg_buf;

   chlg_buf.BufferType = SECBUFFER_TOKEN;

-  chlg_buf.pvBuffer   = (void *) Curl_bufref_ptr(chlg);

+  chlg_buf.pvBuffer   = CURL_UNCONST(Curl_bufref_ptr(chlg));

   chlg_buf.cbBuffer   = curlx_uztoul(Curl_bufref_len(chlg));

 

   /* Setup the response "output" security buffer */

@@ -271,7 +273,7 @@ CURLcode Curl_override_sspi_http_realm(const char *chlg,
         if(strcasecompare(value, "realm")) {

 

           /* Setup identity's domain and length */

-          domain.tchar_ptr = curlx_convert_UTF8_to_tchar((char *) content);

+          domain.tchar_ptr = curlx_convert_UTF8_to_tchar(content);

           if(!domain.tchar_ptr)

             return CURLE_OUT_OF_MEMORY;

 

@@ -413,8 +415,9 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
 

   /* Query the security package for DigestSSP */

   status =

-    Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_DIGEST),

-                                          &SecurityPackage);

+    Curl_pSecFn->QuerySecurityPackageInfo(

+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),

+                                   &SecurityPackage);

   if(status != SEC_E_OK) {

     failf(data, "SSPI: could not get auth info");

     return CURLE_AUTH_ERROR;

@@ -454,10 +457,10 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     chlg_buf[0].pvBuffer   = NULL;

     chlg_buf[0].cbBuffer   = 0;

     chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;

-    chlg_buf[1].pvBuffer   = (void *) request;

+    chlg_buf[1].pvBuffer   = CURL_UNCONST(request);

     chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *) request));

     chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;

-    chlg_buf[2].pvBuffer   = (void *) uripath;

+    chlg_buf[2].pvBuffer   = CURL_UNCONST(uripath);

     chlg_buf[2].cbBuffer   = curlx_uztoul(strlen((const char *) uripath));

     chlg_buf[3].BufferType = SECBUFFER_PKG_PARAMS;

     chlg_buf[3].pvBuffer   = NULL;

@@ -534,10 +537,10 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
 

     /* Acquire our credentials handle */

     status = Curl_pSecFn->AcquireCredentialsHandle(NULL,

-                                                (TCHAR *) TEXT(SP_NAME_DIGEST),

-                                                SECPKG_CRED_OUTBOUND, NULL,

-                                                p_identity, NULL, NULL,

-                                                &credentials, &expiry);

+                                   (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_DIGEST)),

+                                   SECPKG_CRED_OUTBOUND, NULL,

+                                   p_identity, NULL, NULL,

+                                   &credentials, &expiry);

     if(status != SEC_E_OK) {

       Curl_sspi_free_identity(p_identity);

       free(output_token);

@@ -553,7 +556,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     chlg_buf[0].pvBuffer   = digest->input_token;

     chlg_buf[0].cbBuffer   = curlx_uztoul(digest->input_token_len);

     chlg_buf[1].BufferType = SECBUFFER_PKG_PARAMS;

-    chlg_buf[1].pvBuffer   = (void *) request;

+    chlg_buf[1].pvBuffer   = CURL_UNCONST(request);

     chlg_buf[1].cbBuffer   = curlx_uztoul(strlen((const char *) request));

     chlg_buf[2].BufferType = SECBUFFER_PKG_PARAMS;

     chlg_buf[2].pvBuffer   = NULL;

@@ -567,7 +570,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
     resp_buf.pvBuffer   = output_token;

     resp_buf.cbBuffer   = curlx_uztoul(token_max);

 

-    spn = curlx_convert_UTF8_to_tchar((char *) uripath);

+    spn = curlx_convert_UTF8_to_tchar((const char *) uripath);

     if(!spn) {

       Curl_pSecFn->FreeCredentialsHandle(&credentials);

 

@@ -579,8 +582,12 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
 

     /* Allocate our new context handle */

     digest->http_context = calloc(1, sizeof(CtxtHandle));

-    if(!digest->http_context)

+    if(!digest->http_context) {

+      curlx_unicodefree(spn);

+      Curl_sspi_free_identity(p_identity);

+      free(output_token);

       return CURLE_OUT_OF_MEMORY;

+    }

 

