[curl/f14] fixes for #719939, #723075 and #730444
Kamil Dudka
kdudka at fedoraproject.org
Tue Aug 16 17:40:58 UTC 2011
commit 8997807d1a0c72745eca4d333d35c5241fb3cf41
Author: Kamil Dudka <kdudka at redhat.com>
Date: Mon Aug 15 22:11:51 2011 +0200
fixes for #719939, #723075 and #730444
- add a new option CURLOPT_GSSAPI_DELEGATION (#719939)
- fix SIGSEGV of curl -O -J given more than one URLs (#723075)
- introduce the --delegation option of curl (#730444)
0014-curl-7.21.0-a7864c4.patch | 356 ++++++++++++++++++++++++++++++++++++++++
0015-curl-7.21.0-5eb2396.patch | 30 ++++
0016-curl-7.21.0-5538904.patch | 124 ++++++++++++++
curl.spec | 19 ++-
4 files changed, 528 insertions(+), 1 deletions(-)
---
diff --git a/0014-curl-7.21.0-a7864c4.patch b/0014-curl-7.21.0-a7864c4.patch
new file mode 100644
index 0000000..efae254
--- /dev/null
+++ b/0014-curl-7.21.0-a7864c4.patch
@@ -0,0 +1,356 @@
+From 0b164a2c002452d6660d0f745d60686f77060c2d Mon Sep 17 00:00:00 2001
+From: Kamil Dudka <kdudka at redhat.com>
+Date: Wed, 3 Aug 2011 12:48:49 +0200
+Subject: [PATCH] curl - rhbz #719939
+
+---
+ docs/libcurl/curl_easy_setopt.3 | 8 ++++++
+ docs/libcurl/symbols-in-versions | 4 +++
+ include/curl/curl.h | 7 +++++
+ lib/Makefile.in | 7 +++++
+ lib/Makefile.inc | 4 +-
+ lib/curl_gssapi.c | 45 +++++++++++++++++++++++++++++++++++++
+ lib/curl_gssapi.h | 46 ++++++++++++++++++++++++++++++++++++++
+ lib/http_negotiate.c | 6 ++++-
+ lib/krb5.c | 6 ++++-
+ lib/socks_gssapi.c | 7 ++++-
+ lib/url.c | 6 +++++
+ lib/urldata.h | 3 ++
+ 12 files changed, 143 insertions(+), 6 deletions(-)
+ create mode 100644 lib/curl_gssapi.c
+ create mode 100644 lib/curl_gssapi.h
+
+diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3
+index a26898f..3c20d29 100644
+--- a/docs/libcurl/curl_easy_setopt.3
++++ b/docs/libcurl/curl_easy_setopt.3
+@@ -1972,6 +1972,14 @@ of these, 'private' will be used. Set the string to NULL to disable kerberos
+ support for FTP.
+
+ (This option was known as CURLOPT_KRB4LEVEL up to 7.16.3)
++.IP CURLOPT_GSSAPI_DELEGATION
++Set the parameter to CURLGSSAPI_DELEGATION_FLAG to allow unconditional GSSAPI
++credential delegation. The delegation is disabled by default since 7.21.7.
++Set the parameter to CURLGSSAPI_DELEGATION_POLICY_FLAG to delegate only if
++the OK-AS-DELEGATE flag is set in the service ticket in case this feature is
++supported by the GSSAPI implementation and the definition of
++GSS_C_DELEG_POLICY_FLAG was available at compile-time.
