Re: [PATCH] http: Control GSSAPI credential delegation.

[Jeff King <peff@peff.net>]

On Wed, Sep 28, 2016 at 06:05:52PM +0200, Petr Stodulka wrote:

> Delegation of credentials is disabled by default in libcurl since
> version 7.21.7 due to security vulnerability CVE-2011-2192. Which
> makes troubles with GSS/kerberos authentication where delegation
> of credentials is required. This can be changed with option
> CURLOPT_GSSAPI_DELEGATION in libcurl with set expected parameter
> since libcurl version 7.22.0.

I don't have any real knowledge of GSSAPI, so I'll refrain from
commenting on that aspect. But I did notice one mechanical issue:

> +#if LIBCURL_VERSION_NUM >= 0x071600
> +static const char *curl_deleg;
> +static struct {
> +	const char *name;
> +	long curl_deleg_param;
> +} curl_deleg_levels[] = {
> +	{ "none", CURLGSSAPI_DELEGATION_NONE },
> +	{ "policy", CURLGSSAPI_DELEGATION_POLICY_FLAG },
> +	{ "always", CURLGSSAPI_DELEGATION_FLAG },
> +};
> +#endif

We only declare the curl_deleg variable if we have a new-enough curl.
But...

> @@ -323,6 +335,10 @@ static int http_options(const char *var, const char *value, void *cb)
>  		return 0;
>  	}
>  
> +	if (!strcmp("http.delegation", var)) {
> +		return git_config_string(&curl_deleg, var, value);
> +	}
> +

...here we try to use it regardless. I think you want another #ifdef,
and probably to warn the user in the #else block (similar to what the
http.pinnedpubkey code does).

-Peff