     /* Generate our response message */

     status = Curl_pSecFn->InitializeSecurityContext(&credentials, NULL,

diff --git a/libs/libcurl/src/vauth/krb5_gssapi.c b/libs/libcurl/src/vauth/krb5_gssapi.c
index 2048938483..fde838b3ce 100644
--- a/libs/libcurl/src/vauth/krb5_gssapi.c
+++ b/libs/libcurl/src/vauth/krb5_gssapi.c
@@ -133,7 +133,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
       infof(data, "GSSAPI handshake failure (empty challenge message)");

       return CURLE_BAD_CONTENT_ENCODING;

     }

-    input_token.value = (void *) Curl_bufref_ptr(chlg);

+    input_token.value = CURL_UNCONST(Curl_bufref_ptr(chlg));

     input_token.length = Curl_bufref_len(chlg);

   }

 

@@ -210,7 +210,7 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   }

 

   /* Setup the challenge "input" security buffer */

-  input_token.value = (void *) Curl_bufref_ptr(chlg);

+  input_token.value = CURL_UNCONST(Curl_bufref_ptr(chlg));

   input_token.length = Curl_bufref_len(chlg);

 

   /* Decrypt the inbound challenge and obtain the qop */

diff --git a/libs/libcurl/src/vauth/krb5_sspi.c b/libs/libcurl/src/vauth/krb5_sspi.c
index d7a66aa628..eadeb3d046 100644
--- a/libs/libcurl/src/vauth/krb5_sspi.c
+++ b/libs/libcurl/src/vauth/krb5_sspi.c
@@ -55,9 +55,9 @@ bool Curl_auth_is_gssapi_supported(void)
   SECURITY_STATUS status;

 

   /* Query the security package for Kerberos */

-  status = Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *)

-                                              TEXT(SP_NAME_KERBEROS),

-                                              &SecurityPackage);

+  status = Curl_pSecFn->QuerySecurityPackageInfo(

+                                 (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_KERBEROS)),

+                                 &SecurityPackage);

 

   /* Release the package buffer as it is not required anymore */

   if(status == SEC_E_OK) {

@@ -118,9 +118,9 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
 

   if(!krb5->output_token) {

     /* Query the security package for Kerberos */

-    status = Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *)

-                                                TEXT(SP_NAME_KERBEROS),

-                                                &SecurityPackage);

+    status = Curl_pSecFn->QuerySecurityPackageInfo(

+                                 (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_KERBEROS)),

+                                 &SecurityPackage);

     if(status != SEC_E_OK) {

       failf(data, "SSPI: could not get auth info");

       return CURLE_AUTH_ERROR;

@@ -159,11 +159,10 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
 

     /* Acquire our credentials handle */

     status = Curl_pSecFn->AcquireCredentialsHandle(NULL,

-                                                (TCHAR *)

-                                                TEXT(SP_NAME_KERBEROS),

-                                                SECPKG_CRED_OUTBOUND, NULL,

-                                                krb5->p_identity, NULL, NULL,

-                                                krb5->credentials, &expiry);

+                                 (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_KERBEROS)),

+                                 SECPKG_CRED_OUTBOUND, NULL,

+                                 krb5->p_identity, NULL, NULL,

+                                 krb5->credentials, &expiry);

     if(status != SEC_E_OK)

       return CURLE_LOGIN_DENIED;

 

@@ -184,7 +183,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
     chlg_desc.cBuffers  = 1;

     chlg_desc.pBuffers  = &chlg_buf;

     chlg_buf.BufferType = SECBUFFER_TOKEN;

-    chlg_buf.pvBuffer   = (void *) Curl_bufref_ptr(chlg);

+    chlg_buf.pvBuffer   = CURL_UNCONST(Curl_bufref_ptr(chlg));

     chlg_buf.cbBuffer   = curlx_uztoul(Curl_bufref_len(chlg));

   }

 

@@ -297,7 +296,7 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   input_desc.cBuffers = 2;

   input_desc.pBuffers = input_buf;

   input_buf[0].BufferType = SECBUFFER_STREAM;

-  input_buf[0].pvBuffer = (void *) Curl_bufref_ptr(chlg);