++(Added in 7.21.8)
+ .SH SSH OPTIONS
+ .IP CURLOPT_SSH_AUTH_TYPES
+ Pass a long set to a bitmask consisting of one or more of
+diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
+index a02ead4..75c709d 100644
+--- a/docs/libcurl/symbols-in-versions
++++ b/docs/libcurl/symbols-in-versions
+@@ -131,6 +131,9 @@ CURLFTPSSL_TRY 7.11.0 7.17.0
+ CURLFTP_CREATE_DIR 7.19.4
+ CURLFTP_CREATE_DIR_NONE 7.19.4
+ CURLFTP_CREATE_DIR_RETRY 7.19.4
++CURLGSSAPI_DELEGATION_FLAG 7.21.8
++CURLGSSAPI_DELEGATION_NONE 7.21.8
++CURLGSSAPI_DELEGATION_POLICY_FLAG 7.21.8
+ CURLINFO_APPCONNECT_TIME 7.19.0
+ CURLINFO_CERTINFO 7.19.1
+ CURLINFO_CONDITION_UNMET 7.19.4
+@@ -244,6 +247,7 @@ CURLOPT_FTP_SSL_CCC 7.16.1
+ CURLOPT_FTP_USE_EPRT 7.10.5
+ CURLOPT_FTP_USE_EPSV 7.9.2
+ CURLOPT_FTP_USE_PRET 7.20.0
++CURLOPT_GSSAPI_DELEGATION 7.21.8
+ CURLOPT_HEADER 7.1
+ CURLOPT_HEADERDATA 7.10
+ CURLOPT_HEADERFUNCTION 7.7.2
+diff --git a/include/curl/curl.h b/include/curl/curl.h
+index b19828f..0a0c0b3 100644
+--- a/include/curl/curl.h
++++ b/include/curl/curl.h
+@@ -596,6 +596,10 @@ typedef enum {
+ #define CURLSSH_AUTH_KEYBOARD (1<<3) /* keyboard interactive */
+ #define CURLSSH_AUTH_DEFAULT CURLSSH_AUTH_ANY
+
++#define CURLGSSAPI_DELEGATION_NONE 0 /* no delegation (default) */
++#define CURLGSSAPI_DELEGATION_POLICY_FLAG (1<<0) /* if permitted by policy */
++#define CURLGSSAPI_DELEGATION_FLAG (1<<1) /* delegate always */
++
+ #define CURL_ERROR_SIZE 256
+
+ struct curl_khkey {
+@@ -1435,6 +1439,9 @@ typedef enum {
+ /* FNMATCH_FUNCTION user pointer */
+ CINIT(FNMATCH_DATA, OBJECTPOINT, 202),
+
++ /* allow GSSAPI credential delegation */
++ CINIT(GSSAPI_DELEGATION, LONG, 210),
++
+ CURLOPT_LASTENTRY /* the last unused */
+ } CURLoption;
+
+diff --git a/lib/Makefile.in b/lib/Makefile.in
+index e7d451a..a27a417 100644
+--- a/lib/Makefile.in
++++ b/lib/Makefile.in
+@@ -612,6 +612,13 @@ distclean-compile:
+ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+ @am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
+
++libcurlu_la-curl_gssapi.lo: curl_gssapi.c
++ at am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libcurlu_la-curl_gssapi.lo -MD -MP -MF $(DEPDIR)/libcurlu_la-curl_gssapi.Tpo -c -o libcurlu_la-curl_gssapi.lo `test -f 'curl_gssapi.c' || echo '$(srcdir)/'`curl_gssapi.c
++ at am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/libcurlu_la-curl_gssapi.Tpo $(DEPDIR)/libcurlu_la-curl_gssapi.Plo
++ at AMDEP_TRUE@@am__fastdepCC_FALSE@ source='curl_gssapi.c' object='libcurlu_la-curl_gssapi.lo' libtool=yes @AMDEPBACKSLASH@
++ at AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
++ at am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libcurlu_la-curl_gssapi.lo `test -f 'curl_gssapi.c' || echo '$(srcdir)/'`curl_gssapi.c
++
+ mostlyclean-libtool:
+ -rm -f *.lo
+
+diff --git a/lib/Makefile.inc b/lib/Makefile.inc
+index a502e8f..d9360a3 100644
+--- a/lib/Makefile.inc
++++ b/lib/Makefile.inc
+@@ -13,7 +13,7 @@ CSOURCES = file.c timeval.c base64.c hostip.c progress.c formdata.c \
+ strdup.c socks.c ssh.c nss.c qssl.c rawstr.c curl_addrinfo.c \
+ socks_gssapi.c socks_sspi.c curl_sspi.c slist.c nonblock.c \
+ curl_memrchr.c imap.c pop3.c smtp.c pingpong.c rtsp.c curl_threads.c \
+- warnless.c hmac.c polarssl.c curl_rtmp.c openldap.c
++ warnless.c hmac.c polarssl.c curl_rtmp.c openldap.c curl_gssapi.c
+
