On Wed, Sep 28, 2016 at 06:05:52PM +0200, Petr Stodulka wrote:

> Delegation of credentials is disabled by default in libcurl since
> version 7.21.7 due to security vulnerability CVE-2011-2192. Which
> makes troubles with GSS/kerberos authentication where delegation
> of credentials is required. This can be changed with option
> CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter
> since libcurl version 7.22.0.

I don't have any real knowledge of GSSAPI, so I'll refrain from
commenting on that aspect. But I did notice one mechanical issue:

> +#if LIBCURL_VERSION_NUM >= 0x071600
> +static const char *curl_deleg;
> +static struct {
> +     const char *name;
> +     long curl_deleg_param;
> +} curl_deleg_levels[] = {
> +     { "none", CURLGSSAPI_DELEGATION_NONE },
> +     { "policy", CURLGSSAPI_DELEGATION_POLICY_FLAG },
> +     { "always", CURLGSSAPI_DELEGATION_FLAG },
> +};
> +#endif

We only declare the curl_deleg variable if we have a new-enough curl.
But...

> @@ -323,6 +335,10 @@ static int http_options(const char *var, const char 
> *value, void *cb)
>               return 0;
>       }
>  
> +     if (!strcmp("http.delegation", var)) {
> +             return git_config_string(&curl_deleg, var, value);
> +     }
> +

...here we try to use it regardless. I think you want another #ifdef,
and probably to warn the user in the #else block (similar to what the
http.pinnedpubkey code does).

-Peff

Reply via email to