+  input_buf[0].pvBuffer = CURL_UNCONST(Curl_bufref_ptr(chlg));

   input_buf[0].cbBuffer = curlx_uztoul(Curl_bufref_len(chlg));

   input_buf[1].BufferType = SECBUFFER_DATA;

   input_buf[1].pvBuffer = NULL;

diff --git a/libs/libcurl/src/vauth/ntlm.c b/libs/libcurl/src/vauth/ntlm.c
index e835500ebf..e8230e6b83 100644
--- a/libs/libcurl/src/vauth/ntlm.c
+++ b/libs/libcurl/src/vauth/ntlm.c
@@ -46,9 +46,7 @@
 #include "vtls/vtls.h"

 #include "strdup.h"

 

-#define BUILDING_CURL_NTLM_MSGS_C

 #include "vauth/vauth.h"

-#include "vauth/ntlm.h"

 #include "curl_endian.h"

 #include "curl_printf.h"

 

@@ -56,6 +54,112 @@
 #include "curl_memory.h"

 #include "memdebug.h"

 

+

+/* NTLM buffer fixed size, large enough for long user + host + domain */

+#define NTLM_BUFSIZE 1024

+

+/* Flag bits definitions based on

+   https://davenport.sourceforge.net/ntlm.html */

+

+#define NTLMFLAG_NEGOTIATE_UNICODE               (1<<0)

+/* Indicates that Unicode strings are supported for use in security buffer

+   data. */

+

+#define NTLMFLAG_NEGOTIATE_OEM                   (1<<1)

+/* Indicates that OEM strings are supported for use in security buffer data. */

+

+#define NTLMFLAG_REQUEST_TARGET                  (1<<2)

+/* Requests that the server's authentication realm be included in the Type 2

+   message. */

+

+/* unknown (1<<3) */

+#define NTLMFLAG_NEGOTIATE_SIGN                  (1<<4)

+/* Specifies that authenticated communication between the client and server

+   should carry a digital signature (message integrity). */

+

+#define NTLMFLAG_NEGOTIATE_SEAL                  (1<<5)

+/* Specifies that authenticated communication between the client and server

+   should be encrypted (message confidentiality). */

+

+#define NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE        (1<<6)

+/* Indicates that datagram authentication is being used. */

+

+#define NTLMFLAG_NEGOTIATE_LM_KEY                (1<<7)

+/* Indicates that the LAN Manager session key should be used for signing and

+   sealing authenticated communications. */

+

+#define NTLMFLAG_NEGOTIATE_NTLM_KEY              (1<<9)

+/* Indicates that NTLM authentication is being used. */

+

+/* unknown (1<<10) */

+

+#define NTLMFLAG_NEGOTIATE_ANONYMOUS             (1<<11)

+/* Sent by the client in the Type 3 message to indicate that an anonymous

+   context has been established. This also affects the response fields. */

+

+#define NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED       (1<<12)

+/* Sent by the client in the Type 1 message to indicate that a desired

+   authentication realm is included in the message. */

+

+#define NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED  (1<<13)

+/* Sent by the client in the Type 1 message to indicate that the client

+   workstation's name is included in the message. */

+

+#define NTLMFLAG_NEGOTIATE_LOCAL_CALL            (1<<14)

+/* Sent by the server to indicate that the server and client are on the same

+   machine. Implies that the client may use a pre-established local security

+   context rather than responding to the challenge. */

+

+#define NTLMFLAG_NEGOTIATE_ALWAYS_SIGN           (1<<15)

+/* Indicates that authenticated communication between the client and server

+   should be signed with a "dummy" signature. */

+

+#define NTLMFLAG_TARGET_TYPE_DOMAIN              (1<<16)

+/* Sent by the server in the Type 2 message to indicate that the target

+   authentication realm is a domain. */

+

+#define NTLMFLAG_TARGET_TYPE_SERVER              (1<<17)

+/* Sent by the server in the Type 2 message to indicate that the target

+   authentication realm is a server. */

+

+#define NTLMFLAG_TARGET_TYPE_SHARE               (1<<18)

+/* Sent by the server in the Type 2 message to indicate that the target

+   authentication realm is a share. Presumably, this is for share-level

+   authentication. Usage is unclear. */

+

+#define NTLMFLAG_NEGOTIATE_NTLM2_KEY             (1<<19)

+/* Indicates that the NTLM2 signing and sealing scheme should be used for

+   protecting authenticated communications. */

+

+#define NTLMFLAG_REQUEST_INIT_RESPONSE           (1<<20)

+/* unknown purpose */

+

+#define NTLMFLAG_REQUEST_ACCEPT_RESPONSE         (1<<21)