+ HHEADERS = arpa_telnet.h netrc.h file.h timeval.h qssl.h hostip.h \
+ progress.h formdata.h cookie.h http.h sendf.h ftp.h url.h dict.h \
+@@ -27,4 +27,4 @@ HHEADERS = arpa_telnet.h netrc.h file.h timeval.h qssl.h hostip.h \
+ tftp.h sockaddr.h splay.h strdup.h setup_once.h socks.h ssh.h nssg.h \
+ curl_base64.h rawstr.h curl_addrinfo.h curl_sspi.h slist.h nonblock.h \
+ curl_memrchr.h imap.h pop3.h smtp.h pingpong.h rtsp.h curl_threads.h \
+- warnless.h curl_hmac.h polarssl.h curl_rtmp.h
++ warnless.h curl_hmac.h polarssl.h curl_rtmp.h curl_gssapi.h
+diff --git a/lib/curl_gssapi.c b/lib/curl_gssapi.c
+new file mode 100644
+index 0000000..914d1a0
+--- /dev/null
++++ b/lib/curl_gssapi.c
+@@ -0,0 +1,45 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) 2011, Daniel Stenberg, <daniel at haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at http://curl.haxx.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ ***************************************************************************/
++
++#include "setup.h"
++
++#ifdef HAVE_GSSAPI
++
++#include "curl_gssapi.h"
++#include "sendf.h"
++
++void Curl_gss_req_flags(OM_uint32 *req_flags, struct SessionHandle *data)
++{
++ if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_POLICY_FLAG) {
++#ifdef GSS_C_DELEG_POLICY_FLAG
++ *req_flags |= GSS_C_DELEG_POLICY_FLAG;
++#else
++ infof(data, "warning: support for CURLGSSAPI_DELEGATION_POLICY_FLAG not "
++ "compiled in\n");
++#endif
++ }
++
++ if(data->set.gssapi_delegation & CURLGSSAPI_DELEGATION_FLAG)
++ *req_flags |= GSS_C_DELEG_FLAG;
++}
++
++#endif /* HAVE_GSSAPI */
+diff --git a/lib/curl_gssapi.h b/lib/curl_gssapi.h
+new file mode 100644
+index 0000000..c8ffefc
+--- /dev/null
++++ b/lib/curl_gssapi.h
+@@ -0,0 +1,46 @@
++#ifndef HEADER_CURL_GSSAPI_H
++#define HEADER_CURL_GSSAPI_H
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) 2011, Daniel Stenberg, <daniel at haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at http://curl.haxx.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ ***************************************************************************/
++
++#include "setup.h"
++#include "urldata.h"
++
++#ifdef HAVE_GSSAPI
++
++#ifdef HAVE_GSSGNU
++# include <gss.h>
++#elif defined HAVE_GSSMIT
++ /* MIT style */
++# include <gssapi/gssapi.h>
++# include <gssapi/gssapi_generic.h>
++# include <gssapi/gssapi_krb5.h>
++#else
++ /* Heimdal-style */
++# include <gssapi.h>
++#endif
++
++void Curl_gss_req_flags(OM_uint32 *req_flags, struct SessionHandle *data);
++
++#endif /* HAVE_GSSAPI */
++
++#endif /* HEADER_CURL_GSSAPI_H */
+diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c
+index 4b2b254..c33669c 100644
+--- a/lib/http_negotiate.c
++++ b/lib/http_negotiate.c
+@@ -40,6 +40,7 @@
+ #include "curl_base64.h"
+ #include "http_negotiate.h"
+ #include "curl_memory.h"
++#include "curl_gssapi.h"
+
+ #ifdef HAVE_SPNEGO
+ # include <spnegohelp.h>
+@@ -143,6 +144,9 @@ int Curl_input_negotiate(struct connectdata *conn, bool proxy,
+ bool gss;
+ const char* protocol;
+
++ OM_uint32 req_flags = 0;
++ Curl_gss_req_flags(&req_flags, conn->data);
++
+ while(*header && ISSPACE(*header))
+ header++;
+ if(checkprefix("GSS-Negotiate", header)) {
+@@ -242,7 +246,7 @@ int Curl_input_negotiate(struct connectdata *conn, bool proxy,
+ &neg_ctx->context,
+ neg_ctx->server_name,
+ GSS_C_NO_OID,