+/* unknown purpose */

+

+#define NTLMFLAG_REQUEST_NONNT_SESSION_KEY       (1<<22)

+/* unknown purpose */

+

+#define NTLMFLAG_NEGOTIATE_TARGET_INFO           (1<<23)

+/* Sent by the server in the Type 2 message to indicate that it is including a

+   Target Information block in the message. */

+

+/* unknown (1<24) */

+/* unknown (1<25) */

+/* unknown (1<26) */

+/* unknown (1<27) */

+/* unknown (1<28) */

+

+#define NTLMFLAG_NEGOTIATE_128                   (1<<29)

+/* Indicates that 128-bit encryption is supported. */

+

+#define NTLMFLAG_NEGOTIATE_KEY_EXCHANGE          (1<<30)

+/* Indicates that the client will provide an encrypted master key in

+   the "Session Key" field of the Type 3 message. */

+

+#define NTLMFLAG_NEGOTIATE_56                    (1<<31)

+/* Indicates that 56-bit encryption is supported. */

+

 /* "NTLMSSP" signature is always in ASCII regardless of the platform */

 #define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"

 

diff --git a/libs/libcurl/src/vauth/ntlm.h b/libs/libcurl/src/vauth/ntlm.h
deleted file mode 100644
index 4c8f5edd36..0000000000
--- a/libs/libcurl/src/vauth/ntlm.h
+++ /dev/null
@@ -1,143 +0,0 @@
-#ifndef HEADER_VAUTH_NTLM_H

-#define HEADER_VAUTH_NTLM_H

-/***************************************************************************

- *                                  _   _ ____  _

- *  Project                     ___| | | |  _ \| |

- *                             / __| | | | |_) | |

- *                            | (__| |_| |  _ <| |___

- *                             \___|\___/|_| \_\_____|

- *

- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.

- *

- * This software is licensed as described in the file COPYING, which

- * you should have received as part of this distribution. The terms

- * are also available at https://curl.se/docs/copyright.html.

- *

- * You may opt to use, copy, modify, merge, publish, distribute and/or sell

- * copies of the Software, and permit persons to whom the Software is

- * furnished to do so, under the terms of the COPYING file.

- *

- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY

- * KIND, either express or implied.

- *

- * SPDX-License-Identifier: curl

- *

- ***************************************************************************/

-

-#include "curl_setup.h"

-

-#ifdef USE_NTLM

-

-/* NTLM buffer fixed size, large enough for long user + host + domain */

-#define NTLM_BUFSIZE 1024

-

-/* Stuff only required for curl_ntlm_msgs.c */

-#ifdef BUILDING_CURL_NTLM_MSGS_C

-

-/* Flag bits definitions based on

-   https://davenport.sourceforge.net/ntlm.html */

-

-#define NTLMFLAG_NEGOTIATE_UNICODE               (1<<0)

-/* Indicates that Unicode strings are supported for use in security buffer

-   data. */

-

-#define NTLMFLAG_NEGOTIATE_OEM                   (1<<1)

-/* Indicates that OEM strings are supported for use in security buffer data. */

-

-#define NTLMFLAG_REQUEST_TARGET                  (1<<2)

-/* Requests that the server's authentication realm be included in the Type 2

-   message. */

-

-/* unknown (1<<3) */

-#define NTLMFLAG_NEGOTIATE_SIGN                  (1<<4)

-/* Specifies that authenticated communication between the client and server

-   should carry a digital signature (message integrity). */

-

-#define NTLMFLAG_NEGOTIATE_SEAL                  (1<<5)

-/* Specifies that authenticated communication between the client and server

-   should be encrypted (message confidentiality). */

-

-#define NTLMFLAG_NEGOTIATE_DATAGRAM_STYLE        (1<<6)

-/* Indicates that datagram authentication is being used. */

-

-#define NTLMFLAG_NEGOTIATE_LM_KEY                (1<<7)

-/* Indicates that the LAN Manager session key should be used for signing and

-   sealing authenticated communications. */

-

-#define NTLMFLAG_NEGOTIATE_NTLM_KEY              (1<<9)

-/* Indicates that NTLM authentication is being used. */

-

-/* unknown (1<<10) */

-

-#define NTLMFLAG_NEGOTIATE_ANONYMOUS             (1<<11)