+- 0,
++ req_flags,
+ 0,
+ GSS_C_NO_CHANNEL_BINDINGS,
+ &input_token,
+diff --git a/lib/krb5.c b/lib/krb5.c
+index 9fb44f2..7e234d1 100644
+--- a/lib/krb5.c
++++ b/lib/krb5.c
+@@ -65,6 +65,7 @@
+ #include "sendf.h"
+ #include "krb4.h"
+ #include "curl_memory.h"
++#include "curl_gssapi.h"
+
+ #define _MPRINTF_REPLACE /* use our functions only */
+ #include <curl/mprintf.h>
+@@ -175,6 +176,9 @@ krb5_auth(void *app_data, struct connectdata *conn)
+ gss_ctx_id_t *context = app_data;
+ struct gss_channel_bindings_struct chan;
+
++ OM_uint32 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
++ Curl_gss_req_flags(&req_flags, data);
++
+ if(getsockname(conn->sock[FIRSTSOCKET],
+ (struct sockaddr *)LOCAL_ADDR, &l) < 0)
+ perror("getsockname()");
+@@ -233,7 +237,7 @@ krb5_auth(void *app_data, struct connectdata *conn)
+ context,
+ gssname,
+ GSS_C_NO_OID,
+- GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG,
++ req_flags,
+ 0,
+ &chan,
+ gssresp,
+diff --git a/lib/socks_gssapi.c b/lib/socks_gssapi.c
+index 1ff6f60..bc7ed85 100644
+--- a/lib/socks_gssapi.c
++++ b/lib/socks_gssapi.c
+@@ -42,6 +42,7 @@
+ #include "connect.h"
+ #include "timeval.h"
+ #include "socks.h"
++#include "curl_gssapi.h"
+
+ static gss_ctx_id_t gss_context = GSS_C_NO_CONTEXT;
+
+@@ -138,6 +139,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
+ unsigned char socksreq[4]; /* room for gssapi exchange header only */
+ char *serviceptr = data->set.str[STRING_SOCKS5_GSSAPI_SERVICE];
+
++ OM_uint32 req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG;
++ Curl_gss_req_flags(&req_flags, data);
++
+ /* get timeout */
+ timeout = Curl_timeleft(conn, NULL, TRUE);
+
+@@ -188,8 +192,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(int sockindex,
+ GSS_C_NO_CREDENTIAL,
+ &gss_context, server,
+ GSS_C_NULL_OID,
+- GSS_C_MUTUAL_FLAG |
+- GSS_C_REPLAY_FLAG,
++ req_flags,
+ 0,
+ NULL,
+ gss_token,
+diff --git a/lib/url.c b/lib/url.c
+index 432dac8..ad343ef 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -1987,6 +1987,12 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
+ va_arg(param, char *));
+ data->set.krb = (bool)(NULL != data->set.str[STRING_KRB_LEVEL]);
+ break;
++ case CURLOPT_GSSAPI_DELEGATION:
++ /*
++ * GSSAPI credential delegation
++ */
++ data->set.gssapi_delegation = va_arg(param, long);
++ break;
+ case CURLOPT_SSL_VERIFYPEER:
+ /*
+ * Enable peer SSL verifying.
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 7763278..a7df1f2 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1431,6 +1431,9 @@ struct UserDefined {
+ curl_fnmatch_callback fnmatch; /* callback to decide which file corresponds
+ to pattern (e.g. if WILDCARDMATCH is on) */
+ void *fnmatch_data;
++
++ long gssapi_delegation; /* GSSAPI credential delegation, see the
++ documentation of CURLOPT_GSSAPI_DELEGATION */
+ };
+
+ struct Names {
+--
+1.7.4.4
+
diff --git a/0015-curl-7.21.0-5eb2396.patch b/0015-curl-7.21.0-5eb2396.patch
new file mode 100644
index 0000000..520563a
--- /dev/null
+++ b/0015-curl-7.21.0-5eb2396.patch
@@ -0,0 +1,30 @@
+From 88a0c822714edbf2dc252cb21cdc8eae0ddd8ea8 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel at haxx.se>
+Date: Thu, 4 Aug 2011 23:22:48 +0200
+Subject: [PATCH] segfault fixed
+
+When using both -J and a single -O with multiple URLs, a missing init
+could cause badness.