-/* Sent by the client in the Type 3 message to indicate that an anonymous

-   context has been established. This also affects the response fields. */

-

-#define NTLMFLAG_NEGOTIATE_DOMAIN_SUPPLIED       (1<<12)

-/* Sent by the client in the Type 1 message to indicate that a desired

-   authentication realm is included in the message. */

-

-#define NTLMFLAG_NEGOTIATE_WORKSTATION_SUPPLIED  (1<<13)

-/* Sent by the client in the Type 1 message to indicate that the client

-   workstation's name is included in the message. */

-

-#define NTLMFLAG_NEGOTIATE_LOCAL_CALL            (1<<14)

-/* Sent by the server to indicate that the server and client are on the same

-   machine. Implies that the client may use a pre-established local security

-   context rather than responding to the challenge. */

-

-#define NTLMFLAG_NEGOTIATE_ALWAYS_SIGN           (1<<15)

-/* Indicates that authenticated communication between the client and server

-   should be signed with a "dummy" signature. */

-

-#define NTLMFLAG_TARGET_TYPE_DOMAIN              (1<<16)

-/* Sent by the server in the Type 2 message to indicate that the target

-   authentication realm is a domain. */

-

-#define NTLMFLAG_TARGET_TYPE_SERVER              (1<<17)

-/* Sent by the server in the Type 2 message to indicate that the target

-   authentication realm is a server. */

-

-#define NTLMFLAG_TARGET_TYPE_SHARE               (1<<18)

-/* Sent by the server in the Type 2 message to indicate that the target

-   authentication realm is a share. Presumably, this is for share-level

-   authentication. Usage is unclear. */

-

-#define NTLMFLAG_NEGOTIATE_NTLM2_KEY             (1<<19)

-/* Indicates that the NTLM2 signing and sealing scheme should be used for

-   protecting authenticated communications. */

-

-#define NTLMFLAG_REQUEST_INIT_RESPONSE           (1<<20)

-/* unknown purpose */

-

-#define NTLMFLAG_REQUEST_ACCEPT_RESPONSE         (1<<21)

-/* unknown purpose */

-

-#define NTLMFLAG_REQUEST_NONNT_SESSION_KEY       (1<<22)

-/* unknown purpose */

-

-#define NTLMFLAG_NEGOTIATE_TARGET_INFO           (1<<23)

-/* Sent by the server in the Type 2 message to indicate that it is including a

-   Target Information block in the message. */

-

-/* unknown (1<24) */

-/* unknown (1<25) */

-/* unknown (1<26) */

-/* unknown (1<27) */

-/* unknown (1<28) */

-

-#define NTLMFLAG_NEGOTIATE_128                   (1<<29)

-/* Indicates that 128-bit encryption is supported. */

-

-#define NTLMFLAG_NEGOTIATE_KEY_EXCHANGE          (1<<30)

-/* Indicates that the client will provide an encrypted master key in

-   the "Session Key" field of the Type 3 message. */

-

-#define NTLMFLAG_NEGOTIATE_56                    (1<<31)

-/* Indicates that 56-bit encryption is supported. */

-

-#endif /* BUILDING_CURL_NTLM_MSGS_C */

-

-#endif /* USE_NTLM */

-

-#endif /* HEADER_VAUTH_NTLM_H */

diff --git a/libs/libcurl/src/vauth/ntlm_sspi.c b/libs/libcurl/src/vauth/ntlm_sspi.c
index 3bb21cc10b..3d8d1e010e 100644
--- a/libs/libcurl/src/vauth/ntlm_sspi.c
+++ b/libs/libcurl/src/vauth/ntlm_sspi.c
@@ -55,8 +55,9 @@ bool Curl_auth_is_ntlm_supported(void)
   SECURITY_STATUS status;

 

   /* Query the security package for NTLM */

-  status = Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_NTLM),

-                                              &SecurityPackage);

+  status = Curl_pSecFn->QuerySecurityPackageInfo(

+                                     (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NTLM)),

+                                     &SecurityPackage);

 

   /* Release the package buffer as it is not required anymore */

   if(status == SEC_E_OK) {

@@ -103,8 +104,9 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
   Curl_auth_cleanup_ntlm(ntlm);

 

   /* Query the security package for NTLM */

-  status = Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *) TEXT(SP_NAME_NTLM),

-                                              &SecurityPackage);

+  status = Curl_pSecFn->QuerySecurityPackageInfo(

+                                     (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NTLM)),

+                                     &SecurityPackage);

   if(status != SEC_E_OK) {

     failf(data, "SSPI: could not get auth info");

     return CURLE_AUTH_ERROR;

@@ -142,10 +144,10 @@ CURLcode Curl_auth_create_ntlm_type1_message(struct Curl_easy *data,
 

   /* Acquire our credentials handle */

   status = Curl_pSecFn->AcquireCredentialsHandle(NULL,

-                                              (TCHAR *) TEXT(SP_NAME_NTLM),

-                                              SECPKG_CRED_OUTBOUND, NULL,

-                                              ntlm->p_identity, NULL, NULL,

-                                              ntlm->credentials, &expiry);

+                                     (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NTLM)),

+                                     SECPKG_CRED_OUTBOUND, NULL,

+                                     ntlm->p_identity, NULL, NULL,

+                                     ntlm->credentials, &expiry);

   if(status != SEC_E_OK)

     return CURLE_LOGIN_DENIED;

 

diff --git a/libs/libcurl/src/vauth/spnego_gssapi.c b/libs/libcurl/src/vauth/spnego_gssapi.c
index 850d749c1c..7b7ec3ccfc 100644
--- a/libs/libcurl/src/vauth/spnego_gssapi.c
+++ b/libs/libcurl/src/vauth/spnego_gssapi.c
@@ -156,10 +156,10 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
   }

 

   /* Set channel binding data if available */

-  if(nego->channel_binding_data.leng > 0) {

+  if(Curl_dyn_len(&nego->channel_binding_data)) {

     memset(&chan, 0, sizeof(struct gss_channel_bindings_struct));

-    chan.application_data.length = nego->channel_binding_data.leng;

-    chan.application_data.value = nego->channel_binding_data.bufr;

+    chan.application_data.length = Curl_dyn_len(&nego->channel_binding_data);

+    chan.application_data.value = Curl_dyn_ptr(&nego->channel_binding_data);

     chan_bindings = &chan;

   }

 

diff --git a/libs/libcurl/src/vauth/spnego_sspi.c b/libs/libcurl/src/vauth/spnego_sspi.c
index b47475dc31..c42c7f8f10 100644
--- a/libs/libcurl/src/vauth/spnego_sspi.c
+++ b/libs/libcurl/src/vauth/spnego_sspi.c
@@ -57,9 +57,9 @@ bool Curl_auth_is_spnego_supported(void)
   SECURITY_STATUS status;

 

   /* Query the security package for Negotiate */

-  status = Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *)

-                                              TEXT(SP_NAME_NEGOTIATE),

-                                              &SecurityPackage);

+  status = Curl_pSecFn->QuerySecurityPackageInfo(

+                                (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NEGOTIATE)),

+                                &SecurityPackage);

 

   /* Release the package buffer as it is not required anymore */

   if(status == SEC_E_OK) {

@@ -128,9 +128,9 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
 

   if(!nego->output_token) {

     /* Query the security package for Negotiate */

-    nego->status = (DWORD)Curl_pSecFn->QuerySecurityPackageInfo((TCHAR *)

-                                                       TEXT(SP_NAME_NEGOTIATE),

-                                                       &SecurityPackage);

+    nego->status = (DWORD)Curl_pSecFn->QuerySecurityPackageInfo(

+                                (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NEGOTIATE)),

+                                &SecurityPackage);

     if(nego->status != SEC_E_OK) {

       failf(data, "SSPI: could not get auth info");

       return CURLE_AUTH_ERROR;

@@ -170,10 +170,10 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
     /* Acquire our credentials handle */

     nego->status = (DWORD)

       Curl_pSecFn->AcquireCredentialsHandle(NULL,

-                                         (TCHAR *)TEXT(SP_NAME_NEGOTIATE),

-                                         SECPKG_CRED_OUTBOUND, NULL,

-                                         nego->p_identity, NULL, NULL,

-                                         nego->credentials, &expiry);

+                                (TCHAR *)CURL_UNCONST(TEXT(SP_NAME_NEGOTIATE)),

+                                SECPKG_CRED_OUTBOUND, NULL,

+                                nego->p_identity, NULL, NULL,

+                                nego->credentials, &expiry);

     if(nego->status != SEC_E_OK)

       return CURLE_AUTH_ERROR;