+
+Bug: http://curl.haxx.se/mail/lib-2011-07/0126.html and
+ http://bugzilla.redhat.com/723075
+Reported by: Paul Howarth and Garrett Holmstrom
+---
+ src/main.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/src/main.c b/src/main.c
+index 5b78860..2b7cc83 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -4690,6 +4690,7 @@ operate(struct Configurable *config, int argc, argv_item_t argv[])
+ outs.stream = stdout;
+ outs.config = config;
+ outs.bytes = 0; /* nothing written yet */
++ outs.filename = NULL;
+
+ /* save outfile pattern before expansion */
+ if (urlnode->outfile) {
+--
+1.7.4.4
+
diff --git a/0016-curl-7.21.0-5538904.patch b/0016-curl-7.21.0-5538904.patch
new file mode 100644
index 0000000..5c6c94b
--- /dev/null
+++ b/0016-curl-7.21.0-5538904.patch
@@ -0,0 +1,124 @@
+From bceb10aa2ad5709b63dd79c2db32359d6a7efacb Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel at haxx.se>
+Date: Fri, 12 Aug 2011 14:48:32 +0200
+Subject: [PATCH 1/2] added --delegation
+
+Using this option with an argument being set to one of
+none/policy/always instructs libcurl how to deal with GSS
+credentials. Or rather how it tells the server that delegation is fine
+or not.
+
+Signed-off-by: Kamil Dudka <kdudka at redhat.com>
+---
+ src/main.c | 23 +++++++++++++++++++++++
+ 1 files changed, 23 insertions(+), 0 deletions(-)
+
+diff --git a/src/main.c b/src/main.c
+index 2b7cc83..5302b31 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -621,6 +621,7 @@ struct Configurable {
+ int default_node_flags; /* default flags to seach for each 'node', which is
+ basically each given URL to transfer */
+ struct OutStruct *outs;
++ long gssapi_delegation;
+ };
+
+ #define WARN_PREFIX "Warning: "
+@@ -778,6 +779,7 @@ static void help(void)
+ " --data-ascii <data> HTTP POST ASCII data (H)",
+ " --data-binary <data> HTTP POST binary data (H)",
+ " --data-urlencode <name=data/name at filename> HTTP POST data url encoded (H)",
++ " --delegation STRING GSS-API delegation permission",
+ " --digest Use HTTP Digest Authentication (H)",
+ " --disable-eprt Inhibit using EPRT or LPRT (F)",
+ " --disable-epsv Inhibit using EPSV (F)",
+@@ -1746,6 +1748,18 @@ static int sockoptcallback(void *clientp, curl_socket_t curlfd,
+ return 0;
+ }
+
++static long delegation(struct Configurable *config,
++ char *str)
++{
++ if(curlx_raw_equal("none", str))
++ return CURLGSSAPI_DELEGATION_NONE;
++ if(curlx_raw_equal("policy", str))
++ return CURLGSSAPI_DELEGATION_POLICY_FLAG;
++ if(curlx_raw_equal("always", str))
++ return CURLGSSAPI_DELEGATION_FLAG;
++ warnf(config, "unrecognized delegation method '%s', using none\n", str);
++ return CURLGSSAPI_DELEGATION_NONE;
++}
+
+ static ParameterError getparameter(char *flag, /* f or -long-flag */
+ char *nextarg, /* NULL if unset */
+@@ -1863,6 +1877,7 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */
+ {"$C", "ftp-pret", FALSE},
+ {"$D", "proto", TRUE},
+ {"$E", "proto-redir", TRUE},
++ {"$G", "delegation", TRUE},
+ {"0", "http1.0", FALSE},
+ {"1", "tlsv1", FALSE},
+ {"2", "sslv2", FALSE},
+@@ -2415,6 +2430,9 @@ static ParameterError getparameter(char *flag, /* f or -long-flag */
+ if(proto2num(config, &config->proto_redir, nextarg))
+ return PARAM_BAD_USE;
+ break;
++ case 'G': /* --delegation LEVEL */
++ config->gssapi_delegation = delegation(config, nextarg);
++ break;
+ }
+ break;
+ case '#': /* --progress-bar */
+@@ -5351,6 +5369,11 @@ operate(struct Configurable *config, int argc, argv_item_t argv[])
+ my_setopt(curl, CURLOPT_HEADERDATA, &outs);
+ }
+
++ /* new in 7.22.0 */
++ if(config->gssapi_delegation)
++ my_setopt_str(curl, CURLOPT_GSSAPI_DELEGATION,
++ config->gssapi_delegation);
++
+ retry_numretries = config->req_retry;
+
+ retrystart = cutil_tvnow();
+--
+1.7.4.4
+
+
+From 92ed91e886437f0aea8e6866180f1f788ba270f0 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel at haxx.se>
+Date: Fri, 12 Aug 2011 23:51:41 +0200
+Subject: [PATCH 2/2] docs: --delegation
+
+Signed-off-by: Kamil Dudka <kdudka at redhat.com>
+---
+ docs/curl.1 | 12 ++++++++++++
+ 1 files changed, 12 insertions(+), 0 deletions(-)
+
+diff --git a/docs/curl.1 b/docs/curl.1
+index aec3e48..3515d38 100644
+--- a/docs/curl.1
++++ b/docs/curl.1
+@@ -283,6 +283,18 @@ URL-encode that data and pass it on in the POST. The name part gets an equal
+ sign appended, resulting in \fIname=urlencoded-file-content\fP. Note that the
+ name is expected to be URL-encoded already.
+ .RE
++.IP "--delegation LEVEL"
++Set \fILEVEL\fP to tell the server what it is allowed to delegate when it
++comes to user credentials. Used with GSS/kerberos.
++.RS
++.IP "none"
++Don't allow any delegation.
++.IP "policy"
++Delegates if and only if the OK-AS-DELEGATE flag is set in the Kerberos
++service ticket, which is a matter of realm policy.
++.IP "always"
++Unconditionally allow the server to delegate.
++.RE
+ .IP "--digest"
+ (HTTP) Enables HTTP Digest authentication. This is a authentication that
+ prevents the password from being sent over the wire in clear text. Use this in
+--
+1.7.4.4
+
diff --git a/curl.spec b/curl.spec
index 282fc8d..3175036 100644
--- a/curl.spec
+++ b/curl.spec
@@ -1,7 +1,7 @@
Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
Name: curl
Version: 7.21.0
-Release: 8%{?dist}
+Release: 9%{?dist}
License: MIT
Group: Applications/Internet
Source: http://curl.haxx.se/download/%{name}-%{version}.tar.lzma
@@ -48,6 +48,15 @@ Patch12: 0012-curl-7.21.0-c59dba3.patch
# CVE-2011-2192
Patch13: 0013-curl-7.21.0-5c314c6.patch
+# add a new option CURLOPT_GSSAPI_DELEGATION (#719939)
+Patch14: 0014-curl-7.21.0-a7864c4.patch
+
+# fix SIGSEGV of curl -O -J given more than one URLs (#723075)
+Patch15: 0015-curl-7.21.0-5eb2396.patch
+
+# introduce the --delegation option of curl (#730444)
+Patch16: 0016-curl-7.21.0-5538904.patch
+
# patch making libcurl multilib ready
Patch101: 0101-curl-7.20.0-multilib.patch
@@ -153,6 +162,9 @@ done
%patch11 -p1
%patch12 -p1
%patch13 -p1
+%patch14 -p1
+%patch15 -p1
+%patch16 -p1
# Fedora patches
%patch101 -p1
@@ -268,6 +280,11 @@ rm -rf $RPM_BUILD_ROOT
%{_datadir}/aclocal/libcurl.m4
%changelog
+* Tue Aug 16 2011 Kamil Dudka <kdudka at redhat.com> 7.21.0-9
+- add a new option CURLOPT_GSSAPI_DELEGATION (#719939)
+- fix SIGSEGV of curl -O -J given more than one URLs (#723075)
+- introduce the --delegation option of curl (#730444)
+
* Thu Jun 23 2011 Kamil Dudka <kdudka at redhat.com> 7.21.0-8
- do not delegate GSSAPI credentials (CVE-2011-2192)
More information about the scm-commits
mailing list